This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace App\Http\Controllers; |
||
4 | |||
5 | use Illuminate\Http\Request; |
||
6 | use App\Http\Requests; |
||
7 | use App\User; |
||
8 | use App\Countries; |
||
9 | use App\Teams; |
||
10 | |||
11 | class StaffController extends Controller |
||
12 | { |
||
13 | |||
14 | public function __construct() |
||
15 | { |
||
16 | $this->middleware('auth'); |
||
17 | } |
||
18 | |||
19 | |||
20 | /** |
||
21 | * Display all users. |
||
22 | */ |
||
23 | public function index() |
||
24 | { |
||
25 | $users = User::orderBy('fname', 'asc')->paginate(10); |
||
26 | return view('staff/users', ['users' => $users]); |
||
27 | } |
||
28 | |||
29 | /** |
||
30 | * Show the form for creating a new employee. |
||
31 | * |
||
32 | */ |
||
33 | public function create() |
||
34 | { |
||
35 | $countries = Countries::all(); |
||
36 | return view('staff/create_user', ['countries' => $countries]); |
||
37 | } |
||
38 | |||
39 | /** |
||
40 | * Store a newly created employee in storage. |
||
41 | * |
||
42 | */ |
||
43 | public function store(Request $request) |
||
44 | { |
||
45 | $user = new User; |
||
46 | $user->fname = $request->get('fname'); |
||
0 ignored issues
–
show
|
|||
47 | $user->name = $request->get('name'); |
||
0 ignored issues
–
show
The property
name does not exist on object<App\User> . Since you implemented __set , maybe consider adding a @property annotation.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
48 | $user->address = $request->get('address'); |
||
0 ignored issues
–
show
The property
address does not exist on object<App\User> . Since you implemented __set , maybe consider adding a @property annotation.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
49 | $user->postal_code = $request->get('postal_code'); |
||
0 ignored issues
–
show
The property
postal_code does not exist on object<App\User> . Since you implemented __set , maybe consider adding a @property annotation.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
50 | $user->city = $request->get('city'); |
||
0 ignored issues
–
show
The property
city does not exist on object<App\User> . Since you implemented __set , maybe consider adding a @property annotation.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
51 | $user->email = $request->get('email'); |
||
0 ignored issues
–
show
The property
email does not exist on object<App\User> . Since you implemented __set , maybe consider adding a @property annotation.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
52 | $user->password = bcrypt($request->get('password')); |
||
0 ignored issues
–
show
The property
password does not exist on object<App\User> . Since you implemented __set , maybe consider adding a @property annotation.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
53 | $user->save(); |
||
54 | |||
55 | $mailbox = env('MAIL_USERNAME'); |
||
56 | $mail_password = $request->get('password'); |
||
57 | \Session::flash('message', "New employee has been added to the application"); |
||
58 | \Mail::send('emails.new_user', ['user' => $user, 'password' => $mail_password], function ($m) use ($user, $mailbox) { |
||
59 | $m->from($mailbox); |
||
60 | $m->to($user->email)->subject('Your user credentials!'); |
||
0 ignored issues
–
show
The property
email does not exist on object<App\User> . Since you implemented __get , maybe consider adding a @property annotation.
Since your code implements the magic getter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
If the property has read access only, you can use the @property-read annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
61 | }); |
||
62 | return redirect('staff'); |
||
63 | } |
||
64 | |||
65 | public function updateUser($id, Request $request) |
||
66 | { |
||
67 | $user = User::find($id); |
||
68 | $user->fname = $request->get('fname'); |
||
69 | $user->name = $request->get('name'); |
||
70 | $user->address = $request->get('address'); |
||
71 | $user->postal_code = $request->get('postal_code'); |
||
72 | $user->city = $request->get('city'); |
||
73 | $user->email = $request->get('email'); |
||
74 | $user->assignRole($request->get('user_type')); |
||
75 | $user->update(); |
||
76 | |||
77 | \Session::flash('message', "User details have been updated"); |
||
78 | return \Redirect::back(); |
||
79 | } |
||
80 | |||
81 | |||
82 | public function policies() |
||
83 | { |
||
84 | $roles = Role::all(); |
||
85 | return view('staff/roles', ['roles' => $roles]); |
||
86 | } |
||
87 | |||
88 | public function addpolicies() |
||
89 | { |
||
90 | $permissions = Permission::all(); |
||
91 | return view('staff/create_role', ['permissions' => $permissions]); |
||
92 | } |
||
93 | |||
94 | |||
95 | public function addRole(Request $request) |
||
96 | { |
||
97 | $role = Role::create(['name' => $request->get('role_name'), 'description' => $request->get('role_description')]); |
||
98 | foreach ($request->get('permissions') as $permission) { |
||
99 | $role->givePermissionTo($permission); |
||
100 | } |
||
101 | if($assign_role) |
||
0 ignored issues
–
show
The variable
$assign_role does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() |
|||
102 | { |
||
103 | \Session::flash('message', 'New user role has been created'); |
||
104 | return redirect('staff/policies'); |
||
105 | }else { |
||
106 | return "Mislukt"; |
||
107 | } |
||
108 | } |
||
109 | |||
110 | public function editpolicies($id) |
||
111 | { |
||
112 | $role = Role::find($id); |
||
0 ignored issues
–
show
$role is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
113 | $permissions = Permission::all(); |
||
114 | |||
115 | return view('staff/edit_role', ['permissions' => $permissions]); |
||
116 | } |
||
117 | |||
118 | /** |
||
119 | * |
||
120 | * Remove the user role. |
||
121 | * |
||
122 | */ |
||
123 | public function destroyRole($id) |
||
124 | { |
||
125 | $role = Role::find($id); |
||
126 | $role->delete(); |
||
127 | \Session::flash('message', "User role has been removed from the database"); |
||
128 | return redirect('staff/policies'); |
||
129 | } |
||
130 | |||
131 | |||
132 | /** |
||
133 | * |
||
134 | * Show all permission. |
||
135 | * |
||
136 | */ |
||
137 | public function permissions() |
||
138 | { |
||
139 | $permissions = Permission::all(); |
||
140 | return view('staff/permissions', ['permissions' => $permissions]); |
||
141 | } |
||
142 | |||
143 | /** |
||
144 | * |
||
145 | * Show the form to create a new permission. |
||
146 | * |
||
147 | */ |
||
148 | public function create_permission() |
||
149 | { |
||
150 | return view('staff/create_permission'); |
||
151 | } |
||
152 | |||
153 | /** |
||
154 | * |
||
155 | * Save the new permission. |
||
156 | * |
||
157 | */ |
||
158 | public function save_permission(Request $request) |
||
159 | { |
||
160 | // $permission_name = $request->get('permission_name'); |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
59% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
161 | $permission = Permission::create(['name' => $request->get('permission_name')]); |
||
0 ignored issues
–
show
$permission is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
162 | \Session::flash('message', "The new permission has been added to the database"); |
||
163 | return redirect('staff/permissions'); |
||
164 | } |
||
165 | |||
166 | public function destroy_permission($id) |
||
167 | { |
||
168 | $permission = Permission::find($id); |
||
169 | $permission->delete(); |
||
170 | \Session::flash('message', "Permission has been removed from the database"); |
||
171 | return redirect('staff/permissions'); |
||
172 | } |
||
173 | |||
174 | /** |
||
175 | * Display the specified resource. |
||
176 | * |
||
177 | * @param int $id |
||
178 | * @return \Illuminate\Http\Response |
||
179 | */ |
||
180 | public function show($id) |
||
0 ignored issues
–
show
|
|||
181 | { |
||
182 | // |
||
183 | } |
||
184 | |||
185 | /** |
||
186 | * Show the form for editing the specified resource. |
||
187 | */ |
||
188 | public function edit($id) |
||
189 | { |
||
190 | $user = User::findOrFail($id); |
||
191 | $teams = Teams::all(); |
||
192 | $countries = Countries::all(); |
||
193 | $roles = Role::all(); |
||
194 | return view("staff/edit_user", ['user' => $user, 'teams' => $teams, 'countries' => $countries, 'roles' => $roles]); |
||
195 | } |
||
196 | |||
197 | |||
198 | public function profile() |
||
199 | { |
||
200 | $countries = Countries::all(); |
||
201 | return view("staff/profile", ['countries' => $countries]); |
||
202 | } |
||
203 | |||
204 | /** |
||
205 | * Update the specified resource in storage. |
||
206 | * |
||
207 | * @param \Illuminate\Http\Request $request |
||
208 | * @param int $id |
||
209 | * @return \Illuminate\Http\Response |
||
210 | */ |
||
211 | public function update(Request $request, $id) |
||
212 | { |
||
213 | $user = User::findOrFail($id); |
||
214 | $user->fname = $request->get('email'); |
||
215 | $user->name = $request->get('name'); |
||
216 | $user->email = $request->get('email'); |
||
217 | $user->address = $request->get('address'); |
||
218 | $user->email = '[email protected]'; |
||
219 | $user->save(); |
||
220 | } |
||
221 | |||
222 | /** |
||
223 | * Remove the specified employee from the database. |
||
224 | * |
||
225 | */ |
||
226 | public function destroy($id) |
||
227 | { |
||
228 | User::Destroy($id); |
||
229 | session()->flash('message', "User has been removed from the database"); |
||
230 | return redirect('staff'); |
||
231 | } |
||
232 | } |
||
233 |
Since your code implements the magic setter
_set
, this function will be called for any write access on an undefined variable. You can add the@property
annotation to your class or interface to document the existence of this variable.Since the property has write access only, you can use the @property-write annotation instead.
Of course, you may also just have mistyped another name, in which case you should fix the error.
See also the PhpDoc documentation for @property.