This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||
| 2 | /** |
||||
| 3 | * |
||||
| 4 | * @package sitemaker |
||||
| 5 | * @copyright (c) 2016 Daniel A. (blitze) |
||||
| 6 | * @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2 |
||||
| 7 | * |
||||
| 8 | */ |
||||
| 9 | |||||
| 10 | namespace blitze\content\services; |
||||
| 11 | |||||
| 12 | class fields extends topic |
||||
| 13 | { |
||||
| 14 | /** @var \blitze\content\services\comments\factory */ |
||||
| 15 | protected $comments_factory; |
||||
| 16 | |||||
| 17 | /** @var \blitze\content\services\form\fields_factory */ |
||||
| 18 | protected $fields_factory; |
||||
| 19 | |||||
| 20 | /** @var string */ |
||||
| 21 | protected $content_type; |
||||
| 22 | |||||
| 23 | /** @var \blitze\content\services\comments\comments_inferface */ |
||||
|
0 ignored issues
–
show
|
|||||
| 24 | protected $comments; |
||||
| 25 | |||||
| 26 | /** @var string */ |
||||
| 27 | protected $board_url = ''; |
||||
| 28 | |||||
| 29 | /** @var string */ |
||||
| 30 | protected $tpl_name = ''; |
||||
| 31 | |||||
| 32 | /** @var string */ |
||||
| 33 | protected $display_mode = 'detail'; |
||||
| 34 | |||||
| 35 | /** @var string */ |
||||
| 36 | protected $view_mode = 'detail'; |
||||
| 37 | |||||
| 38 | /** @var array */ |
||||
| 39 | protected $content_fields = array(); |
||||
| 40 | |||||
| 41 | /** @var array */ |
||||
| 42 | protected $db_fields = array(); |
||||
| 43 | |||||
| 44 | /** @var array */ |
||||
| 45 | protected $form_fields = array(); |
||||
| 46 | |||||
| 47 | /** @var array */ |
||||
| 48 | protected $label = array('', 'label-hidden', 'label-inline', 'label-newline'); |
||||
| 49 | |||||
| 50 | /** |
||||
| 51 | * Construct |
||||
| 52 | * |
||||
| 53 | * @param \phpbb\config\db $config Config object |
||||
| 54 | * @param \phpbb\controller\helper $controller_helper Controller Helper object |
||||
| 55 | * @param \phpbb\event\dispatcher_interface $phpbb_dispatcher Event dispatcher object |
||||
| 56 | * @param \phpbb\language\language $language Language object |
||||
| 57 | * @param \phpbb\template\template $template Template object |
||||
| 58 | * @param \phpbb\user $user User object |
||||
| 59 | * @param \blitze\content\services\helper $helper Content helper object |
||||
| 60 | * @param \blitze\content\services\comments\factory $comments_factory Comments Factory |
||||
| 61 | * @param \blitze\content\services\form\fields_factory $fields_factory Form fields factory |
||||
| 62 | */ |
||||
| 63 | public function __construct(\phpbb\config\db $config, \phpbb\controller\helper $controller_helper, \phpbb\event\dispatcher_interface $phpbb_dispatcher, \phpbb\language\language $language, \phpbb\template\template $template, \phpbb\user $user, \blitze\content\services\helper $helper, \blitze\content\services\comments\factory $comments_factory, \blitze\content\services\form\fields_factory $fields_factory) |
||||
| 64 | { |
||||
| 65 | parent::__construct($config, $controller_helper, $phpbb_dispatcher, $language, $template, $user, $helper); |
||||
| 66 | |||||
| 67 | $this->comments_factory = $comments_factory; |
||||
| 68 | $this->fields_factory = $fields_factory; |
||||
| 69 | } |
||||
| 70 | |||||
| 71 | /** |
||||
| 72 | * Set type data needed to display topics. This should only run once |
||||
| 73 | * |
||||
| 74 | * @param \blitze\content\model\entity\type $entity |
||||
| 75 | * @param array $topic_ids |
||||
| 76 | * @param array $view_mode_fields array of form array([field_name] => [field_type]) |
||||
| 77 | * @param string $custom_tpl |
||||
| 78 | * @param string $view_mode summary|detail|block |
||||
| 79 | * @param string $tpl_name |
||||
| 80 | * @return void |
||||
| 81 | */ |
||||
| 82 | public function prepare_to_show(\blitze\content\model\entity\type $entity, array $topic_ids, array $view_mode_fields, $custom_tpl, $view_mode, $tpl_name = null) |
||||
| 83 | { |
||||
| 84 | $this->reset(); |
||||
| 85 | $db_fields = array_fill_keys($topic_ids, array()); |
||||
| 86 | |||||
| 87 | /** |
||||
| 88 | * Event to set the values for fields that are stored in the database as opposed to post text e.g. categories |
||||
| 89 | * We do this here so that we can get all values with one query instead of multiple queries for each field for each topic |
||||
| 90 | * |
||||
| 91 | * @event blitze.content.fields.set_values |
||||
| 92 | * @var string view_mode The current view mode (summary|detail|block) |
||||
| 93 | * @var array view_mode_fields Array containing fields for current view_mode |
||||
| 94 | * @var \blitze\content\model\entity\type entity Content type entity |
||||
| 95 | * @var array db_fields This array allows extensions that provide fields to list field values for current topic ids. |
||||
| 96 | * Ex. array([topic_id] => array([field_name] => [field_value])) |
||||
| 97 | */ |
||||
| 98 | $vars = array('view_mode', 'view_mode_fields', 'entity', 'db_fields'); |
||||
| 99 | extract($this->phpbb_dispatcher->trigger_event('blitze.content.fields.set_values', compact($vars))); |
||||
| 100 | |||||
| 101 | $this->content_type = $entity->get_content_name(); |
||||
| 102 | $this->set_view_mode($view_mode); |
||||
| 103 | $this->set_form_fields($view_mode_fields); |
||||
| 104 | $this->set_content_fields($view_mode_fields, $entity->get_content_fields()); |
||||
| 105 | $this->set_comments_type($entity->get_comments()); |
||||
| 106 | |||||
| 107 | $this->board_url = generate_board_url(true); |
||||
| 108 | $this->tpl_name = ($custom_tpl) ? ($tpl_name ?: $this->content_type . '_' . $view_mode) : ''; |
||||
| 109 | $this->db_fields = $db_fields; |
||||
| 110 | } |
||||
| 111 | |||||
| 112 | /** |
||||
| 113 | * @param string $type |
||||
| 114 | * @param array $topic_data |
||||
| 115 | * @param array $post_data |
||||
| 116 | * @param array $users_cache |
||||
| 117 | * @param array $attachments |
||||
| 118 | * @param array $update_count |
||||
| 119 | * @param array $topic_tracking_info |
||||
| 120 | * @param array $topic_data_overwrite |
||||
| 121 | * @param string $redirect_url |
||||
| 122 | * @return array |
||||
| 123 | */ |
||||
| 124 | public function show($type, array &$topic_data, array $post_data, array $users_cache, array &$attachments, array &$update_count, array $topic_tracking_info, array $topic_data_overwrite = array(), $redirect_url = '') |
||||
| 125 | { |
||||
| 126 | $callable = 'get_' . $this->view_mode . '_template_data'; |
||||
| 127 | $tpl_data = array_merge(array( |
||||
| 128 | 'TOPIC_COMMENTS' => !empty($this->comments) ? $this->comments->count($topic_data) : 0, |
||||
| 129 | 'S_USER_LOGGED_IN' => $this->user->data['is_registered'], |
||||
| 130 | ), |
||||
| 131 | $this->{$callable}($type, $topic_data, $post_data, $users_cache, $attachments, $topic_tracking_info, $update_count, $redirect_url), |
||||
| 132 | $topic_data_overwrite |
||||
| 133 | ); |
||||
| 134 | |||||
| 135 | return $this->build_content($tpl_data); |
||||
| 136 | } |
||||
| 137 | |||||
| 138 | /** |
||||
| 139 | * @param array $tpl_data |
||||
| 140 | * @return array |
||||
| 141 | */ |
||||
| 142 | public function build_content(array $tpl_data) |
||||
| 143 | { |
||||
| 144 | $fields_data = $this->get_fields_data_for_display($tpl_data); |
||||
| 145 | |||||
| 146 | $tpl_data['FIELDS'] = $fields_data; |
||||
| 147 | |||||
| 148 | if ($this->tpl_name) |
||||
| 149 | { |
||||
| 150 | $this->template->assign_vars(array_change_key_case(array_merge($tpl_data, (array) $fields_data['all']), CASE_UPPER)); |
||||
| 151 | $this->template->set_filenames(array('content' => $this->tpl_name)); |
||||
| 152 | $tpl_data['CUSTOM_DISPLAY'] = $this->template->assign_display('content'); |
||||
| 153 | } |
||||
| 154 | unset($fields_data); |
||||
| 155 | |||||
| 156 | return $tpl_data; |
||||
| 157 | } |
||||
| 158 | |||||
| 159 | /** |
||||
| 160 | * @param string $type |
||||
| 161 | * @return $this |
||||
| 162 | */ |
||||
| 163 | public function set_content_type($type) |
||||
| 164 | { |
||||
| 165 | $this->content_type = $type; |
||||
| 166 | return $this; |
||||
| 167 | } |
||||
| 168 | |||||
| 169 | /** |
||||
| 170 | * @param string $view_mode summary|detail|print|block|preview |
||||
| 171 | * @return $this |
||||
| 172 | */ |
||||
| 173 | public function set_view_mode($view_mode) |
||||
| 174 | { |
||||
| 175 | $this->display_mode = $view_mode; |
||||
| 176 | $this->view_mode = (in_array($view_mode, array('summary', 'detail'))) ? $view_mode : 'summary'; |
||||
| 177 | return $this; |
||||
| 178 | } |
||||
| 179 | |||||
| 180 | /** |
||||
| 181 | * @param string $service |
||||
| 182 | * @return $this |
||||
| 183 | */ |
||||
| 184 | public function set_comments_type($service) |
||||
| 185 | { |
||||
| 186 | $this->comments = $this->comments_factory->get($service); |
||||
|
0 ignored issues
–
show
It seems like
$this->comments_factory->get($service) can also be of type blitze\content\services\...ents\comments_interface. However, the property $comments is declared as type blitze\content\services\...ents\comments_inferface. Maybe add an additional type check?
Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly. For example, imagine you have a variable Either this assignment is in error or a type check should be added for that assignment. class Id
{
public $id;
public function __construct($id)
{
$this->id = $id;
}
}
class Account
{
/** @var Id $id */
public $id;
}
$account_id = false;
if (starsAreRight()) {
$account_id = new Id(42);
}
$account = new Account();
if ($account instanceof Id)
{
$account->id = $account_id;
}
Loading history...
|
|||||
| 187 | return $this; |
||||
| 188 | } |
||||
| 189 | |||||
| 190 | /** |
||||
| 191 | * @param array $view_mode_fields array of form array([field_name] => [field_type]) |
||||
| 192 | * @param array $fields_data |
||||
| 193 | * @return $this |
||||
| 194 | */ |
||||
| 195 | public function set_content_fields(array $view_mode_fields, array $fields_data) |
||||
| 196 | { |
||||
| 197 | foreach ($view_mode_fields as $name => $field_type) |
||||
| 198 | { |
||||
| 199 | if (isset($this->form_fields[$field_type])) |
||||
| 200 | { |
||||
| 201 | $this->content_fields[$name] = $fields_data[$name]; |
||||
| 202 | } |
||||
| 203 | } |
||||
| 204 | return $this; |
||||
| 205 | } |
||||
| 206 | |||||
| 207 | /** |
||||
| 208 | * @param string $field |
||||
| 209 | * @param array $prop |
||||
| 210 | * @return $this |
||||
| 211 | */ |
||||
| 212 | public function overwrite_field_data($field, array $data) |
||||
| 213 | { |
||||
| 214 | if (isset($this->content_fields[$field])) |
||||
| 215 | { |
||||
| 216 | $this->content_fields[$field] = array_replace_recursive($this->content_fields[$field], $data); |
||||
| 217 | } |
||||
| 218 | return $this; |
||||
| 219 | } |
||||
| 220 | |||||
| 221 | /** |
||||
| 222 | * @param array $view_mode_fields array of form array([field_name] => [field_type]) |
||||
| 223 | * @return $this |
||||
| 224 | */ |
||||
| 225 | public function set_form_fields(array $view_mode_fields) |
||||
| 226 | { |
||||
| 227 | $this->form_fields = array_intersect_key($this->fields_factory->get_all(), array_flip($view_mode_fields)); |
||||
| 228 | return $this; |
||||
| 229 | } |
||||
| 230 | |||||
| 231 | /** |
||||
| 232 | * @param array $tpl_data |
||||
| 233 | * @return array |
||||
| 234 | */ |
||||
| 235 | protected function get_fields_data_for_display(array &$tpl_data) |
||||
| 236 | { |
||||
| 237 | $field_values = $this->get_field_values($tpl_data); |
||||
| 238 | $display_data = array_fill_keys(array('all', 'above', 'body', 'inline', 'footer', 'raw'), array()); |
||||
| 239 | $tpl_data['PERMA_LINK'] = $this->board_url . parse_url($tpl_data['TOPIC_URL'], PHP_URL_PATH); |
||||
| 240 | |||||
| 241 | foreach ($this->content_fields as $field_name => $field_data) |
||||
| 242 | { |
||||
| 243 | $field_type = $field_data['field_type']; |
||||
| 244 | $field_data['content_type'] = $this->content_type; |
||||
| 245 | $field_data['field_props'] = array_replace_recursive($this->form_fields[$field_type]->get_default_props(), $field_data['field_props']); |
||||
| 246 | $field_data['field_value'] = &$field_values[$field_name]; |
||||
| 247 | $field_data['field_value'] = $this->form_fields[$field_type]->get_field_value($field_data); |
||||
| 248 | |||||
| 249 | $field_contents = $this->form_fields[$field_type]->display_field($field_data, $tpl_data, $this->display_mode); |
||||
| 250 | $display_data['raw'][$field_name] = $field_data['field_value']; |
||||
| 251 | |||||
| 252 | // this essentially hides other fields if the field returns an array |
||||
| 253 | if (is_array($field_contents)) |
||||
| 254 | { |
||||
| 255 | $display_data['all'] = $field_contents; |
||||
| 256 | $display_data[$field_data['field_' . $this->view_mode . '_show']] = $field_contents; |
||||
| 257 | break; |
||||
| 258 | } |
||||
| 259 | |||||
| 260 | if (!empty($field_contents)) |
||||
| 261 | { |
||||
| 262 | $field = $this->get_field_label($field_data['field_' . $this->view_mode . '_ldisp'], $field_data['field_label']) . $field_contents; |
||||
| 263 | $display_data['all'][$field_name] = $field; |
||||
| 264 | $display_data[$field_data['field_' . $this->view_mode . '_show']][$field_name] = $field; |
||||
| 265 | } |
||||
| 266 | } |
||||
| 267 | |||||
| 268 | return $display_data; |
||||
| 269 | } |
||||
| 270 | |||||
| 271 | /** |
||||
| 272 | * @param int $label_type |
||||
| 273 | * @param string $label_text |
||||
| 274 | * @return string |
||||
| 275 | */ |
||||
| 276 | protected function get_field_label($label_type, $label_text) |
||||
| 277 | { |
||||
| 278 | $html = ''; |
||||
| 279 | if ($label_type) |
||||
| 280 | { |
||||
| 281 | $html = '<div class="field-label ' . $this->label[$label_type] . '">' . $label_text . $this->language->lang('COLON') . ' </div>'; |
||||
| 282 | } |
||||
| 283 | return $html; |
||||
| 284 | } |
||||
| 285 | |||||
| 286 | /** |
||||
| 287 | * @param array $tpl_data |
||||
| 288 | * @return array |
||||
| 289 | */ |
||||
| 290 | protected function get_field_values(array &$tpl_data) |
||||
| 291 | { |
||||
| 292 | $message = $tpl_data['MESSAGE']; |
||||
| 293 | unset($tpl_data['MESSAGE']); |
||||
| 294 | |||||
| 295 | return array_merge( |
||||
| 296 | isset($this->db_fields[$tpl_data['TOPIC_ID']]) ? $this->db_fields[$tpl_data['TOPIC_ID']] : array(), |
||||
| 297 | $this->get_fields_data_from_post($message) |
||||
| 298 | ); |
||||
| 299 | } |
||||
| 300 | |||||
| 301 | /** |
||||
| 302 | * @param string $post_text |
||||
| 303 | * @return array |
||||
| 304 | */ |
||||
| 305 | protected function get_fields_data_from_post($post_text) |
||||
| 306 | { |
||||
| 307 | $fields_data = array(); |
||||
| 308 | $find_fields = join('|', array_keys($this->content_fields)); |
||||
| 309 | if (preg_match_all("#<div data-field=\"($find_fields)\">(.*?)</div><br><!-- end field -->#s", $post_text, $matches)) |
||||
| 310 | { |
||||
| 311 | $fields_data = array_combine($matches[1], $matches[2]); |
||||
| 312 | } |
||||
| 313 | |||||
| 314 | return array_intersect_key($fields_data, $this->content_fields); |
||||
|
0 ignored issues
–
show
It seems like
$fields_data can also be of type false; however, parameter $array1 of array_intersect_key() does only seem to accept array, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 315 | } |
||||
| 316 | |||||
| 317 | /** |
||||
| 318 | * @return void |
||||
| 319 | */ |
||||
| 320 | protected function reset() |
||||
| 321 | { |
||||
| 322 | $this->content_fields = array(); |
||||
| 323 | $this->form_fields = array(); |
||||
| 324 | $this->tpl_name = ''; |
||||
| 325 | $this->view_mode = ''; |
||||
| 326 | } |
||||
| 327 | } |
||||
| 328 |
The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g.
excluded_paths: ["lib/*"], you can move it to the dependency path list as follows:For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths