This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace Spatie\Activitylog; |
||
| 4 | |||
| 5 | use Illuminate\Auth\AuthManager; |
||
| 6 | use Illuminate\Contracts\Config\Repository; |
||
| 7 | use Illuminate\Database\Eloquent\Model; |
||
| 8 | use Illuminate\Support\Arr; |
||
| 9 | use Illuminate\Support\Carbon; |
||
| 10 | use Illuminate\Support\Str; |
||
| 11 | use Illuminate\Support\Traits\Macroable; |
||
| 12 | use Spatie\Activitylog\Contracts\Activity as ActivityContract; |
||
| 13 | use Spatie\Activitylog\Exceptions\CouldNotLogActivity; |
||
| 14 | |||
| 15 | class ActivityLogger |
||
| 16 | { |
||
| 17 | use Macroable; |
||
| 18 | |||
| 19 | /** @var \Illuminate\Auth\AuthManager */ |
||
| 20 | protected $auth; |
||
| 21 | |||
| 22 | protected $defaultLogName = ''; |
||
| 23 | |||
| 24 | /** @var string */ |
||
| 25 | protected $authDriver; |
||
| 26 | |||
| 27 | /** @var \Spatie\Activitylog\ActivityLogStatus */ |
||
| 28 | protected $logStatus; |
||
| 29 | |||
| 30 | /** @var \Spatie\Activitylog\Contracts\Activity */ |
||
| 31 | protected $activity; |
||
| 32 | 340 | ||
| 33 | public function __construct(AuthManager $auth, Repository $config, ActivityLogStatus $logStatus) |
||
| 34 | 340 | { |
|
| 35 | $this->auth = $auth; |
||
| 36 | 340 | ||
| 37 | $this->authDriver = $config['activitylog']['default_auth_driver'] ?? $auth->getDefaultDriver(); |
||
| 38 | 340 | ||
| 39 | $this->defaultLogName = $config['activitylog']['default_log_name']; |
||
| 40 | 340 | ||
| 41 | 340 | $this->logStatus = $logStatus; |
|
| 42 | } |
||
| 43 | 132 | ||
| 44 | public function setLogStatus(ActivityLogStatus $logStatus) |
||
| 45 | 132 | { |
|
| 46 | $this->logStatus = $logStatus; |
||
| 47 | 132 | ||
| 48 | return $this; |
||
| 49 | } |
||
| 50 | 232 | ||
| 51 | public function performedOn(Model $model) |
||
| 52 | 232 | { |
|
| 53 | $this->getActivity()->subject()->associate($model); |
||
| 54 | 232 | ||
| 55 | return $this; |
||
| 56 | } |
||
| 57 | 16 | ||
| 58 | public function on(Model $model) |
||
| 59 | 16 | { |
|
| 60 | return $this->performedOn($model); |
||
| 61 | } |
||
| 62 | 340 | ||
| 63 | public function causedBy($modelOrId) |
||
| 64 | 340 | { |
|
| 65 | 332 | if ($modelOrId === null) { |
|
| 66 | return $this; |
||
| 67 | } |
||
| 68 | 44 | ||
| 69 | $model = $this->normalizeCauser($modelOrId); |
||
| 70 | 44 | ||
| 71 | $this->getActivity()->causer()->associate($model); |
||
| 72 | 44 | ||
| 73 | return $this; |
||
| 74 | } |
||
| 75 | 20 | ||
| 76 | public function by($modelOrId) |
||
| 77 | 20 | { |
|
| 78 | return $this->causedBy($modelOrId); |
||
| 79 | } |
||
| 80 | 8 | ||
| 81 | public function causedByAnonymous() |
||
| 82 | 8 | { |
|
| 83 | 8 | $this->activity->causer_id = null; |
|
|
0 ignored issues
–
show
|
|||
| 84 | $this->activity->causer_type = null; |
||
|
0 ignored issues
–
show
Accessing
causer_type on the interface Spatie\Activitylog\Contracts\Activity suggest that you code against a concrete implementation. How about adding an instanceof check?
If you access a property on an interface, you most likely code against a concrete implementation of the interface. Available Fixes
Loading history...
