Issues (547)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Helper/Database.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 * PAYONE Magento 2 Connector is free software: you can redistribute it and/or modify
5
 * it under the terms of the GNU Lesser General Public License as published by
6
 * the Free Software Foundation, either version 3 of the License, or
7
 * (at your option) any later version.
8
 *
9
 * PAYONE Magento 2 Connector is distributed in the hope that it will be useful,
10
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12
 * GNU Lesser General Public License for more details.
13
 *
14
 * You should have received a copy of the GNU Lesser General Public License
15
 * along with PAYONE Magento 2 Connector. If not, see <http://www.gnu.org/licenses/>.
16
 *
17
 * PHP version 5
18
 *
19
 * @category  Payone
20
 * @package   Payone_Magento2_Plugin
21
 * @author    FATCHIP GmbH <[email protected]>
22
 * @copyright 2003 - 2016 Payone GmbH
23
 * @license   <http://www.gnu.org/licenses/> GNU Lesser General Public License
24
 * @link      http://www.payone.de
25
 */
26
27
namespace Payone\Core\Helper;
28
29
use Magento\Framework\DB\Adapter\AdapterInterface;
30
use Magento\Quote\Api\Data\AddressInterface;
31
use Magento\Store\Model\ScopeInterface;
32
33
/**
34
 * Helper class for everything that has to do with database connections
35
 */
36
class Database extends \Payone\Core\Helper\Base
37
{
38
    /**
39
     * Database connection resource
40
     *
41
     * @var \Magento\Framework\App\ResourceConnection
42
     */
43
    protected $databaseResource;
44
45
    /**
46
     * Constructor
47
     *
48
     * @param \Magento\Framework\App\Helper\Context      $context
49
     * @param \Magento\Store\Model\StoreManagerInterface $storeManager
50
     * @param \Payone\Core\Helper\Shop                   $shopHelper
51
     * @param \Magento\Framework\App\ResourceConnection  $resource
52
     */
53
    public function __construct(
54
        \Magento\Framework\App\Helper\Context $context,
55
        \Magento\Store\Model\StoreManagerInterface $storeManager,
56
        \Payone\Core\Helper\Shop $shopHelper,
57
        \Magento\Framework\App\ResourceConnection $resource
58
    ) {
59
        parent::__construct($context, $storeManager, $shopHelper);
60
        $this->databaseResource = $resource;
61
    }
62
63
    /**
64
     * Return database connection
65
     *
66
     * @return AdapterInterface
67
     */
68
    protected function getDb()
69
    {
70
        return $this->databaseResource->getConnection();
71
    }
72
73
    /**
74
     * Get the state for a given status from the database
75
     *
76
     * @param  string $sStatus
77
     * @return string
78
     */
79 View Code Duplication
    public function getStateByStatus($sStatus)
80
    {
81
        $sQuery = " SELECT
82
                        state
83
                    FROM
84
                        ".$this->databaseResource->getTableName('sales_order_status_state')."
85
                    WHERE
86
                        status = :status
87
                    LIMIT 1";
88
        $sState = $this->getDb()->fetchOne($sQuery, ['status' => $sStatus]);
89
        return $sState;
90
    }
91
92
    /**
93
     * Get the order increment id by the given TransactionStatus txid
94
     *
95
     * @param  string $sTxid
96
     * @return string
97
     */
98 View Code Duplication
    public function getOrderIncrementIdByTxid($sTxid)
99
    {
100
        $sQuery = " SELECT
101
                        order_id
102
                    FROM
103
                        ".$this->databaseResource->getTableName('payone_protocol_api')."
104
                    WHERE
105
                        txid = :txid
106
                    LIMIT 1";
107
        $sIncrementId = $this->getDb()->fetchOne($sQuery, ['txid' => $sTxid]);
108
        return $sIncrementId;
109
    }
110
111
    /**
112
     * Get module info from db
113
     *
114
     * @return array
115
     */
116
    public function getModuleInfo()
117
    {
118
        $sQuery = " SELECT
119
                        module, schema_version
120
                    FROM
121
                        ".$this->databaseResource->getTableName('setup_module')."
122
                    WHERE
123
                        module NOT LIKE 'Magento_%'";
124
        $aResult = $this->getDb()->fetchAll($sQuery);
125
        return $aResult;
126
    }
127
128
    /**
129
     * Get increment_id from order by given order id
130
     *
131
     * @param  string $sOrderId
132
     * @return string|bool
133
     */
134 View Code Duplication
    public function getIncrementIdByOrderId($sOrderId)
135
    {
136
        $sQuery = " SELECT
137
                        increment_id
138
                    FROM
139
                        ".$this->databaseResource->getTableName('sales_order')."
