Issues (168)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Navigation.php (9 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Created by Vitaly Iegorov <[email protected]>
4
 * on 07.08.14 at 17:11
5
 */
6
namespace samsoncms\api;
7
8
/**
9
 * SamsonCMS Navigation entity
10
 * @author Vitaly Egorov <[email protected]>
11
 * @copyright 2014 SamsonOS
12
 */
13
class Navigation extends \samsonframework\orm\Record
14
{
15
    /** Store entity name */
16
    const ENTITY = __CLASS__;
17
18
    /** Entity field names constants for using in code */
19
    const F_PRIMARY = 'StructureID';
20
    const F_IDENTIFIER = 'Url';
21
    const F_NAME = 'Name';
22
    const F_TYPE = 'type';
23
    const F_DELETION = 'Active';
24
    const F_PARENT = 'ParentID';
25
    const F_PRIORITY = 'priority';
26
    const F_CREATED = 'Created';
27
    const F_MODIFIED = 'Modyfied';
28
    const F_DEF_MATERIAL = 'MaterialID';
29
30
    /** @var self[] Collection of child items */
31
    public $children = array();
32
33
    /** @var array WTF?? */
34
    public $parentsnav = array();
35
    /** @var bool WTF??? */
36
    protected $base = false;
37
    /**
38
     * Material query injection
39
     * @param \samson\activerecord\dbQuery $query Query object
40
     */
41
    public function materialsHandlers(&$query)
42
    {
43
        $query->join('gallery');
44
    }
45
    /**
46
     * Get all materials related to current navigation
47
     * @return Material[] Collection of related materials
48
     * @deprecated Will be removed in nex major version
49
     */
50
    public function &materials()
51
    {
52
        /** @var Material[] $materials Get related materials collection */
53
        $materials = array();
54
        // Perform generic material retrieval
55
        if (CMS::getMaterialsByStructures(
56
            array($this->id),
57
            $materials,
58
            'samson\cms\CMSMaterial',
59
            null,
60
            array(),
61
            array($this, 'materialsHandlers'))
62
        ) {
63
            // Handle
64
        }
65
        return $materials;
66
    }
67
    /**
68
     * Get all related fields
69
     * @return Field[] Collection of related fields
70
     */
71
    public function &fields()
72
    {
73
        // Prepare db request to get related fields
74
        $fieldIDs = dbQuery('structurefield')
0 ignored issues
show
Deprecated Code introduced by
The method samson\activerecord\dbQuery::cond() has been deprecated with message: @see self::where()

This method has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead.

Loading history...
75
            ->cond('StructureID', $this->id)
76
            ->cond('Active', 1)
77
            ->fields('FieldID');
78
        /** @var \samson\cms\NavigationField[] $fields Get collection of related navigation fields */
79
        $fields = array();
80
        if (sizeof($fieldIDs)) {
81
            dbQuery('samson\cms\Field')->id($fieldIDs)->exec($fields);
0 ignored issues
show
Deprecated Code introduced by
The method samson\activerecord\dbQuery::id() has been deprecated with message: Use direct query with where('PRIMARY_FIELD',...)

This method has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead.

Loading history...
82
        }
83
        return $fields;
84
    }
85
    /**
86
     * Get default Material object
87
     * @return \samson\cms\Material|bool Default Material object, otherwise false
88
     */
89
    public function def()
90
    {
91
        // If this naviagtion has default material identifier specified
92
        if (isset($this->MaterialID) && $this->MaterialID > 0) {
93
            // Perform db query to get this material
94
            return dbQuery('samson\cms\Material')->id($this->MaterialID)->first();
0 ignored issues
show
Deprecated Code introduced by
The method samson\activerecord\dbQuery::id() has been deprecated with message: Use direct query with where('PRIMARY_FIELD',...)

This method has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead.

Loading history...
95
        }
96
        return false;
97
    }
98
    /**
99
     * Get all children navigation elements default material object.
100
     * This approach increases performance on large navigation tree branches.
101
     * @return Material[] Collection of material objects
102
     */
103
    public function childrenDef()
104
    {
105
        // Gather all default materials
106
        $defaultMaterialIds = array();
107
        foreach ($this->children() as $child) {
108
            $defaultMaterialIds[] = $child->MaterialID;
109
        }
110
        // Perform database query
111
        return dbQuery('samson\cms\CMSMaterial')->cond('MaterialID', $defaultMaterialIds)->exec();
0 ignored issues
show
$defaultMaterialIds is of type array, but the function expects a string|null.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
Deprecated Code introduced by
The method samson\activerecord\dbQuery::cond() has been deprecated with message: @see self::where()

This method has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead.

Loading history...
112
    }
113
    // TODO: Functions lower to this line should be rewritten by [email protected]
114
    public function parents(CMSNav & $bound = NULL)
115
    {
116
        $parents = array();
117
        $this->base();
118
        if (sizeof($this->parentsnav) > 0) {
119
            $parent = current($this->parentsnav);
120
            $parents[] = $parent;
121
            if (!(isset($bound) && ($bound == $this->parentsnav[0]))) {
122
                $parents = array_merge($parents, $parent->parents($bound));
123
            }
124
        }
125
        //return array_reverse( $parents );
126
        return $parents;
127
    }
128
    public function children()
129
    {
130
        // check? is this objeck full;
131
        $this->base();
132
        return $this->children;
133
    }
134
    public function parent()
135
    {
136
        // check? is this objeck full;
137
        $this->base();
138
        return $this->parent;
139
    }
140
    /**
141
     * WTF?
142
     */
143
    public function prepare()
144
    {
145
        $this->base = true;
146
        if (isset($this->onetomany['_children'])) {
147
            foreach ($this->onetomany['_children'] as & $child) {
148
                $this->children[$child->id] = &$child;
149
            }
150
            unset($this->onetomany['_children']);
151
        }
152
        if (isset($this->onetomany['_parents'])) {
153
            foreach ($this->onetomany['_parents'] as & $parent) {
154
                $this->parentsnav[$parent->id] = &$parent;
155
                $this->parent = &$parent;
156
            }
157
            unset($this->onetomany['_parents']);
158
        }
159
    }
160
    /*
161
     * Has object all its relations?
162
     * If not, fill relations.
163
     */
164
    protected function base()
165
    {
166
        if (!$this->base) {
167
            //$classname = ns_classname('cmsnav', 'samson\cms');
168
            $classname = get_class($this);
169
            $cmsnav = null;
170
            if (dbQuery($classname)
171
                ->where('Active', 1)
172
                ->where('StructureID', $this->id)
173
                ->join('children_relations', null, true)
174
                ->join('children', get_class($this))
175
                ->join('parents_relations', null, true)
176
                ->join('parents', get_class($this))
177
                ->exec($cmsnav)
178
            ) {
179
                $cmsnav = array_shift($cmsnav);
180
                if (isset($cmsnav->onetomany['_children'])) {
181
                    $this->onetomany['_children'] = $cmsnav->onetomany['_children'];
0 ignored issues
show
The property onetomany does not seem to exist. Did you mean oneToMany?

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
182
                }
183
                if (isset($cmsnav->onetomany['_parents'])) {
184
                    $this->onetomany['_parents'] = $cmsnav->onetomany['_parents'];
0 ignored issues
show
The property onetomany does not seem to exist. Did you mean oneToMany?

An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name.

If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading.

Loading history...
185
                }
186
                $this->prepare();
187
            }
188
        }
189
    }
190
    protected function baseChildren()
191
    {
192
        //elapsed('startBaseChildren');
193
        //trace('baseChildren');
194
        $this->base();
195
        //$classname = ns_classname('cmsnav', 'samson\cms');
196
        $classname = get_class($this);
197
        //trace($classname);
198
        $cmsnavs = null;
199
        $children_id = array_keys($this->children);
200
        //elapsed('queryStart');
201
        if (sizeof($children_id)) {
202
            if (dbQuery($classname)
0 ignored issues
show
Deprecated Code introduced by
The method samson\activerecord\dbQuery::cond() has been deprecated with message: @see self::where()

This method has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead.

Loading history...
203
                ->cond('Active', 1)
204
                ->cond('StructureID', $children_id)
0 ignored issues
show
$children_id is of type array<integer,integer>, but the function expects a string|null.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
205
                ->join('children_relations', null, true)
206
                ->join('children', $classname)
207
                ->join('parents_relations', null, true)
208
                ->join('parents', $classname)
209
                ->exec($cmsnavs)
210
            ) {
211
                //elapsed('queryEnd');
212
                $this->children = array();
213
                foreach ($cmsnavs as & $cmsnav) {
214
                    $cmsnav->prepare();
215
                    $this->children[] = &$cmsnav;
216
                }
217
            }
218
        }
219
        //elapsed('endBaseChildren');
220
        return $this->children;
221
    }
222
    public function rewind()
223
    {
224
        $this->base();
225
        reset($this->children);
226
    }
227
    public function next()
228
    {
229
        $this->base();
230
        return next($this->children);
231
    }
232
    public function current()
233
    {
234
        $this->base();
235
        return current($this->children);
236
    }
237
    public function key()
238
    {
239
        $this->base();
240
        return key($this->children);
241
    }
242
    public function valid()
243
    {
244
        $this->base();
245
        $key = key($this->children);
246
        return ($key !== null && $key !== false);
247
    }
248
249
    /**
250
     * Override standard view passing
251
     * @param string $prefix Prefix
252
     * @param array $restricted Collection of ignored entity fields
253
     * @return array Filled collection of key => values for view
254
     */
255
    public function toView($prefix = '', array $restricted = array())
256
    {
257
        return parent::toView(
258
            $prefix,
259
            array_merge(
260
                $restricted,
261
                array('parent', 'parents', 'children'
262
                )
263
            )
264
        );
265
    }
266
}
267