Issues (13)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

code/GoogleAddressField.php (12 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * turns a field into a geo-coding field.
4
 *
5
 * @authors: Nicolaas [at] Sunny Side Up .co.nz
6
 * @package: forms
7
 * @sub-package: geocoding
8
 * @inspiration: http://gmaps-samples-v3.googlecode.com/svn/trunk/places/autocomplete-addressform.html
9
 **/
10
class GoogleAddressField extends TextField
11
{
12
    private static $google_map_api_location = '//maps.googleapis.com/maps/api/js';
13
14
    private static $field_js_location = 'google_address_field/javascript/GoogleAddressField.js';
15
16
17
    //when autocomplete returns a place we check if the type is an allowed type and if not
18
    //provide the user an alert to let them know their address may not have been correctly autocompleted
19
    private static $allowed_types = ['street_address'];
20
21
    /**
22
     * @var string
23
     */
24
    private static $api_key = "";
25
26
    /**
27
     * return a list of requirements
28
     * @return [type] [description]
0 ignored issues
show
The doc-type [type] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
29
     */
30
    public static function js_requirements()
31
    {
32
        $array = [];
33
        $api = Config::inst()->get('GoogleAddressField', 'google_map_api_location');
34
        $js = Config::inst()->get('GoogleAddressField', 'field_js_location');
35
        if ($api) {
36
            $array[] = $api
37
            .'?'
38
            .'&libraries=places'
39
            .'&key='.Config::inst()->get('GoogleAddressField', 'api_key');
40
        }
41
        if ($js) {
42
            $array[] = $js;
43
        }
44
45
        return $array;
46
    }
47
48
    /**
49
     *
50
     * @var bool
51
     */
52
    protected $useSensor = false;
53
54
    /**
55
     * Do you want this annoying ...
56
     * this website wants to know exactly where you are
57
     * and what you are wearing thing ...
58
     * then this is your VAR.
59
     *
60
     * @param bool
61
     */
62
    public function setUseSensor($b)
63
    {
64
        $this->useSensor = $b;
65
        return $this;
66
    }
67
68
    protected $alwaysShowFields = false;
69
70
    /**
71
     * @param bool
72
     */
73
    public function setAlwaysShowFields($b)
74
    {
75
        $this->alwaysShowFields = $b;
76
        return $this;
77
    }
78
79
    /**
80
     * Link to the static map.  Set to an empty string to have no static image appear.
81
     * Use the [ADDRESS] tag to insert the address...
82
     * user the [MAXWIDTH] tag to set it automatically to the width of the container.
83
     *
84
     * @var string
85
     */
86
    protected $googleStaticMapLink = '//maps.googleapis.com/maps/api/staticmap?center=[ADDRESS]&amp;zoom=17&amp;scale=false&amp;size=[MAXWIDTH]x[MAXHEIGHT]&amp;maptype=roadmap&amp;format=png&amp;visual_refresh=true&amp;markers=size:mid%7Ccolor:red%7Clabel:%7C[ADDRESS]';
87
88
    /**
89
     * set to empty string to NOT show a static map.
90
     *
91
     * @param string
92
     */
93
    public function setGoogleStaticMapLink($s)
94
    {
95
        $this->googleStaticMapLink = $s;
96
        return $this;
97
    }
98
99
    /**
100
     * get to empty string to NOT show a static map.
101
     *
102
     * @return string
103
     */
104
    public function getGoogleStaticMapLink()
105
    {
106
        return $this->googleStaticMapLink . '&amp;key='.Config::inst()->get('GoogleAddressField', "api_key");
107
    }
108
109
    /**
110
     * CSS file used in this field (can be themed!).
111
     *
112
     * @var string
113
     */
114
    protected $cssLocation = 'GoogleAddressField';
115
116
    /**
117
     * @param string
118
     */
119
    public function setCssLocation($s)
120
    {
121
        $this->cssLocation = $s;
122
        return $this;
123
    }
124
125
    /**
126
     * list of links between
127
     * form fields in the current field (e.g. TextField with name City)
128
     * and the result XML.
129
     * When the results are returned this field will fill the form
130
     * fields with XML data from the results using this array
131
     * Format is:
132
     * [formFieldName] => array(
133
     *   resultType1 => 'long_name',
134
     *   resultType2 => 'long_name',
135
     *   resultType2 => 'short_name',
136
     *   etc...
137
     * )
138
     * e.g.
139
     * <code php>
140
     *     "BillingRegion" => array("administrative_area_level_1" => "long_name", "country" => "short_name")
141
     * </code>.
142
     *
143
     * @var array
144
     */
145
    protected $fieldMap = array();
146
147
    /**
148
     * @param array
149
     */
150
    public function setFieldMap($a)
151
    {
152
        $this->fieldMap = $a;
153
        return $this;
154
    }
155
156
    /**
157
     * @param string $formField
158
     * @param array  $arrayOfGeoData
159
     */
160
    public function addFieldMapEntry($formField, $arrayOfGeoData)
161
    {
162
        $this->fieldMap[$formField] = $arrayOfGeoData;
163
        return $this;
164
    }
165
166
    /**
167
     * @param string $formField
168
     */
169
    public function removeFieldMapEntry($formField)
170
    {
171
        unset($this->fieldMap[$formField]);
172
    }
173
174
    /**
175
     * @return array
176
     */
177
    public function getFieldMap()
178
    {
179
        return $this->fieldMap;
180
    }
181
182
183
    protected $typeToBeReturned = 'address';
184
185
    /**
186
     * @param string $code - e.g. address
0 ignored issues
show
There is no parameter named $code. Was it maybe removed?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.

Consider the following example. The parameter $italy is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was removed, but the annotation was not.

Loading history...
187
     */
188
    public function setTypeToBeReturned($ype)
0 ignored issues
show
The parameter $ype is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
189
    {
190
        $this->typeToBeReturned = $type;
0 ignored issues
show
The variable $type does not exist. Did you forget to declare it?

This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug.

Loading history...
191
192
        return $this;
193
    }
194
195
196
    protected $restrictToCountryCode = '';
197
198
    /**
199
     * @param string $code - e.g. NZ
200
     */
201
    public function setRestrictToCountryCode($code)
202
    {
203
        $this->restrictToCountryCode = $code;
204
205
        return $this;
206
    }
207
208
    /**
209
     * @return string
210
     */
211
    public function getRestrictToCountryCode()
212
    {
213
        return $this->restrictToCountryCode;
214
    }
215
216
217
218
    /**
219
     * @return bool
220
     */
221
    public function hasData()
222
    {
223
        return false;
224
    }
225
226
    /**
227
     * @return string
228
     */
229
    public function Field($properties = array())
230
    {
231
        $this->addExtraClass('text');
232
        foreach (self::js_requirements() as $jsFile) {
233
            Requirements::javascript($jsFile);
234
        }
235
        Requirements::customScript(
236
            $this->getJavascript(),
237
            'GoogleAddressField'.$this->id()
238
        );
239
240
        if ($this->cssLocation) {
241
            Requirements::themedCSS($this->cssLocation, 'google_address_field');
242
        }
243
        $this->setAttribute('autocomplete', 'false');
244
        $this->setAttribute('autofill', 'false');
245
        $this->setAttribute('data-selectedOptionNotAllowed', Convert::raw2att(_t('GoogleAddressField.SELECTED_OPTION_NOT_ALLOWED', 'ERROR: You have selected an invalid')));
0 ignored issues
show
It seems like \Convert::raw2att(_t('Go... selected an invalid')) targeting Convert::raw2att() can also be of type array; however, FormField::setAttribute() does only seem to accept string, maybe add an additional type check?

This check looks at variables that are passed out again to other methods.

If the outgoing method call has stricter type requirements than the method itself, an issue is raised.

An additional type check may prevent trouble.

Loading history...
246
        $this->setAttribute('data-errorMessageMoreSpecific', Convert::raw2att(_t('GoogleAddressField.ERROR_MESSAGE_MORE_SPECIFIC', 'Error: please enter a more specific location.')));
0 ignored issues
show
It seems like \Convert::raw2att(_t('Go...e specific location.')) targeting Convert::raw2att() can also be of type array; however, FormField::setAttribute() does only seem to accept string, maybe add an additional type check?

This check looks at variables that are passed out again to other methods.

If the outgoing method call has stricter type requirements than the method itself, an issue is raised.

An additional type check may prevent trouble.

Loading history...
247
        $this->setAttribute('data-errorMessageAddressNotFound', Convert::raw2att(_t('GoogleAddressField.ERROR_MESSAGE_ADDRESS_NOT_FOUND', 'Error: sorry, address could not be found.')));
0 ignored issues
show
It seems like \Convert::raw2att(_t('Go... could not be found.')) targeting Convert::raw2att() can also be of type array; however, FormField::setAttribute() does only seem to accept string, maybe add an additional type check?

This check looks at variables that are passed out again to other methods.

If the outgoing method call has stricter type requirements than the method itself, an issue is raised.

An additional type check may prevent trouble.

Loading history...
248
        $this->setAttribute('data-findNewAddressText', Convert::raw2att(_t('GoogleAddressField.FIND_NEW_ADDRESS', 'Find Different Address')));
0 ignored issues
show
It seems like \Convert::raw2att(_t('Go...nd Different Address')) targeting Convert::raw2att() can also be of type array; however, FormField::setAttribute() does only seem to accept string, maybe add an additional type check?

This check looks at variables that are passed out again to other methods.

If the outgoing method call has stricter type requirements than the method itself, an issue is raised.

An additional type check may prevent trouble.

Loading history...
249
        $this->setAttribute('data-relatedFields', Convert::raw2att(Convert::raw2json($this->getFieldMap())));
0 ignored issues
show
It seems like \Convert::raw2att(\Conve...($this->getFieldMap())) targeting Convert::raw2att() can also be of type array; however, FormField::setAttribute() does only seem to accept string, maybe add an additional type check?

This check looks at variables that are passed out again to other methods.

If the outgoing method call has stricter type requirements than the method itself, an issue is raised.

An additional type check may prevent trouble.

Loading history...
250
        $this->setAttribute('data-alwaysShowFields', ($this->alwaysShowFields ? 'true' : 'false'));
251
        $this->setAttribute('data-useSensor', ($this->useSensor ? 'true' : 'false'));
252
        $this->setAttribute('data-googleStaticMapLink', $this->getGoogleStaticMapLink());
253
        $this->setAttribute('data-typeToBeReturned', $this->typeToBeReturned);
254
        if ($code = $this->getRestrictToCountryCode()) {
255
            $this->setAttribute('data-restrictToCountryCode', $code);
256
        }
257
        $this->setAttribute('data-linkLabelToViewMap', Convert::raw2att(_t('GoogleAddressField.LINK_LABEL_TO_VIEW_MAP', 'view map')));
0 ignored issues
show
It seems like \Convert::raw2att(_t('Go...VIEW_MAP', 'view map')) targeting Convert::raw2att() can also be of type array; however, FormField::setAttribute() does only seem to accept string, maybe add an additional type check?

This check looks at variables that are passed out again to other methods.

If the outgoing method call has stricter type requirements than the method itself, an issue is raised.

An additional type check may prevent trouble.

Loading history...
258
        $this->setAttribute('data-defaultAddress', Convert::raw2att(str_replace("'", '', $this->Value())));
0 ignored issues
show
It seems like \Convert::raw2att(str_re...', '', $this->Value())) targeting Convert::raw2att() can also be of type array; however, FormField::setAttribute() does only seem to accept string, maybe add an additional type check?

This check looks at variables that are passed out again to other methods.

If the outgoing method call has stricter type requirements than the method itself, an issue is raised.

An additional type check may prevent trouble.

Loading history...
259
        //right title
260
        $this->RightTitle();
261
262
        return parent::Field($properties);
263
    }
264
265
    /**
266
     * retuns the customised Javascript for the form field.
267
     *
268
     * @return string
269
     */
270
    protected function getJavascript()
271
    {
272
        $allowed_types = Config::inst()->get('GoogleAddressField', 'allowed_types');
273
274
        if ($allowed_types) {
275
            return '
276
                if(typeof GoogleAddressFieldStatics === "undefined") {
277
                    var GoogleAddressFieldStatics = {};
278
                }
279
                GoogleAddressFieldStatics.allowedTypes = '.json_encode($allowed_types).';
280
            ';
281
        }
282
283
        return '';
284
    }
285
    /**
286
     * @return string
0 ignored issues
show
Should the return type not be HTMLText|null?

This check compares the return type specified in the @return annotation of a function or method doc comment with the types returned by the function and raises an issue if they mismatch.

Loading history...
287
     */
288
    public function RightTitle()
289
    {
290
        $rightTitle = $this->renderWith('GoogleAddressFieldRightTitle');
291
        if (strlen(trim($rightTitle))) {
292
            return $rightTitle;
293
        }
294
    }
295
}
296