This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | namespace Redaxscript\Controller; |
||
3 | |||
4 | use Redaxscript\Filter; |
||
5 | use Redaxscript\Model; |
||
6 | use Redaxscript\Validator; |
||
7 | use Redaxscript\View; |
||
8 | use function array_key_exists; |
||
9 | use function in_array; |
||
10 | use function is_array; |
||
11 | use function str_replace; |
||
12 | |||
13 | /** |
||
14 | * children class to process the search request |
||
15 | * |
||
16 | * @since 3.0.0 |
||
17 | * |
||
18 | * @package Redaxscript |
||
19 | * @category Controller |
||
20 | * @author Henry Ruhs |
||
21 | * @author Balázs Szilágyi |
||
22 | */ |
||
23 | |||
24 | class Search extends ControllerAbstract |
||
25 | { |
||
26 | /** |
||
27 | * array of the tables |
||
28 | * |
||
29 | * @var array |
||
30 | */ |
||
31 | |||
32 | protected $tableArray = |
||
33 | [ |
||
34 | 'categories', |
||
35 | 'articles', |
||
36 | 'comments' |
||
37 | ]; |
||
38 | |||
39 | /** |
||
40 | * process the class |
||
41 | * |
||
42 | * @since 3.0.0 |
||
43 | * |
||
44 | * @return string |
||
45 | */ |
||
46 | |||
47 | 8 | public function process() : string |
|
48 | { |
||
49 | 8 | $queryArray = $this->_sanitizeQuery(); |
|
50 | |||
51 | /* validate query */ |
||
52 | |||
53 | 8 | $validateArray = $this->_validateQuery($queryArray); |
|
54 | 8 | if ($validateArray) |
|
55 | { |
||
56 | 2 | return $this->_info( |
|
57 | [ |
||
58 | 2 | 'message' => $validateArray |
|
59 | ]); |
||
60 | } |
||
61 | |||
62 | /* handle search */ |
||
63 | |||
64 | 6 | $resultArray = $this->_search( |
|
65 | [ |
||
66 | 6 | 'table' => $queryArray['table'], |
|
67 | 6 | 'search' => $queryArray['search'], |
|
68 | 6 | 'language' => $this->_registry->get('language') |
|
69 | ]); |
||
70 | 6 | $output = $resultArray ? $this->_renderResult($resultArray) : null; |
|
71 | 6 | if ($output) |
|
0 ignored issues
–
show
|
|||
72 | { |
||
73 | 4 | return $output; |
|
74 | } |
||
75 | |||
76 | /* handle info */ |
||
77 | |||
78 | 2 | return $this->_info( |
|
79 | [ |
||
80 | 2 | 'message' => $this->_language->get('search_no') |
|
81 | ]); |
||
82 | } |
||
83 | |||
84 | /** |
||
85 | * sanitize the query |
||
86 | * |
||
87 | * @since 4.0.0 |
||
88 | * |
||
89 | * @return array |
||
90 | */ |
||
91 | |||
92 | 8 | protected function _sanitizeQuery() : array |
|
93 | { |
||
94 | 8 | $aliasFilter = new Filter\Alias(); |
|
95 | 8 | $secondParameter = $aliasFilter->sanitize($this->_registry->get('secondParameter')); |
|
96 | 8 | $thirdParameter = $aliasFilter->sanitize($this->_registry->get('thirdParameter')); |
|
97 | |||
98 | /* process query */ |
||
99 | |||
100 | 8 | if (!$thirdParameter) |
|
101 | { |
||
102 | return |
||
103 | [ |
||
104 | 4 | 'table' => $this->tableArray, |
|
105 | 4 | 'search' => str_replace('-', ' ', $secondParameter) |
|
106 | ]; |
||
107 | } |
||
108 | 4 | if (in_array($secondParameter, $this->tableArray)) |
|
109 | { |
||
110 | return |
||
111 | [ |
||
112 | 'table' => |
||
113 | [ |
||
114 | 4 | $secondParameter |
|
115 | ], |
||
116 | 4 | 'search' => str_replace('-', ' ', $thirdParameter) |
|
117 | ]; |
||
118 | } |
||
119 | return []; |
||
120 | } |
||
121 | |||
122 | /** |
||
123 | * validate the query |
||
124 | * |
||
125 | * @since 3.0.0 |
||
126 | * |
||
127 | * @param array $queryArray array of the query |
||
128 | * |
||
129 | * @return array |
||
130 | */ |
||
131 | |||
132 | 8 | protected function _validateQuery(array $queryArray = []) : array |
|
133 | { |
||
134 | 8 | $aliasValidator = new Validator\Alias(); |
|
135 | 8 | $validateArray = []; |
|
136 | |||
137 | /* validate query */ |
||
138 | |||
139 | 8 | if (!$queryArray['search']) |
|
140 | { |
||
141 | 1 | $validateArray[] = $this->_language->get('input_empty'); |
|
142 | } |
||
143 | 7 | else if (!$aliasValidator->validate($queryArray['search'])) |
|
144 | { |
||
145 | 1 | $validateArray[] = $this->_language->get('input_incorrect'); |
|
146 | } |
||
147 | 8 | return $validateArray; |
|
148 | } |
||
149 | |||
150 | /** |
||
151 | * search in tables |
||
152 | * |
||
153 | * @since 3.0.0 |
||
154 | * |
||
155 | * @param array $searchArray array of the search |
||
156 | * |
||
157 | * @return array |
||
158 | */ |
||
159 | |||
160 | 6 | protected function _search(array $searchArray = []) : array |
|
161 | { |
||
162 | 6 | $searchModel = new Model\Search(); |
|
163 | 6 | $resultArray = []; |
|
164 | |||
165 | /* process table */ |
||
166 | |||
167 | 6 | if (array_key_exists('table', $searchArray) && is_array($searchArray['table']) && array_key_exists('search', $searchArray) && array_key_exists('language', $searchArray)) |
|
168 | { |
||
169 | 6 | foreach ($searchArray['table'] as $table) |
|
170 | { |
||
171 | 6 | $resultArray[$table] = $searchModel->getByTable($table, $searchArray['search'], $searchArray['language']); |
|
172 | } |
||
173 | } |
||
174 | 6 | return $resultArray; |
|
175 | } |
||
176 | |||
177 | /** |
||
178 | * render the result |
||
179 | * |
||
180 | * @since 3.0.0 |
||
181 | * |
||
182 | * @param array $resultArray array of the result |
||
183 | * |
||
184 | * @return string |
||
185 | */ |
||
186 | |||
187 | 6 | protected function _renderResult(array $resultArray = []) : string |
|
188 | { |
||
189 | 6 | $searchList = new View\ResultList($this->_registry, $this->_language); |
|
190 | 6 | return $searchList->render($resultArray); |
|
191 | } |
||
192 | |||
193 | /** |
||
194 | * show the info |
||
195 | * |
||
196 | * @since 3.0.0 |
||
197 | * |
||
198 | * @param array $infoArray array of the info |
||
199 | * |
||
200 | * @return string |
||
201 | */ |
||
202 | |||
203 | 4 | protected function _info(array $infoArray = []) : string |
|
204 | { |
||
205 | 4 | $messenger = $this->_messengerFactory(); |
|
206 | return $messenger |
||
207 | 4 | ->setUrl($this->_language->get('back'), $this->_registry->get('root')) |
|
208 | 4 | ->info($infoArray['message'], $this->_language->get('something_wrong')); |
|
209 | } |
||
210 | |||
211 | } |
||
212 |
In PHP, under loose comparison (like
==
, or!=
, orswitch
conditions), values of different types might be equal.For
string
values, the empty string''
is a special case, in particular the following results might be unexpected: