This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace DoS\UserBundle\Confirmation; |
||
4 | |||
5 | use Doctrine\Common\Persistence\ObjectManager; |
||
6 | use DoS\UserBundle\Confirmation\Exception\ConfirmationException; |
||
7 | use DoS\UserBundle\Confirmation\Exception\InvalidTokenResendTimeException; |
||
8 | use DoS\UserBundle\Confirmation\Model\ResendInterface; |
||
9 | use DoS\UserBundle\Confirmation\Model\VerificationInterface; |
||
10 | use Sylius\Component\Storage\StorageInterface; |
||
11 | use Sylius\Component\User\Security\TokenProviderInterface; |
||
12 | use Symfony\Component\Form\FormError; |
||
13 | use Symfony\Component\Form\FormFactoryInterface; |
||
14 | use Symfony\Component\HttpFoundation\Request; |
||
15 | use Symfony\Component\OptionsResolver\OptionsResolver; |
||
16 | use Symfony\Component\Translation\TranslatorInterface; |
||
17 | |||
18 | abstract class ConfirmationAbstract implements ConfirmationInterface |
||
19 | { |
||
20 | /** |
||
21 | * @var ObjectManager |
||
22 | */ |
||
23 | protected $manager; |
||
24 | |||
25 | /** |
||
26 | * @var ConfirmationSubjectFinderInterface |
||
27 | */ |
||
28 | protected $finder; |
||
29 | |||
30 | /** |
||
31 | * @var StorageInterface |
||
32 | */ |
||
33 | protected $storage; |
||
34 | |||
35 | /** |
||
36 | * @var TokenProviderInterface |
||
37 | */ |
||
38 | protected $tokenProvider; |
||
39 | |||
40 | /** |
||
41 | * @var SenderInterface |
||
42 | */ |
||
43 | protected $sender; |
||
44 | |||
45 | /** |
||
46 | * @var FormFactoryInterface |
||
47 | */ |
||
48 | protected $formFactory; |
||
49 | |||
50 | /** |
||
51 | * @var TranslatorInterface |
||
52 | */ |
||
53 | protected $translator; |
||
54 | |||
55 | /** |
||
56 | * @var array |
||
57 | */ |
||
58 | protected $options = array(); |
||
59 | |||
60 | /** |
||
61 | * @var bool |
||
62 | */ |
||
63 | protected $isValid = true; |
||
64 | |||
65 | public function __construct( |
||
66 | ObjectManager $manager, |
||
67 | ConfirmationSubjectFinderInterface $finder, |
||
68 | SenderInterface $sender, |
||
69 | StorageInterface $storage, |
||
70 | TokenProviderInterface $tokenProvider, |
||
71 | FormFactoryInterface $formFactory, |
||
72 | TranslatorInterface $translator, |
||
73 | array $options = array() |
||
74 | ) { |
||
75 | $this->manager = $manager; |
||
76 | $this->finder = $finder; |
||
77 | $this->storage = $storage; |
||
78 | $this->tokenProvider = $tokenProvider; |
||
79 | $this->sender = $sender; |
||
80 | $this->formFactory = $formFactory; |
||
81 | $this->translator = $translator; |
||
82 | |||
83 | $this->resetOptions($options); |
||
84 | } |
||
85 | |||
86 | /** |
||
87 | * @param $id |
||
88 | * @param array $parameters |
||
89 | * @param string $domain |
||
90 | * @param null $local |
||
91 | * @return string |
||
92 | */ |
||
93 | private function trans($id, array $parameters = array(), $domain = 'validators', $local = null) |
||
94 | { |
||
95 | return $this->translator->trans($id, $parameters, $domain, $local); |
||
96 | } |
||
97 | |||
98 | /** |
||
99 | * {@inheritdoc} |
||
100 | */ |
||
101 | public function getTokenResendTimeAware() |
||
102 | { |
||
103 | return $this->options['token_resend_time_aware']; |
||
104 | } |
||
105 | |||
106 | /** |
||
107 | * {@inheritdoc} |
||
108 | */ |
||
109 | public function getTargetChannel() |
||
110 | { |
||
111 | return $this->options['channel_path']; |
||
112 | } |
||
113 | |||
114 | /** |
||
115 | * {@inheritdoc} |
||
116 | */ |
||
117 | public function resetOptions(array $options) |
||
118 | { |
||
119 | $resolver = new OptionsResolver(); |
||
120 | $this->configureOptions($resolver); |
||
121 | |||
122 | $this->options = $resolver->resolve($options); |
||
123 | } |
||
124 | |||
125 | /** |
||
126 | * {@inheritdoc} |
||
127 | */ |
||
128 | public function setValid($valid) |
||
129 | { |
||
130 | $this->isValid = $valid; |
||
131 | } |
||
132 | |||
133 | /** |
||
134 | * {@inheritdoc} |
||
135 | */ |
||
136 | public function send(ConfirmationSubjectInterface $subject) |
||
137 | { |
||
138 | $subject->confirmationDisableAccess(); |
||
139 | $subject->setConfirmationType($this->getType()); |
||
140 | $subject->confirmationRequest( |
||
141 | $token = $this->tokenProvider->generateUniqueToken() |
||
142 | ); |
||
143 | |||
144 | $this->sendToken($subject, $token); |
||
145 | |||
146 | if (!$this->isValid) { |
||
147 | return; |
||
148 | } |
||
149 | |||
150 | $this->manager->persist($subject); |
||
151 | $this->manager->flush(); |
||
152 | |||
153 | $this->storage->setData(self::STORE_KEY, $subject->getConfirmationToken()); |
||
154 | } |
||
155 | |||
156 | /** |
||
157 | * {@inheritdoc} |
||
158 | */ |
||
159 | public function resend(Request $request) |
||
160 | { |
||
161 | $form = $this->createResendForm(); |
||
162 | $data = $form->getData(); |
||
163 | |||
164 | if (in_array($request->getMethod(), array('POST', 'PUT', 'PATCH')) |
||
165 | && $form->handleRequest($request)->isValid()) { |
||
166 | try { |
||
167 | $this->canResend($data->getSubject()); |
||
168 | } catch (\Exception $e) { |
||
169 | $form->addError(new FormError($this->trans($e->getMessage()))); |
||
170 | } |
||
171 | |||
172 | if (!$form->getErrors(true)->count()) { |
||
173 | $this->send($data->getSubject()); |
||
174 | } |
||
175 | } |
||
176 | |||
177 | return $form; |
||
178 | } |
||
179 | |||
180 | protected function successVerify(ConfirmationSubjectInterface $subject) |
||
181 | { |
||
182 | $subject->confirmationConfirm(); |
||
183 | $subject->confirmationEnableAccess(); |
||
184 | |||
185 | $this->storage->removeData(self::STORE_KEY); |
||
186 | $this->manager->persist($subject); |
||
187 | $this->manager->flush(); |
||
188 | } |
||
189 | |||
190 | /** |
||
191 | * {@inheritdoc} |
||
192 | */ |
||
193 | public function getStoredToken($clear = false) |
||
194 | { |
||
195 | if ($this->storage->hasData(self::STORE_KEY)) { |
||
196 | $token = $this->storage->getData(self::STORE_KEY); |
||
197 | |||
198 | if ($clear) { |
||
199 | $this->storage->removeData(self::STORE_KEY); |
||
200 | } |
||
201 | |||
202 | return $token; |
||
203 | } |
||
204 | |||
205 | return; |
||
206 | } |
||
207 | |||
208 | /** |
||
209 | * {@inheritdoc} |
||
210 | */ |
||
211 | public function getObjectPath() |
||
212 | { |
||
213 | $paths = explode('.', $this->options['channel_path']); |
||
214 | |||
215 | return $paths[count($paths) - 1]; |
||
216 | } |
||
217 | |||
218 | /** |
||
219 | * {@inheritdoc} |
||
220 | */ |
||
221 | View Code Duplication | public function findSubjectWithToken($token) |
|
0 ignored issues
–
show
|
|||
222 | { |
||
223 | if (empty($token)) { |
||
224 | return null; |
||
225 | } |
||
226 | |||
227 | try { |
||
228 | $subject = $this->finder->findConfirmationSubject($this->options['token_property_path'], $token); |
||
229 | } catch (\Exception $e) { |
||
230 | $subject = null; |
||
231 | } |
||
232 | |||
233 | return $subject; |
||
234 | } |
||
235 | |||
236 | /** |
||
237 | * {@inheritdoc} |
||
238 | */ |
||
239 | View Code Duplication | public function findSubject($value) |
|
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
240 | { |
||
241 | if (empty($value)) { |
||
242 | return null; |
||
243 | } |
||
244 | |||
245 | try { |
||
246 | $subject = $this->finder->findConfirmationSubject($this->options['channel_path'], $value); |
||
247 | } catch (\Exception $e) { |
||
248 | $subject = null; |
||
249 | } |
||
250 | |||
251 | return $subject; |
||
252 | } |
||
253 | |||
254 | /** |
||
255 | * {@inheritdoc} |
||
256 | */ |
||
257 | public function getSubjectValue(ConfirmationSubjectInterface $subject = null) |
||
258 | { |
||
259 | if (!$subject) { |
||
260 | return; |
||
261 | } |
||
262 | |||
263 | return $subject->getConfirmationChannel($this->options['channel_path']); |
||
264 | } |
||
265 | |||
266 | /** |
||
267 | * @param ConfirmationSubjectInterface $subject |
||
268 | * |
||
269 | * @return bool |
||
270 | */ |
||
271 | protected function validateTimeAware(ConfirmationSubjectInterface $subject) |
||
272 | { |
||
273 | if (null === $time = $this->getTokenTimeAware($subject)) { |
||
274 | return true; |
||
275 | } |
||
276 | |||
277 | return $time->getTimestamp() > (new \DateTime())->getTimestamp(); |
||
278 | } |
||
279 | |||
280 | /** |
||
281 | * {@inheritdoc} |
||
282 | */ |
||
283 | public function getTokenTimeAware(ConfirmationSubjectInterface $subject = null) |
||
284 | { |
||
285 | if (null === $subject || null === $timeAware = $this->options['token_time_aware']) { |
||
286 | return; |
||
287 | } |
||
288 | |||
289 | if (!$time = $subject->getConfirmationRequestedAt()) { |
||
290 | return; |
||
291 | } |
||
292 | |||
293 | $time->add(\DateInterval::createFromDateString($timeAware)); |
||
294 | |||
295 | return $time; |
||
296 | } |
||
297 | |||
298 | /** |
||
299 | * {@inheritdoc} |
||
300 | */ |
||
301 | public function canResend(ConfirmationSubjectInterface $subject) |
||
302 | { |
||
303 | if ($subject->isConfirmationConfirmed()) { |
||
304 | throw new ConfirmationException('ui.trans.user.confirmation.resend.confirmed'); |
||
305 | } |
||
306 | |||
307 | if (null === $timeAware = $this->options['token_resend_time_aware']) { |
||
308 | return true; |
||
309 | } |
||
310 | |||
311 | if (!$time = $subject->getConfirmationRequestedAt()) { |
||
312 | return true; |
||
313 | } |
||
314 | |||
315 | $time->add(\DateInterval::createFromDateString($timeAware)); |
||
316 | $valid = $time->getTimestamp() <= (new \DateTime())->getTimestamp(); |
||
317 | |||
318 | if (false === $valid) { |
||
319 | $exception = new InvalidTokenResendTimeException('ui.trans.user.confirmation.invalid_time'); |
||
320 | $exception->setTime($time); |
||
321 | $exception->setTimeAware($timeAware); |
||
322 | |||
323 | throw $exception; |
||
324 | } |
||
325 | |||
326 | return $valid; |
||
327 | } |
||
328 | |||
329 | public function createResendForm() |
||
330 | { |
||
331 | return $this->formFactory->create( |
||
332 | $this->options['token_resend_form'], |
||
333 | $this->getResendModel() |
||
334 | ); |
||
335 | } |
||
336 | |||
337 | public function createVerifyForm() |
||
338 | { |
||
339 | return $this->formFactory->create( |
||
340 | $this->options['token_verify_form'], |
||
341 | $this->getVerifyModel() |
||
342 | ); |
||
343 | } |
||
344 | |||
345 | /** |
||
346 | * @param OptionsResolver $resolver |
||
347 | */ |
||
348 | protected function configureOptions(OptionsResolver $resolver) |
||
349 | { |
||
350 | $resolver->setDefaults( |
||
351 | array( |
||
352 | /* |
||
353 | * The user model property. |
||
354 | */ |
||
355 | 'token_property_path' => 'confirmationToken', |
||
356 | /* |
||
357 | * The resend form. |
||
358 | */ |
||
359 | 'token_resend_form' => null, |
||
360 | /* |
||
361 | * The verify form. |
||
362 | */ |
||
363 | 'token_verify_form' => null, |
||
364 | /* |
||
365 | * The template to send confirmation token. |
||
366 | */ |
||
367 | 'token_send_template' => null, |
||
368 | /* |
||
369 | * Life time of valid token. |
||
370 | * using \DateInterval::createFromDateString() |
||
371 | * @link http://php.net/manual/en/dateinterval.createfromdatestring.php |
||
372 | */ |
||
373 | 'token_time_aware' => null, |
||
374 | 'token_resend_time_aware' => null, |
||
375 | /* |
||
376 | * Which the prpoerty path to using as channel. |
||
377 | */ |
||
378 | 'channel_path' => 'customer.email', |
||
379 | ) |
||
380 | ); |
||
381 | |||
382 | $resolver->setRequired( |
||
383 | array( |
||
384 | 'token_property_path', |
||
385 | 'token_resend_form', |
||
386 | 'token_verify_form', |
||
387 | 'token_send_template', |
||
388 | ) |
||
389 | ); |
||
390 | } |
||
391 | |||
392 | /** |
||
393 | * @param ConfirmationSubjectInterface $subject |
||
394 | * @param string $token |
||
395 | */ |
||
396 | abstract protected function sendToken( |
||
397 | ConfirmationSubjectInterface $subject, |
||
398 | $token |
||
399 | ); |
||
400 | |||
401 | /** |
||
402 | * @return string |
||
403 | */ |
||
404 | abstract public function getType(); |
||
405 | |||
406 | /** |
||
407 | * @return ResendInterface |
||
408 | */ |
||
409 | abstract public function getResendModel(); |
||
410 | |||
411 | /** |
||
412 | * @return VerificationInterface |
||
413 | */ |
||
414 | abstract public function getVerifyModel(); |
||
415 | } |
||
416 |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.