This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | class PhotoUploadPage extends Page |
||
0 ignored issues
–
show
|
|||
4 | { |
||
5 | private static $icon = 'mysite/images/treeicons/PhotoUploadPage'; |
||
0 ignored issues
–
show
|
|||
6 | |||
7 | private static $db = array( |
||
0 ignored issues
–
show
|
|||
8 | 'InvitationMessage' => 'HTMLText', |
||
9 | 'InviteButtonText' => 'Varchar(30)', |
||
10 | 'UploadExplanation' => 'HTMLText', |
||
11 | 'AlertEmail1' => 'Varchar(100)', |
||
12 | 'AlertEmail2' => 'Varchar(100)', |
||
13 | 'NumberOfImages' => 'Int', |
||
14 | 'ThankYouTitle' => 'Varchar(200)', |
||
15 | 'ThankYouMessage' => 'HTMLText', |
||
16 | 'FirstName_Note' => 'Varchar(255)', |
||
17 | 'Surname_Note' => 'Varchar(255)', |
||
18 | 'Email_Note' => 'Varchar(255)', |
||
19 | 'Image_Note' => 'Varchar(255)' |
||
20 | ); |
||
21 | |||
22 | private static $description = 'Photo Upload Page'; |
||
0 ignored issues
–
show
|
|||
23 | |||
24 | private static $can_be_root = true; |
||
0 ignored issues
–
show
|
|||
25 | |||
26 | private static $allow_children = 'none'; |
||
0 ignored issues
–
show
|
|||
27 | |||
28 | private static $default = array( |
||
0 ignored issues
–
show
|
|||
29 | "NumberOfImages" => 1 |
||
30 | ); |
||
31 | |||
32 | public function getCMSFields() |
||
0 ignored issues
–
show
The return type could not be reliably inferred; please add a
@return annotation.
Our type inference engine in quite powerful, but sometimes the code does not
provide enough clues to go by. In these cases we request you to add a ![]() |
|||
33 | { |
||
34 | $fields = parent::getCMSFields(); |
||
35 | |||
36 | //invite section |
||
37 | $fields->addFieldToTab('Root.CustomerImages', new HeaderField('Invite to upload')); |
||
38 | //InvitationMessage |
||
39 | $invitationMessageField = new HtmlEditorField("InvitationMessage", "Invite"); |
||
40 | $invitationMessageField->setRows(5); |
||
41 | $invitationMessageField->setRightTitle("Invite the user to upload their images."); |
||
42 | $fields->addFieldToTab('Root.CustomerImages', $invitationMessageField); |
||
43 | //InviteButtonText |
||
44 | $fields->addFieldToTab('Root.CustomerImages', $inviteButtonTextField = new TextField('InviteButtonText', 'Invite Button Text')); |
||
45 | $inviteButtonTextField->setRightTitle("Button that the user clicks to show the form for uploading the customer images."); |
||
46 | |||
47 | //upload section |
||
48 | $fields->addFieldToTab('Root.CustomerImages', new HeaderField('Upload Explanations')); |
||
49 | $uploadExplanationField = new HtmlEditorField("UploadExplanation", "Explanation"); |
||
50 | $uploadExplanationField->setRows(5); |
||
51 | $uploadExplanationField->setRightTitle("tell the user how to enter their details and upload the image (e.g. what size image, what format, etc...)"); |
||
52 | $fields->addFieldToTab('Root.CustomerImages', $uploadExplanationField); |
||
53 | $fields->addFieldToTab('Root.CustomerImages', new TextField("Email_Note", "Explanation about E-mail")); |
||
54 | $fields->addFieldToTab('Root.CustomerImages', new TextField("Image_Note", "Explanation about Image")); |
||
55 | |||
56 | //thank you section |
||
57 | $fields->addFieldToTab('Root.CustomerImages', new HeaderField('Thank You')); |
||
58 | $fields->addFieldToTab('Root.CustomerImages', new TextField("ThankYouTitle", "Title shown on thank you page.")); |
||
59 | $thankYouMessage = new HtmlEditorField("ThankYouMessage", "Thank you message after uploading"); |
||
60 | $thankYouMessage->setRows(5); |
||
61 | $fields->addFieldToTab('Root.CustomerImages', $thankYouMessage); |
||
62 | |||
63 | |||
64 | //settings |
||
65 | $fields->addFieldToTab('Root.CustomerImages', new HeaderField('Settings')); |
||
66 | $fields->addFieldToTab('Root.CustomerImages', $emailField1 = new EmailField("AlertEmail1")); |
||
67 | $emailField1->setRightTitle("Alert email 1 goes to (alert emails let the website owner know that a new customer image has been uploaded)"); |
||
68 | $fields->addFieldToTab('Root.CustomerImages', $emailField2 = new EmailField("AlertEmail2")); |
||
69 | $emailField2->setRightTitle("Alert email 2 goes to (alert emails let the website owner know that a new customer image has been uploaded)"); |
||
70 | $fields->addFieldToTab('Root.CustomerImages', $numberOfImagesField = new NumericField("NumberOfImages")); |
||
71 | $numberOfImagesField->setRightTitle("Number of images that can be uploaded at any one time"); |
||
72 | |||
73 | //previous images |
||
74 | $fields->addFieldToTab('Root.UploadedImages', |
||
75 | new GridField('images', '', CustomerImage::get(), GridFieldConfig_RecordEditor::create()) |
||
0 ignored issues
–
show
|
|||
76 | ); |
||
77 | return $fields; |
||
78 | } |
||
79 | |||
80 | public function requireDefaultRecords() |
||
81 | { |
||
82 | parent::requireDefaultRecords(); |
||
83 | $pages = PhotoUploadPage::get(); |
||
84 | foreach ($pages as $page) { |
||
85 | $write = false; |
||
86 | if (strlen($page->InvitationMessage) < 20) { |
||
87 | $write = true; |
||
88 | $page->InvitationMessage = ' |
||
89 | <p> |
||