140
                    WHERE
141
                        entity_id = :entity_id";
142
        $sIncrementId = $this->getDb()->fetchOne($sQuery, ['entity_id' => $sOrderId]);
143
        return $sIncrementId;
144
    }
145
146
    /**
147
     * Get payone user id by given customer nr
148
     *
149
     * @param  string $sCustNr
150
     * @return string
151
     */
152 View Code Duplication
    public function getPayoneUserIdByCustNr($sCustNr)
153
    {
154
        $sQuery = " SELECT
155
                        userid
156
                    FROM
157
                        ".$this->databaseResource->getTableName('payone_protocol_transactionstatus')."
158
                    WHERE
159
                        customerid = :customerid
160
                    LIMIT 1";
161
        $sUserId = $this->getDb()->fetchOne($sQuery, ['customerid' => $sCustNr]);
162
        return $sUserId;
163
    }
164
165
    /**
166
     * Get the next sequencenumber for this transaction
167
     *
168
     * @param  int $iTxid
169
     * @return int
170
     */
171
    public function getSequenceNumber($iTxid)
172
    {
173
        $sQuery = " SELECT
174
                        MAX(sequencenumber)
175
                    FROM
176
                        ".$this->databaseResource->getTableName('payone_protocol_transactionstatus')."
177
                    WHERE
178
                        txid = :txid";
179
        $iCount = $this->getDb()->fetchOne($sQuery, ['txid' => $iTxid]);
180
        if ($iCount === null) {
181
            return 0;
182
        }
183
        return $iCount + 1;
184
    }
185
186
    /**
187
     * Helper method to get parameter from the config directly from db without cache
188
     *
189
     * @param  string $sKey
190
     * @param  string $sGroup
191
     * @param  string $sSection
192
     * @param  string $sScopeId
193
     * @return string
194
     */
195
    public function getConfigParamWithoutCache($sKey, $sGroup = 'global', $sSection = 'payone_general', $sScopeId = null)
196
    {
197
        $sQuery = " SELECT
198
                        value
199
                    FROM
200
                        ".$this->databaseResource->getTableName('core_config_data')."
201
                    WHERE
202
                        path = :path AND
203
                        scope = :scope AND
204
                        scope_id = :scope_id";
205
        $sPath = $sSection."/".$sGroup."/".$sKey;
206
        $sScope = ScopeInterface::SCOPE_STORE;
207
        if (!$sScopeId) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $sScopeId of type string|null is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
208
            $sScopeId = $this->storeManager->getStore()->getId();
209
        }
210
        $sReturn = $this->getDb()->fetchOne($sQuery, ['path' => $sPath, 'scope' => $sScope, 'scope_id' => $sScopeId]);
211
        return $sReturn;
212
    }
213
214
    /**
215
     * Get the address status from a previous order address
216
     *
217
     * @param  AddressInterface $oAddress
218
     * @param  bool             $blIsCreditrating
219
     * @return string
220
     */
221
    public function getOldAddressStatus(AddressInterface $oAddress, $blIsCreditrating = true)
222
    {
223
        $sSelectField = 'payone_protect_score';
224
        if ($blIsCreditrating === false) {
225
            $sSelectField = 'payone_addresscheck_score';
226
        }
227
228
        $aParams = [
229
            'firstname' => $oAddress->getFirstname(),
230
            'lastname' => $oAddress->getLastname(),
231
            'street' => $oAddress->getStreet()[0],
232
            'city' => $oAddress->getCity(),
233
            'region' => $oAddress->getRegion(),
234
            'postcode' => $oAddress->getPostcode(),
235
            'country_id' => $oAddress->getCountryId(),
236
        ];
237
        $sQuery = " SELECT
238
                        {$sSelectField}
239
                    FROM
240
                        {$this->databaseResource->getTableName('quote_address')}
241
                    WHERE
242
                        firstname = :firstname AND
243
                        lastname = :lastname AND
244
                        street = :street AND
245
                        city = :city AND
246
                        region = :region AND
247
                        postcode = :postcode AND
248
                        country_id = :country_id";
249
        if (!empty($oAddress->getId())) {
250
            $sQuery .= " AND address_id != :curr_id";
251
            $aParams['curr_id'] = $oAddress->getId();
252
        }
253
        if (!empty($oAddress->getCustomerId())) {
254
            $sQuery .= " AND customer_id = :cust_id";
255
            $aParams['cust_id'] = $oAddress->getCustomerId();
256
        }
257
        if (!empty($oAddress->getAddressType())) {
258
            $sQuery .= " AND address_type = :addr_type";
259
            $aParams['addr_type'] = $oAddress->getAddressType();
260
        }
261
        if ($blIsCreditrating === true) {
262
            $sQuery .= " AND payone_protect_score != ''";
263
        } else {
264
            $sQuery .= " AND payone_addresscheck_score != ''";
265
        }
266
        $sQuery .= " ORDER BY address_id DESC LIMIT 1";
267
268
        $sReturn = $this->getDb()->fetchOne($sQuery, $aParams);
269
        return $sReturn;
270
    }
271
}
272