This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * @copyright Copyright (c) Flipbox Digital Limited |
||
5 | * @license https://flipboxfactory.com/software/meta/license |
||
6 | * @link https://www.flipboxfactory.com/software/meta/ |
||
7 | */ |
||
8 | |||
9 | namespace flipbox\meta\elements\db; |
||
10 | |||
11 | use Craft; |
||
12 | use craft\base\Element; |
||
13 | use craft\base\ElementInterface; |
||
14 | use craft\db\Query; |
||
15 | use craft\elements\db\ElementQuery; |
||
16 | use craft\helpers\Db as DbHelper; |
||
17 | use craft\models\Site; |
||
18 | use flipbox\meta\elements\Meta as MetaElement; |
||
19 | use flipbox\meta\fields\Meta as MetaField; |
||
20 | use flipbox\meta\helpers\Field as FieldHelper; |
||
21 | use flipbox\meta\Meta as MetaPlugin; |
||
22 | use flipbox\meta\records\Meta as MetaRecord; |
||
23 | use yii\base\Exception; |
||
24 | |||
25 | /** |
||
26 | * @author Flipbox Factory <[email protected]> |
||
27 | * @since 1.0.0 |
||
28 | * |
||
29 | * @property string|string[]|Site $ownerSite The handle(s) of the site(s) that the owner element should be in |
||
30 | * |
||
31 | * @method MetaElement[]|array all($db = null) |
||
32 | * @method MetaElement|null one($db = null) |
||
33 | */ |
||
34 | class Meta extends ElementQuery |
||
35 | { |
||
36 | |||
37 | /** |
||
38 | * The field ID(s) that the resulting Meta must belong to. |
||
39 | * |
||
40 | * @var integer|integer[] |
||
41 | */ |
||
42 | public $fieldId; |
||
43 | |||
44 | /** |
||
45 | * The owner element ID(s) that the resulting Meta must belong to. |
||
46 | * |
||
47 | * @var int|int[]|null |
||
48 | */ |
||
49 | public $ownerId; |
||
50 | |||
51 | /** |
||
52 | * The site ID that the resulting Meta must have been defined in, or ':empty:' to find |
||
53 | * elements without an owner site ID. |
||
54 | * |
||
55 | * @var int|string|null |
||
56 | */ |
||
57 | public $ownerSiteId; |
||
58 | |||
59 | /** |
||
60 | * @inheritdoc |
||
61 | */ |
||
62 | public function __construct($elementType, array $config = []) |
||
63 | { |
||
64 | // Default orderBy |
||
65 | if (!isset($config['orderBy'])) { |
||
66 | $config['orderBy'] = 'meta.sortOrder'; |
||
67 | } |
||
68 | |||
69 | parent::__construct($elementType, $config); |
||
70 | } |
||
71 | |||
72 | /** |
||
73 | * @inheritdoc |
||
74 | */ |
||
75 | public function __set($name, $value) |
||
76 | { |
||
77 | switch ($name) { |
||
78 | case 'ownerSite': |
||
79 | $this->ownerSite($value); |
||
80 | break; |
||
81 | default: |
||
82 | parent::__set($name, $value); |
||
83 | } |
||
84 | } |
||
85 | |||
86 | /** |
||
87 | * Sets the [[fieldId]] property. |
||
88 | * |
||
89 | * @param int|int[]|null $value The property value |
||
90 | * |
||
91 | * @return static self reference |
||
92 | */ |
||
93 | public function fieldId($value) |
||
94 | { |
||
95 | $this->fieldId = $value; |
||
96 | |||
97 | return $this; |
||
98 | } |
||
99 | |||
100 | /** |
||
101 | * Sets the [[ownerId]] property. |
||
102 | * |
||
103 | * @param int|int[]|null $value The property value |
||
104 | * |
||
105 | * @return static self reference |
||
106 | */ |
||
107 | public function ownerId($value) |
||
108 | { |
||
109 | $this->ownerId = $value; |
||
110 | |||
111 | return $this; |
||
112 | } |
||
113 | |||
114 | /** |
||
115 | * Sets the [[ownerSiteId]] and [[siteId]] properties. |
||
116 | * |
||
117 | * @param int|string|null $value The property value |
||
118 | * |
||
119 | * @return static self reference |
||
120 | */ |
||
121 | public function ownerSiteId($value) |
||
122 | { |
||
123 | $this->ownerSiteId = $value; |
||
124 | |||
125 | if ($value && strtolower($value) !== ':empty:') { |
||
126 | // A meta will never exist in a site that is different than its ownerSiteId, |
||
127 | // so let's set the siteId param here too. |
||
128 | $this->siteId = (int)$value; |
||
129 | } |
||
130 | |||
131 | return $this; |
||
132 | } |
||
133 | |||
134 | /** |
||
135 | * Sets the [[ownerSiteId]] property based on a given site(s)’s handle(s). |
||
136 | * |
||
137 | * @param string|string[]|Site $value The property value |
||
138 | * |
||
139 | * @return static self reference |
||
140 | * @throws Exception if $value is an invalid site handle |
||
141 | */ |
||
142 | public function ownerSite($value) |
||
143 | { |
||
144 | if ($value instanceof Site) { |
||
145 | $this->ownerSiteId($value->id); |
||
146 | } else { |
||
147 | $site = Craft::$app->getSites()->getSiteByHandle($value); |
||
148 | |||
149 | if (!$site) { |
||
150 | throw new Exception('Invalid site handle: ' . $value); |
||
151 | } |
||
152 | |||
153 | $this->ownerSiteId($site->id); |
||
154 | } |
||
155 | |||
156 | return $this; |
||
157 | } |
||
158 | |||
159 | /** |
||
160 | * Sets the [[ownerId]] and [[ownerSiteId]] properties based on a given element. |
||
161 | * |
||
162 | * @param ElementInterface $owner The owner element |
||
163 | * |
||
164 | * @return static self reference |
||
165 | */ |
||
166 | public function owner(ElementInterface $owner) |
||
167 | { |
||
168 | /** @var Element $owner */ |
||
169 | $this->ownerId = $owner->id; |
||
170 | $this->siteId = $owner->siteId; |
||
171 | |||
172 | return $this; |
||
173 | } |
||
174 | |||
175 | /** |
||
176 | * @inheritdoc |
||
177 | */ |
||
178 | protected function beforePrepare(): bool |
||
179 | { |
||
180 | $this->joinElementTable(MetaRecord::tableAlias()); |
||
181 | |||
182 | // Figure out which content table to use |
||
183 | $this->contentTable = null; |
||
184 | |||
185 | if (!$this->fieldId && $this->id && is_numeric($this->id)) { |
||
186 | $this->fieldId = (new Query()) |
||
0 ignored issues
–
show
|
|||
187 | ->select('fieldId') |
||
188 | ->from(MetaRecord::tableName()) |
||
189 | ->where(['id' => $this->id]) |
||
190 | ->scalar(); |
||
191 | } |
||
192 | |||
193 | if ($this->fieldId && is_numeric($this->fieldId)) { |
||
194 | /** @var MetaField $field */ |
||
195 | $field = Craft::$app->getFields()->getFieldById($this->fieldId); |
||
196 | |||
197 | if ($field) { |
||
198 | $this->contentTable = MetaPlugin::getInstance()->getField()->getContentTableName($field); |
||
199 | } |
||
200 | } |
||
201 | |||
202 | $this->query->select([ |
||
203 | MetaRecord::tableAlias() . '.fieldId', |
||
204 | MetaRecord::tableAlias() . '.ownerId', |
||
205 | MetaRecord::tableAlias() . '.sortOrder', |
||
206 | ]); |
||
207 | |||
208 | if ($this->fieldId) { |
||
209 | $this->subQuery->andWhere(DbHelper::parseParam(MetaRecord::tableAlias() . '.fieldId', $this->fieldId)); |
||
210 | } |
||
211 | |||
212 | if ($this->ownerId) { |
||
213 | $this->subQuery->andWhere(DbHelper::parseParam(MetaRecord::tableAlias() . '.ownerId', $this->ownerId)); |
||
214 | } |
||
215 | |||
216 | if ($this->ownerSiteId) { |
||
217 | $this->subQuery->andWhere(DbHelper::parseParam(MetaRecord::tableAlias() . '.siteId', $this->ownerSiteId)); |
||
218 | } |
||
219 | |||
220 | return parent::beforePrepare(); |
||
221 | } |
||
222 | |||
223 | /** |
||
224 | * @inheritdoc |
||
225 | */ |
||
226 | protected function customFields(): array |
||
227 | { |
||
228 | return Craft::$app->getFields()->getAllFields( |
||
229 | FieldHelper::getContextById($this->fieldId) |
||
230 | ); |
||
231 | } |
||
232 | } |
||
233 |
Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly.
For example, imagine you have a variable
$accountId
that can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to theid
property of an instance of theAccount
class. This class holds a proper account, so the id value must no longer be false.Either this assignment is in error or a type check should be added for that assignment.