svbackend /
my-art-lib
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace App\Users\Controller; |
||
| 4 | |||
| 5 | use App\Controller\BaseController; |
||
| 6 | use App\Guests\Entity\GuestSession; |
||
| 7 | use App\Movies\Repository\MovieRepository; |
||
| 8 | use App\Movies\Request\AddWatchedMovieRequest; |
||
| 9 | use App\Movies\Request\UpdateWatchedMovieRequest; |
||
| 10 | use App\Movies\Service\WatchedMovieService; |
||
| 11 | use App\Movies\Transformer\MovieTransformer; |
||
| 12 | use App\Pagination\CustomPaginatedCollection; |
||
| 13 | use App\Users\Entity\User; |
||
| 14 | use App\Users\Entity\UserWatchedMovie; |
||
| 15 | use App\Users\Repository\WatchedMovieRepository; |
||
| 16 | use App\Users\Request\MergeWatchedMoviesRequest; |
||
| 17 | use Symfony\Component\HttpFoundation\JsonResponse; |
||
| 18 | use Symfony\Component\HttpFoundation\Request; |
||
| 19 | use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException; |
||
| 20 | use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; |
||
| 21 | use Symfony\Component\Routing\Annotation\Route; |
||
| 22 | |||
| 23 | class WatchedMovieController extends BaseController |
||
| 24 | { |
||
| 25 | /** |
||
| 26 | * @Route("/api/users/watchedMovies", methods={"POST"}); |
||
| 27 | * |
||
| 28 | * @param AddWatchedMovieRequest $addWatchedMovieRequest |
||
| 29 | * @param Request $request |
||
| 30 | * @param WatchedMovieService $watchedMovieService |
||
| 31 | * |
||
| 32 | * @throws \Exception|NotFoundHttpException |
||
| 33 | * |
||
| 34 | * @return JsonResponse |
||
| 35 | */ |
||
| 36 | 6 | public function postWatchedMovies(AddWatchedMovieRequest $addWatchedMovieRequest, Request $request, WatchedMovieService $watchedMovieService) |
|
| 37 | { |
||
| 38 | 6 | $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY'); |
|
| 39 | |||
| 40 | 6 | $watchedMovieDTO = $addWatchedMovieRequest->getWatchedMovieDTO(); |
|
| 41 | 6 | $isMovieAdded = $watchedMovieService->addUserWatchedMovie($this->getUser(), $watchedMovieDTO, $request->getLocale()); |
|
|
0 ignored issues
–
show
|
|||
| 42 | |||
| 43 | 6 | if ($isMovieAdded === false) { |
|
| 44 | throw new NotFoundHttpException('Movie not found by provided ID / TMDB ID'); |
||
| 45 | } |
||
| 46 | |||
| 47 | 6 | return new JsonResponse(null, 202); |
|
| 48 | } |
||
| 49 | |||
| 50 | /** |
||
| 51 | * @Route("/api/users/{user}/watchedMovies/{watchedMovie}", methods={"PATCH"}); |
||
| 52 | * |
||
| 53 | * @param UserWatchedMovie $watchedMovie |
||
| 54 | * @param UpdateWatchedMovieRequest $request |
||
| 55 | * @param WatchedMovieService $watchedMovieService |
||
| 56 | * |
||
| 57 | * @throws \Exception |
||
| 58 | * |
||
| 59 | * @return JsonResponse |
||
| 60 | */ |
||
| 61 | 1 | public function patchWatchedMoviesById(UserWatchedMovie $watchedMovie, UpdateWatchedMovieRequest $request, WatchedMovieService $watchedMovieService) |
|
| 62 | { |
||
| 63 | 1 | $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY'); |
|
| 64 | |||
| 65 | 1 | if ($watchedMovie->getUser()->getId() !== $this->getUser()->getId()) { |
|
| 66 | throw new AccessDeniedHttpException(); |
||
| 67 | } |
||
| 68 | |||
| 69 | 1 | $watchedMovieDTO = $request->getWatchedMovieDTO(); |
|
| 70 | 1 | $watchedMovieService->updateUserWatchedMovie($watchedMovie, $watchedMovieDTO); |
|
| 71 | |||
| 72 | 1 | $this->getDoctrine()->getManager()->flush(); |
|
| 73 | |||
| 74 | 1 | return new JsonResponse(null, 200); |
|
| 75 | } |
||
| 76 | |||
| 77 | /** |
||
| 78 | * @Route("/api/users/{user}/watchedMovies/movie/{movieId}", methods={"PATCH"}); |
||
| 79 | * |
||
| 80 | * @param int $movieId |
||
| 81 | * @param UpdateWatchedMovieRequest $request |
||
| 82 | * @param WatchedMovieService $watchedMovieService |
||
| 83 | * |
||
| 84 | * @throws \Exception |
||
| 85 | * |
||
| 86 | * @return JsonResponse |
||
| 87 | */ |
||
| 88 | 1 | public function patchWatchedMoviesByMovieId(int $movieId, UpdateWatchedMovieRequest $request, WatchedMovieService $watchedMovieService, WatchedMovieRepository $repository) |
|
| 89 | { |
||
| 90 | 1 | $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY'); |
|
| 91 | |||
| 92 | /** @var $user User */ |
||
| 93 | 1 | $user = $this->getUser(); |
|
| 94 | |||
| 95 | 1 | if (null === $watchedMovie = $repository->findOneByMovieId($movieId, $user->getId())) { |
|
| 96 | throw new NotFoundHttpException(); |
||
| 97 | } |
||
| 98 | |||
| 99 | 1 | $watchedMovieDTO = $request->getWatchedMovieDTO(); |
|
| 100 | 1 | $watchedMovieService->updateUserWatchedMovie($watchedMovie, $watchedMovieDTO); |
|
| 101 | |||
| 102 | 1 | $this->getDoctrine()->getManager()->flush(); |
|
| 103 | |||
| 104 | 1 | return new JsonResponse(null, 200); |
|
| 105 | } |
||
| 106 | |||
| 107 | /** |
||
| 108 | * @Route("/api/users/{id<\d+>}/watchedMovies", methods={"GET"}); |
||
| 109 | * |
||
| 110 | * @param Request $request |
||
| 111 | * @param User $profileOwner |
||
| 112 | * @param MovieRepository $repository |
||
| 113 | * |
||
| 114 | * @throws |
||
| 115 | * |
||
| 116 | * @return JsonResponse |
||
| 117 | */ |
||
| 118 | 2 | public function getAll(Request $request, User $profileOwner, MovieRepository $repository) |
|
| 119 | { |
||
| 120 | 2 | $offset = (int) $request->get('offset', 0); |
|
| 121 | 2 | $limit = $request->get('limit', null); |
|
| 122 | |||
| 123 | 2 | $currentUser = $this->getUser(); |
|
| 124 | |||
| 125 | 2 | [$items, $ids, $count] = $repository->getAllWatchedMoviesByUserId($profileOwner, $currentUser); |
|
|
0 ignored issues
–
show
|
|||
| 126 | 2 | $collection = new CustomPaginatedCollection($items, $ids, $count, $offset, $limit); |
|
| 127 | |||
| 128 | 2 | return $this->items($collection, MovieTransformer::list()); |
|
| 129 | } |
||
| 130 | |||
| 131 | /** |
||
| 132 | * @Route("/api/users/{user}/watchedMovies/{watchedMovieId}", methods={"DELETE"}); |
||
| 133 | * |
||
| 134 | * @param int $watchedMovieId |
||
| 135 | * @param WatchedMovieRepository $repository |
||
| 136 | * |
||
| 137 | * @return JsonResponse |
||
| 138 | */ |
||
| 139 | public function deleteWatchedMovies(int $watchedMovieId, WatchedMovieRepository $repository) |
||
| 140 | { |
||
| 141 | $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY'); |
||
| 142 | |||
| 143 | /** @var $currentUser User */ |
||
| 144 | $currentUser = $this->getUser(); |
||
| 145 | |||
| 146 | if (null === $watchedMovie = $repository->findOneById($watchedMovieId, $currentUser->getId())) { |
||
| 147 | $watchedMovie = $repository->findOneByMovieId($watchedMovieId, $currentUser->getId()); |
||
| 148 | } |
||
| 149 | |||
| 150 | if (null === $watchedMovie) { |
||
| 151 | throw new NotFoundHttpException(); |
||
| 152 | } |
||
| 153 | |||
| 154 | $this->getDoctrine()->getManager()->remove($watchedMovie); |
||
| 155 | $this->getDoctrine()->getManager()->flush(); |
||
| 156 | |||
| 157 | return new JsonResponse(null, 202); |
||
| 158 | } |
||
| 159 | |||
| 160 | /** |
||
| 161 | * @Route("/api/users/mergeWatchedMovies", methods={"POST"}); |
||
| 162 | * |
||
| 163 | * @param MergeWatchedMoviesRequest $mergeWatchedMoviesRequest |
||
| 164 | * @param WatchedMovieService $watchedMovieService |
||
| 165 | * |
||
| 166 | * @throws \Exception |
||
| 167 | * |
||
| 168 | * @return JsonResponse |
||
| 169 | */ |
||
| 170 | public function postMergeWatchedMovies(MergeWatchedMoviesRequest $mergeWatchedMoviesRequest, WatchedMovieService $watchedMovieService) |
||
| 171 | { |
||
| 172 | $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY'); |
||
| 173 | $guestSessionRepository = $this->getDoctrine()->getRepository(GuestSession::class); |
||
| 174 | $guestSession = $guestSessionRepository->findOneBy([ |
||
| 175 | 'token' => $mergeWatchedMoviesRequest->get('token'), |
||
| 176 | ]); |
||
| 177 | |||
| 178 | /** @var $guestSession GuestSession|null */ |
||
| 179 | if ($guestSession === null) { |
||
| 180 | throw new NotFoundHttpException('Guest session not found by provided token'); |
||
| 181 | } |
||
| 182 | |||
| 183 | $watchedMovieService->mergeWatchedMovies($guestSession, $this->getUser()); |
||
|
0 ignored issues
–
show
$this->getUser() is of type null|object, but the function expects a object<App\Users\Entity\User>.
It seems like the type of the argument is not accepted by the function/method which you are calling. In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug. We suggest to add an explicit type cast like in the following example: function acceptsInteger($int) { }
$x = '123'; // string "123"
// Instead of
acceptsInteger($x);
// we recommend to use
acceptsInteger((integer) $x);
Loading history...
|
|||
| 184 | |||
| 185 | return new JsonResponse(null, 202); |
||
| 186 | } |
||
| 187 | } |
||
| 188 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: