Issues (66)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Magestead/Installers/MagentoProject.php (6 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php namespace Magestead\Installers;
2
3
use Magestead\Helper\HostsPluginChecker;
4
use Magestead\Service\Notification;
5
use Magestead\Service\VersionControl;
6
use Magestead\Command\ProcessCommand;
7
use Symfony\Component\Console\Helper\ProgressBar;
8
use Symfony\Component\Console\Helper\Table;
9
use Symfony\Component\Console\Output\OutputInterface;
10
use Symfony\Component\Yaml\Dumper;
11
use Symfony\Component\Yaml\Exception\ParseException;
12
use Symfony\Component\Yaml\Parser;
13
14
/**
15
 * Class MagentoProject
16
 * @package Magestead\Installers
17
 */
18
class MagentoProject
19
{
20
    /**
21
     * MagentoProject constructor.
22
     * @param array $options
23
     * @param array $config
24
     * @param $projectPath
25
     * @param OutputInterface $output
26
     */
27
    public function __construct(array $options, array $config, $projectPath, OutputInterface $output)
28
    {
29
        $output->writeln('<info>Installing Magento with Composer</info>');
30
        $this->composerInstall($projectPath, $output);
31
32
        $output->writeln('<info>Installing Magento Software</info>');
33
        $this->installMagento($config, $projectPath, $output);
34
35
        $this->configureTestSuites($options, $projectPath, $output);
36
37
        $output->writeln('<info>Finalising Setup</info>');
38
        $this->finaliseSetup($options, $projectPath, $output);
39
        $this->showCredentials($config, $output);
40
41
        Notification::send('Magento was successfully installed!');
42
    }
43
44
    /**
45
     * @param array $options
46
     * @param $projectPath
47
     * @param $output
48
     */
49 View Code Duplication
    protected function installMagento(array $options, $projectPath, OutputInterface $output)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
50
    {
51
        $locale           = $options['magestead']['apps']['mba_12345']['locale'];
52
        $db_name          = $options['magestead']['apps']['mba_12345']['db_name'];
53
        $base_url         = $options['magestead']['apps']['mba_12345']['base_url'];
54
        $default_currency = $options['magestead']['apps']['mba_12345']['default_currency'];
55
56
        $install = 'vagrant ssh -c \'cd /var/www/public; php -f install.php -- \
57
--license_agreement_accepted "yes" \
58
--locale "' . $locale . '" \
59
--timezone "Europe/London" \
60
--default_currency "' . $default_currency . '" \
61
--db_host "localhost" \
62
--db_name "' . $db_name . '" \
63
--db_user "magestead" \
64
--db_pass "vagrant" \
65
--session_save "db" \
66
--url "http://' . $base_url . '/" \
67
--use_rewrites "yes" \
68
--skip_url_validation "yes" \
69
--use_secure "no" \
70
--use_secure_admin "no" \
71
--secure_base_url "http://' . $base_url . '/" \
72
--admin_firstname "RichDynamix" \
73
--admin_lastname "Magestead" \
74
--admin_email "[email protected]" \
75
--admin_username "admin" \
76
--admin_password "password123"\' ';
77
78
        new ProcessCommand($install, $projectPath, $output);
79
80
        $this->configureRedis($projectPath);
81
        $this->setPermissions($projectPath, $output);
82
        $this->installMagerun($projectPath, $output);
83
    }
84
85
    /**
86
     * @param $projectPath
87
     * @param OutputInterface $output
88
     */
89
    protected function setPermissions($projectPath, OutputInterface $output)
90
    {
91
        $command = 'vagrant ssh -c \'cd /var/www/public; sudo find var/ -type f -exec chmod 600 {} \;\'';
92
        $output->writeln('<comment>Setting "var" Files Permissions</comment>');
93
        new ProcessCommand($command, $projectPath, $output);
94
95
        $command = 'vagrant ssh -c \'cd /var/www/public; sudo find media/ -type f -exec chmod 600 {} \;\'';
96
        $output->writeln('<comment>Setting "media" Files Permissions</comment>');
97
        new ProcessCommand($command, $projectPath, $output);
98
99
        $command = 'vagrant ssh -c \'cd /var/www/public; sudo find var/ -type d -exec chmod 700 {} \;\'';
100
        $output->writeln('<comment>Setting "var" Folder Permissions</comment>');
101
        new ProcessCommand($command, $projectPath, $output);
102
103
        $command = 'vagrant ssh -c \'cd /var/www/public; sudo find media/ -type d -exec chmod 700 {} \;\'';
104
        $output->writeln('<comment>Setting "media" Folder Permissions</comment>');
105
        new ProcessCommand($command, $projectPath, $output);
106
107
        $command = 'vagrant ssh -c \'cd /var/www/public; sudo chmod 700 includes;\'';
108
        $output->writeln('<comment>Setting "includes" Permissions</comment>');
109
        new ProcessCommand($command, $projectPath, $output);
110
111
        $command = 'vagrant ssh -c \'cd /var/www/public; sudo chmod 600 includes/config.php;\'';
112
        $output->writeln('<comment>Setting "includes/config.php" Permissions</comment>');
113
        new ProcessCommand($command, $projectPath, $output);
114
    }
115
116
    /**
117
     * @param $projectPath
118
     * @param OutputInterface $output
119
     */
120
    protected function installMagerun($projectPath, OutputInterface $output)
121
    {
122
        $command = 'vagrant ssh -c \'cd /var/www/bin; sudo wget https://files.magerun.net/n98-magerun.phar;\'';
123
        $output->writeln('<info>Downloading Magerun</info>');
124
        new ProcessCommand($command, $projectPath, $output);
125
126
        $command = 'vagrant ssh -c \'cd /var/www/bin; sudo chmod +x ./n98-magerun.phar;\'';
127
        $output->writeln('<comment>Setting Magerun Permissions</comment>');
128
        new ProcessCommand($command, $projectPath, $output);
129
    }
130
131
    /**
132
     * @param array $options
133
     * @param $projectPath
134
     * @param OutputInterface $output
135
     */
136
    protected function finaliseSetup(array $options, $projectPath, OutputInterface $output)
137
    {
138
        $command = 'vagrant ssh -c \'cd /var/www/public; ../bin/n98-magerun.phar index:reindex:all;\'';
139
        $output->writeln('<comment>Reindexing Tables</comment>');
140
        new ProcessCommand($command, $projectPath, $output);
141
142
        $command = 'vagrant ssh -c \'cd /var/www/public; ../bin/n98-magerun.phar cache:enable;\'';
143
        $output->writeln('<comment>Enabling All Cache</comment>');
144
        new ProcessCommand($command, $projectPath, $output);
145
146
        $command = 'vagrant ssh -c \'cd /var/www/public; ../bin/n98-magerun.phar cache:flush;\'';
147
        $output->writeln('<comment>Flushing All Cache</comment>');
148
        new ProcessCommand($command, $projectPath, $output);
149
150
        $this->processVcs($options, $projectPath, $output);
151
152
        $command = 'vagrant ssh -c \'cd /var/www/public; ../bin/n98-magerun.phar sys:check;\'';
153
        $output->writeln('<comment>System Check</comment>');
154
        new ProcessCommand($command, $projectPath, $output);
155
    }
156
157
    /**
158
     * @param array $options
159
     * @param OutputInterface $output
160
     */
161 View Code Duplication
    protected function showCredentials(array $options, OutputInterface $output)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
162
    {
163
        $output->writeln('<info>SUCCESS: Magestead has finished installing Magento!</info>');
164
        $table = new Table($output);
165
        $table
166
            ->setHeaders(['Username', 'Password', 'Base URL'])
167
            ->setRows([
168
                ['admin', 'password123', $options['magestead']['apps']['mba_12345']['base_url']],
169
            ]);
170
        $table->render();
171
172
        HostsPluginChecker::verify($options, $output);
173
    }
174
175
    /**
176
     * @param array $options
177
     * @param $projectPath
178
     * @param OutputInterface $output
179
     * @return VersionControl|null
180
     */
181 View Code Duplication
    protected function processVcs(array $options, $projectPath, OutputInterface $output)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
182
    {
183
        if (!empty($options['repo_url'])) {
184
            copy($projectPath . "/puphpet/magestead/magento/stubs/gitignore.tmp", $projectPath . "/.gitignore");
185
            return new VersionControl($options['repo_url'], $projectPath, $output);
186
        }
187
    }
188
189
    /**
190
     * @param $projectPath
191
     * @param OutputInterface $output
192
     */
193
    protected function composerInstall($projectPath, OutputInterface $output)
194
    {
195
        copy($projectPath . "/puphpet/magestead/magento/stubs/composer.tmp", $projectPath . "/composer.json");
196
        new ProcessCommand('composer install', $projectPath, $output);
197
    }
198
199
    /**
200
     * @param $projectPath
201
     */
202
    protected function configureRedis($projectPath)
203
    {
204
        $this->updateConfigXml($projectPath);
205
        $this->activateModule($projectPath);
206
    }
207
208
    /**
209
     * @param $projectPath
210
     */
211
    protected function updateConfigXml($projectPath)
212
    {
213
        $localFile = '/public/app/etc/local.xml';
214
        $localXml  = file_get_contents($projectPath . $localFile);
215
216
        $config = new \SimpleXMLElement($localXml);
217
218
        $config->global[0]->redis_session[0]->host                  = '127.0.0.1';
219
        $config->global[0]->redis_session[0]->port                  = '6379';
220
        $config->global[0]->redis_session[0]->password              = '';
221
        $config->global[0]->redis_session[0]->timeout               = '2.5';
222
        $config->global[0]->redis_session[0]->persistent            = '';
223
        $config->global[0]->redis_session[0]->db                    = '';
224
        $config->global[0]->redis_session[0]->compression_threshold = '2048';
225
        $config->global[0]->redis_session[0]->compression_lib       = 'gzip';
226
        $config->global[0]->redis_session[0]->log_level             = '1';
227
        $config->global[0]->redis_session[0]->max_concurrency       = '6';
228
        $config->global[0]->redis_session[0]->break_after_frontend  = '5';
229
        $config->global[0]->redis_session[0]->break_after_adminhtml = '30';
230
        $config->global[0]->redis_session[0]->first_lifetime        = '600';
231
        $config->global[0]->redis_session[0]->bot_first_lifetime    = '60';
232
        $config->global[0]->redis_session[0]->bot_lifetime          = '7200';
233
        $config->global[0]->redis_session[0]->disable_locking       = '0';
234
        $config->global[0]->redis_session[0]->min_lifetime          = '60';
235
        $config->global[0]->redis_session[0]->max_lifetime          = '2592000';
236
237
        file_put_contents($projectPath . $localFile, $config->asXML());
238
    }
239
240
    /**
241
     * @param $projectPath
242
     */
243
    protected function activateModule($projectPath)
244
    {
245
        $moduleFile = '/public/app/etc/modules/Cm_RedisSession.xml';
246
        $moduleXml  = file_get_contents($projectPath . $moduleFile);
247
        $config     = new \SimpleXMLElement($moduleXml);
248
249
        $config->modules[0]->Cm_RedisSession[0]->active = 'true';
250
        file_put_contents($projectPath . $moduleFile, $config->asXML());
251
    }
252
253
    /**
254
     * @param array $options
255
     * @param $projectPath
256
     * @param OutputInterface $output
257
     * @return ProcessCommand
258
     */
259
    protected function configureTestSuites(array $options, $projectPath, OutputInterface $output)
0 ignored issues
show
The parameter $options is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
260
    {
261
        $output->writeln('<info>Configuring PHPSpec & Behat Suites</info>');
262
        $progress = new ProgressBar($output, 2);
263
264
        $progress->start();
265
        copy($projectPath . "/puphpet/magestead/magento/stubs/phpspec.yml", $projectPath . "/phpspec.yml");
266
        $progress->advance();
267
        $progress->advance();
268
//        $behat = $this->getBehatConfig($options, $projectPath, $output);
0 ignored issues
show
Unused Code Comprehensibility introduced by
64% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
269
//        $this->saveBehatConfig($projectPath, $output, $behat, $progress);
270
        $progress->finish();
271
        echo "\n";
272
        new ProcessCommand('bin/phpspec r', $projectPath, $output);
273
        return new ProcessCommand('bin/behat --init', $projectPath, $output);
274
    }
275
276
    /**
277
     * @param array $options
278
     * @param $projectPath
279
     * @param OutputInterface $output
280
     * @return bool|mixed
281
     */
282
    protected function getBehatConfig(array $options, $projectPath, OutputInterface $output)
283
    {
284
        $yaml = new Parser();
285
286
        try {
287
            $behat = $yaml->parse(file_get_contents($projectPath . "/puphpet/magestead/magento/stubs/behat.yml"));
288
289
            $behat['default']['extensions']['MageTest\MagentoExtension\Extension']['base_url'] = $options['base_url'];
290
            return $behat;
291
        } catch (ParseException $e) {
292
            $output->writeln('<error>Unable to parse the YAML config</error>');
293
        }
294
295
        return false;
296
    }
297
298
    /**
299
     * @param $projectPath
300
     * @param OutputInterface $output
301
     * @param $behat
302
     * @param $progress
303
     */
304 View Code Duplication
    protected function saveBehatConfig($projectPath, OutputInterface $output, $behat, $progress)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
305
    {
306
        $dumper = new Dumper();
307
        $yaml   = $dumper->dump($behat, 6);
308
309
        try {
310
            file_put_contents($projectPath . '/behat.yml', $yaml);
311
            $progress->advance();
312
        } catch (\Exception $e) {
313
            $output->writeln('<error>Unable to write to the YAML file</error>');
314
        }
315
    }
316
}