Issues (214)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

forms/SettingsForm.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 *  _   __ __ _____ _____ ___  ____  _____
5
 * | | / // // ___//_  _//   ||  __||_   _|
6
 * | |/ // /(__  )  / / / /| || |     | |
7
 * |___//_//____/  /_/ /_/ |_||_|     |_|
8
 * @link https://vistart.me/
9
 * @copyright Copyright (c) 2016 - 2017 vistart
10
 * @license https://vistart.me/license/
11
 */
12
13
namespace rhosocial\organization\forms;
14
15
use rhosocial\organization\Organization;
16
use rhosocial\organization\OrganizationSetting;
17
use Yii;
18
use yii\base\InvalidConfigException;
19
use yii\base\Model;
20
use yii\helpers\Html;
21
use yii\web\ServerErrorHttpException;
22
23
/**
24
 * Class SettingsForm
25
 * @package rhosocial\organization\forms
26
 * @version 1.0
27
 * @author vistart <[email protected]>
28
 */
29
class SettingsForm extends Model
30
{
31
    /**
32
     * @var string
33
     */
34
    public $exclude_other_members;
35
36
    /**
37
     * @var string
38
     */
39
    public $disallow_member_join_other;
40
41
    /**
42
     * @var string
43
     */
44
    public $only_accept_current_org_member;
45
46
    /**
47
     * @var string
48
     */
49
    public $only_accept_superior_org_member;
50
51
    /**
52
     * @var string
53
     */
54
    public $join_password;
55
56
    /**
57
     * @var string
58
     */
59
    public $join_ip_address;
60
61
    /**
62
     * @var string
63
     */
64
    public $join_entrance_url;
65
66
    /**
67
     * @var string
68
     */
69
    public $exit_allow_withdraw_actively;
70
71
    const SCENARIO_ORGANIZATION = 'organization';
72
    const SCENARIO_DEPARTMENT = 'department';
73
74
    /**
75
     * @var Organization
76
     */
77
    public $organization;
78
79
    /**
80
     * @inheritdoc
81
     */
82
    public function init()
83
    {
84
        if (!$this->organization) {
85
            throw new InvalidConfigException('Invalid Organization Model.');
86
        }
87
        $this->scenario = $this->organization->isOrganization() ? static::SCENARIO_ORGANIZATION : static::SCENARIO_DEPARTMENT;
88
        $this->loadSettings();
89
    }
90
91
    /**
92
     * Load settings.
93
     */
94
    protected function loadSettings()
95
    {
96
        if ($this->organization->isOrganization()) {
97
            $this->exclude_other_members = $this->organization->isExcludeOtherMembers ? '1' : '0';
98
            $this->disallow_member_join_other = $this->organization->isDisallowMemberJoinOther ? '1' : '0';
99
        } elseif ($this->organization->isDepartment()) {
100
            $this->only_accept_current_org_member = $this->organization->isOnlyAcceptCurrentOrgMember ? '1' : '0';
101
            $this->only_accept_superior_org_member = $this->organization->isOnlyAcceptSuperiorOrgMember ? '1' : '0';
102
        }
103
        $this->join_password = $this->organization->joinPassword;
104
        $this->join_ip_address = $this->organization->joinIpAddress;
105
        $this->join_entrance_url = $this->organization->joinEntranceUrl;
106
        $this->exit_allow_withdraw_actively = $this->organization->exitAllowWithdrawActively ? '1' : '0';
107
    }
108
109
    /**
110
     * Submit settings.
111
     */
112
    public function submit()
113
    {
114
        try {
115
            if ($this->organization->isOrganization()) {
116
                if ($this->exclude_other_members != ($this->organization->isExcludeOtherMembers ? '1' : '0')) {
117
                    $this->organization->isExcludeOtherMembers = ($this->exclude_other_members == '1');
118
                }
119
                if ($this->disallow_member_join_other != ($this->organization->isDisallowMemberJoinOther ? '1' : '0')) {
120
                    $this->organization->isDisallowMemberJoinOther = ($this->disallow_member_join_other == '1');
121
                }
122
            } elseif ($this->organization->isDepartment()) {
123
                if ($this->only_accept_current_org_member != ($this->organization->isOnlyAcceptCurrentOrgMember ? '1' : '0')) {
124
                    $this->organization->isOnlyAcceptCurrentOrgMember = ($this->only_accept_current_org_member == '1');
125
                }
126
                if ($this->only_accept_superior_org_member != ($this->organization->isOnlyAcceptSuperiorOrgMember ? '1' : '0')) {
127
                    $this->organization->isOnlyAcceptSuperiorOrgMember = ($this->only_accept_superior_org_member == '1');
128
                }
129
            }
130
            if ($this->join_password != $this->organization->joinPassword) {
131
                $this->organization->joinPassword = $this->join_password;
132
            }
133
            if ($this->join_ip_address != $this->organization->joinIpAddress) {
134
                $this->organization->joinIpAddress = $this->join_ip_address;
135
            }
136
            if ($this->join_entrance_url != $this->organization->joinEntranceUrl) {
137
                $this->organization->joinEntranceUrl = $this->join_entrance_url;
138
            }
139
            if ($this->exit_allow_withdraw_actively != ($this->organization->exitAllowWithdrawActively ? '1' : '0')) {
140
                $this->organization->exitAllowWithdrawActively = ($this->exit_allow_withdraw_actively == '1');
141
            }
142
        } catch (\Exception $ex) {
143
            throw new ServerErrorHttpException($ex->getMessage());
144
        }
145
        return true;
146
    }
147
148
    /**
149
     * @inheritdoc
150
     */
151
    public function attributeLabels()
152
    {
153
        return [
154
            'exclude_other_members' => Yii::t('organization', 'Exclude other members'),
155
            'disallow_member_join_other' => Yii::t('organization', 'Disallow members to join other'),
156
            'only_accept_current_org_member' => Yii::t('organization', 'Only accept organization members'),
157
            'only_accept_superior_org_member' => Yii::t('organization', 'Only accept superior members'),
158
            'join_password' => Yii::t('organization', 'Password'),
159
            'join_ip_address' => Yii::t('organization', 'IP Address'),
160
            'join_entrance_url' => Yii::t('organization', 'Entrance URL Code'),
161
            'exit_allow_withdraw_actively' => Yii::t('organization', 'Allow to Withdraw Actively'),
162
        ];
163
    }
164
165
    /**
166
     * @inheritdoc
167
     */
168
    public function attributeHints()
169
    {
170
        $topName = $this->organization->isDepartment() ? $this->organization->topOrganization->profile->name . ' (' . $this->organization->topOrganization->getID() . ')' : '';
171
        $parentName = $this->organization->isDepartment() ? $this->organization->parent->profile->name . ' (' . $this->organization->parent->getID() . ')' : '';
0 ignored issues
show
The property profile does not seem to exist in rhosocial\base\models\traits\SelfBlameableTrait.

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
It seems like getID() must be provided by classes using this trait. How about adding it as abstract method to this trait?

This check looks for methods that are used by a trait but not required by it.

To illustrate, let’s look at the following code example

trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

The trait Idable provides a method equalsId that in turn relies on the method getId(). If this method does not exist on a class mixing in this trait, the method will fail.

Adding the getId() as an abstract method to the trait will make sure it is available.

Loading history...
172
        return [
173
            'exclude_other_members' =>
174
                Yii::t('organization', 'This organization does not allow other organizations and their subordinates\' members to join.') . "<br>" .
175
                Yii::t('organization', 'All members of the other organizations (including their subordinates) who have joined this organization (including subordinate departments) are not affected.'),
176
            'disallow_member_join_other' =>
177
                Yii::t('organization', 'This organization does not allow the organization and its subordinates\' members to join other organizations or their subordinates.') . "<br>" .
178
                Yii::t('organization', 'All members of this organization (including subordinate departments) who have joined other organizations (including their subordinates) are not affected.') . "<br>" .
179
                Yii::t('organization', 'If this option is enabled, all members of the organization (including subordinate departments) who have the "Set Up Organization" permission will not be able to set up a new organization.'),
180
            'only_accept_current_org_member' =>
181
                Yii::t('organization', 'This department is only accepted by members of the organization.') . "<br>" .
182
                Yii::t('organization', 'That is to say, only the members of {name} are accepted.', ['name' => $topName]),
183
            'only_accept_superior_org_member' =>
184
                Yii::t('organization', 'This department only accepts members of the parent organization or department.') . "<br>" .
185
                Yii::t('organization', 'That is to say, only the members of {name} are accepted.', ['name' => $parentName]),
186
            'join_entrance_url' => Yii::t('organization', 'You can assign a unique code to the ' . ($this->organization->isOrganization() ? 'organization' : 'department') . ', and we will generate a unique entrance URL based on this code.') . "<br>" .
187
                Yii::t('organization', 'After you enter the code and submit it, the generated URL will appear below.') . "<br>" .
188
                Yii::t('organization', 'If you do not want users to join the ' . ($this->organization->isOrganization() ? 'organization' : 'department') . ', please leave blank.') . "<br>" .
189
                (empty($this->join_entrance_url) ? Yii::t('organization', 'No entrance URL is currently available.') : Html::a(Yii::t('organization', 'The entrance URL'), [
190
                        '/organization/join/index',
191
                        'entrance' => $this->join_entrance_url,
192
                ], [
193
                    'class' => 'btn btn-primary',
194
                    'target' => '_blank',
195
                ])),
196
            'join_password' =>
197
                Yii::t('organization', 'If you specify a password, the user needs to provide the password to join.') . "<br>" .
198
                Yii::t('organization', 'If you do not need a user to enter a password, leave it blank.'),
199
            'join_ip_address' =>
200
                Yii::t('organization', 'Only the users from the above IP address (segment) can join the organization / department proactively.') . "<br>" .
201
                Yii::t('organization', 'For example, the local address segment is {ip}.', ['ip' => '127.0.0.0/8']) . "<br>" .
202
                Yii::t('organization', 'If you do not restrict the IP address (segment), leave it blank.'),
203
        ];
204
    }
205
206
    /**
207
     * @inheritdoc
208
     */
209
    public function rules()
210
    {
211
        $orgClass = get_class($this->organization);
212
        return [
213
            [['exclude_other_members', 'disallow_member_join_other', 'only_accept_current_org_member', 'only_accept_superior_org_member', 'exit_allow_withdraw_actively'], 'boolean', 'trueValue' => '1', 'falseValue' => '0'],
214
            [['join_password', 'join_entrance_url'], 'string', 'max' => 255],
215
            ['join_ip_address', 'ip', 'subnet' => null, 'normalize' => true],
216
            ['join_entrance_url', 'setting_unique', 'skipOnError' => false, 'params' => ['item' => $orgClass::SETTING_ITEM_JOIN_ENTRANCE_URL]],
217
        ];
218
    }
219
220
    /**
221
     * Check whether the setting is unique.
222
     * @param string $attribute the attribute currently being validated
223
     * @param mixed $params the value of the "params" given in the rule
224
     * @param \yii\validators\InlineValidator related InlineValidator instance.
225
     */
226
    public function setting_unique($attribute, $params, $validator)
0 ignored issues
show
The parameter $validator is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
227
    {
228
        $value = (string)$this->$attribute;
229
        if (empty($value)) {
230
            return;
231
        }
232
233
        $class = $this->organization->organizationSettingClass;
234
        if (empty($class) || !is_string($class)) {
235
            return;
236
        }
237
238
        $setting = $class::find()->andWhere([
239
            $this->organization->getNoInitOrganizationSetting()->idAttribute => $params['item'],
240
            $this->organization->getNoInitOrganizationSetting()->contentAttribute => $value,
241
        ])->one();
242
        /* @var $setting OrganizationSetting */
243
        if ($setting && !$setting->host->equals($this->organization)) {
244
            $this->addError($attribute, Yii::t('organization', "{value} already exists.", ['value' => $value]));
245
        }
246
    }
247
248
    /**
249
     * @inheritdoc
250
     */
251
    public function scenarios()
252
    {
253
        return [
254
            static::SCENARIO_ORGANIZATION => [
255
                'exclude_other_members',
256
                'disallow_member_join_other',
257
                'join_password',
258
                'join_entrance_url',
259
                'join_ip_address',
260
                'exit_allow_withdraw_actively'
261
            ],
262
            static::SCENARIO_DEPARTMENT => [
263
                'only_accept_current_org_member',
264
                'only_accept_superior_org_member',
265
                'join_password',
266
                'join_entrance_url',
267
                'join_ip_address',
268
                'exit_allow_withdraw_actively'
269
            ],
270
        ];
271
    }
272
}
273