Issues (89)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

modules/user/models/User.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace app\modules\user\models;
4
5
use app\modules\user\models\forms\ChangePasswordForm;
6
use Yii;
7
use yii\base\Exception;
8
use yii\behaviors\TimestampBehavior;
9
use yii\db\ActiveRecord;
10
use yii\helpers\ArrayHelper;
11
use yii\web\IdentityInterface;
12
use yii\web\ServerErrorHttpException;
13
14
/**
15
 * This is the model class for table "users".
16
 *
17
 * @property integer $id
18
 * @property string $first_name
19
 * @property string $last_name
20
 * @property string $email
21
 * @property string $password
22
 * @property string $avatar
23
 * @property string $status
24
 * @property string $created_at
25
 * @property string $last_login_at
26
 * @property string $auth_key
27
 * @property string $auth_provider
28
 * @property string $social_id
29
 */
30
class User extends ActiveRecord implements IdentityInterface
31
{
32
    /** Active user status */
33
    const STATUS_ACTIVE = 'active';
34
35
    /** Blocked user status */
36
    const STATUS_BLOCKED = 'blocked';
37
38
    /** Created user status */
39
    const STATUS_CREATED = 'created';
40
41
    /** Role user */
42
    const ROLE_USER = 'user';
43
44
    /** Role admin */
45
    const ROLE_ADMIN = 'admin';
46
47
    const DEFAULT_AVATAR_URL = '/img/no_image.png';
48
49
    public $rememberMe = true;
50
51
    /**
52
     * @inheritdoc
53
     */
54 52
    public static function tableName()
55
    {
56 52
        return 'users';
57
    }
58
59
    /**
60
     * @inheritdoc
61
     */
62 7
    public function rules()
63
    {
64
        return [
65 7
            ['id', 'integer'],
66
            [['status'], 'string'],
67
            ['email', 'email'],
68
            ['email', 'unique'],
69
            [['created_at', 'last_login_at'], 'safe'],
70
            [['auth_key', 'avatar', 'email', 'password', 'auth_provider'], 'string'],
71
            [['first_name', 'last_name'], 'string', 'max' => 64],
72
        ];
73
    }
74
75
    /**
76
     * @inheritdoc
77
     */
78 10
    public function attributeLabels()
79
    {
80
        return [
81 10
            'id' => Yii::t('user', 'ID'),
82 10
            'first_name' => Yii::t('user', 'First name'),
83 10
            'last_name' => Yii::t('user', 'Last name'),
84 10
            'email' => Yii::t('user', 'Email'),
85 10
            'password' => Yii::t('user', 'Password'),
86 10
            'avatar' => Yii::t('user', 'Avatar'),
87 10
            'status' => Yii::t('user', 'Status'),
88 10
            'created_at' => Yii::t('user', 'Registration time'),
89 10
            'last_login_at' => Yii::t('user', 'Last sign in'),
90
        ];
91
    }
92
93
    /**
94
     * @return array
95
     */
96 54 View Code Duplication
    public function behaviors()
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
97
    {
98
        return [
99
            [
100 54
                'class' => TimestampBehavior::className(),
101
                'attributes' => [
102 54
                    ActiveRecord::EVENT_BEFORE_INSERT => ['created_at'],
103
                ],
104 54
                'value' => date('Y-m-d H:i:s'),
105 54
            ],
106
        ];
107
    }
108
109
    /**
110
     * @inheritdoc
111
     */
112 44
    public static function findIdentity($id)
113
    {
114 44
        return static::findOne($id);
115
    }
116
117
    /**
118
     * @inheritdoc
119
     */
120
    public static function findIdentityByAccessToken($token, $type = null)
121
    {
122
        return static::findOne(['accessToken' => $token]);
123
    }
124
125
    /**
126
     * @param $email
127
     * @return static
128
     */
129 2
    public static function findByEmail($email)
130
    {
131 2
        return static::findOne(['email' => $email]);
132
    }
133
134
    /**
135
     * @inheritdoc
136
     */
137 46
    public function getId()
138
    {
139 46
        return $this->id;
140
    }
141
142
    /**
143
     * @inheritdoc
144
     */
145 2
    public function getAuthKey()
146
    {
147 2
        return $this->auth_key;
148
    }
149
150
    /**
151
     * @inheritdoc
152
     */
153
    public function validateAuthKey($authKey)
154
    {
155
        return $this->auth_key === $authKey;
156
    }
157
158
    /**
159
     * Validates password
160
     *
161
     * @param string $password password to validate
162
     * @return bool if password provided is valid for current user
163
     */
164 1
    public function validatePassword($password)
165
    {
166 1
        return Yii::$app->security->validatePassword($password, $this->password);
167
    }
168
169
    /**
170
     * @return bool
171
     */
172 1
    public function hasEmptyPassword()
173
    {
174 1
        return empty($this->password);
175
    }
176
177
    /**
178
     * Logs in a user using the provided username and password.
