This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * @link http://www.writesdown.com/ |
||
4 | * @copyright Copyright (c) 2015 WritesDown |
||
5 | * @license http://www.writesdown.com/license/ |
||
6 | */ |
||
7 | |||
8 | namespace common\models; |
||
9 | |||
10 | use Yii; |
||
11 | use yii\base\NotSupportedException; |
||
12 | use yii\db\ActiveRecord; |
||
13 | use yii\db\Expression; |
||
14 | use yii\web\IdentityInterface; |
||
15 | |||
16 | /** |
||
17 | * This is the model class for table "{{%user}}". |
||
18 | * |
||
19 | * @property integer $id |
||
20 | * @property string $username |
||
21 | * @property string $email |
||
22 | * @property string $full_name |
||
23 | * @property string $display_name |
||
24 | * @property string $password_hash |
||
25 | * @property string $password_reset_token |
||
26 | * @property string $auth_key |
||
27 | * @property integer $status |
||
28 | * @property string $created_at |
||
29 | * @property string $updated_at |
||
30 | * @property string $login_at |
||
31 | * @property string $role |
||
32 | * @property string $password |
||
33 | * @property string $password_old |
||
34 | * @property string $password_repeat |
||
35 | * @property string $url |
||
36 | * |
||
37 | * @property Media[] $media |
||
38 | * @property Post[] $posts |
||
39 | * |
||
40 | * @author Agiel K. Saputra <[email protected]> |
||
41 | * @since 0.1.0 |
||
42 | */ |
||
43 | class User extends ActiveRecord implements IdentityInterface |
||
44 | { |
||
45 | const STATUS_REMOVED = 0; |
||
46 | const STATUS_NOT_ACTIVE = 5; |
||
47 | const STATUS_ACTIVE = 10; |
||
48 | |||
49 | public $password; |
||
50 | public $password_old; |
||
51 | public $password_repeat; |
||
52 | public $role; |
||
53 | |||
54 | /** |
||
55 | * @inheritdoc |
||
56 | */ |
||
57 | public static function tableName() |
||
58 | { |
||
59 | return '{{%user}}'; |
||
60 | } |
||
61 | |||
62 | /** |
||
63 | * @inheritdoc |
||
64 | */ |
||
65 | public function rules() |
||
66 | { |
||
67 | return [ |
||
68 | [ |
||
69 | ['username', 'email', 'full_name', 'display_name', 'password_hash', 'password_reset_token'], |
||
70 | 'string', |
||
71 | 'max' => 255, |
||
72 | ], |
||
73 | [['username', 'email'], 'required'], |
||
74 | [['username', 'email'], 'unique'], |
||
75 | ['username', 'filter', 'filter' => 'trim'], |
||
76 | ['username', 'string', 'min' => 3, 'max' => 255], |
||
77 | ['email', 'filter', 'filter' => 'trim'], |
||
78 | ['email', 'email'], |
||
79 | ['status', 'integer'], |
||
80 | ['status', 'default', 'value' => self::STATUS_ACTIVE], |
||
81 | ['status', 'in', 'range' => [self::STATUS_ACTIVE, self::STATUS_NOT_ACTIVE, self::STATUS_REMOVED]], |
||
82 | ['auth_key', 'string', 'max' => 32], |
||
83 | [['created_at', 'updated_at', 'login_at', 'role'], 'safe'], |
||
84 | [['password', 'password_old', 'password_repeat'], 'required', 'on' => 'resetPassword'], |
||
85 | ['password', 'required', 'on' => 'register'], |
||
86 | ['password', 'string', 'min' => 6], |
||
87 | ['password_old', 'passwordValidation'], |
||
88 | ['password_repeat', 'compare', 'compareAttribute' => 'password'], |
||
89 | ]; |
||
90 | } |
||
91 | |||
92 | /** |
||
93 | * @inheritdoc |
||
94 | */ |
||
95 | public function attributeLabels() |
||
96 | { |
||
97 | return [ |
||
98 | 'id' => Yii::t('writesdown', 'ID'), |
||
99 | 'username' => Yii::t('writesdown', 'Username'), |
||
100 | 'email' => Yii::t('writesdown', 'Email'), |
||
101 | 'full_name' => Yii::t('writesdown', 'Full Name'), |
||
102 | 'display_name' => Yii::t('writesdown', 'Display Name'), |
||
103 | 'password_hash' => Yii::t('writesdown', 'Password Hash'), |
||
104 | 'password_reset_token' => Yii::t('writesdown', 'Password Reset Token'), |
||
105 | 'auth_key' => Yii::t('writesdown', 'Auth Key'), |
||
106 | 'status' => Yii::t('writesdown', 'Status'), |
||
107 | 'created_at' => Yii::t('writesdown', 'Registered'), |
||
108 | 'updated_at' => Yii::t('writesdown', 'Updated'), |
||
109 | 'login_at' => Yii::t('writesdown', 'Last Activity'), |
||
110 | 'role' => Yii::t('writesdown', 'Role'), |
||
111 | 'password' => Yii::t('writesdown', 'Password'), |
||
112 | 'password_repeat' => Yii::t('writesdown', 'Repeat Password'), |
||
113 | 'password_old' => Yii::t('writesdown', 'Old Password'), |
||
114 | ]; |
||
115 | } |
||
116 | |||
117 | /** |
||
118 | * @return \yii\db\ActiveQuery |
||
119 | */ |
||
120 | public function getMedia() |
||
121 | { |
||
122 | return $this->hasMany(Media::className(), ['author' => 'id']); |
||
123 | } |
||
124 | |||
125 | /** |
||
126 | * @return \yii\db\ActiveQuery |
||
127 | */ |
||
128 | public function getPosts() |
||
129 | { |
||
130 | return $this->hasMany(Post::className(), ['author' => 'id']); |
||
131 | } |
||
132 | |||
133 | /** |
||
134 | * @inheritdoc |
||
135 | */ |
||
136 | public static function findIdentity($id) |
||
137 | { |
||
138 | return static::findOne(['id' => $id, 'status' => self::STATUS_ACTIVE]); |
||
0 ignored issues
–
show
|
|||
139 | } |
||
140 | |||
141 | /** |
||
142 | * @inheritdoc |
||
143 | */ |
||
144 | public static function findIdentityByAccessToken($token, $type = null) |
||
145 | { |
||
146 | throw new NotSupportedException('"findIdentityByAccessToken" is not implemented.'); |
||
147 | } |
||
148 | |||
149 | /** |
||
150 | * Finds user by username |
||
151 | * |
||
152 | * @param string $username |
||
153 | * @return static|null |
||
154 | */ |
||
155 | public static function findByUsername($username) |
||
156 | { |
||
157 | return static::findOne(['username' => $username, 'status' => self::STATUS_ACTIVE]); |
||
158 | } |
||
159 | |||
160 | /** |
||
161 | * Finds user by password reset token |
||
162 | * |
||
163 | * @param string $token password reset token |
||
164 | * @return static|null |
||
165 | */ |
||
166 | public static function findByPasswordResetToken($token) |
||
167 | { |
||
168 | if (!static::isPasswordResetTokenValid($token)) { |
||
169 | return null; |
||
170 | } |
||
171 | |||
172 | return static::findOne([ |
||
173 | 'password_reset_token' => $token, |
||
174 | 'status' => self::STATUS_ACTIVE, |
||
175 | ]); |
||
176 | } |
||
177 | |||
178 | /** |
||
179 | * Finds out if password reset token is valid |
||
180 | * |
||
181 | * @param string $token password reset token |
||
182 | * @return boolean |
||
183 | */ |
||
184 | public static function isPasswordResetTokenValid($token) |
||
185 | { |
||
186 | if (empty($token)) { |
||
187 | return false; |
||
188 | } |
||
189 | $expire = Yii::$app->params['user.passwordResetTokenExpire']; |
||
190 | $parts = explode('_', $token); |
||
191 | $timestamp = (int)end($parts); |
||
192 | |||
193 | return $timestamp + $expire >= time(); |
||
194 | } |
||
195 | |||
196 | /** |
||
197 | * @inheritdoc |
||
198 | */ |
||
199 | public function getId() |
||
200 | { |
||
201 | return $this->getPrimaryKey(); |
||
202 | } |
||
203 | |||
204 | /** |
||
205 | * @inheritdoc |
||
206 | */ |
||
207 | public function getAuthKey() |
||
208 | { |
||
209 | return $this->auth_key; |
||
210 | } |
||
211 | |||
212 | /** |
||
213 | * @inheritdoc |
||
214 | */ |
||
215 | public function validateAuthKey($authKey) |
||
216 | { |
||
217 | return $this->getAuthKey() === $authKey; |
||
218 | } |
||
219 | |||
220 | /** |
||
221 | * Validates password |
||
222 | * |
||
223 | * @param string $password password to validate |
||
224 | * @return boolean if password provided is valid for current user |
||
225 | */ |
||
226 | public function validatePassword($password) |
||
227 | { |
||
228 | return Yii::$app->security->validatePassword($password, $this->password_hash); |
||
229 | } |
||
230 | |||
231 | /** |
||
232 | * Generates password hash from password and sets it to the model |
||
233 | * |
||
234 | * @param string $password |
||
235 | */ |
||
236 | public function setPassword($password) |
||
237 | { |
||
238 | $this->password_hash = Yii::$app->security->generatePasswordHash($password); |
||
239 | } |
||
240 | |||
241 | /** |
||
242 | * Generates "remember me" authentication key |
||
243 | */ |
||
244 | public function generateAuthKey() |
||
245 | { |
||
246 | $this->auth_key = Yii::$app->security->generateRandomString(); |
||
247 | } |
||
248 | |||
249 | /** |
||
250 | * Generates new password reset token |
||
251 | */ |
||
252 | public function generatePasswordResetToken() |
||
253 | { |
||
254 | $this->password_reset_token = Yii::$app->security->generateRandomString() . '_' . time(); |
||
255 | } |
||
256 | |||
257 | /** |
||
258 | * Removes password reset token |
||
259 | */ |
||
260 | public function removePasswordResetToken() |
||
261 | { |
||
262 | $this->password_reset_token = null; |
||
263 | } |
||
264 | |||
265 | /** |
||
266 | * Validate password when resetting |
||
267 | */ |
||
268 | public function passwordValidation() |
||
269 | { |
||
270 | $user = static::findOne(Yii::$app->user->id); |
||
271 | |||
272 | if (!$user || !$user->validatePassword($this->password_old)) { |
||
0 ignored issues
–
show
|
|||
273 | $this->addError('password_old', Yii::t('writesdown', 'The old password is not correct.')); |
||
274 | } |
||
275 | } |
||
276 | |||
277 | /** |
||
278 | * Get array of user status. |
||
279 | * |
||
280 | * @return array |
||
281 | */ |
||
282 | public function getStatuses() |
||
283 | { |
||
284 | return [ |
||
285 | self::STATUS_ACTIVE => "Active", |
||
286 | self::STATUS_NOT_ACTIVE => "Not Active", |
||
287 | self::STATUS_REMOVED => "Removed", |
||
288 | ]; |
||
289 | } |
||
290 | |||
291 | /** |
||
292 | * Get text from user status. |
||
293 | * |
||
294 | * @return string |
||
295 | */ |
||
296 | public function getStatusText() |
||
297 | { |
||
298 | $status = $this->getStatuses(); |
||
299 | |||
300 | return isset($status[$this->status]) ? $status[$this->status] : "unknown($this->status)"; |
||
301 | } |
||
302 | |||
303 | /** |
||
304 | * Get user's frontend url |
||
305 | * |
||
306 | * @return string |
||
307 | */ |
||
308 | public function getUrl() |
||
309 | { |
||
310 | return Yii::$app->urlManagerFront->createAbsoluteUrl(['user/view', 'id' => $this->id]); |
||
311 | } |
||
312 | |||
313 | /** |
||
314 | * Check permission of accessed model by current user. |
||
315 | */ |
||
316 | public function checkPermission() |
||
317 | { |
||
318 | if ((Yii::$app->user->can('superadmin') && $this->id !== Yii::$app->user->id) |
||
319 | || (Yii::$app->user->can('administrator') && !Yii::$app->authManager->checkAccess($this->id, |
||
320 | 'administrator')) |
||
321 | ) { |
||
322 | return true; |
||
323 | } |
||
324 | |||
325 | return false; |
||
326 | } |
||
327 | |||
328 | /** |
||
329 | * @inheritdoc |
||
330 | */ |
||
331 | public function beforeSave($insert) |
||
332 | { |
||
333 | if (parent::beforeSave($insert)) { |
||
334 | if ($this->isNewRecord) { |
||
335 | $this->created_at = new Expression('NOW()'); |
||
336 | if (!$this->status) { |
||
337 | $this->status = self::STATUS_NOT_ACTIVE; |
||
338 | } |
||
339 | if (!$this->display_name) { |
||
340 | $this->display_name = $this->username; |
||
341 | } |
||
342 | } |
||
343 | $this->updated_at = new Expression('NOW()'); |
||
344 | |||
345 | return true; |
||
346 | } |
||
347 | |||
348 | return false; |
||
349 | } |
||
350 | } |
||
351 |
If you return a value from a function or method, it should be a sub-type of the type that is given by the parent type f.e. an interface, or abstract method. This is more formally defined by the Lizkov substitution principle, and guarantees that classes that depend on the parent type can use any instance of a child type interchangably. This principle also belongs to the SOLID principles for object oriented design.
Let’s take a look at an example:
Our function
my_function
expects aPost
object, and outputs the author of the post. The base classPost
returns a simple string and outputting a simple string will work just fine. However, the child classBlogPost
which is a sub-type ofPost
instead decided to return anobject
, and is therefore violating the SOLID principles. If aBlogPost
were passed tomy_function
, PHP would not complain, but ultimately fail when executing thestrtoupper
call in its body.