This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | /** |
||
| 4 | * @author Rafał Muszyński <[email protected]> |
||
| 5 | * @copyright 2015 Sourcefabric z.ú. |
||
| 6 | * @license http://www.gnu.org/licenses/gpl-3.0.txt |
||
| 7 | */ |
||
| 8 | |||
| 9 | namespace Newscoop\PaywallBundle\Controller; |
||
| 10 | |||
| 11 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route; |
||
| 12 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Method; |
||
| 13 | use Symfony\Component\HttpFoundation\Request; |
||
| 14 | use Newscoop\PaywallBundle\Entity\Order; |
||
| 15 | use Newscoop\PaywallBundle\Entity\UserSubscription; |
||
| 16 | use Newscoop\PaywallBundle\Form\Type\OrderItemType; |
||
| 17 | use Newscoop\PaywallBundle\Events\PaywallEvents; |
||
| 18 | use Newscoop\PaywallBundle\Permissions; |
||
| 19 | |||
| 20 | class UserOrderController extends BaseController |
||
| 21 | { |
||
| 22 | /** |
||
| 23 | * @Route("/admin/paywall_plugin/orders", name="paywall_plugin_userorder_index", options={"expose"=true}) |
||
| 24 | * |
||
| 25 | * @Method("GET") |
||
| 26 | */ |
||
| 27 | View Code Duplication | public function indexAction(Request $request) |
|
| 28 | { |
||
| 29 | $this->hasPermission(Permissions::ORDERS_VIEW); |
||
| 30 | $query = $this->getOrderRepository()->findOrders(); |
||
| 31 | $paginator = $this->get('knp_paginator'); |
||
| 32 | $pagination = $paginator->paginate( |
||
| 33 | $query, |
||
| 34 | $request->query->getInt('knp_page', 1), |
||
| 35 | 10 |
||
| 36 | ); |
||
| 37 | |||
| 38 | $pagination->setTemplate('NewscoopNewscoopBundle:Pagination:pagination_bootstrap3.html.twig'); |
||
| 39 | |||
| 40 | return $this->render('NewscoopPaywallBundle:UserOrder:index.html.twig', array( |
||
| 41 | 'pagination' => $pagination, |
||
| 42 | )); |
||
| 43 | } |
||
| 44 | |||
| 45 | /** |
||
| 46 | * @Route("/admin/paywall_plugin/orders/{id}", name="paywall_plugin_userorder_show", options={"expose"=true}) |
||
| 47 | */ |
||
| 48 | public function showAction(Request $request, $id) |
||
| 49 | { |
||
| 50 | $this->hasPermission(Permissions::ORDERS_VIEW); |
||
| 51 | $order = $this->getOrderRepository()->findSingleBy($id, $request->getLocale()); |
||
| 52 | |||
| 53 | return $this->render('NewscoopPaywallBundle:UserOrder:show.html.twig', array( |
||
| 54 | 'order' => $order, |
||
| 55 | )); |
||
| 56 | } |
||
| 57 | |||
| 58 | /** |
||
| 59 | * @Route("/admin/paywall_plugin/orders/edit/{id}", name="paywall_plugin_userorder_edit", options={"expose"=true}) |
||
| 60 | */ |
||
| 61 | public function editAction(Request $request, Order $order) |
||
| 62 | { |
||
| 63 | $this->hasPermission(Permissions::ORDERS_MANAGE); |
||
| 64 | $form = $this->createForm(new OrderItemType()); |
||
| 65 | |||
| 66 | return $this->render('NewscoopPaywallBundle:UserOrder:edit.html.twig', array( |
||
| 67 | 'order' => $order, |
||
| 68 | 'form' => $form->createView(), |
||
| 69 | )); |
||
| 70 | } |
||
| 71 | |||
| 72 | /** |
||
| 73 | * @Route("/admin/paywall_plugin/orders/delete/{id}", options={"expose"=true}, name="paywall_plugin_userorder_delete") |
||
| 74 | * |
||
| 75 | * @Method("DELETE") |
||
| 76 | */ |
||
| 77 | View Code Duplication | public function deleteAction(Request $request, Order $order) |
|
| 78 | { |
||
| 79 | $this->hasPermission(Permissions::ORDERS_MANAGE); |
||
| 80 | $translator = $this->get('translator'); |
||
| 81 | if ($this->exists($order)) { |
||
| 82 | $em = $this->get('em'); |
||
| 83 | $em->remove($order); |
||
| 84 | $em->flush(); |
||
| 85 | |||
| 86 | $this->get('session')->getFlashBag()->add('success', $translator->trans('paywall.success.removed')); |
||
| 87 | } else { |
||
| 88 | $this->get('session')->getFlashBag()->add('error', $translator->trans('paywall.success.notexists')); |
||
| 89 | } |
||
| 90 | |||
| 91 | return $this->redirect($this->generateUrl('paywall_plugin_userorder_index')); |
||
| 92 | } |
||
| 93 | |||
| 94 | /** |
||
| 95 | * @Route("/admin/paywall_plugin/orders/create/", options={"expose"=true}, name="paywall_plugin_userorder_create") |
||
| 96 | * |
||
| 97 | * @Method("POST") |
||
| 98 | */ |
||
| 99 | public function createAction(Request $request) |
||
| 100 | { |
||
| 101 | $this->hasPermission(Permissions::ORDERS_MANAGE); |
||
| 102 | |||
| 103 | return array(); |
||
| 104 | } |
||
| 105 | |||
| 106 | /** |
||
| 107 | * @Route("/admin/paywall_plugin/orders/{id}/periods/", options={"expose"=true}, name="paywall_plugin_userorder_periods") |
||
| 108 | * |
||
| 109 | * @Method("POST") |
||
| 110 | */ |
||
| 111 | View Code Duplication | public function periodsAction(Request $request, Order $order) |
|
| 112 | { |
||
| 113 | $this->hasPermission(Permissions::ORDERS_MANAGE); |
||
| 114 | $activeOnes = $this->getActiveSubscriptions($request->getLocale()); |
||
| 115 | $orderItem = new UserSubscription(); |
||
| 116 | $form = $this->createForm(new OrderItemType(), $orderItem, array('items' => $activeOnes)); |
||
| 117 | $form->handleRequest($request); |
||
| 118 | |||
| 119 | return $this->render( |
||
| 120 | 'NewscoopPaywallBundle:UserOrder:createItem.html.twig', |
||
| 121 | array( |
||
| 122 | 'form' => $form->createView(), |
||
| 123 | 'orderId' => $order->getId(), |
||
| 124 | ) |
||
| 125 | ); |
||
| 126 | } |
||
| 127 | |||
| 128 | /** |
||
| 129 | * @Route("/admin/paywall_plugin/orders/{id}/item/create/", options={"expose"=true}, name="paywall_plugin_userorder_createitem") |
||
| 130 | */ |
||
| 131 | public function createItemAction(Request $request, Order $order) |
||
| 132 | { |
||
| 133 | $this->hasPermission(Permissions::ORDERS_MANAGE); |
||
| 134 | $em = $this->get('em'); |
||
| 135 | $activeOnes = $this->getActiveSubscriptions($request->getLocale()); |
||
| 136 | $orderItem = new UserSubscription(); |
||
| 137 | $form = $this->createForm(new OrderItemType(), $orderItem, array('items' => $activeOnes)); |
||
| 138 | |||
| 139 | $translator = $this->get('translator'); |
||
| 140 | $subscriptionService = $this->container->get('paywall.subscription.service'); |
||
| 141 | |||
| 142 | $form->handleRequest($request); |
||
| 143 | if ($form->isValid()) { |
||
| 144 | $data = $form->getData(); |
||
| 145 | $orderItem->setOrder($order); |
||
| 146 | $subscription = $orderItem->getSubscription(); |
||
| 147 | $durationObj = $subscriptionService->filterRanges($subscription, $orderItem->getDuration()->getId()); |
||
|
0 ignored issues
–
show
|
|||
| 148 | $duration = array( |
||
| 149 | 'id' => $durationObj->getId(), |
||
| 150 | 'value' => $durationObj->getValue(), |
||
| 151 | 'attribute' => $durationObj->getAttribute(), |
||
| 152 | ); |
||
| 153 | |||
| 154 | $discount = array(); |
||
| 155 | View Code Duplication | if ($durationObj->getDiscount()) { |
|
| 156 | $discount['value'] = $durationObj->getDiscount()->getValue(); |
||
| 157 | $discount['type'] = $durationObj->getDiscount()->getType(); |
||
| 158 | } |
||
| 159 | $subscriptionConfig = $subscriptionService->getOneSubscriptionSpecification($subscription); |
||
| 160 | $subscriptionData = new \Newscoop\PaywallBundle\Subscription\SubscriptionData(array( |
||
| 161 | 'userId' => $order->getUser(), |
||
| 162 | 'duration' => $duration, |
||
| 163 | 'discount' => $discount, |
||
| 164 | 'subscriptionId' => $subscriptionConfig->getSubscription(), |
||
| 165 | 'publicationId' => $subscriptionConfig->getPublication(), |
||
| 166 | 'toPay' => $subscriptionConfig->getSubscription()->getPrice(), |
||
| 167 | 'currency' => $subscriptionConfig->getSubscription()->getCurrency(), |
||
| 168 | 'type' => $data->getType(), |
||
| 169 | 'active' => $data->isActive(), |
||
| 170 | ), $orderItem); |
||
| 171 | |||
| 172 | $orderItem = $subscriptionService->update($orderItem, $subscriptionData); |
||
| 173 | if ($data->isActive()) { |
||
| 174 | $orderItem->setExpireAt($subscriptionService->getExpirationDate($orderItem)); |
||
| 175 | } |
||
| 176 | |||
| 177 | if ($this->getOrderItemRepository()->checkExistanceInOrder($orderItem) == 0) { |
||
| 178 | $subscriptionService->save($orderItem); |
||
| 179 | $processor = $this->get('newscoop_paywall.processor.discounts'); |
||
| 180 | $processor->process($orderItem); |
||
| 181 | $order->calculateTotal(); |
||
| 182 | $em->flush(); |
||
| 183 | $this->dispatchNotificationEvent(PaywallEvents::ADMIN_ORDER_SUBSCRIPTION, $orderItem); |
||
| 184 | |||
| 185 | $this->get('session')->getFlashBag()->add('success', $translator->trans('paywall.success.created')); |
||
| 186 | } else { |
||
| 187 | $this->get('session')->getFlashBag()->add('error', $translator->trans('paywall.manage.error.exists.subscription')); |
||
| 188 | } |
||
| 189 | |||
| 190 | return $this->redirect($this->generateUrl('paywall_plugin_userorder_edit', array( |
||
| 191 | 'id' => $order->getId(), |
||
| 192 | ))); |
||
| 193 | } |
||
| 194 | |||
| 195 | return $this->render('NewscoopPaywallBundle:UserOrder:createItem.html.twig', array( |
||
| 196 | 'form' => $form->createView(), |
||
| 197 | 'orderId' => $order->getId(), |
||
| 198 | )); |
||
| 199 | } |
||
| 200 | |||
| 201 | private function getOrderItemRepository() |
||
| 202 | { |
||
| 203 | $em = $this->get('em'); |
||
| 204 | |||
| 205 | return $em->getRepository('Newscoop\PaywallBundle\Entity\UserSubscription'); |
||
| 206 | } |
||
| 207 | |||
| 208 | private function exists(Order $order) |
||
| 209 | { |
||
| 210 | if ($this->getOrderRepository()->findOneById($order->getId())) { |
||
| 211 | return true; |
||
| 212 | } |
||
| 213 | |||
| 214 | return false; |
||
| 215 | } |
||
| 216 | |||
| 217 | private function getOrderRepository() |
||
| 218 | { |
||
| 219 | $em = $this->get('em'); |
||
| 220 | |||
| 221 | return $em->getRepository('Newscoop\PaywallBundle\Entity\Order'); |
||
| 222 | } |
||
| 223 | |||
| 224 | private function getActiveSubscriptions($locale) |
||
| 225 | { |
||
| 226 | $em = $this->get('em'); |
||
| 227 | |||
| 228 | return $em->getRepository('Newscoop\PaywallBundle\Entity\Subscription') |
||
| 229 | ->findActive($locale) |
||
| 230 | ->getResult(); |
||
| 231 | } |
||
| 232 | } |
||
| 233 |
Methods can only be called on objects. This check looks for methods being called on variables that have been inferred to never be objects.