This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace SilverStripe\SiteConfig; |
||
4 | |||
5 | use SilverStripe\Admin\LeftAndMain; |
||
6 | use SilverStripe\CMS\Model\SiteTree; |
||
7 | use SilverStripe\Control\Director; |
||
8 | use SilverStripe\Forms\Form; |
||
9 | use SilverStripe\Forms\FormAction; |
||
10 | use SilverStripe\Forms\HiddenField; |
||
11 | use SilverStripe\Forms\LiteralField; |
||
12 | use SilverStripe\ORM\ArrayList; |
||
13 | use SilverStripe\ORM\DataObject; |
||
14 | use SilverStripe\ORM\ValidationResult; |
||
15 | use SilverStripe\View\ArrayData; |
||
16 | use SilverStripe\View\Requirements; |
||
17 | |||
18 | class SiteConfigLeftAndMain extends LeftAndMain |
||
19 | { |
||
20 | /** |
||
21 | * @var string |
||
22 | */ |
||
23 | private static $url_segment = 'settings'; |
||
24 | |||
25 | /** |
||
26 | * @var string |
||
27 | */ |
||
28 | private static $url_rule = '/$Action/$ID/$OtherID'; |
||
29 | |||
30 | /** |
||
31 | * @var int |
||
32 | */ |
||
33 | private static $menu_priority = -1; |
||
34 | |||
35 | /** |
||
36 | * @var string |
||
37 | */ |
||
38 | private static $menu_title = 'Settings'; |
||
39 | |||
40 | /** |
||
41 | * @var string |
||
42 | */ |
||
43 | private static $menu_icon_class = 'font-icon-cog'; |
||
44 | |||
45 | /** |
||
46 | * @var string |
||
47 | */ |
||
48 | private static $tree_class = SiteConfig::class; |
||
49 | |||
50 | /** |
||
51 | * @var array |
||
52 | */ |
||
53 | private static $required_permission_codes = array('EDIT_SITECONFIG'); |
||
54 | |||
55 | /** |
||
56 | * Initialises the {@link SiteConfig} controller. |
||
57 | */ |
||
58 | public function init() |
||
59 | { |
||
60 | parent::init(); |
||
61 | if (class_exists(SiteTree::class)) { |
||
62 | Requirements::javascript('silverstripe/cms: client/dist/js/bundle.js'); |
||
63 | } |
||
64 | } |
||
65 | |||
66 | /** |
||
67 | * @param null $id Not used. |
||
68 | * @param null $fields Not used. |
||
69 | * |
||
70 | * @return Form |
||
71 | */ |
||
72 | public function getEditForm($id = null, $fields = null) |
||
73 | { |
||
74 | $siteConfig = SiteConfig::current_site_config(); |
||
75 | $fields = $siteConfig->getCMSFields(); |
||
76 | |||
77 | // Tell the CMS what URL the preview should show |
||
78 | $home = Director::absoluteBaseURL(); |
||
79 | $fields->push(new HiddenField('PreviewURL', 'Preview URL', $home)); |
||
80 | |||
81 | // Added in-line to the form, but plucked into different view by LeftAndMain.Preview.js upon load |
||
82 | /** @skipUpgrade */ |
||
83 | $fields->push($navField = new LiteralField('SilverStripeNavigator', $this->getSilverStripeNavigator())); |
||
84 | $navField->setAllowHTML(true); |
||
85 | |||
86 | // Retrieve validator, if one has been setup (e.g. via data extensions). |
||
87 | if ($siteConfig->hasMethod("getCMSValidator")) { |
||
88 | $validator = $siteConfig->getCMSValidator(); |
||
89 | } else { |
||
90 | $validator = null; |
||
91 | } |
||
92 | |||
93 | $actions = $siteConfig->getCMSActions(); |
||
94 | $negotiator = $this->getResponseNegotiator(); |
||
95 | /** @var Form $form */ |
||
96 | $form = Form::create( |
||
97 | $this, |
||
98 | 'EditForm', |
||
99 | $fields, |
||
100 | $actions, |
||
101 | $validator |
||
102 | )->setHTMLID('Form_EditForm'); |
||
103 | $form->setValidationResponseCallback(function (ValidationResult $errors) use ($negotiator, $form) { |
||
0 ignored issues
–
show
|
|||
104 | $request = $this->getRequest(); |
||
105 | if ($request->isAjax() && $negotiator) { |
||
106 | $result = $form->forTemplate(); |
||
107 | return $negotiator->respond($request, array( |
||
108 | 'CurrentForm' => function () use ($result) { |
||
109 | return $result; |
||
110 | } |
||
111 | )); |
||
112 | } |
||
113 | }); |
||
114 | $form->addExtraClass('flexbox-area-grow fill-height cms-content cms-edit-form'); |
||
115 | $form->setAttribute('data-pjax-fragment', 'CurrentForm'); |
||
116 | |||
117 | if ($form->Fields()->hasTabSet()) { |
||
118 | $form->Fields()->findOrMakeTab('Root')->setTemplate('SilverStripe\\Forms\\CMSTabSet'); |
||
119 | } |
||
120 | $form->setHTMLID('Form_EditForm'); |
||
121 | $form->loadDataFrom($siteConfig); |
||
122 | $form->setTemplate($this->getTemplatesWithSuffix('_EditForm')); |
||
0 ignored issues
–
show
It seems like
$this->getTemplatesWithSuffix('_EditForm') targeting SilverStripe\Admin\LeftA...etTemplatesWithSuffix() can also be of type array ; however, SilverStripe\Forms\Form::setTemplate() does only seem to accept string , maybe add an additional type check?
This check looks at variables that are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. ![]() |
|||
123 | |||
124 | // Use <button> to allow full jQuery UI styling |
||
125 | $actions = $actions->dataFields(); |
||
126 | if ($actions) { |
||
127 | /** @var FormAction $action */ |
||
128 | foreach ($actions as $action) { |
||
129 | $action->setUseButtonTag(true); |
||
130 | } |
||
131 | } |
||
132 | |||
133 | $this->extend('updateEditForm', $form); |
||
134 | |||
135 | return $form; |
||
136 | } |
||
137 | |||
138 | /** |
||
139 | * Save the current sites {@link SiteConfig} into the database. |
||
140 | * |
||
141 | * @param array $data |
||
142 | * @param Form $form |
||
143 | * @return String |
||
144 | */ |
||
145 | public function save_siteconfig($data, $form) |
||
146 | { |
||
147 | $data = $form->getData(); |
||
148 | $siteConfig = DataObject::get_one(SiteConfig::class, ['ID' => $data['ID']]); |
||
149 | $form->saveInto($siteConfig); |
||
0 ignored issues
–
show
It seems like
$siteConfig defined by \SilverStripe\ORM\DataOb...y('ID' => $data['ID'])) on line 148 can be null ; however, SilverStripe\Forms\Form::saveInto() does not accept null , maybe add an additional type check?
Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: /** @return stdClass|null */
function mayReturnNull() { }
function doesNotAcceptNull(stdClass $x) { }
// With potential error.
function withoutCheck() {
$x = mayReturnNull();
doesNotAcceptNull($x); // Potential error here.
}
// Safe - Alternative 1
function withCheck1() {
$x = mayReturnNull();
if ( ! $x instanceof stdClass) {
throw new \LogicException('$x must be defined.');
}
doesNotAcceptNull($x);
}
// Safe - Alternative 2
function withCheck2() {
$x = mayReturnNull();
if ($x instanceof stdClass) {
doesNotAcceptNull($x);
}
}
![]() |
|||
150 | $siteConfig->write(); |
||
151 | $this->response->addHeader('X-Status', rawurlencode(_t(LeftAndMain::class . '.SAVEDUP', 'Saved.'))); |
||
152 | return $form->forTemplate(); |
||
153 | } |
||
154 | |||
155 | |||
156 | public function Breadcrumbs($unlinked = false) |
||
157 | { |
||
158 | return new ArrayList(array( |
||
159 | new ArrayData(array( |
||
160 | 'Title' => static::menu_title(), |
||
161 | 'Link' => $this->Link() |
||
162 | )) |
||
163 | )); |
||
164 | } |
||
165 | } |
||
166 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.