This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /* |
||
4 | * This file is part of the Tinyissue package. |
||
5 | * |
||
6 | * (c) Mohamed Alsharaf <[email protected]> |
||
7 | * |
||
8 | * For the full copyright and license information, please view the LICENSE |
||
9 | * file that was distributed with this source code. |
||
10 | */ |
||
11 | |||
12 | namespace Tinyissue\Http\Controllers; |
||
13 | |||
14 | use Illuminate\Http\Request; |
||
15 | use Tinyissue\Form\FilterIssue as FilterForm; |
||
16 | use Tinyissue\Form\Note as NoteForm; |
||
17 | use Tinyissue\Form\Project as Form; |
||
18 | use Tinyissue\Http\Requests\FormRequest; |
||
19 | use Tinyissue\Model\Project; |
||
20 | use Tinyissue\Model\Project\Issue; |
||
21 | use Tinyissue\Model\Project\Note; |
||
22 | use Tinyissue\Services\Exporter; |
||
23 | |||
24 | /** |
||
25 | * ProjectController is the controller class for managing request related to a project. |
||
26 | * |
||
27 | * @author Mohamed Alsharaf <[email protected]> |
||
28 | */ |
||
29 | class ProjectController extends Controller |
||
30 | { |
||
31 | /** |
||
32 | * Display activity for a project. |
||
33 | * |
||
34 | * @param Project $project |
||
35 | * |
||
36 | * @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View |
||
37 | */ |
||
38 | 12 | public function getIndex(Project $project) |
|
39 | { |
||
40 | 12 | $activities = $project->activities() |
|
41 | 12 | ->with('activity', 'issue', 'user', 'assignTo', 'comment', 'note') |
|
42 | 12 | ->orderBy('users_activity.created_at', 'DESC') |
|
43 | 12 | ->take(10); |
|
44 | |||
45 | // Internal project and logged user can see created only |
||
46 | 12 | if ($project->isPrivateInternal() && $this->getLoggedUser()->isUser()) { |
|
47 | $activities->join('projects_issues', 'projects_issues.id', '=', 'item_id'); |
||
48 | $activities->where('created_by', '=', $this->getLoggedUser()->id); |
||
49 | } |
||
50 | |||
51 | 12 | return view('project.index', [ |
|
52 | 12 | 'tabs' => $this->projectMainViewTabs($project, 'index'), |
|
53 | 11 | 'project' => $project, |
|
54 | 11 | 'active' => 'activity', |
|
55 | 11 | 'activities' => $activities->get(), |
|
56 | 11 | 'sidebar' => 'project', |
|
57 | ]); |
||
58 | } |
||
59 | |||
60 | /** |
||
61 | * Display issues for a project. |
||
62 | * |
||
63 | * @param FilterForm $filterForm |
||
64 | * @param Request $request |
||
65 | * @param Project $project |
||
66 | * @param int $status |
||
67 | * |
||
68 | * @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View |
||
69 | */ |
||
70 | 2 | public function getIssues(FilterForm $filterForm, Request $request, Project $project, $status = Issue::STATUS_OPEN) |
|
71 | { |
||
72 | 2 | if ($project->isPrivateInternal() && $this->getLoggedUser()->isUser()) { |
|
73 | $request['created_by'] = $this->getLoggedUser()->id; |
||
74 | } |
||
75 | 2 | $active = $status == Issue::STATUS_OPEN ? 'open_issue' : 'closed_issue'; |
|
76 | 2 | $issues = $project->listIssues($status, $request->all()); |
|
77 | |||
78 | 2 | return view('project.index', [ |
|
79 | 2 | 'tabs' => $this->projectMainViewTabs($project, 'issues', $issues, $status), |
|
0 ignored issues
–
show
|
|||
80 | 2 | 'project' => $project, |
|
81 | 2 | 'active' => $active, |
|
82 | 2 | 'issues' => $issues, |
|
83 | 2 | 'sidebar' => 'project', |
|
84 | 2 | 'filterForm' => $filterForm, |
|
85 | ]); |
||
86 | } |
||
87 | |||
88 | /** |
||
89 | * Display issues assigned to current user for a project. |
||
90 | * |
||
91 | * @param Project $project |
||
92 | * |
||
93 | * @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View |
||
94 | */ |
||
95 | 1 | View Code Duplication | public function getAssigned(Project $project) |
96 | { |
||
97 | 1 | $issues = $project->listAssignedOrCreatedIssues($this->getLoggedUser()); |
|
98 | |||
99 | 1 | return view('project.index', [ |
|
100 | 1 | 'tabs' => $this->projectMainViewTabs($project, 'assigned', $issues), |
|
101 | 1 | 'project' => $project, |
|
102 | 1 | 'active' => 'issue_assigned_to_you', |
|
103 | 1 | 'issues' => $issues, |
|
104 | 1 | 'sidebar' => 'project', |
|
105 | ]); |
||
106 | } |
||
107 | |||
108 | /** |
||
109 | * Display issues created to current user for a project. |
||
110 | * |
||
111 | * @param Project $project |
||
112 | * |
||
113 | * @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View |
||
114 | */ |
||
115 | View Code Duplication | public function getCreated(Project $project) |
|
116 | { |
||
117 | $issues = $project->listAssignedOrCreatedIssues($this->getLoggedUser()); |
||
118 | |||
119 | return view('project.index', [ |
||
120 | 'tabs' => $this->projectMainViewTabs($project, 'created', $issues), |
||
121 | 'project' => $project, |
||
122 | 'active' => 'issue_created_by_you', |
||
123 | 'issues' => $issues, |
||
124 | 'sidebar' => 'project', |
||
125 | ]); |
||
126 | } |
||
127 | |||
128 | /** |
||
129 | * Display notes for a project. |
||
130 | * |
||
131 | * @param Project $project |
||
132 | * @param NoteForm $form |
||
133 | * |
||
134 | * @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View |
||
135 | */ |
||
136 | 7 | View Code Duplication | public function getNotes(Project $project, NoteForm $form) |
137 | { |
||
138 | 7 | $notes = $project->notes()->with('createdBy')->get(); |
|
139 | |||
140 | 7 | return view('project.index', [ |
|
141 | 7 | 'tabs' => $this->projectMainViewTabs($project, 'notes', $notes), |
|
142 | 7 | 'project' => $project, |
|
143 | 7 | 'active' => 'notes', |
|
144 | 7 | 'notes' => $notes, |
|
145 | 7 | 'sidebar' => 'project', |
|
146 | 7 | 'noteForm' => $form, |
|
147 | ]); |
||
148 | } |
||
149 | |||
150 | /** |
||
151 | * @param Project $project |
||
152 | * @param string $view |
||
153 | * @param null $data |
||
154 | * @param bool $status |
||
155 | * |
||
156 | * @return array |
||
157 | */ |
||
158 | 22 | protected function projectMainViewTabs(Project $project, $view, $data = null, $status = false) |
|
159 | { |
||
160 | 22 | $user = $this->getLoggedUser(); |
|
161 | 21 | $isLoggedIn = !$this->auth->guest(); |
|
162 | 21 | $isUser = $isLoggedIn && $user->isUser(); |
|
163 | 21 | $isInternalProject = $project->isPrivateInternal(); |
|
164 | |||
165 | 21 | if ($view === 'note') { |
|
166 | $notesCount = !is_null($data) ? $data->count() : 0; |
||
167 | } else { |
||
168 | 21 | $notesCount = $project->notes()->count(); |
|
169 | } |
||
170 | |||
171 | 21 | if ($view === 'issues') { |
|
172 | 2 | if ($status == Issue::STATUS_OPEN) { |
|
173 | 2 | $closedIssuesCount = $project->closedIssuesCount($user)->count(); |
|
174 | 2 | $openIssuesCount = !is_null($data) ? $data->count() : 0; |
|
175 | } else { |
||
176 | 1 | $closedIssuesCount = !is_null($data) ? $data->count() : 0; |
|
177 | 2 | $openIssuesCount = $project->openIssuesCount($user)->count(); |
|
178 | } |
||
179 | } else { |
||
180 | 19 | $openIssuesCount = $project->openIssuesCount($user)->count(); |
|
181 | 19 | $closedIssuesCount = $project->closedIssuesCount($user)->count(); |
|
182 | } |
||
183 | |||
184 | 21 | $tabs = []; |
|
185 | 21 | $tabs[] = [ |
|
186 | 21 | 'url' => $project->to(), |
|
187 | 21 | 'page' => 'activity', |
|
188 | ]; |
||
189 | 21 | $tabs[] = [ |
|
190 | 21 | 'url' => $project->to('issues'), |
|
191 | 21 | 'page' => 'open_issue', |
|
192 | 21 | 'prefix' => $openIssuesCount, |
|
193 | ]; |
||
194 | 21 | $tabs[] = [ |
|
195 | 21 | 'url' => $project->to('issues') . '/0', |
|
196 | 21 | 'page' => 'closed_issue', |
|
197 | 21 | 'prefix' => $closedIssuesCount, |
|
198 | ]; |
||
199 | 21 | if ($isLoggedIn && (!$isInternalProject || (!$isUser && $isInternalProject))) { |
|
200 | 21 | if ($view !== 'assigned') { |
|
201 | 20 | $method = $isUser ? 'createdIssuesCount' : 'assignedIssuesCount'; |
|
202 | 20 | $assignedIssuesCount = $this->getLoggedUser()->$method($project->id); |
|
203 | } else { |
||
204 | 1 | $assignedIssuesCount = !is_null($data) ? $data->count() : 0; |
|
205 | } |
||
206 | |||
207 | 21 | $tabs[] = [ |
|
208 | 21 | 'url' => $project->to($isUser ? 'created' : 'assigned'), |
|
209 | 21 | 'page' => ($isUser ? 'issue_created_by_you' : 'issue_assigned_to_you'), |
|
210 | 21 | 'prefix' => $assignedIssuesCount, |
|
211 | ]; |
||
212 | } |
||
213 | 21 | $tabs[] = [ |
|
214 | 21 | 'url' => $project->to('notes'), |
|
215 | 21 | 'page' => 'notes', |
|
216 | 21 | 'prefix' => $notesCount, |
|
217 | ]; |
||
218 | |||
219 | 21 | return $tabs; |
|
220 | } |
||
221 | |||
222 | /** |
||
223 | * Edit the project. |
||
224 | * |
||
225 | * @param Project $project |
||
226 | * @param Form $form |
||
227 | * |
||
228 | * @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View |
||
229 | */ |
||
230 | 3 | public function getEdit(Project $project, Form $form) |
|
231 | { |
||
232 | 3 | return view('project.edit', [ |
|
233 | 3 | 'form' => $form, |
|
234 | 3 | 'project' => $project, |
|
235 | 3 | 'sidebar' => 'project', |
|
236 | ]); |
||
237 | } |
||
238 | |||
239 | /** |
||
240 | * To update project details. |
||
241 | * |
||
242 | * @param Project $project |
||
243 | * @param FormRequest\Project $request |
||
244 | * |
||
245 | * @return \Illuminate\Http\RedirectResponse |
||
246 | */ |
||
247 | 3 | public function postEdit(Project $project, FormRequest\Project $request) |
|
248 | { |
||
249 | // Delete the project |
||
250 | 3 | if ($request->has('delete-project')) { |
|
251 | 1 | $project->delete(); |
|
252 | |||
253 | 1 | return redirect('projects') |
|
254 | 1 | ->with('notice', trans('tinyissue.project_has_been_deleted')); |
|
255 | } |
||
256 | |||
257 | 2 | $project->update($request->all()); |
|
258 | |||
259 | 2 | return redirect($project->to()) |
|
260 | 2 | ->with('notice', trans('tinyissue.project_has_been_updated')); |
|
261 | } |
||
262 | |||
263 | /** |
||
264 | * Ajax: returns list of users that are not in the project. |
||
265 | * |
||
266 | * @param Project $project |
||
267 | * |
||
268 | * @return \Symfony\Component\HttpFoundation\Response |
||
269 | */ |
||
270 | 1 | public function getInactiveUsers(Project $project) |
|
271 | { |
||
272 | 1 | $users = $project->usersNotIn(); |
|
273 | |||
274 | 1 | return response()->json($users); |
|
275 | } |
||
276 | |||
277 | /** |
||
278 | * Ajax: add user to the project. |
||
279 | * |
||
280 | * @param Project $project |
||
281 | * @param Request $request |
||
282 | * |
||
283 | * @return \Symfony\Component\HttpFoundation\Response |
||
284 | */ |
||
285 | 1 | public function postAssign(Project $project, Request $request) |
|
286 | { |
||
287 | 1 | $status = $project->assignUser((int) $request->input('user_id')); |
|
288 | |||
289 | 1 | return response()->json(['status' => (bool) $status]); |
|
290 | } |
||
291 | |||
292 | /** |
||
293 | * Ajax: remove user from the project. |
||
294 | * |
||
295 | * @param Project $project |
||
296 | * @param Request $request |
||
297 | * |
||
298 | * @return \Symfony\Component\HttpFoundation\Response |
||
299 | */ |
||
300 | 1 | public function postUnassign(Project $project, Request $request) |
|
301 | { |
||
302 | 1 | $status = $project->unassignUser((int) $request->input('user_id')); |
|
303 | |||
304 | 1 | return response()->json(['status' => (bool) $status]); |
|
305 | } |
||
306 | |||
307 | /** |
||
308 | * To add a new note to the project. |
||
309 | * |
||
310 | * @param Project $project |
||
311 | * @param Note $note |
||
312 | * @param FormRequest\Note $request |
||
313 | * |
||
314 | * @return \Illuminate\Http\RedirectResponse |
||
315 | */ |
||
316 | 2 | public function postAddNote(Project $project, Note $note, FormRequest\Note $request) |
|
317 | { |
||
318 | 2 | $note->setRelation('project', $project); |
|
319 | 2 | $note->setRelation('createdBy', $this->getLoggedUser()); |
|
320 | 2 | $note->createNote($request->all()); |
|
321 | |||
322 | 2 | return redirect($note->to())->with('notice', trans('tinyissue.your_note_added')); |
|
323 | } |
||
324 | |||
325 | /** |
||
326 | * Ajax: To update project note. |
||
327 | * |
||
328 | * @param Project $project |
||
329 | * @param Note $note |
||
330 | * @param Request $request |
||
331 | * |
||
332 | * @return \Symfony\Component\HttpFoundation\Response |
||
333 | */ |
||
334 | 1 | public function postEditNote(Project $project, Project\Note $note, Request $request) |
|
335 | { |
||
336 | 1 | $body = ''; |
|
337 | 1 | if ($request->has('body')) { |
|
338 | 1 | $note->setRelation('project', $project); |
|
339 | 1 | $note->updateBody($request->input('body'), $this->getLoggedUser()); |
|
0 ignored issues
–
show
It seems like
$request->input('body') targeting Illuminate\Http\Request::input() can also be of type array ; however, Tinyissue\Model\Traits\P...CrudTrait::updateBody() does only seem to accept string , maybe add an additional type check?
This check looks at variables that are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. ![]() |
|||
340 | |||
341 | 1 | $body = \Html::format($note->body); |
|
342 | } |
||
343 | |||
344 | 1 | return response()->json(['status' => true, 'text' => $body]); |
|
345 | } |
||
346 | |||
347 | /** |
||
348 | * Ajax: to delete a project note. |
||
349 | * |
||
350 | * @param Project $project |
||
351 | * @param Note $note |
||
352 | * |
||
353 | * @return \Symfony\Component\HttpFoundation\Response |
||
354 | */ |
||
355 | 1 | public function getDeleteNote(Project $project, Project\Note $note) |
|
0 ignored issues
–
show
|
|||
356 | { |
||
357 | 1 | $note->deleteNote($this->getLoggedUser()); |
|
358 | |||
359 | 1 | return response()->json(['status' => true]); |
|
360 | } |
||
361 | |||
362 | /** |
||
363 | * Ajax: generate the issues export file. |
||
364 | * |
||
365 | * @param Project $project |
||
366 | * @param Exporter $exporter |
||
367 | * @param Request $request |
||
368 | * |
||
369 | * @return \Symfony\Component\HttpFoundation\Response |
||
370 | */ |
||
371 | 4 | public function postExportIssues(Project $project, Exporter $exporter, Request $request) |
|
372 | { |
||
373 | // Generate export file |
||
374 | 4 | $info = $exporter->exportFile( |
|
375 | 4 | 'Project\Issue', |
|
376 | 4 | $request->input('format', Exporter::TYPE_CSV), |
|
0 ignored issues
–
show
It seems like
$request->input('format'...ces\Exporter::TYPE_CSV) targeting Illuminate\Http\Request::input() can also be of type array ; however, Tinyissue\Services\Exporter::exportFile() does only seem to accept string , maybe add an additional type check?
This check looks at variables that are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. ![]() |
|||
377 | 4 | $request->all() |
|
378 | ); |
||
379 | |||
380 | // Download link |
||
381 | 4 | $link = link_to( |
|
382 | 4 | $project->to('download_export/' . $info['file']), |
|
383 | 4 | trans('tinyissue.download_export'), |
|
384 | 4 | ['class' => 'btn btn-link'] |
|
385 | ); |
||
386 | |||
387 | 4 | return response()->json([ |
|
388 | 4 | 'link' => $link, |
|
389 | 4 | 'title' => $info['title'], |
|
390 | 4 | 'file' => $info['file'], |
|
391 | 4 | 'ext' => $info['ext'], |
|
392 | ]); |
||
393 | } |
||
394 | |||
395 | /** |
||
396 | * Download and then delete an export file. |
||
397 | * |
||
398 | * @param Project $project |
||
399 | * @param string $file |
||
400 | * |
||
401 | * @return \Symfony\Component\HttpFoundation\BinaryFileResponse |
||
402 | */ |
||
403 | 4 | public function getDownloadExport(Project $project, $file) |
|
0 ignored issues
–
show
|
|||
404 | { |
||
405 | // Filter out any characters that are not in pattern |
||
406 | 4 | $file = preg_replace('/[^a-z0-9\_\.]/mi', '', $file); |
|
407 | |||
408 | // Download export |
||
409 | 4 | return response()->download(storage_path('exports/' . $file), $file)->deleteFileAfterSend(true); |
|
410 | } |
||
411 | } |
||
412 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: