This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace App\Http\Controllers; |
||
4 | |||
5 | use App\Http\Requests\UserUpdateRequest; |
||
6 | use App\Repositories\UserRepository as User; |
||
7 | use App\Transformers\UserTransformer; |
||
8 | use Chrisbjr\ApiGuard\Http\Controllers\ApiGuardController; |
||
9 | use Illuminate\Support\Facades\Storage; |
||
10 | |||
11 | /** |
||
12 | * Class UserController. |
||
13 | */ |
||
14 | class UserController extends ApiGuardController |
||
15 | { |
||
16 | /** |
||
17 | * @var UserTransformer |
||
18 | */ |
||
19 | protected $userTransformer; |
||
20 | |||
21 | /** |
||
22 | * @var array |
||
23 | */ |
||
24 | protected $apiMethods = [ |
||
25 | 'getAllUsers' => [ |
||
26 | 'keyAuthentication' => false, |
||
27 | ], |
||
28 | 'show' => [ |
||
29 | 'keyAuthentication' => false, |
||
30 | ], |
||
31 | ]; |
||
32 | |||
33 | /** |
||
34 | * UserController constructor. |
||
35 | * |
||
36 | * @param User $user |
||
37 | * @param UserTransformer $userTransformer |
||
38 | */ |
||
39 | 5 | public function __construct(User $user, UserTransformer $userTransformer) |
|
40 | { |
||
41 | 5 | parent::__construct(); |
|
42 | |||
43 | 5 | $this->userTransformer = $userTransformer; |
|
44 | 5 | $this->user = $user; |
|
45 | 5 | } |
|
46 | |||
47 | /** |
||
48 | * Get all users. |
||
49 | * |
||
50 | * @return mixed |
||
51 | */ |
||
52 | 4 | public function getAllUsers() |
|
53 | { |
||
54 | 4 | $user = $this->user->all(); |
|
55 | |||
56 | 4 | return $this->response->withCollection($user, $this->userTransformer); |
|
0 ignored issues
–
show
|
|||
57 | } |
||
58 | |||
59 | /** |
||
60 | * Get user find id. |
||
61 | * |
||
62 | * @param $id |
||
63 | * |
||
64 | * @return mixed |
||
65 | */ |
||
66 | 1 | public function show($id) |
|
67 | { |
||
68 | 1 | $user = $this->user->findOrFail($id); |
|
69 | |||
70 | 1 | return $this->response->withItem($user, $this->userTransformer); |
|
0 ignored issues
–
show
$this->userTransformer is of type object<App\Transformers\UserTransformer> , but the function expects a callable .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
Loading history...
|
|||
71 | } |
||
72 | |||
73 | /** |
||
74 | * Update user. |
||
75 | * |
||
76 | * @param UserUpdateRequest $request |
||
77 | * @param $id |
||
78 | * |
||
79 | * @return mixed |
||
80 | */ |
||
81 | 2 | public function update(UserUpdateRequest $request, $id) |
|
82 | { |
||
83 | 2 | $user = $this->user->findOrFail($id); |
|
84 | |||
85 | 2 | if ($request->avatar != '') { |
|
0 ignored issues
–
show
The property
avatar does not exist on object<App\Http\Requests\UserUpdateRequest> . Since you implemented __get , maybe consider adding a @property annotation.
Since your code implements the magic getter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
If the property has read access only, you can use the @property-read annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property.
Loading history...
|
|||
86 | 1 | $path = $this->storeImage($request->avatar, $user); |
|
0 ignored issues
–
show
The property
avatar does not exist on object<App\Http\Requests\UserUpdateRequest> . Since you implemented __get , maybe consider adding a @property annotation.
Since your code implements the magic getter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
If the property has read access only, you can use the @property-read annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property.
Loading history...
|
|||
87 | } else { |
||
88 | 1 | $path = $user->avatar; |
|
89 | } |
||
90 | |||
91 | $data = [ |
||
92 | 2 | 'name' => $request->input('name'), |
|
93 | 2 | 'email' => $request->input('email'), |
|
94 | 2 | 'password' => bcrypt($request->input('password')), |
|
0 ignored issues
–
show
It seems like
$request->input('password') targeting Illuminate\Http\Request::input() can also be of type array ; however, bcrypt() does only seem to accept string , maybe add an additional type check?
This check looks at variables that are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble.
Loading history...
|
|||
95 | 2 | 'avatar' => $path, |
|
96 | ]; |
||
97 | |||
98 | 2 | $this->user->update($data, $id); |
|
99 | |||
100 | 2 | return $this->response->withItem($user, $this->userTransformer); |
|
0 ignored issues
–
show
$this->userTransformer is of type object<App\Transformers\UserTransformer> , but the function expects a callable .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
Loading history...
|
|||
101 | } |
||
102 | |||
103 | /** |
||
104 | * Delete user. |
||
105 | * |
||
106 | * @param $id |
||
107 | */ |
||
108 | 1 | public function delete($id) |
|
109 | { |
||
110 | 1 | $this->user->delete($id); |
|
111 | 1 | } |
|
112 | |||
113 | /** |
||
114 | * Store image avatar. |
||
115 | * |
||
116 | * @param $image |
||
117 | * @param $user |
||
118 | * |
||
119 | * @return mixed |
||
120 | */ |
||
121 | 1 | private function storeImage($image, $user) |
|
122 | { |
||
123 | 1 | $path = Storage::url('images/avatars/'.$user->id.'.'.$image->getClientOriginalExtension()); |
|
124 | |||
125 | 1 | Storage::disk('public')->put( |
|
126 | 1 | 'images/avatars/'.$user->id.'.'.$image->getClientOriginalExtension(), |
|
127 | 1 | file_get_contents($image->getRealPath()) |
|
128 | ); |
||
129 | |||
130 | 1 | return $path; |
|
131 | } |
||
132 | } |
||
133 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: