kiy0taka /
ec-cube
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /* |
||
| 3 | * This file is part of EC-CUBE |
||
| 4 | * |
||
| 5 | * Copyright(c) 2000-2015 LOCKON CO.,LTD. All Rights Reserved. |
||
| 6 | * |
||
| 7 | * http://www.lockon.co.jp/ |
||
| 8 | * |
||
| 9 | * This program is free software; you can redistribute it and/or |
||
| 10 | * modify it under the terms of the GNU General Public License |
||
| 11 | * as published by the Free Software Foundation; either version 2 |
||
| 12 | * of the License, or (at your option) any later version. |
||
| 13 | * |
||
| 14 | * This program is distributed in the hope that it will be useful, |
||
| 15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 17 | * GNU General Public License for more details. |
||
| 18 | * |
||
| 19 | * You should have received a copy of the GNU General Public License |
||
| 20 | * along with this program; if not, write to the Free Software |
||
| 21 | * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
||
| 22 | */ |
||
| 23 | |||
| 24 | |||
| 25 | namespace Eccube\Controller; |
||
| 26 | |||
| 27 | use Eccube\Application; |
||
| 28 | use Eccube\Entity\Master\CustomerStatus; |
||
| 29 | use Eccube\Event\EccubeEvents; |
||
| 30 | use Eccube\Event\EventArgs; |
||
| 31 | use Symfony\Component\HttpFoundation\Request; |
||
| 32 | use Symfony\Component\HttpKernel\Exception as HttpException; |
||
| 33 | use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken; |
||
| 34 | use Symfony\Component\Validator\Constraints as Assert; |
||
| 35 | |||
| 36 | class EntryController extends AbstractController |
||
|
0 ignored issues
–
show
introduced
by
Loading history...
|
|||
| 37 | { |
||
| 38 | |||
| 39 | /** |
||
| 40 | * 会員登録画面. |
||
| 41 | * |
||
| 42 | * @param Application $app |
||
| 43 | * @param Request $request |
||
|
0 ignored issues
–
show
|
|||
| 44 | * @return \Symfony\Component\HttpFoundation\Response |
||
| 45 | */ |
||
| 46 | 8 | public function index(Application $app, Request $request) |
|
| 47 | { |
||
| 48 | 8 | if ($app->isGranted('ROLE_USER')) { |
|
| 49 | log_info('認証済のためログイン処理をスキップ'); |
||
| 50 | |||
| 51 | return $app->redirect($app->url('mypage')); |
||
| 52 | } |
||
| 53 | |||
| 54 | /** @var $Customer \Eccube\Entity\Customer */ |
||
| 55 | 8 | $Customer = $app['eccube.repository.customer']->newCustomer(); |
|
| 56 | |||
| 57 | /* @var $builder \Symfony\Component\Form\FormBuilderInterface */ |
||
| 58 | 8 | $builder = $app['form.factory']->createBuilder('entry', $Customer); |
|
| 59 | |||
| 60 | 8 | $event = new EventArgs( |
|
| 61 | array( |
||
| 62 | 8 | 'builder' => $builder, |
|
| 63 | 8 | 'Customer' => $Customer, |
|
| 64 | ), |
||
| 65 | $request |
||
| 66 | ); |
||
| 67 | 8 | $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_ENTRY_INDEX_INITIALIZE, $event); |
|
| 68 | |||
| 69 | /* @var $form \Symfony\Component\Form\FormInterface */ |
||
| 70 | 8 | $form = $builder->getForm(); |
|
| 71 | |||
| 72 | 8 | $form->handleRequest($request); |
|
| 73 | |||
| 74 | 8 | if ($form->isSubmitted() && $form->isValid()) { |
|
| 75 | 5 | switch ($request->get('mode')) { |
|
| 76 | 5 | case 'confirm': |
|
| 77 | 2 | log_info('会員登録確認開始'); |
|
| 78 | 2 | $builder->setAttribute('freeze', true); |
|
| 79 | 2 | $form = $builder->getForm(); |
|
| 80 | 2 | $form->handleRequest($request); |
|
| 81 | 2 | log_info('会員登録確認完了'); |
|
| 82 | |||
| 83 | 2 | return $app->render('Entry/confirm.twig', array( |
|
| 84 | 2 | 'form' => $form->createView(), |
|
| 85 | )); |
||
| 86 | |||
| 87 | 3 | case 'complete': |
|
| 88 | 2 | log_info('会員登録開始'); |
|
| 89 | $Customer |
||
| 90 | 2 | ->setSalt( |
|
| 91 | 2 | $app['eccube.repository.customer']->createSalt(5) |
|
| 92 | ) |
||
| 93 | 2 | ->setPassword( |
|
| 94 | 2 | $app['eccube.repository.customer']->encryptPassword($app, $Customer) |
|
| 95 | ) |
||
| 96 | 2 | ->setSecretKey( |
|
| 97 | 2 | $app['eccube.repository.customer']->getUniqueSecretKey($app) |
|
| 98 | ); |
||
| 99 | |||
| 100 | 2 | $CustomerAddress = new \Eccube\Entity\CustomerAddress(); |
|
| 101 | $CustomerAddress |
||
| 102 | 2 | ->setFromCustomer($Customer); |
|
| 103 | |||
| 104 | 2 | $app['orm.em']->persist($Customer); |
|
| 105 | 2 | $app['orm.em']->persist($CustomerAddress); |
|
| 106 | 2 | $app['orm.em']->flush(); |
|
| 107 | |||
| 108 | 2 | log_info('会員登録完了'); |
|
| 109 | |||
| 110 | 2 | $event = new EventArgs( |
|
| 111 | array( |
||
| 112 | 2 | 'form' => $form, |
|
| 113 | 2 | 'Customer' => $Customer, |
|
| 114 | 2 | 'CustomerAddress' => $CustomerAddress, |
|
| 115 | ), |
||
| 116 | $request |
||
| 117 | ); |
||
| 118 | 2 | $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_ENTRY_INDEX_COMPLETE, $event); |
|
| 119 | |||
| 120 | 2 | $activateUrl = $app->url('entry_activate', array('secret_key' => $Customer->getSecretKey())); |
|
| 121 | |||
| 122 | /** @var $BaseInfo \Eccube\Entity\BaseInfo */ |
||
| 123 | 2 | $BaseInfo = $app['eccube.repository.base_info']->get(); |
|
| 124 | 2 | $activateFlg = $BaseInfo->getOptionCustomerActivate(); |
|
| 125 | |||
| 126 | // 仮会員設定が有効な場合は、確認メールを送信し完了画面表示. |
||
| 127 | 2 | if ($activateFlg) { |
|
| 128 | // メール送信 |
||
| 129 | 2 | $app['eccube.service.mail']->sendCustomerConfirmMail($Customer, $activateUrl); |
|
| 130 | |||
| 131 | 2 | if ($event->hasResponse()) { |
|
| 132 | return $event->getResponse(); |
||
| 133 | } |
||
| 134 | |||
| 135 | 2 | log_info('仮会員登録完了画面へリダイレクト'); |
|
| 136 | |||
| 137 | 2 | return $app->redirect($app->url('entry_complete')); |
|
| 138 | // 仮会員設定が無効な場合は認証URLへ遷移させ、会員登録を完了させる. |
||
| 139 | } else { |
||
| 140 | log_info('本会員登録画面へリダイレクト'); |
||
| 141 | |||
| 142 | 1 | return $app->redirect($activateUrl); |
|
| 143 | } |
||
| 144 | } |
||
| 145 | } |
||
| 146 | |||
| 147 | 4 | return $app->render('Entry/index.twig', array( |
|
| 148 | 4 | 'form' => $form->createView(), |
|
| 149 | )); |
||
| 150 | } |
||
| 151 | |||
| 152 | /** |
||
| 153 | * 会員登録完了画面. |
||
| 154 | * |
||
| 155 | * @param Application $app |
||
| 156 | * @return \Symfony\Component\HttpFoundation\Response |
||
| 157 | */ |
||
| 158 | 1 | public function complete(Application $app) |
|
| 159 | { |
||
| 160 | 1 | return $app->render('Entry/complete.twig', array()); |
|
| 161 | } |
||
| 162 | |||
| 163 | /** |
||
|
0 ignored issues
–
show
|
|||
| 164 | * 会員のアクティベート(本会員化)を行う. |
||
| 165 | * |
||
| 166 | * @param Application $app |
||
| 167 | * @param Request $request |
||
|
0 ignored issues
–
show
|
|||
| 168 | * @param $secret_key |
||
|
0 ignored issues
–
show
|
|||
| 169 | * @return \Symfony\Component\HttpFoundation\Response |
||
| 170 | */ |
||
| 171 | 4 | public function activate(Application $app, Request $request, $secret_key) |
|
| 172 | { |
||
| 173 | 4 | $errors = $app['validator']->validateValue($secret_key, array( |
|
|
0 ignored issues
–
show
|
|||
| 174 | 4 | new Assert\NotBlank(), |
|
| 175 | 4 | new Assert\Regex(array( |
|
| 176 | 4 | 'pattern' => '/^[a-zA-Z0-9]+$/', |
|
| 177 | )) |
||
| 178 | ) |
||
| 179 | ); |
||
| 180 | |||
| 181 | 4 | if ($request->getMethod() === 'GET' && count($errors) === 0) { |
|
| 182 | 3 | log_info('本会員登録開始'); |
|
| 183 | try { |
||
| 184 | 3 | $Customer = $app['eccube.repository.customer'] |
|
| 185 | 3 | ->getNonActiveCustomerBySecretKey($secret_key); |
|
| 186 | 1 | } catch (\Exception $e) { |
|
| 187 | 1 | throw new HttpException\NotFoundHttpException('※ 既に会員登録が完了しているか、無効なURLです。'); |
|
| 188 | } |
||
| 189 | |||
| 190 | 2 | $CustomerStatus = $app['eccube.repository.customer_status']->find(CustomerStatus::ACTIVE); |
|
| 191 | 2 | $Customer->setStatus($CustomerStatus); |
|
| 192 | 2 | $app['orm.em']->persist($Customer); |
|
| 193 | 2 | $app['orm.em']->flush(); |
|
| 194 | |||
| 195 | 2 | log_info('本会員登録完了'); |
|
| 196 | |||
| 197 | 2 | $event = new EventArgs( |
|
| 198 | array( |
||
| 199 | 2 | 'Customer' => $Customer, |
|
| 200 | ), |
||
| 201 | $request |
||
| 202 | ); |
||
| 203 | 2 | $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_ENTRY_ACTIVATE_COMPLETE, $event); |
|
| 204 | |||
| 205 | // メール送信 |
||
| 206 | 2 | $app['eccube.service.mail']->sendCustomerCompleteMail($Customer); |
|
| 207 | |||
| 208 | // 本会員登録してログイン状態にする |
||
| 209 | 2 | $token = new UsernamePasswordToken($Customer, null, 'customer', array('ROLE_USER')); |
|
| 210 | 2 | $this->getSecurity($app)->setToken($token); |
|
| 211 | |||
| 212 | 2 | log_info('ログイン済に変更', array($app->user()->getId())); |
|
| 213 | |||
| 214 | 2 | return $app->render('Entry/activate.twig'); |
|
| 215 | } else { |
||
| 216 | 1 | throw new HttpException\AccessDeniedHttpException('不正なアクセスです。'); |
|
| 217 | } |
||
| 218 | } |
||
| 219 | } |
||
| 220 |