This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * @author Rafał Muszyński <[email protected]> |
||
5 | * @copyright 2015 Sourcefabric z.ú. |
||
6 | * @license http://www.gnu.org/licenses/gpl-3.0.txt |
||
7 | */ |
||
8 | |||
9 | namespace Newscoop\PaywallBundle\Controller; |
||
10 | |||
11 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route; |
||
12 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Method; |
||
13 | use Symfony\Component\HttpFoundation\Request; |
||
14 | use Newscoop\PaywallBundle\Entity\Order; |
||
15 | use Newscoop\PaywallBundle\Entity\UserSubscription; |
||
16 | use Newscoop\PaywallBundle\Form\Type\OrderItemType; |
||
17 | use Newscoop\PaywallBundle\Events\PaywallEvents; |
||
18 | use Newscoop\PaywallBundle\Permissions; |
||
19 | |||
20 | class UserOrderController extends BaseController |
||
21 | { |
||
22 | /** |
||
23 | * @Route("/admin/paywall_plugin/orders", name="paywall_plugin_userorder_index", options={"expose"=true}) |
||
24 | * |
||
25 | * @Method("GET") |
||
26 | */ |
||
27 | View Code Duplication | public function indexAction(Request $request) |
|
28 | { |
||
29 | $this->hasPermission(Permissions::ORDERS_VIEW); |
||
30 | $query = $this->getOrderRepository()->findOrders(); |
||
31 | $paginator = $this->get('knp_paginator'); |
||
32 | $pagination = $paginator->paginate( |
||
33 | $query, |
||
34 | $request->query->getInt('knp_page', 1), |
||
35 | 10 |
||
36 | ); |
||
37 | |||
38 | $pagination->setTemplate('NewscoopNewscoopBundle:Pagination:pagination_bootstrap3.html.twig'); |
||
39 | |||
40 | return $this->render('NewscoopPaywallBundle:UserOrder:index.html.twig', array( |
||
41 | 'pagination' => $pagination, |
||
42 | )); |
||
43 | } |
||
44 | |||
45 | /** |
||
46 | * @Route("/admin/paywall_plugin/orders/{id}", name="paywall_plugin_userorder_show", options={"expose"=true}) |
||
47 | */ |
||
48 | public function showAction(Request $request, $id) |
||
49 | { |
||
50 | $this->hasPermission(Permissions::ORDERS_VIEW); |
||
51 | $order = $this->getOrderRepository()->findSingleBy($id, $request->getLocale()); |
||
52 | |||
53 | return $this->render('NewscoopPaywallBundle:UserOrder:show.html.twig', array( |
||
54 | 'order' => $order, |
||
55 | )); |
||
56 | } |
||
57 | |||
58 | /** |
||
59 | * @Route("/admin/paywall_plugin/orders/edit/{id}", name="paywall_plugin_userorder_edit", options={"expose"=true}) |
||
60 | */ |
||
61 | public function editAction(Request $request, Order $order) |
||
62 | { |
||
63 | $this->hasPermission(Permissions::ORDERS_MANAGE); |
||
64 | $form = $this->createForm(new OrderItemType()); |
||
65 | |||
66 | return $this->render('NewscoopPaywallBundle:UserOrder:edit.html.twig', array( |
||
67 | 'order' => $order, |
||
68 | 'form' => $form->createView(), |
||
69 | )); |
||
70 | } |
||
71 | |||
72 | /** |
||
73 | * @Route("/admin/paywall_plugin/orders/delete/{id}", options={"expose"=true}, name="paywall_plugin_userorder_delete") |
||
74 | * |
||
75 | * @Method("DELETE") |
||
76 | */ |
||
77 | View Code Duplication | public function deleteAction(Request $request, Order $order) |
|
78 | { |
||
79 | $this->hasPermission(Permissions::ORDERS_MANAGE); |
||
80 | $translator = $this->get('translator'); |
||
81 | if ($this->exists($order)) { |
||
82 | $em = $this->get('em'); |
||
83 | $em->remove($order); |
||
84 | $em->flush(); |
||
85 | |||
86 | $this->get('session')->getFlashBag()->add('success', $translator->trans('paywall.success.removed')); |
||
87 | } else { |
||
88 | $this->get('session')->getFlashBag()->add('error', $translator->trans('paywall.success.notexists')); |
||
89 | } |
||
90 | |||
91 | return $this->redirect($this->generateUrl('paywall_plugin_userorder_index')); |
||
92 | } |
||
93 | |||
94 | /** |
||
95 | * @Route("/admin/paywall_plugin/orders/create/", options={"expose"=true}, name="paywall_plugin_userorder_create") |
||
96 | * |
||
97 | * @Method("POST") |
||
98 | */ |
||
99 | public function createAction(Request $request) |
||
100 | { |
||
101 | $this->hasPermission(Permissions::ORDERS_MANAGE); |
||
102 | |||
103 | return array(); |
||
104 | } |
||
105 | |||
106 | /** |
||
107 | * @Route("/admin/paywall_plugin/orders/{id}/periods/", options={"expose"=true}, name="paywall_plugin_userorder_periods") |
||
108 | * |
||
109 | * @Method("POST") |
||
110 | */ |
||
111 | View Code Duplication | public function periodsAction(Request $request, Order $order) |
|
112 | { |
||
113 | $this->hasPermission(Permissions::ORDERS_MANAGE); |
||
114 | $activeOnes = $this->getActiveSubscriptions($request->getLocale()); |
||
115 | $orderItem = new UserSubscription(); |
||
116 | $form = $this->createForm(new OrderItemType(), $orderItem, array('items' => $activeOnes)); |
||
117 | $form->handleRequest($request); |
||
118 | |||
119 | return $this->render( |
||
120 | 'NewscoopPaywallBundle:UserOrder:createItem.html.twig', |
||
121 | array( |
||
122 | 'form' => $form->createView(), |
||
123 | 'orderId' => $order->getId(), |
||
124 | ) |
||
125 | ); |
||
126 | } |
||
127 | |||
128 | /** |
||
129 | * @Route("/admin/paywall_plugin/orders/{id}/item/create/", options={"expose"=true}, name="paywall_plugin_userorder_createitem") |
||
130 | */ |
||
131 | public function createItemAction(Request $request, Order $order) |
||
132 | { |
||
133 | $this->hasPermission(Permissions::ORDERS_MANAGE); |
||
134 | $em = $this->get('em'); |
||
135 | $activeOnes = $this->getActiveSubscriptions($request->getLocale()); |
||
136 | $orderItem = new UserSubscription(); |
||
137 | $form = $this->createForm(new OrderItemType(), $orderItem, array('items' => $activeOnes)); |
||
138 | |||
139 | $translator = $this->get('translator'); |
||
140 | $subscriptionService = $this->container->get('paywall.subscription.service'); |
||
141 | |||
142 | $form->handleRequest($request); |
||
143 | if ($form->isValid()) { |
||
144 | $data = $form->getData(); |
||
145 | $orderItem->setOrder($order); |
||
146 | $subscription = $orderItem->getSubscription(); |
||
147 | $durationObj = $subscriptionService->filterRanges($subscription, $orderItem->getDuration()->getId()); |
||
0 ignored issues
–
show
|
|||
148 | $duration = array( |
||
149 | 'id' => $durationObj->getId(), |
||
150 | 'value' => $durationObj->getValue(), |
||
151 | 'attribute' => $durationObj->getAttribute(), |
||
152 | ); |
||
153 | |||
154 | $discount = array(); |
||
155 | View Code Duplication | if ($durationObj->getDiscount()) { |
|
156 | $discount['value'] = $durationObj->getDiscount()->getValue(); |
||
157 | $discount['type'] = $durationObj->getDiscount()->getType(); |
||
158 | } |
||
159 | $subscriptionConfig = $subscriptionService->getOneSubscriptionSpecification($subscription); |
||
160 | $subscriptionData = new \Newscoop\PaywallBundle\Subscription\SubscriptionData(array( |
||
161 | 'userId' => $order->getUser(), |
||
162 | 'duration' => $duration, |
||
163 | 'discount' => $discount, |
||
164 | 'subscriptionId' => $subscriptionConfig->getSubscription(), |
||
165 | 'publicationId' => $subscriptionConfig->getPublication(), |
||
166 | 'toPay' => $subscriptionConfig->getSubscription()->getPrice(), |
||
167 | 'currency' => $subscriptionConfig->getSubscription()->getCurrency(), |
||
168 | 'type' => $data->getType(), |
||
169 | 'active' => $data->isActive(), |
||
170 | ), $orderItem); |
||
171 | |||
172 | $orderItem = $subscriptionService->update($orderItem, $subscriptionData); |
||
173 | if ($data->isActive()) { |
||
174 | $orderItem->setExpireAt($subscriptionService->getExpirationDate($orderItem)); |
||
175 | } |
||
176 | |||
177 | if ($this->getOrderItemRepository()->checkExistanceInOrder($orderItem) == 0) { |
||
178 | $subscriptionService->save($orderItem); |
||
179 | $processor = $this->get('newscoop_paywall.processor.discounts'); |
||
180 | $processor->process($orderItem); |
||
181 | $order->calculateTotal(); |
||
182 | $em->flush(); |
||
183 | $this->dispatchNotificationEvent(PaywallEvents::ADMIN_ORDER_SUBSCRIPTION, $orderItem); |
||
184 | |||
185 | $this->get('session')->getFlashBag()->add('success', $translator->trans('paywall.success.created')); |
||
186 | } else { |
||
187 | $this->get('session')->getFlashBag()->add('error', $translator->trans('paywall.manage.error.exists.subscription')); |
||
188 | } |
||
189 | |||
190 | return $this->redirect($this->generateUrl('paywall_plugin_userorder_edit', array( |
||
191 | 'id' => $order->getId(), |
||
192 | ))); |
||
193 | } |
||
194 | |||
195 | return $this->render('NewscoopPaywallBundle:UserOrder:createItem.html.twig', array( |
||
196 | 'form' => $form->createView(), |
||
197 | 'orderId' => $order->getId(), |
||
198 | )); |
||
199 | } |
||
200 | |||
201 | private function getOrderItemRepository() |
||
202 | { |
||
203 | $em = $this->get('em'); |
||
204 | |||
205 | return $em->getRepository('Newscoop\PaywallBundle\Entity\UserSubscription'); |
||
206 | } |
||
207 | |||
208 | private function exists(Order $order) |
||
209 | { |
||
210 | if ($this->getOrderRepository()->findOneById($order->getId())) { |
||
211 | return true; |
||
212 | } |
||
213 | |||
214 | return false; |
||
215 | } |
||
216 | |||
217 | private function getOrderRepository() |
||
218 | { |
||
219 | $em = $this->get('em'); |
||
220 | |||
221 | return $em->getRepository('Newscoop\PaywallBundle\Entity\Order'); |
||
222 | } |
||
223 | |||
224 | private function getActiveSubscriptions($locale) |
||
225 | { |
||
226 | $em = $this->get('em'); |
||
227 | |||
228 | return $em->getRepository('Newscoop\PaywallBundle\Entity\Subscription') |
||
229 | ->findActive($locale) |
||
230 | ->getResult(); |
||
231 | } |
||
232 | } |
||
233 |
Methods can only be called on objects. This check looks for methods being called on variables that have been inferred to never be objects.