90 | Invite message |
||
91 | </p>'; |
||
92 | } |
||
93 | if (!$page->InviteButtonText) { |
||
94 | $write = true; |
||
95 | $page->InviteButtonText = 'Upload Now'; |
||
96 | } |
||
97 | if ($write) { |
||
98 | $page->writeToStage(); |
||
99 | $page->publish("Stage", "Live"); |
||
100 | } |
||
101 | } |
||
102 | } |
||
103 | } |
||
104 | |||
105 | class PhotoUploadPage_Controller extends Page_Controller |
||
0 ignored issues
–
show
PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions.
You can fix this by adding a namespace to your class: namespace YourVendor;
class YourClass { }
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries. ![]() |
|||
106 | { |
||
107 | private static $allowed_actions = array( |
||
0 ignored issues
–
show
|
|||
108 | "thankyou", |
||
109 | "deleteimage", |
||
110 | "Form", |
||
111 | "ajaxform" |
||
112 | ); |
||
113 | |||
114 | private static $number_of_images = 3; |
||
0 ignored issues
–
show
|
|||
115 | |||
116 | private static $images_session_name = 'Images'; |
||
0 ignored issues
–
show
|
|||
117 | |||
118 | private static $customers_group = 'Customers'; |
||
0 ignored issues
–
show
|
|||
119 | |||
120 | private $productID = 0; |
||
121 | |||
122 | public function init() |
||
123 | { |
||
124 | parent::init(); |
||
125 | $this->productID = intval($this->request->param("ID")); |
||
126 | } |
||
127 | |||
128 | |||
129 | public function ajaxform() |
||
0 ignored issues
–
show
The return type could not be reliably inferred; please add a
@return annotation.
Our type inference engine in quite powerful, but sometimes the code does not
provide enough clues to go by. In these cases we request you to add a ![]() |
|||
130 | { |
||
131 | return $this->renderWith("PhotoUploadPage_Ajax"); |
||
132 | } |
||
133 | |||
134 | public function Form() |
||
135 | { |
||
136 | $settings = $this->dataRecord; |
||
137 | $requiredFields = new RequiredFields('Image1'); |
||
138 | $fields = new FieldList(); |
||
139 | $required = ' <span class="required">*</span>'; |
||
140 | if ($this->UploadExplanation) { |
||
141 | $fields->push(new LiteralField('UploadExplanation', $this->UploadExplanation)); |
||
142 | } |
||
143 | $fields->push(new TextField('FirstName', 'Your First Name')); |
||
144 | //$requiredFields->addRequiredField('FirstName'); |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
86% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
145 | $fields->push(new TextField('Surname', 'Your Last Name')); |
||
146 | $fields->push(new EmailField('Email', "Email$required")); |
||
147 | $requiredFields->addRequiredField('Email'); |
||
148 | $fields->push(new TextField('Location', "Photograph Location$required")); |
||
149 | //spam field |
||
150 | $fields->push(new TextField('Website', "Website")); |
||
151 | $product = Product::get()->byID($this->productID); |
||
152 | if ($product) { |
||
153 | $variations = ProductVariation::get()->filter(array("ProductID" => $product->ID))->map("ID", "Title")->toArray(); |
||
154 | $productDropdown = new HiddenField('ProductPageID', "Hidden Product", $product->ID); |
||
0 ignored issues
–
show
'ProductPageID' is of type string , but the function expects a object<The> .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() 'Hidden Product' is of type string , but the function expects a object<The>|null .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
155 | $variationsDropdown = new DropdownField('ProductVariationID', 'Model', $variations); |
||
156 | } else { |
||
157 | $products = Product::get()->map("ID", "Title")->toArray(); |
||
158 | $productDropdown = new DropdownField('ProductPageID', 'Product', $products); |
||
159 | $variationsDropdown = new HiddenField('ProductVariationID', 0, 0); |
||
0 ignored issues
–
show
'ProductVariationID' is of type string , but the function expects a object<The> .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() 0 is of type integer , but the function expects a object<The>|null .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
160 | } |
||
161 | $fields->push($productDropdown); |
||
162 | $fields->push($variationsDropdown); |
||
163 | |||
164 | $feedbackField = new TextareaField('Feedback', "Do you have any feedback or question (not published)"); |
||
165 | $feedbackField->setRows(5); |
||
166 | $fields->push($feedbackField); |
||
167 | |||
168 | for ($i = 1; ($i <= $this->NumberOfImages || $i == 1) && $i < 6; $i++) { |
||
169 | $fields->push($field = new FileField("Image$i", ($i == 1 ? "Your Photo$required" : "Photo $i"))); |
||
170 | $field->setFolderName('Customer-Photos/Drafts'); |
||
171 | $field->getValidator()->setAllowedExtensions(array('jpg', 'gif', 'png')); |
||
172 | } |
||
173 | //final cleanup |
||
174 | $requiredFields->addRequiredField('Image1'); |
||
175 | $fields->fieldByName("Email")->setRightTitle($settings->Email_Note); |
||
176 | $fields->fieldByName("Image1")->setRightTitle($settings->Image_Note); |
||
177 | $actions = new FieldList( |
||
178 | new FormAction('upload', 'Upload') |
||
0 ignored issues
–
show
'upload' is of type string , but the function expects a object<The> .
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
![]() |
|||
179 | ); |
||
180 | $form = new Form($this, 'Form', $fields, $actions, $requiredFields); |
||
181 | return $form; |
||
182 | } |
||
183 | |||
184 | public function upload($data, $form) |
||
0 ignored issues
–
show
The return type could not be reliably inferred; please add a
@return annotation.
Our type inference engine in quite powerful, but sometimes the code does not
provide enough clues to go by. In these cases we request you to add a ![]() |
|||
185 | { |
||
186 | //check for spam |
||
187 | if (isset($data["Website"]) && $data["Website"]) { |
||
188 | $form->sessionMessage('Please dont be overzealous.', 'bad'); |
||
189 | $this->redirectBack(); |
||
190 | } |
||
191 | if (!isset($data['Email'])) { |
||
192 | $form->sessionMessage('Please fill in "Email", it is required.', 'bad'); |
||
193 | return $this->redirectBack(); |
||
194 | } |
||
195 | if (!isset($data['Feedback'])) { |
||
196 | $data['Feedback'] = 'NO FEEDBACK PROVIDED'; |
||
197 | } |
||
198 | $customerImage = CustomerImage::create(); |
||
199 | $form->saveInto($customerImage); |
||
200 | $customerImage->write(); |
||
201 | mail($this->AlertEmail1, "customer image uploaded", "customer image uploaded: FEEDBACK".$data['Feedback']); |
||
202 | mail($this->AlertEmail2, "customer image uploaded", "customer image uploaded: FEEDBACK".$data['Feedback']); |
||
203 | return $this->redirect($this->Link('thankyou')); |
||
204 | } |
||
205 | |||
206 | private $isThankYouContent = false; |
||
207 | |||
208 | public function IsThankYouContent() |
||
209 | { |
||
210 | return $this->isThankYouContent; |
||
211 | } |
||
212 | |||
213 | public function thankyou() |
||
0 ignored issues
–
show
The return type could not be reliably inferred; please add a
@return annotation.
Our type inference engine in quite powerful, but sometimes the code does not
provide enough clues to go by. In these cases we request you to add a ![]() |
|||
214 | { |
||
215 | $this->isThankYouContent = true; |
||
216 | $this->Title = $this->ThankYouTitle; |
||
217 | $this->MetaTitle = $this->ThankYouTitle; |
||
218 | if (Director::is_ajax()) { |
||
219 | return $this->renderWith("PhotoUploadPage_Ajax"); |
||
220 | } else { |
||
221 | return array(); |
||
222 | } |
||
223 | } |
||
224 | } |
||
225 | /* |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
57% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
226 | class PhotoUploadPage_Uploader extends UploadField { |
||
227 | |||
228 | public function saveInto(Member $member) { |
||
229 | if(!isset($_FILES[$this->name])) return false; |
||
230 | |||
231 | $file = new CustomerImage(); |
||
232 | |||
233 | $this->upload->loadIntoFile($_FILES[$this->name], $file, $this->folderName); |
||
234 | if($this->upload->isError()) return false; |
||
235 | |||
236 | $file = $this->upload->getFile(); |
||
237 | |||
238 | $file->OwnerID = $member->ID; |
||
239 | $file->write(); |
||
240 | |||
241 | Session::add_to_array(PhotoUploadPage_Controller::$images_session_name, $file->ID); |
||
242 | } |
||
243 | }*/ |
||
244 |
You can fix this by adding a namespace to your class:
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.