This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace app\models; |
||
4 | |||
5 | use Yii; |
||
6 | |||
7 | /** |
||
8 | * This is the model class for table "content". |
||
9 | * |
||
10 | * @property int $id |
||
11 | * @property string $name |
||
12 | * @property string $description |
||
13 | * @property int $flow_id |
||
14 | * @property string $type_id |
||
15 | * @property string $data |
||
16 | * @property int $duration |
||
17 | * @property string $start_ts |
||
18 | * @property string $end_ts |
||
19 | * @property string $add_ts |
||
20 | * @property bool $enabled |
||
21 | * @property Flow $flow |
||
22 | * @property ContentType $type |
||
23 | */ |
||
24 | class Content extends \yii\db\ActiveRecord |
||
25 | { |
||
26 | /** |
||
27 | * {@inheritdoc} |
||
28 | */ |
||
29 | public static function tableName() |
||
30 | { |
||
31 | return 'content'; |
||
32 | } |
||
33 | |||
34 | /** |
||
35 | * {@inheritdoc} |
||
36 | */ |
||
37 | public function rules() |
||
38 | { |
||
39 | return array_merge([ |
||
40 | [['name', 'flow_id', 'type_id'], 'required'], |
||
41 | [['flow_id', 'duration'], 'integer'], |
||
42 | [['data'], 'string'], |
||
43 | [['start_ts', 'end_ts', 'add_ts'], 'safe'], |
||
44 | [['enabled'], 'boolean'], |
||
45 | [['name'], 'string', 'max' => 64], |
||
46 | [['type_id'], 'string', 'max' => 45], |
||
47 | [['description'], 'string', 'max' => 1024], |
||
48 | [['flow_id'], 'exist', 'skipOnError' => true, 'targetClass' => Flow::class, 'targetAttribute' => ['flow_id' => 'id']], |
||
49 | [['type_id'], 'exist', 'skipOnError' => true, 'targetClass' => ContentType::class, 'targetAttribute' => ['type_id' => 'id']], |
||
50 | ], $this->type ? $this->type->contentRules() : []); |
||
51 | } |
||
52 | |||
53 | /** |
||
54 | * {@inheritdoc} |
||
55 | */ |
||
56 | public function attributeLabels() |
||
57 | { |
||
58 | return array_merge([ |
||
59 | 'id' => Yii::t('app', 'ID'), |
||
60 | 'name' => Yii::t('app', 'Name'), |
||
61 | 'description' => Yii::t('app', 'Description'), |
||
62 | 'flow_id' => Yii::t('app', 'Flow'), |
||
63 | 'type_id' => Yii::t('app', 'Type'), |
||
64 | 'data' => Yii::t('app', 'Content'), |
||
65 | 'duration' => Yii::t('app', 'Duration in seconds'), |
||
66 | 'start_ts' => Yii::t('app', 'Start at'), |
||
67 | 'end_ts' => Yii::t('app', 'End on'), |
||
68 | 'add_ts' => Yii::t('app', 'Added at'), |
||
69 | 'enabled' => Yii::t('app', 'Enabled'), |
||
70 | ], $this->type ? $this->type->contentLabels() : []); |
||
71 | } |
||
72 | |||
73 | /** |
||
74 | * @return \yii\db\ActiveQuery |
||
75 | */ |
||
76 | public function getFlow() |
||
77 | { |
||
78 | return $this->hasOne(Flow::class, ['id' => 'flow_id']); |
||
79 | } |
||
80 | |||
81 | /** |
||
82 | * @return \yii\db\ActiveQuery |
||
83 | */ |
||
84 | public function getType() |
||
85 | { |
||
86 | return $this->hasOne(ContentType::class, ['id' => 'type_id']); |
||
87 | } |
||
88 | |||
89 | /** |
||
90 | * Build a query for a specific user, allowing to see only authorized contents. |
||
91 | * |
||
92 | * @param \yii\web\User $user |
||
93 | * |
||
94 | * @return \yii\db\ActiveQuery |
||
95 | */ |
||
96 | public static function availableQuery($user) |
||
97 | { |
||
98 | if ($user->can('setFlowContent')) { |
||
99 | return self::find()->joinWith(['type']); |
||
100 | View Code Duplication | } elseif ($user->can('setOwnFlowContent') && $user->identity instanceof \app\models\User) { |
|
0 ignored issues
–
show
|
|||
101 | return self::find()->joinWith(['type', 'flow.users'])->where(['username' => $user->identity->username]); |
||
102 | } |
||
103 | } |
||
104 | |||
105 | /** |
||
106 | * Check if a specific user is allowed to see this content. |
||
107 | * |
||
108 | * @param \yii\web\User $user |
||
109 | * |
||
110 | * @return bool can see |
||
111 | */ |
||
112 | View Code Duplication | public function canView($user) |
|
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
113 | { |
||
114 | if ($user->can('setFlowContent')) { |
||
115 | return true; |
||
116 | } |
||
117 | if ($user->can('setOwnFlowContent') && in_array($user->identity, $this->flow->users)) { |
||
118 | return true; |
||
119 | } |
||
120 | |||
121 | return false; |
||
122 | } |
||
123 | |||
124 | /** |
||
125 | * Get raw data and transform it to content type specific needs. |
||
126 | * |
||
127 | * @param string $data |
||
128 | * |
||
129 | * @return string transformed data |
||
130 | */ |
||
131 | public function processData($data) |
||
132 | { |
||
133 | return $this->type->processData($data); |
||
134 | } |
||
135 | |||
136 | /** |
||
137 | * Retrieve data for content |
||
138 | * Transforming it if necessary (mostly urls). |
||
139 | * |
||
140 | * @return string|null usable data |
||
141 | */ |
||
142 | public function getData() |
||
143 | { |
||
144 | $data = $this->data; |
||
145 | if ($this->type->appendParams) { |
||
146 | $data .= (strpos($data, '#') === false ? '#' : ';') . $this->type->appendParams; |
||
147 | } |
||
148 | |||
149 | $data = $this->processData($data); |
||
150 | if ($data === null) { |
||
151 | return null; |
||
152 | } |
||
153 | |||
154 | $data = str_replace('%name%', $this->name, $data); |
||
155 | $data = str_replace('%description%', $this->description, $data); |
||
156 | $data = str_replace('%dur%', $this->duration, $data); |
||
157 | |||
158 | if ($this->type->html) { |
||
159 | return str_replace('%data%', $data, $this->type->html); |
||
160 | } |
||
161 | |||
162 | return $data; |
||
163 | } |
||
164 | |||
165 | public function beforeSave($insert) |
||
166 | { |
||
167 | if (!parent::beforeSave($insert)) { |
||
168 | return false; |
||
169 | } |
||
170 | |||
171 | $res = $this->type->transformDataBeforeSave($insert, $this->data); |
||
172 | if ($res == null) { |
||
173 | return false; |
||
174 | } |
||
175 | |||
176 | $this->data = $res; |
||
177 | |||
178 | return true; |
||
179 | } |
||
180 | |||
181 | /** |
||
182 | * After delete event |
||
183 | * Try to delete file if necessary. |
||
184 | */ |
||
185 | public function afterDelete() |
||
186 | { |
||
187 | if ($this->shouldDeleteFile()) { |
||
188 | unlink($this->getRealFilepath()); |
||
189 | } |
||
190 | parent::afterDelete(); |
||
191 | } |
||
192 | |||
193 | /** |
||
194 | * Decide if content file should be deleted by checking usage in DB. |
||
195 | * |
||
196 | * @return bool deletable |
||
197 | */ |
||
198 | protected function shouldDeleteFile() |
||
199 | { |
||
200 | if ($this->type->input == ContentType::KINDS['FILE']) { |
||
201 | return self::find() |
||
202 | ->joinWith(['type']) |
||
203 | ->where([ContentType::tableName() . '.id' => ContentType::getAllFileTypeIds()]) |
||
204 | ->andWhere(['data' => $this->data]) |
||
205 | ->count() == 0; |
||
206 | } |
||
207 | |||
208 | return false; |
||
209 | } |
||
210 | |||
211 | /** |
||
212 | * Get filepath from web root. |
||
213 | * |
||
214 | * @return string filepath |
||
215 | */ |
||
216 | public function getFilepath() |
||
217 | { |
||
218 | $type = $this->type; |
||
219 | |||
220 | return str_replace($type::BASE_URI, '', $this->getWebFilepath()); |
||
221 | } |
||
222 | |||
223 | /** |
||
224 | * Get Yii aliased filepath. |
||
225 | * |
||
226 | * @return string filepath |
||
227 | */ |
||
228 | public function getWebFilepath() |
||
229 | { |
||
230 | return $this->data; |
||
231 | } |
||
232 | |||
233 | /** |
||
234 | * Get filesystem filepath. |
||
235 | * |
||
236 | * @return string filepath |
||
237 | */ |
||
238 | public function getRealFilepath() |
||
239 | { |
||
240 | return \Yii::getAlias('@app/') . 'web/' . $this->getFilepath(); |
||
241 | } |
||
242 | } |
||
243 |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.