Issues (621)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

code/dataobjects/WorkflowActionInstance.php (4 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * A workflow action attached to a {@link WorkflowInstance} that has been run,
4
 * and is either currently running, or has finished.
5
 *
6
 * Each step of the workflow has one of these created for it - it refers back
7
 * to the original action definition, but is unique for each step of the
8
 * workflow to ensure re-entrant behaviour.
9
 *
10
 * @license BSD License (http://silverstripe.org/bsd-license/)
11
 * @package advancedworkflow
12
 */
13
class WorkflowActionInstance extends DataObject {
14
15
	private static $db = array(
16
		'Comment'  => 'Text',
17
		'Finished' => 'Boolean'
18
	);
19
20
	private static $has_one = array(
21
		'Workflow'   => 'WorkflowInstance',
22
		'BaseAction' => 'WorkflowAction',
23
		'Member'     => 'Member'
24
	);
25
26
	private static $summary_fields = array(
27
		'BaseAction.Title',
28
		'Comment',
29
		'Created',
30
		'Member.Name',
31
	);
32
33
	public function fieldLabels($includerelations = true) {
34
		$labels = parent::fieldLabels($includerelations);
35
		$labels['BaseAction.Title'] = _t('WorkflowActionInstance.Title', 'Title');
36
		$labels['Comment'] = _t('WorkflowAction.CommentLabel', 'Comment');
37
		$labels['Member.Name'] = _t('WorkflowAction.Author', 'Author');
38
		$labels['Finished'] = _t('WorkflowAction.FinishedLabel', 'Finished');
39
		$labels['BaseAction.Title'] = _t('WorkflowAction.TITLE', 'Title');
40
41
		return $labels;
42
	}
43
44
	/**
45
	 * Gets fields for when this is part of an active workflow
46
	 */
47
	public function updateWorkflowFields($fields) {
48
		if ($this->BaseAction()->AllowCommenting) {
49
			$fields->push(new TextareaField('Comment', _t('WorkflowAction.COMMENT', 'Comment')));
50
		}
51
	}
52
53
	public function updateFrontendWorkflowFields($fields){
54
		if ($this->BaseAction()->AllowCommenting) {
55
			$fields->push(new TextareaField('WorkflowActionInstanceComment', _t('WorkflowAction.FRONTENDCOMMENT', 'Comment')));
56
		}
57
58
		$ba = $this->BaseAction();
59
		$fields = $ba->updateFrontendWorkflowFields($fields, $this->Workflow());
60
	}
61
62
	/**
63
	 * Gets Front-End DataObject
64
	 *
65
	 * Use the DataObject as defined in the WorkflowAction, otherwise fall back to the
66
	 * context object.
67
	 *
68
	 * Useful for situations where front end workflow deals with multiple data objects
69
	 *
70
	 * @return DataObject
71
	 */
72
	public function getFrontEndDataObject() {
73
		$obj = null;
74
		$ba = $this->BaseAction();
75
76
		if ($ba->hasMethod('getFrontEndDataObject')) {
77
			$obj = $ba->getFrontEndDataObject();
78
		} else {
79
			$obj = $this->Workflow()->getTarget();
80
		}
81
82
		return $obj;
83
	}
84
85
	public function updateFrontEndWorkflowActions($actions) {
86
		$ba = $this->BaseAction();
87
88
		if ($ba->hasMethod('updateFrontEndWorkflowActions')) {
89
			$ba->updateFrontEndWorkflowActions($actions);
90
		}
91
	}
92
93
	public function getRequiredFields() {
94
		$validator = null;
95
		$ba = $this->BaseAction();
96
97
		if ($ba->hasMethod('getRequiredFields')) {
98
			$validator = $ba->getRequiredFields();
99
		}
100
101
		return $validator;
102
	}
103
104
	public function setFrontendFormRequirements() {
105
		$ba = $this->BaseAction();
106
107
		if ($ba->hasMethod('setFrontendFormRequirements')) {
108
			$ba->setFrontendFormRequirements();
109
		}
110
	}
111
112
	public function doFrontEndAction(array $data, Form $form, SS_HTTPRequest $request) {
113
		//Save Front End Workflow notes, then hand over to Workflow Action
114
		if (isset($data["WorkflowActionInstanceComment"])) {
115
			$this->Comment = $data["WorkflowActionInstanceComment"];
116
			$this->write();
117
		}
118
119
		$ba = $this->BaseAction();
120
		if ($ba->hasMethod('doFrontEndAction')) {
121
			$ba->doFrontEndAction($data, $form, $request);
122
		}
123
	}
124
125
126
	/**
127
	 * Gets the title of this active action instance
128
	 *
129
	 * @return string
130
	 */
131
	public function getTitle() {
132
		return $this->BaseAction()->Title;
133
	}
134
135
	/**
136
	 * Returns all the valid transitions that lead out from this action.
137
	 *
138
	 * This is called if this action has finished, and the workflow engine wants
139
	 * to run the next action.
140
	 *
141
	 * If this action returns only one valid transition it will be immediately
142
	 * followed; otherwise the user will decide which transition to follow.
143
	 *
144
	 * @return ArrayList
145
	 */
146
	public function getValidTransitions() {
147
		$available = $this->BaseAction()->Transitions();
148
		$valid     = new ArrayList();
149
150
		// iterate through the transitions and see if they're valid for the current state of the item being
151
		// workflowed
152
		if($available) foreach($available as $transition) {
153
			if($transition->isValid($this->Workflow())) $valid->push($transition);
154
		}
155
156
		return $valid;
157
	}
158
159
	/**
160
	 * Called when this instance is started within the workflow
161
	 */
162
	public function actionStart(WorkflowTransition $transition) {
163
		$this->extend('onActionStart', $transition);
164
	}
165
166
	/**
167
	 * Called when this action has been completed within the workflow
168
	 */
169
	public function actionComplete(WorkflowTransition $transition) {
170
		$this->MemberID = Member::currentUserID();
171
		$this->write();
172
		$this->extend('onActionComplete', $transition);
173
	}
174
175
176
	/**
177
	 * Can documents in the current workflow state be edited?
178
	 *
179
	 * @param  DataObject $target
180
	 * @return bool
181
	 */
182
	public function canEditTarget(DataObject $target) {
183
		$absolute = $this->BaseAction()->canEditTarget($target);
184
		if (!is_null($absolute)) {
185
			return $absolute;
186
		}
187
		switch ($this->BaseAction()->AllowEditing) {
188
			case 'By Assignees':
189
				return $this->Workflow()->canEdit();
190
			case 'No':
191
				return false;
192
			case 'Content Settings':
193
			default:
194
				return null;
195
		}
196
	}
197
198
	/**
199
	 * Does this action restrict viewing of the document?
200
	 *
201
	 * @param  DataObject $target
202
	 * @return bool
203
	 */
204
	public function canViewTarget(DataObject $target) {
205
		return $this->BaseAction()->canViewTarget($target);
206
	}
207
208
	/**
209
	 * Does this action restrict the publishing of a document?
210
	 *
211
	 * @param  DataObject $target
212
	 * @return bool
213
	 */
214
	public function canPublishTarget(DataObject $target) {
215
		$absolute = $this->BaseAction()->canPublishTarget($target);
0 ignored issues
show
Documentation Bug introduced by
The method BaseAction does not exist on object<WorkflowActionInstance>? Since you implemented __call, maybe consider adding a @method annotation.

If you implement __call and you know which methods are available, you can improve IDE auto-completion and static analysis by adding a @method annotation to the class.

This is often the case, when __call is implemented by a parent class and only the child class knows which methods exist:

class ParentClass {
    private $data = array();

    public function __call($method, array $args) {
        if (0 === strpos($method, 'get')) {
            return $this->data[strtolower(substr($method, 3))];
        }

        throw new \LogicException(sprintf('Unsupported method: %s', $method));
    }
}

/**
 * If this class knows which fields exist, you can specify the methods here:
 *
 * @method string getName()
 */
class SomeClass extends ParentClass { }
Loading history...
216
		if (!is_null($absolute)) {
217
			return $absolute;
218
		}
219
		return false;
220
	}
221
222
	public function canView($member = null) {
223
		return $this->Workflow()->canView($member);
0 ignored issues
show
The method Workflow() does not exist on WorkflowActionInstance. Did you maybe mean updateWorkflowFields()?

This check marks calls to methods that do not seem to exist on an object.

This is most likely the result of a method being renamed without all references to it being renamed likewise.

Loading history...
224
	}
225
226
	public function canEdit($member = null) {
227
		return $this->Workflow()->canEdit($member);
0 ignored issues
show
The method Workflow() does not exist on WorkflowActionInstance. Did you maybe mean updateWorkflowFields()?

This check marks calls to methods that do not seem to exist on an object.

This is most likely the result of a method being renamed without all references to it being renamed likewise.

Loading history...
228
	}
229
230
	public function canDelete($member = null) {
231
		return $this->Workflow()->canDelete($member);
0 ignored issues
show
The method Workflow() does not exist on WorkflowActionInstance. Did you maybe mean updateWorkflowFields()?

This check marks calls to methods that do not seem to exist on an object.

This is most likely the result of a method being renamed without all references to it being renamed likewise.

Loading history...
232
	}
233
}