Issues (125)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

code/MapExtension.php (15 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
class MapExtension extends DataExtension implements Mappable
4
{
5
    /*
6
     * Template suffix for rendering MapInfoWindow aka  map bubble
7
     */
8
    private static $map_info_window_suffix = '_MapInfoWindow';
9
10
    private static $db = array(
11
        'Lat' => 'Decimal(18,15)',
12
        'Lon' => 'Decimal(18,15)',
13
        'ZoomLevel' => 'Int',
14
        'MapPinEdited' => 'Boolean',
15
    );
16
17
    public static $has_one = array(
18
        'MapPinIcon' => 'Image',
19
    );
20
21
    public static $defaults = array(
22
        'Lat' => 0,
23
        'Lon' => 0,
24
        'Zoom' => 4,
25
        'MapPinEdited' => false,
26
    );
27
28
    /*
29
    Map editing field
30
     */
31
    private $mapField = null;
32
33
    /*
34
    Add a Location tab containing the map
35
    */
36 3
    public function updateCMSFields(FieldList $fields)
37
    {
38
        // These fields need removed, as they may have already been created by the form scaffolding
39 2
        $fields->removeByName('Lat');
40 2
        $fields->removeByName('Lon');
41 2
        $fields->removeByName('ZoomLevel');
42 2
        $fields->removeByName('MapPinIcon');
43 2
        $fields->removeByName('MapPinEdited');
44
45 2
        $fields->addFieldToTab(
46 2
            'Root.Location',
47 3
            $this->getMapField()
48
        );
49 2
50 2
        $fields->addFieldToTab('Root.Location', $uf = new UploadField(
51 2
            'MapPinIcon',
52 2
            _t('Mappable.MAP_PIN', 'Map Pin Icon.  Leave this blank for default pin to show')
53
        ));
54 16
        $uf->setFolderName('mapicons');
55
    }
56 16
57
    public function getMappableLatitude()
58
    {
59 16
        return $this->owner->Lat;
0 ignored issues
show
The property Lat does not seem to exist in SS_Object.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
60
    }
61 16
62
    public function getMappableLongitude()
63
    {
64
        return $this->owner->Lon;
0 ignored issues
show
The property Lon does not seem to exist in SS_Object.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
65
    }
66
67
    /**
68
     * Renders the map info window for the DataObject.
69
     *
70
     * Be sure to define a template for that, named by the decorated class suffixed with _MapInfoWindow
71
     * e.g. MyPage_MapInfoWindow
72
     *
73
     * You can change the suffix globally by editing the MapExtension.map_info_window_suffix config val
74 9
     *
75
     * @return string
76 9
     */
77
    public function getMappableMapContent()
78 9
    {
79 9
        $defaultTemplate = 'MapInfoWindow';
80 9
        $classTemplate =
81 9
            SSViewer::get_templates_by_class(
82
                $this->owner->ClassName,
0 ignored issues
show
The property ClassName does not seem to exist in SS_Object.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
83 9
                Config::inst()->get('MapExtension', 'map_info_window_suffix')
84
            );
85 9
86
        $template = count($classTemplate) ? $classTemplate : $defaultTemplate;
87
88
        return MapUtil::sanitize($this->owner->renderWith($template));
89
    }
90
91
    /*
92 27
    If the marker pin is not at position 0,0 mark the pin as edited. This provides the option of
93
    filtering out (0,0) point which is often irrelevant for plots
94 27
    */
95 27
    public function onBeforeWrite()
96 27
    {
97
        $latzero = ($this->owner->Lat == 0);
0 ignored issues
show
The property Lat does not seem to exist in SS_Object.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
98
        $lonzero = ($this->owner->Lon == 0);
0 ignored issues
show
The property Lon does not seem to exist in SS_Object.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
99 27
        $latlonzero = $latzero && $lonzero;
100 9
101 9
        // if both latitude and longitude still default, do not set the map location as edited
102 27
        if (!$latlonzero) {
103
            $this->owner->MapPinEdited = true;
0 ignored issues
show
The property MapPinEdited does not seem to exist in SS_Object.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
104
        }
105
    }
106
107 15
    /*
108
    If a user has uploaded a map pin icon display that, otherwise
109 15
    */
110 15
    public function getMappableMapPin()
111 2
    {
112 2
        $result = false;
113 2
        if ($this->owner->MapPinIconID != 0) {
0 ignored issues
show
The property MapPinIconID does not seem to exist in SS_Object.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
114
            $mapPin = $this->owner->MapPinIcon();
115 14
            $result = $mapPin->getAbsoluteURL();
116 1
        } else {
117 1
            // check for a cached map pin already having been provided for the layer
118
            if ($this->owner->CachedMapPinURL) {
119
                $result = $this->owner->CachedMapPinURL;
0 ignored issues
show
The property CachedMapPinURL does not seem to exist in SS_Object.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
120 15
            }
121
        }
122
123
        return $result;
124
    }
125
126 10
    /*
127
        Check for non zero coordinates, on the assumption that (0,0) will never be the desired coordinates
128 10
    */
129 10
    public function HasGeo()
0 ignored issues
show
Method name "MapExtension::HasGeo" is not in camel caps format
Loading history...
130 10
    {
131 10
        $isOrigin = ($this->owner->Lat == 0) && ($this->owner->Lon == 0);
0 ignored issues
show
The property Lat does not seem to exist in SS_Object.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
The property Lon does not seem to exist in SS_Object.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
132 1
        $result = !$isOrigin;
133 1
        if ($this->owner->hasExtension('MapLayerExtension')) {
134 10
            if ($this->owner->MapLayers()->count() > 0) {
135 10
                $result = true;
136 10
            }
137
        }
138
        $this->owner->extend('updateHasGeo', $result);
139
        return $result;
140
    }
141
142 2
    /*
143
    Render a map at the provided lat,lon, zoom from the editing functions,
144 2
    */
145 2
    public function BasicMap()
0 ignored issues
show
Method name "MapExtension::BasicMap" is not in camel caps format
Loading history...
146 2
    {
147 2
        $map = $this->owner->getRenderableMap()->
148
            setZoom($this->owner->ZoomLevel)->
0 ignored issues
show
The property ZoomLevel does not seem to exist in SS_Object.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
149 2
            setAdditionalCSSClasses('fullWidthMap')->
150
            setShowInlineMapDivStyle(true);
151
152
        $autozoom = false;
153 2
154
155 2
156 2
        $this->owner->extend('updateBasicMap', $map, $autozoom);
157
158 2
        $map->setEnableAutomaticCenterZoom($autozoom);
159
        $map->setShowInlineMapDivStyle(true);
160
161
        return $map;
162
    }
163
164
    /**
165
     * Access the map editing field for the purpose of adding guide points.
166 3
     *
167
     * @return [LatLongField] instance of location editing field
0 ignored issues
show
The doc-type [LatLongField] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
168 3
     */
169 3
    public function getMapField()
170 3
    {
171 3
        if (!isset($this->mapField)) {
172 3
            $this->mapField = new LatLongField(
173
                array(
174 3
                new TextField('Lat', 'Latitude'),
175 3
                new TextField('Lon', 'Longitude'),
176
                new TextField('ZoomLevel', 'Zoom'),
177 3
                )
178
            );
179
        }
180
181
        return $this->mapField;
182
    }
183 1
184
    /**
185 1
     * Template helper, used to decide whether or not to use compressed assets.
186
     */
187
    public function UseCompressedAssets()
0 ignored issues
show
Method name "MapExtension::UseCompressedAssets" is not in camel caps format
Loading history...
188 1
    {
189
        return Config::inst()->get('Mappable', 'use_compressed_assets');
190
    }
191
}
192