This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * This file is part of yii2-imperavi-widget. |
||
4 | * |
||
5 | * For the full copyright and license information, please view the LICENSE |
||
6 | * file that was distributed with this source code. |
||
7 | * |
||
8 | * @see https://github.com/vova07/yii2-imperavi-widget |
||
9 | */ |
||
10 | |||
11 | namespace vova07\imperavi; |
||
12 | |||
13 | use Yii; |
||
14 | use yii\base\InvalidConfigException; |
||
15 | use yii\base\Model; |
||
16 | use yii\base\Widget as BaseWidget; |
||
17 | use yii\helpers\ArrayHelper; |
||
18 | use yii\helpers\Html; |
||
19 | use yii\helpers\Json; |
||
20 | use yii\web\JsExpression; |
||
21 | |||
22 | /** |
||
23 | * Imperavi Redactor widget. |
||
24 | * |
||
25 | * @property array $settings JS Redactor settings |
||
26 | * @property string|null $selector Textarea selector |
||
27 | * @property array $plugins JS Redactor plugins |
||
28 | * |
||
29 | * @author Vasile Crudu <[email protected]> |
||
30 | * |
||
31 | * @link https://github.com/vova07/yii2-imperavi-widget |
||
32 | * @link https://imperavi.com/assets/pdf/redactor-documentation-10.pdf |
||
33 | * |
||
34 | * @license https://github.com/vova07/yii2-imperavi-widget/blob/master/LICENSE.md |
||
35 | */ |
||
36 | class Widget extends BaseWidget |
||
37 | { |
||
38 | /** Name of inline JavaScript package that is registered by the widget */ |
||
39 | const INLINE_JS_KEY = 'vova07/imperavi/'; |
||
40 | |||
41 | /** |
||
42 | * @var Model|null The data model that this widget is associated with. |
||
43 | */ |
||
44 | public $model; |
||
45 | |||
46 | /** |
||
47 | * @var string|null The model attribute that this widget is associated with. |
||
48 | */ |
||
49 | public $attribute; |
||
50 | |||
51 | /** |
||
52 | * @var string|null The input name. This must be set if `model` and `attribute` are not set. |
||
53 | */ |
||
54 | public $name; |
||
55 | |||
56 | /** |
||
57 | * @var string|null The input value. |
||
58 | */ |
||
59 | public $value; |
||
60 | |||
61 | /** |
||
62 | * @var string|null Selector pointing to textarea to initialize redactor for. |
||
63 | * Defaults to `null` meaning that textarea does not exist yet and will be rendered by this widget. |
||
64 | */ |
||
65 | public $selector; |
||
66 | |||
67 | /** |
||
68 | * @var array The HTML attribute options for the input tag. |
||
69 | * |
||
70 | * @see \yii\helpers\Html::renderTagAttributes() for details on how attributes are being rendered. |
||
71 | */ |
||
72 | public $options = []; |
||
73 | |||
74 | /** |
||
75 | * @var array {@link https://imperavi.com/assets/pdf/redactor-documentation-10.pdf redactor options} to manage the redactor itself. |
||
76 | */ |
||
77 | public $settings = []; |
||
78 | |||
79 | /** |
||
80 | * @var array Default settings that will be merged with {@link $settings}. Useful with DI container. |
||
81 | */ |
||
82 | public $defaultSettings = []; |
||
83 | |||
84 | /** |
||
85 | * This property must be used only for registering widget's custom plugins. |
||
86 | * The `key` is the name of the plugin, and the `value` must be the class name of the plugin bundle. |
||
87 | * |
||
88 | * @var array Widget custom plugins ['key' => 'value'] array. |
||
89 | * |
||
90 | * @example `['my-custom-plugin' => MyCustomPlugin::className(), ...]` |
||
91 | */ |
||
92 | public $plugins = []; |
||
93 | |||
94 | /** |
||
95 | * @var boolean Whether to render the `textarea` or not. |
||
96 | */ |
||
97 | private $_renderTextarea = true; |
||
98 | |||
99 | /** |
||
100 | * @inheritdoc |
||
101 | */ |
||
102 | 42 | public function init() |
|
103 | { |
||
104 | 42 | if ($this->name === null && $this->selector === null && !$this->hasModel()) { |
|
105 | 3 | throw new InvalidConfigException("Either 'name', or 'model' and 'attribute' properties must be specified."); |
|
106 | } |
||
107 | 39 | if (!isset($this->options['id'])) { |
|
108 | 27 | $this->options['id'] = $this->hasModel() ? Html::getInputId($this->model, $this->attribute) : $this->getId(); |
|
0 ignored issues
–
show
|
|||
109 | 9 | } |
|
110 | 39 | if (!empty($this->defaultSettings)) { |
|
111 | 3 | $this->settings = ArrayHelper::merge($this->defaultSettings, $this->settings); |
|
112 | 1 | } |
|
113 | 39 | if (isset($this->settings['plugins']) && !is_array($this->settings['plugins']) || !is_array($this->plugins)) { |
|
114 | 6 | throw new InvalidConfigException('The "plugins" property must be an array.'); |
|
115 | } |
||
116 | 33 | if (!isset($this->settings['lang']) && Yii::$app->language !== 'en-US') { |
|
117 | 3 | $this->settings['lang'] = substr(Yii::$app->language, 0, 2); |
|
118 | 1 | } |
|
119 | 33 | if ($this->selector === null) { |
|
120 | 30 | $this->selector = '#' . $this->options['id']; |
|
121 | 10 | } else { |
|
122 | 6 | $this->_renderTextarea = false; |
|
123 | } |
||
124 | |||
125 | // @codeCoverageIgnoreStart |
||
126 | $request = Yii::$app->getRequest(); |
||
127 | |||
128 | if ($request->enableCsrfValidation) { |
||
129 | $this->settings['uploadImageFields'][$request->csrfParam] = $request->getCsrfToken(); |
||
130 | $this->settings['uploadFileFields'][$request->csrfParam] = $request->getCsrfToken(); |
||
131 | } |
||
132 | // @codeCoverageIgnoreEnd |
||
133 | |||
134 | 33 | parent::init(); |
|
135 | 33 | } |
|
136 | |||
137 | /** |
||
138 | * @inheritdoc |
||
139 | */ |
||
140 | 18 | public function run() |
|
141 | { |
||
142 | 18 | $this->register(); |
|
143 | |||
144 | 18 | if ($this->_renderTextarea === true) { |
|
145 | 15 | if ($this->hasModel()) { |
|
146 | 9 | return Html::activeTextarea($this->model, $this->attribute, $this->options); |
|
0 ignored issues
–
show
It seems like
$this->model can be null ; however, activeTextarea() does not accept null , maybe add an additional type check?
Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: /** @return stdClass|null */
function mayReturnNull() { }
function doesNotAcceptNull(stdClass $x) { }
// With potential error.
function withoutCheck() {
$x = mayReturnNull();
doesNotAcceptNull($x); // Potential error here.
}
// Safe - Alternative 1
function withCheck1() {
$x = mayReturnNull();
if ( ! $x instanceof stdClass) {
throw new \LogicException('$x must be defined.');
}
doesNotAcceptNull($x);
}
// Safe - Alternative 2
function withCheck2() {
$x = mayReturnNull();
if ($x instanceof stdClass) {
doesNotAcceptNull($x);
}
}
![]() |
|||
147 | } else { |
||
148 | 6 | return Html::textarea($this->name, $this->value, $this->options); |
|
149 | } |
||
150 | } |
||
151 | |||
152 | 3 | return ''; |
|
153 | } |
||
154 | |||
155 | /** |
||
156 | * Register widget translations. |
||
157 | */ |
||
158 | 45 | public static function registerTranslations() |
|
159 | { |
||
160 | 45 | if (!isset(Yii::$app->i18n->translations['vova07/imperavi']) && !isset(Yii::$app->i18n->translations['vova07/imperavi*'])) { |
|
161 | 45 | Yii::$app->i18n->translations['vova07/imperavi'] = [ |
|
162 | 15 | 'class' => 'yii\i18n\PhpMessageSource', |
|
163 | 15 | 'basePath' => '@vova07/imperavi/messages', |
|
164 | 15 | 'forceTranslation' => true, |
|
165 | 'fileMap' => [ |
||
166 | 15 | 'vova07/imperavi' => 'imperavi.php', |
|
167 | 15 | ], |
|
168 | ]; |
||
169 | 15 | } |
|
170 | 45 | } |
|
171 | |||
172 | /** |
||
173 | * @return boolean whether this widget is associated with a data model. |
||
174 | */ |
||
175 | 42 | protected function hasModel() |
|
176 | { |
||
177 | 42 | return $this->model instanceof Model && $this->attribute !== null; |
|
178 | } |
||
179 | |||
180 | /** |
||
181 | * Register all widget logic. |
||
182 | */ |
||
183 | 18 | protected function register() |
|
184 | { |
||
185 | 18 | self::registerTranslations(); |
|
186 | 18 | $this->registerDefaultCallbacks(); |
|
187 | 18 | $this->registerClientScripts(); |
|
188 | 18 | } |
|
189 | |||
190 | /** |
||
191 | * Register default callbacks. |
||
192 | */ |
||
193 | 21 | protected function registerDefaultCallbacks() |
|
194 | { |
||
195 | 21 | if (isset($this->settings['imageUpload']) && !isset($this->settings['imageUploadErrorCallback'])) { |
|
196 | 3 | $message = Yii::t('vova07/imperavi', 'ERROR_DURING_UPLOAD_PROCESS'); |
|
197 | |||
198 | 3 | $this->settings['imageUploadErrorCallback'] = new JsExpression('function (response) { alert("' . $message . '"); }'); |
|
199 | 1 | } |
|
200 | 21 | if (isset($this->settings['fileUpload']) && !isset($this->settings['fileUploadErrorCallback'])) { |
|
201 | 3 | $message = Yii::t('vova07/imperavi', 'ERROR_DURING_UPLOAD_PROCESS'); |
|
202 | |||
203 | 3 | $this->settings['fileUploadErrorCallback'] = new JsExpression('function (response) { alert("' . $message . '"); }'); |
|
204 | 1 | } |
|
205 | 21 | } |
|
206 | |||
207 | /** |
||
208 | * Register widget asset. |
||
209 | */ |
||
210 | 24 | protected function registerClientScripts() |
|
211 | { |
||
212 | 24 | $view = $this->getView(); |
|
213 | /** @var Asset $asset */ |
||
214 | 24 | $asset = Yii::$container->get(Asset::className()); |
|
0 ignored issues
–
show
The method
yii\base\BaseObject::className() has been deprecated with message: since 2.0.14. On PHP >=5.5, use `::class` instead.
This method has been deprecated. The supplier of the class has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead. ![]() |
|||
215 | 24 | $asset = $asset::register($view); |
|
216 | |||
217 | 24 | if (isset($this->settings['lang'])) { |
|
218 | 6 | $asset->addLanguage($this->settings['lang']); |
|
219 | 2 | } |
|
220 | 24 | if (isset($this->settings['plugins'])) { |
|
221 | 3 | $asset->addPlugins($this->settings['plugins']); |
|
222 | 1 | } |
|
223 | 24 | if (!empty($this->plugins)) { |
|
224 | /** @var \yii\web\AssetBundle $bundle Asset bundle */ |
||
225 | 3 | foreach ($this->plugins as $plugin => $bundle) { |
|
226 | 3 | $this->settings['plugins'][] = $plugin; |
|
227 | 3 | $bundle::register($view); |
|
228 | 1 | } |
|
229 | 1 | } |
|
230 | |||
231 | 24 | $selector = Json::encode($this->selector); |
|
232 | 24 | $settings = !empty($this->settings) ? Json::encode($this->settings) : ''; |
|
233 | |||
234 | 24 | $view->registerJs("jQuery($selector).redactor($settings);", $view::POS_READY, self::INLINE_JS_KEY . $this->options['id']); |
|
235 | 24 | } |
|
236 | } |
||
237 |
Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: