This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php namespace Myth\Controllers; |
||
0 ignored issues
–
show
|
|||
2 | /** |
||
3 | * Sprint |
||
4 | * |
||
5 | * A set of power tools to enhance the CodeIgniter framework and provide consistent workflow. |
||
6 | * |
||
7 | * Permission is hereby granted, free of charge, to any person obtaining a copy |
||
8 | * of this software and associated documentation files (the "Software"), to deal |
||
9 | * in the Software without restriction, including without limitation the rights |
||
10 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
||
11 | * copies of the Software, and to permit persons to whom the Software is |
||
12 | * furnished to do so, subject to the following conditions: |
||
13 | * |
||
14 | * The above copyright notice and this permission notice shall be included in |
||
15 | * all copies or substantial portions of the Software. |
||
16 | * |
||
17 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
||
18 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
||
19 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
||
20 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
||
21 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
||
22 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN |
||
23 | * THE SOFTWARE. |
||
24 | * |
||
25 | * @package Sprint |
||
26 | * @author Lonnie Ezell |
||
27 | * @copyright Copyright 2014-2015, New Myth Media, LLC (http://newmythmedia.com) |
||
28 | * @license http://opensource.org/licenses/MIT (MIT) |
||
29 | * @link http://sprintphp.com |
||
30 | * @since Version 1.0 |
||
31 | */ |
||
32 | use Myth\Themers\MetaCollection; |
||
33 | use Zend\Escaper\Escaper; |
||
34 | |||
35 | require_once dirname(__FILE__) .'/../Themers/escape.php'; |
||
36 | |||
37 | /** |
||
38 | * Class ThemedController |
||
39 | * |
||
40 | * @package Myth\Controllers |
||
41 | */ |
||
42 | class ThemedController extends BaseController |
||
43 | { |
||
44 | /** |
||
45 | * Stores data variables to be sent to the view. |
||
46 | * @var array |
||
47 | */ |
||
48 | protected $vars = array(); |
||
49 | |||
50 | /** |
||
51 | * Stores current status message. |
||
52 | * @var |
||
53 | */ |
||
54 | protected $message; |
||
55 | |||
56 | /** |
||
57 | * The UIKit to make available to the template views. |
||
58 | * @var string |
||
59 | */ |
||
60 | protected $uikit = ''; |
||
61 | |||
62 | /** |
||
63 | * An instance of an active Themer to use. |
||
64 | * @var null |
||
65 | */ |
||
66 | protected $themer = null; |
||
67 | |||
68 | /** |
||
69 | * Allows per-controller override of theme. |
||
70 | * @var null |
||
71 | */ |
||
72 | protected $theme = null; |
||
73 | |||
74 | /** |
||
75 | * Per-controller override of the current layout file. |
||
76 | * @var null |
||
77 | */ |
||
78 | protected $layout = null; |
||
79 | |||
80 | /** |
||
81 | * Stores an array of javascript files. |
||
82 | * @var array |
||
83 | */ |
||
84 | protected $external_scripts = array(); |
||
85 | |||
86 | /** |
||
87 | * Stores an array of CSS stylesheets. |
||
88 | * @var array |
||
89 | */ |
||
90 | protected $stylesheets = array(); |
||
91 | |||
92 | /** |
||
93 | * A MenuCollection instance |
||
94 | * @var |
||
95 | */ |
||
96 | protected $meta; |
||
97 | |||
98 | /** |
||
99 | * Whether set() should escape the output... |
||
100 | * @var bool |
||
101 | */ |
||
102 | protected $auto_escape = null; |
||
103 | |||
104 | /** |
||
105 | * An instance of ZendFrameworks Escaper |
||
106 | * @var null |
||
107 | */ |
||
108 | protected $escaper = null; |
||
109 | |||
110 | //-------------------------------------------------------------------- |
||
111 | |||
112 | /** |
||
113 | * Constructor takes care of getting the template engine up and running |
||
114 | * and bound to our DI object, as well as any other preliminary needs, |
||
115 | * like detecting the variant to use, etc. |
||
116 | */ |
||
117 | public function __construct() |
||
118 | { |
||
119 | parent::__construct(); |
||
120 | |||
121 | // Setup our Template Engine |
||
122 | $themer = config_item('active_themer'); |
||
123 | |||
124 | if (empty($themer)) { |
||
125 | throw new \RuntimeException( lang('no_themer') ); |
||
126 | } |
||
127 | |||
128 | $this->themer = new $themer( get_instance() ); |
||
129 | |||
130 | // Register our paths with the themer |
||
131 | $paths = config_item('theme.paths'); |
||
132 | |||
133 | foreach ($paths as $key => $path) { |
||
134 | $this->themer->addThemePath($key, $path); |
||
135 | } |
||
136 | |||
137 | // Set our default theme. |
||
138 | $this->themer->setDefaultTheme( config_item('theme.default_theme') ); |
||
139 | |||
140 | // Register our variants with the engine. |
||
141 | $variants = config_item('theme.variants'); |
||
142 | |||
143 | foreach ($variants as $key => $value) { |
||
144 | $this->themer->addVariant($key, $value); |
||
145 | } |
||
146 | |||
147 | $this->detectVariant(); |
||
148 | |||
149 | // Ensure that our UIKit is loaded up if we're using one. |
||
150 | $uikit = config_item('theme.uikit'); |
||
151 | |||
152 | if ($uikit) |
||
153 | { |
||
154 | $this->uikit = new $uikit(); |
||
155 | } |
||
156 | |||
157 | // Load up our meta collection |
||
158 | $this->meta = new MetaCollection( get_instance() ); |
||
159 | |||
160 | // Should we autoescape vars? |
||
161 | if (is_null($this->auto_escape)) |
||
162 | { |
||
163 | $this->auto_escape = config_item( 'theme.auto_escape' ); |
||
164 | } |
||
165 | } |
||
166 | |||
167 | //-------------------------------------------------------------------- |
||
168 | |||
169 | /** |
||
170 | * Provides a common interface with the other rendering methods to |
||
171 | * set the output of the method. Uses the current instance of $this->template. |
||
172 | * Ensures that any data we've stored through $this->setVar() are present |
||
173 | * and includes the status messages into the data. |
||
174 | * |
||
175 | * @param array $data |
||
176 | * @param int $cache_time |
||
177 | */ |
||
178 | public function render($data = array(), $cache_time=0) |
||
179 | { |
||
180 | if ($cache_time > 0) |
||
181 | { |
||
182 | $this->output->cache( (int)$cache_time ); |
||
0 ignored issues
–
show
The property
output does not exist. Did you maybe forget to declare it?
In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { }
$x = new MyClass();
$x->foo = true;
Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass {
public $foo;
}
$x = new MyClass();
$x->foo = true;
![]() |
|||
183 | } |
||
184 | |||
185 | // Determine the correct theme to use |
||
186 | $theme = ! empty($this->theme) ? $this->theme : config_item('theme.default_theme'); |
||
187 | $this->themer->setTheme($theme); |
||
188 | |||
189 | // Determine the correct layout to use |
||
190 | $layout = !empty($this->layout) ? $this->layout : null; |
||
191 | $this->themer->setLayout($layout); |
||
192 | |||
193 | // Merge any saved vars into the data |
||
194 | // But first, escape the data if needed |
||
195 | if ($this->auto_escape) |
||
196 | { |
||
197 | $data = esc($data, 'html'); |
||
198 | } |
||
199 | $data = array_merge($data, $this->vars); |
||
200 | |||
201 | // Make sure the MetaCollection is available in the view. |
||
202 | $data['html_meta'] = $this->meta; |
||
203 | |||
204 | // Include our UIKit so views can use it |
||
205 | if (! empty($this->uikit)) { |
||
206 | $data['uikit'] = $this->uikit; |
||
207 | } |
||
208 | |||
209 | // Build our notices from the theme's view file. |
||
210 | $data['notice'] = $this->themer->display($this->themer->theme() . ':notice', ["notice" => $this->message()]); |
||
211 | |||
212 | // Make sure any scripts/stylesheets are available to the view |
||
213 | $data['external_scripts'] = $this->external_scripts; |
||
214 | $data['stylesheets'] = $this->stylesheets; |
||
215 | |||
216 | $this->themer->set($data); |
||
217 | |||
218 | $this->output->set_content_type('html') |
||
219 | ->set_output($this->themer->render()); |
||
220 | } |
||
221 | |||
222 | //-------------------------------------------------------------------- |
||
223 | |||
224 | /** |
||
225 | * Sets a data variable to be sent to the view during the render() method. |
||
226 | * Will auto-escape data on the way in, unless specifically told not to. |
||
227 | * |
||
228 | * Uses ZendFramework's Escaper to handle the data escaping, |
||
229 | * based on context. Valid contexts are: |
||
230 | * - html |
||
231 | * - htmlAttr |
||
232 | * - js |
||
233 | * - css |
||
234 | * - url |
||
235 | * |
||
236 | * @param string $name |
||
237 | * @param mixed $value |
||
238 | * @param string $context |
||
239 | * @param bool $do_escape |
||
240 | */ |
||
241 | public function setVar($name, $value = null, $context='html', $do_escape=null) |
||
242 | { |
||
243 | $escape = $do_escape == true ? true : $this->auto_escape; |
||
244 | |||
245 | if (is_null($this->escaper)) |
||
246 | { |
||
247 | $this->escaper = new Escaper(config_item('charset')); |
||
248 | } |
||
249 | |||
250 | if (is_array($name)) |
||
251 | { |
||
252 | foreach ($name as $k => $v) |
||
253 | { |
||
254 | $this->vars[$k] = $escape ? esc($v, $context, $this->escaper) : $v; |
||
255 | } |
||
256 | } |
||
257 | else |
||
258 | { |
||
259 | $this->vars[$name] = $escape ? esc($value, $context, $this->escaper) : $value; |
||
260 | } |
||
261 | } |
||
262 | |||
263 | //-------------------------------------------------------------------- |
||
264 | |||
265 | //-------------------------------------------------------------------- |
||
266 | // Status Messages |
||
267 | //-------------------------------------------------------------------- |
||
268 | |||
269 | /** |
||
270 | * Sets a status message (for displaying small success/error messages). |
||
271 | * This is used in place of the session->flashdata functions since you |
||
272 | * don't always want to have to refresh the page to show the message. |
||
273 | * |
||
274 | * @param string $message The message to save. |
||
275 | * @param string $type The string to be included as the CSS class of the containing div. |
||
276 | */ |
||
277 | public function setMessage($message = '', $type = 'info') |
||
278 | { |
||
279 | if (! empty($message)) { |
||
280 | if (isset($this->session)) { |
||
281 | $this->session->set_flashdata('message', $type . '::' . $message); |
||
0 ignored issues
–
show
The property
session does not exist. Did you maybe forget to declare it?
In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { }
$x = new MyClass();
$x->foo = true;
Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass {
public $foo;
}
$x = new MyClass();
$x->foo = true;
![]() |
|||
282 | } |
||
283 | |||
284 | $this->message = array( |
||
285 | 'type' => $type, |
||
286 | 'message' => $message |
||
287 | ); |
||
288 | } |
||
289 | } |
||
290 | |||
291 | //-------------------------------------------------------------------- |
||
292 | |||
293 | /** |
||
294 | * Retrieves the status message to display (if any). |
||
295 | * |
||
296 | * @param string $message [description] |
||
297 | * @param string $type [description] |
||
298 | * @return array |
||
299 | */ |
||
300 | public function message($message = '', $type = 'info') |
||
301 | { |
||
302 | $return = array( |
||
303 | 'message' => $message, |
||
304 | 'type' => $type |
||
305 | ); |
||
306 | |||
307 | // Does session data exist? |
||
308 | if (empty($message) && class_exists('CI_Session')) { |
||
309 | $message = $this->session->flashdata('message'); |
||
310 | |||
311 | if (! empty($message)) { |
||
312 | // Split out our message parts |
||
313 | $temp_message = explode('::', $message); |
||
314 | $return['type'] = $temp_message[0]; |
||
315 | $return['message'] = $temp_message[1]; |
||
316 | |||
317 | unset($temp_message); |
||
318 | } |
||
319 | } |
||
320 | |||
321 | // If message is empty, we need to check our own storage. |
||
322 | if (empty($message)) { |
||
323 | if (empty($this->message['message'])) { |
||
324 | return ''; |
||
325 | } |
||
326 | |||
327 | $return = $this->message; |
||
328 | } |
||
329 | |||
330 | // Clear our session data so we don't get extra messages on rare occasions. |
||
331 | if (class_exists('CI_Session')) { |
||
332 | $this->session->set_flashdata('message', ''); |
||
333 | } |
||
334 | |||
335 | return $return; |
||
336 | } |
||
337 | |||
338 | //-------------------------------------------------------------------- |
||
339 | |||
340 | //-------------------------------------------------------------------- |
||
341 | // Utility Methods |
||
342 | //-------------------------------------------------------------------- |
||
343 | |||
344 | /** |
||
345 | * Detects whether the item is being displayed on a desktop, phone, |
||
346 | * or tablet device. |
||
347 | */ |
||
348 | protected function detectVariant() |
||
349 | { |
||
350 | // Variant Detection and setup |
||
351 | if (config_item('autodetect_variant') === true) { |
||
352 | $detect = new \Mobile_Detect(); |
||
353 | |||
354 | if ($detect->isMobile()) { |
||
355 | $this->template->setVariant('phone'); |
||
356 | } else if ($detect->isTablet()) { |
||
357 | $this->template->setVariant('tablet'); |
||
358 | } |
||
359 | } |
||
360 | } |
||
361 | |||
362 | //-------------------------------------------------------------------- |
||
363 | |||
364 | //-------------------------------------------------------------------- |
||
365 | // 'Asset' functions |
||
366 | //-------------------------------------------------------------------- |
||
367 | |||
368 | /** |
||
369 | * Adds an external javascript file to the 'external_scripts' array. |
||
370 | * |
||
371 | * @param [type] $filename [description] |
||
372 | */ |
||
373 | View Code Duplication | public function addScript($filename) |
|
374 | { |
||
375 | if (strpos($filename, 'http') === FALSE) { |
||
376 | $filename = base_url() . 'assets/js/' . $filename; |
||
377 | } |
||
378 | |||
379 | $this->external_scripts[] = $filename; |
||
380 | } |
||
381 | |||
382 | //-------------------------------------------------------------------- |
||
383 | |||
384 | /** |
||
385 | * Adds an external stylesheet file to the 'stylesheets' array. |
||
386 | */ |
||
387 | View Code Duplication | public function addStyle($filename) |
|
388 | { |
||
389 | if (strpos($filename, 'http') === FALSE) { |
||
390 | $filename = base_url() . 'assets/css/' . $filename; |
||
391 | } |
||
392 | |||
393 | $this->stylesheets[] = $filename; |
||
394 | } |
||
395 | |||
396 | //-------------------------------------------------------------------- |
||
397 | } |
||
398 | |||
399 |
The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.
The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.
To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.