sant0ro /
chocolatey
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace App\Http\Controllers; |
||
| 4 | |||
| 5 | use App\Facades\Mail; |
||
| 6 | use App\Facades\User as UserFacade; |
||
| 7 | use App\Facades\Validation; |
||
| 8 | use App\Models\ChocolateyId; |
||
| 9 | use App\Models\User; |
||
| 10 | use App\Models\UserPreferences; |
||
| 11 | use App\Models\UserSettings; |
||
| 12 | use Illuminate\Http\JsonResponse; |
||
| 13 | use Illuminate\Http\Request; |
||
| 14 | use Illuminate\Http\Response; |
||
| 15 | use Illuminate\Support\Facades\Config; |
||
| 16 | use Laravel\Lumen\Routing\Controller as BaseController; |
||
| 17 | use Nubs\RandomNameGenerator\Alliteration; |
||
| 18 | |||
| 19 | /** |
||
| 20 | * Class AccountController. |
||
| 21 | */ |
||
| 22 | class AccountController extends BaseController |
||
| 23 | { |
||
| 24 | /** |
||
| 25 | * Save User Look. |
||
| 26 | * |
||
| 27 | * @param Request $request |
||
| 28 | * |
||
| 29 | * @return JsonResponse |
||
| 30 | */ |
||
| 31 | public function saveLook(Request $request): JsonResponse |
||
| 32 | { |
||
| 33 | UserFacade::updateSession(['look' => $request->json()->get('figure'), 'gender' => $request->json()->get('gender')]); |
||
| 34 | |||
| 35 | return response()->json(UserFacade::getUser()); |
||
|
0 ignored issues
–
show
|
|||
| 36 | } |
||
| 37 | |||
| 38 | /** |
||
| 39 | * Get User Non Read Messenger Discussions. |
||
| 40 | * |
||
| 41 | * @TODO: Code Integration with HabboMessenger |
||
| 42 | * @TODO: Create Messenger Model |
||
| 43 | * |
||
| 44 | * @return JsonResponse |
||
| 45 | */ |
||
| 46 | public function getDiscussions(): JsonResponse |
||
| 47 | { |
||
| 48 | return response()->json([]); |
||
|
0 ignored issues
–
show
The method
json does only exist in Laravel\Lumen\Http\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 49 | } |
||
| 50 | |||
| 51 | /** |
||
| 52 | * Get User Preferences. |
||
| 53 | * |
||
| 54 | * @return JsonResponse |
||
| 55 | */ |
||
| 56 | public function getPreferences(): JsonResponse |
||
| 57 | { |
||
| 58 | $userPreferences = UserPreferences::firstOrCreate(['user_id' => UserFacade::getUser()->uniqueId]); |
||
| 59 | |||
| 60 | foreach ($userPreferences->getAttributes() as $attributeName => $attributeValue) { |
||
| 61 | $userPreferences->{$attributeName} = $attributeValue == 1; |
||
| 62 | } |
||
| 63 | |||
| 64 | return response()->json($userPreferences); |
||
|
0 ignored issues
–
show
The method
json does only exist in Laravel\Lumen\Http\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 65 | } |
||
| 66 | |||
| 67 | /** |
||
| 68 | * Save New User Preferences. |
||
| 69 | * |
||
| 70 | * @param Request $request |
||
| 71 | * |
||
| 72 | * @return Response |
||
| 73 | */ |
||
| 74 | public function savePreferences(Request $request): Response |
||
| 75 | { |
||
| 76 | UserSettings::updateOrCreate(['user_id' => UserFacade::getUser()->uniqueId], [ |
||
| 77 | 'block_following' => $request->json()->get('friendCanFollow') == false ? '1' : '0', |
||
| 78 | 'block_friendrequests' => $request->json()->get('friendRequestEnabled') == false ? '1' : '0', |
||
| 79 | ]); |
||
| 80 | |||
| 81 | foreach ((array) $request->json()->all() as $setting => $value) { |
||
| 82 | UserPreferences::find(UserFacade::getUser()->uniqueId)->update([$setting => $value == true ? '1' : '0']); |
||
| 83 | } |
||
| 84 | |||
| 85 | return response(null); |
||
| 86 | } |
||
| 87 | |||
| 88 | /** |
||
| 89 | * Get All E-Mail Accounts. |
||
| 90 | * |
||
| 91 | * @return JsonResponse |
||
| 92 | */ |
||
| 93 | public function getAvatars(): JsonResponse |
||
| 94 | { |
||
| 95 | if (UserFacade::getUser()->getChocolateyId() === null) { |
||
| 96 | return response()->json(User::where('mail', UserFacade::getUser()->realEmail)->get()); |
||
|
0 ignored issues
–
show
The method
json does only exist in Laravel\Lumen\Http\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 97 | } |
||
| 98 | |||
| 99 | return response()->json(UserFacade::getUser()->getChocolateyId()->relatedAccounts); |
||
| 100 | } |
||
| 101 | |||
| 102 | /** |
||
| 103 | * Check if an Username is available |
||
| 104 | * for a new Avatar Account. |
||
| 105 | * |
||
| 106 | * @param Request $request |
||
| 107 | * |
||
| 108 | * @return JsonResponse |
||
| 109 | */ |
||
| 110 | public function checkName(Request $request): JsonResponse |
||
| 111 | { |
||
| 112 | return response()->json(['isAvailable' => (User::where('username', $request->input('name'))->count() == 0 |
||
|
0 ignored issues
–
show
The method
json does only exist in Laravel\Lumen\Http\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 113 | && Validation::filterUserName($request->input('name')) && !UserFacade::getUser()->isStaff)]); |
||
| 114 | } |
||
| 115 | |||
| 116 | /** |
||
| 117 | * Create a New User Avatar. |
||
| 118 | * |
||
| 119 | * @param Request $request |
||
| 120 | * |
||
| 121 | * @return JsonResponse |
||
| 122 | */ |
||
| 123 | public function createAvatar(Request $request): JsonResponse |
||
| 124 | { |
||
| 125 | if (User::where('username', $request->json()->get('name'))->count() == 0 && Validation::filterUserName($request->json()->get('name'))) { |
||
| 126 | $user = $this->createUser($request, ['username' => $request->json()->get('name'), 'email' => UserFacade::getUser()->email]); |
||
| 127 | |||
| 128 | ChocolateyId::find(UserFacade::getUser()->email)->update(['last_logged_id' => $user->uniqueId]); |
||
| 129 | |||
| 130 | return response()->json(''); |
||
|
0 ignored issues
–
show
The method
json does only exist in Laravel\Lumen\Http\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 131 | } |
||
| 132 | |||
| 133 | return response()->json(''); |
||
| 134 | } |
||
| 135 | |||
| 136 | /** |
||
| 137 | * Create a New User. |
||
| 138 | * |
||
| 139 | * @param Request $request |
||
| 140 | * @param array $userInfo |
||
| 141 | * @param bool $newUser If is a New User |
||
| 142 | * @param bool $sendEmail |
||
| 143 | * |
||
| 144 | * @return User |
||
| 145 | */ |
||
| 146 | public function createUser(Request $request, array $userInfo, bool $newUser = false, bool $sendEmail = false): User |
||
| 147 | { |
||
| 148 | $userName = $newUser ? $this->uniqueName($userInfo['email']) : $userInfo['username']; |
||
| 149 | |||
| 150 | $token = Mail::store($userInfo['email'], 'public/registration/activate'); |
||
| 151 | |||
| 152 | if ($sendEmail == true) { |
||
|
0 ignored issues
–
show
|
|||
| 153 | Mail::send(['email' => $userInfo['email'], 'name' => $userName, 'url' => "/activate/{$token}", |
||
| 154 | 'subject' => 'Welcome to '.Config::get('chocolatey.hotelName'), ]); |
||
| 155 | } |
||
| 156 | |||
| 157 | return UserFacade::setSession((new User())->store($userName, $userInfo['email'], $request->ip(), $newUser)); |
||
| 158 | } |
||
| 159 | |||
| 160 | /** |
||
| 161 | * Create Random Unique Username. |
||
| 162 | * |
||
| 163 | * @WARNING: Doesn't create Like Habbo Way |
||
| 164 | * |
||
| 165 | * @param string $userMail |
||
| 166 | * |
||
| 167 | * @return string |
||
| 168 | */ |
||
| 169 | protected function uniqueName(string $userMail): string |
||
| 170 | { |
||
| 171 | $partialName = explode(' ', (new Alliteration())->getName()); |
||
| 172 | |||
| 173 | return strtolower($partialName[0].strstr($userMail, '@', true).$partialName[1]); |
||
| 174 | } |
||
| 175 | |||
| 176 | /** |
||
| 177 | * Change Logged In User. |
||
| 178 | * |
||
| 179 | * @param Request $request |
||
| 180 | */ |
||
| 181 | public function selectAvatar(Request $request) |
||
| 182 | { |
||
| 183 | UserFacade::getUser()->getChocolateyId()->update(['last_logged_id' => $request->json()->get('uniqueId')]); |
||
| 184 | |||
| 185 | UserFacade::setSession(User::find($request->json()->get('uniqueId'))); |
||
| 186 | } |
||
| 187 | |||
| 188 | /** |
||
| 189 | * Send User Forgot E-Mail. |
||
| 190 | * |
||
| 191 | * @param Request $request |
||
| 192 | * |
||
| 193 | * @return JsonResponse |
||
| 194 | */ |
||
| 195 | public function forgotPassword(Request $request): JsonResponse |
||
| 196 | { |
||
| 197 | if (($user = User::where('mail', $request->json()->get('email'))->first()) == null) { |
||
| 198 | return response()->json(['email' => $request->json()->get('email')]); |
||
|
0 ignored issues
–
show
The method
json does only exist in Laravel\Lumen\Http\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 199 | } |
||
| 200 | |||
| 201 | $token = Mail::store($user->email, 'public/forgotPassword'); |
||
| 202 | |||
| 203 | Mail::send(['name' => $user->name, 'email' => $user->email, 'subject' => 'Password reset confirmation', |
||
| 204 | 'url' => "/reset-password/{$token}", |
||
| 205 | ], 'habbo-web-mail.password-reset'); |
||
| 206 | |||
| 207 | return response()->json(['email' => $user->email]); |
||
| 208 | } |
||
| 209 | |||
| 210 | /** |
||
| 211 | * Send an Account Confirmation E-Mail. |
||
| 212 | * |
||
| 213 | * @param Request $request |
||
| 214 | * |
||
| 215 | * @return Response |
||
| 216 | */ |
||
| 217 | public function verifyAccount(Request $request): Response |
||
| 218 | { |
||
| 219 | $token = Mail::store(UserFacade::getUser()->email, 'public/registration/activate'); |
||
| 220 | |||
| 221 | Mail::send(['name' => UserFacade::getUser()->name, 'email' => $request->user()->email, |
||
| 222 | 'url' => "/activate/{$token}", 'subject' => 'Welcome to '.Config::get('chocolatey.hotelName'), |
||
| 223 | ]); |
||
| 224 | |||
| 225 | return response(null); |
||
| 226 | } |
||
| 227 | } |
||
| 228 |
It seems like the method you are trying to call exists only in some of the possible types.
Let’s take a look at an example:
Available Fixes
Add an additional type-check:
Only allow a single type to be passed if the variable comes from a parameter: