Issues in Lifecycle.php (master) - Issues in master - shopware/SwagConnect - Measure and Improve Code Quality continuously with Scrutinizer

Issues (258)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Subscribers/Lifecycle.php (9 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/**
 * (c) shopware AG <[email protected]>
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace ShopwarePlugins\Connect\Subscribers;

use Enlight\Event\SubscriberInterface;
use Shopware\Connect\SDK;
use Shopware\Connect\Struct\PaymentStatus;
use Shopware\Components\Model\ModelManager;
use Shopware\Connect\Struct\Tracking;
use Shopware\CustomModels\Connect\Attribute;
use ShopwarePlugins\Connect\Components\Config;
use ShopwarePlugins\Connect\Components\Helper;
use ShopwarePlugins\Connect\Components\Utils;
use ShopwarePlugins\Connect\Components\ConnectExport;
use Shopware\Models\Order\Order;
use Symfony\Component\Config\Definition\Exception\Exception;

/**
 * Handles article lifecycle events in order to automatically update/delete products to/from connect
 *
 * Class Lifecycle
 * @package ShopwarePlugins\Connect\Subscribers
 */
class Lifecycle implements SubscriberInterface
{
    /**
     * @var \Shopware\Components\Model\ModelManager
     */
    private $manager;

    /**
     * @var Helper
     */
    private $helper;
    /**
     * @var SDK
     */
    private $sdk;

    /**
     * @var Config
     */
    private $config;

    /**
     * @var ConnectExport
     */
    private $connectExport;

    /**
     * @var int
     */
    private $autoUpdateProducts;

    /**
     * Lifecycle constructor.
     *
     * @param ModelManager $modelManager
     * @param Helper $helper
     * @param SDK $sdk
     * @param Config $config
     * @param ConnectExport $connectExport
     */
    public function __construct(
        ModelManager $modelManager,
        Helper $helper,
        SDK $sdk,
        Config $config,
        ConnectExport $connectExport
    ) {
        $this->manager = $modelManager;
        $this->helper = $helper;
        $this->sdk = $sdk;
        $this->config = $config;
        $this->connectExport = $connectExport;
        $this->autoUpdateProducts = $this->config->getConfig('autoUpdateProducts', 1);
class A
{
    function getObject()
    {
        return null;
    }

}

$a = new A();
$object = $a->getObject();
    }

    /**
     * {@inheritdoc}
     */
    public static function getSubscribedEvents()
    {
        return [
            'Shopware\Models\Article\Article::preUpdate' => 'onPreUpdate',
            'Shopware\Models\Article\Article::postPersist' => 'onUpdateArticle',
            'Shopware\Models\Article\Detail::postPersist' => 'onPersistDetail',
            'Shopware\Models\Article\Article::preRemove' => 'onDeleteArticle',
            'Shopware\Models\Article\Detail::preRemove' => 'onDeleteDetail',
            'Shopware\Models\Order\Order::postUpdate' => 'onUpdateOrder',
            'Shopware\Models\Shop\Shop::preRemove' => 'onDeleteShop',
            'Shopware\Models\Category\Category::preRemove' => 'onPreDeleteCategory',
            'Shopware\Models\Category\Category::postRemove' => 'onPostDeleteCategory'
        ];
    }

    public function onPreUpdate(\Enlight_Event_EventArgs $eventArgs)
    {
        /** @var \Shopware\Models\Article\Article $entity */
        $entity = $eventArgs->get('entity');
        $db = Shopware()->Db();

        // Check if entity is a connect product
        $attribute = $this->helper->getConnectAttributeByModel($entity);
        if (!$attribute) {
            return;
        }

        // if article is not exported to Connect
        // don't need to generate changes
        if (!$this->helper->isProductExported($attribute) || !empty($attribute->getShopId())) {
            return;
        }

        if (!SDK::isPriceTypeValid($this->sdk->getPriceType())) {
            return;
        }

        $changeSet = $eventArgs->get('entityManager')->getUnitOfWork()->getEntityChangeSet($entity);

        // If product propertyGroup is changed we need to store the old one,
        // because product property value are still not changed and
        // this will generate wrong Connect changes
        if ($changeSet['propertyGroup']) {
            $filterGroupId = $db->fetchOne(
                'SELECT filtergroupID FROM s_articles WHERE id = ?',
                [$entity->getId()]
            );

            $db->executeUpdate(
                'UPDATE `s_articles_attributes` SET `connect_property_group` = ? WHERE `articledetailsID` = ?',
                [$filterGroupId, $entity->getMainDetail()->getId()]
            );
        }
    }

    /**
     * @param \Enlight_Event_EventArgs $eventArgs
     */
    public function onUpdateOrder(\Enlight_Event_EventArgs $eventArgs)
    {
        /** @var \Shopware\Models\Order\Order $order */
        $order = $eventArgs->get('entity');

        // Compute the changeset and return, if orderStatus did not change
        $changeSet = $eventArgs->get('entityManager')->getUnitOfWork()->getEntityChangeSet($order);

        if (isset($changeSet['paymentStatus'])) {
            $this->updatePaymentStatus($order);
        }

        if (isset($changeSet['orderStatus']) || isset($changeSet['trackingCode'])) {
            $this->updateOrderStatus($order);
        }
    }

    /**
     * Callback function to delete an product from connect
     * after it is going to be deleted locally
     *
     * @param \Enlight_Event_EventArgs $eventArgs
     */
    public function onDeleteArticle(\Enlight_Event_EventArgs $eventArgs)
    {
        $entity = $eventArgs->get('entity');
        $this->connectExport->setDeleteStatusForVariants($entity);
    }

    /**
     * Callback function to delete an product from connect
     * after it is going to be deleted locally
     *
     * @param \Enlight_Event_EventArgs $eventArgs
     */
    public function onPreDeleteCategory(\Enlight_Event_EventArgs $eventArgs)
    {
        if ($this->autoUpdateProducts===Config::UPDATE_MANUAL) {
            return;
        }
        $category = $eventArgs->get('entity');
        $this->connectExport->markProductsInToBeDeletedCategories($category);
    }

    /**
     * Callback function to delete an product from connect
     * after it is going to be deleted locally
     *
     * @param \Enlight_Event_EventArgs $eventArgs
     */
    public function onPostDeleteCategory(\Enlight_Event_EventArgs $eventArgs)
    {
        // if update is set to auto we have to export all marked products
        // else cron_job will do it or user does it manually
        if ($this->autoUpdateProducts===Config::UPDATE_AUTO) {
            $this->connectExport->handleMarkedProducts();
        }
    }

    /**
     * Callback function to delete product detail from connect
     * after it is going to be deleted locally
     *
     * @param \Enlight_Event_EventArgs $eventArgs
     */
    public function onDeleteDetail(\Enlight_Event_EventArgs $eventArgs)
    {
        /** @var \Shopware\Models\Article\Detail $entity */
        $entity = $eventArgs->get('entity');
        if ($entity->getKind() !== 1) {
            $attribute = $this->helper->getConnectAttributeByModel($entity);

            if (!$attribute) {
                return;
            }

            if (!$this->helper->isProductExported($attribute)) {
                return;
            }
            $this->sdk->recordDelete($attribute->getSourceId());
            $this->connectExport->updateConnectItemsStatus([$attribute->getSourceId()], Attribute::STATUS_DELETE);
        }
    }

    /**
     * Callback method to update changed connect products
     *
     * @param \Enlight_Event_EventArgs $eventArgs
     */
    public function onUpdateArticle(\Enlight_Event_EventArgs $eventArgs)
    {
        $entity = $eventArgs->get('entity');

        $this->handleChange($entity);
    }

    /**
     * Generate changes for Article or Detail if necessary
     *
     * @param \Shopware\Models\Article\Article | \Shopware\Models\Article\Detail $entity
     */
    public function handleChange($entity)
    {
        if (!$entity instanceof \Shopware\Models\Article\Article
if ($x instanceof DoesNotExist) {
    // Do something.
}
            && !$entity instanceof \Shopware\Models\Article\Detail
if ($x instanceof DoesNotExist) {
    // Do something.
}
        ) {
            return;
        }

        $id = $entity->getId();
        $className = get_class($entity);
        $model = $this->manager->getRepository($className)->find($id);
        // Check if we have a valid model
        if (!$model) {
            return;
        }

        // Check if entity is a connect product
        $attribute = $this->helper->getConnectAttributeByModel($model);
        if (!$attribute) {
            return;
        }

        // if article is not exported to Connect
        // or at least one article detail from same article is not exported
        // don't need to generate changes
        if (!$this->helper->isProductExported($attribute) || !empty($attribute->getShopId())) {
            if (!$this->helper->hasExportedVariants($attribute)) {
                return;
            }
        }

        if (!SDK::isPriceTypeValid($this->sdk->getPriceType())) {
            return;
        }

        $forceExport = false;
        if ($entity instanceof \Shopware\Models\Article\Detail) {
if ($x instanceof DoesNotExist) {
    // Do something.
}
            $changeSet = $this->manager->getUnitOfWork()->getEntityChangeSet($entity);
            // if detail number has been changed
            // sc plugin must generate & sync the change immediately
            if (array_key_exists('number', $changeSet)) {
                $forceExport = true;
            }
        }

        // Mark the product for connect update
        try {
            if ($model instanceof \Shopware\Models\Article\Detail) {
if ($x instanceof DoesNotExist) {
    // Do something.
}
                $this->generateChangesForDetail($model, $forceExport);
            } elseif ($model instanceof \Shopware\Models\Article\Article) {
if ($x instanceof DoesNotExist) {
    // Do something.
}
                $this->generateChangesForArticle($model, $forceExport);
            }
        } catch (\Exception $e) {
            // If the update fails due to missing requirements
            // (e.g. category assignment), continue without error
        }
    }

    /**
     * Callback method to insert new article details in Connect system
     * Used when article is exported and after that variants are generated
     *
     * @param \Enlight_Event_EventArgs $eventArgs
     */
    public function onPersistDetail(\Enlight_Event_EventArgs $eventArgs)
    {
        /** @var \Shopware\Models\Article\Detail $detail */
        $detail = $eventArgs->get('entity');

        /** @var \Shopware\Models\Article\Article $article */
        $article = $detail->getArticle();
        $articleAttribute = $this->helper->getConnectAttributeByModel($article);
        if (!$articleAttribute) {
            return;
        }

        // if article is not exported to Connect
        // don't need to generate changes
        if (!$this->helper->isProductExported($articleAttribute) || !empty($articleAttribute->getShopId())) {
            return;
        }

        if (!SDK::isPriceTypeValid($this->sdk->getPriceType())) {
            return;
        }

        // Mark the article detail for connect export
        try {
            $attribute = $this->helper->getOrCreateConnectAttributeByModel($detail);
            $forceExport = false;
            $changeSet = $eventArgs->get('entityManager')->getUnitOfWork()->getEntityChangeSet($detail);
            // if detail number has been changed
            // sc plugin must generate & sync the change immediately
            if (array_key_exists('number', $changeSet)) {
                $forceExport = true;
            }

            // if the variant is assigned to a new Article we have to delete the old variant
            // and insert a new ConnectAttribute with the right articleId
            if (array_key_exists('articleId', $changeSet) && $attribute->getArticleId() !== $detail->getArticleId()) {
                $this->sdk->recordDelete($attribute->getSourceId());
                $this->manager->delete($attribute);
                $this->manager->flush();

                $this->helper->getOrCreateConnectAttributeByModel($detail);
            }

            $this->generateChangesForDetail($detail, $forceExport);
        } catch (\Exception $e) {
            // If the update fails due to missing requirements
            // (e.g. category assignment), continue without error
        }
    }

    /**
     * Callback function to shop from export languages
     *
     * @param \Enlight_Event_EventArgs $eventArgs
     */
    public function onDeleteShop(\Enlight_Event_EventArgs $eventArgs)
    {
        /** @var \Shopware\Models\Shop\Shop $shop */
        $shop = $eventArgs->get('entity');
        $shopId = $shop->getId();

        $exportLanguages = $this->config->getConfig('exportLanguages');
class A
{
    function getObject()
    {
        return null;
    }

}

$a = new A();
$object = $a->getObject();
        $exportLanguages = $exportLanguages ?: [];

        $shopIndex = array_search($shopId, $exportLanguages);
        if (false === $shopIndex) {
            return;
        }

        array_splice($exportLanguages, $shopIndex, 1);
        $this->config->setConfig('exportLanguages', $exportLanguages, null, 'export');
    }

    /**
     * @param \Shopware\Models\Article\Detail $detail
     * @param bool $force
     */
    private function generateChangesForDetail(\Shopware\Models\Article\Detail $detail, $force = false)

    {
        $attribute = $this->helper->getConnectAttributeByModel($detail);
        if (!$detail->getActive() && $this->config->getConfig('excludeInactiveProducts')) {
            $this->connectExport->syncDeleteDetail($detail);

            return;
        }

        if ($this->isAutoUpdateEnabled($force)) {
            $this->connectExport->export(
                [$attribute->getSourceId()],
                null
            );
        } elseif ($this->autoUpdateProducts == Config::UPDATE_CRON_JOB) {
            $this->manager->getConnection()->update(
                's_plugin_connect_items',
                ['cron_update' => 1],
                ['article_detail_id' => $detail->getId()]
            );
        }
    }

    /**
     * @param \Shopware\Models\Article\Article $article
     * @param bool $force
     */
    private function generateChangesForArticle(\Shopware\Models\Article\Article $article, $force = false)

    {
        if (!$article->getActive() && $this->config->getConfig('excludeInactiveProducts')) {
            $this->connectExport->setDeleteStatusForVariants($article);

            return;
        }

        if ($this->isAutoUpdateEnabled($force)) {
            $sourceIds = $this->helper->getSourceIdsFromArticleId($article->getId());

            $this->connectExport->export($sourceIds, null);
        } elseif ($this->autoUpdateProducts == Config::UPDATE_CRON_JOB) {
            $this->manager->getConnection()->update(
                's_plugin_connect_items',
                ['cron_update' => 1],
                ['article_id' => $article->getId()]
            );
        }
    }

    /**
     * @param bool $force
     * @return bool
     */
    private function isAutoUpdateEnabled($force)
    {
        return $this->autoUpdateProducts == Config::UPDATE_AUTO || $force === true;
    }

    /**
     * Sends the new order status when supplier change it
     *
     * @param Order $order
     */
    private function updateOrderStatus(Order $order)
    {
        $attribute = $order->getAttribute();
        if (!$attribute || !$attribute->getConnectShopId()) {
            return;
        }

        $orderStatusMapper = new Utils\OrderStatusMapper();
        $orderStatus = $orderStatusMapper->getOrderStatusStructFromOrder($order);
        $tracking = new Tracking();
        $tracking->id = $order->getTrackingCode();
        $orderStatus->tracking = $tracking;
        try {
            $this->sdk->updateOrderStatus($orderStatus);
        } catch (\Exception $e) {
            // if sn is not available, proceed without exception
        }
    }

    /**
     * Sends the new payment status when merchant change it
     *
     * @param Order $order
     */
    private function updatePaymentStatus(Order $order)
    {
        $orderUtil = new Utils\ConnectOrderUtil();
        if (!$orderUtil->hasLocalOrderConnectProducts($order->getId())) {
            return;
        }

        $paymentStatusMapper = new Utils\OrderPaymentStatusMapper();
        $paymentStatus = $paymentStatusMapper->getPaymentStatus($order);

        $this->generateChangeForPaymentStatus($paymentStatus);
    }

    /**
     * @param PaymentStatus $paymentStatus
     */
    private function generateChangeForPaymentStatus(PaymentStatus $paymentStatus)
    {
        try {
            $this->sdk->updatePaymentStatus($paymentStatus);
        } catch (\Exception $e) {
            // if sn is not available, proceed without exception
        }
    }
}


Issues (258)

Security Analysis not enabled

Subscribers/Lifecycle.php (9 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

1. Missing dependencies

2. Missing use statement

1. Missing dependencies

2. Missing use statement

1. Missing dependencies

2. Missing use statement

1. Missing dependencies

2. Missing use statement

1. Missing dependencies

2. Missing use statement

shopware / SwagConnect

Issues (258)

Security Analysis not enabled

Subscribers/Lifecycle.php (9 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

1. Missing dependencies

2. Missing use statement

1. Missing dependencies

2. Missing use statement

1. Missing dependencies

2. Missing use statement

1. Missing dependencies

2. Missing use statement

1. Missing dependencies

2. Missing use statement

Duplication Side-by-Side

Filter issues like