This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * This file contains functionality relating to the news articles admins can post |
||
4 | * |
||
5 | * @package BZiON\Models |
||
6 | * @license https://github.com/allejo/bzion/blob/master/LICENSE.md GNU General Public License Version 3 |
||
7 | */ |
||
8 | |||
9 | /** |
||
10 | * A news article |
||
11 | * @package BZiON\Models |
||
12 | */ |
||
13 | class News extends UrlModel implements NamedModel |
||
14 | { |
||
15 | /** |
||
16 | * The category of the article |
||
17 | * @var int |
||
18 | */ |
||
19 | protected $category; |
||
20 | |||
21 | /** |
||
22 | * The subject of the news article |
||
23 | * @var string |
||
24 | */ |
||
25 | protected $subject; |
||
26 | |||
27 | /** |
||
28 | * The content of the news article |
||
29 | * @var string |
||
30 | */ |
||
31 | protected $content; |
||
32 | |||
33 | /** |
||
34 | * The creation date of the news article |
||
35 | * @var TimeDate |
||
36 | */ |
||
37 | protected $created; |
||
38 | |||
39 | /** |
||
40 | * The date the news article was last updated |
||
41 | * @var TimeDate |
||
42 | */ |
||
43 | protected $updated; |
||
44 | |||
45 | /** |
||
46 | * The ID of the author of the news article |
||
47 | * @var int |
||
48 | */ |
||
49 | protected $author; |
||
50 | |||
51 | /** |
||
52 | * The ID of the last person to edit the news article |
||
53 | * @var int |
||
54 | */ |
||
55 | protected $editor; |
||
56 | |||
57 | const DEFAULT_STATUS = 'published'; |
||
58 | |||
59 | /** |
||
60 | * The name of the database table used for queries |
||
61 | */ |
||
62 | const TABLE = "news"; |
||
63 | |||
64 | const CREATE_PERMISSION = Permission::CREATE_NEWS; |
||
65 | const EDIT_PERMISSION = Permission::EDIT_NEWS; |
||
66 | const SOFT_DELETE_PERMISSION = Permission::SOFT_DELETE_NEWS; |
||
67 | const HARD_DELETE_PERMISSION = Permission::HARD_DELETE_NEWS; |
||
68 | |||
69 | /** |
||
70 | * {@inheritdoc} |
||
71 | */ |
||
72 | protected function assignResult($news) |
||
73 | { |
||
74 | $this->category = $news['category']; |
||
75 | $this->subject = $news['subject']; |
||
76 | 2 | $this->content = $news['content']; |
|
77 | $this->created = TimeDate::fromMysql($news['created']); |
||
78 | 2 | $this->updated = TimeDate::fromMysql($news['updated']); |
|
79 | 2 | $this->author = $news['author']; |
|
80 | 2 | $this->editor = $news['editor']; |
|
81 | 2 | $this->status = $news['status']; |
|
82 | 2 | } |
|
83 | 2 | ||
84 | 2 | /** |
|
85 | 2 | * Get the author of the news article |
|
86 | 2 | * @return Player The author of the post |
|
87 | */ |
||
88 | public function getAuthor() |
||
89 | { |
||
90 | return Player::get($this->author); |
||
91 | } |
||
92 | 1 | ||
93 | /** |
||
94 | 1 | * Get the user ID of the author who wrote this article |
|
95 | * @return int The author ID |
||
96 | */ |
||
97 | public function getAuthorID() |
||
98 | { |
||
99 | return $this->author; |
||
100 | } |
||
101 | |||
102 | /** |
||
103 | * Get the category of the news article |
||
104 | * @return NewsCategory The category of the post |
||
105 | */ |
||
106 | public function getCategory() |
||
107 | { |
||
108 | return NewsCategory::get($this->category); |
||
109 | } |
||
110 | |||
111 | /** |
||
112 | * Get the database ID from the category the article belongs into |
||
113 | * @return int The category ID |
||
114 | */ |
||
115 | public function getCategoryID() |
||
116 | { |
||
117 | return $this->category; |
||
118 | } |
||
119 | |||
120 | /** |
||
121 | * Get the content of the article |
||
122 | * @return string The raw content of the article |
||
123 | */ |
||
124 | public function getContent() |
||
125 | { |
||
126 | return $this->content; |
||
127 | } |
||
128 | |||
129 | /** |
||
130 | * Get the time when the article was submitted |
||
131 | * |
||
132 | * @return TimeDate The article's creation time |
||
133 | */ |
||
134 | public function getCreated() |
||
135 | { |
||
136 | return $this->created->copy(); |
||
137 | } |
||
138 | 1 | ||
139 | /** |
||
140 | 1 | * Get the time when the article was last updated |
|
141 | * |
||
142 | * @return TimeDate The article's last update time |
||
143 | */ |
||
144 | public function getLastEdit() |
||
145 | { |
||
146 | return $this->updated->copy(); |
||
147 | } |
||
148 | |||
149 | /** |
||
150 | * Get the last editor of the post |
||
151 | * @return Player A Player object of the last editor |
||
152 | */ |
||
153 | public function getLastEditor() |
||
154 | { |
||
155 | return Player::get($this->editor); |
||
156 | } |
||
157 | |||
158 | /** |
||
159 | * Get the ID of the person who last edited the article |
||
160 | * @return int The ID of the last editor |
||
161 | */ |
||
162 | public function getLastEditorID() |
||
163 | { |
||
164 | return $this->editor; |
||
165 | } |
||
166 | |||
167 | /** |
||
168 | * Get the subject of the news article |
||
169 | * @return string |
||
170 | */ |
||
171 | public function getSubject() |
||
172 | { |
||
173 | return $this->subject; |
||
174 | } |
||
175 | 1 | ||
176 | /** |
||
177 | 1 | * {@inheritdoc} |
|
178 | */ |
||
179 | public function getName() |
||
180 | { |
||
181 | return $this->getSubject(); |
||
182 | } |
||
183 | 1 | ||
184 | /** |
||
185 | 1 | * {@inheritdoc} |
|
186 | */ |
||
187 | public static function getParamName() |
||
188 | { |
||
189 | return "article"; |
||
190 | } |
||
191 | 1 | ||
192 | /** |
||
193 | 1 | * {@inheritdoc} |
|
194 | */ |
||
195 | public static function getRouteName($action = 'show') |
||
196 | { |
||
197 | return "news_$action"; |
||
198 | } |
||
199 | 1 | ||
200 | /** |
||
201 | 1 | * Update the content of a post |
|
202 | * |
||
203 | * @param string $content The new content of the post |
||
204 | * |
||
205 | * @return self |
||
206 | */ |
||
207 | public function updateContent($content) |
||
208 | { |
||
209 | return $this->updateProperty($this->content, 'content', $content); |
||
210 | } |
||
211 | |||
212 | /** |
||
213 | * Update the last edit timestamp |
||
214 | * @return self |
||
215 | */ |
||
216 | public function updateEditTimestamp() |
||
217 | { |
||
218 | return $this->updateProperty($this->updated, 'updated', TimeDate::now()); |
||
219 | } |
||
220 | |||
221 | /** |
||
222 | * Update the editor of the post |
||
223 | * |
||
224 | * @param int $editorID The ID of the editor |
||
225 | * @return self |
||
226 | */ |
||
227 | public function updateLastEditor($editorID) |
||
228 | { |
||
229 | return $this->updateProperty($this->editor, 'editor', $editorID); |
||
230 | } |
||
231 | |||
232 | /** |
||
233 | * Update the category of the post |
||
234 | * |
||
235 | * @param int $categoryID The ID of the category |
||
236 | * @return self |
||
237 | */ |
||
238 | public function updateCategory($categoryID) |
||
239 | { |
||
240 | return $this->updateProperty($this->category, 'category', $categoryID); |
||
241 | } |
||
242 | |||
243 | /** |
||
244 | * Update the status of a post |
||
245 | * |
||
246 | * @param string $status The new status of a post |
||
247 | * @return self |
||
248 | */ |
||
249 | public function updateStatus($status = 'published') |
||
