ItemModel::addItem()

Complexity

Conditions	19
Paths	122

Size

Total Lines	225
Code Lines	141

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function addItem(
        int $folderId,
        string $label,
        string $password,
        string $description,
        string $login,
        string $email,
        string $url,
        string $tags,
        string $anyone_can_modify,
        string $icon,
        int $userId,
        string $username
    ) : array
    {
        include_once API_ROOT_PATH . '/../sources/main.functions.php';
        $data = [
            'folderId' => $folderId,
            'label' => $label,
            'password' => $password,
            'description' => $description,
            'login' => $login,
            'email' => $email,
            'tags' => $tags,
            'anyoneCanModify' => $anyone_can_modify,
            'url' => $url,
            'icon' => $icon,
        ];
        
        $filters = [
            'folderId' => 'cast:integer',
            'label' => 'trim|escape',
            'password' => 'trim|escape',
            'description' => 'trim|escape',
            'login' => 'trim|escape',
            'email' => 'trim|escape',
            'tags' => 'trim|escape',
            'anyoneCanModify' => 'trim|escape',
            'url' => 'trim|escape',
            'icon' => 'trim|escape',
        ];
        
        $inputData = dataSanitizer(
            $data,
            $filters
        );
        extract($inputData);

It seems like $inputData can also be of type string; however, parameter $array of extract() does only seem to accept array, maybe add an additional type check?

        $lang = new Language();
        include API_ROOT_PATH . '/../includes/config/tp.config.php';

        // is pwd empty?
        if ($this->isPasswordEmptyAllowed($password, $SETTINGS['create_item_without_password'], $lang)) {
            return [

The expression return array('error' => true, 'error_header' => 'HTTP/1.1 422 Unprocessable Entity', 'error_message' => 'Empty password is not allowed') returns the type array<string,string|true> which is incompatible with the documented return type boolean.

                'error' => true,
                'error_header' => 'HTTP/1.1 422 Unprocessable Entity',
                'error_message' => 'Empty password is not allowed'
            ];
        }

        // Check length
        if (strlen($password) > $SETTINGS['pwd_maximum_length']) {
            return [

The expression return array('error' => true, 'error_header' => 'HTTP/1.1 422 Unprocessable Entity', 'error_message' => 'Password is too long (max allowed is ' . $SETTINGS['pwd_maximum_length'] . ' characters)') returns the type array<string,string|true> which is incompatible with the documented return type boolean.

                'error' => true,
                'error_header' => 'HTTP/1.1 422 Unprocessable Entity',
                'error_message' => 'Password is too long (max allowed is ' . $SETTINGS['pwd_maximum_length'] . ' characters)'
            ];
        }

        // Need info in DB
        // About special settings
        $dataFolderSettings = DB::queryFirstRow(
            'SELECT bloquer_creation, bloquer_modification, personal_folder
            FROM ' . prefixTable('nested_tree') . ' 
            WHERE id = %i',
            $inputData['folderId']
        );
        $itemInfos = [];
        $itemInfos['personal_folder'] = $dataFolderSettings['personal_folder'];
        $itemInfos['no_complex_check_on_modification'] = (int) $itemInfos['personal_folder'] === 1 ? 1 : (int) $dataFolderSettings['bloquer_modification'];
        $itemInfos['no_complex_check_on_creation'] = (int) $itemInfos['personal_folder'] === 1 ? 1 : (int) $dataFolderSettings['bloquer_creation'];

        // Get folder complexity
        $folderComplexity = DB::queryfirstrow(
            'SELECT valeur
            FROM ' . prefixTable('misc') . '
            WHERE type = %s AND intitule = %i',
            'complex',
            $inputData['folderId']
        );
        $itemInfos['requested_folder_complexity'] = $folderComplexity !== null ? (int) $folderComplexity['valeur'] : 0;

        // Check COMPLEXITY
        $zxcvbn = new Zxcvbn();
        $passwordStrength = $zxcvbn->passwordStrength($password);
        $folderPasswordStrength = convertPasswordStrength($itemInfos['requested_folder_complexity']);
        if ($passwordStrength['score'] < $folderPasswordStrength && (int) $itemInfos['no_complex_check_on_creation'] === 0) {
            return [

The expression return array('error' => true, 'error_header' => 'HTTP/1.1 422 Unprocessable Entity', 'error_message' => 'Password strength is too low') returns the type array<string,string|true> which is incompatible with the documented return type boolean.

                'error' => true,
                'error_header' => 'HTTP/1.1 422 Unprocessable Entity',
                'error_message' => 'Password strength is too low'
            ];
        }

        // check if element doesn't already exist
        DB::queryfirstrow(
            'SELECT * FROM ' . prefixTable('items') . '
            WHERE label = %s AND inactif = %i',
            $label,
            0
        );
        if (
            DB::count() > 0
            && ((isset($SETTINGS['duplicate_item']) === true && (int) $SETTINGS['duplicate_item'] === 0)
            || (int) $itemInfos['personal_folder'] === 0)
        ) {
            return [

The expression return array('error' => true, 'error_header' => 'HTTP/1.1 422 Unprocessable Entity', 'error_message' => 'Similar item already exists. Duplicates are not allowed.') returns the type array<string,string|true> which is incompatible with the documented return type boolean.

                'error' => true,
                'error_header' => 'HTTP/1.1 422 Unprocessable Entity',
                'error_message' => 'Similar item already exists. Duplicates are not allowed.'
            ];
        }

        // Handle case where pw is empty
        // if not allowed then warn user
        if (
            isset($SETTINGS['create_item_without_password']) === true && (int) $SETTINGS['create_item_without_password'] === 0
            && empty($password) === true
        ) {
            return [

The expression return array('error' => true, 'error_header' => 'HTTP/1.1 422 Unprocessable Entity', 'error_message' => 'Empty password is not allowed.') returns the type array<string,string|true> which is incompatible with the documented return type boolean.

                'error' => true,
                'error_header' => 'HTTP/1.1 422 Unprocessable Entity',
                'error_message' => 'Empty password is not allowed.'
            ];
        }
        if (empty($password) === false) {
            $cryptedStuff = doDataEncryption($password);
            $password = $cryptedStuff['encrypted'];
            $passwordKey = $cryptedStuff['objectKey'];
        } else {
            $passwordKey = '';
        }
        
        // ADD item
        DB::insert(
            prefixTable('items'),
            array(
                'label' => $label,
                'description' => $description,
                'pw' => $password,
                'pw_iv' => '',
                'email' => $email,
                'url' => $url,
                'id_tree' => $folderId,
                'login' => $login,
                'inactif' => 0,
                'restricted_to' => '',
                'perso' => $itemInfos['personal_folder'],
                'anyone_can_modify' => $anyoneCanModify,
                'complexity_level' => $passwordStrength['score'],
                'encryption_type' => 'teampass_aes',
                'fa_icon' => $icon,
                'item_key' => uniqidReal(50),
                'created_at' => time(),
            )
        );
        $newID = DB::insertId();

        // Create sharekeys for the user itself
        storeUsersShareKey(
            prefixTable('sharekeys_items'),
            (int) $itemInfos['personal_folder'],
            (int) $folderId,
            (int) $newID,
            $passwordKey,
            true,   // only for the item creator
            false,  // no delete all
            [],
            -1,
            $userId
        );

        // log
        logItems(
            $SETTINGS,
            (int) $newID,
            $label,
            $userId,
            'at_creation',
            $username
        );

        // Create new task for the new item
        // If it is not a personnal one
        if ((int) $itemInfos['personal_folder'] === 0) {
            storeTask(
                'new_item',
                $userId,
                0,
                (int) $folderId,
                (int) $newID,
                $passwordKey,
                [],
                [],
            );
        }

        // Add tags
        $tags = explode(',', $tags);
        foreach ($tags as $tag) {
            if (empty($tag) === false) {
                DB::insert(
                    prefixTable('tags'),
                    array(
                        'item_id' => $newID,
                        'tag' => strtolower($tag),
                    )
                );
            }
        }

        return [

The expression return array('error' => false, 'message' => 'Item added successfully', 'newId' => $newID) returns the type array<string,false|mixed|string> which is incompatible with the documented return type boolean.

            'error' => false,
            'message' => 'Item added successfully',
            'newId' => $newID,
        ];
}