Issues in InteractsWithPermission.php (master) - Issues in master - yajra/laravel-acl - Measure and Improve Code Quality continuously with Scrutinizer

Issues (43)

Security Analysis no request data

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Traits/InteractsWithPermission.php (9 issues)

Labels

Bug 9

Severity

Minor 9

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

namespace Yajra\Acl\Traits;

use Illuminate\Database\Eloquent\Relations\BelongsToMany;
use Yajra\Acl\Models\Permission;

/**
 * @property \Illuminate\Database\Eloquent\Collection|Permission[] permissions
 * @mixin \Illuminate\Database\Eloquent\Model
 */
trait InteractsWithPermission
{
    private $permissionClass;

    /**
     * Grant permissions by slug(/s).
     *
     * @param  string|array  $slug
     */
    public function grantPermissionBySlug($slug)
    {
        $this->getPermissionClass()
            ->newQuery()
            ->whereIn('slug', (array) $slug)
            ->each(function ($permission) {
                $this->grantPermission($permission);
            });

        $this->load('permissions');
trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}
    }

    /**
     * Get Permission class.
     *
     * @return \Yajra\Acl\Models\Permission
     */
    public function getPermissionClass(): Permission
    {
        if (!isset($this->permissionClass)) {
            $this->permissionClass = resolve(config('acl.permission'));
        }

        return $this->permissionClass;
    }

    /**
     * Get related permissions.
     *
     * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
     */
    public function permissions(): BelongsToMany
    {
        return $this->belongsToMany(config('acl.permission', Permission::class))->withTimestamps();
trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}
    }

    /**
     * Grant permissions by resource.
     *
     * @param  string|array  $resource
     */
    public function grantPermissionByResource($resource)
    {
        $this->getPermissionClass()
            ->newQuery()
            ->whereIn('resource', (array) $resource)
            ->each(function ($permission) {
                $this->grantPermission($permission);
            });

        $this->load('permissions');
trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}
    }

    /**
     * Grant the given permission.
     *
     * @param  \Illuminate\Support\Collection|\Illuminate\Database\Eloquent\Model|array  $id
     * @param  array  $attributes
     * @param  bool  $touch
     * @return void
     */
    public function grantPermission($id, array $attributes = [], $touch = true)
    {
        $this->permissions()->attach($id, $attributes, $touch);

        $this->load('permissions');
trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}
    }

    /**
     * Revoke permissions by the given slug(/s).
     *
     * @param  string|array  $slug
     */
    public function revokePermissionBySlug($slug)
    {
        $this->getPermissionClass()
            ->newQuery()
            ->whereIn('slug', (array) $slug)
            ->each(function ($permission) {
                $this->revokePermission($permission);
            });

        $this->load('permissions');
trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}
    }

    /**
     * Revoke permissions by resource.
     *
     * @param string|array $resource
     */
    public function revokePermissionByResource($resource)
    {
        $this->getPermissionClass()
            ->newQuery()
            ->whereIn('resource', (array) $resource)
            ->each(function ($permission) {
                $this->revokePermission($permission);
            });

        $this->load('permissions');
trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}
    }

    /**
     * Revokes the given permission.
     *
     * @param  mixed  $id
     * @param  bool  $touch
     * @return int
     */
    public function revokePermission($id = null, $touch = true): int
    {
        $detached = $this->permissions()->detach($id, $touch);

        $this->load('permissions');
trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

        return  $detached;
    }

    /**
     * Syncs the given permission.
     *
     * @param  \Illuminate\Support\Collection|\Illuminate\Database\Eloquent\Model|array  $ids
     * @param  bool  $detaching
     * @return array
     */
    public function syncPermissions($ids, $detaching = true): array
    {
        $synced = $this->permissions()->sync($ids, $detaching);

        $this->load('permissions');
trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

        return $synced;
    }

    /**
     * Revokes all permissions.
     *
     * @return int
     */
    public function revokeAllPermissions(): int
    {
        $detached = $this->permissions()->detach();

        $this->load('permissions');
trait Idable {
    public function equalIds(Idable $other) {
        return $this->getId() === $other->getId();
    }
}

        return $detached;
    }

    /**
     * Get list of permissions slug.
     *
     * @return array
     */
    public function getPermissions(): array
    {
        return $this->permissions->pluck('slug')->toArray();
    }
}


1			<?php
2
3			namespace Yajra\Acl\Traits;
4
5			use Illuminate\Database\Eloquent\Relations\BelongsToMany;
6			use Yajra\Acl\Models\Permission;
7
8			/**
9			* @property \Illuminate\Database\Eloquent\Collection\|Permission[] permissions
10			* @mixin \Illuminate\Database\Eloquent\Model
11			*/
12			trait InteractsWithPermission
13			{
14			private $permissionClass;
15
16			/**
17			* Grant permissions by slug(/s).
18			*
19			* @param string\|array $slug
20			*/
21			public function grantPermissionBySlug($slug)
22			{
23			$this->getPermissionClass()
24			->newQuery()
25			->whereIn('slug', (array) $slug)
26			->each(function ($permission) {
27			$this->grantPermission($permission);
28			});
29
30			$this->load('permissions');
			0 ignored issues – show Bug introduced 2021-04-17 10:10 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `load()` must be provided by classes using this trait. How about adding it as abstract method to this trait? This check looks for methods that are used by a trait but not required by it. To illustrate, let’s look at the following code example trait Idable { public function equalIds(Idable $other) { return $this->getId() === $other->getId(); } } The trait `Idable` provides a method `equalsId` that in turn relies on the method `getId()`. If this method does not exist on a class mixing in this trait, the method will fail. Adding the `getId()` as an abstract method to the trait will make sure it is available. Loading history...
31			}
32
33			/**
34			* Get Permission class.
35			*
36			* @return \Yajra\Acl\Models\Permission
37			*/
38			public function getPermissionClass(): Permission
39			{
40			if (!isset($this->permissionClass)) {
41			$this->permissionClass = resolve(config('acl.permission'));
42			}
43
44			return $this->permissionClass;
45			}
46
47			/**
48			* Get related permissions.
49			*
50			* @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
51			*/
52			public function permissions(): BelongsToMany
53			{
54			return $this->belongsToMany(config('acl.permission', Permission::class))->withTimestamps();
			0 ignored issues – show Bug introduced 2016-06-13 03:50 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `belongsToMany()` must be provided by classes using this trait. How about adding it as abstract method to this trait? This check looks for methods that are used by a trait but not required by it. To illustrate, let’s look at the following code example trait Idable { public function equalIds(Idable $other) { return $this->getId() === $other->getId(); } } The trait `Idable` provides a method `equalsId` that in turn relies on the method `getId()`. If this method does not exist on a class mixing in this trait, the method will fail. Adding the `getId()` as an abstract method to the trait will make sure it is available. Loading history...
55			}
56
57			/**
58			* Grant permissions by resource.
59			*
60			* @param string\|array $resource
61			*/
62			public function grantPermissionByResource($resource)
63			{
64			$this->getPermissionClass()
65			->newQuery()
66			->whereIn('resource', (array) $resource)
67			->each(function ($permission) {
68			$this->grantPermission($permission);
69			});
70
71			$this->load('permissions');
			0 ignored issues – show Bug introduced 2021-04-17 10:10 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `load()` must be provided by classes using this trait. How about adding it as abstract method to this trait? This check looks for methods that are used by a trait but not required by it. To illustrate, let’s look at the following code example trait Idable { public function equalIds(Idable $other) { return $this->getId() === $other->getId(); } } The trait `Idable` provides a method `equalsId` that in turn relies on the method `getId()`. If this method does not exist on a class mixing in this trait, the method will fail. Adding the `getId()` as an abstract method to the trait will make sure it is available. Loading history...
72			}
73
74			/**
75			* Grant the given permission.
76			*
77			* @param \Illuminate\Support\Collection\|\Illuminate\Database\Eloquent\Model\|array $id
78			* @param array $attributes
79			* @param bool $touch
80			* @return void
81			*/
82			public function grantPermission($id, array $attributes = [], $touch = true)
83			{
84			$this->permissions()->attach($id, $attributes, $touch);
85
86			$this->load('permissions');
			0 ignored issues – show Bug introduced 2021-04-18 08:52 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `load()` must be provided by classes using this trait. How about adding it as abstract method to this trait? This check looks for methods that are used by a trait but not required by it. To illustrate, let’s look at the following code example trait Idable { public function equalIds(Idable $other) { return $this->getId() === $other->getId(); } } The trait `Idable` provides a method `equalsId` that in turn relies on the method `getId()`. If this method does not exist on a class mixing in this trait, the method will fail. Adding the `getId()` as an abstract method to the trait will make sure it is available. Loading history...
87			}
88
89			/**
90			* Revoke permissions by the given slug(/s).
91			*
92			* @param string\|array $slug
93			*/
94			public function revokePermissionBySlug($slug)
95			{
96			$this->getPermissionClass()
97			->newQuery()
98			->whereIn('slug', (array) $slug)
99			->each(function ($permission) {
100			$this->revokePermission($permission);
101			});
102
103			$this->load('permissions');
			0 ignored issues – show Bug introduced 2021-04-17 10:10 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `load()` must be provided by classes using this trait. How about adding it as abstract method to this trait? This check looks for methods that are used by a trait but not required by it. To illustrate, let’s look at the following code example trait Idable { public function equalIds(Idable $other) { return $this->getId() === $other->getId(); } } The trait `Idable` provides a method `equalsId` that in turn relies on the method `getId()`. If this method does not exist on a class mixing in this trait, the method will fail. Adding the `getId()` as an abstract method to the trait will make sure it is available. Loading history...
104			}
105
106			/**
107			* Revoke permissions by resource.
108			*
109			* @param string\|array $resource
110			*/
111			public function revokePermissionByResource($resource)
112			{
113			$this->getPermissionClass()
114			->newQuery()
115			->whereIn('resource', (array) $resource)
116			->each(function ($permission) {
117			$this->revokePermission($permission);
118			});
119
120			$this->load('permissions');
			0 ignored issues – show Bug introduced 2021-04-18 08:52 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `load()` must be provided by classes using this trait. How about adding it as abstract method to this trait? This check looks for methods that are used by a trait but not required by it. To illustrate, let’s look at the following code example trait Idable { public function equalIds(Idable $other) { return $this->getId() === $other->getId(); } } The trait `Idable` provides a method `equalsId` that in turn relies on the method `getId()`. If this method does not exist on a class mixing in this trait, the method will fail. Adding the `getId()` as an abstract method to the trait will make sure it is available. Loading history...
121			}
122
123			/**
124			* Revokes the given permission.
125			*
126			* @param mixed $id
127			* @param bool $touch
128			* @return int
129			*/
130			public function revokePermission($id = null, $touch = true): int
131			{
132			$detached = $this->permissions()->detach($id, $touch);
133
134			$this->load('permissions');
			0 ignored issues – show Bug introduced 2021-04-18 08:52 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `load()` must be provided by classes using this trait. How about adding it as abstract method to this trait? This check looks for methods that are used by a trait but not required by it. To illustrate, let’s look at the following code example trait Idable { public function equalIds(Idable $other) { return $this->getId() === $other->getId(); } } The trait `Idable` provides a method `equalsId` that in turn relies on the method `getId()`. If this method does not exist on a class mixing in this trait, the method will fail. Adding the `getId()` as an abstract method to the trait will make sure it is available. Loading history...
135
136			return $detached;
137			}
138
139			/**
140			* Syncs the given permission.
141			*
142			* @param \Illuminate\Support\Collection\|\Illuminate\Database\Eloquent\Model\|array $ids
143			* @param bool $detaching
144			* @return array
145			*/
146			public function syncPermissions($ids, $detaching = true): array
147			{
148			$synced = $this->permissions()->sync($ids, $detaching);
149
150			$this->load('permissions');
			0 ignored issues – show Bug introduced 2021-04-18 08:52 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `load()` must be provided by classes using this trait. How about adding it as abstract method to this trait? This check looks for methods that are used by a trait but not required by it. To illustrate, let’s look at the following code example trait Idable { public function equalIds(Idable $other) { return $this->getId() === $other->getId(); } } The trait `Idable` provides a method `equalsId` that in turn relies on the method `getId()`. If this method does not exist on a class mixing in this trait, the method will fail. Adding the `getId()` as an abstract method to the trait will make sure it is available. Loading history...
151
152			return $synced;
153			}
154
155			/**
156			* Revokes all permissions.
157			*
158			* @return int
159			*/
160			public function revokeAllPermissions(): int
161			{
162			$detached = $this->permissions()->detach();
163
164			$this->load('permissions');
			0 ignored issues – show Bug introduced 2021-04-18 08:52 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like `load()` must be provided by classes using this trait. How about adding it as abstract method to this trait? This check looks for methods that are used by a trait but not required by it. To illustrate, let’s look at the following code example trait Idable { public function equalIds(Idable $other) { return $this->getId() === $other->getId(); } } The trait `Idable` provides a method `equalsId` that in turn relies on the method `getId()`. If this method does not exist on a class mixing in this trait, the method will fail. Adding the `getId()` as an abstract method to the trait will make sure it is available. Loading history...
165
166			return $detached;
167			}
168
169			/**
170			* Get list of permissions slug.
171			*
172			* @return array
173			*/
174			public function getPermissions(): array
175			{
176			return $this->permissions->pluck('slug')->toArray();
177			}
178			}
179

yajra / laravel-acl

Issues (43)

Security Analysis no request data

src/Traits/InteractsWithPermission.php (9 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like