This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * |
||
5 | *@author nicolaas [at] sunnysideup.co.nz |
||
6 | * |
||
7 | **/ |
||
8 | |||
9 | class AddToCartPage extends Page |
||
0 ignored issues
–
show
|
|||
10 | { |
||
11 | private static $icon = "ecommerce_quick_add/images/treeicons/AddToCartPage"; |
||
0 ignored issues
–
show
|
|||
12 | |||
13 | public function canCreate($member = null) |
||
14 | { |
||
15 | return AddToCartPage::get()->count() ? false : true; |
||
16 | } |
||
17 | |||
18 | private static $many_many = array( |
||
0 ignored issues
–
show
|
|||
19 | "ExcludedProductsAndGroups" => "SiteTree", |
||
20 | ); |
||
21 | } |
||
22 | |||
23 | class AddToCartPage_Controller extends Page_Controller |
||
0 ignored issues
–
show
PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions.
You can fix this by adding a namespace to your class: namespace YourVendor;
class YourClass { }
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries. ![]() |
|||
24 | { |
||
25 | private static $allowed_actions = array( |
||
0 ignored issues
–
show
|
|||
26 | "AddMemberToCartForm" => true, |
||
27 | "addmembertocartform_add" => true, |
||
28 | "QuickAddToCartForm" => true, |
||
29 | "quickaddtocartform_add" => true |
||
30 | ); |
||
31 | |||
32 | public function init() |
||
33 | { |
||
34 | parent::init(); |
||
35 | Requirements::themedCSS('Products', 'ecommerce'); |
||
36 | Requirements::themedCSS('AddToCartPage', 'ecommerce_quick_add'); |
||
37 | Requirements::javascript(THIRDPARTY_DIR."/jquery/jquery.js"); |
||
38 | //Requirements::block(THIRDPARTY_DIR."/jquery/jquery.js"); |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
56% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
39 | //Requirements::javascript(Director::protocol()."ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js"); |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
62% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
40 | Requirements::javascript(THIRDPARTY_DIR."/jquery-form/jquery.form.js"); |
||
41 | Requirements::javascript("ecommerce_quick_add/javascript/AddToCartPage.js"); |
||
42 | } |
||
43 | |||
44 | public function AddMemberToCartForm() |
||
45 | { |
||
46 | $member = Member::currentUser(); |
||
47 | $order = ShoppingCart::current_order(); |
||
48 | $currentCustomer = $order->CreateOrReturnExistingMember(false); |
||
49 | if ($member && $member->IsShopAdmin()) { |
||
50 | $fields = new FieldList( |
||
51 | new HeaderField("SelectCustomer", _t("AddToCartPage.SELECTCUSTOMER", "Select Customer")), |
||
52 | new ReadonlyField("CurrentMember", _t("AddToCartPage.CURRENTCUSTOMER", "Current"), $currentCustomer->getTitle()), |
||
53 | new DropdownField("MemberID", _t("AddToCartPage.CUSTOMER", "Change to"), EcommerceRole::list_of_customers(), $currentCustomer->ID) |
||
54 | ); |
||
55 | $actions = new FieldList( |
||
56 | new FormAction("addmembertocartform_add", _t("AddToCartPage.ADDMEMBERTOORDER", "Update customer")) |
||
57 | ); |
||
58 | $validator = new RequiredFields(array("MemberID")); |
||
59 | return new Form($this, "AddMemberToCartForm", $fields, $actions, $validator); |
||
60 | } |
||
61 | } |
||
62 | |||
63 | public function addmembertocartform_add($data, $form) |
||
64 | { |
||
65 | $member = Member::currentUser(); |
||
66 | if ($member && $member->IsShopAdmin()) { |
||
67 | $order = ShoppingCart::current_order(); |
||
68 | $member = Member::get()->byID(intval($data["MemberID"])); |
||
69 | if ($member) { |
||
70 | if ($member->ID != $order->MemberID) { |
||
71 | $order->MemberID = $member->ID; |
||
72 | $order->BillingAddressID = 0; |
||
73 | $order->ShippingAddressID = 0; |
||
74 | $order->write(); |
||
75 | $response = $member->getTitle()." "._t("AddToCartPage.ADDED", "customer has been added to order."); |
||
76 | $status = "good"; |
||
77 | } else { |
||
78 | $response = _t("AddToCartPage.NOCHANGE", "The order has not been changed."); |
||
79 | $status = "good"; |
||
80 | } |
||
81 | } else { |
||
82 | $response = _t("AddToCartPage.CUSTOMERNOTADDED", "Customer could not be added."); |
||
83 | $status = "bad"; |
||
84 | } |
||
85 | if (Director::is_ajax()) { |
||
86 | return $response; |
||
87 | } else { |
||
88 | $form->setMessage($response, $status); |
||
89 | $this->redirectBack(); |
||
90 | } |
||
91 | } |
||
92 | } |
||
93 | |||
94 | public function QuickAddToCartForm() |
||
95 | { |
||
96 | $fields = new FieldList( |
||
97 | new HeaderField("SelectCustomer", _t("AddToCartPage.ADDPRODUCTS", "Add Products to your order")), |
||
98 | new HiddenField("BuyableID"), |
||
99 | new HiddenField("BuyableClassName"), |
||
100 | new HiddenField("Version"), |
||
101 | new BuyableSelectField("FindBuyable", _t("AddToCartPage.PRODUCT", "Product")), |
||
102 | new NumericField("Quantity", _t("AddToCartPage.QUANTITY", "Quantity"), 1) |
||
103 | ); |
||
104 | $actions = new FieldList( |
||
105 | new FormAction("quickaddtocartform_add", _t("AddToCartPage.ADD", "Add")) |
||
106 | ); |
||
107 | $validator = new RequiredFields(array("Quantity")); |
||
108 | return new Form($this, "QuickAddToCartForm", $fields, $actions, $validator); |
||
109 | } |
||
110 | |||
111 | public function quickaddtocartform_add($data, $form) |
||
0 ignored issues
–
show
The return type could not be reliably inferred; please add a
@return annotation.
Our type inference engine in quite powerful, but sometimes the code does not
provide enough clues to go by. In these cases we request you to add a ![]() |
|||
112 | { |
||
113 | $shoppingCart = ShoppingCart::singleton(); |
||
114 | $buyableID = intval($data["BuyableID"]); |
||
115 | $buyableClassName = Convert::raw2sql($data["BuyableClassName"]); |
||
116 | $version = Intval($data["Version"]); |
||
0 ignored issues
–
show
$version is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
117 | $quantity = floatval($data["Quantity"]); |
||
118 | $status = "bad"; |
||
119 | $message = _t("AddToCartPage.ERRORPRODUCTNOTADDED", "ERROR: Product Not Added - make sure to find a product first."); |
||
120 | if (class_exists($buyableClassName) && EcommerceDBConfig::is_buyable($buyableClassName)) { |
||
0 ignored issues
–
show
It seems like
$buyableClassName defined by \Convert::raw2sql($data['BuyableClassName']) on line 115 can also be of type array ; however, EcommerceDBConfig::is_buyable() does only seem to accept string , maybe add an additional type check?
If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check: /**
* @return array|string
*/
function returnsDifferentValues($x) {
if ($x) {
return 'foo';
}
return array();
}
$x = returnsDifferentValues($y);
if (is_array($x)) {
// $x is an array.
}
If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue. ![]() |
|||
121 | $buyable = $buyableClassName::get()->byID($buyableID); |
||
122 | if ($buyable) { |
||
123 | $shoppingCart->addBuyable($buyable, $quantity); |
||
124 | $status = "good"; |
||
125 | $message = _t("AddToCartPage.ADDED", "Added"); |
||
126 | } |
||
127 | } |
||
128 | if (Director::is_ajax()) { |
||
129 | return $shoppingCart->setMessageAndReturn($message, $status, $form); |
||
130 | } else { |
||
131 | $form->setMessage($message, $status); |
||
132 | $this->redirectBack(); |
||
133 | } |
||
134 | } |
||
135 | } |
||
136 |
You can fix this by adding a namespace to your class:
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.