zsturgess /
overwatch
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace Overwatch\TestBundle\Controller; |
||
| 4 | |||
| 5 | use Nelmio\ApiDocBundle\Annotation\ApiDoc; |
||
| 6 | use Overwatch\TestBundle\Entity\TestGroup; |
||
| 7 | use Overwatch\UserBundle\Entity\User; |
||
| 8 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Method; |
||
| 9 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\ParamConverter; |
||
| 10 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route; |
||
| 11 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security; |
||
| 12 | use Symfony\Bundle\FrameworkBundle\Controller\Controller; |
||
| 13 | use Symfony\Component\DependencyInjection\ContainerInterface; |
||
| 14 | use Symfony\Component\HttpFoundation\JsonResponse; |
||
| 15 | use Symfony\Component\HttpFoundation\Request; |
||
| 16 | |||
| 17 | /** |
||
| 18 | * TestGroupApiController |
||
| 19 | * Handles API requests made for TestGroups |
||
| 20 | * |
||
| 21 | * @Route("/api/groups") |
||
| 22 | */ |
||
| 23 | class TestGroupApiController extends Controller |
||
|
0 ignored issues
–
show
|
|||
| 24 | { |
||
| 25 | private $_em; |
||
| 26 | |||
| 27 | 23 | public function setContainer(ContainerInterface $container = null) |
|
| 28 | { |
||
| 29 | 23 | parent::setContainer($container); |
|
| 30 | 23 | $this->_em = $this->getDoctrine()->getManager(); |
|
| 31 | 23 | } |
|
| 32 | |||
| 33 | /** |
||
| 34 | * Creates a new group |
||
| 35 | * |
||
| 36 | * @Route("") |
||
| 37 | * @Method({"POST"}) |
||
| 38 | * @Security("has_role('ROLE_SUPER_ADMIN')") |
||
| 39 | * @ApiDoc( |
||
| 40 | * resource=true, |
||
| 41 | * parameters={ |
||
| 42 | * {"name"="name", "description"="A user-friendly name for the group", "required"=true, "format"="Group 1", "dataType"="string"}, |
||
| 43 | * }, |
||
| 44 | * tags={ |
||
| 45 | * "Super Admin" = "#ff1919" |
||
| 46 | * } |
||
| 47 | * ) |
||
| 48 | */ |
||
| 49 | 2 | public function createGroupAction(Request $request) |
|
| 50 | { |
||
| 51 | 2 | if ($request->request->get('name') === null) { |
|
| 52 | 1 | return new JsonResponse('You must provide a name for the new group', JsonResponse::HTTP_UNPROCESSABLE_ENTITY); |
|
| 53 | } |
||
| 54 | |||
| 55 | 1 | $group = new TestGroup; |
|
| 56 | $group |
||
| 57 | 1 | ->setName($request->request->get('name')) |
|
| 58 | ; |
||
| 59 | |||
| 60 | 1 | $this->_em->persist($group); |
|
| 61 | 1 | $this->_em->flush(); |
|
| 62 | |||
| 63 | 1 | return new JsonResponse($group, JsonResponse::HTTP_CREATED); |
|
| 64 | } |
||
| 65 | |||
| 66 | /** |
||
| 67 | * Returns a list of all groups the current user has access to |
||
| 68 | * |
||
| 69 | * @Route("") |
||
| 70 | * @Method({"GET"}) |
||
| 71 | * @Security("has_role('ROLE_USER')") |
||
| 72 | * @ApiDoc( |
||
| 73 | * tags={ |
||
| 74 | * "Super Admin" = "#ff1919", |
||
| 75 | * "Admin" = "#ffff33", |
||
| 76 | * "User" = "#75ff47" |
||
| 77 | * } |
||
| 78 | * ) |
||
| 79 | */ |
||
| 80 | 2 | public function getAllGroupsAction() |
|
| 81 | { |
||
| 82 | 2 | if ($this->isGranted('ROLE_SUPER_ADMIN')) { |
|
| 83 | 1 | $groups = $this->_em->getRepository('OverwatchTestBundle:TestGroup')->findAll(); |
|
| 84 | 1 | } else { |
|
| 85 | 1 | $groups = $this->getUser()->getGroups()->toArray(); |
|
| 86 | } |
||
| 87 | |||
| 88 | 2 | return new JsonResponse($groups); |
|
| 89 | } |
||
| 90 | |||
| 91 | /** |
||
| 92 | * Returns the details of the specified group |
||
| 93 | * |
||
| 94 | * @Route("/{id}") |
||
| 95 | * @Method({"GET"}) |
||
| 96 | * @Security("is_granted('view', group)") |
||
| 97 | * @ApiDoc( |
||
| 98 | * requirements={ |
||
| 99 | * {"name"="id", "description"="The ID of the group to return", "dataType"="integer", "requirement"="\d+"} |
||
| 100 | * }, |
||
| 101 | * tags={ |
||
| 102 | * "Super Admin" = "#ff1919", |
||
| 103 | * "Admin" = "#ffff33", |
||
| 104 | * "User" = "#75ff47" |
||
| 105 | * } |
||
| 106 | * ) |
||
| 107 | */ |
||
| 108 | 1 | public function getGroupAction(TestGroup $group) |
|
| 109 | { |
||
| 110 | 1 | return new JsonResponse($group); |
|
| 111 | } |
||
| 112 | |||
| 113 | /** |
||
| 114 | * Updates the given group |
||
| 115 | * |
||
| 116 | * @Route("/{id}") |
||
| 117 | * @Method({"PUT"}) |
||
| 118 | * @Security("has_role('ROLE_SUPER_ADMIN')") |
||
| 119 | * @ApiDoc( |
||
| 120 | * parameters={ |
||
| 121 | * {"name"="name", "description"="A user-friendly name for the group", "required"=false, "format"="Group 1", "dataType"="string"} |
||
| 122 | * }, |
||
| 123 | * requirements={ |
||
| 124 | * {"name"="id", "description"="The ID of the group to edit", "dataType"="integer", "requirement"="\d+"} |
||
| 125 | * }, |
||
| 126 | * tags={ |
||
| 127 | * "Super Admin" = "#ff1919" |
||
| 128 | * } |
||
| 129 | * ) |
||
| 130 | */ |
||
| 131 | 1 | public function updateGroupAction(Request $request, TestGroup $group) |
|
| 132 | { |
||
| 133 | 1 | if ($request->request->has('name')) { |
|
| 134 | 1 | $group->setName($request->request->get('name')); |
|
| 135 | |||
| 136 | 1 | $this->_em->flush(); |
|
| 137 | 1 | } |
|
| 138 | |||
| 139 | 1 | return new JsonResponse($group); |
|
| 140 | } |
||
| 141 | |||
| 142 | /** |
||
| 143 | * Deletes the given group |
||
| 144 | * |
||
| 145 | * @Route("/{id}") |
||
| 146 | * @Method({"DELETE"}) |
||
| 147 | * @Security("has_role('ROLE_SUPER_ADMIN')") |
||
| 148 | * @ApiDoc( |
||
| 149 | * requirements={ |
||
| 150 | * {"name"="id", "description"="The ID of the group to delete", "dataType"="integer", "requirement"="\d+"} |
||
| 151 | * }, |
||
| 152 | * tags={ |
||
| 153 | * "Super Admin" = "#ff1919" |
||
| 154 | * } |
||
| 155 | * ) |
||
| 156 | */ |
||
| 157 | 2 | public function deleteGroupAction(TestGroup $group) |
|
| 158 | { |
||
| 159 | 2 | if ($group->getUsers()->count() + $group->getTests()->count() !== 0) { |
|
| 160 | 1 | return new JsonResponse('This group still has users and/or tests in it. You must remove them before continuing.', JsonResponse::HTTP_UNPROCESSABLE_ENTITY); |
|
| 161 | } |
||
| 162 | |||
| 163 | 1 | $this->_em->remove($group); |
|
| 164 | 1 | $this->_em->flush(); |
|
| 165 | |||
| 166 | 1 | return new JsonResponse(null, JsonResponse::HTTP_NO_CONTENT); |
|
| 167 | } |
||
| 168 | |||
| 169 | /** |
||
| 170 | * Adds the given user to the given group |
||
| 171 | * |
||
| 172 | * @Route("/{groupId}/user/{userId}") |
||
| 173 | * @Method({"POST"}) |
||
| 174 | * @Security("has_role('ROLE_SUPER_ADMIN')") |
||
| 175 | * @ParamConverter("group", class="OverwatchTestBundle:TestGroup", options={"id" = "groupId"}) |
||
| 176 | * @ParamConverter("user", class="OverwatchUserBundle:User", options={"id" = "userId"}) |
||
| 177 | * @ApiDoc( |
||
| 178 | * resource=true, |
||
| 179 | * requirements={ |
||
| 180 | * {"name"="userId", "description"="The ID of the user", "dataType"="integer", "requirement"="\d+"}, |
||
| 181 | * {"name"="groupId", "description"="The ID of the group", "dataType"="integer", "requirement"="\d+"} |
||
| 182 | * }, |
||
| 183 | * tags={ |
||
| 184 | * "Super Admin" = "#ff1919" |
||
| 185 | * } |
||
| 186 | * ) |
||
| 187 | */ |
||
| 188 | 1 | public function addUserToGroupAction(TestGroup $group, User $user) |
|
| 189 | { |
||
| 190 | 1 | $group->addUser($user); |
|
| 191 | 1 | $this->_em->flush(); |
|
| 192 | |||
| 193 | 1 | return new JsonResponse($user, JsonResponse::HTTP_CREATED); |
|
| 194 | } |
||
| 195 | |||
| 196 | /** |
||
| 197 | * Removes the given user from the given group |
||
| 198 | * |
||
| 199 | * @Route("/{groupId}/user/{userId}") |
||
| 200 | * @Method({"DELETE"}) |
||
| 201 | * @Security("has_role('ROLE_SUPER_ADMIN')") |
||
| 202 | * @ParamConverter("group", class="OverwatchTestBundle:TestGroup", options={"id" = "groupId"}) |
||
| 203 | * @ParamConverter("user", class="OverwatchUserBundle:User", options={"id" = "userId"}) |
||
| 204 | * @ApiDoc( |
||
| 205 | * requirements={ |
||
| 206 | * {"name"="userId", "description"="The ID of the user", "dataType"="integer", "requirement"="\d+"}, |
||
| 207 | * {"name"="groupId", "description"="The ID of the group", "dataType"="integer", "requirement"="\d+"} |
||
| 208 | * }, |
||
| 209 | * tags={ |
||
| 210 | * "Super Admin" = "#ff1919" |
||
| 211 | * } |
||
| 212 | * ) |
||
| 213 | */ |
||
| 214 | 1 | public function removeUserFromGroupAction(TestGroup $group, User $user) |
|
| 215 | { |
||
| 216 | 1 | $group->removeUser($user); |
|
| 217 | 1 | $this->_em->flush(); |
|
| 218 | |||
| 219 | 1 | return new JsonResponse($user); |
|
| 220 | } |
||
| 221 | } |
||
| 222 |
This check marks property names that have not been written in camelCase.
In camelCase names are written without any punctuation, the start of each new word being marked by a capital letter. Thus the name database connection string becomes
databaseConnectionString.