Issues in UserRelationship.php (master) - Issues in master - flipboxfactory/organizations - Measure and Improve Code Quality continuously with Scrutinizer

Issues (55)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/relationships/UserRelationship.php (3 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

/**
 * @copyright  Copyright (c) Flipbox Digital Limited
 * @license    https://flipboxfactory.com/software/organization/license
 * @link       https://www.flipboxfactory.com/software/organization/
 */

namespace flipbox\organizations\relationships;

use craft\elements\db\ElementQueryInterface;
use craft\elements\db\UserQuery;
use craft\elements\User;
use craft\helpers\ArrayHelper;
use flipbox\organizations\elements\Organization;
use flipbox\organizations\Organizations;
use flipbox\organizations\queries\OrganizationQuery;
use flipbox\organizations\queries\UserAssociationQuery;
use flipbox\organizations\records\UserAssociation;
use Tightenco\Collect\Support\Collection;

/**
 * Manages Users associated to Organizations
 *
 * @author Flipbox Factory <[email protected]>
 * @since 2.0.0
 *
 * @method UserAssociation findOrCreate($object)
 * @method UserAssociation findOne($object = null)
 * @method UserAssociation findOrFail($object)
 */
class UserRelationship implements ElementRelationshipInterface
{
    use RelationshipTrait;

    /**
     * @var Organization
     */
    private $organization;

    /**
     * @param Organization $organization
     */
    public function __construct(Organization $organization)
    {
        $this->organization = $organization;
    }


    /************************************************************
     * COLLECTION
     ************************************************************/

    /**
     * Get a collection of associated users
     *
     * @return User[]|Collection
     */
    public function getCollection(): Collection
    {
        if (null === $this->relations) {
            return new Collection(
                $this->getQuery()
                    ->anyStatus()
                    ->limit(null)
                    ->all()
            );
        }

        return $this->createCollectionFromRelations();
    }

    /**
     * @return Collection
     */
    protected function createCollectionFromRelations()
    {
        $ids = $this->getRelationships()->pluck('userId')->all();
        if (empty($ids)) {
            return $this->getRelationships()->pluck('user');
        }

        // 'eager' load where we'll pre-populate all of the elements
        $elements = $this->getQuery()
            ->id($ids)
            ->indexBy('id')
            ->anyStatus()
            ->limit(null)
            ->all();

        return $this->getRelationships()
            ->transform(function (UserAssociation $association) use ($elements) {
                if (!$association->isUserSet() && isset($elements[$association->getUserId()])) {
                    $association->setUser($elements[$association->getUserId()]);
                }

                $association->setOrganization($this->organization);

                return $association;
            })
            ->pluck('user');
    }

    /**
     * @return Collection
     */
    protected function existingRelationships(): Collection
    {
        $relationships = $this->associationQuery()
            ->with('types')
            ->all();

        return $this->createRelations($relationships);
    }

    /************************************************************
     * QUERY
     ************************************************************/

    /**
     * @inheritDoc
     * @return UserQuery
     */
    public function getQuery(): ElementQueryInterface
    {
        return User::find()
            ->organizationId($this->organization->getId() ?: false);
    }

    /**
     * @return UserAssociationQuery
     */
    private function associationQuery(): UserAssociationQuery
    {
        /** @noinspection PhpUndefinedMethodInspection */
        return UserAssociation::find()
            ->setOrganizationId($this->organization->getId() ?: false)

            ->orderBy([
                'organizationOrder' => SORT_ASC
            ])
            ->limit(null);
    }

    /************************************************************
     * CREATE
     ************************************************************/

    /**
     * @param $object
     * @return UserAssociation
     */
    protected function create($object): UserAssociation
    {
        if ($object instanceof UserAssociation) {
            return $object;
        }

        return (new UserAssociation())
            ->setOrganization($this->organization)
            ->setUser($this->resolveObject($object));
    }


    /*******************************************
     * DELTA
     *******************************************/

    /**
     * @inheritDoc
     */
    protected function delta(): array
    {
        $existingAssociations = $this->associationQuery()
            ->indexBy('userId')
            ->all();

        $associations = [];
        $order = 1;

        /** @var UserAssociation $newAssociation */
        foreach ($this->getRelationships() as $newAssociation) {
            $association = ArrayHelper::remove(
                $existingAssociations,
                $newAssociation->getUserId()
            );

            $newAssociation->userOrder = $order++;

            /** @var UserAssociation $association */
            $association = $association ?: $newAssociation;

