webmatch /
WbmTemplateManager
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * Template Manager |
||
| 4 | * Copyright (c) Webmatch GmbH |
||
| 5 | * |
||
| 6 | * This program is free software: you can redistribute it and/or modify |
||
| 7 | * it under the terms of the GNU General Public License as published by |
||
| 8 | * the Free Software Foundation, either version 3 of the License, or |
||
| 9 | * (at your option) any later version. |
||
| 10 | * |
||
| 11 | * This program is distributed in the hope that it will be useful, |
||
| 12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 14 | * GNU General Public License for more details. |
||
| 15 | */ |
||
| 16 | |||
| 17 | use Shopware\Components\CSRFWhitelistAware; |
||
| 18 | |||
| 19 | /** |
||
| 20 | * Class Shopware_Controllers_Backend_WbmTemplateManager |
||
| 21 | */ |
||
| 22 | class Shopware_Controllers_Backend_WbmTemplateManager extends Shopware_Controllers_Backend_ExtJs implements CSRFWhitelistAware |
||
|
0 ignored issues
–
show
|
|||
| 23 | { |
||
| 24 | |||
| 25 | public function indexAction() |
||
| 26 | { |
||
| 27 | $this->View()->loadTemplate("backend/wbm_template_manager/app.js"); |
||
| 28 | } |
||
| 29 | |||
| 30 | public function listAction() |
||
| 31 | { |
||
| 32 | $templateRoot = $this->container->getParameter('wbm_template_manager.plugin_dir') . '/Resources/views/responsive/'; |
||
| 33 | $baseTemplateRoot = $this->container->get('application')->DocPath() . 'themes/Frontend/Bare/'; |
||
| 34 | $name = $this->Request()->getParam('name', null); |
||
| 35 | |||
| 36 | $baseTemplates = new \RecursiveIteratorIterator( |
||
| 37 | new \RecursiveDirectoryIterator($baseTemplateRoot) |
||
| 38 | ); |
||
| 39 | |||
| 40 | $customTemplates = new \RecursiveIteratorIterator( |
||
| 41 | new \RecursiveDirectoryIterator($templateRoot) |
||
| 42 | ); |
||
| 43 | |||
| 44 | $data = []; |
||
| 45 | |||
| 46 | foreach($baseTemplates as $pathName => $baseTemplate) { |
||
| 47 | $namespace = str_replace($baseTemplateRoot, '', $pathName); |
||
| 48 | |||
| 49 | if ( |
||
| 50 | !$baseTemplate->isFile() || |
||
| 51 | pathinfo($pathName, PATHINFO_EXTENSION) != 'tpl' || |
||
| 52 | (!empty($name) && $name !== $namespace) |
||
| 53 | ) { |
||
| 54 | continue; |
||
| 55 | } |
||
| 56 | |||
| 57 | $data[$namespace] = [ |
||
| 58 | 'name' => $namespace, |
||
| 59 | 'content' => "{extends file='parent:" . $namespace . "'}", |
||
| 60 | 'oContent' => file_get_contents($pathName), |
||
| 61 | 'custom' => 0 |
||
| 62 | ]; |
||
| 63 | } |
||
| 64 | |||
| 65 | foreach($customTemplates as $pathName => $customTemplate) { |
||
| 66 | $namespace = str_replace($templateRoot, '', $pathName); |
||
| 67 | |||
| 68 | if ( |
||
| 69 | !$customTemplate->isFile() || |
||
| 70 | substr(basename($pathName), 0, 1) === '.' || |
||
| 71 | (!empty($name) && $name !== $namespace) |
||
| 72 | ) { |
||
| 73 | continue; |
||
| 74 | } |
||
| 75 | |||
| 76 | $data[$namespace] = [ |
||
| 77 | 'name' => $namespace, |
||
| 78 | 'content' => file_get_contents($pathName), |
||
| 79 | 'oContent' => isset($data[$namespace]['oContent']) ? $data[$namespace]['oContent'] : '', |
||
| 80 | 'custom' => 1 |
||
| 81 | ]; |
||
| 82 | } |
||
| 83 | |||
| 84 | ksort($data); |
||
| 85 | $data = array_values($data); |
||
| 86 | |||
| 87 | $this->View()->assign( |
||
| 88 | array('success' => true, 'data' => $data) |
||
| 89 | ); |
||
| 90 | } |
||
| 91 | |||
| 92 | public function createAction() |
||
| 93 | { |
||
| 94 | $this->save(); |
||
| 95 | } |
||
| 96 | |||
| 97 | public function updateAction() |
||
| 98 | { |
||
| 99 | $this->save(); |
||
| 100 | } |
||
| 101 | |||
| 102 | private function save() |
||
| 103 | { |
||
| 104 | $templateRoot = $this->container->getParameter('wbm_template_manager.plugin_dir') . '/Resources/views/responsive/'; |
||
| 105 | $name = ltrim($this->Request()->get('name'), '/'); |
||
| 106 | $content = $this->Request()->get('content'); |
||
| 107 | |||
| 108 | if (!empty($name)) { |
||
| 109 | $filePath = $templateRoot . $name; |
||
| 110 | $dirname = dirname($filePath); |
||
| 111 | |||
| 112 | if (!is_dir($dirname)) { |
||
| 113 | $dirParts = str_replace($templateRoot, '', $dirname); |
||
| 114 | $buildPath = rtrim($templateRoot, '/'); |
||
| 115 | foreach (explode('/', $dirParts) as $dirPart) { |
||
| 116 | $buildPath .= '/' . $dirPart; |
||
| 117 | if (!is_dir($buildPath)) { |
||
| 118 | mkdir($buildPath, 0777, true); |
||
| 119 | } |
||
| 120 | } |
||
| 121 | } |
||
| 122 | |||
| 123 | $file = fopen($filePath, "w"); |
||
| 124 | fwrite($file, $content); |
||
| 125 | fclose($file); |
||
| 126 | } |
||
| 127 | |||
| 128 | $this->View()->assign( |
||
| 129 | array( |
||
| 130 | 'success' => true |
||
| 131 | ) |
||
| 132 | ); |
||
| 133 | } |
||
| 134 | |||
| 135 | public function deleteAction() |
||
| 136 | { |
||
| 137 | $templateRoot = $this->container->getParameter('wbm_template_manager.plugin_dir') . '/Resources/views/responsive/'; |
||
| 138 | $name = $this->Request()->get('name'); |
||
| 139 | |||
| 140 | unlink($templateRoot . $name); |
||
| 141 | |||
| 142 | $this->View()->assign( |
||
| 143 | array('success' => true) |
||
| 144 | ); |
||
| 145 | } |
||
| 146 | |||
| 147 | /** |
||
| 148 | * @return array |
||
| 149 | */ |
||
| 150 | public function getWhitelistedCSRFActions() |
||
| 151 | { |
||
| 152 | return [ |
||
| 153 | 'list', |
||
| 154 | 'create', |
||
| 155 | 'update', |
||
| 156 | 'delete' |
||
| 157 | ]; |
||
| 158 | } |
||
| 159 | |||
| 160 | } |
||
| 161 | |||
| 162 |
You can fix this by adding a namespace to your class:
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.