eduVPN /
vpn-server-api
| Conditions | 4 |
| Paths | 1 |
| Total Lines | 87 |
| Code Lines | 49 |
| Lines | 49 |
| Ratio | 56.32 % |
| Changes | 1 | ||
| Bugs | 0 | Features | 0 |
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
| 1 | <?php |
||
| 49 | public function init(Service $service) |
||
| 50 | { |
||
| 51 | // GET /config/common_names get all CNs |
||
| 52 | // GET /config/common_names?user_id=foo get all CNs, but only for one user |
||
| 53 | $service->get( |
||
| 54 | '/config/common_names', |
||
| 55 | function (Request $request, TokenInfo $tokenInfo) { |
||
| 56 | Utils::requireScope($tokenInfo, ['admin', 'portal']); |
||
| 57 | $userId = $request->getUrl()->getQueryParameter('user_id'); |
||
| 58 | if (!is_null($userId)) { |
||
| 59 | InputValidation::userId($userId); |
||
| 60 | // filter the directory list if user_id was specified |
||
| 61 | $fileFilter = sprintf('%s_*', $userId); |
||
| 62 | } else { |
||
| 63 | // only admin is allow to request all CNs for all users |
||
| 64 | Utils::requireScope($tokenInfo, ['admin']); |
||
| 65 | $fileFilter = '*'; |
||
| 66 | } |
||
| 67 | |||
| 68 | $cnConfigArray = []; |
||
| 69 | View Code Duplication | foreach ($this->io->readFolder($this->configDir, $fileFilter) as $configFile) { |
|
| 70 | $cnConfig = new CnConfig( |
||
| 71 | Json::decode( |
||
| 72 | $this->io->readFile($configFile) |
||
| 73 | ) |
||
| 74 | ); |
||
| 75 | $cnConfigArray[basename($configFile)] = $cnConfig->toArray(); |
||
| 76 | } |
||
| 77 | |||
| 78 | $response = new JsonResponse(); |
||
| 79 | $response->setBody($cnConfigArray); |
||
| 80 | |||
| 81 | return $response; |
||
| 82 | } |
||
| 83 | ); |
||
| 84 | |||
| 85 | // GET /config/common_names/:commonName get a particular CN |
||
| 86 | $service->get( |
||
| 87 | '/config/common_names/:commonName', |
||
| 88 | View Code Duplication | function (Request $request, TokenInfo $tokenInfo, $commonName) { |
|
| 89 | Utils::requireScope($tokenInfo, ['admin']); |
||
| 90 | InputValidation::commonName($commonName); |
||
| 91 | |||
| 92 | $fileName = sprintf('%s/%s', $this->configDir, $commonName); |
||
| 93 | if (!$this->io->isFile($fileName)) { |
||
| 94 | // if the file does not exist, use default values |
||
| 95 | $cnConfig = new CnConfig([]); |
||
| 96 | } else { |
||
| 97 | $cnConfig = new CnConfig( |
||
| 98 | Json::decode( |
||
| 99 | $this->io->readFile( |
||
| 100 | sprintf('%s/%s', $this->configDir, $commonName) |
||
| 101 | ) |
||
| 102 | ) |
||
| 103 | ); |
||
| 104 | } |
||
| 105 | |||
| 106 | $response = new JsonResponse(); |
||
| 107 | $response->setBody($cnConfig->toArray()); |
||
| 108 | |||
| 109 | return $response; |
||
| 110 | } |
||
| 111 | ); |
||
| 112 | |||
| 113 | // PUT /config/common_names/:commonName set new config for CN |
||
| 114 | $service->put( |
||
| 115 | '/config/common_names/:commonName', |
||
| 116 | View Code Duplication | function (Request $request, TokenInfo $tokenInfo, $commonName) { |
|
| 117 | Utils::requireScope($tokenInfo, ['admin']); |
||
| 118 | InputValidation::commonName($commonName); |
||
| 119 | |||
| 120 | // we wrap the request body in an CnConfig object to validate |
||
| 121 | // whatever is there |
||
| 122 | $requestCnConfig = new CnConfig(Json::decode($request->getBody())); |
||
| 123 | |||
| 124 | $this->io->writeFile( |
||
| 125 | sprintf('%s/%s', $this->configDir, $commonName), |
||
| 126 | Json::encode($requestCnConfig->toArray()) |
||
| 127 | ); |
||
| 128 | |||
| 129 | $response = new JsonResponse(); |
||
| 130 | $response->setBody(['ok' => true]); |
||
| 131 | |||
| 132 | return $response; |
||
| 133 | } |
||
| 134 | ); |
||
| 135 | } |
||
| 136 | } |
||
| 137 |
Loading history...
$fileFiltercan contain request data and is used in file inclusion context(s) leading to a potential security vulnerability.General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }For numeric data, we recommend to explicitly cast the data: