This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * @description: for the management of Product and Product Groups only |
||
5 | * |
||
6 | * |
||
7 | * @authors: Nicolaas [at] Sunny Side Up .co.nz |
||
8 | * @package: ecommerce |
||
9 | * @sub-package: cms |
||
10 | **/ |
||
11 | |||
12 | class SecondHandProductAdmin extends ModelAdminEcommerceBaseClass |
||
0 ignored issues
–
show
|
|||
13 | { |
||
14 | private static $menu_priority = 3.2; |
||
0 ignored issues
–
show
|
|||
15 | |||
16 | private static $url_segment = 'secondhandproducts'; |
||
0 ignored issues
–
show
|
|||
17 | |||
18 | private static $menu_title = 'Second Hand'; |
||
0 ignored issues
–
show
|
|||
19 | |||
20 | private static $managed_models = array( |
||
0 ignored issues
–
show
|
|||
21 | 'SecondHandProduct', |
||
22 | 'SecondHandArchive' |
||
23 | ); |
||
24 | |||
25 | private static $allowed_actions = array( |
||
0 ignored issues
–
show
|
|||
26 | "editinsitetree", |
||
27 | "ItemEditForm", |
||
28 | "archive" => true, |
||
29 | "restore" => true, |
||
30 | ); |
||
31 | |||
32 | /** |
||
33 | * standard SS variable |
||
34 | * @var String |
||
35 | */ |
||
36 | private static $menu_icon = "ecommerce/images/icons/product-file.gif"; |
||
0 ignored issues
–
show
|
|||
37 | |||
38 | |||
39 | public function getEditForm($id = null, $fields = null) |
||
40 | { |
||
41 | foreach (GoogleAddressField::js_requirements() as $jsFile) { |
||
42 | Requirements::javascript($jsFile); |
||
43 | } |
||
44 | $form = parent::getEditForm(); |
||
45 | if (singleton($this->modelClass) instanceof SiteTree) { |
||
46 | if ($gridField = $form->Fields()->dataFieldByName($this->sanitiseClassName($this->modelClass))) { |
||
47 | if ($gridField instanceof GridField) { |
||
48 | $gridField->setConfig(GridFieldEditOriginalPageConfigSecondHandPage::create()); |
||
49 | } |
||
50 | } |
||
51 | } |
||
52 | return $form; |
||
53 | } |
||
54 | |||
55 | |||
56 | public function doCancel($data, $form) |
||
0 ignored issues
–
show
|
|||
57 | { |
||
58 | return $this->redirect(singleton('CMSMain')->Link()); |
||
59 | } |
||
60 | |||
61 | public function archive($request) |
||
0 ignored issues
–
show
archive uses the super-global variable $_GET which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
![]() |
|||
62 | { |
||
63 | if (isset($_GET['productid'])) { |
||
64 | $id = intval($_GET['productid']); |
||
65 | if ($id) { |
||
66 | $secondHandProduct = SecondHandProduct::get()->byID($id); |
||
67 | $internalItemID = $secondHandProduct->InternalItemID; |
||
68 | if (is_a($secondHandProduct, Object::getCustomClass('SiteTree'))) { |
||
69 | $secondHandProduct->deleteFromStage('Live'); |
||
70 | $secondHandProduct->deleteFromStage('Stage'); |
||
71 | } else { |
||
72 | $secondHandProduct->delete(); |
||
73 | } |
||
74 | //after deleting the product redirect to the archived page |
||
75 | $archivedProduct = SecondHandArchive::get()->filter(['InternalItemID' => $internalItemID])->first(); |
||
76 | if ($archivedProduct) { |
||
77 | $this->getResponse()->addHeader( |
||
78 | 'X-Status', |
||
79 | rawurlencode(_t( |
||
80 | 'CMSMain.RESTORED', |
||
81 | "Archived '{title}' successfully", |
||
82 | array('title' => $archivedProduct->Title) |
||
0 ignored issues
–
show
array('title' => $archivedProduct->Title) is of type array<string,?,{"title":"?"}> , but the function expects a string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
83 | )) |
||
84 | ); |
||
85 | $cmsEditLink = '/admin/secondhandproducts/SecondHandArchive/EditForm/field/SecondHandArchive/item/'.$archivedProduct->ID.'/edit'; |
||
86 | return Controller::curr()->redirect($cmsEditLink); |
||
87 | } |
||
88 | } |
||
89 | } |
||
90 | return new SS_HTTPResponse("ERROR!", 400); |
||
91 | } |
||
92 | |||
93 | public function restore($request) |
||
0 ignored issues
–
show
restore uses the super-global variable $_GET which is generally not recommended.
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: // Bad
class Router
{
public function generate($path)
{
return $_SERVER['HOST'].$path;
}
}
// Better
class Router
{
private $host;
public function __construct($host)
{
$this->host = $host;
}
public function generate($path)
{
return $this->host.$path;
}
}
class Controller
{
public function myAction(Request $request)
{
// Instead of
$page = isset($_GET['page']) ? intval($_GET['page']) : 1;
// Better (assuming you use the Symfony2 request)
$page = $request->query->get('page', 1);
}
}
![]() |
|||
94 | { |
||
95 | if (isset($_GET['productid'])) { |
||
96 | $id = intval($_GET['productid']); |
||
97 | if ($id) { |
||
98 | $restoredPage = Versioned::get_latest_version("SiteTree", $id); |
||
99 | $parentID = $restoredPage->ParentID; |
||
100 | if ($parentID) { |
||
101 | var_dump($parentID); |
||
0 ignored issues
–
show
|
|||
102 | $this->ensureParentHasVersion($parentID); |
||
103 | if (!$restoredPage) { |
||
104 | return new SS_HTTPResponse("SiteTree #$id not found", 400); |
||
105 | } |
||
106 | $restoredPage = $restoredPage->doRestoreToStage(); |
||
107 | //$restoredPage->doPublish(); |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
84% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
108 | $this->getResponse()->addHeader( |
||
109 | 'X-Status', |
||
110 | rawurlencode(_t( |
||
111 | 'CMSMain.RESTORED', |
||
112 | "Restored '{title}' successfully", |
||
113 | array('title' => $restoredPage->Title) |
||
0 ignored issues
–
show
array('title' => $restoredPage->Title) is of type array<string,?,{"title":"?"}> , but the function expects a string .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
114 | )) |
||
115 | ); |
||
116 | $cmsEditLink = '/admin/secondhandproducts/SecondHandProduct/EditForm/field/SecondHandProduct/item/'.$id.'/edit'; |
||
117 | return Controller::curr()->redirect($cmsEditLink); |
||
118 | } else { |
||
119 | return new SS_HTTPResponse("Parent Page #$parentID is missing", 400); |
||
120 | } |
||
121 | } |
||
122 | } |
||
123 | return new SS_HTTPResponse("ERROR!", 400); |
||
124 | } |
||
125 | |||
126 | /** |
||
127 | * little hack to fix parent if it is not versioned into versions table |
||
128 | */ |
||
129 | public function ensureParentHasVersion($parentID) |
||
130 | { |
||
131 | $parentPage = Versioned::get_latest_version("SiteTree", $parentID); |
||
132 | if (!$parentPage) { |
||
133 | $parentPage = SiteTree::get()->byID($parentID); |
||
134 | if ($parentPage) { |
||
135 | $parentPage->writeToStage('Stage'); |
||
136 | $parentPage->publish('Stage', 'Live', true); |
||
137 | } |
||
138 | } |
||
139 | } |
||
140 | } |
||
141 |
You can fix this by adding a namespace to your class:
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.