This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||
2 | /** |
||||
3 | * |
||||
4 | * @package sitemaker |
||||
5 | * @copyright (c) 2016 Daniel A. (blitze) |
||||
6 | * @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2 |
||||
7 | * |
||||
8 | */ |
||||
9 | |||||
10 | namespace blitze\content\services; |
||||
11 | |||||
12 | class fields extends topic |
||||
13 | { |
||||
14 | /** @var \blitze\content\services\comments\factory */ |
||||
15 | protected $comments_factory; |
||||
16 | |||||
17 | /** @var \blitze\content\services\form\fields_factory */ |
||||
18 | protected $fields_factory; |
||||
19 | |||||
20 | /** @var string */ |
||||
21 | protected $content_type; |
||||
22 | |||||
23 | /** @var \blitze\content\services\comments\comments_inferface */ |
||||
0 ignored issues
–
show
|
|||||
24 | protected $comments; |
||||
25 | |||||
26 | /** @var string */ |
||||
27 | protected $board_url = ''; |
||||
28 | |||||
29 | /** @var string */ |
||||
30 | protected $tpl_name = ''; |
||||
31 | |||||
32 | /** @var string */ |
||||
33 | protected $display_mode = 'detail'; |
||||
34 | |||||
35 | /** @var string */ |
||||
36 | protected $view_mode = 'detail'; |
||||
37 | |||||
38 | /** @var array */ |
||||
39 | protected $content_fields = array(); |
||||
40 | |||||
41 | /** @var array */ |
||||
42 | protected $db_fields = array(); |
||||
43 | |||||
44 | /** @var array */ |
||||
45 | protected $form_fields = array(); |
||||
46 | |||||
47 | /** @var array */ |
||||
48 | protected $label = array('', 'label-hidden', 'label-inline', 'label-newline'); |
||||
49 | |||||
50 | /** |
||||
51 | * Construct |
||||
52 | * |
||||
53 | * @param \phpbb\config\db $config Config object |
||||
54 | * @param \phpbb\controller\helper $controller_helper Controller Helper object |
||||
55 | * @param \phpbb\event\dispatcher_interface $phpbb_dispatcher Event dispatcher object |
||||
56 | * @param \phpbb\language\language $language Language object |
||||
57 | * @param \phpbb\template\template $template Template object |
||||
58 | * @param \phpbb\user $user User object |
||||
59 | * @param \blitze\content\services\helper $helper Content helper object |
||||
60 | * @param \blitze\content\services\comments\factory $comments_factory Comments Factory |
||||
61 | * @param \blitze\content\services\form\fields_factory $fields_factory Form fields factory |
||||
62 | */ |
||||
63 | public function __construct(\phpbb\config\db $config, \phpbb\controller\helper $controller_helper, \phpbb\event\dispatcher_interface $phpbb_dispatcher, \phpbb\language\language $language, \phpbb\template\template $template, \phpbb\user $user, \blitze\content\services\helper $helper, \blitze\content\services\comments\factory $comments_factory, \blitze\content\services\form\fields_factory $fields_factory) |
||||
64 | { |
||||
65 | parent::__construct($config, $controller_helper, $phpbb_dispatcher, $language, $template, $user, $helper); |
||||
66 | |||||
67 | $this->comments_factory = $comments_factory; |
||||
68 | $this->fields_factory = $fields_factory; |
||||
69 | } |
||||
70 | |||||
71 | /** |
||||
72 | * Set type data needed to display topics. This should only run once |
||||
73 | * |
||||
74 | * @param \blitze\content\model\entity\type $entity |
||||
75 | * @param array $topic_ids |
||||
76 | * @param array $view_mode_fields array of form array([field_name] => [field_type]) |
||||
77 | * @param string $custom_tpl |
||||
78 | * @param string $view_mode summary|detail|block |
||||
79 | * @param string $tpl_name |
||||
80 | * @return void |
||||
81 | */ |
||||
82 | public function prepare_to_show(\blitze\content\model\entity\type $entity, array $topic_ids, array $view_mode_fields, $custom_tpl, $view_mode, $tpl_name = null) |
||||
83 | { |
||||
84 | $this->reset(); |
||||
85 | $db_fields = array_fill_keys($topic_ids, array()); |
||||
86 | |||||
87 | /** |
||||
88 | * Event to set the values for fields that are stored in the database as opposed to post text e.g. categories |
||||
89 | * We do this here so that we can get all values with one query instead of multiple queries for each field for each topic |
||||
90 | * |
||||
91 | * @event blitze.content.fields.set_values |
||||
92 | * @var string view_mode The current view mode (summary|detail|block) |
||||
93 | * @var array view_mode_fields Array containing fields for current view_mode |
||||
94 | * @var \blitze\content\model\entity\type entity Content type entity |
||||
95 | * @var array db_fields This array allows extensions that provide fields to list field values for current topic ids. |
||||
96 | * Ex. array([topic_id] => array([field_name] => [field_value])) |
||||
97 | */ |
||||
98 | $vars = array('view_mode', 'view_mode_fields', 'entity', 'db_fields'); |
||||
99 | extract($this->phpbb_dispatcher->trigger_event('blitze.content.fields.set_values', compact($vars))); |
||||
100 | |||||
101 | $this->content_type = $entity->get_content_name(); |
||||
102 | $this->set_view_mode($view_mode); |
||||
103 | $this->set_form_fields($view_mode_fields); |
||||
104 | $this->set_content_fields($view_mode_fields, $entity->get_content_fields()); |
||||
105 | $this->set_comments_type($entity->get_comments()); |
||||
106 | |||||
107 | $this->board_url = generate_board_url(true); |
||||
108 | $this->tpl_name = ($custom_tpl) ? ($tpl_name ?: $this->content_type . '_' . $view_mode) : ''; |
||||
109 | $this->db_fields = $db_fields; |
||||
110 | } |
||||
111 | |||||
112 | /** |
||||
113 | * @param string $type |
||||
114 | * @param array $topic_data |
||||
115 | * @param array $post_data |
||||
116 | * @param array $users_cache |
||||
117 | * @param array $attachments |
||||
118 | * @param array $update_count |
||||
119 | * @param array $topic_tracking_info |
||||
120 | * @param array $topic_data_overwrite |
||||
121 | * @param string $redirect_url |
||||
122 | * @return array |
||||
123 | */ |
||||
124 | public function show($type, array &$topic_data, array $post_data, array $users_cache, array &$attachments, array &$update_count, array $topic_tracking_info, array $topic_data_overwrite = array(), $redirect_url = '') |
||||
125 | { |
||||
126 | $callable = 'get_' . $this->view_mode . '_template_data'; |
||||
127 | $tpl_data = array_merge(array( |
||||
128 | 'TOPIC_COMMENTS' => !empty($this->comments) ? $this->comments->count($topic_data) : 0, |
||||
129 | 'S_USER_LOGGED_IN' => $this->user->data['is_registered'], |
||||
130 | ), |
||||
131 | $this->{$callable}($type, $topic_data, $post_data, $users_cache, $attachments, $topic_tracking_info, $update_count, $redirect_url), |
||||
132 | $topic_data_overwrite |
||||
133 | ); |
||||
134 | |||||
135 | return $this->build_content($tpl_data); |
||||
136 | } |
||||
137 | |||||
138 | /** |
||||
139 | * @param array $tpl_data |
||||
140 | * @return array |
||||
141 | */ |
||||
142 | public function build_content(array $tpl_data) |
||||
143 | { |
||||
144 | $fields_data = $this->get_fields_data_for_display($tpl_data); |
||||
145 | |||||
146 | $tpl_data['FIELDS'] = $fields_data; |
||||
147 | |||||
148 | if ($this->tpl_name) |
||||
149 | { |
||||
150 | $this->template->assign_vars(array_change_key_case(array_merge($tpl_data, (array) $fields_data['all']), CASE_UPPER)); |
||||
151 | $this->template->set_filenames(array('content' => $this->tpl_name)); |
||||
152 | $tpl_data['CUSTOM_DISPLAY'] = $this->template->assign_display('content'); |
||||
153 | } |
||||
154 | unset($fields_data); |
||||
155 | |||||
156 | return $tpl_data; |
||||
157 | } |
||||
158 | |||||
159 | /** |
||||
160 | * @param string $type |
||||
161 | * @return $this |
||||
162 | */ |
||||
163 | public function set_content_type($type) |
||||
164 | { |
||||
165 | $this->content_type = $type; |
||||
166 | return $this; |
||||
167 | } |
||||
168 | |||||
169 | /** |
||||
170 | * @param string $view_mode summary|detail|print|block|preview |
||||
171 | * @return $this |
||||
172 | */ |
||||
173 | public function set_view_mode($view_mode) |
||||
174 | { |
||||
175 | $this->display_mode = $view_mode; |
||||
176 | $this->view_mode = (in_array($view_mode, array('summary', 'detail'))) ? $view_mode : 'summary'; |
||||
177 | return $this; |
||||
178 | } |
||||
179 | |||||
180 | /** |
||||
181 | * @param string $service |
||||
182 | * @return $this |
||||
183 | */ |
||||
184 | public function set_comments_type($service) |
||||
185 | { |
||||
186 | $this->comments = $this->comments_factory->get($service); |
||||
0 ignored issues
–
show
It seems like
$this->comments_factory->get($service) can also be of type blitze\content\services\...ents\comments_interface . However, the property $comments is declared as type blitze\content\services\...ents\comments_inferface . Maybe add an additional type check?
Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly. For example, imagine you have a variable Either this assignment is in error or a type check should be added for that assignment. class Id
{
public $id;
public function __construct($id)
{
$this->id = $id;
}
}
class Account
{
/** @var Id $id */
public $id;
}
$account_id = false;
if (starsAreRight()) {
$account_id = new Id(42);
}
$account = new Account();
if ($account instanceof Id)
{
$account->id = $account_id;
}
![]() |
|||||
187 | return $this; |
||||
188 | } |
||||
189 | |||||
190 | /** |
||||
191 | * @param array $view_mode_fields array of form array([field_name] => [field_type]) |
||||
192 | * @param array $fields_data |
||||
193 | * @return $this |
||||
194 | */ |
||||
195 | public function set_content_fields(array $view_mode_fields, array $fields_data) |
||||
196 | { |
||||
197 | foreach ($view_mode_fields as $name => $field_type) |
||||
198 | { |
||||
199 | if (isset($this->form_fields[$field_type])) |
||||
200 | { |
||||
201 | $this->content_fields[$name] = $fields_data[$name]; |
||||
202 | } |
||||
203 | } |
||||
204 | return $this; |
||||
205 | } |
||||
206 | |||||
207 | /** |
||||
208 | * @param string $field |
||||
209 | * @param array $prop |
||||
210 | * @return $this |
||||
211 | */ |
||||
212 | public function overwrite_field_data($field, array $data) |
||||
213 | { |
||||
214 | if (isset($this->content_fields[$field])) |
||||
215 | { |
||||
216 | $this->content_fields[$field] = array_replace_recursive($this->content_fields[$field], $data); |
||||
217 | } |
||||
218 | return $this; |
||||
219 | } |
||||
220 | |||||
221 | /** |
||||
222 | * @param array $view_mode_fields array of form array([field_name] => [field_type]) |
||||
223 | * @return $this |
||||
224 | */ |
||||
225 | public function set_form_fields(array $view_mode_fields) |
||||
226 | { |
||||
227 | $this->form_fields = array_intersect_key($this->fields_factory->get_all(), array_flip($view_mode_fields)); |
||||
228 | return $this; |
||||
229 | } |
||||
230 | |||||
231 | /** |
||||
232 | * @param array $tpl_data |
||||
233 | * @return array |
||||
234 | */ |
||||
235 | protected function get_fields_data_for_display(array &$tpl_data) |
||||
236 | { |
||||
237 | $field_values = $this->get_field_values($tpl_data); |
||||
238 | $display_data = array_fill_keys(array('all', 'above', 'body', 'inline', 'footer', 'raw'), array()); |
||||
239 | $tpl_data['PERMA_LINK'] = $this->board_url . parse_url($tpl_data['TOPIC_URL'], PHP_URL_PATH); |
||||
240 | |||||
241 | foreach ($this->content_fields as $field_name => $field_data) |
||||
242 | { |
||||
243 | $field_type = $field_data['field_type']; |
||||
244 | $field_data['content_type'] = $this->content_type; |
||||
245 | $field_data['field_props'] = array_replace_recursive($this->form_fields[$field_type]->get_default_props(), $field_data['field_props']); |
||||
246 | $field_data['field_value'] = &$field_values[$field_name]; |
||||
247 | $field_data['field_value'] = $this->form_fields[$field_type]->get_field_value($field_data); |
||||
248 | |||||
249 | $field_contents = $this->form_fields[$field_type]->display_field($field_data, $tpl_data, $this->display_mode); |
||||
250 | $display_data['raw'][$field_name] = $field_data['field_value']; |
||||
251 | |||||
252 | // this essentially hides other fields if the field returns an array |
||||
253 | if (is_array($field_contents)) |
||||
254 | { |
||||
255 | $display_data['all'] = $field_contents; |
||||
256 | $display_data[$field_data['field_' . $this->view_mode . '_show']] = $field_contents; |
||||
257 | break; |
||||
258 | } |
||||
259 | |||||
260 | if (!empty($field_contents)) |
||||
261 | { |
||||
262 | $field = $this->get_field_label($field_data['field_' . $this->view_mode . '_ldisp'], $field_data['field_label']) . $field_contents; |
||||
263 | $display_data['all'][$field_name] = $field; |
||||
264 | $display_data[$field_data['field_' . $this->view_mode . '_show']][$field_name] = $field; |
||||
265 | } |
||||
266 | } |
||||
267 | |||||
268 | return $display_data; |
||||
269 | } |
||||
270 | |||||
271 | /** |
||||
272 | * @param int $label_type |
||||
273 | * @param string $label_text |
||||
274 | * @return string |
||||
275 | */ |
||||
276 | protected function get_field_label($label_type, $label_text) |
||||
277 | { |
||||
278 | $html = ''; |
||||
279 | if ($label_type) |
||||
280 | { |
||||
281 | $html = '<div class="field-label ' . $this->label[$label_type] . '">' . $label_text . $this->language->lang('COLON') . ' </div>'; |
||||
282 | } |
||||
283 | return $html; |
||||
284 | } |
||||
285 | |||||
286 | /** |
||||
287 | * @param array $tpl_data |
||||
288 | * @return array |
||||
289 | */ |
||||
290 | protected function get_field_values(array &$tpl_data) |
||||
291 | { |
||||
292 | $message = $tpl_data['MESSAGE']; |
||||
293 | unset($tpl_data['MESSAGE']); |
||||
294 | |||||
295 | return array_merge( |
||||
296 | isset($this->db_fields[$tpl_data['TOPIC_ID']]) ? $this->db_fields[$tpl_data['TOPIC_ID']] : array(), |
||||
297 | $this->get_fields_data_from_post($message) |
||||
298 | ); |
||||
299 | } |
||||
300 | |||||
301 | /** |
||||
302 | * @param string $post_text |
||||
303 | * @return array |
||||
304 | */ |
||||
305 | protected function get_fields_data_from_post($post_text) |
||||
306 | { |
||||
307 | $fields_data = array(); |
||||
308 | $find_fields = join('|', array_keys($this->content_fields)); |
||||
309 | if (preg_match_all("#<div data-field=\"($find_fields)\">(.*?)</div><br><!-- end field -->#s", $post_text, $matches)) |
||||
310 | { |
||||
311 | $fields_data = array_combine($matches[1], $matches[2]); |
||||
312 | } |
||||
313 | |||||
314 | return array_intersect_key($fields_data, $this->content_fields); |
||||
0 ignored issues
–
show
It seems like
$fields_data can also be of type false ; however, parameter $array1 of array_intersect_key() does only seem to accept array , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
315 | } |
||||
316 | |||||
317 | /** |
||||
318 | * @return void |
||||
319 | */ |
||||
320 | protected function reset() |
||||
321 | { |
||||
322 | $this->content_fields = array(); |
||||
323 | $this->form_fields = array(); |
||||
324 | $this->tpl_name = ''; |
||||
325 | $this->view_mode = ''; |
||||
326 | } |
||||
327 | } |
||||
328 |
The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g.
excluded_paths: ["lib/*"]
, you can move it to the dependency path list as follows:For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths