Passed
Pull Request — master (#68)
by
unknown
05:38
created

HasPermissions::getPermissionOf()   B

Complexity

Conditions 6
Paths 10

Size

Total Lines 24
Code Lines 15

Duplication

Lines 0
Ratio 0 %

Code Coverage

Tests 0
CRAP Score 42

Importance

Changes 0
Metric Value
dl 0
loc 24
ccs 0
cts 14
cp 0
rs 8.5125
c 0
b 0
f 0
cc 6
eloc 15
nc 10
nop 3
crap 42
1
<?php
2
declare(strict_types=1);
3
4
namespace Maklad\Permission\Traits;
5
6
use Illuminate\Support\Collection;
7
use Jenssegers\Mongodb\Eloquent\Builder;
8
use Jenssegers\Mongodb\Eloquent\Model;
9
use Jenssegers\Mongodb\Relations\BelongsToMany;
10
use Maklad\Permission\Contracts\PermissionInterface as Permission;
11
use Maklad\Permission\Exceptions\GuardDoesNotMatch;
12
use Maklad\Permission\Guard;
13
use Maklad\Permission\Helpers;
14
use Maklad\Permission\Models\Role;
15
use Maklad\Permission\PermissionRegistrar;
16
use Maklad\Permission\Models\RoleAssignment;
17
use Metabuyer\Models\Users;
18
19
/**
20
 * Trait HasPermissions
21
 * @package Maklad\Permission\Traits
22
 */
23
trait HasPermissions
24
{
25
    public static function bootHasPermissions()
26
    {
27 123
        static::deleting(function (Model $model) {
28 6
            if (isset($model->forceDeleting) && !$model->forceDeleting) {
29 2
                return;
30
            }
31
32 4
            $model->permissions()->sync([]);
33 123
        });
34 123
    }
35
36
    /**
37
     * A role may be given various permissions.
38
     * @return BelongsToMany
39
     */
40 54
    public function permissions(): BelongsToMany
41
    {
42 54
        return $this->belongsToMany(
0 ignored issues
show
Bug introduced by
It seems like belongsToMany() must be provided by classes using this trait. How about adding it as abstract method to this trait?

This check looks for methods that are used by a trait but not required by it.

To illustrate, let’s look at the following code example

trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

The trait Idable provides a method equalsId that in turn relies on the method getId(). If this method does not exist on a class mixing in this trait, the method will fail.

Adding the getId() as an abstract method to the trait will make sure it is available.

Loading history...
43 54
            config('permission.models.permission'),
44 54
            config('permission.collection_names.role_has_permissions')
45
        );
46
    }
47
48
    /**
49
     * A role belongs to some users of the model associated with its guard.
50
     */
51 2
    public function users(): BelongsToMany
52
    {
53 2
        return $this->belongsToMany($this->helpers->getModelForGuard($this->attributes['guard_name']));
0 ignored issues
show
Bug introduced by
The property helpers does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
Bug introduced by
The property attributes does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
Bug introduced by
It seems like belongsToMany() must be provided by classes using this trait. How about adding it as abstract method to this trait?

This check looks for methods that are used by a trait but not required by it.

To illustrate, let’s look at the following code example

trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

The trait Idable provides a method equalsId that in turn relies on the method getId(). If this method does not exist on a class mixing in this trait, the method will fail.

Adding the getId() as an abstract method to the trait will make sure it is available.

Loading history...
Security Code Execution introduced by
$this->helpers->getModel...tributes['guard_name']) can contain request data and is used in code execution context(s) leading to a potential security vulnerability.