            // Has anything changed?
            if (!$association->getIsNewRecord() && !$this->hasChanged($newAssociation, $association)) {
                continue;
            }

            $associations[] = $this->sync($association, $newAssociation);
        }

        return [$associations, $existingAssociations];
    }

    /**
     * @param UserAssociation $new
     * @param UserAssociation $existing
     * @return bool
     */
    private function hasChanged(UserAssociation $new, UserAssociation $existing): bool
    {
        return (Organizations::getInstance()->getSettings()->getEnforceUserSortOrder() &&
                $new->userOrder != $existing->userOrder
            ) ||
            $new->state != $existing->state ||
            $new->getTypes()->isMutated();
    }

    /**
     * @param UserAssociation $from
     * @param UserAssociation $to
     *
     * @return UserAssociation
     */
    private function sync(UserAssociation $to, UserAssociation $from): UserAssociation
    {
        $to->userOrder = $from->userOrder;
        $to->state = $from->state;

        if ($from->getTypes()->isMutated()) {
            $to->getTypes()->clear()->add(
                $from->getTypes()->getCollection()
            );
        }

        $to->ignoreSortOrder();

        return $to;
    }


    /*******************************************
     * COLLECTION UTILS
     *******************************************/

    /**
     * @inheritDoc
     */
    protected function insertCollection(Collection $collection, UserAssociation $association)
    {
        if (Organizations::getInstance()->getSettings()->getEnforceUserSortOrder() && $association->userOrder > 0) {
            $collection->splice($association->userOrder - 1, 0, [$association]);
            return;
        }

        $collection->push($association);
    }

    /**
     * @inheritDoc
     */
    protected function updateCollection(Collection $collection, UserAssociation $association)
    {
        if (!Organizations::getInstance()->getSettings()->getEnforceUserSortOrder()) {
            return;
        }

        if (null !== ($key = $this->findKey($association))) {
            $collection->offsetUnset($key);
        }

        $this->insertCollection($collection, $association);
    }


    /*******************************************
     * UTILS
     *******************************************/

    /**
     * @param UserAssociation|User|int|array|null $object
     * @return int|null
     */
    protected function findKey($object = null)
    {
        if ($object instanceof UserAssociation) {
            if (!$object->getUser()) {
                var_dump("NOT FOUND");

                return null;
            }

            return $this->findRelationshipKey($object->getUser()->email);
        }

        if (null === ($element = $this->resolveObject($object))) {
            return null;
        }

        return $this->findRelationshipKey($element->email);
    }

    /**
     * @param $identifier
     * @return int|string|null
     */
    private function findRelationshipKey($identifier)
    {
        if (null === $identifier) {
            return null;
        }

        /** @var UserAssociation $association */
        foreach ($this->getRelationships()->all() as $key => $association) {
            if (null !== $association->getUser() && $association->getUser()->email == $identifier) {
                return $key;
            }
        }

        return null;
    }

    /**
     * @param UserAssociation|User|int|array|null $user
     * @return User|null
     */
    protected function resolveObjectInternal($user)
    {
        if ($user instanceof UserAssociation) {
            return $user->getUser();
        }

        if ($user instanceof User) {
            return $user;
        }

        if (is_numeric($user)) {
            return \Craft::$app->getUsers()->getUserById($user);
        }

        if (is_string($user)) {
            return \Craft::$app->getUsers()->getUserByUsernameOrEmail($user);
        }

        return User::findOne($user);

    }
}


1			<?php
2
3			/**
4			* @copyright Copyright (c) Flipbox Digital Limited
5			* @license https://flipboxfactory.com/software/organization/license
6			* @link https://www.flipboxfactory.com/software/organization/
7			*/
8
9			namespace flipbox\organizations\relationships;
10
11			use craft\elements\db\ElementQueryInterface;
12			use craft\elements\db\UserQuery;
13			use craft\elements\User;
14			use craft\helpers\ArrayHelper;
15			use flipbox\organizations\elements\Organization;
16			use flipbox\organizations\Organizations;
17			use flipbox\organizations\queries\OrganizationQuery;
18			use flipbox\organizations\queries\UserAssociationQuery;
19			use flipbox\organizations\records\UserAssociation;
20			use Tightenco\Collect\Support\Collection;
21
22			/**
23			* Manages Users associated to Organizations
24			*
25			* @author Flipbox Factory <[email protected]>
26			* @since 2.0.0
27			*
28			* @method UserAssociation findOrCreate($object)
29			* @method UserAssociation findOne($object = null)
30			* @method UserAssociation findOrFail($object)
31			*/
32			class UserRelationship implements ElementRelationshipInterface
33			{
34			use RelationshipTrait;
35
36			/**
37			* @var Organization
38			*/
39			private $organization;
40
41			/**
42			* @param Organization $organization
43			*/
44			public function __construct(Organization $organization)
45			{
46			$this->organization = $organization;
47			}
48
49
50			/************************************************************
51			* COLLECTION
52			************************************************************/
53
54			/**
55			* Get a collection of associated users
56			*
57			* @return User[]\|Collection
58			*/
59			public function getCollection(): Collection
60			{
61			if (null === $this->relations) {
62			return new Collection(
63			$this->getQuery()
64			->anyStatus()
65			->limit(null)
66			->all()
67			);
68			}
69
70			return $this->createCollectionFromRelations();
71			}
72
73			/**
74			* @return Collection
75			*/
76			protected function createCollectionFromRelations()
77			{
78			$ids = $this->getRelationships()->pluck('userId')->all();
79			if (empty($ids)) {
80			return $this->getRelationships()->pluck('user');
81			}
82
83			// 'eager' load where we'll pre-populate all of the elements
84			$elements = $this->getQuery()
85			->id($ids)
86			->indexBy('id')
87			->anyStatus()
88			->limit(null)
89			->all();
90
91			return $this->getRelationships()
92			->transform(function (UserAssociation $association) use ($elements) {
93			if (!$association->isUserSet() && isset($elements[$association->getUserId()])) {
94			$association->setUser($elements[$association->getUserId()]);
95			}
96
97			$association->setOrganization($this->organization);
98
99			return $association;
100			})
101			->pluck('user');
102			}
103
104			/**
105			* @return Collection
106			*/
107			protected function existingRelationships(): Collection
108			{
109			$relationships = $this->associationQuery()
110			->with('types')
111			->all();
112
113			return $this->createRelations($relationships);
114			}
115
116			/************************************************************
117			* QUERY
118			************************************************************/
119
120			/**
121			* @inheritDoc
122			* @return UserQuery
123			*/
124			public function getQuery(): ElementQueryInterface
125			{
126			return User::find()
127			->organizationId($this->organization->getId() ?: false);
128			}
129
130			/**
131			* @return UserAssociationQuery
132			*/
133			private function associationQuery(): UserAssociationQuery
134			{
135			/** @noinspection PhpUndefinedMethodInspection */
136			return UserAssociation::find()
137			->setOrganizationId($this->organization->getId() ?: false)
			0 ignored issues – show Security Bug introduced 2019-06-04 06:45 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `$this->organization->getId() ?: false` can also be of type `false`; however, `flipbox\organizations\qu...it::setOrganizationId()` does only seem to accept `string\|array<integer,str...nts\Organization>>\|null`, did you maybe forget to handle an error condition? Loading history...
138			->orderBy([
139			'organizationOrder' => SORT_ASC
140			])
141			->limit(null);
142			}
143
144			/************************************************************
145			* CREATE
146			************************************************************/
147
148			/**
149			* @param $object
150			* @return UserAssociation
151			*/
152			protected function create($object): UserAssociation
153			{
154			if ($object instanceof UserAssociation) {
155			return $object;
156			}
157
158			return (new UserAssociation())
159			->setOrganization($this->organization)
160			->setUser($this->resolveObject($object));
161			}
162
163
164			/*******************************************
165			* DELTA
166			*******************************************/
167
168			/**
169			* @inheritDoc
170			*/
171			protected function delta(): array
172			{
173			$existingAssociations = $this->associationQuery()
174			->indexBy('userId')
175			->all();
176
177			$associations = [];
178			$order = 1;
179
180			/** @var UserAssociation $newAssociation */
181			foreach ($this->getRelationships() as $newAssociation) {
182			$association = ArrayHelper::remove(
183			$existingAssociations,
184			$newAssociation->getUserId()
185			);
186
187			$newAssociation->userOrder = $order++;
188
189			/** @var UserAssociation $association */
190			$association = $association ?: $newAssociation;
191
192			// Has anything changed?
193			if (!$association->getIsNewRecord() && !$this->hasChanged($newAssociation, $association)) {
194			continue;
195			}
196
197			$associations[] = $this->sync($association, $newAssociation);
198			}
199
200			return [$associations, $existingAssociations];
201			}
202
203			/**
204			* @param UserAssociation $new
205			* @param UserAssociation $existing
206			* @return bool
207			*/
208			private function hasChanged(UserAssociation $new, UserAssociation $existing): bool
209			{
210			return (Organizations::getInstance()->getSettings()->getEnforceUserSortOrder() &&
211			$new->userOrder != $existing->userOrder
212			) \|\|
213			$new->state != $existing->state \|\|
214			$new->getTypes()->isMutated();
215			}
216
217			/**
218			* @param UserAssociation $from
219			* @param UserAssociation $to
220			*
221			* @return UserAssociation
222			*/
223			private function sync(UserAssociation $to, UserAssociation $from): UserAssociation
224			{
225			$to->userOrder = $from->userOrder;
226			$to->state = $from->state;
227
228			if ($from->getTypes()->isMutated()) {
229			$to->getTypes()->clear()->add(
230			$from->getTypes()->getCollection()
231			);
232			}
233
234			$to->ignoreSortOrder();
235
236			return $to;
237			}
238
239
240			/*******************************************
241			* COLLECTION UTILS
242			*******************************************/
243
244			/**
245			* @inheritDoc
246			*/
247			protected function insertCollection(Collection $collection, UserAssociation $association)
248			{
249			if (Organizations::getInstance()->getSettings()->getEnforceUserSortOrder() && $association->userOrder > 0) {
250			$collection->splice($association->userOrder - 1, 0, [$association]);
251			return;
252			}
253
254			$collection->push($association);
255			}
256
257			/**
258			* @inheritDoc
259			*/
260			protected function updateCollection(Collection $collection, UserAssociation $association)
261			{
262			if (!Organizations::getInstance()->getSettings()->getEnforceUserSortOrder()) {
263			return;
264			}
265
266			if (null !== ($key = $this->findKey($association))) {
267			$collection->offsetUnset($key);
268			}
269
270			$this->insertCollection($collection, $association);
271			}
272
273
274			/*******************************************
275			* UTILS
276			*******************************************/
277
278			/**
279			* @param UserAssociation\|User\|int\|array\|null $object
280			* @return int\|null
281			*/
282			protected function findKey($object = null)
283			{
284			if ($object instanceof UserAssociation) {
285			if (!$object->getUser()) {
286			var_dump("NOT FOUND");
			0 ignored issues – show Security Debugging Code introduced 2019-06-18 19:59 UTC by Report Bug Copy Issue Report Show Similar Issues like this `var_dump('NOT FOUND');` looks like debug code. Are you sure you do not want to remove it? This might expose sensitive data. Loading history...
287			return null;
288			}
289
290			return $this->findRelationshipKey($object->getUser()->email);
291			}
292
293			if (null === ($element = $this->resolveObject($object))) {
294			return null;
295			}
296
297			return $this->findRelationshipKey($element->email);
298			}
299
300			/**
301			* @param $identifier
302			* @return int\|string\|null
303			*/
304			private function findRelationshipKey($identifier)
305			{
306			if (null === $identifier) {
307			return null;
308			}
309
310			/** @var UserAssociation $association */
311			foreach ($this->getRelationships()->all() as $key => $association) {
312			if (null !== $association->getUser() && $association->getUser()->email == $identifier) {
313			return $key;
314			}
315			}
316
317			return null;
318			}
319
320			/**
321			* @param UserAssociation\|User\|int\|array\|null $user
322			* @return User\|null
323			*/
324			protected function resolveObjectInternal($user)
325			{
326			if ($user instanceof UserAssociation) {
327			return $user->getUser();
328			}
329
330			if ($user instanceof User) {
331			return $user;
332			}
333
334			if (is_numeric($user)) {
335			return \Craft::$app->getUsers()->getUserById($user);
336			}
337
338			if (is_string($user)) {
339			return \Craft::$app->getUsers()->getUserByUsernameOrEmail($user);
340			}
341
342			return User::findOne($user);
			0 ignored issues – show Bug Compatibility introduced 2020-10-27 19:36 UTC by Report Bug Copy Issue Report Show Similar Issues like this The expression `\craft\elements\User::findOne($user);` of type `craft\base\ElementInterface\|array\|null` adds the type `array` to the return on line 342 which is incompatible with the return type documented by `flipbox\organizations\re...::resolveObjectInternal` of type `craft\elements\User\|null`. Loading history...
343			}
344			}
345

flipboxfactory / organizations

Issues (55)

Security Analysis not enabled

src/relationships/UserRelationship.php (3 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like