|
|||
| 85 | 8 | ||
| 86 | return $this; |
||
| 87 | } |
||
| 88 | 4 | ||
| 89 | public function byAnonymous() |
||
| 90 | 4 | { |
|
| 91 | return $this->causedByAnonymous(); |
||
| 92 | } |
||
| 93 | 340 | ||
| 94 | public function withProperties($properties) |
||
| 95 | 340 | { |
|
| 96 | $this->getActivity()->properties = collect($properties); |
||
| 97 | 340 | ||
| 98 | return $this; |
||
| 99 | } |
||
| 100 | 4 | ||
| 101 | public function withProperty(string $key, $value) |
||
| 102 | 4 | { |
|
| 103 | $this->getActivity()->properties = $this->getActivity()->properties->put($key, $value); |
||
| 104 | 4 | ||
| 105 | return $this; |
||
| 106 | } |
||
| 107 | 340 | ||
| 108 | public function createdAt(Carbon $dateTime) |
||
| 109 | 340 | { |
|
| 110 | $this->getActivity()->created_at = $dateTime; |
||
| 111 | 340 | ||
| 112 | return $this; |
||
| 113 | } |
||
| 114 | |||
| 115 | public function useLog(string $logName) |
||
| 116 | { |
||
| 117 | $this->getActivity()->log_name = $logName; |
||
| 118 | |||
| 119 | 12 | return $this; |
|
| 120 | } |
||
| 121 | 12 | ||
| 122 | public function inLog(string $logName) |
||
| 123 | 12 | { |
|
| 124 | return $this->useLog($logName); |
||
| 125 | } |
||
| 126 | 4 | ||
| 127 | public function tap(callable $callback, string $eventName = null) |
||
| 128 | 4 | { |
|
| 129 | call_user_func($callback, $this->getActivity(), $eventName); |
||
| 130 | 4 | ||
| 131 | return $this; |
||
| 132 | } |
||
| 133 | 4 | ||
| 134 | public function enableLogging() |
||
| 135 | 4 | { |
|
| 136 | $this->logStatus->enable(); |
||
| 137 | 4 | ||
| 138 | return $this; |
||
| 139 | } |
||
| 140 | 340 | ||
| 141 | public function disableLogging() |
||
| 142 | 340 | { |
|
| 143 | 8 | $this->logStatus->disable(); |
|
| 144 | |||
| 145 | return $this; |
||
| 146 | 332 | } |
|
| 147 | |||
| 148 | 332 | public function log(string $description) |
|
| 149 | 332 | { |
|
| 150 | 83 | if ($this->logStatus->disabled()) { |
|
| 151 | return; |
||
| 152 | } |
||
| 153 | 332 | ||
| 154 | $activity = $this->activity; |
||
| 155 | 332 | ||
| 156 | $activity->description = $this->replacePlaceholders( |
||
| 157 | 332 | $activity->description ?? $description, |
|
| 158 | $activity |
||
| 159 | ); |
||
| 160 | 44 | ||
| 161 | $activity->save(); |
||
| 162 | 44 | ||
| 163 | 40 | $this->activity = null; |
|
| 164 | |||
| 165 | return $activity; |
||
| 166 | 4 | } |
|
| 167 | 4 | ||
| 168 | 4 | public function withoutLogs(callable $callback) |
|
| 169 | { |
||
| 170 | 4 | if ($this->logStatus->disabled()) { |
|
| 171 | 4 | return $callback(); |
|
| 172 | } |
||
| 173 | |||
| 174 | $this->logStatus->disable(); |
||
| 175 | |||
| 176 | try { |
||
| 177 | 332 | return $callback(); |
|
| 178 | } finally { |
||
| 179 | $this->logStatus->enable(); |
||
| 180 | 12 | } |
|
| 181 | } |
||
| 182 | 12 | ||
| 183 | protected function normalizeCauser($modelOrId): Model |
||
| 184 | 12 | { |
|
| 185 | 4 | if ($modelOrId instanceof Model) { |
|
| 186 | return $modelOrId; |
||
| 187 | } |
||
| 188 | 8 | ||
| 189 | $guard = $this->auth->guard($this->authDriver); |
||
| 190 | 8 | $provider = method_exists($guard, 'getProvider') ? $guard->getProvider() : null; |
|
| 191 | $model = method_exists($provider, 'retrieveById') ? $provider->retrieveById($modelOrId) : null; |
||
| 192 | 8 | ||
| 193 | 4 | if ($model instanceof Model) { |
|
| 194 | return $model; |
||
| 195 | } |
||
| 196 | 4 | ||
| 197 | throw CouldNotLogActivity::couldNotDetermineUser($modelOrId); |
||
| 198 | 4 | } |
|
| 199 | 332 | ||
| 200 | protected function replacePlaceholders(string $description, ActivityContract $activity): string |
||
| 201 | { |
||
| 202 | 340 | return preg_replace_callback('/:[a-z0-9._-]+/i', function ($match) use ($activity) { |
|
| 203 | $match = $match[0]; |
||
| 204 | 340 | ||
| 205 | 340 | $attribute = Str::before(Str::after($match, ':'), '.'); |
|
| 206 | |||
| 207 | 340 | if (! in_array($attribute, ['subject', 'causer', 'properties'])) { |
|
| 208 | 340 | return $match; |
|
| 209 | 340 | } |
|
| 210 | |||
| 211 | $propertyName = substr($match, strpos($match, '.') + 1); |
||
| 212 | 340 | ||
| 213 | $attributeValue = $activity->$attribute; |
||
| 214 | |||
| 215 | if (is_null($attributeValue)) { |
||
| 216 | return $match; |
||
| 217 | } |
||
| 218 | |||
| 219 | $attributeValue = $attributeValue->toArray(); |
||
| 220 | |||
| 221 | return Arr::get($attributeValue, $propertyName, $match); |
||
| 222 | }, $description); |
||
| 223 | } |
||
| 224 | |||
| 225 | protected function getActivity(): ActivityContract |
||
| 226 | { |
||
| 227 | if (! $this->activity instanceof ActivityContract) { |
||
| 228 | $this->activity = ActivitylogServiceProvider::getActivityModelInstance(); |
||
| 229 | $this |
||
| 230 | ->useLog($this->defaultLogName) |
||
| 231 | ->withProperties([]) |
||
| 232 | ->causedBy($this->auth->guard($this->authDriver)->user()); |
||
| 233 | } |
||
| 234 | |||
| 235 | return $this->activity; |
||
| 236 | } |
||
| 237 | } |
||
| 238 |
If you access a property on an interface, you most likely code against a concrete implementation of the interface.
Available Fixes
Adding an additional type check:
Changing the type hint: