This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace SilverStripe\SiteConfig; |
||
4 | |||
5 | use SilverStripe\Admin\LeftAndMain; |
||
6 | use SilverStripe\CMS\Model\SiteTree; |
||
7 | use SilverStripe\Control\Director; |
||
8 | use SilverStripe\Forms\Form; |
||
9 | use SilverStripe\Forms\FormAction; |
||
10 | use SilverStripe\Forms\HiddenField; |
||
11 | use SilverStripe\Forms\LiteralField; |
||
12 | use SilverStripe\ORM\ArrayList; |
||
13 | use SilverStripe\ORM\DataObject; |
||
14 | use SilverStripe\ORM\ValidationResult; |
||
15 | use SilverStripe\View\ArrayData; |
||
16 | use SilverStripe\View\Requirements; |
||
17 | |||
18 | class SiteConfigLeftAndMain extends LeftAndMain |
||
19 | { |
||
20 | /** |
||
21 | * @var string |
||
22 | */ |
||
23 | private static $url_segment = 'settings'; |
||
0 ignored issues
–
show
Comprehensibility
introduced
by
![]() |
|||
24 | |||
25 | /** |
||
26 | * @var string |
||
27 | */ |
||
28 | private static $url_rule = '/$Action/$ID/$OtherID'; |
||
0 ignored issues
–
show
|
|||
29 | |||
30 | /** |
||
31 | * @var int |
||
32 | */ |
||
33 | private static $menu_priority = -1; |
||
0 ignored issues
–
show
|
|||
34 | |||
35 | /** |
||
36 | * @var string |
||
37 | */ |
||
38 | private static $menu_title = 'Settings'; |
||
0 ignored issues
–
show
|
|||
39 | |||
40 | /** |
||
41 | * @var string |
||
42 | */ |
||
43 | private static $menu_icon_class = 'font-icon-cog'; |
||
0 ignored issues
–
show
|
|||
44 | |||
45 | /** |
||
46 | * @var string |
||
47 | */ |
||
48 | private static $tree_class = SiteConfig::class; |
||
0 ignored issues
–
show
|
|||
49 | |||
50 | /** |
||
51 | * @var array |
||
52 | */ |
||
53 | private static $required_permission_codes = array('EDIT_SITECONFIG'); |
||
0 ignored issues
–
show
|
|||
54 | |||
55 | /** |
||
56 | * Initialises the {@link SiteConfig} controller. |
||
57 | */ |
||
58 | public function init() |
||
59 | { |
||
60 | parent::init(); |
||
61 | if (class_exists(SiteTree::class)) { |
||
62 | Requirements::javascript('silverstripe/cms: client/dist/js/bundle.js'); |
||
63 | } |
||
64 | } |
||
65 | |||
66 | /** |
||
67 | * @param null $id Not used. |
||
68 | * @param null $fields Not used. |
||
69 | * |
||
70 | * @return Form |
||
71 | */ |
||
72 | public function getEditForm($id = null, $fields = null) |
||
73 | { |
||
74 | $siteConfig = SiteConfig::current_site_config(); |
||
75 | $fields = $siteConfig->getCMSFields(); |
||
76 | |||
77 | // Tell the CMS what URL the preview should show |
||
78 | $home = Director::absoluteBaseURL(); |
||
79 | $fields->push(new HiddenField('PreviewURL', 'Preview URL', $home)); |
||
80 | |||
81 | // Added in-line to the form, but plucked into different view by LeftAndMain.Preview.js upon load |
||
82 | /** @skipUpgrade */ |
||
83 | $fields->push($navField = new LiteralField('SilverStripeNavigator', $this->getSilverStripeNavigator())); |
||
84 | $navField->setAllowHTML(true); |
||
85 | |||
86 | // Retrieve validator, if one has been setup (e.g. via data extensions). |
||
87 | if ($siteConfig->hasMethod("getCMSValidator")) { |
||
88 | $validator = $siteConfig->getCMSValidator(); |
||
0 ignored issues
–
show
The method
getCMSValidator does not exist on object<SilverStripe\SiteConfig\SiteConfig> ? Since you implemented __call , maybe consider adding a @method annotation.
If you implement This is often the case, when class ParentClass {
private $data = array();
public function __call($method, array $args) {
if (0 === strpos($method, 'get')) {
return $this->data[strtolower(substr($method, 3))];
}
throw new \LogicException(sprintf('Unsupported method: %s', $method));
}
}
/**
* If this class knows which fields exist, you can specify the methods here:
*
* @method string getName()
*/
class SomeClass extends ParentClass { }
![]() |
|||
89 | } else { |
||
90 | $validator = null; |
||
91 | } |
||
92 | |||
93 | $actions = $siteConfig->getCMSActions(); |
||
94 | $negotiator = $this->getResponseNegotiator(); |
||
95 | /** @var Form $form */ |
||
96 | $form = Form::create( |
||
97 | $this, |
||
98 | 'EditForm', |
||
99 | $fields, |
||
100 | $actions, |
||
101 | $validator |
||
102 | )->setHTMLID('Form_EditForm'); |
||
103 | $form->setValidationResponseCallback(function (ValidationResult $errors) use ($negotiator, $form) { |
||
0 ignored issues
–
show
|
|||
104 | $request = $this->getRequest(); |
||
105 | if ($request->isAjax() && $negotiator) { |
||
106 | $result = $form->forTemplate(); |
||
107 | return $negotiator->respond($request, array( |
||
108 | 'CurrentForm' => function () use ($result) { |
||
109 | return $result; |
||
110 | } |
||
111 | )); |
||
112 | } |
||
113 | }); |
||
114 | $form->addExtraClass('flexbox-area-grow fill-height cms-content cms-edit-form'); |
||
115 | $form->setAttribute('data-pjax-fragment', 'CurrentForm'); |
||
116 | |||
117 | if ($form->Fields()->hasTabSet()) { |
||
118 | $form->Fields()->findOrMakeTab('Root')->setTemplate('SilverStripe\\Forms\\CMSTabSet'); |
||
119 | } |
||
120 | $form->setHTMLID('Form_EditForm'); |
||
121 | $form->loadDataFrom($siteConfig); |
||
122 | $form->setTemplate($this->getTemplatesWithSuffix('_EditForm')); |
||
0 ignored issues
–
show
It seems like
$this->getTemplatesWithSuffix('_EditForm') targeting SilverStripe\Admin\LeftA...etTemplatesWithSuffix() can also be of type array ; however, SilverStripe\Forms\Form::setTemplate() does only seem to accept string , maybe add an additional type check?
This check looks at variables that are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. ![]() |
|||
123 | |||
124 | // Use <button> to allow full jQuery UI styling |
||
125 | $actions = $actions->dataFields(); |
||
126 | if ($actions) { |
||
0 ignored issues
–
show
The expression
$actions of type SilverStripe\Forms\FormField[] is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using ![]() |
|||
127 | /** @var FormAction $action */ |
||
128 | foreach ($actions as $action) { |
||
129 | $action->setUseButtonTag(true); |
||
130 | } |
||
131 | } |
||
132 | |||
133 | $this->extend('updateEditForm', $form); |
||
134 | |||
135 | return $form; |
||
136 | } |
||
137 | |||
138 | /** |
||
139 | * Save the current sites {@link SiteConfig} into the database. |
||
140 | * |
||
141 | * @param array $data |
||
142 | * @param Form $form |
||
143 | * @return String |
||
144 | */ |
||
145 | public function save_siteconfig($data, $form) |
||
0 ignored issues
–
show
|
|||
146 | { |
||
147 | $data = $form->getData(); |
||
148 | $siteConfig = DataObject::get_one(SiteConfig::class, ['ID' => $data['ID']]); |
||
149 | $form->saveInto($siteConfig); |
||
0 ignored issues
–
show
It seems like
$siteConfig defined by \SilverStripe\ORM\DataOb...y('ID' => $data['ID'])) on line 148 can be null ; however, SilverStripe\Forms\Form::saveInto() does not accept null , maybe add an additional type check?
Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: /** @return stdClass|null */
function mayReturnNull() { }
function doesNotAcceptNull(stdClass $x) { }
// With potential error.
function withoutCheck() {
$x = mayReturnNull();
doesNotAcceptNull($x); // Potential error here.
}
// Safe - Alternative 1
function withCheck1() {
$x = mayReturnNull();
if ( ! $x instanceof stdClass) {
throw new \LogicException('$x must be defined.');
}
doesNotAcceptNull($x);
}
// Safe - Alternative 2
function withCheck2() {
$x = mayReturnNull();
if ($x instanceof stdClass) {
doesNotAcceptNull($x);
}
}
![]() |
|||
150 | $siteConfig->write(); |
||
151 | $this->response->addHeader('X-Status', rawurlencode(_t(LeftAndMain::class . '.SAVEDUP', 'Saved.'))); |
||
152 | return $form->forTemplate(); |
||
153 | } |
||
154 | |||
155 | |||
156 | public function Breadcrumbs($unlinked = false) |
||
157 | { |
||
158 | return new ArrayList(array( |
||
159 | new ArrayData(array( |
||
160 | 'Title' => static::menu_title(), |
||
161 | 'Link' => $this->Link() |
||
162 | )) |
||
163 | )); |
||
164 | } |
||
165 | } |
||
166 |