Issues (55)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

app/Http/routes.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/*
4
 * This file is part of the HRis Software package.
5
 *
6
 * NOTICE OF LICENSE
7
 *
8
 * Licensed under the 3-clause BSD License.
9
 *
10
 * This source file is subject to the 3-clause BSD License that is
11
 * bundled with this package in the LICENSE file.
12
 *
13
 * @version    alpha
14
 *
15
 * @author     Bertrand Kintanar <[email protected]>
16
 * @license    BSD License (3-clause)
17
 * @copyright  (c) 2014-2016, b8 Studios, Ltd
18
 *
19
 * @link       http://github.com/HB-Co/HRis
20
 */
21
22
use Dingo\Api\Routing\Router;
23
use Illuminate\Database\Eloquent\ModelNotFoundException;
24
25 204
$api = app(Router::class);
26 204
$response = app(Dingo\Api\Http\Response\Factory::class);
27
28
app(Dingo\Api\Exception\Handler::class)->register(function (ModelNotFoundException $e) use ($response) {
0 ignored issues
show
The parameter $e is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
29
    $response_array = [
30 28
        'message'     => '422 Unprocessable Entity',
31 28
        'status_code' => 422,
32 28
    ];
33
34 28
    return $response->withArray($response_array)->statusCode($response_array['status_code']);
35 204
});
36
37
// Version 1 of our API
38
$api->version('v1', function (Router $api) {
39
40
    // Set our namespace for the underlying routes
41 204
    $api->group([
42 204
        'namespace'  => 'HRis\Api\Controllers',
43
        'middleware' => [
44 204
            'cors',
45 204
            'api.throttle',
46 204
        ],
47 204
        'limit'      => 200,
48 204
        'expires'    => 5,
49
    ], function (Router $api) {
50 204
        $api->post('oauth/access-token', 'Auth\OAuth\Controller@accessToken');
51
52
        // Login route
53 204
        $api->post('login', 'Auth\AuthController@authenticate');                                                      // docs done
54 204
        $api->post('register', 'Auth\AuthController@register');
55
56 204
        $api->get('auth/refresh', 'Auth\AuthController@token');
57
58
        // All routes in here are protected and thus need a valid token
59
        $api->group(['protected' => true, 'middleware' => 'api.auth'], function (Router $api) {
60
61
            // Authentication
62 204
            $api->get('logout', 'Auth\AuthController@logout');                                                        // docs done
63 204
            $api->get('users/me', 'Auth\AuthController@me');
64 204
            $api->post('sidebar', 'Auth\AuthController@sidebar');
65
66
            // Employee
67 204
            $api->get('employee/{employee}', 'EmployeeController@show');
68
69
            // Profile
70
            $api->group(['prefix' => 'profile', 'namespace' => 'Profile'], function (Router $api) {
71 204
                $api->patch('personal-details', 'PersonalDetailsController@update');                                  // docs done
72
73 204
                $api->patch('contact-details', 'PersonalDetailsController@update');                                   // docs done
74
75 204
                $api->post('emergency-contacts', 'EmergencyContactsController@store');                                // docs done
76 204
                $api->patch('emergency-contacts', 'EmergencyContactsController@update');                              // docs done
77 204
                $api->delete('emergency-contacts/{emergency_contact}', 'EmergencyContactsController@destroy');        // docs done
78
79 204
                $api->post('dependents', 'DependentsController@store');                                               // docs done
80 204
                $api->patch('dependents', 'DependentsController@update');                                             // docs done
81 204
                $api->delete('dependents/{dependent}', 'DependentsController@destroy');                               // docs done
82
83 204
                $api->post('reports-to', 'ReportsToController@store');                                                // docs done
84 204
                $api->patch('reports-to', 'ReportsToController@update');                                              // docs done
85 204
                $api->delete('reports-to/{employee_supervisor}', 'ReportsToController@destroy');                      // docs done
86
87 204
                $api->patch('job', 'JobController@update');
88 204
                $api->delete('job/{job_history}', 'JobController@destroy');
89
90
                $api->group(['prefix' => 'qualifications'], function (Router $api) {
91 204
                    $api->post('work-experiences', 'QualificationsController@storeWorkExperience');
92 204
                    $api->delete('work-experiences/{work_experience}', 'QualificationsController@destroyWorkExperience');
93 204
                    $api->patch('work-experiences', 'QualificationsController@updateWorkExperience');
94 204
                    $api->post('educations', 'QualificationsController@storeEducation');
95 204
                    $api->delete('educations/{education}', 'QualificationsController@destroyEducation');
96 204
                    $api->patch('educations', 'QualificationsController@updateEducation');
97 204
                    $api->post('skills', 'QualificationsController@storeSkill');
98 204
                    $api->delete('skills/{employee_skill}', 'QualificationsController@destroySkill');
99 204
                    $api->patch('skills', 'QualificationsController@updateSkill');
100 204
                });
101
102 204
                $api->patch('custom-fields', 'CustomFieldsController@update');
103 204
            });
104
105
            // PIM
106
            $api->group(['prefix' => 'pim', 'namespace' => 'PIM'], function (Router $api) {
107 204
                $api->get('employee-list', 'EmployeeListController@index');
108
109
                // Configuration
110
                $api->group(['prefix' => 'configuration', 'namespace' => 'Configuration'], function (Router $api) {
111 204
                    $api->get('termination-reasons', 'TerminationReasonsController@index');                           // docs done
112 204
                    $api->get('termination-reasons/{termination_reason}', 'TerminationReasonsController@show');       // docs done
113 204
                    $api->post('termination-reasons', 'TerminationReasonsController@store');                          // docs done
114 204
                    $api->patch('termination-reasons', 'TerminationReasonsController@update');                        // docs done
115 204
                    $api->delete('termination-reasons/{termination_reason}', 'TerminationReasonsController@destroy'); // docs done
116
117 204
                    $api->get('custom-field-sections', 'CustomFieldsController@index');
118 204
                    $api->post('custom-field-sections', 'CustomFieldsController@store');
119 204
                    $api->patch('custom-field-sections', 'CustomFieldsController@update');
120 204
                    $api->delete('custom-field-sections/{custom_field_section}', 'CustomFieldsController@destroy');
121 204
                    $api->post('custom-field-sections-by-screen-id', 'CustomFieldsController@getCustomFieldSectionsByScreenId');
122
123 204
                    $api->get('custom-fields', 'CustomFieldsController@show');
124 204
                    $api->post('custom-fields', 'CustomFieldsController@storeCustomField');
125 204
                    $api->patch('custom-fields', 'CustomFieldsController@updateCustomField');
126 204
                    $api->delete('custom-fields/{custom_field}', 'CustomFieldsController@destroyCustomField');
127 204
                });
128 204
            });
129
130
            // Admin
131
            $api->group(['prefix' => 'admin', 'namespace' => 'Admin'], function (Router $api) {
132
133
                // Job
134
                $api->group(['prefix' => 'job', 'namespace' => 'Job'], function (Router $api) {
135 204
                    $api->get('titles', 'JobTitlesController@index');                                                 // docs done
136 204
                    $api->get('titles/{job_title}', 'JobTitlesController@show');                                      // docs done
137 204
                    $api->post('titles', 'JobTitlesController@store');                                                // docs done
138 204
                    $api->patch('titles', 'JobTitlesController@update');                                              // docs done
139 204
                    $api->delete('titles/{job_title}', 'JobTitlesController@destroy');                                // docs done
140
141 204
                    $api->get('employment-status', 'EmploymentStatusController@index');                               // docs done
142 204
                    $api->get('employment-status/{employment_status}', 'EmploymentStatusController@show');            // docs done
143 204
                    $api->post('employment-status', 'EmploymentStatusController@store');                              // docs done
144 204
                    $api->patch('employment-status', 'EmploymentStatusController@update');                            // docs done
145 204
                    $api->delete('employment-status/{employment_status}', 'EmploymentStatusController@destroy');      // docs done
146
147 204
                    $api->get('pay-grades', 'PayGradesController@index');                                             // docs done
148 204
                    $api->get('pay-grades/{pay_grade}', 'PayGradesController@show');                                  // docs done
149 204
                    $api->post('pay-grades', 'PayGradesController@store');                                            // docs done
150 204
                    $api->patch('pay-grades', 'PayGradesController@update');                                          // docs done
151 204
                    $api->delete('pay-grades/{pay_grade}', 'PayGradesController@destroy');                            // docs done
152 204
                });
153
154
                // Qualification
155
                $api->group(['prefix' => 'qualifications', 'namespace' => 'Qualifications'], function (Router $api) {
156 204
                    $api->get('educations', 'EducationsController@index');                                            // docs done
157 204
                    $api->get('educations/{education_level}', 'EducationsController@show');                           // docs done
158 204
                    $api->post('educations', 'EducationsController@store');                                           // docs done
159 204
                    $api->patch('educations', 'EducationsController@update');                                         // docs done
160 204
                    $api->delete('educations/{education_level}', 'EducationsController@destroy');                     // docs done
161 204
                });
162 204
            });
163
164
            // Presence
165
            $api->group(['prefix' => 'presence', 'namespace' => 'Presence'], function (Router $api) {
166 204
                $api->get('timelogs', 'TimelogController@index');
167 204
                $api->get('alert/time-in', 'TimelogController@attemptTimeIn');
168 204
                $api->get('alert/time-out', 'TimelogController@attemptTimeOut');
169 204
                $api->post('time-in', 'TimelogController@timeIn');
170 204
                $api->post('time-out', 'TimelogController@timeOut');
171 204
                $api->get('server-time', 'TimelogController@serverTime');
172 204
            });
173
174
            // Chosen
175 204
            $api->get('cities', 'LookupTableController@cities');                                                      // docs done
176 204
            $api->get('countries', 'LookupTableController@countries');                                                // docs done
177 204
            $api->get('departments', 'LookupTableController@departments');                                            // docs done
178 204
            $api->get('education-levels', 'LookupTableController@educationLevels');                                   // docs done
179 204
            $api->get('employment-statuses', 'LookupTableController@employmentStatuses');                             // docs done
180 204
            $api->get('job-titles', 'LookupTableController@jobTitles');                                               // docs done
181 204
            $api->get('locations', 'LookupTableController@locations');                                                // docs done
182 204
            $api->get('marital-statuses', 'LookupTableController@maritalStatuses');                                   // docs done
183 204
            $api->get('screens', 'LookupTableController@screens');                                                    // docs done
184 204
            $api->get('types', 'LookupTableController@types');                                                        // docs done
185 204
            $api->get('nationalities', 'LookupTableController@nationalities');                                        // docs done
186 204
            $api->get('provinces', 'LookupTableController@provinces');                                                // docs done
187 204
            $api->get('relationships', 'LookupTableController@relationships');                                        // docs done
188 204
            $api->get('skills', 'LookupTableController@skills');                                                      // docs done
189 204
        });
190
191 204
        $api->get('playground', 'PlaygroundController@index');
192 204
    });
193
});
194