This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||
2 | |||||
3 | declare(strict_types=1); |
||||
4 | |||||
5 | /* |
||||
6 | * Copyright (C) 2020-2025 Iain Cambridge |
||||
7 | * |
||||
8 | * This program is free software: you can redistribute it and/or modify |
||||
9 | * it under the terms of the GNU LESSER GENERAL PUBLIC LICENSE as published by |
||||
10 | * the Free Software Foundation, either version 2.1 of the License, or |
||||
11 | * (at your option) any later version. |
||||
12 | * |
||||
13 | * This program is distributed in the hope that it will be useful, |
||||
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
16 | * GNU Lesser General Public License for more details. |
||||
17 | * |
||||
18 | * You should have received a copy of the GNU General Public License |
||||
19 | * along with this program. If not, see <https://www.gnu.org/licenses/>. |
||||
20 | */ |
||||
21 | |||||
22 | namespace Parthenon\Payments\Controller; |
||||
23 | |||||
24 | use Parthenon\Payments\CheckoutManagerInterface; |
||||
25 | use Parthenon\Payments\ConfigInterface; |
||||
26 | use Parthenon\Payments\Event\PaymentSuccessEvent; |
||||
27 | use Parthenon\Payments\Plan\PlanManager; |
||||
28 | use Parthenon\Payments\Plan\PlanManagerInterface; |
||||
29 | use Parthenon\Payments\PriceProviderInterface; |
||||
30 | use Parthenon\Payments\Repository\SubscriberRepositoryInterface; |
||||
31 | use Parthenon\Payments\Subscriber\CurrentSubscriberProviderInterface; |
||||
32 | use Parthenon\Payments\Subscriber\SubscriptionFactoryInterface; |
||||
33 | use Parthenon\Payments\SubscriptionManagerInterface; |
||||
34 | use Parthenon\Payments\SubscriptionOptionsFactoryInterface; |
||||
35 | use Psr\Log\LoggerInterface; |
||||
36 | use Symfony\Component\DependencyInjection\ParameterBag\ParameterBagInterface; |
||||
37 | use Symfony\Component\EventDispatcher\EventDispatcherInterface; |
||||
38 | use Symfony\Component\HttpFoundation\JsonResponse; |
||||
39 | use Symfony\Component\HttpFoundation\RedirectResponse; |
||||
40 | use Symfony\Component\HttpFoundation\Request; |
||||
41 | use Symfony\Component\Routing\Annotation\Route; |
||||
42 | use Symfony\Component\Routing\Generator\UrlGeneratorInterface; |
||||
43 | |||||
44 | class PaymentsController |
||||
45 | { |
||||
46 | #[Route('/payments/plans/checkout/{planName}/{paymentSchedule}', name: 'parthenon_payment_checkout')] |
||||
47 | public function createCheckout( |
||||
48 | Request $request, |
||||
49 | LoggerInterface $logger, |
||||
50 | CurrentSubscriberProviderInterface $subscriberProvider, |
||||
51 | SubscriberRepositoryInterface $subscriberRepository, |
||||
52 | PlanManagerInterface $planManager, |
||||
53 | SubscriptionFactoryInterface $subscriptionFactory, |
||||
54 | SubscriptionOptionsFactoryInterface $subscriptionOptionsFactory, |
||||
55 | CheckoutManagerInterface $checkoutManager, |
||||
56 | ) { |
||||
57 | $content = json_decode($request->getContent(), true); |
||||
58 | $seats = 1; |
||||
59 | if ($content) { |
||||
60 | if (isset($content['seats'])) { |
||||
61 | $seats = (int) $content['seats']; |
||||
62 | } |
||||
63 | } |
||||
64 | |||||
65 | $planName = $request->get('planName'); |
||||
66 | $paymentSchedule = $request->get('paymentSchedule'); |
||||
67 | |||||
68 | $logger->info('Generate checkout session', ['planName' => $planName, 'paymentSchedule' => $paymentSchedule]); |
||||
69 | |||||
70 | $plan = $planManager->getPlanByName($planName); |
||||
71 | |||||
72 | if ($plan->isFree()) { |
||||
73 | return new JsonResponse(['free' => true]); |
||||
74 | } |
||||
75 | |||||
76 | $subscriber = $subscriberProvider->getSubscriber(); |
||||
77 | $subscription = $subscriptionFactory->createFromPlanAndPaymentSchedule($plan, $paymentSchedule); |
||||
78 | $options = $subscriptionOptionsFactory->getOptions($plan, $paymentSchedule); |
||||
79 | $checkout = $checkoutManager->createCheckoutForSubscription($subscription, $options, $seats); |
||||
80 | |||||
81 | $subscriber->setSubscription($subscription); |
||||
82 | $subscriberRepository->save($subscriber); |
||||
83 | |||||
84 | return new JsonResponse(['id' => $checkout->getId()]); |
||||
85 | } |
||||
86 | |||||
87 | #[Route('/payments/success/{checkoutId}', name: 'parthenon_payment_checkout_success', requirements: ['checkoutId' => '\w+'])] |
||||
88 | public function success( |
||||
89 | Request $request, |
||||
0 ignored issues
–
show
|
|||||
90 | LoggerInterface $logger, |
||||
91 | CurrentSubscriberProviderInterface $subscriberProvider, |
||||
92 | SubscriberRepositoryInterface $subscriberRepository, |
||||
93 | CheckoutManagerInterface $checkoutManager, |
||||
94 | UrlGeneratorInterface $urlGenerator, |
||||
95 | EventDispatcherInterface $dispatcher, |
||||
96 | ParameterBagInterface $parameterBag, |
||||
97 | ?string $checkoutId = null, |
||||
98 | ) { |
||||
99 | $subscriber = $subscriberProvider->getSubscriber(); |
||||
100 | if ($checkoutId) { |
||||
101 | if (!$subscriber->getSubscription()->getCheckoutId()) { |
||||
102 | $logger->warning("The subscriber doesn't have a checkout id"); |
||||
103 | |||||
104 | return new RedirectResponse('/'); |
||||
105 | } |
||||
106 | |||||
107 | if ($subscriber->getSubscription()->getCheckoutId() !== $checkoutId) { |
||||
108 | $logger->warning("The checkout ids don't match"); |
||||
109 | |||||
110 | return new RedirectResponse('/'); |
||||
111 | } |
||||
112 | } |
||||
113 | |||||
114 | $checkoutManager->handleSuccess($subscriber->getSubscription()); |
||||
0 ignored issues
–
show
It seems like
$subscriber->getSubscription() can also be of type null ; however, parameter $subscription of Parthenon\Payments\Check...erface::handleSuccess() does only seem to accept Parthenon\Payments\Entity\Subscription , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
115 | |||||
116 | $logger->info('A subscriber has successfully paid'); |
||||
117 | |||||
118 | $subscriberRepository->save($subscriber); |
||||
119 | $dispatcher->dispatch(new PaymentSuccessEvent($subscriber), PaymentSuccessEvent::NAME); |
||||
120 | |||||
121 | return new RedirectResponse($urlGenerator->generate($parameterBag->get('parthenon_payments_success_redirect_route'))); |
||||
122 | } |
||||
123 | |||||
124 | #[Route('/payments/plans/change/{planName}/{paymentSchedule}', name: 'parthenon_payment_change')] |
||||
125 | public function changeSubscription( |
||||
126 | Request $request, |
||||
127 | LoggerInterface $logger, |
||||
128 | CurrentSubscriberProviderInterface $subscriberProvider, |
||||
129 | SubscriberRepositoryInterface $subscriberRepository, |
||||
130 | SubscriptionManagerInterface $subscriptionManager, |
||||
131 | PlanManager $planManager, |
||||
132 | PriceProviderInterface $priceProvider, |
||||
133 | ) { |
||||
134 | try { |
||||
135 | $planName = $request->get('planName'); |
||||
136 | $paymentSchedule = $request->get('paymentSchedule'); |
||||
137 | |||||
138 | $logger->info('Changing a subscription to a different plan/payment schedule', ['planName' => $planName, 'paymentSchedule' => $paymentSchedule]); |
||||
139 | |||||
140 | $plan = $planManager->getPlanByName($planName); |
||||
141 | |||||
142 | $subscriber = $subscriberProvider->getSubscriber(); |
||||
143 | |||||
144 | $subscriber->getSubscription()->setPriceId($priceProvider->getPriceId($plan, $paymentSchedule)); |
||||
145 | $subscriber->getSubscription()->setPlanName($planName); |
||||
146 | $subscriber->getSubscription()->setPaymentSchedule($paymentSchedule); |
||||
147 | if ($plan->isFree()) { |
||||
148 | $subscriptionManager->cancel($subscriber->getSubscription()); |
||||
0 ignored issues
–
show
It seems like
$subscriber->getSubscription() can also be of type null ; however, parameter $subscription of Parthenon\Payments\Subsc...agerInterface::cancel() does only seem to accept Parthenon\Payments\Entity\Subscription , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
149 | } else { |
||||
150 | $subscriptionManager->change($subscriber->getSubscription()); |
||||
0 ignored issues
–
show
It seems like
$subscriber->getSubscription() can also be of type null ; however, parameter $subscription of Parthenon\Payments\Subsc...agerInterface::change() does only seem to accept Parthenon\Payments\Entity\Subscription , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
151 | } |
||||
152 | $subscriberRepository->save($subscriber); |
||||
153 | } catch (\Throwable $e) { |
||||
154 | $logger->error('Unable to change payment', ['error_message' => $e->getMessage()]); |
||||
155 | |||||
156 | return new JsonResponse(['success' => false]); |
||||
157 | } |
||||
158 | |||||
159 | return new JsonResponse(['success' => true, 'plan' => ['plan_name' => $planName, 'payment_schedule' => $paymentSchedule, 'status' => $subscriber->getSubscription()->getStatus()]]); |
||||
160 | } |
||||
161 | |||||
162 | #[Route('/payments/portal', name: 'parthenon_payments_billing_portal')] |
||||
163 | public function redirectToBillingPortal( |
||||
164 | Request $request, |
||||
0 ignored issues
–
show
The parameter
$request is not used and could be removed.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for parameters that have been defined for a function or method, but which are not used in the method body. ![]() |
|||||
165 | CurrentSubscriberProviderInterface $currentSubscriberProvider, |
||||
166 | SubscriptionManagerInterface $subscriptionManager, |
||||
167 | ) { |
||||
168 | $subscriber = $currentSubscriberProvider->getSubscriber(); |
||||
169 | $url = $subscriptionManager->getBillingPortal($subscriber->getSubscription()); |
||||
0 ignored issues
–
show
It seems like
$subscriber->getSubscription() can also be of type null ; however, parameter $subscription of Parthenon\Payments\Subsc...ace::getBillingPortal() does only seem to accept Parthenon\Payments\Entity\Subscription , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
170 | |||||
171 | return new RedirectResponse($url); |
||||
172 | } |
||||
173 | |||||
174 | #[Route('/payments/checkout/cancel', name: 'parthenon_payments_cancel_checkout')] |
||||
175 | public function cancelCheckout( |
||||
176 | LoggerInterface $logger, |
||||
177 | UrlGeneratorInterface $urlGenerator, |
||||
178 | ParameterBagInterface $parameterBag, |
||||
179 | ) { |
||||
180 | $logger->info('A user has returned from the checkout by cancelling'); |
||||
181 | |||||
182 | return new RedirectResponse($urlGenerator->generate($parameterBag->get('parthenon_payments_cancel_checkout_redirect_route'))); |
||||
183 | } |
||||
184 | |||||
185 | #[Route('/payments/cancel', name: 'parthenon_payments_cancel')] |
||||
186 | public function cancel( |
||||
187 | Request $request, |
||||
188 | LoggerInterface $logger, |
||||
189 | CurrentSubscriberProviderInterface $subscriberProvider, |
||||
190 | SubscriberRepositoryInterface $subscriberRepository, |
||||
191 | SubscriptionManagerInterface $subscriptionManager, |
||||
192 | ) { |
||||
193 | $logger->info('A user has cancelled their subscription'); |
||||
194 | |||||
195 | $subscriber = $subscriberProvider->getSubscriber(); |
||||
196 | $subscriptionManager->cancel($subscriber->getSubscription()); |
||||
0 ignored issues
–
show
It seems like
$subscriber->getSubscription() can also be of type null ; however, parameter $subscription of Parthenon\Payments\Subsc...agerInterface::cancel() does only seem to accept Parthenon\Payments\Entity\Subscription , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
197 | $subscriberRepository->save($subscriber); |
||||
198 | |||||
199 | return new JsonResponse(['success' => true]); |
||||
200 | } |
||||
201 | |||||
202 | #[Route('/payments/plans', name: 'parthenon_payments_plans')] |
||||
203 | public function listAction(PlanManager $planManager, ConfigInterface $config, CurrentSubscriberProviderInterface $currentSubscriberProvider, PriceProviderInterface $priceProvider) |
||||
204 | { |
||||
205 | $plans = $planManager->getPlans(); |
||||
206 | |||||
207 | $output = []; |
||||
208 | |||||
209 | foreach ($plans as $plan) { |
||||
210 | $output[$plan->getName()] = [ |
||||
211 | 'name' => $plan->getName(), |
||||
212 | 'limits' => $plan->getLimits(), |
||||
213 | 'prices' => $priceProvider->getPrices($plan), |
||||
214 | ]; |
||||
215 | } |
||||
216 | |||||
217 | $subscriber = $currentSubscriberProvider->getSubscriber(); |
||||
218 | |||||
219 | return new JsonResponse([ |
||||
220 | 'plans' => $output, |
||||
221 | 'current_plan' => [ |
||||
222 | 'plan_name' => $subscriber->getSubscription()->getPlanName(), |
||||
223 | 'status' => $subscriber->getSubscription()->getStatus(), |
||||
224 | 'payment_schedule' => $subscriber->getSubscription()->getPaymentSchedule(), |
||||
225 | ], |
||||
226 | 'provider' => $config->getConfigPublicPayload(), |
||||
227 | ]); |
||||
228 | } |
||||
229 | } |
||||
230 |
This check looks for parameters that have been defined for a function or method, but which are not used in the method body.