250 | { |
||
251 | return $this->updateProperty($this->status, 'status', $status); |
||
252 | } |
||
253 | |||
254 | /** |
||
255 | * Update the subject of a post |
||
256 | * |
||
257 | * @param string $subject The new subject of a post |
||
258 | * @return self |
||
259 | */ |
||
260 | public function updateSubject($subject) |
||
261 | { |
||
262 | return $this->updateProperty($this->subject, 'subject', $subject); |
||
263 | } |
||
264 | |||
265 | /** |
||
266 | * {@inheritdoc} |
||
267 | */ |
||
268 | public static function getActiveStatuses() |
||
269 | { |
||
270 | return array('published', 'revision'); |
||
271 | } |
||
272 | 1 | ||
273 | /** |
||
274 | 1 | * Add a new news article |
|
275 | * |
||
276 | * @param string $subject The subject of the article |
||
277 | * @param string $content The content of the article |
||
278 | * @param int $authorID The ID of the author |
||
279 | * @param int $categoryId The ID of the category this article will be published under |
||
280 | * @param string $status The status of the article: 'published', 'disabled', or 'deleted' |
||
281 | * |
||
282 | * @return News An object representing the article that was just created or false if the article was not created |
||
283 | */ |
||
284 | View Code Duplication | public static function addNews($subject, $content, $authorID, $categoryId = 1, $status = 'published') |
|
285 | { |
||
286 | return self::create(array( |
||
287 | 'category' => $categoryId, |
||
288 | 2 | 'subject' => $subject, |
|
289 | 'content' => $content, |
||
290 | 2 | 'author' => $authorID, |
|
291 | 2 | 'editor' => $authorID, |
|
292 | 2 | 'status' => $status, |
|
293 | 2 | ), array('created', 'updated')); |
|
294 | 2 | } |
|
295 | 2 | ||
296 | 2 | /** |
|
297 | 2 | * Get all the news entries in the database that aren't disabled or deleted |
|
298 | * |
||
299 | * @param int $start The offset used when fetching matches, i.e. the starting point |
||
300 | * @param int $limit The amount of matches to be retrieved |
||
301 | * @param bool $getDrafts Whether or not to fetch drafts |
||
302 | * |
||
303 | * @return News[] An array of news objects |
||
304 | */ |
||
305 | public static function getNews($start = 0, $limit = 5, $getDrafts = false) |
||
306 | { |
||
307 | $ignoredStatuses[] = "deleted"; |
||
0 ignored issues
–
show
|
|||
308 | |||
309 | 1 | if (!$getDrafts) { |
|
310 | $ignoredStatuses[] = "draft"; |
||
311 | 1 | } |
|
312 | |||
313 | 1 | return self::arrayIdToModel( |
|
314 | 1 | self::fetchIdsFrom( |
|
315 | "status", $ignoredStatuses, true, |
||
316 | "ORDER BY created DESC LIMIT $limit OFFSET $start" |
||
317 | 1 | ) |
|
318 | 1 | ); |
|
319 | 1 | } |
|
320 | 1 | ||
321 | /** |
||
322 | * Get a query builder for news |
||
323 | * @return QueryBuilder |
||
324 | */ |
||
325 | public static function getQueryBuilder() |
||
326 | { |
||
327 | return new QueryBuilder('News', array( |
||
328 | 'columns' => array( |
||
329 | 'subject' => 'subject', |
||
330 | 'category' => 'category', |
||
331 | 'created' => 'created', |
||
332 | 'status' => 'status' |
||
333 | ), |
||
334 | 'name' => 'subject' |
||
335 | )); |
||
336 | } |
||
337 | } |
||
338 |
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code.
Let’s take a look at an example:
As you can see in this example, the array
$myArray
is initialized the first time when the foreach loop is entered. You can also see that the value of thebar
key is only written conditionally; thus, its value might result from a previous iteration.This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop.