This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace Dealer\Controller\Image; |
||
4 | |||
5 | use Dealer\Dealer; |
||
6 | use Dealer\Form\DealerImageBoxForm; |
||
7 | use Dealer\Form\DealerImageHeaderForm; |
||
8 | use Dealer\Model\DealerImage; |
||
9 | use Dealer\Model\DealerImageQuery; |
||
10 | use Thelia\Controller\Admin\FileController; |
||
11 | use Thelia\Core\Event\File\FileCreateOrUpdateEvent; |
||
12 | use Thelia\Core\Event\File\FileDeleteEvent; |
||
13 | use Thelia\Core\Event\TheliaEvents; |
||
14 | use Thelia\Core\Security\AccessManager; |
||
15 | use Thelia\Core\Security\Resource\AdminResources; |
||
16 | use Thelia\Log\Tlog; |
||
17 | use Thelia\Model\Lang; |
||
18 | use Thelia\Model\LangQuery; |
||
19 | use Thelia\Tools\URL; |
||
20 | |||
21 | class CustomImagesAdminController extends FileController |
||
22 | { |
||
23 | const MODULE_RIGHT = Dealer::DOMAIN_NAME; |
||
24 | const PRODUCT_IMAGE_PARENT_TYPE = 'dealer'; |
||
25 | |||
26 | public function updateProductImageHeader() |
||
27 | { |
||
28 | return $this->uploadProductFile(DealerImageHeaderForm::DEALER_IMAGE_HEADER_FORM_ID); |
||
29 | } |
||
30 | |||
31 | public function updateProductImageBox() |
||
32 | { |
||
33 | return $this->uploadProductFile(DealerImageBoxForm::DEALER_IMAGE_BOX_FORM_ID); |
||
34 | } |
||
35 | |||
36 | public function updateCustomImageAction($id, $parentId, $type) |
||
37 | { |
||
38 | try { |
||
39 | $this->registerDealerCustomProductImageType($type); |
||
40 | if (null !== $response = $this->checkAccessForParentType(AccessManager::UPDATE)) { |
||
41 | return $response; |
||
42 | } |
||
43 | return $this->updateFileAction($id, self::PRODUCT_IMAGE_PARENT_TYPE, $type, TheliaEvents::IMAGE_UPDATE); |
||
44 | } catch (\Exception $exception) { |
||
45 | Tlog::getInstance()->error($exception->getMessage()); |
||
46 | } |
||
47 | return $this |
||
48 | ->generateRedirect(URL::getInstance() |
||
49 | ->absoluteUrl(sprintf('/admin/module/dealer/image/%1$s/edit/%2$s/%3$s', $type, $parentId, $id)) |
||
50 | ); |
||
51 | } |
||
52 | |||
53 | /** |
||
54 | * @param $type |
||
55 | * @param $parentId |
||
56 | * @param $id |
||
57 | * @return mixed|\Thelia\Core\HttpFoundation\Response |
||
58 | * @throws \Exception |
||
59 | */ |
||
60 | public function editCustomImageAction($type, $parentId, $id) |
||
61 | { |
||
62 | $this->registerDealerCustomProductImageType($type); |
||
63 | if (null !== $response = $this->checkAccessForParentType(AccessManager::UPDATE)) { |
||
64 | return $response; |
||
65 | } |
||
66 | $fileManager = $this->getFileManager(); |
||
67 | $imageModel = $fileManager->getModelInstance($type, self::PRODUCT_IMAGE_PARENT_TYPE); |
||
68 | |||
69 | /** @var DealerImage $image */ |
||
70 | $image = DealerImageQuery::create() |
||
71 | ->filterByType(DealerImage::getTypeIdFromLabel($type)) |
||
72 | ->findPk($id); |
||
73 | if ($image === null) { |
||
74 | return $this->pageNotFound(); |
||
75 | } |
||
76 | |||
77 | $redirectionUrl = '/admin/module/Dealer/dealer/edit?dealer_id=' . $parentId; |
||
78 | $redirectUrl = URL::getInstance()->absoluteUrl($redirectionUrl, ['current_tab' => 'images']); |
||
79 | |||
80 | return $this->render('custom-dealer-image-edit', array( |
||
81 | 'imageId' => $id, |
||
82 | 'imageType' => $type, |
||
83 | 'redirectUrl' => $redirectUrl, |
||
84 | 'parentId' => $parentId, |
||
85 | 'formId' => $imageModel->getUpdateFormId(), |
||
86 | )); |
||
87 | } |
||
88 | |||
89 | public function deleteCustomImageAction($type, $parentId, $id) |
||
90 | { |
||
91 | $message = null; |
||
92 | $this->registerDealerCustomProductImageType($type); |
||
93 | $this->checkAccessForParentType(AccessManager::UPDATE); |
||
94 | |||
95 | $fileManager = $this->getFileManager(); |
||
96 | $modelInstance = $fileManager->getModelInstance($type, self::PRODUCT_IMAGE_PARENT_TYPE); |
||
97 | $model = $modelInstance->getQueryInstance()->findPk($id); |
||
98 | if ($model == null) { |
||
99 | return $this->pageNotFound(); |
||
100 | } |
||
101 | // Feed event |
||
102 | $fileDeleteEvent = new FileDeleteEvent($model); |
||
103 | // Dispatch Event to the Action |
||
104 | try { |
||
105 | $this->dispatch(TheliaEvents::IMAGE_DELETE, $fileDeleteEvent); |
||
106 | $this->adminLogAppend( |
||
107 | $this->getAdminResources()->getResource(self::PRODUCT_IMAGE_PARENT_TYPE, ucfirst(Dealer::DOMAIN_NAME)), |
||
108 | $this->getTranslator()->trans( |
||
109 | 'Deleting %obj% for %id% with parent id %parentId%', |
||
110 | array( |
||
111 | '%obj%' => $type, |
||
112 | '%id%' => $fileDeleteEvent->getFileToDelete()->getId(), |
||
113 | '%parentId%' => $fileDeleteEvent->getFileToDelete()->getParentId(), |
||
114 | ) |
||
115 | ), |
||
116 | AccessManager::UPDATE, |
||
117 | $fileDeleteEvent->getFileToDelete()->getId() |
||
118 | ); |
||
119 | } catch (\Exception $e) { |
||
120 | $message = $this->getTranslator()->trans( |
||
121 | 'Fail to delete %obj% for %id% with parent id %parentId% (Exception : %e%)', |
||
122 | array( |
||
123 | '%obj%' => $type, |
||
124 | '%id%' => $fileDeleteEvent->getFileToDelete()->getId(), |
||
125 | '%parentId%' => $fileDeleteEvent->getFileToDelete()->getParentId(), |
||
126 | '%e%' => $e->getMessage() |
||
127 | ) |
||
128 | ); |
||
129 | } |
||
130 | if (null === $message) { |
||
131 | $message = $this->getTranslator()->trans( |
||
132 | '%obj%s deleted successfully', |
||
133 | ['%obj%' => ucfirst($type)], |
||
134 | Dealer::DOMAIN_NAME |
||
135 | ); |
||
136 | } |
||
137 | $this->adminLogAppend( |
||
138 | self::PRODUCT_IMAGE_PARENT_TYPE, |
||
139 | AccessManager::UPDATE, |
||
140 | $message, |
||
141 | $fileDeleteEvent->getFileToDelete()->getId() |
||
142 | ); |
||
143 | $redirectionUrl = '/admin/module/Dealer/dealer/edit?dealer_id=' . $parentId; |
||
144 | return $this->generateRedirect(URL::getInstance()->absoluteUrl($redirectionUrl, ['current_tab' => 'images'])); |
||
145 | } |
||
146 | |||
147 | private function uploadProductFile($formName) |
||
148 | { |
||
149 | if (null !== $response = $this->checkAuth(AdminResources::PRODUCT, [], AccessManager::UPDATE)) { |
||
150 | return $response; |
||
151 | } |
||
152 | return self::uploadFile($formName, true); |
||
153 | } |
||
154 | |||
155 | /** |
||
156 | * @param $formName |
||
157 | * @param $forProduct |
||
158 | * @return null|\Symfony\Component\HttpFoundation\Response |
||
159 | */ |
||
160 | private function uploadFile($formName, $forProduct) |
||
161 | { |
||
162 | $imageForm = $this->createForm($formName); |
||
163 | try { |
||
164 | $form = $this->validateForm($imageForm); |
||
165 | $imageFile = $form->get('file')->getData(); |
||
166 | if (is_null($imageFile)) { |
||
167 | /** @noinspection PhpTranslationKeyInspection */ |
||
168 | throw new \Exception($this->getTranslator()->trans('No files uploaded', [], Dealer::DOMAIN_NAME)); |
||
169 | } |
||
170 | $parentId = $form->get('parent_id')->getData(); |
||
171 | |||
172 | if ($forProduct) { |
||
173 | $fileModel = DealerImage::fromProductIdAndFormName($parentId, $formName); |
||
174 | } |
||
175 | |||
176 | $uploadDir = $fileModel->getUploadDir(); |
||
0 ignored issues
–
show
|
|||
177 | if (!file_exists($uploadDir)) { |
||
178 | mkdir($uploadDir, 0777, true); |
||
179 | } |
||
180 | |||
181 | $fileCreateOrUpdateEvent = new FileCreateOrUpdateEvent($parentId); |
||
182 | $fileCreateOrUpdateEvent->setModel($fileModel); |
||
183 | $fileCreateOrUpdateEvent->setUploadedFile($imageFile); |
||
184 | |||
185 | $this->dispatch( |
||
186 | TheliaEvents::IMAGE_SAVE, |
||
187 | $fileCreateOrUpdateEvent |
||
188 | ); |
||
189 | |||
190 | // Compensate issue #1005 |
||
191 | $langs = LangQuery::create()->find(); |
||
192 | |||
193 | /** @var Lang $lang */ |
||
194 | foreach ($langs as $lang) { |
||
195 | $pageProductImage = $fileCreateOrUpdateEvent->getModel(); |
||
196 | $pageProductImage->setLocale($lang->getLocale()); |
||
197 | $pageProductImage->setTitle(''); |
||
198 | $pageProductImage->save(); |
||
199 | } |
||
200 | |||
201 | return $this->generateSuccessRedirect($imageForm); |
||
202 | |||
203 | } catch (\Exception $e) { |
||
204 | Tlog::getInstance()->addError(sprintf("Failed to upload file with form %s error :%s", $formName, $e->getMessage())); |
||
205 | $error_message = $e->getMessage(); |
||
206 | $imageForm->setErrorMessage($error_message); |
||
207 | $this->getParserContext() |
||
208 | ->addForm($imageForm) |
||
209 | ->setGeneralError($error_message); |
||
210 | return $this->generateErrorRedirect($imageForm); |
||
211 | } |
||
212 | } |
||
213 | |||
214 | |||
215 | /** |
||
216 | * @param string $access |
||
217 | * @return mixed null if authorization is granted, or a Response object which contains the error page otherwise |
||
218 | */ |
||
219 | protected function checkAccessForParentType($access) |
||
220 | { |
||
221 | return $this->checkAuth(AdminResources::MODULE, [Dealer::DOMAIN_NAME], $access); |
||
222 | } |
||
223 | |||
224 | private function registerDealerCustomProductImageType($type) |
||
225 | { |
||
226 | /** @noinspection PhpParamsInspection */ |
||
227 | /** @noinspection PhpUnhandledExceptionInspection */ |
||
228 | $this->getAdminResources()->addModuleResources([strtoupper(self::PRODUCT_IMAGE_PARENT_TYPE) => "admin.Dealer"], ucfirst(static::MODULE_RIGHT)); |
||
229 | $this->getFileManager()->addFileModel( |
||
230 | $type, |
||
231 | self::PRODUCT_IMAGE_PARENT_TYPE, |
||
232 | DealerImage::class |
||
233 | ); |
||
234 | } |
||
235 | } |
If you define a variable conditionally, it can happen that it is not defined for all execution paths.
Let’s take a look at an example:
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined.
Available Fixes
Check for existence of the variable explicitly:
Define a default value for the variable:
Add a value for the missing path: