Issues (258)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Bootstrap/SubscriberRegistration.php (6 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * (c) shopware AG <[email protected]>
4
 * For the full copyright and license information, please view the LICENSE
5
 * file that was distributed with this source code.
6
 */
7
8
namespace ShopwarePlugins\Connect\Bootstrap;
9
10
use Enlight_Components_Db_Adapter_Pdo_Mysql;
11
use Shopware\Components\Model\ModelManager;
12
use Shopware\Connect\Gateway\PDO;
13
use Shopware\Connect\SDK;
14
use Shopware\CustomModels\Connect\ProductStreamAttributeRepository;
15
use ShopwarePlugins\Connect\Components\Config;
16
use ShopwarePlugins\Connect\Components\ConnectFactory;
17
use ShopwarePlugins\Connect\Components\Helper;
18
19
use ShopwarePlugins\Connect\Components\Logger;
20
use ShopwarePlugins\Connect\Components\ProductStream\ProductStreamRepository;
21
use ShopwarePlugins\Connect\Components\ProductStream\ProductStreamService;
22
use ShopwarePlugins\Connect\Subscribers\Article;
23
use ShopwarePlugins\Connect\Subscribers\ArticleList;
24
use ShopwarePlugins\Connect\Subscribers\BasketWidget;
25
use ShopwarePlugins\Connect\Subscribers\Category;
26
use ShopwarePlugins\Connect\Subscribers\Checkout;
27
use ShopwarePlugins\Connect\Subscribers\Connect;
28
use ShopwarePlugins\Connect\Subscribers\ControllerPath;
29
use ShopwarePlugins\Connect\Subscribers\CronJob;
30
use ShopwarePlugins\Connect\Subscribers\CustomerGroup;
31
use ShopwarePlugins\Connect\Subscribers\DisableConnectInFrontend;
32
use ShopwarePlugins\Connect\Subscribers\Dispatches;
33
use ShopwarePlugins\Connect\Subscribers\Javascript;
34
use ShopwarePlugins\Connect\Subscribers\Less;
35
use ShopwarePlugins\Connect\Subscribers\Lifecycle;
36
use ShopwarePlugins\Connect\Subscribers\OrderDocument;
37
use ShopwarePlugins\Connect\Subscribers\PaymentSubscriber;
38
use ShopwarePlugins\Connect\Subscribers\ProductStreams;
39
use ShopwarePlugins\Connect\Subscribers\Property;
40
use ShopwarePlugins\Connect\Subscribers\Search;
41
use ShopwarePlugins\Connect\Subscribers\ServiceContainer;
42
use ShopwarePlugins\Connect\Subscribers\Supplier;
43
use ShopwarePlugins\Connect\Subscribers\TemplateExtension;
44
use ShopwarePlugins\Connect\Subscribers\Voucher;
45
use Symfony\Component\DependencyInjection\Container;
46
use Shopware\Models\Payment\Payment;
47
48
class SubscriberRegistration
49
{
50
    /**
51
     * @var ModelManager
52
     */
53
    private $modelManager;
54
55
    /**
56
     * @var Config
57
     */
58
    private $config;
59
60
    /**
61
     * @var Enlight_Components_Db_Adapter_Pdo_Mysql
62
     */
63
    private $db;
64
65
    /**
66
     * @var \Shopware_Plugins_Backend_SwagConnect_Bootstrap
67
     */
68
    private $pluginBootstrap;
69
70
    /**
71
     * @var \Enlight_Event_EventManager
72
     */
73
    private $eventManager;
74
75
    /**
76
     * @var SDK
77
     */
78
    private $SDK;
79
80
    /**
81
     * @var ConnectFactory
82
     */
83
    private $connectFactory;
84
85
    /**
86
     * @var Helper
87
     */
88
    private $helper;
89
90
    /**
91
     * This property saves all product updates and will be inserted back later
92
     *
93
     * @var array
94
     */
95
    private $productUpdates = [];
96
97
    /**
98
     * @var Lifecycle
99
     */
100
    private $lifecycle;
101
102
    /**
103
     * @var Container
104
     */
105
    private $container;
106
107
    /**
108
     * @param Config $config
109
     * @param ModelManager $modelManager
110
     * @param Enlight_Components_Db_Adapter_Pdo_Mysql $db
111
     * @param \Shopware_Plugins_Backend_SwagConnect_Bootstrap $pluginBootstrap
112
     * @param \Enlight_Event_EventManager $eventManager
113
     * @param SDK $SDK
114
     * @param ConnectFactory $connectFactory
115
     * @param Helper $helper
116
     * @param Container $container
117
     */
118
    public function __construct(
119
        Config $config,
120
        ModelManager $modelManager,
121
        Enlight_Components_Db_Adapter_Pdo_Mysql $db,
122
        \Shopware_Plugins_Backend_SwagConnect_Bootstrap $pluginBootstrap,
123
        \Enlight_Event_EventManager $eventManager,
124
        SDK $SDK,
125
        ConnectFactory $connectFactory,
126
        Helper $helper,
127
        Container $container
128
    ) {
129
        $this->config = $config;
130
        $this->modelManager = $modelManager;
131
        $this->db = $db;
132
        $this->pluginBootstrap = $pluginBootstrap;
133
        $this->eventManager = $eventManager;
134
        $this->SDK = $SDK;
135
        $this->connectFactory = $connectFactory;
136
        $this->helper = $helper;
137
        $this->container = $container;
138
    }
139
140
    public function registerSubscribers()
141
    {
142
        try {
143
            $verified = $this->config->getConfig('apiKeyVerified', false);
0 ignored issues
show
Are you sure the assignment to $verified is correct as $this->config->getConfig('apiKeyVerified', false) (which targets ShopwarePlugins\Connect\...nts\Config::getConfig()) seems to always return null.

This check looks for function or method calls that always return null and whose return value is assigned to a variable.

class A
{
    function getObject()
    {
        return null;
    }

}

$a = new A();
$object = $a->getObject();

The method getObject() can return nothing but null, so it makes no sense to assign that value to a variable.

The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes.

Loading history...
144
        } catch (\Exception $e) {
145
            // if the config table is not available, just assume, that the update
146
            // still needs to be installed
147
            $verified = false;
148
        }
149
150
        $subscribers = $this->getDefaultSubscribers();
151
        if ($verified) {
152
            $subscribers = array_merge($subscribers, $this->getVerifiedSubscribers());
153
        } else {
154
            $subscribers = array_merge($subscribers, $this->getNotVerifiedSubscribers());
155
        }
156
157
        foreach ($subscribers as $newSubscriber) {
158
            $this->eventManager->addSubscriber($newSubscriber);
159
        }
160
161
        $this->modelManager->getEventManager()->addEventListener(
162
            [\Doctrine\ORM\Events::onFlush, \Doctrine\ORM\Events::postFlush],
163
            $this
164
        );
165
    }
166
167
    /**
168
     * @return array
169
     */
170
    private function getDefaultSubscribers()
171
    {
172
        return [
173
            new Article(
174
                new PDO($this->db->getConnection()),
175
                $this->modelManager,
176
                $this->connectFactory->getConnectExport(),
177
                $this->helper,
178
                $this->config,
179
                $this->connectFactory->getSDK()
180
            ),
181
            new ArticleList($this->container->get('db')),
182
            new Category(
183
                $this->container->get('dbal_connection'),
184
                $this->createProductStreamService()
185
            ),
186
            new Connect(
187
                $this->config,
188
                $this->SDK,
189
                $this->container->get('snippets')
190
            ),
191
            new ControllerPath($this->pluginBootstrap->Path()),
192
            new CronJob(
193
                $this->SDK,
194
                $this->connectFactory->getConnectExport(),
195
                $this->config,
196
                $this->helper,
197
                $this->container,
198
                $this->createProductStreamService()
199
            ),
200
            new CustomerGroup(
201
                $this->modelManager,
202
                new Logger(Shopware()->Db())
203
            ),
204
            $this->getLifecycleSubscriber(),
205
            new OrderDocument(),
206
            new PaymentSubscriber(
207
                $this->helper,
208
                $this->modelManager->getRepository(Payment::class)
209
            ),
210
            new ProductStreams(
211
                $this->connectFactory->getConnectExport(),
212
                $this->config,
213
                $this->helper,
214
                $this->SDK,
215
                $this->container->get('db')
216
            ),
217
            new Property($this->modelManager),
218
            new Search($this->modelManager),
219
            new ServiceContainer(
220
                $this->modelManager,
221
                $this->db,
222
                $this->container,
223
                $this->config,
224
                $this->SDK
225
            ),
226
            new Supplier($this->container->get('dbal_connection'))
227
        ];
228
    }
229
230
    /**
231
     * Generate changes for updated Articles and Details.
232
     * On postFlush all related entities are updated and product can
233
     * be fetched from DB correctly.
234
     *
235
     * @param \Doctrine\ORM\Event\PostFlushEventArgs $eventArgs
236
     */
237
    public function postFlush(\Doctrine\ORM\Event\PostFlushEventArgs $eventArgs)
0 ignored issues
show
The parameter $eventArgs is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
238
    {
239
        $updates = $this->expandConfigSetsToProducts($this->productUpdates);
240
241
        foreach ($updates as $entity) {
242
            $this->getLifecycleSubscriber()->handleChange($entity);
243
        }
244
245
        $this->productUpdates = [];
246
    }
247
248
    /**
249
     * @param array $productUpdates
250
     * @return array
251
     */
252
    private function expandConfigSetsToProducts($productUpdates)
253
    {
254
        $updates = [];
255
        foreach ($productUpdates as $entity) {
256
            if ($entity instanceof \Shopware\Models\Article\Configurator\Set) {
0 ignored issues
show
The class Shopware\Models\Article\Configurator\Set does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
257
                foreach ($entity->getArticles() as $article) {
258
                    $updates[] = $article;
259
                }
260
            } else {
261
                $updates[] = $entity;
262
            }
263
        }
264
265
        return $updates;
266
    }
267
268
    /**
269
     * @return Lifecycle
270
     */
271
    private function getLifecycleSubscriber()
272
    {
273
        if (!$this->lifecycle) {
274
            $this->lifecycle = new Lifecycle(
275
                $this->modelManager,
276
                $this->helper,
277
                $this->SDK,
278
                $this->config,
279
                $this->connectFactory->getConnectExport()
280
            );
281
        }
282
283
        return $this->lifecycle;
284
    }
285
286
    /**
287
     * Collect updated Articles and Details
288
     * Lifecycle events don't work correctly, because products will be fetched via query builder,
289
     * but related entities like price are not updated yet.
290
     *
291
     * @param \Doctrine\ORM\Event\OnFlushEventArgs $eventArgs
292
     */
293
    public function onFlush(\Doctrine\ORM\Event\OnFlushEventArgs $eventArgs)
294
    {
295
        /** @var $em ModelManager */
296
        $em = $eventArgs->getEntityManager();
297
        $uow = $em->getUnitOfWork();
298
299
        // Entity updates
300
        foreach ($uow->getScheduledEntityUpdates() as $entity) {
301
            if (!$entity instanceof \Shopware\Models\Article\Article
0 ignored issues
show
The class Shopware\Models\Article\Article does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
302
                && !$entity instanceof \Shopware\Models\Article\Detail
0 ignored issues
show
The class Shopware\Models\Article\Detail does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
303
                && !$entity instanceof \Shopware\Models\Article\Configurator\Set
0 ignored issues
show
The class Shopware\Models\Article\Configurator\Set does not exist. Did you forget a USE statement, or did you not list all dependencies?

This error could be the result of:

1. Missing dependencies

PHP Analyzer uses your composer.json file (if available) to determine the dependencies of your project and to determine all the available classes and functions. It expects the composer.json to be in the root folder of your repository.

Are you sure this class is defined by one of your dependencies, or did you maybe not list a dependency in either the require or require-dev section?

2. Missing use statement

PHP does not complain about undefined classes in ìnstanceof checks. For example, the following PHP code will work perfectly fine:

if ($x instanceof DoesNotExist) {
    // Do something.
}

If you have not tested against this specific condition, such errors might go unnoticed.

Loading history...
304
            ) {
305
                continue;
306
            }
307
308
            $this->productUpdates[] = $entity;
309
        }
310
    }
311
312
    /**
313
     * @return ProductStreamService
314
     */
315
    private function createProductStreamService()
316
    {
317
        /** @var ProductStreamAttributeRepository $streamAttrRepository */
318
        $streamAttrRepository = $this->modelManager->getRepository('Shopware\CustomModels\Connect\ProductStreamAttribute');
319
320
        return new ProductStreamService(
321
            new ProductStreamRepository($this->modelManager, $this->container->get('shopware_product_stream.repository')),
322
            $streamAttrRepository,
323
            $this->config
324
        );
325
    }
326
327
    /**
328
     * @return array
329
     */
330
    private function getVerifiedSubscribers()
331
    {
332
        return [
333
            new BasketWidget(
334
                $this->pluginBootstrap->getBasketHelper(),
335
                $this->helper
336
            ),
337
            new Checkout(
338
                $this->modelManager,
339
                $this->eventManager,
340
                $this->connectFactory->getSDK(),
341
                $this->connectFactory->getBasketHelper(),
342
                $this->connectFactory->getHelper()
343
            ),
344
            new Dispatches($this->helper),
345
            new Javascript(),
346
            new TemplateExtension(
347
                $this->SDK,
348
                $this->helper
349
            ),
350
            new Voucher(
351
                $this->helper,
352
                $this->connectFactory->getBasketHelper(),
353
                $this->container->get('snippets')
354
            ),
355
            new Less()
356
        ];
357
    }
358
359
    /**
360
     * @return array
361
     */
362
    private function getNotVerifiedSubscribers()
363
    {
364
        return [
365
            new DisableConnectInFrontend(
366
                $this->container->get('db')
367
            )
368
        ];
369
    }
370
}
371