This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace app\modules\user\controllers; |
||
4 | |||
5 | use app\modules\mailTemplate\models\Mail; |
||
6 | use app\modules\mailTemplate\models\MailTemplate; |
||
7 | use app\modules\user\models\forms\ChangePasswordForm; |
||
8 | use app\modules\user\models\forms\UserForm; |
||
9 | use app\modules\user\models\Hash; |
||
10 | use app\modules\user\models\User; |
||
11 | use Yii; |
||
12 | use yii\filters\AccessControl; |
||
13 | use yii\helpers\Url; |
||
14 | use yii\web\BadRequestHttpException; |
||
15 | use yii\web\Controller; |
||
16 | use yii\web\NotFoundHttpException; |
||
17 | use yii\web\ServerErrorHttpException; |
||
18 | |||
19 | /** |
||
20 | * Class DefaultController |
||
21 | * |
||
22 | * @package app\modules\user\controllers |
||
23 | */ |
||
24 | class DefaultController extends Controller |
||
25 | { |
||
26 | /** |
||
27 | * @inheritdoc |
||
28 | */ |
||
29 | 12 | View Code Duplication | public function behaviors() |
0 ignored issues
–
show
|
|||
30 | { |
||
31 | return [ |
||
32 | 'access' => [ |
||
33 | 12 | 'class' => AccessControl::className(), |
|
34 | 'rules' => [ |
||
35 | [ |
||
36 | 'allow' => true, |
||
37 | 'actions' => ['profile', 'update', 'send-change-password-mail', 'change-password'], |
||
38 | 'roles' => ['@'], |
||
39 | ], |
||
40 | ] |
||
41 | 12 | ], |
|
42 | ]; |
||
43 | } |
||
44 | |||
45 | /** |
||
46 | * Display user profile |
||
47 | * |
||
48 | * @return string |
||
49 | */ |
||
50 | 6 | public function actionProfile() |
|
51 | { |
||
52 | 6 | return $this->render('profile', [ |
|
53 | 6 | 'model' => $this->findModel(Yii::$app->user->getId()), |
|
54 | ]); |
||
55 | } |
||
56 | |||
57 | /** |
||
58 | * Updates an existing Users model. |
||
59 | * If update is successful, the browser will be redirected to the 'profile' page. |
||
60 | * |
||
61 | * @param integer $id |
||
62 | * @return mixed |
||
63 | */ |
||
64 | 2 | public function actionUpdate($id) |
|
65 | { |
||
66 | 2 | $user = $this->findModel($id); |
|
67 | 2 | $userForm = new UserForm(['scenario' => UserForm::SCENARIO_PROFILE]); |
|
68 | 2 | $userForm->setAttributes($user->attributes); |
|
69 | |||
70 | 2 | if ($userForm->load(Yii::$app->request->post()) && $userForm->validate()) { |
|
71 | 1 | $user->setAttributes($userForm->attributes); |
|
72 | 1 | $user->update(false); |
|
73 | 1 | Yii::$app->getSession()->setFlash('success', Yii::t('user', 'Information saved.')); |
|
0 ignored issues
–
show
The method
getSession does only exist in yii\web\Application , but not in yii\console\Application .
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
![]() |
|||
74 | 1 | return $this->redirect(['profile']); |
|
75 | } |
||
76 | |||
77 | 2 | return $this->render('update', [ |
|
78 | 2 | 'userForm' => $userForm, |
|
79 | 2 | 'id' => $user->id, |
|
80 | ]); |
||
81 | } |
||
82 | |||
83 | /** |
||
84 | * Finds the Users model based on its primary key value. |
||
85 | * If the model is not found, a 404 HTTP exception will be thrown. |
||
86 | * |
||
87 | * @param integer $id |
||
88 | * @return User the loaded model |
||
89 | * @throws NotFoundHttpException if the model cannot be found |
||
90 | */ |
||
91 | 7 | View Code Duplication | protected function findModel($id) |
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
92 | { |
||
93 | 7 | $model = User::findOne($id); |
|
94 | 7 | if (null === $model) { |
|
95 | throw new NotFoundHttpException('The requested page does not exist.'); |
||
96 | } |
||
97 | 7 | return $model; |
|
98 | } |
||
99 | |||
100 | /** |
||
101 | * Sends link for changing password on user email |
||
102 | * |
||
103 | * @return string|\yii\web\Response |
||
104 | * @throws ServerErrorHttpException |
||
105 | */ |
||
106 | 1 | public function actionSendChangePasswordMail() |
|
107 | { |
||
108 | 1 | $user = $this->findModel(Yii::$app->user->getId()); |
|
109 | |||
110 | 1 | if (!$mailTemplate = MailTemplate::findByKey(MailTemplate::CHANGE_PASSWORD)) { |
|
111 | throw new ServerErrorHttpException('The server encountered an internal error and could not complete your request.'); |
||
112 | } |
||
113 | |||
114 | 1 | $hash = new Hash(); |
|
115 | 1 | $mailTemplate->replacePlaceholders([ |
|
116 | 1 | 'name' => $user->first_name, |
|
117 | 1 | 'link' => Yii::$app->urlManager->createAbsoluteUrl([ |
|
118 | 1 | Url::to('user/default/change-password'), |
|
119 | 1 | 'hash' => $hash->generate(Hash::TYPE_CHANGE_PASSWORD, $user->id), |
|
120 | ]), |
||
121 | ]); |
||
122 | |||
123 | 1 | $mail = new Mail(); |
|
124 | 1 | $mail->setTemplate($mailTemplate); |
|
125 | 1 | $mail->sendTo($user->email); |
|
126 | |||
127 | 1 | Yii::$app->session->setFlash( |
|
128 | 1 | 'success', |
|
129 | 1 | Yii::t('user', 'Please check your email and follow instructions to change your password.') |
|
130 | ); |
||
131 | 1 | return $this->render('profile', [ |
|
132 | 1 | 'model' => $user, |
|
133 | ]); |
||
134 | } |
||
135 | |||
136 | /** |
||
137 | * @return string|\yii\web\Response |
||
138 | * @throws BadRequestHttpException |
||
139 | * @throws ServerErrorHttpException |
||
140 | */ |
||
141 | 5 | View Code Duplication | public function actionChangePassword() |
0 ignored issues
–
show
This method seems to be duplicated in your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
142 | { |
||
143 | 5 | if (!$hash = Yii::$app->request->get('hash')) { |
|
144 | throw new BadRequestHttpException(); |
||
145 | } |
||
146 | 5 | if (!$user = User::findByHash($hash)) { |
|
147 | throw new ServerErrorHttpException('The server encountered an internal error and could not complete your request.'); |
||
148 | } |
||
149 | 5 | $changePasswordForm = new ChangePasswordForm(); |
|
150 | 5 | if ($user->changePassword($changePasswordForm)) { |
|
151 | 1 | return $this->goHome(); |
|
152 | } |
||
153 | 5 | return $this->render('change-password', [ |
|
154 | 5 | 'model' => $changePasswordForm, |
|
155 | ]); |
||
156 | } |
||
157 | } |
||
158 |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.