This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * @description: adds a few functions to SiteTree to give each page |
||
5 | * some e-commerce related functionality. |
||
6 | * |
||
7 | * |
||
8 | * |
||
9 | * @authors: Nicolaas [at] Sunny Side Up .co.nz |
||
10 | * @package: ecommerce |
||
11 | * @sub-package: extensions |
||
12 | * @inspiration: Silverstripe Ltd, Jeremy |
||
13 | **/ |
||
14 | class EcommerceSiteTreeExtension extends SiteTreeExtension |
||
15 | { |
||
16 | /** |
||
17 | * returns the instance of EcommerceConfigAjax for use in templates. |
||
18 | * In templates, it is used like this: |
||
19 | * $AJAXDefinitions.TableID. |
||
20 | * |
||
21 | * @return EcommerceConfigAjax |
||
0 ignored issues
–
show
|
|||
22 | **/ |
||
23 | public function AJAXDefinitions() |
||
24 | { |
||
25 | return EcommerceConfigAjax::get_one($this->owner); |
||
0 ignored issues
–
show
$this->owner of type object<SS_Object> is not a sub-type of object<DataObject> . It seems like you assume a child class of the class SS_Object to be always present.
This check looks for parameters that are defined as one type in their type hint or doc comment but seem to be used as a narrower type, i.e an implementation of an interface or a subclass. Consider changing the type of the parameter or doing an instanceof check before assuming your parameter is of the expected type. ![]() |
|||
26 | } |
||
27 | |||
28 | /** |
||
29 | * @return EcommerceDBConfig |
||
30 | **/ |
||
31 | public function EcomConfig() |
||
32 | { |
||
33 | return EcommerceDBConfig::current_ecommerce_db_config(); |
||
34 | } |
||
35 | |||
36 | /** |
||
37 | * tells us if the current page is part of e-commerce. |
||
38 | * |
||
39 | * @return bool |
||
40 | */ |
||
41 | public function IsEcommercePage() |
||
42 | { |
||
43 | return false; |
||
44 | } |
||
45 | |||
46 | /** |
||
47 | * Log in link. |
||
48 | * |
||
49 | * @return string |
||
50 | */ |
||
51 | public function EcommerceLogInLink() |
||
52 | { |
||
53 | if ($this->owner->IsEcommercePage()) { |
||
54 | $link = $this->owner->Link(); |
||
55 | } else { |
||
56 | $link = $this->EcomConfig()->AccountPageLink(); |
||
57 | } |
||
58 | |||
59 | return '/Security/login?BackURL='.urlencode($link); |
||
60 | } |
||
61 | |||
62 | public function augmentValidURLSegment() |
||
63 | { |
||
64 | if ($this->owner instanceof ProductGroup) { |
||
65 | $checkForDuplicatesURLSegments = ProductGroup::get() |
||
66 | ->filter(array('URLSegment' => $this->owner->URLSegment)) |
||
67 | ->exclude(array('ID' => $this->owner->ID)); |
||
68 | if ($checkForDuplicatesURLSegments->count() > 0) { |
||
69 | return false; |
||
70 | } |
||
71 | } |
||
72 | } |
||
73 | } |
||
74 | |||
75 | class EcommerceSiteTreeExtension_Controller extends Extension |
||
76 | { |
||
77 | /** |
||
78 | * standard SS method. |
||
79 | * Runs before the Page::init method is called. |
||
80 | */ |
||
81 | public function onBeforeInit() |
||
82 | { |
||
83 | //$this->secureHostSwitcher(); |
||
84 | |||
85 | Requirements::javascript(THIRDPARTY_DIR.'/jquery/jquery.js'); |
||
86 | //Requirements::block(THIRDPARTY_DIR."/jquery/jquery.js"); |
||
87 | //Requirements::javascript(Director::protocol()."ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js"); |
||
88 | //todo: check if we even need this (via ShoppingCartsRequirements.ss) |
||
89 | if ($this->owner->dataRecord) { |
||
90 | if (is_a($this->owner->dataRecord, Object::getCustomClass('Product')) || is_a($this->owner->dataRecord, Object::getCustomClass('ProductGroup'))) { |
||
0 ignored issues
–
show
The property
dataRecord does not seem to exist in SS_Object .
An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name. If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading. ![]() |
|||
91 | Session::set('ContinueShoppingLink', $this->owner->Link()); |
||
92 | } |
||
93 | } |
||
94 | } |
||
95 | |||
96 | /** |
||
97 | * Standard SS method. |
||
98 | * Runs after the Page::init method is called. |
||
99 | */ |
||
100 | public function onAfterInit() |
||
101 | { |
||
102 | Requirements::javascript(EcommerceConfig::get('EcommerceConfigAjax', 'cart_js_file_location')); |
||
103 | Requirements::javascript(EcommerceConfig::get('EcommerceConfigAjax', 'dialogue_js_file_location')); |
||
104 | Requirements::themedCSS('Cart', 'ecommerce'); |
||
105 | Requirements::themedCSS('jquery.colorbox', 'ecommerce'); |
||
106 | } |
||
107 | |||
108 | /** |
||
109 | * This returns a link that displays just the cart, for use in ajax calls. |
||
110 | * |
||
111 | * @see ShoppingCart::showcart |
||
112 | * It uses AjaxSimpleCart.ss to render the cart. |
||
113 | * |
||
114 | * @return string |
||
115 | **/ |
||
116 | public function SimpleCartLinkAjax() |
||
117 | { |
||
118 | return EcommerceConfig::get('ShoppingCart_Controller', 'url_segment').'/showcart/?ajax=1'; |
||
119 | } |
||
120 | |||
121 | /** |
||
122 | * returns the current order. |
||
123 | * |
||
124 | * @return Order |
||
125 | **/ |
||
126 | public function Cart() |
||
127 | { |
||
128 | return ShoppingCart::current_order(); |
||
129 | } |
||
130 | |||
131 | /** |
||
132 | * @return string (Link) |
||
133 | */ |
||
134 | public function ContinueShoppingLink() |
||
135 | { |
||
136 | $link = Session::get('ContinueShoppingLink'); |
||
137 | if (!$link) { |
||
138 | $link = Director::baseURL(); |
||
139 | } |
||
140 | |||
141 | return $link; |
||
142 | } |
||
143 | |||
144 | |||
145 | /** |
||
146 | * Is the page a secure page? |
||
147 | * |
||
148 | * @return true/false |
||
0 ignored issues
–
show
The doc-type
true/false could not be parsed: Unknown type name "true/false" at position 0. (view supported doc-types)
This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. ![]() |
|||
149 | */ |
||
150 | public function isSecurePage() |
||
151 | { |
||
152 | return $this->owner->dataRecord instanceof CartPage; |
||
0 ignored issues
–
show
The property
dataRecord does not seem to exist in SS_Object .
An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name. If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading. ![]() |
|||
153 | } |
||
154 | |||
155 | /** |
||
156 | * Redirect users if found on incorrect domain |
||
157 | * Detects if $_GET['session'] is present, sets session |
||
158 | * and redirects back to "clean URL" |
||
159 | * Both _SECURE_URL and _STANDARD_URL must be defined, |
||
160 | * and include protocol (http(s)://mydomain.com) with no trailing slash. |
||
161 | * protected function secureHostSwitcher() |
||
162 | * { |
||
163 | * if (!DEFINED('_SECURE_URL') || !DEFINED('_STANDARD_URL')) { |
||
164 | * return false; |
||
165 | * } |
||
166 | * |
||
167 | * $protocol = Director::is_https() ? 'https://' : 'http://'; |
||
168 | * $currentUrlFull = $protocol.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']; |
||
169 | * list($currentUrlFull) = explode('#', $currentUrlFull); |
||
170 | * $currentUrlWithoutHost = $_SERVER['REQUEST_URI']; |
||
171 | * //remove fragment...just to keep it simple... |
||
172 | * list($currentUrlWithoutHost) = explode('#', $currentUrlWithoutHost); |
||
173 | * $sessionPartOfURL = ''; |
||
174 | * $sessionID = session_id(); |
||
175 | * if ($sessionID) { |
||
176 | * if (strpos($currentUrlWithoutHost, '?')) { |
||
177 | * $sessionPartOfURL .= '&'; |
||
178 | * } else { |
||
179 | * $sessionPartOfURL = '?'; |
||
180 | * } |
||
181 | * $sessionPartOfURL .= 'session='.$sessionID; |
||
182 | * $currentUrlWithoutHost .= $sessionPartOfURL; |
||
183 | * } |
||
184 | * |
||
185 | * $isSecure = $this->owner->isSecurePage(); |
||
186 | * |
||
187 | * if ($isSecure && !preg_match('/^'.preg_quote(_SECURE_URL, '/').'/', $currentUrlFull)) { |
||
188 | * return $this->owner->redirect(_SECURE_URL.$currentUrlWithoutHost); |
||
189 | * } elseif (!$isSecure && !preg_match('/^'.preg_quote(_STANDARD_URL, '/').'/', $currentUrlFull)) { |
||
190 | * return $this->owner->redirect(_STANDARD_URL.$currentUrlWithoutHost); |
||
191 | * } |
||
192 | * |
||
193 | * if ($sessionID = $this->owner->request->getVar('session')) { |
||
194 | * $currentUrlFull = str_replace('?session='.$sessionID, '', $currentUrlFull); |
||
195 | * $currentUrlFull = str_replace('&session='.$sessionID, '', $currentUrlFull); |
||
196 | * // force hard-coded session setting |
||
197 | * @session_write_close(); |
||
198 | * @session_id($sessionID); |
||
199 | * @session_start(); |
||
200 | * header('location: '.$currentUrlFull, 302); |
||
201 | * exit; |
||
202 | * } |
||
203 | *} |
||
204 | */ |
||
205 | } |
||
206 |
This check compares the return type specified in the
@return
annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.