This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace Overwatch\TestBundle\Controller; |
||
4 | |||
5 | use Nelmio\ApiDocBundle\Annotation\ApiDoc; |
||
6 | use Overwatch\TestBundle\Entity\TestGroup; |
||
7 | use Overwatch\UserBundle\Entity\User; |
||
8 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Method; |
||
9 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\ParamConverter; |
||
10 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route; |
||
11 | use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security; |
||
12 | use Symfony\Bundle\FrameworkBundle\Controller\Controller; |
||
13 | use Symfony\Component\DependencyInjection\ContainerInterface; |
||
14 | use Symfony\Component\HttpFoundation\JsonResponse; |
||
15 | use Symfony\Component\HttpFoundation\Request; |
||
16 | |||
17 | /** |
||
18 | * TestGroupApiController |
||
19 | * Handles API requests made for TestGroups |
||
20 | * |
||
21 | * @Route("/api/groups") |
||
22 | */ |
||
23 | class TestGroupApiController extends Controller |
||
0 ignored issues
–
show
|
|||
24 | { |
||
25 | private $_em; |
||
26 | |||
27 | 23 | public function setContainer(ContainerInterface $container = null) |
|
28 | { |
||
29 | 23 | parent::setContainer($container); |
|
30 | 23 | $this->_em = $this->getDoctrine()->getManager(); |
|
31 | 23 | } |
|
32 | |||
33 | /** |
||
34 | * Creates a new group |
||
35 | * |
||
36 | * @Route("") |
||
37 | * @Method({"POST"}) |
||
38 | * @Security("has_role('ROLE_SUPER_ADMIN')") |
||
39 | * @ApiDoc( |
||
40 | * resource=true, |
||
41 | * parameters={ |
||
42 | * {"name"="name", "description"="A user-friendly name for the group", "required"=true, "format"="Group 1", "dataType"="string"}, |
||
43 | * }, |
||
44 | * tags={ |
||
45 | * "Super Admin" = "#ff1919" |
||
46 | * } |
||
47 | * ) |
||
48 | */ |
||
49 | 2 | public function createGroupAction(Request $request) |
|
50 | { |
||
51 | 2 | if ($request->request->get('name') === null) { |
|
52 | 1 | return new JsonResponse('You must provide a name for the new group', JsonResponse::HTTP_UNPROCESSABLE_ENTITY); |
|
53 | } |
||
54 | |||
55 | 1 | $group = new TestGroup; |
|
56 | $group |
||
57 | 1 | ->setName($request->request->get('name')) |
|
58 | ; |
||
59 | |||
60 | 1 | $this->_em->persist($group); |
|
61 | 1 | $this->_em->flush(); |
|
62 | |||
63 | 1 | return new JsonResponse($group, JsonResponse::HTTP_CREATED); |
|
64 | } |
||
65 | |||
66 | /** |
||
67 | * Returns a list of all groups the current user has access to |
||
68 | * |
||
69 | * @Route("") |
||
70 | * @Method({"GET"}) |
||
71 | * @Security("has_role('ROLE_USER')") |
||
72 | * @ApiDoc( |
||
73 | * tags={ |
||
74 | * "Super Admin" = "#ff1919", |
||
75 | * "Admin" = "#ffff33", |
||
76 | * "User" = "#75ff47" |
||
77 | * } |
||
78 | * ) |
||
79 | */ |
||
80 | 2 | public function getAllGroupsAction() |
|
81 | { |
||
82 | 2 | if ($this->isGranted('ROLE_SUPER_ADMIN')) { |
|
83 | 1 | $groups = $this->_em->getRepository('OverwatchTestBundle:TestGroup')->findAll(); |
|
84 | 1 | } else { |
|
85 | 1 | $groups = $this->getUser()->getGroups()->toArray(); |
|
86 | } |
||
87 | |||
88 | 2 | return new JsonResponse($groups); |
|
89 | } |
||
90 | |||
91 | /** |
||
92 | * Returns the details of the specified group |
||
93 | * |
||
94 | * @Route("/{id}") |
||
95 | * @Method({"GET"}) |
||
96 | * @Security("is_granted('view', group)") |
||
97 | * @ApiDoc( |
||
98 | * requirements={ |
||
99 | * {"name"="id", "description"="The ID of the group to return", "dataType"="integer", "requirement"="\d+"} |
||
100 | * }, |
||
101 | * tags={ |
||
102 | * "Super Admin" = "#ff1919", |
||
103 | * "Admin" = "#ffff33", |
||
104 | * "User" = "#75ff47" |
||
105 | * } |
||
106 | * ) |
||
107 | */ |
||
108 | 1 | public function getGroupAction(TestGroup $group) |
|
109 | { |
||
110 | 1 | return new JsonResponse($group); |
|
111 | } |
||
112 | |||
113 | /** |
||
114 | * Updates the given group |
||
115 | * |
||
116 | * @Route("/{id}") |
||
117 | * @Method({"PUT"}) |
||
118 | * @Security("has_role('ROLE_SUPER_ADMIN')") |
||
119 | * @ApiDoc( |
||
120 | * parameters={ |
||
121 | * {"name"="name", "description"="A user-friendly name for the group", "required"=false, "format"="Group 1", "dataType"="string"} |
||
122 | * }, |
||
123 | * requirements={ |
||
124 | * {"name"="id", "description"="The ID of the group to edit", "dataType"="integer", "requirement"="\d+"} |
||
125 | * }, |
||
126 | * tags={ |
||
127 | * "Super Admin" = "#ff1919" |
||
128 | * } |
||
129 | * ) |
||
130 | */ |
||
131 | 1 | public function updateGroupAction(Request $request, TestGroup $group) |
|
132 | { |
||
133 | 1 | if ($request->request->has('name')) { |
|
134 | 1 | $group->setName($request->request->get('name')); |
|
135 | |||
136 | 1 | $this->_em->flush(); |
|
137 | 1 | } |
|
138 | |||
139 | 1 | return new JsonResponse($group); |
|
140 | } |
||
141 | |||
142 | /** |
||
143 | * Deletes the given group |
||
144 | * |
||
145 | * @Route("/{id}") |
||
146 | * @Method({"DELETE"}) |
||
147 | * @Security("has_role('ROLE_SUPER_ADMIN')") |
||
148 | * @ApiDoc( |
||
149 | * requirements={ |
||
150 | * {"name"="id", "description"="The ID of the group to delete", "dataType"="integer", "requirement"="\d+"} |
||
151 | * }, |
||
152 | * tags={ |
||
153 | * "Super Admin" = "#ff1919" |
||
154 | * } |
||
155 | * ) |
||
156 | */ |
||
157 | 2 | public function deleteGroupAction(TestGroup $group) |
|
158 | { |
||
159 | 2 | if ($group->getUsers()->count() + $group->getTests()->count() !== 0) { |
|
160 | 1 | return new JsonResponse('This group still has users and/or tests in it. You must remove them before continuing.', JsonResponse::HTTP_UNPROCESSABLE_ENTITY); |
|
161 | } |
||
162 | |||
163 | 1 | $this->_em->remove($group); |
|
164 | 1 | $this->_em->flush(); |
|
165 | |||
166 | 1 | return new JsonResponse(null, JsonResponse::HTTP_NO_CONTENT); |
|
167 | } |
||
168 | |||
169 | /** |
||
170 | * Adds the given user to the given group |
||
171 | * |
||
172 | * @Route("/{groupId}/user/{userId}") |
||
173 | * @Method({"POST"}) |
||
174 | * @Security("has_role('ROLE_SUPER_ADMIN')") |
||
175 | * @ParamConverter("group", class="OverwatchTestBundle:TestGroup", options={"id" = "groupId"}) |
||
176 | * @ParamConverter("user", class="OverwatchUserBundle:User", options={"id" = "userId"}) |
||
177 | * @ApiDoc( |
||
178 | * resource=true, |
||
179 | * requirements={ |
||
180 | * {"name"="userId", "description"="The ID of the user", "dataType"="integer", "requirement"="\d+"}, |
||
181 | * {"name"="groupId", "description"="The ID of the group", "dataType"="integer", "requirement"="\d+"} |
||
182 | * }, |
||
183 | * tags={ |
||
184 | * "Super Admin" = "#ff1919" |
||
185 | * } |
||
186 | * ) |
||
187 | */ |
||
188 | 1 | public function addUserToGroupAction(TestGroup $group, User $user) |
|
189 | { |
||
190 | 1 | $group->addUser($user); |
|
191 | 1 | $this->_em->flush(); |
|
192 | |||
193 | 1 | return new JsonResponse($user, JsonResponse::HTTP_CREATED); |
|
194 | } |
||
195 | |||
196 | /** |
||
197 | * Removes the given user from the given group |
||
198 | * |
||
199 | * @Route("/{groupId}/user/{userId}") |
||
200 | * @Method({"DELETE"}) |
||
201 | * @Security("has_role('ROLE_SUPER_ADMIN')") |
||
202 | * @ParamConverter("group", class="OverwatchTestBundle:TestGroup", options={"id" = "groupId"}) |
||
203 | * @ParamConverter("user", class="OverwatchUserBundle:User", options={"id" = "userId"}) |
||
204 | * @ApiDoc( |
||
205 | * requirements={ |
||
206 | * {"name"="userId", "description"="The ID of the user", "dataType"="integer", "requirement"="\d+"}, |
||
207 | * {"name"="groupId", "description"="The ID of the group", "dataType"="integer", "requirement"="\d+"} |
||
208 | * }, |
||
209 | * tags={ |
||
210 | * "Super Admin" = "#ff1919" |
||
211 | * } |
||
212 | * ) |
||
213 | */ |
||
214 | 1 | public function removeUserFromGroupAction(TestGroup $group, User $user) |
|
215 | { |
||
216 | 1 | $group->removeUser($user); |
|
217 | 1 | $this->_em->flush(); |
|
218 | |||
219 | 1 | return new JsonResponse($user); |
|
220 | } |
||
221 | } |
||
222 |
This check marks property names that have not been written in camelCase.
In camelCase names are written without any punctuation, the start of each new word being marked by a capital letter. Thus the name database connection string becomes
databaseConnectionString
.