9 paths for user data to reach this point

  1. Path: $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned in ServerBag.php on line 62
  1. $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned
    in vendor/ServerBag.php on line 62
  2. ParameterBag::$parameters is assigned
    in vendor/ServerBag.php on line 77
  3. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  4. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  5. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  6. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  7. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  8. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  9. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  10. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 53
  2. Path: Read from $_POST, and $_POST is passed to Request::createRequestFromFactory() in Request.php on line 314
  1. Read from $_POST, and $_POST is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  2. $request is passed to Request::__construct()
    in vendor/Request.php on line 2068
  3. $request is passed to Request::initialize()
    in vendor/Request.php on line 255
  4. $request is passed to ParameterBag::__construct()
    in vendor/Request.php on line 273
  5. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  6. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  7. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  8. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  9. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  10. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  11. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  12. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  13. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 53
  3. Path: Read from $_SERVER, and $server is assigned in Request.php on line 304
  1. Read from $_SERVER, and $server is assigned
    in vendor/Request.php on line 304
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  13. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  14. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 53
  4. Path: Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned in Request.php on line 307
  1. Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned
    in vendor/Request.php on line 307
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  13. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  14. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 53
  5. Path: Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned in Request.php on line 310
  1. Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned
    in vendor/Request.php on line 310
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  13. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  14. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 53
  6. Path: $server['HTTP_HOST'] seems to return tainted data, and $server is assigned in Request.php on line 380
  1. $server['HTTP_HOST'] seems to return tainted data, and $server is assigned
    in vendor/Request.php on line 380
  2. $server is assigned
    in vendor/Request.php on line 428
  3. $server is assigned
    in vendor/Request.php on line 429
  4. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 431
  5. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  6. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  7. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  8. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  9. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  10. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  11. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  12. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  13. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  14. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  15. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  16. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 53
  7. Path: $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 43
  1. $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 43
  2. $headers is assigned
    in vendor/ServerBag.php on line 44
  3. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 279
  4. $values is assigned
    in vendor/HeaderBag.php on line 29
  5. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 30
  6. $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  7. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  8. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 65
  9. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 113
  10. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1831
  11. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1862
  12. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 95
  13. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  14. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  15. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  16. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  17. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  18. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  19. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  20. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 53
  8. Path: $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 44
  1. $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 44
  2. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 279
  3. $values is assigned
    in vendor/HeaderBag.php on line 29
  4. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 30
  5. $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  6. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  7. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 65
  8. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 113
  9. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1831
  10. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1862
  11. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 95
  12. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  13. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  14. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  15. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  16. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  17. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  18. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  19. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 53
  9. Path: Read from $_SERVER, and $server is assigned in src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 22
  1. Read from $_SERVER, and $server is assigned
    in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 22
  2. Data is passed through array_replace()
    in vendor/Request.php on line 357
  3. Data is passed through call_user_func()
    in vendor/Request.php on line 2059
  4. \Illuminate\Http\Request::create($uri, 'GET', array(), array(), array(), $server) is passed to Container::instance()
    in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 31
  5. Container::$instances is assigned
    in vendor/src/Illuminate/Container/Container.php on line 379
  6. Tainted property Container::$instances is read
    in vendor/src/Illuminate/Container/Container.php on line 620
  7. Container::resolve() returns tainted data
    in vendor/src/Illuminate/Container/Container.php on line 586
  8. Container::make() returns tainted data
    in vendor/src/Illuminate/Container/Container.php on line 1195
  9. Container::offsetGet() returns tainted data, and $table is assigned
    in vendor/src/Illuminate/Session/SessionManager.php on line 73
  10. $table is passed to DatabaseSessionHandler::__construct()
    in vendor/src/Illuminate/Session/SessionManager.php on line 78
  11. DatabaseSessionHandler::$table is assigned
    in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 64
  12. Tainted property DatabaseSessionHandler::$table is read, and $this->table is passed to Connection::table()
    in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 279
  13. $table is passed to Builder::from()
    in vendor/src/Illuminate/Database/Connection.php on line 265
  14. Builder::$from is assigned
    in vendor/src/Illuminate/Database/Query/Builder.php on line 327
  15. Tainted property Builder::$from is read, and $query->from is passed to Grammar::wrapTable()
    in vendor/src/Illuminate/Database/Query/Grammars/Grammar.php on line 783
  16. $this->tablePrefix . $table is passed to Grammar::wrap()
    in vendor/src/Illuminate/Database/Grammar.php on line 36
  17. $value is passed through explode(), and explode('.', $value) is passed to Grammar::wrapSegments()
    in vendor/src/Illuminate/Database/Grammar.php on line 62
  18. $segments is passed to collect()
    in vendor/src/Illuminate/Database/Grammar.php on line 96
  19. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  20. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  21. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 648
  22. Collection::get() returns tainted data
    in src/Helpers.php on line 21
  23. Helpers::getModelForGuard() returns tainted data
    in src/Traits/HasPermissions.php on line 53

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
54
    }
55
56
    /**
57
     * Grant the given permission(s) to a role.
58
     *
59
     * @param string|array|Permission|\Illuminate\Support\Collection $permissions
60
     *
61
     * @return $this
62
     * @throws GuardDoesNotMatch
63
     */
64 46 View Code Duplication
    public function givePermissionTo(...$permissions)
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
65
    {
66 46
        $permissions = collect($permissions)
67 46
            ->flatten()
68 46
            ->map(function ($permission) {
69 44
                return $this->getStoredPermission($permission);
70 46
            })
71 44
            ->each(function ($permission) {
72 42
                $this->ensureModelSharesGuard($permission);
73 44
            })
74 41
            ->all();
75
76 41
        $this->permissions()->saveMany($permissions);
77
78 41
        $this->forgetCachedPermissions();
79
80 41
        return $this;
81
    }
82
83
    /**
84
     * Remove all current permissions and set the given ones.
85
     *
86
     * @param string|array|Permission|\Illuminate\Support\Collection $permissions
87
     *
88
     * @return $this
89
     * @throws GuardDoesNotMatch
90
     */
91 4
    public function syncPermissions(...$permissions)
92
    {
93 4
        $this->permissions()->sync([]);
94
95 4
        return $this->givePermissionTo($permissions);
96
    }
97
98
    /**
99
     * Revoke the given permission.
100
     *
101
     * @param string|array|Permission|\Illuminate\Support\Collection $permissions
102
     *
103
     * @return $this
104
     * @throws \Maklad\Permission\Exceptions\GuardDoesNotMatch
105
     */
106 6 View Code Duplication
    public function revokePermissionTo(...$permissions)
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
107
    {
108 6
        collect($permissions)
109 6
            ->flatten()
110 6
            ->map(function ($permission) {
111 6
                $permission = $this->getStoredPermission($permission);
112 6
                $this->permissions()->detach($permission);
0 ignored issues
show
Documentation introduced by
$permission is of type object<Maklad\Permission...ts\PermissionInterface>, but the function expects a array.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
113
114 6
                return $permission;
115 6
            });
116
117 6
        $this->forgetCachedPermissions();
118
119 6
        return $this;
120
    }
121
122
    /**
123
     * @param string|Permission $permission
124
     *
125
     * @return Permission
126
     * @throws \ReflectionException
127
     */
128 45
    protected function getStoredPermission($permission): Permission
129
    {
130 45
        if (\is_string($permission)) {
131 32
            return \app(Permission::class)->findByName($permission, $this->getDefaultGuardName());
132
        }
133
134 16
        return $permission;
135
    }
136
137
    /**
138
     * @param Model $roleOrPermission
139
     *
140
     * @throws GuardDoesNotMatch
141
     * @throws \ReflectionException
142
     */
143 83
    protected function ensureModelSharesGuard(Model $roleOrPermission)
144
    {
145 83 View Code Duplication
        if (! $this->getGuardNames()->contains($roleOrPermission->guard_name)) {
0 ignored issues
show
Security Code Execution introduced by
$roleOrPermission->guard_name can contain request data and is used in code execution context(s) leading to a potential security vulnerability.

9 paths for user data to reach this point

  1. Path: $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned in ServerBag.php on line 62
  1. $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned
    in vendor/ServerBag.php on line 62
  2. ParameterBag::$parameters is assigned
    in vendor/ServerBag.php on line 77
  3. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  4. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  5. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  6. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  7. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  8. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  9. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  10. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  11. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  12. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  13. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  14. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  15. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  16. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  17. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  18. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  19. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  20. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  21. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  22. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  23. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 145
  2. Path: Read from $_POST, and $_POST is passed to Request::createRequestFromFactory() in Request.php on line 314
  1. Read from $_POST, and $_POST is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  2. $request is passed to Request::__construct()
    in vendor/Request.php on line 2068
  3. $request is passed to Request::initialize()
    in vendor/Request.php on line 255
  4. $request is passed to ParameterBag::__construct()
    in vendor/Request.php on line 273
  5. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  6. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  7. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  8. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  9. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  10. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  11. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  12. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  13. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  14. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  15. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  16. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  17. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  18. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  19. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  20. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  21. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  22. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  23. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  24. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  25. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  26. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 145
  3. Path: Read from $_SERVER, and $server is assigned in Request.php on line 304
  1. Read from $_SERVER, and $server is assigned
    in vendor/Request.php on line 304
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  13. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  14. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  15. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  16. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  17. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  18. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  19. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  20. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  21. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  22. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  23. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  24. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  25. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  26. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  27. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 145
  4. Path: Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned in Request.php on line 307
  1. Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned
    in vendor/Request.php on line 307
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  13. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  14. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  15. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  16. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  17. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  18. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  19. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  20. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  21. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  22. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  23. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  24. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  25. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  26. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  27. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 145
  5. Path: Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned in Request.php on line 310
  1. Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned
    in vendor/Request.php on line 310
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 314
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  8. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  9. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  10. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  11. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  12. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  13. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  14. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  15. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  16. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  17. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  18. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  19. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  20. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  21. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  22. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  23. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  24. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  25. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  26. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  27. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 145
  6. Path: $server['HTTP_HOST'] seems to return tainted data, and $server is assigned in Request.php on line 380
  1. $server['HTTP_HOST'] seems to return tainted data, and $server is assigned
    in vendor/Request.php on line 380
  2. $server is assigned
    in vendor/Request.php on line 428
  3. $server is assigned
    in vendor/Request.php on line 429
  4. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 431
  5. $server is passed to Request::__construct()
    in vendor/Request.php on line 2068
  6. $server is passed to Request::initialize()
    in vendor/Request.php on line 255
  7. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 278
  8. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 31
  9. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  10. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  11. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  12. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  13. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  14. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  15. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  16. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  17. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  18. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  19. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  20. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  21. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  22. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  23. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  24. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  25. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  26. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  27. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  28. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  29. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 145
