nixsolutions /
yandex-php-library
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | if (!isset($_REQUEST['databaseId']) || !$_REQUEST['databaseId']) { |
||
| 3 | header('Location: index.php'); |
||
| 4 | } |
||
| 5 | $settings = require_once '../settings.php'; |
||
| 6 | use Yandex\DataSync\DataSyncClient; |
||
| 7 | use Yandex\Common\Exception\ForbiddenException; |
||
| 8 | use \Yandex\DataSync\Models\Database\Delta\RecordFieldValue; |
||
| 9 | use \Yandex\DataSync\Models\Database\Delta\RecordField; |
||
| 10 | use \Yandex\DataSync\Models\Database\Delta\Record; |
||
| 11 | use \Yandex\DataSync\Models\Database\Delta; |
||
| 12 | |||
| 13 | $errorMessage = false; |
||
| 14 | |||
| 15 | // Is auth |
||
| 16 | if (isset($_COOKIE['yaAccessToken']) && isset($_COOKIE['yaClientId'])) { |
||
| 17 | $dataSync = new DataSyncClient($_COOKIE['yaAccessToken']); |
||
| 18 | $context = Yandex\DataSync\DataSyncClient::CONTEXT_USER; |
||
| 19 | $databaseId = $_REQUEST['databaseId']; |
||
| 20 | //Устанавливаем Контекст базы данных (app или user) |
||
| 21 | $dataSync->setContext($context); |
||
| 22 | //Устанавливаем Идентификатор базы данных (можно указать позже, непосредственно в запросах) |
||
| 23 | $dataSync->setDatabaseId($databaseId); |
||
| 24 | |||
| 25 | try { |
||
| 26 | //Получение информации о базе данных |
||
| 27 | //@see https://tech.yandex.ru/datasync/http/doc/tasks/get-database-docpage/ |
||
| 28 | $database = $dataSync->getDatabase($databaseId); |
||
| 29 | |||
| 30 | if (isset($_REQUEST['action'])) { |
||
| 31 | if ($_REQUEST['action'] === 'editTitle' && isset($_REQUEST['title']) && $_REQUEST['title']) { |
||
| 32 | //Изменение заголовка базы данных |
||
| 33 | //@see https://tech.yandex.ru/datasync/http/doc/tasks/edit-title-docpage/ |
||
| 34 | $database = $dataSync->updateDatabaseTitle($_REQUEST['title'], $databaseId); |
||
| 35 | } elseif ($_REQUEST['action'] === 'createField' |
||
| 36 | && isset($_REQUEST['collectionId']) && $_REQUEST['collectionId'] |
||
| 37 | && isset($_REQUEST['recordId']) && $_REQUEST['recordId'] |
||
| 38 | && isset($_REQUEST['recordChangeType']) && $_REQUEST['recordChangeType'] |
||
| 39 | ) { |
||
| 40 | if ($_REQUEST['recordChangeType'] === Record::CHANGE_TYPE_INSERT |
||
| 41 | || $_REQUEST['recordChangeType'] === Record::CHANGE_TYPE_UPDATE |
||
| 42 | || $_REQUEST['recordChangeType'] === Record::CHANGE_TYPE_SET |
||
| 43 | || $_REQUEST['recordChangeType'] === Record::CHANGE_TYPE_DELETE |
||
| 44 | |||
| 45 | ) { |
||
| 46 | $delta = new Delta(); |
||
| 47 | //Поясняющий комментарий к изменению. |
||
| 48 | $delta->setDeltaId('insert record ' . $_REQUEST['recordId']); |
||
| 49 | //Запись |
||
| 50 | $record = new Record(); |
||
| 51 | //Тип изменения, применяемого к записи. |
||
| 52 | //@see https://tech.yandex.ru/datasync/http/doc/tasks/create-changes-docpage/#changes-types |
||
| 53 | $record->setChangeType($_REQUEST['recordChangeType']) |
||
| 54 | //Идентификатор коллекции, которой принадлежит запись. Уникальный для БД |
||
| 55 | ->setCollectionId($_REQUEST['collectionId']) |
||
| 56 | //Идентификатор записи. Уникальный для Коллекции |
||
| 57 | ->setRecordId($_REQUEST['recordId']); |
||
| 58 | |||
| 59 | if (isset($_REQUEST['fieldChangeType']) && $_REQUEST['fieldChangeType'] |
||
| 60 | && isset($_REQUEST['fieldId']) && $_REQUEST['fieldId'] |
||
| 61 | ) { |
||
| 62 | //Поле |
||
| 63 | $field = new RecordField(); |
||
| 64 | //Тип изменения, применяемого к полю записи |
||
| 65 | //@see https://tech.yandex.ru/datasync/http/doc/tasks/create-changes-docpage/#changes-types |
||
| 66 | $field->setChangeType($_REQUEST['fieldChangeType']); |
||
| 67 | //Идентификатор поля. |
||
| 68 | $field->setFieldId($_REQUEST['fieldId']); |
||
| 69 | if (isset($_REQUEST['value']) && $_REQUEST['value']) { |
||
| 70 | |||
| 71 | //Указание значение и его типа |
||
| 72 | //Если Тип значения не указан, то он определиться автоматически |
||
| 73 | //@see https://tech.yandex.ru/datasync/http/doc/tasks/create-changes-docpage/#data-types |
||
| 74 | $recordFieldValue = new RecordFieldValue(); |
||
| 75 | $recordFieldValue->setValue($_REQUEST['value']); |
||
| 76 | //установка Значения |
||
| 77 | $field->setValue($recordFieldValue); |
||
| 78 | } |
||
| 79 | //Изменения отдельных полей записи. |
||
| 80 | $record->setChanges([$field]); |
||
| 81 | } |
||
| 82 | //Изменения отдельных записей базы данных. |
||
| 83 | $delta->setChanges([$record]); |
||
| 84 | //@see https://tech.yandex.ru/datasync/http/doc/tasks/create-changes-docpage/ |
||
| 85 | $dataSync->saveDelta($delta->toArray(), $database->getRevision()); |
||
| 86 | //Получение "свежей" информации о БД |
||
| 87 | $database = $dataSync->getDatabase($databaseId); |
||
| 88 | } |
||
| 89 | } |
||
| 90 | } |
||
| 91 | |||
| 92 | //Получение снапшота базы данных |
||
| 93 | //@see https://tech.yandex.ru/datasync/http/doc/tasks/get-snapshot-docpage/ |
||
| 94 | $snapshotResponse = $dataSync->getDatabaseSnapshot($database->getDatabaseId()); |
||
| 95 | $collections = []; |
||
| 96 | /** @var Record $record */ |
||
| 97 | foreach ($snapshotResponse->getRecords()->getItems() as $record) { |
||
| 98 | //$record - запись в Коллекции |
||
| 99 | $collections[$record->getCollectionId()][$record->getRecordId()] = []; |
||
| 100 | foreach ($record->getFields()->getAll() as $field) { |
||
| 101 | //$field - поле в Записи |
||
| 102 | $collections[$record->getCollectionId()][$record->getRecordId()][$field->getFieldId()] = |
||
| 103 | $field->getValue()->getValue(); |
||
| 104 | } |
||
| 105 | } |
||
| 106 | } catch (ForbiddenException $ex) { |
||
| 107 | $errorMessage = $ex->getMessage(); |
||
| 108 | $errorMessage .= '<p>Возможно, у приложения нет прав на доступ к ресурсу. Попробуйте ' |
||
| 109 | . '<a href="' . rtrim(str_replace($_SERVER['DOCUMENT_ROOT'], '', __DIR__), "/") . "/../OAuth/" . |
||
| 110 | '">авторизироваться</a> и повторить.</p>'; |
||
| 111 | } catch (Exception $ex) { |
||
| 112 | $errorMessage = $ex->getMessage(); |
||
| 113 | } |
||
| 114 | } |
||
| 115 | ?> |
||
| 116 | <!doctype html> |
||
| 117 | <html lang="en-US"> |
||
| 118 | <head> |
||
| 119 | <meta charset="UTF-8"> |
||
| 120 | <title>Yandex PHP Library: DataSync Demo</title> |
||
| 121 | <link rel="stylesheet" href="//yandex.st/bootstrap/3.0.0/css/bootstrap.min.css"> |
||
| 122 | <link href="//netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css" rel="stylesheet"> |
||
| 123 | <link rel="stylesheet" href="/examples/Disk/css/style.css"> |
||
| 124 | </head> |
||
| 125 | <body> |
||
| 126 | <div class="container"> |
||
| 127 | <div class="jumbotron"> |
||
| 128 | <h2><span class="glyphicon glyphicon-shopping-cart"></span> Пример работы с Яндекс DataSync HTTP API</h2> |
||
| 129 | </div> |
||
| 130 | <ol class="breadcrumb"> |
||
| 131 | <li><a href="/examples">Examples</a></li> |
||
| 132 | <li><a href="/examples/DataSync">DataSync</a></li> |
||
| 133 | <li class="active"><?= $database->getDatabaseId() ?></li> |
||
| 134 | </ol> |
||
| 135 | <?php |
||
| 136 | if (!isset($_COOKIE['yaAccessToken']) || !isset($_COOKIE['yaClientId'])) { |
||
| 137 | ?> |
||
| 138 | <div class="alert alert-info"> |
||
| 139 | Для просмотра этой страници вам необходимо авторизироваться. |
||
| 140 | <a id="goToAuth" |
||
| 141 | href="<?php echo rtrim(str_replace($_SERVER['DOCUMENT_ROOT'], '', __DIR__), "/") . '/../OAuth/' ?>" |
||
| 142 | class="alert-link">Перейти на страницу авторизации</a>. |
||
| 143 | </div> |
||
| 144 | <?php |
||
| 145 | } elseif ($errorMessage) { |
||
|
0 ignored issues
–
show
|
|||
| 146 | ?> |
||
| 147 | <div class="alert alert-danger"> |
||
| 148 | <?= $errorMessage ?> |
||
| 149 | </div> |
||
| 150 | <?php |
||
| 151 | } elseif (isset($database)) { |
||
| 152 | ?> |
||
| 153 | <div> |
||
| 154 | <form class="form-horizontal" action="database.php?databaseId=<?= $database->getDatabaseId() ?>" method="post"> |
||
| 155 | <div class="form-group"> |
||
| 156 | <label class="col-sm-2 control-label">Идентификатор</label> |
||
| 157 | |||
| 158 | <div class="col-sm-10"> |
||
| 159 | <?= $database->getDatabaseId() ?> |
||
| 160 | </div> |
||
| 161 | </div> |
||
| 162 | <div class="form-group"> |
||
| 163 | <label for="databaseTitle" class="col-sm-2 control-label">Название</label> |
||
| 164 | |||
| 165 | <div class="col-sm-10"> |
||
| 166 | <input type="text" class="form-control" id="databaseTitle" |
||
| 167 | name="title" |
||
| 168 | value="<?= $database->getTitle() ?>" |
||
| 169 | placeholder="Название"> |
||
| 170 | </div> |
||
| 171 | </div> |
||
| 172 | <div class="form-group"> |
||
| 173 | <label class="col-sm-2 control-label">Номер ревизии</label> |
||
| 174 | |||
| 175 | <div class="col-sm-10"> |
||
| 176 | <?= $database->getRevision() ?> |
||
| 177 | </div> |
||
| 178 | </div> |
||
| 179 | <div class="form-group"> |
||
| 180 | <label class="col-sm-2 control-label">Количество записей</label> |
||
| 181 | |||
| 182 | <div class="col-sm-10"> |
||
| 183 | <?= $database->getRecordsCount() ?> |
||
| 184 | </div> |
||
| 185 | </div> |
||
| 186 | <div class="form-group"> |
||
| 187 | <label class="col-sm-2 control-label">Дата и время модификации</label> |
||
| 188 | |||
| 189 | <div class="col-sm-10"> |
||
| 190 | <?= $database->getModified() ?> |
||
| 191 | </div> |
||
| 192 | </div> |
||
| 193 | <div class="form-group"> |
||
| 194 | <label class="col-sm-2 control-label">Дата и время создания</label> |
||
| 195 | |||
| 196 | <div class="col-sm-10"> |
||
| 197 | <?= $database->getCreated() ?> |
||
| 198 | </div> |
||
| 199 | </div> |
||
| 200 | <div class="form-group"> |
||
| 201 | <label class="col-sm-2 control-label">Размер</label> |
||
| 202 | |||
| 203 | <div class="col-sm-10"> |
||
| 204 | <?= $database->getSize() ?> |
||
| 205 | </div> |
||
| 206 | </div> |
||
| 207 | <div class="form-group"> |
||
| 208 | <div class="col-sm-offset-2 col-sm-10"> |
||
| 209 | <input type="hidden" name="action" value="editTitle"> |
||
| 210 | <button type="submit" class="btn btn-default">Сохранить</button> |
||
| 211 | </div> |
||
| 212 | </div> |
||
| 213 | </form> |
||
| 214 | |||
| 215 | <?php foreach ($collections as $collectionName => $records) { ?> |
||
| 216 | <div class="col-sm-2"><h3><?php echo $collectionName;//Идентификатор Коллекции ?></h3></div> |
||
| 217 | <div class="col-sm-10"> |
||
| 218 | <?php foreach ($records as $recordName => $fields) { ?> |
||
| 219 | <h4><?php echo $recordName;//Идентификатор Записи ?></h4> |
||
| 220 | <table id="accountTable" class="table table-striped table-bordered table-hover"> |
||
| 221 | <thead> |
||
| 222 | <tr> |
||
| 223 | <td>Поле</td> |
||
| 224 | <td>Значение</td> |
||
| 225 | </tr> |
||
| 226 | </thead> |
||
| 227 | <tbody> |
||
| 228 | <?php foreach ($fields as $fieldName => $value) { ?> |
||
| 229 | <tr> |
||
| 230 | <td><?php echo $fieldName;//Идентификатор Поля ?></td> |
||
| 231 | <td><?php echo $value;//Значение Поля ?></td> |
||
| 232 | </tr> |
||
| 233 | |||
| 234 | <?php } ?> |
||
| 235 | </tbody> |
||
| 236 | </table> |
||
| 237 | <?php } ?> |
||
| 238 | </div> |
||
| 239 | <?php } ?> |
||
| 240 | |||
| 241 | <button type="button" class="btn btn-primary btn-lg" data-toggle="modal" data-target="#createFieldModal"> |
||
| 242 | Создать новую запись в БД |
||
| 243 | </button> |
||
| 244 | |||
| 245 | <!-- Modal --> |
||
| 246 | <div class="modal fade" id="createFieldModal" tabindex="-1" role="dialog" aria-labelledby="myModalLabel"> |
||
| 247 | <div class="modal-dialog" role="document"> |
||
| 248 | <div class="modal-content"> |
||
| 249 | <form class="form-horizontal" action="database.php?databaseId=<?= $database->getDatabaseId() ?>" |
||
| 250 | method="post"> |
||
| 251 | <div class="modal-header"> |
||
| 252 | <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span |
||
| 253 | aria-hidden="true">×</span></button> |
||
| 254 | <h4 class="modal-title" id="myModalLabel">Создать новую запись в БД</h4> |
||
| 255 | </div> |
||
| 256 | <div class="modal-body"> |
||
| 257 | <div class="form-group"> |
||
| 258 | <label for="inputCollectionId" class="col-sm-4 control-label">Идентификатор |
||
| 259 | коллекции</label> |
||
| 260 | |||
| 261 | <div class="col-sm-8"> |
||
| 262 | <input type="text" name="collectionId" list="collections" |
||
| 263 | class="form-control" |
||
| 264 | id="inputCollectionId" |
||
| 265 | placeholder="Идентификатор коллекции"/> |
||
| 266 | <datalist id="collections"></datalist> |
||
| 267 | </div> |
||
| 268 | </div> |
||
| 269 | |||
| 270 | <div class="form-group"> |
||
| 271 | <label for="inputRecordId" class="col-sm-4 control-label">Идентификатор записи</label> |
||
| 272 | |||
| 273 | <div class="col-sm-8"> |
||
| 274 | <input type="text" name="recordId" list="records" |
||
| 275 | class="form-control" |
||
| 276 | id="inputRecordId" |
||
| 277 | placeholder="Идентификатор записи"/> |
||
| 278 | <datalist id="records"></datalist> |
||
| 279 | </div> |
||
| 280 | </div> |
||
| 281 | |||
| 282 | <div class="form-group"> |
||
| 283 | <label for="inputRecordChangeType" class="col-sm-4 control-label">Тип изменения |
||
| 284 | записи</label> |
||
| 285 | |||
| 286 | <div class="col-sm-8"> |
||
| 287 | <select class="form-control" name="recordChangeType" id="inputRecordChangeType"> |
||
| 288 | <option value="insert">insert - Добавление новой записи.</option> |
||
| 289 | <option value="update">update - Частичное изменение записи (изменяются только |
||
| 290 | указанные поля, все существующие поля записи сохраняются). |
||
| 291 | </option> |
||
| 292 | <option value="set">set - Полное изменение записи (все существующие поля |
||
| 293 | удаляются). |
||
| 294 | </option> |
||
| 295 | <option value="delete">delete - Удаление записи.</option> |
||
| 296 | </select> |
||
| 297 | </div> |
||
| 298 | </div> |
||
| 299 | |||
| 300 | <div class="form-group"> |
||
| 301 | <label for="inputFieldChangeType" class="col-sm-4 control-label">Тип изменения |
||
| 302 | поля</label> |
||
| 303 | |||
| 304 | <div class="col-sm-8"> |
||
| 305 | <select class="form-control" name="fieldChangeType" id="inputFieldChangeType"> |
||
| 306 | <option value="set">set - Добавление нового поля или изменение значения уже |
||
| 307 | существующего. |
||
| 308 | </option> |
||
| 309 | <option value="delete">delete - Удаление поля.</option> |
||
| 310 | </select> |
||
| 311 | </div> |
||
| 312 | </div> |
||
| 313 | |||
| 314 | <div class="form-group"> |
||
| 315 | <label for="inputFieldId" class="col-sm-4 control-label">Идентификатор поля</label> |
||
| 316 | |||
| 317 | <div class="col-sm-8"> |
||
| 318 | <input type="text" name="fieldId" |
||
| 319 | class="form-control" |
||
| 320 | id="inputFieldId" |
||
| 321 | placeholder="Идентификатор поля"/> |
||
| 322 | </div> |
||
| 323 | </div> |
||
| 324 | |||
| 325 | <div class="form-group"> |
||
| 326 | <label for="value" class="col-sm-4 control-label">Данные, которые необходимо |
||
| 327 | синхронизировать</label> |
||
| 328 | |||
| 329 | <div class="col-sm-8"> |
||
| 330 | <input type="text" name="value" |
||
| 331 | class="form-control" |
||
| 332 | id="value" |
||
| 333 | placeholder="Данные, которые необходимо синхронизировать"/> |
||
| 334 | </div> |
||
| 335 | </div> |
||
| 336 | </div> |
||
| 337 | <div class="modal-footer"> |
||
| 338 | <input type="hidden" name="action" value="createField"> |
||
| 339 | <button type="button" class="btn btn-default" data-dismiss="modal">Close</button> |
||
| 340 | <button type="submit" class="btn btn-primary">Save changes</button> |
||
| 341 | </div> |
||
| 342 | </form> |
||
| 343 | </div> |
||
| 344 | </div> |
||
| 345 | </div> |
||
| 346 | |||
| 347 | </div> |
||
| 348 | <?php |
||
| 349 | } |
||
| 350 | ?> |
||
| 351 | <script src="http://yandex.st/jquery/2.0.3/jquery.min.js"></script> |
||
| 352 | <script src="http://yandex.st/jquery/cookie/1.0/jquery.cookie.min.js"></script> |
||
| 353 | <script src="//maxcdn.bootstrapcdn.com/bootstrap/3.2.0/js/bootstrap.min.js"></script> |
||
| 354 | <script> |
||
| 355 | var collections = []; |
||
| 356 | $(function () { |
||
| 357 | $('#goToAuth').click(function (e) { |
||
| 358 | $.cookie('back', location.href, {expires: 256, path: '/'}); |
||
| 359 | }); |
||
| 360 | collections = <?=($collections)? json_encode($collections): '[]'?>; |
||
| 361 | |||
| 362 | var $records = $('#records'); |
||
| 363 | var $collections = $('#collections'); |
||
| 364 | //Populate datalist from collections |
||
| 365 | var collectionsHtml = ''; |
||
| 366 | for (var collectionName in collections) { |
||
| 367 | collectionsHtml += '<option value="' + collectionName + '">' + collectionName + '</option>'; |
||
| 368 | } |
||
| 369 | $collections.html(collectionsHtml); |
||
| 370 | |||
| 371 | $('#inputCollectionId').change(function () { |
||
| 372 | var collectionId = $(this).val(); |
||
| 373 | //Remove old |
||
| 374 | $records.find('option').remove(); |
||
| 375 | //Populate from collection |
||
| 376 | if (collectionId && collections.hasOwnProperty(collectionId)) { |
||
| 377 | var recordsHtml = ''; |
||
| 378 | for (var recordName in collections[collectionId]) { |
||
| 379 | recordsHtml += '<option value="' + recordName + '">' + recordName + '</option>'; |
||
| 380 | } |
||
| 381 | $records.html(recordsHtml); |
||
| 382 | } |
||
| 383 | }); |
||
| 384 | }); |
||
| 385 | </script> |
||
| 386 | </body> |
||
| 387 | </html> |
||
| 388 |
In PHP, under loose comparison (like
==, or!=, orswitchconditions), values of different types might be equal.For
stringvalues, the empty string''is a special case, in particular the following results might be unexpected: