Completed
Push — master ( 3465b8...09799a )
by Philip
06:13
created

ControllerProvider::setupI18n()   A

Complexity

Conditions 2
Paths 1

Size

Total Lines 10
Code Lines 7

Duplication

Lines 0
Ratio 0 %

Importance

Changes 1
Bugs 0 Features 0
Metric Value
c 1
b 0
f 0
dl 0
loc 10
rs 9.4285
cc 2
eloc 7
nc 1
nop 1
1
<?php
2
3
/*
4
 * This file is part of the CRUDlex package.
5
 *
6
 * (c) Philip Lehmann-Böhm <[email protected]>
7
 *
8
 * For the full copyright and license information, please view the LICENSE
9
 * file that was distributed with this source code.
10
 */
11
12
namespace CRUDlex;
13
14
use Silex\Api\ControllerProviderInterface;
15
use Silex\Application;
16
use Symfony\Component\HttpFoundation\Request;
17
use Symfony\Component\HttpFoundation\Response;
18
use Symfony\Component\HttpFoundation\StreamedResponse;
19
20
/**
21
 * This is the ControllerProvider offering all CRUD pages.
22
 *
23
 * It offers this routes:
24
 *
25
 * "/resource/static" serving static resources
26
 *
27
 * "/{entity}/create" creation page of the entity
28
 *
29
 * "/{entity}" list page of the entity
30
 *
31
 * "/{entity}/{id}" details page of a single entity instance
32
 *
33
 * "/{entity}/{id}/edit" edit page of a single entity instance
34
 *
35
 * "/{entity}/{id}/delete" POST only deletion route for an entity instance
36
 *
37
 * "/{entity}/{id}/{field}/file" renders a file field of an entity instance
38
 *
39
 * "/{entity}/{id}/{field}/delete" POST only deletion of a file field of an entity instance
40
 */
41
class ControllerProvider implements ControllerProviderInterface {
42
43
    /**
44
     * Generates the not found page.
45
     *
46
     * @param Application $app
47
     * the Silex application
48
     * @param string $error
49
     * the cause of the not found error
50
     *
51
     * @return Response
52
     * the rendered not found page with the status code 404
53
     */
54
    protected function getNotFoundPage(Application $app, $error) {
55
        return new Response($app['twig']->render('@crud/notFound.twig', [
56
            'error' => $error,
57
            'crudEntity' => '',
58
            'layout' => $app['crud.layout']
59
        ]), 404);
60
    }
61
62
    /**
63
     * Postprocesses the entity after modification by handling the uploaded
64
     * files and setting the flash.
65
     *
66
     * @param Application $app
67
     * the current application
68
     * @param AbstractData $crudData
69
     * the data instance of the entity
70
     * @param Entity $instance
71
     * the entity
72
     * @param string $entity
73
     * the name of the entity
74
     * @param string $mode
75
     * whether to 'edit' or to 'create' the entity
76
     *
77
     * @return null|\Symfony\Component\HttpFoundation\RedirectResponse
78
     * the HTTP response of this modification
79
     */
80
    protected function modifyFilesAndSetFlashBag(Application $app, AbstractData $crudData, Entity $instance, $entity, $mode) {
81
        $id      = $instance->get('id');
82
        $request = $app['request_stack']->getCurrentRequest();
83
        $result  = $mode == 'edit' ? $crudData->updateFiles($request, $instance, $entity) : $crudData->createFiles($request, $instance, $entity);
84
        if (!$result) {
85
            return null;
86
        }
87
        $app['session']->getFlashBag()->add('success', $app['translator']->trans('crudlex.'.$mode.'.success', [
88
            '%label%' => $crudData->getDefinition()->getLabel(),
89
            '%id%' => $id
90
        ]));
91
        return $app->redirect($app['url_generator']->generate('crudShow', ['entity' => $entity, 'id' => $id]));
92
    }
93
94
    /**
95
     * Sets the flashes of a failed entity modification.
96
     *
97
     * @param Application $app
98
     * the current application
99
     * @param boolean $optimisticLocking
100
     * whether the optimistic locking failed
101
     * @param string $mode
102
     * the modification mode, either 'create' or 'edit'
103
     */
104
    protected function setValidationFailedFlashes(Application $app, $optimisticLocking, $mode) {
105
        $app['session']->getFlashBag()->add('danger', $app['translator']->trans('crudlex.'.$mode.'.error'));
106
        if ($optimisticLocking) {
107
            $app['session']->getFlashBag()->add('danger', $app['translator']->trans('crudlex.edit.locked'));
108
        }
109
    }
110
111
    /**
112
     * Validates and saves the new or updated entity and returns the appropriate HTTP
113
     * response.
114
     *
115
     * @param Application $app
116
     * the current application
117
     * @param AbstractData $crudData
118
     * the data instance of the entity
119
     * @param Entity $instance
120
     * the entity
121
     * @param string $entity
122
     * the name of the entity
123
     * @param boolean $edit
124
     * whether to edit (true) or to create (false) the entity
125
     *
126
     * @return Response
127
     * the HTTP response of this modification
128
     */
129
    protected function modifyEntity(Application $app, AbstractData $crudData, Entity $instance, $entity, $edit) {
130
        $fieldErrors = [];
131
        $mode        = $edit ? 'edit' : 'create';
132
        $request     = $app['request_stack']->getCurrentRequest();
133
        if ($request->getMethod() == 'POST') {
134
            $instance->populateViaRequest($request);
135
            $validator  = new EntityValidator($instance);
136
            $validation = $validator->validate($crudData, intval($request->get('version')));
137
138
            $fieldErrors = $validation['errors'];
139
            if (!$validation['valid']) {
140
                $optimisticLocking = isset($fieldErrors['version']);
141
                $this->setValidationFailedFlashes($app, $optimisticLocking, $mode);
142
            } else {
143
                $modified = $edit ? $crudData->update($instance) : $crudData->create($instance);
144
                $response = $modified ? $this->modifyFilesAndSetFlashBag($app, $crudData, $instance, $entity, $mode) : false;
145
                if ($response) {
146
                    return $response;
147
                }
148
                $app['session']->getFlashBag()->add('danger', $app['translator']->trans('crudlex.'.$mode.'.failed'));
149
            }
150
        }
151
152
        return $app['twig']->render($app['crud']->getTemplate($app, 'template', 'form', $entity), [
153
            'crudEntity' => $entity,
154
            'crudData' => $crudData,
155
            'entity' => $instance,
156
            'mode' => $mode,
157
            'fieldErrors' => $fieldErrors,
158
            'layout' => $app['crud']->getTemplate($app, 'layout', $mode, $entity)
159
        ]);
160
    }
161
162
    /**
163
     * Gets the parameters for the redirection after deleting an entity.
164
     *
165
     * @param Request $request
166
     * the current request
167
     * @param string $entity
168
     * the entity name
169
     * @param string $redirectPage
170
     * reference, where the page to redirect to will be stored
171
     *
172
     * @return array<string,string>
173
     * the parameters of the redirection, entity and id
174
     */
175
    protected function getAfterDeleteRedirectParameters(Request $request, $entity, &$redirectPage) {
176
        $redirectPage       = 'crudList';
177
        $redirectParameters = ['entity' => $entity];
178
        $redirectEntity     = $request->get('redirectEntity');
179
        $redirectId         = $request->get('redirectId');
180
        if ($redirectEntity && $redirectId) {
181
            $redirectPage       = 'crudShow';
182
            $redirectParameters = [
183
                'entity' => $redirectEntity,
184
                'id' => $redirectId
185
            ];
186
        }
187
        return $redirectParameters;
188
    }
189
190
    /**
191
     * Builds up the parameters of the list page filters.
192
     *
193
     * @param Request $request
194
     * the current application
195
     * @param EntityDefinition $definition
196
     * the current entity definition
197
     * @param array &$filter
198
     * will hold a map of fields to request parameters for the filters
199
     * @param boolean $filterActive
200
     * reference, will be true if at least one filter is active
201
     * @param array $filterToUse
202
     * reference, will hold a map of fields to integers (0 or 1) which boolean filters are active
203
     * @param array $filterOperators
204
     * reference, will hold a map of fields to operators for AbstractData::listEntries()
205
     */
206
    protected function buildUpListFilter(Request $request, EntityDefinition $definition, &$filter, &$filterActive, &$filterToUse, &$filterOperators) {
207
        foreach ($definition->getFilter() as $filterField) {
208
            $type                 = $definition->getType($filterField);
209
            $filter[$filterField] = $request->get('crudFilter'.$filterField);
210
            if ($filter[$filterField]) {
211
                $filterActive = true;
212
                if ($type === 'boolean') {
213
                    $filterToUse[$filterField]     = $filter[$filterField] == 'true' ? 1 : 0;
214
                    $filterOperators[$filterField] = '=';
215
                } else if ($type === 'many') {
216
                    $filter[$filterField] = array_map(function($value) {
217
                        return ['id' => $value];
218
                    }, $filter[$filterField]);
219
                    $filterToUse[$filterField] = $filter[$filterField];
220
                } else {
221
                    $filterToUse[$filterField]     = '%'.$filter[$filterField].'%';
222
                    $filterOperators[$filterField] = 'LIKE';
223
                }
224
            }
225
        }
226
    }
227
228
    /**
229
     * Setups the templates.
230
     *
231
     * @param Application $app
232
     * the Application instance of the Silex application
233
     */
234
    protected function setupTemplates(Application $app) {
235
        if ($app->offsetExists('twig.loader.filesystem')) {
236
            $app['twig.loader.filesystem']->addPath(__DIR__.'/../views/', 'crud');
237
        }
238
239
        if (!$app->offsetExists('crud.layout')) {
240
            $app['crud.layout'] = '@crud/layout.twig';
241
        }
242
    }
243
244
    /**
245
     * Setups the routes.
246
     *
247
     * @param Application $app
248
     * the Application instance of the Silex application
249
     *
250
     * @return mixed
251
     * the created controller factory
252
     */
253
    protected function setupRoutes(Application $app) {
254
255
        $self        = $this;
256
        $entityCheck = function(Request $request, Application $app) use ($self) {
257
            if (!$app['crud']->getData($request->get('entity'))) {
258
                return $self->getNotFoundPage($app, $app['translator']->trans('crudlex.entityNotFound'));
259
            }
260
        };
261
262
        $class   = get_class($this);
263
        $factory = $app['controllers_factory'];
264
        $factory->get('/resource/static', $class.'::staticFile')->bind('static');
265
        $factory->match('/{entity}/create', $class.'::create')->bind('crudCreate')->before($entityCheck);
266
        $factory->match('/{entity}', $class.'::showList')->bind('crudList')->before($entityCheck);
267
        $factory->match('/{entity}/{id}', $class.'::show')->bind('crudShow')->before($entityCheck);
268
        $factory->match('/{entity}/{id}/edit', $class.'::edit')->bind('crudEdit')->before($entityCheck);
269
        $factory->post('/{entity}/{id}/delete', $class.'::delete')->bind('crudDelete')->before($entityCheck);
270
        $factory->match('/{entity}/{id}/{field}/file', $class.'::renderFile')->bind('crudRenderFile')->before($entityCheck);
271
        $factory->post('/{entity}/{id}/{field}/delete', $class.'::deleteFile')->bind('crudDeleteFile')->before($entityCheck);
272
        $factory->get('/setting/locale/{locale}', $class.'::setLocale')->bind('crudSetLocale');
273
274
        return $factory;
275
    }
276
277
    /**
278
     * Setups i18n.
279
     *
280
     * @param Application $app
281
     * the Application instance of the Silex application
282
     */
283
    protected function setupI18n(Application $app) {
284
        $app->before(function(Request $request, Application $app) {
285
            if ($app['crud']->isManagingI18n()) {
286
                $locale = $app['session']->get('locale', 'en');
287
                $app['translator']->setLocale($locale);
288
            }
289
            $locale = $app['translator']->getLocale();
290
            $app['crud']->setLocale($locale);
291
        });
292
    }
293
294
    /**
295
     * Implements ControllerProviderInterface::connect() connecting this
296
     * controller.
297
     *
298
     * @param Application $app
299
     * the Application instance of the Silex application
300
     *
301
     * @return \SilexController\Collection
302
     * this method is expected to return the used ControllerCollection instance
303
     */
304
    public function connect(Application $app) {
305
        $this->setupTemplates($app);
306
        $factory = $this->setupRoutes($app);
307
        $this->setupI18n($app);
308
        return $factory;
309
    }
310
311
    /**
312
     * The controller for the "create" action.
313
     *
314
     * @param Application $app
315
     * the Silex application
316
     * @param string $entity
317
     * the current entity
318
     *
319
     * @return Response
320
     * the HTTP response of this action
321
     */
322
    public function create(Application $app, $entity) {
323
        $crudData = $app['crud']->getData($entity);
324
        $instance = $crudData->createEmpty();
325
        return $this->modifyEntity($app, $crudData, $instance, $entity, false);
326
    }
327
328
    /**
329
     * The controller for the "show list" action.
330
     *
331
     * @param Request $request
332
     * the current request
333
     * @param Application $app
334
     * the Silex application
335
     * @param string $entity
336
     * the current entity
337
     *
338
     * @return Response
339
     * the HTTP response of this action or 404 on invalid input
340
     */
341
    public function showList(Request $request, Application $app, $entity) {
342
        $crudData   = $app['crud']->getData($entity);
343
        $definition = $crudData->getDefinition();
344
345
        $filter          = [];
346
        $filterActive    = false;
347
        $filterToUse     = [];
348
        $filterOperators = [];
349
        $this->buildUpListFilter($request, $definition, $filter, $filterActive, $filterToUse, $filterOperators);
350
351
        $pageSize = $definition->getPageSize();
352
        $total    = $crudData->countBy($definition->getTable(), $filterToUse, $filterOperators, true);
353
        $page     = abs(intval($request->get('crudPage', 0)));
354
        $maxPage  = intval($total / $pageSize);
355
        if ($total % $pageSize == 0) {
356
            $maxPage--;
357
        }
358
        if ($page > $maxPage) {
359
            $page = $maxPage;
360
        }
361
        $skip = $page * $pageSize;
362
363
        $sortField            = $request->get('crudSortField', $definition->getInitialSortField());
364
        $sortAscendingRequest = $request->get('crudSortAscending');
365
        $sortAscending        = $sortAscendingRequest !== null ? $sortAscendingRequest === 'true' : $definition->isInitialSortAscending();
366
367
        $entities = $crudData->listEntries($filterToUse, $filterOperators, $skip, $pageSize, $sortField, $sortAscending);
368
        $crudData->fetchReferences($entities);
369
370
        return $app['twig']->render($app['crud']->getTemplate($app, 'template', 'list', $entity), [
371
            'crudEntity' => $entity,
372
            'crudData' => $crudData,
373
            'definition' => $definition,
374
            'entities' => $entities,
375
            'pageSize' => $pageSize,
376
            'maxPage' => $maxPage,
377
            'page' => $page,
378
            'total' => $total,
379
            'filter' => $filter,
380
            'filterActive' => $filterActive,
381
            'sortField' => $sortField,
382
            'sortAscending' => $sortAscending,
383
            'layout' => $app['crud']->getTemplate($app, 'layout', 'list', $entity)
384
        ]);
385
    }
386
387
    /**
388
     * The controller for the "show" action.
389
     *
390
     * @param Application $app
391
     * the Silex application
392
     * @param string $entity
393
     * the current entity
394
     * @param string $id
395
     * the instance id to show
396
     *
397
     * @return Response
398
     * the HTTP response of this action or 404 on invalid input
399
     */
400
    public function show(Application $app, $entity, $id) {
401
        $crudData = $app['crud']->getData($entity);
402
        $instance = $crudData->get($id);
403
        if (!$instance) {
404
            return $this->getNotFoundPage($app, $app['translator']->trans('crudlex.instanceNotFound'));
405
        }
406
        $instance = [$instance];
407
        $crudData->fetchReferences($instance);
408
        $instance   = $instance[0];
409
        $definition = $crudData->getDefinition();
410
411
        $childrenLabelFields = $definition->getChildrenLabelFields();
412
        $children            = [];
413
        if (count($childrenLabelFields) > 0) {
414
            foreach ($definition->getChildren() as $child) {
415
                $childField      = $child[1];
416
                $childEntity     = $child[2];
417
                $childLabelField = array_key_exists($childEntity, $childrenLabelFields) ? $childrenLabelFields[$childEntity] : 'id';
418
                $childCrud       = $app['crud']->getData($childEntity);
419
                $children[]      = [
420
                    $childCrud->getDefinition()->getLabel(),
421
                    $childEntity,
422
                    $childLabelField,
423
                    $childCrud->listEntries([$childField => $instance->get('id')])
424
                ];
425
            }
426
        }
427
428
        return $app['twig']->render($app['crud']->getTemplate($app, 'template', 'show', $entity), [
429
            'crudEntity' => $entity,
430
            'entity' => $instance,
431
            'children' => $children,
432
            'layout' => $app['crud']->getTemplate($app, 'layout', 'show', $entity)
433
        ]);
434
    }
435
436
    /**
437
     * The controller for the "edit" action.
438
     *
439
     * @param Application $app
440
     * the Silex application
441
     * @param string $entity
442
     * the current entity
443
     * @param string $id
444
     * the instance id to edit
445
     *
446
     * @return Response
447
     * the HTTP response of this action or 404 on invalid input
448
     */
449
    public function edit(Application $app, $entity, $id) {
450
        $crudData = $app['crud']->getData($entity);
451
        $instance = $crudData->get($id);
452
        if (!$instance) {
453
            return $this->getNotFoundPage($app, $app['translator']->trans('crudlex.instanceNotFound'));
454
        }
455
456
        return $this->modifyEntity($app, $crudData, $instance, $entity, true);
457
    }
458
459
    /**
460
     * The controller for the "delete" action.
461
     *
462
     * @param Application $app
463
     * the Silex application
464
     * @param string $entity
465
     * the current entity
466
     * @param string $id
467
     * the instance id to delete
468
     *
469
     * @return Response
470
     * redirects to the entity list page or 404 on invalid input
471
     */
472
    public function delete(Application $app, $entity, $id) {
473
        $crudData = $app['crud']->getData($entity);
474
        $instance = $crudData->get($id);
475
        if (!$instance) {
476
            return $this->getNotFoundPage($app, $app['translator']->trans('crudlex.instanceNotFound'));
477
        }
478
479
        $filesDeleted = $crudData->deleteFiles($instance, $entity);
480
        $deleted      = $filesDeleted ? $crudData->delete($instance) : AbstractData::DELETION_FAILED_EVENT;
481
482
        if ($deleted === AbstractData::DELETION_FAILED_EVENT) {
483
            $app['session']->getFlashBag()->add('danger', $app['translator']->trans('crudlex.delete.failed'));
484
            return $app->redirect($app['url_generator']->generate('crudShow', ['entity' => $entity, 'id' => $id]));
485
        } elseif ($deleted === AbstractData::DELETION_FAILED_STILL_REFERENCED) {
486
            $app['session']->getFlashBag()->add('danger', $app['translator']->trans('crudlex.delete.error', [
487
                '%label%' => $crudData->getDefinition()->getLabel()
488
            ]));
489
            return $app->redirect($app['url_generator']->generate('crudShow', ['entity' => $entity, 'id' => $id]));
490
        }
491
492
        $redirectPage       = 'crudList';
493
        $redirectParameters = $this->getAfterDeleteRedirectParameters($app['request_stack']->getCurrentRequest(), $entity, $redirectPage);
494
495
        $app['session']->getFlashBag()->add('success', $app['translator']->trans('crudlex.delete.success', [
496
            '%label%' => $crudData->getDefinition()->getLabel()
497
        ]));
498
        return $app->redirect($app['url_generator']->generate($redirectPage, $redirectParameters));
499
    }
500
501
    /**
502
     * The controller for the "render file" action.
503
     *
504
     * @param Application $app
505
     * the Silex application
506
     * @param string $entity
507
     * the current entity
508
     * @param string $id
509
     * the instance id
510
     * @param string $field
511
     * the field of the file to render of the instance
512
     *
513
     * @return Response
514
     * the rendered file
515
     */
516
        public function renderFile(Application $app, $entity, $id, $field) {
517
        $crudData   = $app['crud']->getData($entity);
518
        $instance   = $crudData->get($id);
519
        $definition = $crudData->getDefinition();
520
        if (!$instance || $definition->getType($field) != 'file' || !$instance->get($field)) {
521
            return $this->getNotFoundPage($app, $app['translator']->trans('crudlex.instanceNotFound'));
522
        }
523
        return $crudData->renderFile($instance, $entity, $field);
524
    }
525
526
    /**
527
     * The controller for the "delete file" action.
528
     *
529
     * @param Application $app
530
     * the Silex application
531
     * @param string $entity
532
     * the current entity
533
     * @param string $id
534
     * the instance id
535
     * @param string $field
536
     * the field of the file to delete of the instance
537
     *
538
     * @return Response
539
     * redirects to the instance details page or 404 on invalid input
540
     */
541
    public function deleteFile(Application $app, $entity, $id, $field) {
542
        $crudData = $app['crud']->getData($entity);
543
        $instance = $crudData->get($id);
544
        if (!$instance) {
545
            return $this->getNotFoundPage($app, $app['translator']->trans('crudlex.instanceNotFound'));
546
        }
547
        if (!$crudData->getDefinition()->getField($field, 'required', false) && $crudData->deleteFile($instance, $entity, $field)) {
548
            $instance->set($field, '');
549
            $crudData->update($instance);
550
            $app['session']->getFlashBag()->add('success', $app['translator']->trans('crudlex.file.deleted'));
551
        } else {
552
            $app['session']->getFlashBag()->add('danger', $app['translator']->trans('crudlex.file.notDeleted'));
553
        }
554
        return $app->redirect($app['url_generator']->generate('crudShow', ['entity' => $entity, 'id' => $id]));
555
    }
556
557
    /**
558
     * The controller for serving static files.
559
     *
560
     * @param Request $request
561
     * the current request
562
     * @param Application $app
563
     * the Silex application
564
     *
565
     * @return Response
566
     * redirects to the instance details page or 404 on invalid input
567
     */
568
    public function staticFile(Request $request, Application $app) {
569
        $fileParam = str_replace('..', '', $request->get('file'));
570
        $file      = __DIR__.'/../static/'.$fileParam;
571
        if (!$fileParam || !file_exists($file)) {
572
            return $this->getNotFoundPage($app, $app['translator']->trans('crudlex.resourceNotFound'));
573
        }
574
575
        $mimeTypes = new MimeTypes();
576
        $mimeType  = $mimeTypes->getMimeType($file);
577
        $size      = filesize($file);
578
579
        $streamedFileResponse = new StreamedFileResponse();
580
        $response             = new StreamedResponse($streamedFileResponse->getStreamedFileFunction($file), 200, [
581
            'Content-Type' => $mimeType,
582
            'Content-Disposition' => 'attachment; filename="'.basename($file).'"',
583
            'Content-length' => $size
584
        ]);
585
586
        $response->setETag(filemtime($file))->setPublic()->isNotModified($request);
587
        $response->send();
588
589
        return $response;
590
    }
591
592
    /**
593
     * The controller for setting the locale.
594
     *
595
     * @param Request $request
596
     * the current request
597
     * @param Application $app
598
     * the Silex application
599
     * @param string $locale
600
     * the new locale
601
     *
602
     * @return Response
603
     * redirects to the instance details page or 404 on invalid input
604
     */
605
    public function setLocale(Request $request, Application $app, $locale) {
606
607
        if (!in_array($locale, $app['crud']->getLocales())) {
608
            return $this->getNotFoundPage($app, 'Locale '.$locale.' not found.');
609
        }
610
611
        if ($app['crud']->isManagingI18n()) {
612
            $app['session']->set('locale', $locale);
613
        }
614
        $redirect = $request->get('redirect');
615
        return $app->redirect($redirect);
0 ignored issues
show
Security Cross-Site Scripting introduced by
$redirect can contain request data and is used in output context(s) leading to a potential security vulnerability.

8 paths for user data to reach this point

  1. Path: $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned in ServerBag.php on line 62
  1. $this->parameters['HTTP_AUTHORIZATION'] seems to return tainted data, and $authorizationHeader is assigned
    in vendor/ServerBag.php on line 62
  2. ParameterBag::$parameters is assigned
    in vendor/ServerBag.php on line 77
  3. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  4. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  5. Request::get() returns tainted data, and $redirect is assigned
    in src/CRUDlex/ControllerProvider.php on line 614
  2. Path: Read from $_POST, and $_POST is passed to Request::createRequestFromFactory() in Request.php on line 281
  1. Read from $_POST, and $_POST is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 281
  2. $request is passed to Request::__construct()
    in vendor/Request.php on line 1929
  3. $request is passed to Request::initialize()
    in vendor/Request.php on line 222
  4. $request is passed to ParameterBag::__construct()
    in vendor/Request.php on line 240
  5. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  6. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  7. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  8. Request::get() returns tainted data, and $redirect is assigned
    in src/CRUDlex/ControllerProvider.php on line 614
  3. Path: Read from $_SERVER, and $server is assigned in Request.php on line 271
  1. Read from $_SERVER, and $server is assigned
    in vendor/Request.php on line 271
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 281
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 1929
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 222
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 245
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  9. Request::get() returns tainted data, and $redirect is assigned
    in src/CRUDlex/ControllerProvider.php on line 614
  4. Path: Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned in Request.php on line 274
  1. Fetching key HTTP_CONTENT_LENGTH from $_SERVER, and $server is assigned
    in vendor/Request.php on line 274
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 281
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 1929
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 222
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 245
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  9. Request::get() returns tainted data, and $redirect is assigned
    in src/CRUDlex/ControllerProvider.php on line 614
  5. Path: Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned in Request.php on line 277
  1. Fetching key HTTP_CONTENT_TYPE from $_SERVER, and $server is assigned
    in vendor/Request.php on line 277
  2. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 281
  3. $server is passed to Request::__construct()
    in vendor/Request.php on line 1929
  4. $server is passed to Request::initialize()
    in vendor/Request.php on line 222
  5. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 245
  6. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  7. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  8. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  9. Request::get() returns tainted data, and $redirect is assigned
    in src/CRUDlex/ControllerProvider.php on line 614
  6. Path: $server['HTTP_HOST'] seems to return tainted data, and $server is assigned in Request.php on line 347
  1. $server['HTTP_HOST'] seems to return tainted data, and $server is assigned
    in vendor/Request.php on line 347
  2. $server is assigned
    in vendor/Request.php on line 395
  3. $server is assigned
    in vendor/Request.php on line 396
  4. $server is passed to Request::createRequestFromFactory()
    in vendor/Request.php on line 398
  5. $server is passed to Request::__construct()
    in vendor/Request.php on line 1929
  6. $server is passed to Request::initialize()
    in vendor/Request.php on line 222
  7. $server is passed to ParameterBag::__construct()
    in vendor/Request.php on line 245
  8. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 35
  9. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  10. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  11. Request::get() returns tainted data, and $redirect is assigned
    in src/CRUDlex/ControllerProvider.php on line 614
  7. Path: $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 43
  1. $this->parameters['PHP_AUTH_USER'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 43
  2. $headers is assigned
    in vendor/ServerBag.php on line 44
  3. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 246
  4. $values is assigned
    in vendor/HeaderBag.php on line 31
  5. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 32
  6. (array) $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  7. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  8. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 125
  9. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1699
  10. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1730
  11. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 99
  12. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  13. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  14. Request::get() returns tainted data, and $redirect is assigned
    in src/CRUDlex/ControllerProvider.php on line 614
  8. Path: $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned in ServerBag.php on line 44
  1. $this->parameters['PHP_AUTH_PW'] seems to return tainted data, and $headers is assigned
    in vendor/ServerBag.php on line 44
  2. ServerBag::getHeaders() returns tainted data, and $this->server->getHeaders() is passed to HeaderBag::__construct()
    in vendor/Request.php on line 246
  3. $values is assigned
    in vendor/HeaderBag.php on line 31
  4. $values is passed to HeaderBag::set()
    in vendor/HeaderBag.php on line 32
  5. (array) $values is passed through array_values(), and $values is assigned
    in vendor/HeaderBag.php on line 142
  6. HeaderBag::$headers is assigned
    in vendor/HeaderBag.php on line 145
  7. Tainted property HeaderBag::$headers is read
    in vendor/HeaderBag.php on line 125
  8. HeaderBag::get() returns tainted data, and $requestUri is assigned
    in vendor/Request.php on line 1699
  9. $requestUri is passed to ParameterBag::set()
    in vendor/Request.php on line 1730
  10. ParameterBag::$parameters is assigned
    in vendor/ParameterBag.php on line 99
  11. Tainted property ParameterBag::$parameters is read
    in vendor/ParameterBag.php on line 88
  12. ParameterBag::get() returns tainted data, and $result is assigned
    in vendor/Request.php on line 719
  13. Request::get() returns tainted data, and $redirect is assigned
    in src/CRUDlex/ControllerProvider.php on line 614

Used in output context

  1. Application::redirect() uses RedirectResponse::__construct() ($url)
    in vendor/src/Silex/Application.php on line 376
  2. RedirectResponse::__construct() uses RedirectResponse::setTargetUrl() ($url)
    in vendor/RedirectResponse.php on line 39
  3. RedirectResponse::setTargetUrl() uses Response::setContent() ($content)
    in vendor/RedirectResponse.php on line 82
  4. Response::setContent() uses property Response::$content for writing
    in vendor/Response.php on line 406
  5. Property Response::$content is used in echo
    in vendor/Response.php on line 365

Preventing Cross-Site-Scripting Attacks

Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user.

In order to prevent this, make sure to escape all user-provided data:

// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
616
    }
617
}
618