  7. Path: $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 43
  1. $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 43
  2. $headers is assigned
    in vendor/ServerBag.php on line 44
  3. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 279
  4. $values is assigned
    in vendor/HeaderBag.php on line 29
  5. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 30
  6. $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  7. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  8. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 65
  9. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 113
  10. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1831
  11. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1862
  12. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 95
  13. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  14. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  15. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  16. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  17. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  18. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  19. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  20. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  21. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  22. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  23. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  24. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  25. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  26. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  27. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  28. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  29. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  30. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  31. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  32. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  33. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 145
  8. Path: $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 44
  1. $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 44
  2. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 279
  3. $values is assigned
    in vendor/HeaderBag.php on line 29
  4. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 30
  5. $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  6. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  7. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 65
  8. HeaderBag::all() returns tainted data, and $headers is assigned
    in vendor/HeaderBag.php on line 113
  9. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1831
  10. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1862
  11. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 95
  12. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 41
  13. ParameterBag::all() returns tainted data, and $bag->all() is passed to TransformsRequest::cleanArray()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 58
  14. $data is passed to collect()
    in vendor/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php on line 69
  15. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  16. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  17. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  18. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  19. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  20. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  21. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  22. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  23. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  24. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  25. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  26. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  27. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  28. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  29. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  30. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  31. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  32. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 145
  9. Path: Read from $_SERVER, and $server is assigned in src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 22
  1. Read from $_SERVER, and $server is assigned
    in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 22
  2. Data is passed through array_replace()
    in vendor/Request.php on line 357
  3. Data is passed through call_user_func()
    in vendor/Request.php on line 2059
  4. \Illuminate\Http\Request::create($uri, 'GET', array(), array(), array(), $server) is passed to Container::instance()
    in vendor/src/Illuminate/Foundation/Bootstrap/SetRequestForConsole.php on line 31
  5. Container::$instances is assigned
    in vendor/src/Illuminate/Container/Container.php on line 379
  6. Tainted property Container::$instances is read
    in vendor/src/Illuminate/Container/Container.php on line 620
  7. Container::resolve() returns tainted data
    in vendor/src/Illuminate/Container/Container.php on line 586
  8. Container::make() returns tainted data
    in vendor/src/Illuminate/Container/Container.php on line 1195
  9. Container::offsetGet() returns tainted data, and $table is assigned
    in vendor/src/Illuminate/Session/SessionManager.php on line 73
  10. $table is passed to DatabaseSessionHandler::__construct()
    in vendor/src/Illuminate/Session/SessionManager.php on line 78
  11. DatabaseSessionHandler::$table is assigned
    in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 64
  12. Tainted property DatabaseSessionHandler::$table is read, and $this->table is passed to Connection::table()
    in vendor/src/Illuminate/Session/DatabaseSessionHandler.php on line 279
  13. $table is passed to Builder::from()
    in vendor/src/Illuminate/Database/Connection.php on line 265
  14. Builder::$from is assigned
    in vendor/src/Illuminate/Database/Query/Builder.php on line 327
  15. Tainted property Builder::$from is read, and $query->from is passed to Grammar::wrapTable()
    in vendor/src/Illuminate/Database/Query/Grammars/Grammar.php on line 783
  16. $this->tablePrefix . $table is passed to Grammar::wrap()
    in vendor/src/Illuminate/Database/Grammar.php on line 36
  17. $value is passed through explode(), and explode('.', $value) is passed to Grammar::wrapSegments()
    in vendor/src/Illuminate/Database/Grammar.php on line 62
  18. $segments is passed to collect()
    in vendor/src/Illuminate/Database/Grammar.php on line 96
  19. $value is passed to Collection::__construct()
    in vendor/src/Illuminate/Support/helpers.php on line 423
  20. Collection::$items is assigned
    in vendor/src/Illuminate/Support/Collection.php on line 48
  21. Tainted property Collection::$items is read
    in vendor/src/Illuminate/Support/Collection.php on line 113
  22. Collection::all() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 134
  23. InteractsWithPivotTable::formatRecordsList() returns tainted data, and $records is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 96
  24. $records is passed to InteractsWithPivotTable::attachNew()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 112
  25. $attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 155
  26. $attributes is passed to InteractsWithPivotTable::updateExistingPivot()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 169
  27. $attributes is passed to InteractsWithPivotTable::castAttributes()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 192
  28. $attributes is passed to Model::fill()
    in vendor/src/Illuminate/Database/Eloquent/Relations/Concerns/InteractsWithPivotTable.php on line 514
  29. $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 223
  30. $value is passed to HasAttributes::setAttribute()
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 230
  31. HasAttributes::$attributes is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 546
  32. Tainted property HasAttributes::$attributes is read
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 370
  33. HasAttributes::getAttributeFromArray() returns tainted data, and $value is assigned
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 334
  34. HasAttributes::getAttributeValue() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php on line 313
  35. HasAttributes::getAttribute() returns tainted data
    in vendor/src/Illuminate/Database/Eloquent/Model.php on line 1375
  36. Model::__get() returns tainted data
    in src/Traits/HasPermissions.php on line 145

Used in code-execution context

  1. Collection::contains() uses Collection::first() ($callback)
    in vendor/src/Illuminate/Support/Collection.php on line 223
  2. Collection::first() uses Arr::first() ($callback)
    in vendor/src/Illuminate/Support/Collection.php on line 584
  3. Arr::first() uses call_user_func() ($callback)
    in vendor/src/Illuminate/Support/Arr.php on line 175

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
Duplication introduced by
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
146 5
            $expected = $this->getGuardNames();
147 5
            $given    = $roleOrPermission->guard_name;
148 5
            $helpers  = new Helpers();
149
150 5
            throw new GuardDoesNotMatch($helpers->getGuardDoesNotMatchMessage($expected, $given));
151
        }
152 79
    }
153
154
    /**
155
     * @return Collection
156
     * @throws \ReflectionException
157
     */
158 86
    protected function getGuardNames(): Collection
159
    {
160 86
        return (new Guard())->getNames($this);
161
    }
162
163
    /**
164
     * @return string
165
     * @throws \ReflectionException
166
     */
167 78
    protected function getDefaultGuardName(): string
168
    {
169 78
        return (new Guard())->getDefaultName($this);
170
    }
171
172
    /**
173
     * Forget the cached permissions.
174
     */
175 80
    public function forgetCachedPermissions()
176
    {
177 80
        app(PermissionRegistrar::class)->forgetCachedPermissions();
178 80
    }
179
180
    /**
181
     * Convert to Permission Models
182
     *
183
     * @param string|array|Collection $permissions
184
     *
185
     * @return Collection
186
     */
187 7 View Code Duplication
    private function convertToPermissionModels($permissions): Collection
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
188
    {
189 7
        if (\is_array($permissions)) {
190 3
            $permissions = collect($permissions);
191
        }
192
193 7
        if (! $permissions instanceof Collection) {
194 5
            $permissions = collect([$permissions]);
195
        }
196
197 7
        $permissions = $permissions->map(function ($permission) {
198 7
            return $this->getStoredPermission($permission);
199 7
        });
200
201 6
        return $permissions;
202
    }
203
204
    /**
205
     * Return a collection of permission names associated with this user.
206
     *
207
     * @return Collection
208
     */
209 1
    public function getPermissionNames(): Collection
210
    {
211 1
        return $this->getAllPermissions()->pluck('name');
212
    }
213
214
    /**
215
     * Return all the permissions the model has via roles.
216
     */
217 3
    public function getPermissionsViaRoles(): Collection
218
    {
219 3
        return $this->load('roles', 'roles.permissions')
0 ignored issues
show
Bug introduced by
It seems like load() must be provided by classes using this trait. How about adding it as abstract method to this trait?

This check looks for methods that are used by a trait but not required by it.

To illustrate, let’s look at the following code example

trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

The trait Idable provides a method equalsId that in turn relies on the method getId(). If this method does not exist on a class mixing in this trait, the method will fail.

Adding the getId() as an abstract method to the trait will make sure it is available.

Loading history...
220 3
            ->roles->flatMap(function (Role $role) {
221 2
                return $role->permissions;
0 ignored issues
show
Documentation introduced by
The property permissions does not exist on object<Maklad\Permission\Models\Role>. Since you implemented __get, maybe consider adding a @property annotation.

Since your code implements the magic getter _get, this function will be called for any read access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

If the property has read access only, you can use the @property-read annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
222 3
            })->sort()->values();
223
    }
224
225
    /**
226
     * Return all the permissions the model has, both directly and via roles.
227
     */
228 2
    public function getAllPermissions(): Collection
229
    {
230 2
        return $this->permissions
0 ignored issues
show
Bug introduced by
The property permissions does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
231 2
            ->merge($this->getPermissionsViaRoles())
232 2
            ->sort()
233 2
            ->values();
234
    }
235
236
    /**
237
     * Determine if the model may perform the given permission.
238
     *
239
     * @param string|Permission $permission
240
     * @param string|null $guardName
241
     *
242
     * @return bool
243
     * @throws \ReflectionException
244
     */
245 24
    public function hasPermissionTo($permission, $guardName = null): bool
246
    {
247 24
        if (\is_string($permission)) {
248 15
            $permission = \app(Permission::class)->findByName(
249 15
                $permission,
250 15
                $guardName ?? $this->getDefaultGuardName()
251
            );
252
        }
253
254 22
        return $this->hasDirectPermission($permission) || $this->hasPermissionViaRole($permission);
255
    }
256
257
    public function getPermissionOf($permission, $guardName = null, $org_id = null)
0 ignored issues
show
Unused Code introduced by
The parameter $guardName is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
258
    {
259
        if ($this instanceof Users) {
0 ignored issues
show
Bug introduced by
The class Metabuyer\Models\Users does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
260
            $roleAssignment_datas = RoleAssignment::where('organization_id', $org_id)->get();
261
            $user = $this->toArray();
262
263
            foreach ($roleAssignment_datas as $roleAssignment_data) {
264
                if (array_key_exists($roleAssignment_data->_id, $user)) {
265
                    $role_assignment_id = $roleAssignment_data->_id;
266
                }
267
            }
268
269
            foreach ($user[$role_assignment_id]['role_id'] as $key => $value) {
0 ignored issues
show
Bug introduced by
The variable $role_assignment_id does not seem to be defined for all execution paths leading up to this point.

If you define a variable conditionally, it can happen that it is not defined for all execution paths.

Let’s take a look at an example:

function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}

In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined.

Available Fixes

  1. Check for existence of the variable explicitly:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        if (isset($x)) { // Make sure it's always set.
            echo $x;
        }
    }
    
  2. Define a default value for the variable:

    function myFunction($a) {
        $x = ''; // Set a default which gets overridden for certain paths.
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        echo $x;
    }
    
  3. Add a value for the missing path:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
    
            // We add support for the missing case.
            default:
                $x = '';
                break;
        }
    
        echo $x;
    }
    
Loading history...
270
                $role = Role::where('_id', $value)->first();
271
                if ($role->hasPermissionTo($permission)) {
272
                    return true;
273
                } else {
274
                    return false;
275
                }
276
            }
277
        } else {
278
            return $this->hasPermissionTo($permission);
279
        }
280
    }
281
282
    /**
283
     * Determine if the model has any of the given permissions.
284
     *
285
     * @param array ...$permissions
286
     *
287
     * @return bool
288
     * @throws \ReflectionException
289
     */
290 8
    public function hasAnyPermission(...$permissions): bool
291
    {
292 8
        if (\is_array($permissions[0])) {
293 6
            $permissions = $permissions[0];
294
        }
295
296 8
        foreach ($permissions as $permission) {
297 8
            if ($this->hasPermissionTo($permission)) {
298 8
                return true;
299
            }
300
        }
301
302 5
        return false;
303
    }
304
305
    /**
306
     * Determine if the model has, via roles, the given permission.
307
     *
308
     * @param Permission $permission
309
     *
310
     * @return bool
311
     */
312 17
    protected function hasPermissionViaRole(Permission $permission): bool
313
    {
314 17
        return $this->hasRole($permission->roles);
0 ignored issues
show
Bug introduced by
Accessing roles on the interface Maklad\Permission\Contracts\PermissionInterface suggest that you code against a concrete implementation. How about adding an instanceof check?

If you access a property on an interface, you most likely code against a concrete implementation of the interface.

Available Fixes

  1. Adding an additional type check:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeInterface $object) {
        if ($object instanceof SomeClass) {
            $a = $object->a;
        }
    }
    
  2. Changing the type hint:

    interface SomeInterface { }
    class SomeClass implements SomeInterface {
        public $a;
    }
    
    function someFunction(SomeClass $object) {
        $a = $object->a;
    }
    
Loading history...
Bug introduced by
It seems like hasRole() must be provided by classes using this trait. How about adding it as abstract method to this trait?

This check looks for methods that are used by a trait but not required by it.

To illustrate, let’s look at the following code example

trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

The trait Idable provides a method equalsId that in turn relies on the method getId(). If this method does not exist on a class mixing in this trait, the method will fail.

Adding the getId() as an abstract method to the trait will make sure it is available.

Loading history...
315
    }
316
317
    /**
318
     * Determine if the model has the given permission.
319
     *
320
     * @param string|Permission $permission
321
     *
322
     * @return bool
323
     * @throws \ReflectionException
324
     */
325 23
    public function hasDirectPermission($permission): bool
326
    {
327 23
        if (\is_string($permission)) {
328 1
            $permission = \app(Permission::class)->findByName($permission, $this->getDefaultGuardName());
329
        }
330
331 23
        return $this->permissions->contains('id', $permission->id);
332
    }
333
334
    /**
335
     * Return all permissions the directory coupled to the model.
336
     */
337 1
    public function getDirectPermissions(): Collection
338
    {
339 1
        return $this->permissions;
340
    }
341
342
    /**
343
     * Scope the model query to certain permissions only.
344
     *
345
     * @param Builder $query
346
     * @param string|array|Permission|Collection $permissions
347
     *
348
     * @return Builder
349
     */
350 7
    public function scopePermission(Builder $query, $permissions): Builder
351
    {
352 7
        $permissions = $this->convertToPermissionModels($permissions);
353
354 6
        $roles = \collect([]);
355
356 6
        foreach ($permissions as $permission) {
357 6
            $roles = $roles->merge($permission->roles);
358
        }
359 6
        $roles = $roles->unique();
360
361 6
        return $query->orWhereIn('permission_ids', $permissions->pluck('_id'))
362 6
            ->orWhereIn('role_ids', $roles->pluck('_id'));
363
    }
364
}
365