179
     *
180
     * @return boolean whether the user is logged in successfully
181
     * @throws Exception
182
     */
183 2
    public function login()
184
    {
185 2
        if (!Yii::$app->user->login($this, $this->rememberMe ? 3600 * 24 * 7 : 0)) {
186
            throw new Exception('User could not be logged in.');
187
        }
188 2
        $this->last_login_at = date('Y-m-d H:i:s');
189 2
        $this->update();
190 2
    }
191
192
    /**
193
     * @param $userData
194
     * @return User
195
     */
196 2
    public function create($userData)
197
    {
198 2
        $this->first_name = $userData->firstName;
199 2
        $this->last_name = $userData->lastName;
200 2
        $this->email = $userData->email;
201 2
        $this->password = Yii::$app->security->generatePasswordHash($userData->password);
202 2
        $this->auth_key = Yii::$app->security->generateRandomString();
203 2
        $this->avatar = self::DEFAULT_AVATAR_URL;
204
205 2
        $this->save();
206 2
        $this->setRole(self::ROLE_USER);
207 2
        return $this;
208
    }
209
210
    /**
211
     * Set new role
212
     *
213
     * @param $role
214
     */
215 3
    public function setRole($role)
216
    {
217 3
        $auth = Yii::$app->authManager;
218 3
        $auth->revokeAll($this->id);
219 3
        $userRole = $auth->getRole($role);
220 3
        $auth->assign($userRole, $this->getId());
221 3
    }
222
223
    /**
224
     * Return role for user
225
     *
226
     * @return string
227
     */
228 12
    public function getRoleName()
229
    {
230 12
        $auth = Yii::$app->authManager;
231 12
        $userRole = $auth->getRolesByUser($this->id);
232 12
        return !empty($userRole) ? array_shift($userRole)->name : '';
233
    }
234
235
    /**
236
     * @param $hash
237
     * @return static
238
     * @throws ServerErrorHttpException
239
     */
240 10
    public static function findByHash($hash)
241
    {
242 10
        if (!$hash = Hash::findOne(['hash' => $hash])) {
243
            throw new ServerErrorHttpException('The server encountered an internal error and could not complete your request.');
244
        }
245 10
        return static::findOne($hash->user_id);
246
    }
247
248
    /**
249
     * @param $socialId
250
     * @return static
251
     */
252
    public static function findBySocialId($socialId)
253
    {
254
        return static::findOne(['social_id' => $socialId]);
255
    }
256
257
    /**
258
     * @param $userAttributes
259
     * @return bool
260
     */
261
    public function saveSocialAccountInfo($userAttributes)
262
    {
263
        if ($this->isNewRecord) {
264
            $this->first_name = ArrayHelper::getValue($userAttributes, 'firstName');
265
            $this->last_name = ArrayHelper::getValue($userAttributes, 'lastName');
266
            $this->email = ArrayHelper::getValue($userAttributes, 'email');
267
            $this->avatar = ArrayHelper::getValue($userAttributes, 'avatar');
268
            $this->status = self::STATUS_ACTIVE;
269
        }
270
        $this->social_id = ArrayHelper::getValue($userAttributes, 'socialId');
271
        $this->auth_provider = ArrayHelper::getValue($userAttributes, 'authProvider');
272
273
        return $this->save();
274
    }
275
276
    /**
277
     * @param $form
278
     * @return bool
279
     */
280 10
    public function changePassword($form)
281
    {
282 10
        if ($form->load(Yii::$app->request->post()) && $form->validate()) {
283 2
            $this->password = Yii::$app->security->generatePasswordHash($form->newPassword);
284 2
            $this->update();
285 2
            Hash::findByUserId($this->id)->delete();
286 2
            return true;
287
        }
288 10
        return false;
289
    }
290
}
291