This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace App\Movies\Controller; |
||
4 | |||
5 | use App\Controller\BaseController; |
||
6 | use App\Countries\Entity\Country; |
||
7 | use App\Filters\FilterBuilder; |
||
8 | use App\Filters\Movie as Filter; |
||
9 | use App\Movies\DTO\MovieTranslationDTO; |
||
10 | use App\Movies\Entity\Movie; |
||
11 | use App\Movies\Entity\MovieTranslations; |
||
12 | use App\Movies\EventListener\SimilarMoviesProcessor; |
||
13 | use App\Movies\Repository\MovieReleaseDateRepository; |
||
14 | use App\Movies\Repository\MovieRepository; |
||
15 | use App\Movies\Request\CreateMovieRequest; |
||
16 | use App\Movies\Request\SearchRequest; |
||
17 | use App\Movies\Request\UpdateMovieRequest; |
||
18 | use App\Movies\Request\UpdatePosterRequest; |
||
19 | use App\Movies\Service\MovieManageService; |
||
20 | use App\Movies\Service\SearchService; |
||
21 | use App\Movies\Transformer\MovieTransformer; |
||
22 | use App\Movies\Utils\Poster; |
||
23 | use App\Pagination\CustomPaginatedCollection; |
||
24 | use App\Users\Entity\UserRoles; |
||
25 | use Enqueue\Client\ProducerInterface; |
||
26 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\ParamConverter; |
||
27 | use Symfony\Component\HttpFoundation\JsonResponse; |
||
28 | use Symfony\Component\HttpFoundation\Request; |
||
29 | use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; |
||
30 | use Symfony\Component\Routing\Annotation\Route; |
||
31 | use Symfony\Component\Validator\Validator\ValidatorInterface; |
||
32 | |||
33 | /** |
||
34 | * Class MovieController. |
||
35 | */ |
||
36 | class MovieController extends BaseController |
||
37 | { |
||
38 | /** |
||
39 | * Get all movies. |
||
40 | * |
||
41 | * @Route("/api/movies", methods={"GET"}) |
||
42 | * |
||
43 | * @param Request $request |
||
44 | * @param MovieRepository $movieRepository |
||
45 | * |
||
46 | * @throws |
||
47 | * |
||
48 | * @return \Symfony\Component\HttpFoundation\JsonResponse |
||
49 | */ |
||
50 | 34 | public function getAll(Request $request, MovieRepository $movieRepository) |
|
51 | { |
||
52 | 34 | [$movies, $ids] = $movieRepository->findAllWithIsWatchedFlag($this->getUser(), $this->getGuest()); |
|
0 ignored issues
–
show
|
|||
53 | |||
54 | 34 | $offset = (int) $request->get('offset', 0); |
|
55 | 34 | $limit = $request->get('limit', null); |
|
56 | |||
57 | // Its important to keep order of filters from easiest to heaviest in order to improve performance (in theory) |
||
58 | 34 | $filter = new FilterBuilder( |
|
59 | 34 | new Filter\YearRange(), |
|
60 | 34 | new Filter\Rating(), |
|
61 | 34 | new Filter\Genre(), |
|
62 | 34 | new Filter\Actor() |
|
63 | ); |
||
64 | |||
65 | 34 | $filter->process($request->query, $ids); |
|
66 | |||
67 | // todo move this clone qb to CustomPaginatedCollection |
||
68 | 34 | $count = clone $ids; |
|
69 | 34 | $count->select('COUNT(m.id)')->resetDQLPart('orderBy'); |
|
70 | |||
71 | 34 | $collection = new CustomPaginatedCollection($movies->getQuery(), $ids->getQuery(), $count->getQuery(), $offset, $limit); |
|
72 | |||
73 | 34 | return $this->items($collection, MovieTransformer::list()); |
|
74 | } |
||
75 | |||
76 | /** |
||
77 | * Get movie resource. |
||
78 | * |
||
79 | * @Route("/api/movies/{id}", methods={"GET"}, requirements={"id"="\d+"}) |
||
80 | * |
||
81 | * @param int $id |
||
82 | * @param MovieRepository $repository |
||
83 | * @param ProducerInterface $producer |
||
84 | * |
||
85 | * @throws \Doctrine\ORM\NoResultException |
||
86 | * @throws \Doctrine\ORM\NonUniqueResultException |
||
87 | * |
||
88 | * @return JsonResponse |
||
89 | */ |
||
90 | 3 | public function getMovies(Request $request, int $id, MovieRepository $repository, ProducerInterface $producer) |
|
91 | { |
||
92 | 3 | if (null === $movie = $repository->findOneForMoviePage($id, $request->getLocale(), $this->getUser())) { |
|
93 | throw new NotFoundHttpException(); |
||
94 | } |
||
95 | |||
96 | 3 | if (\count($movie->getSimilarMovies()) === 0) { |
|
97 | 3 | $producer->sendEvent(SimilarMoviesProcessor::LOAD_SIMILAR_MOVIES, json_encode($movie->getId())); |
|
98 | } |
||
99 | |||
100 | 3 | return $this->response($movie, 200, [], [ |
|
101 | 3 | 'groups' => ['view'], |
|
102 | ]); |
||
103 | } |
||
104 | |||
105 | /** |
||
106 | * @Route("/api/movies/{movieId}/releaseDate/{countryCode}", methods={"GET"}, requirements={"movieId"="\d+"}) |
||
107 | * @ParamConverter("country", options={"mapping": {"countryCode": "code"}}) |
||
108 | */ |
||
109 | public function getMovieReleaseDate(int $movieId, Country $country, MovieReleaseDateRepository $repository) |
||
110 | { |
||
111 | if (null === $releaseDate = $repository->findOneByCountry($movieId, $country->getId())) { |
||
112 | throw new NotFoundHttpException(); |
||
113 | } |
||
114 | |||
115 | return $this->response($releaseDate, 200, [], [ |
||
116 | 'groups' => ['view'], |
||
117 | ]); |
||
118 | } |
||
119 | |||
120 | /** |
||
121 | * @Route("/api/movies/{id}/updatePoster", methods={"POST"}, requirements={"id"="\d+"}) |
||
122 | * |
||
123 | * @param Movie $movie |
||
124 | * @param UpdatePosterRequest $request |
||
125 | * |
||
126 | * @return JsonResponse |
||
127 | */ |
||
128 | 1 | public function postMoviesUpdatePoster(Movie $movie, UpdatePosterRequest $request) |
|
129 | { |
||
130 | 1 | $this->denyAccessUnlessGranted(UserRoles::ROLE_ADMIN); |
|
131 | |||
132 | 1 | if (null === $posterPath = Poster::savePoster($movie->getId(), $request->get('url'))) { |
|
133 | return $this->json([], 400); |
||
134 | } |
||
135 | |||
136 | 1 | $movie->setOriginalPosterUrl(Poster::getUrl($movie->getId())); |
|
137 | 1 | $this->getDoctrine()->getManager()->flush(); |
|
138 | |||
139 | 1 | return $this->json([]); |
|
140 | } |
||
141 | |||
142 | /** |
||
143 | * Get movies by title. |
||
144 | * |
||
145 | * @Route("/api/movies/search", methods={"POST"}) |
||
146 | * |
||
147 | * @param SearchRequest $request |
||
148 | * @param SearchService $searchService |
||
149 | * @param Request $currentRequest |
||
150 | * |
||
151 | * @throws \Exception |
||
152 | * |
||
153 | * @return \Symfony\Component\HttpFoundation\JsonResponse |
||
154 | */ |
||
155 | 2 | public function getSearch(SearchRequest $request, SearchService $searchService, Request $currentRequest) |
|
156 | { |
||
157 | 2 | $offset = (int) $request->get('offset', 0); |
|
158 | 2 | $limit = $request->get('limit', null); |
|
159 | |||
160 | 2 | $query = $request->get('query'); |
|
161 | 2 | $movies = $searchService->findByQuery($query, $currentRequest->getLocale(), $offset, $limit); |
|
162 | |||
163 | 2 | return $this->response($movies, 200, [], [ |
|
164 | 2 | 'groups' => ['list'], |
|
165 | ]); |
||
166 | } |
||
167 | |||
168 | /** |
||
169 | * Create new movie. |
||
170 | * |
||
171 | * @Route("/api/movies", methods={"POST"}) |
||
172 | * |
||
173 | * @param CreateMovieRequest $request |
||
174 | * @param MovieManageService $service |
||
175 | * @param ValidatorInterface $validator |
||
176 | * |
||
177 | * @throws \Exception |
||
178 | * |
||
179 | * @return \Symfony\Component\HttpFoundation\JsonResponse |
||
180 | */ |
||
181 | 2 | public function postMovies(CreateMovieRequest $request, MovieManageService $service, ValidatorInterface $validator) |
|
182 | { |
||
183 | 2 | $this->denyAccessUnlessGranted(UserRoles::ROLE_ADMIN); |
|
184 | |||
185 | 1 | $movie = $service->createMovieByRequest($request); |
|
186 | 1 | $errors = $validator->validate($movie); |
|
187 | |||
188 | 1 | if (\count($errors)) { |
|
189 | return $request->getErrorResponse($errors); |
||
190 | } |
||
191 | |||
192 | 1 | $entityManager = $this->getDoctrine()->getManager(); |
|
193 | 1 | $entityManager->persist($movie); |
|
194 | 1 | $entityManager->flush(); |
|
195 | |||
196 | 1 | return $this->response($movie, 200, [], [ |
|
197 | 1 | 'groups' => ['view'], |
|
198 | ]); |
||
199 | } |
||
200 | |||
201 | /** |
||
202 | * @Route("/api/movies/{id}", methods={"POST", "PUT", "PATCH"}, requirements={"id"="\d+"}) |
||
203 | * |
||
204 | * @param Movie $movie |
||
205 | * @param UpdateMovieRequest $request |
||
206 | * |
||
207 | * @throws \ErrorException |
||
208 | * @throws \Exception |
||
209 | * |
||
210 | * @return JsonResponse |
||
211 | */ |
||
212 | 2 | public function putMovies(Movie $movie, UpdateMovieRequest $request) |
|
213 | { |
||
214 | 2 | $this->denyAccessUnlessGranted([UserRoles::ROLE_ADMIN, UserRoles::ROLE_MODERATOR]); |
|
215 | |||
216 | 1 | $movieData = $request->get('movie'); |
|
217 | 1 | $movieTranslationsData = $movieData['translations']; |
|
218 | |||
219 | 1 | $movie->setOriginalTitle($movieData['originalTitle']); |
|
220 | 1 | $movie->setImdbId($movieData['imdbId']); |
|
221 | 1 | $movie->setRuntime($movieData['runtime']); |
|
222 | 1 | $movie->setBudget($movieData['budget']); |
|
223 | 1 | $movie->setReleaseDate(new \DateTimeImmutable($movieData['releaseDate'])); |
|
224 | |||
225 | $addTranslation = function (array $trans) use ($movie) { |
||
226 | 1 | $transDto = new MovieTranslationDTO($trans['locale'], $trans['title'], $trans['overview'], null); |
|
227 | 1 | $movie->addTranslation( |
|
228 | 1 | new MovieTranslations($movie, $transDto) |
|
229 | ); |
||
230 | 1 | }; |
|
231 | |||
232 | $updateTranslation = function (array $trans, MovieTranslations $oldTranslation) use ($movie) { |
||
233 | 1 | $oldTranslation->setTitle($trans['title']); |
|
234 | 1 | $oldTranslation->setOverview($trans['overview']); |
|
235 | 1 | }; |
|
236 | |||
237 | 1 | $movie->updateTranslations($movieTranslationsData, $addTranslation, $updateTranslation); |
|
238 | |||
239 | 1 | $em = $this->getDoctrine()->getManager(); |
|
240 | 1 | $em->persist($movie); // if there 1+ new translations lets persist movie to be sure that they will be saved |
|
241 | 1 | $em->flush(); |
|
242 | |||
243 | 1 | return new JsonResponse(null, 202); |
|
244 | } |
||
245 | } |
||
246 |
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug.