This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace Lexik\Bundle\PayboxBundle\Paybox\System\Base; |
||
| 4 | |||
| 5 | use Lexik\Bundle\PayboxBundle\Paybox\AbstractRequest; |
||
| 6 | use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException; |
||
| 7 | use Symfony\Component\Form\Form; |
||
| 8 | use Symfony\Component\Form\FormFactoryInterface; |
||
| 9 | use Symfony\Component\HttpKernel\Kernel; |
||
| 10 | |||
| 11 | /** |
||
| 12 | * Class Request |
||
| 13 | * |
||
| 14 | * @package Lexik\Bundle\PayboxBundle\Paybox\System\Base |
||
| 15 | * |
||
| 16 | * @author Lexik <[email protected]> |
||
| 17 | * @author Olivier Maisonneuve <[email protected]> |
||
| 18 | */ |
||
| 19 | class Request extends AbstractRequest |
||
| 20 | { |
||
| 21 | /** |
||
| 22 | * @var FormFactoryInterface |
||
| 23 | */ |
||
| 24 | protected $factory; |
||
| 25 | |||
| 26 | /** |
||
| 27 | * Constructor. |
||
| 28 | * |
||
| 29 | * @param array $parameters |
||
| 30 | * @param array $servers |
||
| 31 | * @param FormFactoryInterface $factory |
||
| 32 | * |
||
| 33 | * @throws InvalidConfigurationException If the hash_hmac() function of PECL hash is not available. |
||
| 34 | */ |
||
| 35 | public function __construct(array $parameters, array $servers, FormFactoryInterface $factory) |
||
| 36 | { |
||
| 37 | if (!function_exists('hash_hmac')) { |
||
| 38 | throw new InvalidConfigurationException('Function "hash_hmac()" unavailable. You need to install "PECL hash >= 1.1".'); |
||
| 39 | } |
||
| 40 | |||
| 41 | parent::__construct($parameters, $servers['system']); |
||
| 42 | |||
| 43 | $this->factory = $factory; |
||
| 44 | } |
||
| 45 | |||
| 46 | /** |
||
| 47 | * {@inheritdoc} |
||
| 48 | */ |
||
| 49 | View Code Duplication | protected function initGlobals(array $parameters) |
|
|
0 ignored issues
–
show
|
|||
| 50 | { |
||
| 51 | $this->globals = array( |
||
| 52 | 'production' => isset($parameters['production']) ? $parameters['production'] : false, |
||
| 53 | 'currencies' => $parameters['currencies'], |
||
| 54 | 'site' => $parameters['site'], |
||
| 55 | 'rank' => $parameters['rank'], |
||
| 56 | 'login' => $parameters['login'], |
||
| 57 | 'hmac_key' => $parameters['hmac']['key'], |
||
| 58 | 'hmac_algorithm' => $parameters['hmac']['algorithm'], |
||
| 59 | 'hmac_signature_name' => $parameters['hmac']['signature_name'], |
||
| 60 | ); |
||
| 61 | } |
||
| 62 | |||
| 63 | /** |
||
| 64 | * {@inheritdoc} |
||
| 65 | */ |
||
| 66 | protected function initParameters() |
||
| 67 | { |
||
| 68 | $this->setParameter('PBX_SITE', $this->globals['site']); |
||
| 69 | $this->setParameter('PBX_RANG', $this->globals['rank']); |
||
| 70 | $this->setParameter('PBX_IDENTIFIANT', $this->globals['login']); |
||
| 71 | $this->setParameter('PBX_HASH', $this->globals['hmac_algorithm']); |
||
| 72 | } |
||
| 73 | |||
| 74 | /** |
||
| 75 | * Sets a parameter. |
||
| 76 | * |
||
| 77 | * @param string $name |
||
| 78 | * @param mixed $value |
||
| 79 | * |
||
| 80 | * @return Request |
||
| 81 | */ |
||
| 82 | public function setParameter($name, $value) |
||
| 83 | { |
||
| 84 | /** |
||
| 85 | * PBX_RETOUR have to be ended by ";Sign:K" |
||
| 86 | */ |
||
| 87 | if ('PBX_RETOUR' == $name = strtoupper($name)) { |
||
| 88 | $value = $this->verifyReturnParameter($value); |
||
| 89 | } |
||
| 90 | |||
| 91 | return parent::setParameter($name, $value); |
||
| 92 | } |
||
| 93 | |||
| 94 | /** |
||
| 95 | * Parameter PBX_RETOUR must contain the string ";Sign:K" at the end for ipn signature verification. |
||
| 96 | * |
||
| 97 | * @param string $value |
||
| 98 | * |
||
| 99 | * @return string |
||
| 100 | */ |
||
| 101 | protected function verifyReturnParameter($value) |
||
| 102 | { |
||
| 103 | if (false !== preg_match('`[^\:]+\:k`i', $value)) { |
||
| 104 | $vars = explode(';', $value); |
||
| 105 | |||
| 106 | array_walk($vars, function ($value, $key) use (&$vars) { |
||
| 107 | if (false !== stripos($value, ':K')) { |
||
| 108 | unset($vars[$key]); |
||
| 109 | } |
||
| 110 | }); |
||
| 111 | |||
| 112 | $value = implode(';', $vars); |
||
| 113 | } |
||
| 114 | |||
| 115 | return sprintf( |
||
| 116 | '%s;%s:K', |
||
| 117 | $value, |
||
| 118 | $this->globals['hmac_signature_name'] |
||
| 119 | ); |
||
| 120 | } |
||
| 121 | |||
| 122 | /** |
||
| 123 | * Returns all parameters set for a payment. |
||
| 124 | * |
||
| 125 | * @return array |
||
| 126 | */ |
||
| 127 | View Code Duplication | public function getParameters() |
|
|
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
|
|||
| 128 | { |
||
| 129 | if (null === $this->getParameter('PBX_HMAC')) { |
||
| 130 | $this->setParameter('PBX_TIME', date('c')); |
||
| 131 | $this->setParameter('PBX_HMAC', strtoupper($this->computeHmac())); |
||
| 132 | } |
||
| 133 | |||
| 134 | $resolver = new ParameterResolver($this->globals['currencies']); |
||
| 135 | |||
| 136 | return $resolver->resolve($this->parameters); |
||
| 137 | } |
||
| 138 | |||
| 139 | /** |
||
| 140 | * Returns a form with defined parameters. |
||
| 141 | * |
||
| 142 | * @param array $options |
||
| 143 | * |
||
| 144 | * @return Form |
||
| 145 | */ |
||
| 146 | public function getForm($options = array()) |
||
| 147 | { |
||
| 148 | $options['csrf_protection'] = false; |
||
| 149 | |||
| 150 | $parameters = $this->getParameters(); |
||
| 151 | // If symfony version is >=2.8 then we use the FQCN for form types |
||
| 152 | // Else we use the IDs. |
||
| 153 | if (method_exists('Symfony\Component\Form\AbstractType', 'getBlockPrefix')) { |
||
| 154 | $builder = $this->factory->createNamedBuilder( |
||
| 155 | '', |
||
| 156 | 'Symfony\Component\Form\Extension\Core\Type\FormType', |
||
| 157 | $parameters, |
||
| 158 | $options |
||
| 159 | ); |
||
| 160 | foreach ($parameters as $key => $value) { |
||
| 161 | $builder->add($key, 'Symfony\Component\Form\Extension\Core\Type\HiddenType'); |
||
| 162 | } |
||
| 163 | } else { |
||
| 164 | $builder = $this->factory->createNamedBuilder('', 'form', $parameters, $options); |
||
| 165 | foreach ($parameters as $key => $value) { |
||
| 166 | $builder->add($key, 'hidden'); |
||
| 167 | } |
||
| 168 | } |
||
| 169 | |||
| 170 | return $builder->getForm(); |
||
| 171 | } |
||
| 172 | |||
| 173 | /** |
||
| 174 | * {@inheritdoc} |
||
| 175 | */ |
||
| 176 | public function getUrl() |
||
| 177 | { |
||
| 178 | $server = $this->getServer(); |
||
| 179 | |||
| 180 | return sprintf( |
||
| 181 | '%s://%s%s', |
||
| 182 | $server['protocol'], |
||
| 183 | $server['host'], |
||
| 184 | $server['system_path'] |
||
| 185 | ); |
||
| 186 | } |
||
| 187 | } |
||
| 188 |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.