This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace Saxulum\RestCrud\Controller; |
||
4 | |||
5 | use Doctrine\Common\Persistence\ManagerRegistry; |
||
6 | use Doctrine\Common\Persistence\ObjectManager; |
||
7 | use Doctrine\Common\Persistence\ObjectRepository; |
||
8 | use JMS\Serializer\SerializerInterface; |
||
9 | use Knp\Component\Pager\Pagination\AbstractPagination; |
||
10 | use Knp\Component\Pager\PaginatorInterface; |
||
11 | use Saxulum\RestCrud\Exception\ServiceNotFoundException; |
||
12 | use Saxulum\RestCrud\Repository\QueryBuilderForFilterFormInterface; |
||
13 | use Symfony\Component\Form\FormFactoryInterface; |
||
14 | use Symfony\Component\Form\FormInterface; |
||
15 | use Symfony\Component\Form\FormTypeInterface; |
||
16 | use Symfony\Component\HttpFoundation\Request; |
||
17 | use Symfony\Component\HttpFoundation\Response; |
||
18 | use Symfony\Component\HttpKernel\Exception\MethodNotAllowedHttpException; |
||
19 | use Symfony\Component\Routing\Generator\UrlGeneratorInterface; |
||
20 | use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface; |
||
21 | use Symfony\Component\Security\Core\Exception\AccessDeniedException; |
||
22 | use Symfony\Component\Security\Core\SecurityContextInterface; |
||
23 | |||
24 | trait RestCrudTrait |
||
25 | { |
||
26 | /** |
||
27 | * @param Request $request |
||
28 | * @param array $additionalResponseVars |
||
29 | * |
||
30 | * @return Response |
||
31 | * |
||
32 | * @throws \Exception |
||
33 | */ |
||
34 | public function restCrudObjectList(Request $request, array $additionalResponseVars = array()) |
||
35 | { |
||
36 | if ($request->getMethod() !== 'GET') { |
||
37 | throw new MethodNotAllowedHttpException('Only GET is allowed!'); |
||
0 ignored issues
–
show
|
|||
38 | } |
||
39 | |||
40 | $role = $this->restCrudListRole(); |
||
41 | if (!$this->restCrudIsGranted($role)) { |
||
42 | throw new AccessDeniedException(sprintf('You need the permission to list entities, role: %s!', $role)); |
||
43 | } |
||
44 | |||
45 | $form = $this->restCrudListForm($request); |
||
46 | if (null !== $form) { |
||
47 | $form->handleRequest($request); |
||
48 | $formData = $form->getData(); |
||
49 | } else { |
||
50 | $formData = array(); |
||
51 | } |
||
52 | |||
53 | $formData = $this->restCrudListFormDataEnrich($request, $formData); |
||
54 | |||
55 | $repo = $this->restCrudRepositoryForClass($this->restCrudObjectClass()); |
||
56 | if (!$repo instanceof QueryBuilderForFilterFormInterface) { |
||
57 | throw new \Exception(sprintf('A repo used for crudListObjects needs to implement: %s', QueryBuilderForFilterFormInterface::interfacename)); |
||
58 | } |
||
59 | |||
60 | $qb = $repo->getQueryBuilderForFilterForm($formData); |
||
61 | |||
62 | $pagination = $this->restCrudPaginate($qb, $request); |
||
63 | $page = $pagination->getCurrentPageNumber(); |
||
64 | $itemCountPerPage = $pagination->getItemNumberPerPage(); |
||
65 | $itemCount = $pagination->getTotalItemCount(); |
||
66 | $pageCount = ceil($itemCount / $itemCountPerPage); |
||
67 | |||
68 | $data = array_replace_recursive(array( |
||
69 | 'items' => $pagination->getItems(), |
||
70 | '_links' => array( |
||
71 | 'first' => $this->restCrudGenerateListUrl($request, array('page' => 1)), |
||
72 | 'prev' => $page > 1 ? $this->restCrudGenerateListUrl($request, array('page' => $page - 1)) : null, |
||
73 | 'next' => $page < $pageCount ? $this->restCrudGenerateListUrl($request, array('page' => $page + 1)) : null, |
||
74 | 'last' => $this->restCrudGenerateListUrl($request, array('page' => $pageCount)), |
||
75 | ), |
||
76 | '_metadata' => array( |
||
77 | 'itemCount' => $itemCount, |
||
78 | 'itemPerPage' => $itemCountPerPage, |
||
79 | 'page' => $page, |
||
80 | 'pageCount' => $pageCount, |
||
81 | ), |
||
82 | ), $additionalResponseVars); |
||
83 | |||
84 | $content = $this->restCrudSerializer()->serialize($data, 'json'); |
||
85 | |||
86 | return new Response($content); |
||
87 | } |
||
88 | |||
89 | public function restCrudObjectCreate(Request $request) |
||
0 ignored issues
–
show
|
|||
90 | { |
||
91 | } |
||
92 | |||
93 | public function restCrudObjectRead(Request $request, $id) |
||
0 ignored issues
–
show
|
|||
94 | { |
||
95 | } |
||
96 | |||
97 | public function restCrudObjectUpdate(Request $request, $id) |
||
0 ignored issues
–
show
|
|||
98 | { |
||
99 | } |
||
100 | |||
101 | public function restCrudObjectPartialUpdate(Request $request, $id) |
||
0 ignored issues
–
show
|
|||
102 | { |
||
103 | } |
||
104 | |||
105 | public function restCrudObjectDelete(Request $request, $id) |
||
0 ignored issues
–
show
|
|||
106 | { |
||
107 | } |
||
108 | |||
109 | /** |
||
110 | * @return string |
||
111 | */ |
||
112 | protected function restCrudListRole() |
||
113 | { |
||
114 | return strtoupper(sprintf($this->restCrudRolePattern(), $this->restCrudName(), 'list')); |
||
115 | } |
||
116 | |||
117 | /** |
||
118 | * @return string |
||
119 | */ |
||
120 | protected function restCrudListRoute() |
||
121 | { |
||
122 | return strtolower(sprintf($this->restCrudRoutePattern(), $this->restCrudName(), 'list')); |
||
123 | } |
||
124 | |||
125 | /** |
||
126 | * @param Request $request |
||
127 | * |
||
128 | * @return FormInterface|null |
||
129 | */ |
||
130 | protected function restCrudListForm(Request $request) |
||
131 | { |
||
132 | if (null === $formType = $this->restCrudListFormType($request)) { |
||
133 | return; |
||
134 | } |
||
135 | |||
136 | return $this->restCrudForm($formType, array()); |
||
137 | } |
||
138 | |||
139 | /** |
||
140 | * @param Request $request |
||
141 | * |
||
142 | * @return FormTypeInterface|null |
||
143 | */ |
||
144 | protected function restCrudListFormType(Request $request) |
||
0 ignored issues
–
show
|
|||
145 | { |
||
146 | return; |
||
147 | } |
||
148 | |||
149 | /** |
||
150 | * @param Request $request |
||
151 | * @param array $formData |
||
152 | * |
||
153 | * @return array |
||
154 | */ |
||
155 | protected function restCrudListFormDataEnrich(Request $request, array $formData) |
||
0 ignored issues
–
show
|
|||
156 | { |
||
157 | return $formData; |
||
158 | } |
||
159 | |||
160 | /** |
||
161 | * @param Request $request |
||
162 | * @param array $replace |
||
163 | * |
||
164 | * @return string |
||
165 | */ |
||
166 | protected function restCrudGenerateListUrl(Request $request, array $replace = array()) |
||
167 | { |
||
168 | return $this->restCrudGenerateRoute($this->restCrudListRoute(), array_replace_recursive($request->query->all(), $replace)); |
||
169 | } |
||
170 | |||
171 | /** |
||
172 | * @return string |
||
173 | */ |
||
174 | protected function restCrudRolePattern() |
||
175 | { |
||
176 | return 'role_%s_%s'; |
||
177 | } |
||
178 | |||
179 | /** |
||
180 | * @return string |
||
181 | */ |
||
182 | protected function restCrudRoutePattern() |
||
183 | { |
||
184 | return 'api_%s_%s'; |
||
185 | } |
||
186 | |||
187 | /** |
||
188 | * @param mixed $attributes |
||
189 | * @param mixed $object |
||
190 | * |
||
191 | * @return bool |
||
192 | * |
||
193 | * @throws \Exception |
||
194 | */ |
||
195 | protected function restCrudIsGranted($attributes, $object = null) |
||
196 | { |
||
197 | try { |
||
198 | return $this->restCrudAuthorizationChecker()->isGranted($attributes, $object); |
||
199 | } catch (ServiceNotFoundException $e) { |
||
200 | return $this->restCrudSecurity()->isGranted($attributes, $object); |
||
201 | } |
||
202 | } |
||
203 | |||
204 | /** |
||
205 | * @param FormTypeInterface $type |
||
206 | * @param mixed $data |
||
207 | * @param array $options |
||
208 | * |
||
209 | * @return FormInterface |
||
210 | */ |
||
211 | protected function restCrudForm(FormTypeInterface $type, $data = null, array $options = array()) |
||
212 | { |
||
213 | return $this->restCrudFormFactory()->create($type, $data, $options); |
||
214 | } |
||
215 | |||
216 | /** |
||
217 | * @param string $class |
||
218 | * |
||
219 | * @return ObjectManager |
||
220 | * |
||
221 | * @throws \Exception |
||
222 | */ |
||
223 | protected function restCrudManagerForClass($class) |
||
224 | { |
||
225 | $om = $this->restCrudDoctrine()->getManagerForClass($class); |
||
226 | |||
227 | if (null === $om) { |
||
228 | throw new \Exception(sprintf('There is no object manager for class: %s', $class)); |
||
229 | } |
||
230 | |||
231 | return $om; |
||
232 | } |
||
233 | |||
234 | /** |
||
235 | * @param string $class |
||
236 | * |
||
237 | * @return ObjectRepository |
||
238 | */ |
||
239 | protected function restCrudRepositoryForClass($class) |
||
240 | { |
||
241 | return $this->restCrudManagerForClass($class)->getRepository($class); |
||
242 | } |
||
243 | |||
244 | /** |
||
245 | * @param object $target |
||
246 | * @param Request $request |
||
247 | * |
||
248 | * @return AbstractPagination |
||
249 | */ |
||
250 | protected function restCrudPaginate($target, Request $request) |
||
251 | { |
||
252 | return $this->restCrudPaginator()->paginate( |
||
253 | $target, |
||
254 | $request->query->get('page', 1), |
||
255 | $request->query->get('perPage', $this->restCrudListPerPage()) |
||
256 | ); |
||
257 | } |
||
258 | |||
259 | /** |
||
260 | * @param string $name |
||
261 | * @param array $parameters |
||
262 | * |
||
263 | * @return string |
||
264 | */ |
||
265 | protected function restCrudGenerateRoute($name, array $parameters = array()) |
||
266 | { |
||
267 | return $this->restCrudUrlGenerator()->generate($name, $parameters, UrlGeneratorInterface::ABSOLUTE_URL); |
||
268 | } |
||
269 | |||
270 | /** |
||
271 | * @return int |
||
272 | */ |
||
273 | protected function restCrudListPerPage() |
||
274 | { |
||
275 | return 10; |
||
276 | } |
||
277 | |||
278 | /** |
||
279 | * @return string |
||
280 | */ |
||
281 | abstract protected function restCrudName(); |
||
282 | |||
283 | /** |
||
284 | * @return string |
||
285 | */ |
||
286 | abstract protected function restCrudObjectClass(); |
||
287 | |||
288 | /** |
||
289 | * @return AuthorizationCheckerInterface |
||
290 | * |
||
291 | * @throws ServiceNotFoundException |
||
292 | */ |
||
293 | protected function restCrudAuthorizationChecker() |
||
294 | { |
||
295 | throw new ServiceNotFoundException(sprintf( |
||
296 | 'For actions using authorization checker you need: %s', |
||
297 | 'Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface' |
||
298 | )); |
||
299 | } |
||
300 | |||
301 | /** |
||
302 | * @return SecurityContextInterface |
||
303 | * |
||
304 | * @throws ServiceNotFoundException |
||
305 | */ |
||
306 | protected function restCrudSecurity() |
||
307 | { |
||
308 | throw new ServiceNotFoundException(sprintf( |
||
309 | 'For actions using security you need: %s', |
||
310 | 'Symfony\Component\Security\Core\SecurityContextInterface' |
||
311 | )); |
||
312 | } |
||
313 | |||
314 | /** |
||
315 | * @return FormFactoryInterface |
||
316 | * |
||
317 | * @throws ServiceNotFoundException |
||
318 | */ |
||
319 | protected function restCrudFormFactory() |
||
320 | { |
||
321 | throw new ServiceNotFoundException(sprintf( |
||
322 | 'For actions using form you need: %s', |
||
323 | 'Symfony\Component\Form\FormFactoryInterface' |
||
324 | )); |
||
325 | } |
||
326 | |||
327 | /** |
||
328 | * @return ManagerRegistry |
||
329 | * |
||
330 | * @throws ServiceNotFoundException |
||
331 | */ |
||
332 | protected function restCrudDoctrine() |
||
333 | { |
||
334 | throw new ServiceNotFoundException(sprintf( |
||
335 | 'For actions using doctrine you need: %s', |
||
336 | 'Doctrine\Common\Persistence\ManagerRegistry' |
||
337 | )); |
||
338 | } |
||
339 | |||
340 | /** |
||
341 | * @return PaginatorInterface |
||
342 | * |
||
343 | * @throws ServiceNotFoundException |
||
344 | */ |
||
345 | protected function restCrudPaginator() |
||
346 | { |
||
347 | throw new ServiceNotFoundException(sprintf( |
||
348 | 'For actions using pagination you need: %s', |
||
349 | 'Saxulum\Crud\Pagination\PaginatorInterface' |
||
350 | )); |
||
351 | } |
||
352 | |||
353 | /** |
||
354 | * @return UrlGeneratorInterface |
||
355 | * |
||
356 | * @throws ServiceNotFoundException |
||
357 | */ |
||
358 | protected function restCrudUrlGenerator() |
||
359 | { |
||
360 | throw new ServiceNotFoundException(sprintf( |
||
361 | 'For actions using url generation you need: %s', |
||
362 | 'Symfony\Component\Routing\Generator\UrlGeneratorInterface' |
||
363 | )); |
||
364 | } |
||
365 | |||
366 | /** |
||
367 | * @return SerializerInterface |
||
368 | * |
||
369 | * @throws ServiceNotFoundException |
||
370 | */ |
||
371 | protected function restCrudSerializer() |
||
372 | { |
||
373 | throw new ServiceNotFoundException(sprintf( |
||
374 | 'For serializing you need: %s', |
||
375 | 'JMS\Serializer\SerializerInterface' |
||
376 | )); |
||
377 | } |
||
378 | } |
||
379 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: