This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace SilverStripe\SiteConfig; |
||
4 | |||
5 | use SilverStripe\Admin\LeftAndMain; |
||
6 | use SilverStripe\CMS\Model\SiteTree; |
||
7 | use SilverStripe\Control\Director; |
||
8 | use SilverStripe\Forms\Form; |
||
9 | use SilverStripe\Forms\FormAction; |
||
10 | use SilverStripe\Forms\HiddenField; |
||
11 | use SilverStripe\Forms\LiteralField; |
||
12 | use SilverStripe\ORM\ArrayList; |
||
13 | use SilverStripe\ORM\DataObject; |
||
14 | use SilverStripe\ORM\ValidationResult; |
||
15 | use SilverStripe\View\ArrayData; |
||
16 | use SilverStripe\View\Requirements; |
||
17 | |||
18 | class SiteConfigLeftAndMain extends LeftAndMain |
||
19 | { |
||
20 | /** |
||
21 | * @var string |
||
22 | */ |
||
23 | private static $url_segment = 'settings'; |
||
24 | |||
25 | /** |
||
26 | * @var string |
||
27 | */ |
||
28 | private static $url_rule = '/$Action/$ID/$OtherID'; |
||
29 | |||
30 | /** |
||
31 | * @var int |
||
32 | */ |
||
33 | private static $menu_priority = -1; |
||
34 | |||
35 | /** |
||
36 | * @var string |
||
37 | */ |
||
38 | private static $menu_title = 'Settings'; |
||
39 | |||
40 | /** |
||
41 | * @var string |
||
42 | */ |
||
43 | private static $menu_icon_class = 'font-icon-cog'; |
||
44 | |||
45 | /** |
||
46 | * @var string |
||
47 | */ |
||
48 | private static $tree_class = SiteConfig::class; |
||
49 | |||
50 | /** |
||
51 | * @var array |
||
52 | */ |
||
53 | private static $required_permission_codes = array('EDIT_SITECONFIG'); |
||
54 | |||
55 | /** |
||
56 | * Initialises the {@link SiteConfig} controller. |
||
57 | */ |
||
58 | public function init() |
||
59 | { |
||
60 | parent::init(); |
||
61 | if (class_exists(SiteTree::class)) { |
||
62 | Requirements::javascript('silverstripe/cms: client/dist/js/bundle.js'); |
||
63 | } |
||
64 | } |
||
65 | |||
66 | /** |
||
67 | * @param null $id Not used. |
||
68 | * @param null $fields Not used. |
||
69 | * |
||
70 | * @return Form |
||
71 | */ |
||
72 | public function getEditForm($id = null, $fields = null) |
||
73 | { |
||
74 | $siteConfig = SiteConfig::current_site_config(); |
||
75 | $fields = $siteConfig->getCMSFields(); |
||
76 | |||
77 | // Tell the CMS what URL the preview should show |
||
78 | $home = Director::absoluteBaseURL(); |
||
79 | $fields->push(new HiddenField('PreviewURL', 'Preview URL', $home)); |
||
80 | |||
81 | // Added in-line to the form, but plucked into different view by LeftAndMain.Preview.js upon load |
||
82 | /** @skipUpgrade */ |
||
83 | $fields->push($navField = new LiteralField('SilverStripeNavigator', $this->getSilverStripeNavigator())); |
||
84 | $navField->setAllowHTML(true); |
||
85 | |||
86 | // Retrieve validator, if one has been setup (e.g. via data extensions). |
||
87 | if ($siteConfig->hasMethod("getCMSValidator")) { |
||
88 | $validator = $siteConfig->getCMSValidator(); |
||
89 | } else { |
||
90 | $validator = null; |
||
91 | } |
||
92 | |||
93 | $actions = $siteConfig->getCMSActions(); |
||
94 | $negotiator = $this->getResponseNegotiator(); |
||
95 | /** @var Form $form */ |
||
96 | $form = Form::create( |
||
97 | $this, |
||
98 | 'EditForm', |
||
99 | $fields, |
||
100 | $actions, |
||
101 | $validator |
||
102 | )->setHTMLID('Form_EditForm'); |
||
103 | $form->setValidationResponseCallback(function (ValidationResult $errors) use ($negotiator, $form) { |
||
104 | $request = $this->getRequest(); |
||
105 | if ($request->isAjax() && $negotiator) { |
||
106 | $result = $form->forTemplate(); |
||
107 | return $negotiator->respond($request, array( |
||
108 | 'CurrentForm' => function () use ($result) { |
||
109 | return $result; |
||
110 | } |
||
111 | )); |
||
112 | } |
||
113 | }); |
||
114 | $form->addExtraClass('flexbox-area-grow fill-height cms-content cms-edit-form'); |
||
115 | $form->setAttribute('data-pjax-fragment', 'CurrentForm'); |
||
116 | |||
117 | if ($form->Fields()->hasTabSet()) { |
||
118 | $form->Fields()->findOrMakeTab('Root')->setTemplate('SilverStripe\\Forms\\CMSTabSet'); |
||
119 | } |
||
120 | $form->setHTMLID('Form_EditForm'); |
||
121 | $form->loadDataFrom($siteConfig); |
||
122 | $form->setTemplate($this->getTemplatesWithSuffix('_EditForm')); |
||
123 | |||
124 | // Use <button> to allow full jQuery UI styling |
||
125 | $actions = $actions->dataFields(); |
||
126 | if ($actions) { |
||
0 ignored issues
–
show
|
|||
127 | /** @var FormAction $action */ |
||
128 | foreach ($actions as $action) { |
||
129 | $action->setUseButtonTag(true); |
||
130 | } |
||
131 | } |
||
132 | |||
133 | $this->extend('updateEditForm', $form); |
||
134 | |||
135 | return $form; |
||
136 | } |
||
137 | |||
138 | /** |
||
139 | * Save the current sites {@link SiteConfig} into the database. |
||
140 | * |
||
141 | * @param array $data |
||
142 | * @param Form $form |
||
143 | * @return String |
||
144 | */ |
||
145 | public function save_siteconfig($data, $form) |
||
0 ignored issues
–
show
|
|||
146 | { |
||
147 | $data = $form->getData(); |
||
148 | $siteConfig = DataObject::get_one(SiteConfig::class, ['ID' => $data['ID']]); |
||
149 | $form->saveInto($siteConfig); |
||
150 | $siteConfig->write(); |
||
151 | $this->response->addHeader('X-Status', rawurlencode(_t(LeftAndMain::class . '.SAVEDUP', 'Saved.'))); |
||
152 | return $form->forTemplate(); |
||
153 | } |
||
154 | |||
155 | |||
156 | public function Breadcrumbs($unlinked = false) |
||
157 | { |
||
158 | return new ArrayList(array( |
||
159 | new ArrayData(array( |
||
160 | 'Title' => static::menu_title(), |
||
161 | 'Link' => $this->Link() |
||
162 | )) |
||
163 | )); |
||
164 | } |
||
165 | } |
||
166 |
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.
Consider making the comparison explicit by using
empty(..)
or! empty(...)
instead.