writesdown /
app-cms
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * @link http://www.writesdown.com/ |
||
| 4 | * @copyright Copyright (c) 2015 WritesDown |
||
| 5 | * @license http://www.writesdown.com/license/ |
||
| 6 | */ |
||
| 7 | |||
| 8 | namespace backend\controllers; |
||
| 9 | |||
| 10 | use common\models\LoginForm; |
||
| 11 | use common\models\Option; |
||
| 12 | use common\models\PasswordResetRequestForm; |
||
| 13 | use common\models\Post; |
||
| 14 | use common\models\PostComment; |
||
| 15 | use common\models\ResetPasswordForm; |
||
| 16 | use common\models\SignupForm; |
||
| 17 | use common\models\User; |
||
| 18 | use Yii; |
||
| 19 | use yii\base\InvalidParamException; |
||
| 20 | use yii\filters\AccessControl; |
||
| 21 | use yii\filters\VerbFilter; |
||
| 22 | use yii\web\BadRequestHttpException; |
||
| 23 | use yii\web\Controller; |
||
| 24 | use yii\web\ForbiddenHttpException; |
||
| 25 | use yii\web\NotFoundHttpException; |
||
| 26 | |||
| 27 | /** |
||
| 28 | * Site controller. |
||
| 29 | * |
||
| 30 | * @author Agiel K. Saputra <[email protected]> |
||
| 31 | * @since 0.1.0 |
||
| 32 | */ |
||
| 33 | class SiteController extends Controller |
||
| 34 | { |
||
| 35 | /** |
||
| 36 | * @inheritdoc |
||
| 37 | */ |
||
| 38 | public function behaviors() |
||
| 39 | { |
||
| 40 | return [ |
||
| 41 | 'access' => [ |
||
| 42 | 'class' => AccessControl::className(), |
||
| 43 | 'rules' => [ |
||
| 44 | [ |
||
| 45 | 'actions' => [ |
||
| 46 | 'login', |
||
| 47 | 'request-password-reset', |
||
| 48 | 'reset-password', |
||
| 49 | 'forbidden', |
||
| 50 | 'not-found', |
||
| 51 | 'terms', |
||
| 52 | ], |
||
| 53 | 'allow' => true, |
||
| 54 | ], |
||
| 55 | [ |
||
| 56 | 'actions' => ['logout', 'index', 'error'], |
||
| 57 | 'allow' => true, |
||
| 58 | 'roles' => ['@'], |
||
| 59 | ], |
||
| 60 | [ |
||
| 61 | 'actions' => ['signup'], |
||
| 62 | 'allow' => true, |
||
| 63 | 'matchCallback' => function () { |
||
| 64 | return Option::get('allow_signup') && Yii::$app->user->isGuest; |
||
| 65 | }, |
||
| 66 | ], |
||
| 67 | ], |
||
| 68 | ], |
||
| 69 | 'verbs' => [ |
||
| 70 | 'class' => VerbFilter::className(), |
||
| 71 | 'actions' => [ |
||
| 72 | 'logout' => ['post'], |
||
| 73 | ], |
||
| 74 | ], |
||
| 75 | ]; |
||
| 76 | } |
||
| 77 | |||
| 78 | /** |
||
| 79 | * @inheritdoc |
||
| 80 | */ |
||
| 81 | public function actions() |
||
| 82 | { |
||
| 83 | return [ |
||
| 84 | 'error' => [ |
||
| 85 | 'class' => 'yii\web\ErrorAction', |
||
| 86 | ], |
||
| 87 | ]; |
||
| 88 | } |
||
| 89 | |||
| 90 | /** |
||
| 91 | * Show user count, post count, post-comment count on index (dashboard). |
||
| 92 | * |
||
| 93 | * @return string |
||
| 94 | */ |
||
| 95 | public function actionIndex() |
||
| 96 | { |
||
| 97 | // Get list User model |
||
| 98 | $userQuery = User::find()->andWhere(['status' => '10']); |
||
| 99 | $userCloneQuery = clone $userQuery; |
||
| 100 | $userCount = $userCloneQuery->count(); |
||
| 101 | $users = $userQuery->limit(8)->orderBy(['id' => SORT_DESC])->all(); |
||
| 102 | // Get list Post model |
||
| 103 | $postQuery = Post::find()->andWhere(['status' => 'publish'])->andWhere(['<=', 'date', date('Y-m-d H:i:s')]); |
||
| 104 | $postCloneQuery = clone $postQuery; |
||
| 105 | $postCount = $postCloneQuery->count(); |
||
| 106 | $posts = $postQuery->limit(5)->orderBy(['id' => SORT_DESC])->all(); |
||
| 107 | // Get list PostComment model |
||
| 108 | $commentQuery = PostComment::find()->andWhere(['status' => 'approved']); |
||
| 109 | $commentCloneQuery = clone $commentQuery; |
||
| 110 | $commentCount = $commentCloneQuery->count(); |
||
| 111 | $comments = $commentQuery->limit(3)->orderBy(['id' => SORT_DESC])->all(); |
||
| 112 | |||
| 113 | return $this->render('index', [ |
||
| 114 | 'users' => $users, |
||
| 115 | 'posts' => $posts, |
||
| 116 | 'comments' => $comments, |
||
| 117 | 'userCount' => $userCount, |
||
| 118 | 'postCount' => $postCount, |
||
| 119 | 'commentCount' => $commentCount, |
||
| 120 | ]); |
||
| 121 | } |
||
| 122 | |||
| 123 | /** |
||
| 124 | * Show login page and process login page. |
||
| 125 | * |
||
| 126 | * @return string|\yii\web\Response |
||
| 127 | */ |
||
| 128 | public function actionLogin() |
||
| 129 | { |
||
| 130 | // Set layout and bodyClass for login-page |
||
| 131 | $this->layout = 'blank'; |
||
| 132 | Yii::$app->params['bodyClass'] = 'login-page'; |
||
| 133 | |||
| 134 | if (!Yii::$app->user->isGuest) { |
||
| 135 | return $this->goHome(); |
||
| 136 | } |
||
| 137 | |||
| 138 | $model = new LoginForm(); |
||
| 139 | |||
| 140 | if ($model->load(Yii::$app->request->post()) && $model->login()) { |
||
| 141 | return $this->goBack(); |
||
| 142 | } |
||
| 143 | |||
| 144 | return $this->render('login', [ |
||
| 145 | 'model' => $model, |
||
| 146 | ]); |
||
| 147 | } |
||
| 148 | |||
| 149 | /** |
||
| 150 | * Logout for current user and redirect to home of backend. |
||
| 151 | * |
||
| 152 | * @return \yii\web\Response |
||
| 153 | */ |
||
| 154 | public function actionLogout() |
||
| 155 | { |
||
| 156 | Yii::$app->user->logout(); |
||
| 157 | |||
| 158 | return $this->goHome(); |
||
| 159 | } |
||
| 160 | |||
| 161 | /** |
||
| 162 | * Show signup for guest to register on site while Option::get('allow_signup') is true. |
||
| 163 | * |
||
| 164 | * @return string|\yii\web\Response |
||
| 165 | */ |
||
| 166 | public function actionSignup() |
||
| 167 | { |
||
| 168 | // Set layout and body class of register-page |
||
| 169 | $this->layout = 'blank'; |
||
| 170 | Yii::$app->params['bodyClass'] = 'register-page'; |
||
| 171 | $model = new SignupForm(); |
||
| 172 | |||
| 173 | if ($model->load(Yii::$app->request->post())) { |
||
| 174 | if ($user = $model->signup()) { |
||
| 175 | if (Yii::$app->getUser()->login($user)) { |
||
|
0 ignored issues
–
show
|
|||
| 176 | return $this->goHome(); |
||
| 177 | } |
||
| 178 | } |
||
| 179 | } |
||
| 180 | |||
| 181 | return $this->render('signup', [ |
||
| 182 | 'model' => $model, |
||
| 183 | ]); |
||
| 184 | } |
||
| 185 | |||
| 186 | /** |
||
| 187 | * Generate and send token to user's email for resetting password. |
||
| 188 | * |
||
| 189 | * @return string|\yii\web\Response |
||
| 190 | */ |
||
| 191 | public function actionRequestPasswordReset() |
||
| 192 | { |
||
| 193 | // Change layout and body class of register page |
||
| 194 | $this->layout = 'blank'; |
||
| 195 | Yii::$app->params['bodyClass'] = 'register-page'; |
||
| 196 | $model = new PasswordResetRequestForm(); |
||
| 197 | |||
| 198 | if ($model->load(Yii::$app->request->post()) && $model->validate()) { |
||
| 199 | if ($model->sendEmail()) { |
||
| 200 | Yii::$app->getSession()->setFlash('success', 'Check your email for further instructions.'); |
||
|
0 ignored issues
–
show
The method
getSession does only exist in yii\web\Application, but not in yii\console\Application.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 201 | |||
| 202 | return $this->goHome(); |
||
| 203 | } else { |
||
| 204 | Yii::$app->getSession()->setFlash( |
||
| 205 | 'error', |
||
| 206 | 'Sorry, we are unable to reset password for email provided.' |
||
| 207 | ); |
||
| 208 | } |
||
| 209 | } |
||
| 210 | |||
| 211 | return $this->render('request-password-reset-token', [ |
||
| 212 | 'model' => $model, |
||
| 213 | ]); |
||
| 214 | } |
||
| 215 | |||
| 216 | /** |
||
| 217 | * Show reset password. It requires param $token that generated on actionRequestPasswordReset which is sent to |
||
| 218 | * user's email. |
||
| 219 | * |
||
| 220 | * @param $token |
||
| 221 | * @return string|\yii\web\Response |
||
| 222 | * @throws \yii\web\BadRequestHttpException |
||
| 223 | */ |
||
| 224 | public function actionResetPassword($token) |
||
| 225 | { |
||
| 226 | // Change layout and body class of reset password page |
||
| 227 | $this->layout = 'blank'; |
||
| 228 | Yii::$app->params['bodyClass'] = 'register-page'; |
||
| 229 | |||
| 230 | try { |
||
| 231 | $model = new ResetPasswordForm($token); |
||
| 232 | } catch (InvalidParamException $e) { |
||
| 233 | throw new BadRequestHttpException($e->getMessage()); |
||
| 234 | } |
||
| 235 | |||
| 236 | if ($model->load(Yii::$app->request->post()) && $model->validate() && $model->resetPassword()) { |
||
| 237 | Yii::$app->getSession()->setFlash('success', 'New password was saved.'); |
||
|
0 ignored issues
–
show
The method
getSession does only exist in yii\web\Application, but not in yii\console\Application.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 238 | |||
| 239 | return $this->goHome(); |
||
| 240 | } |
||
| 241 | |||
| 242 | return $this->render('reset-password', [ |
||
| 243 | 'model' => $model, |
||
| 244 | ]); |
||
| 245 | } |
||
| 246 | |||
| 247 | /** |
||
| 248 | * Render term and condition |
||
| 249 | */ |
||
| 250 | public function actionTerms() |
||
| 251 | { |
||
| 252 | $this->layout = 'blank'; |
||
| 253 | Yii::$app->params['bodyClass'] = 'skin-blue layout-boxed sidebar-mini'; |
||
| 254 | |||
| 255 | return $this->render('terms'); |
||
| 256 | } |
||
| 257 | |||
| 258 | /** |
||
| 259 | * @throws \yii\web\ForbiddenHttpException |
||
| 260 | */ |
||
| 261 | public function actionForbidden() |
||
| 262 | { |
||
| 263 | throw new ForbiddenHttpException(Yii::t('writesdown', 'You are not allowed to perform this action.')); |
||
| 264 | } |
||
| 265 | |||
| 266 | /** |
||
| 267 | * @throws \yii\web\NotFoundHttpException |
||
| 268 | */ |
||
| 269 | public function actionNotFound() |
||
| 270 | { |
||
| 271 | throw new NotFoundHttpException(Yii::t('writesdown', 'Page not found')); |
||
| 272 | } |
||
| 273 | } |
||
| 274 |
It seems like the method you are trying to call exists only in some of the possible types.
Let’s take a look at an example:
Available Fixes
Add an additional type-check:
Only allow a single type to be passed if the variable comes from a parameter: