Issues (65)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Entity/User.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Vivait\AuthBundle\Entity;
4
5
use Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface;
6
use Symfony\Component\Security\Core\User\AdvancedUserInterface;
7
use Doctrine\ORM\Mapping as ORM;
8
use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
9
use Symfony\Component\Validator\Constraints as Assert;
10
use Doctrine\Common\Collections\ArrayCollection;
11
use Vivait\Common\Model\Footprint\UserInterface as FootprintUserInterface;
12
use JMS\Serializer\Annotation as Serializer;
13
14
/**
15
 * @ORM\Entity
16
 * @UniqueEntity("username")
17
 * @UniqueEntity("email")
18
 * @ORM\Table(name="Users")
19
 * @ORM\Entity(repositoryClass="Vivait\AuthBundle\Entity\UserRepository")
20
 */
21
class User implements AdvancedUserInterface, \Serializable, \JsonSerializable, FootprintUserInterface {
22
	const STATUS_UNKNOWN = 0;
23
	const STATUS_ONLINE  = 10;
24
	const STATUS_AWAY    = 11;
25
	const DEFAULT_GRAVATAR = 'wavatar';
26
27
	public static function getAllStatus() {
28
		$a = array(
29
			self::STATUS_ONLINE => 'Online',
30
			self::STATUS_AWAY   => 'Away',
31
		);
32
		return $a;
33
	}
34
35
	public function getStatusName() {
36
		foreach (self::getAllStatus() as $key => $value) {
37
			if ($key == $this->status) {
38
				return $value;
39
			}
40
		}
41
		return 'Unknown';
42
	}
43
44
	public function jsonSerialize() {
45
		return array(
46
			'id'       => $this->id,
47
			'initials' => $this->initials,
48
			'fullname' => $this->fullname,
49
			'username' => $this->username,
50
        'tenant'     => $this->current_tenant ? $this->current_tenant->jsonSerialize() : null,
51
			'gravatar' => $this->getGravatar(),
52
		);
53
	}
54
55
	public function __toString() {
56
		return $this->fullname;
57
	}
58
59
	/**
60
	 * @ORM\Column(name="id", type="guid")
61
	 * @ORM\Id
62
	 * @ORM\GeneratedValue(strategy="UUID")
63
	 * @Serializer\Groups({"basic"})
64
	 */
65
	private $id;
66
67
	/**
68
	 * @ORM\Column(type="string", length=25, unique=true)
69
	 * @Assert\Type(type="string")
70
	 * @Assert\NotBlank()
71
	 * @Assert\Length(min = "3", max="25");
72
     * @Serializer\Groups({"basic"})
73
	 */
74
	private $username;
75
76
	/**
77
	 * @ORM\Column(type="string", length=32)
78
	 */
79
	private $salt;
80
81
	/**
82
	 * @ORM\Column(type="string", length=88)
83
	 */
84
	private $password;
85
86
	/**
87
	 * @ORM\Column(type="string", length=60, unique=true)
88
	 * @Assert\Type(type="string")
89
	 * @Assert\NotBlank()
90
	 * @Assert\Email
91
	 * @Assert\Length(min = "3", max="60");
92
     * @Serializer\Groups({"basic"})
93
	 */
94
	private $email;
95
96
	/**
97
	 * @ORM\Column(type="string", length=60)
98
	 * @Assert\NotBlank()
99
	 * @Assert\Length(min = "3", max="60");
100
	 * @Assert\Type(type="string")
101
     * @Serializer\Groups({"basic"})
102
	 */
103
	private $fullname;
104
105
	/**
106
	 * @ORM\Column(type="string", length=10, nullable=true)
107
	 * @Assert\NotBlank()
108
	 * @Assert\Length(min = "2", max="10");
109
	 * @Assert\Type(type="string")
110
     * @Serializer\Groups({"basic"})
111
	 */
112
	private $initials;
113
114
	/**
115
	 * @ORM\Column(type="string", length=60, nullable=true)
116
	 * @Assert\Length(max="60");
117
	 * @Assert\Type(type="string")
118
     * @Serializer\Groups({"basic"})
119
	 */
120
	private $jobtitle;
121
122
	/**
123
	 * @ORM\Column(type="string", length=60, nullable=true)
124
	 * @Assert\Length(max="60");
125
	 * @Assert\Type(type="string")
126
     * @Serializer\Groups({"basic"})
127
	 */
128
	private $department;
129
130
	/**
131
	 * @ORM\Column(type="string", length=60, nullable=true)
132
	 * @Assert\Length(max="60");
133
	 * @Assert\Type(type="string")
134
     * @Serializer\Groups({"basic"})
135
	 */
136
	private $location;
137
138
	/**
139
	 * @ORM\Column(type="string", length=15, nullable=true)
140
	 * @Assert\Regex("^\+?[0-9]{11,15}*$")
141
     * @Serializer\Groups({"basic"})
142
	 */
143
	private $telephone;
144
145
	/**
146
	 * @var Group[]|ArrayCollection
147
	 * @ORM\ManyToMany(targetEntity="Vivait\AuthBundle\Entity\Group", inversedBy="users")
148
	 */
149
	private $groups;
150
151
	/**
152
	 * @ORM\ManyToMany(targetEntity="Vivait\AuthBundle\Entity\Tenant", inversedBy="users")
153
	 * @ORM\OrderBy({"priority" = "ASC", "tenant" = "ASC"})
154
	 */
155
	private $tenants;
156
157
	/**
158
	 * @var Tenant
159
	 * @ORM\ManyToOne(targetEntity="Vivait\AuthBundle\Entity\Tenant")
160
	 * @ORM\JoinColumn(name="current_tenant", referencedColumnName="id")
161
	 **/
162
	private $current_tenant;
163
164
	/**
165
	 * @ORM\Column(name="active", type="boolean")
166
	 */
167
	private $active;
168
169
	/**
170
	 * @var \DateTime
171
	 * @ORM\Column(name="lastactivity", type="datetime", nullable=true)
172
	 */
173
	private $lastactivity;
174
175
	/**
176
	 * @var \DateTime
177
	 * @ORM\Column(name="lastresponse", type="datetime", nullable=true)
178
	 */
179
	private $lastresponse;
180
181
	/**
182
	 * @var string
183
	 * @ORM\Column(name="lastip", type="string", length=46, nullable=true)
184
	 */
185
	private $lastip;
186
187
		/**
188
		 * @var string
189
		 * @ORM\Column(name="lasturl", type="string", length=255, nullable=true)
190
		 */
191
		private $lasturl;
192
193
		/**
194
		 * @var string
195
		 * @ORM\Column(name="lastua", type="string", length=255, nullable=true)
196
		 */
197
		private $lastua;
198
199
		/**
200
		 * @var integer
201
		 * @ORM\Column(name="status", type="integer", nullable=true)
202
		 */
203
		private $status;
204
205
	/**
206
	 * @ORM\Column(type="string", length=10, nullable=true)
207
	 */
208
	private $tfkey;
209
210
		private $gravatarhash;
211
212
	/**
213
	 * This is called once Doctrine has loaded the entity
214
	 * @ORM\PostLoad
215
	 */
216
217
#############################################
218
219
	public function __construct() {
220
		$this->newSalt();
221
		$this->active       = true;
222
		$this->groups       = new ArrayCollection();
223
		$this->tenants      = new ArrayCollection();
224
	}
225
226
	public function isAccountNonExpired() {
227
		return $this->isTenantLicensed();
228
	}
229
230
	public function isAccountNonLocked() {
231
		return true;
232
	}
233
234
	public function isCredentialsNonExpired() {
235
		return true;
236
	}
237
238
	public function isEnabled() {
239
		return $this->active && $this->isTenantActive();
240
	}
241
242
243
	private function isTenantActive() {
244
		foreach ($this->getTenants() as $tenant) {
245
			if ($tenant->getActive()) {
246
				return true;
247
			}
248
		}
249
		return false;
250
	}
251
252
	private function isTenantLicensed() {
253
		foreach ($this->getTenants() as $tenant) {
254
			if ($tenant->getLicenseduntil() > new \DateTime()) {
255
				return true;
256
			}
257
		}
258
		return false;
259
	}
260
261
	public function getLicensedUntil() {
0 ignored issues
show
The return type could not be reliably inferred; please add a @return annotation.

Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a @return annotation as described here.

Loading history...
262
		$licensed_until = new \DateTime('2000-01-01');
263
		foreach ($this->getTenants() as $tenant) {
264
			if ($tenant->getLicenseduntil() > $licensed_until) {
265
				$licensed_until = $tenant->getLicenseduntil();
266
			}
267
		}
268
		return $licensed_until;
269
	}
270
271
	/**
272
	 * @inheritDoc
273
	 */
274
	public function getUsername() {
275
		return $this->username;
276
	}
277
278
	public function newSalt() {
279
		$this->salt = md5(uniqid(null, true));
280
	}
281
282
	/**
283
	 * @inheritDoc
284
	 */
285
	public function getSalt() {
286
		return $this->salt;
287
	}
288
289
	/**
290
	 * @inheritDoc
291
	 */
292
	public function getPassword() {
293
		return $this->password;
294
	}
295
296
	/**
297
	 * @inheritDoc
298
	 */
299
	public function getRoles() {
300
		$roles = array();
301
		foreach ($this->groups as $role) {
302
			$roles[] = $role->getRole();
303
		}
304
305
			if($this->getCurrentTenant()) {
306
				foreach($this->getCurrentTenant()->getGroups() as $role) {
307
					$roles[] = $role->getRole();
308
				}
309
			}
310
			return $roles;
311
		}
312
313
	/**
314
	 * @inheritDoc
315
	 */
316
	public function eraseCredentials() {
317
	}
318
319
	/**
320
	 * @see \Serializable::serialize()
321
	 */
322
	public function serialize() {
323
		return serialize(array(
324
			$this->id,
325
			$this->active,
326
			$this->username
327
		));
328
	}
329
330
	/**
331
	 * @see \Serializable::unserialize()
332
	 */
333
	public function unserialize($serialized) {
334
		list (
335
			$this->id,
336
			$this->active,
337
			$this->username
338
			) = unserialize($serialized);
339
	}
340
341
	/**
342
	 * Get id
343
	 * @return integer
344
	 */
345
	public function getId() {
346
		return $this->id;
347
	}
348
349
	/**
350
	 * Set username
351
	 * @param string $username
352
	 * @return User
353
	 */
354
	public function setUsername($username) {
355
		$this->username = $username;
356
357
		return $this;
358
	}
359
360
361
	/**
362
	 * Set salt
363
	 * @param string $salt
364
	 * @return User
365
	 */
366
	public function setSalt($salt) {
367
		$this->salt = $salt;
368
369
		return $this;
370
	}
371
372
	/**
373
	 * Set password
374
	 * @param string $password
375
	 * @return User
376
	 */
377
	public function setPassword($password) {
378
		$this->password = $password;
379
380
		return $this;
381
	}
382
383
	/**
384
	 * Set email
385
	 * @param string $email
386
	 * @return User
387
	 */
388
	public function setEmail($email) {
389
		$this->email = $email;
390
391
		return $this;
392
	}
393
394
	/**
395
	 * Get email
396
	 * @return string
397
	 */
398
	public function getEmail() {
399
		return $this->email;
400
	}
401
402
	/**
403
	 * Set fullname
404
	 * @param string $fullname
405
	 * @return User
406
	 */
407
	public function setFullname($fullname) {
408
		$this->fullname = $fullname;
409
410
		return $this;
411
	}
412
413
	/**
414
	 * A helper method to get the tenanted full name
415
	 * @return string
416
	 */
417
	public function getTenantedFullname() {
418
		return $this->getFullname(true);
419
	}
420
421
	/**
422
	 * Get fullname
423
	 * @param $include_tenant boolean
424
	 * @return string
425
	 */
426
	public function getFullname($include_tenant = false) {
427
		$tenant = '';
428
429
		if ($include_tenant && ($tenants = $this->getTenants()) && $tenants->count()) {
430
431
			foreach ($tenants as $row) {
432
				$tenant .= $row->getCode() . ', ';
433
			}
434
435
			$tenant = '(' . substr($tenant, 0, -2) . ') ';
436
		}
437
438
		return $tenant . $this->fullname;
439
	}
440
441
442
	public function getForename() {
0 ignored issues
show
The return type could not be reliably inferred; please add a @return annotation.

Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a @return annotation as described here.

Loading history...
443
		$names = explode(' ', $this->fullname);
444
		return $names[0];
445
	}
446
447
	/**
448
	 * Set initials
449
	 * @param string $initials
450
	 * @return User
451
	 */
452
	public function setInitials($initials) {
453
		$this->initials = $initials;
454
455
		return $this;
456
	}
457
458
	/**
459
	 * Get initials
460
	 * @return string
461
	 */
462
	public function getInitials() {
463
		return $this->initials;
464
	}
465
466
	/**
467
	 * Set jobtitle
468
	 * @param string $jobtitle
469
	 * @return User
470
	 */
471
	public function setJobtitle($jobtitle) {
472
		$this->jobtitle = $jobtitle;
473
474
		return $this;
475
	}
476
477
	/**
478
	 * Get jobtitle
479
	 * @return string
480
	 */
481
	public function getJobtitle() {
482
		return $this->jobtitle;
483
	}
484
485
	/**
486
	 * Set department
487
	 * @param string $department
488
	 * @return User
489
	 */
490
	public function setDepartment($department) {
491
		$this->department = $department;
492
493
		return $this;
494
	}
495
496
	/**
497
	 * Get department
498
	 * @return string
499
	 */
500
	public function getDepartment() {
501
		return $this->department;
502
	}
503
504
	/**
505
	 * Set location
506
	 * @param string $location
507
	 * @return User
508
	 */
509
	public function setLocation($location) {
510
		$this->location = $location;
511
512
		return $this;
513
	}
514
515
	/**
516
	 * Get location
517
	 * @return string
518
	 */
519
	public function getLocation() {
520
		return $this->location;
521
	}
522
523
	/**
524
	 * Set telephone
525
	 * @param string $telephone
526
	 * @return User
527
	 */
528
	public function setTelephone($telephone) {
529
		$this->telephone = $telephone;
530
531
		return $this;
532
	}
533
534
	/**
535
	 * Get telephone
536
	 * @return string
537
	 */
538
	public function getTelephone() {
539
		return $this->telephone;
540
	}
541
542
	/**
543
	 * Set active
544
	 * @param boolean $active
545
	 * @return User
546
	 */
547
	public function setActive($active) {
548
		$this->active = $active;
549
550
		return $this;
551
	}
552
553
	/**
554
	 * Get active
555
	 * @return boolean
556
	 */
557
	public function getActive() {
558
		return $this->active;
559
	}
560
561
	/**
562
	 * Add groups
563
	 * @param Group $groups
564
	 * @return User
565
	 */
566
	public function addGroup(Group $groups) {
567
		$this->groups[] = $groups;
568
569
		return $this;
570
	}
571
572
	/**
573
	 * Remove groups
574
	 * @param Group $groups
575
	 */
576
	public function removeGroup(Group $groups) {
577
		$this->groups->removeElement($groups);
578
	}
579
580
	/**
581
	 * Get groups
582
	 * @return Group[]|ArrayCollection
583
	 */
584
	public function getGroups() {
585
		return $this->groups;
586
	}
587
588
589
	/**
590
	 * Add tenants
591
	 * @param Tenant $tenants
592
	 * @return User
593
	 */
594
	public function addTenant(Tenant $tenants) {
595
		$this->tenants[] = $tenants;
596
597
		return $this;
598
	}
599
600
	/**
601
	 * Remove tenants
602
	 * @param Tenant $tenants
603
	 */
604
	public function removeTenant(Tenant $tenants) {
605
		$this->tenants->removeElement($tenants);
606
	}
607
608
	/**
609
	 * Get tenants
610
	 * @return Tenant[]|ArrayCollection
611
	 */
612
	public function getTenants() {
613
		return $this->tenants;
614
	}
615
616
	/**
617
	 * Sets current_tenant
618
	 * @param Tenant $current_tenant
619
	 * @return $this
620
	 */
621
	public function setCurrentTenant(Tenant $current_tenant) {
622
		$this->current_tenant = $current_tenant;
623
		return $this;
624
	}
625
626
	/**
627
	 * @return Tenant
628
	 */
629
	public function getCurrentTenant() {
630
		return $this->current_tenant;
631
	}
632
633
	public function getAllowedTenants() {
634
		$current_tenant = $this->getCurrentTenant();
635
636
		// Restrict them to just the current tenant
637
		if ($current_tenant) {
638
			return array($current_tenant->getId());
639
		}
640
641
		$tenants = array();
642
643
		foreach ($this->getTenants() as $tenant) {
644
			$tenants[] = $tenant->getId();
645
		}
646
647
		return $tenants;
648
	}
649
650
	/**
651
	 * Set lastactivity
652
	 * @param \DateTime $lastactivity
653
	 * @return User
654
	 */
655
	public function setLastactivity($lastactivity) {
656
		$this->lastactivity = $lastactivity;
657
658
		return $this;
659
	}
660
661
	/**
662
	 * Get lastactivity
663
	 * @return \DateTime
664
	 */
665
	public function getLastactivity() {
666
		return $this->lastactivity;
667
	}
668
669
	/**
670
	 * Set status
671
	 * @param integer $status
672
	 * @return User
673
	 */
674
	public function setStatus($status) {
675
		$this->status = $status;
676
677
		return $this;
678
	}
679
680
	/**
681
	 * Get status
682
	 * @return integer
683
	 */
684
	public function getStatus() {
685
		return $this->status;
686
	}
687
688
	/**
689
	 * Set lastresponse
690
	 * @param \DateTime $lastresponse
691
	 * @return User
692
	 */
693
	public function setLastresponse($lastresponse) {
694
		$this->lastresponse = $lastresponse;
695
696
		return $this;
697
	}
698
699
	/**
700
	 * Get lastresponse
701
	 * @return \DateTime
702
	 */
703
	public function getLastresponse() {
704
		return $this->lastresponse;
705
	}
706
707
	/**
708
	 * Set Lastip
709
	 * @param string $lastip
710
	 * @return $this
711
	 */
712
	public function setLastip($lastip) {
713
		$this->lastip = $lastip;
714
		return $this;
715
	}
716
717
	/**
718
	 * Get Lastip
719
	 * @return string
720
	 */
721
	public function getLastip() {
722
		return $this->lastip;
723
	}
724
725
	/**
726
	 * Set tfkey
727
	 * @param string $tfkey
728
	 * @return User
729
	 */
730
	public function setTfkey($tfkey) {
731
		$this->tfkey = $tfkey;
732
733
		return $this;
734
	}
735
736
	/**
737
	 * Get tfkey
738
	 * @return string
739
	 */
740
	public function getTfkey() {
741
		return $this->tfkey;
742
	}
743
744
		public function getGravatarHash() {
0 ignored issues
show
The return type could not be reliably inferred; please add a @return annotation.

Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a @return annotation as described here.

Loading history...
745
			if (!$this->gravatarhash) {
746
				$this->gravatarhash = md5(strtolower(trim($this->email)));
747
			}
748
749
			return $this->gravatarhash;
750
		}
751
752
		public function getGravatar() {
753
			return sprintf('//www.gravatar.com/avatar/%s?d=%s',$this->getGravatarHash(), self::DEFAULT_GRAVATAR);
754
		}
755
		/**
756
		 * Get Lastua
757
		 * @return string
758
		 */
759
		public function getLastua() {
760
			return $this->lastua;
761
		}
762
		/**
763
		 * Set Lastua
764
		 * @param string $lastua
765
		 * @return $this
766
		 */
767
		public function setLastua($lastua) {
768
			$this->lastua = $lastua;
769
			return $this;
770
		}
771
		/**
772
		 * Get Lasturl
773
		 * @return string
774
		 */
775
		public function getLasturl() {
776
			return $this->lasturl;
777
		}
778
		/**
779
		 * Set Lasturl
780
		 * @param string $lasturl
781
		 * @return $this
782
		 */
783
		public function setLasturl($lasturl) {
784
			$this->lasturl = $lasturl;
785
			return $this;
786
		}
787
788
	public function hashPassword(EncoderFactoryInterface $encoder_factory){
789
		$this->newSalt();
790
		$encoder  = $encoder_factory->getEncoder( $this );
791
		$password = $encoder->encodePassword( $this->getPassword(), $this->getSalt() );
792
793
		$this->setPassword( $password );
794
	}
795
}
796