This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Nextcloud - NextNote |
||
4 | * |
||
5 | * |
||
6 | * @copyright Copyright (c) 2017, Sander Brand ([email protected]) |
||
7 | * @license GNU AGPL version 3 or any later version |
||
8 | * |
||
9 | * This program is free software: you can redistribute it and/or modify |
||
10 | * it under the terms of the GNU Affero General Public License as |
||
11 | * published by the Free Software Foundation, either version 3 of the |
||
12 | * License, or (at your option) any later version. |
||
13 | * |
||
14 | * This program is distributed in the hope that it will be useful, |
||
15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
17 | * GNU Affero General Public License for more details. |
||
18 | * |
||
19 | * You should have received a copy of the GNU Affero General Public License |
||
20 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
||
21 | * |
||
22 | */ |
||
23 | |||
24 | namespace OCA\NextNote\Controller; |
||
25 | |||
26 | use OCA\NextNote\Db\Notebook; |
||
27 | use OCA\NextNote\Db\Note; |
||
28 | use OCA\NextNote\Service\NotebookService; |
||
29 | use OCA\NextNote\Service\NoteService; |
||
30 | use OCA\NextNote\Utility\NotFoundJSONResponse; |
||
31 | use OCA\NextNote\Utility\Utils; |
||
32 | use \OCP\AppFramework\ApiController; |
||
33 | use OCP\AppFramework\Http\JSONResponse; |
||
34 | use OCP\Constants; |
||
35 | use OCP\IConfig; |
||
36 | use OCP\ILogger; |
||
37 | use \OCP\IRequest; |
||
38 | use OCP\IUserManager; |
||
39 | |||
40 | |||
41 | |||
42 | class NoteApiController extends ApiController { |
||
43 | |||
44 | private $config; |
||
45 | private $noteService; |
||
46 | private $userManager; |
||
47 | private $notebookService; |
||
48 | |||
49 | View Code Duplication | public function __construct($appName, IRequest $request, |
|
50 | ILogger $logger, IConfig $config, NoteService $noteService, NotebookService $groupService,IUserManager $userManager) { |
||
51 | parent::__construct($appName, $request); |
||
52 | $this->config = $config; |
||
53 | $this->noteService = $noteService; |
||
54 | $this->notebookService = $groupService; |
||
55 | $this->userManager = $userManager; |
||
56 | } |
||
57 | |||
58 | /** |
||
59 | * @NoAdminRequired |
||
60 | * @NoCSRFRequired |
||
61 | * @TODO Add etag / lastmodified |
||
62 | * @param int|bool $deleted |
||
63 | * @param string|bool $notebook_id |
||
64 | * @return JSONResponse |
||
65 | */ |
||
66 | public function index($deleted = false, $notebook_id = false) { |
||
67 | $uid = \OC::$server->getUserSession()->getUser()->getUID(); |
||
68 | |||
69 | if(!empty($notebook_id)){ |
||
70 | $notebook_id = $this->notebookService->find($notebook_id)->getId(); |
||
0 ignored issues
–
show
|
|||
71 | } |
||
72 | $result = $this->noteService->findNotesFromUser($uid, $deleted, $notebook_id); |
||
73 | foreach ($result as &$note) { |
||
74 | if (is_array($note)) { |
||
75 | $note = $this->noteService->find($note['id']); |
||
76 | } |
||
77 | $note = $note->jsonSerialize(); |
||
78 | $note = $this->formatApiResponse($note); |
||
79 | |||
80 | } |
||
81 | |||
82 | $results = $result; |
||
83 | if($results instanceof Note){ |
||
84 | $results = []; |
||
85 | /** |
||
86 | * @var $result Note |
||
87 | */ |
||
88 | $results[$result->getId()] = $result; |
||
89 | } |
||
90 | return new JSONResponse($results); |
||
91 | } |
||
92 | |||
93 | /** |
||
94 | * @NoAdminRequired |
||
95 | * @NoCSRFRequired |
||
96 | * @TODO Add etag / lastmodified |
||
97 | */ |
||
98 | public function get($id) { |
||
99 | $result = $this->noteService->find($id); |
||
100 | if (!$result) { |
||
101 | return new NotFoundJSONResponse(); |
||
102 | } |
||
103 | //@todo Check access |
||
104 | $result = $result->jsonSerialize(); |
||
105 | return new JSONResponse($this->formatApiResponse($result)); |
||
106 | } |
||
107 | |||
108 | |||
109 | /** |
||
110 | * @NoAdminRequired |
||
111 | * @NoCSRFRequired |
||
112 | */ |
||
113 | public function create($title, $notebook_id, $content) { |
||
114 | if ($title == "" || !$title) { |
||
115 | return new JSONResponse(['error' => 'title is missing']); |
||
116 | } |
||
117 | |||
118 | $uid = \OC::$server->getUserSession()->getUser()->getUID(); |
||
119 | $note = new Note(); |
||
120 | $note->setName($title); |
||
121 | $note->setUid($uid); |
||
122 | $note->setGuid(Utils::GUID()); |
||
123 | $note->setNote($content); |
||
124 | $note->setMtime(time()); |
||
125 | $note->setDeleted(0); |
||
126 | |||
127 | View Code Duplication | if(!empty($notebook_id)){ |
|
128 | $notebook = $this->notebookService->find($notebook_id); |
||
129 | if($notebook instanceof Notebook) { |
||
130 | $note->setNotebook($notebook->getId()); |
||
131 | } else { |
||
132 | return new JSONResponse(['error' => 'Notebook not found']); |
||
133 | } |
||
134 | } |
||
135 | |||
136 | $result = $this->noteService->create($note)->jsonSerialize(); |
||
137 | \OC_Hook::emit('OCA\NextNote', 'post_create_note', ['note' => $note]); |
||
138 | return new JSONResponse($this->formatApiResponse($result)); |
||
139 | } |
||
140 | |||
141 | /** |
||
142 | * @NoAdminRequired |
||
143 | * @NoCSRFRequired |
||
144 | */ |
||
145 | public function update($id, $title, $content, $deleted, $notebook_id) { |
||
146 | if ($title == "" || !$title) { |
||
147 | return new JSONResponse(['error' => 'title is missing']); |
||
148 | } |
||
149 | |||
150 | $note = $this->noteService->find($id); |
||
151 | if (!$note) { |
||
152 | return new NotFoundJSONResponse(); |
||
153 | } |
||
154 | |||
155 | if(!$note->getGuid()){ |
||
156 | $note->setGuid(Utils::GUID()); |
||
157 | } |
||
158 | |||
159 | |||
160 | View Code Duplication | if(!empty($notebook_id)){ |
|
161 | $notebook = $this->notebookService->find($notebook_id); |
||
162 | if($notebook instanceof Notebook) { |
||
163 | $note->setNotebook($notebook->getId()); |
||
164 | } else { |
||
165 | return new JSONResponse(['error' => 'Notebook not found']); |
||
166 | } |
||
167 | } |
||
168 | $note->setName($title); |
||
169 | $note->setNote($content); |
||
170 | $note->setDeleted($deleted); |
||
171 | |||
172 | $results = $this->noteService->update($note)->jsonSerialize(); |
||
173 | \OC_Hook::emit('OCA\NextNote', 'post_update_note', ['note' => $note]); |
||
174 | return new JSONResponse($this->formatApiResponse($results)); |
||
175 | } |
||
176 | |||
177 | /** |
||
178 | * @NoAdminRequired |
||
179 | * @NoCSRFRequired |
||
180 | */ |
||
181 | View Code Duplication | public function delete($id) { |
|
182 | $entity = $this->noteService->find($id); |
||
183 | if (!$entity) { |
||
184 | return new NotFoundJSONResponse(); |
||
185 | } |
||
186 | |||
187 | $this->noteService->delete($id); |
||
188 | $result = (object)['success' => true]; |
||
189 | \OC_Hook::emit('OCA\NextNote', 'post_delete_note', ['note_id' => $id]); |
||
190 | return new JSONResponse($result); |
||
191 | } |
||
192 | |||
193 | /** |
||
194 | * @param $note array |
||
195 | * @return array |
||
196 | */ |
||
197 | private function formatApiResponse($note) { |
||
198 | $uid = \OC::$server->getUserSession()->getUser()->getUID(); |
||
199 | $acl = [ |
||
200 | 'permissions' => Constants::PERMISSION_ALL |
||
201 | ]; |
||
202 | |||
203 | $note['owner'] = Utils::getUserInfo($note['uid']); |
||
204 | $note['permissions'] = $acl['permissions']; |
||
205 | |||
206 | $shared_with = []; |
||
207 | |||
208 | $note['shared_with'] = ($note['uid'] == $uid) ? $shared_with : [$uid]; |
||
209 | unset($note['uid']); |
||
210 | return $note; |
||
211 | } |
||
212 | } |
||
213 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: