mag/WMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M3 Security Fixes for scan command pass 33 major code smell fixes and style fixes

Browse Source
This commit is contained in:
Mark Gregory
2026-09-17 11:34:41 +01:00
parent 0a05f05843
commit 0c445f89af
69 changed files with 1786 additions and 1752 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Modules/M3/Http/Controllers/userControlController.php
+31 -30
View File
@@ -12,9 +12,13 @@ use Modules\M3\Services\PostgresProgramBridge;
class userControlController extends Controller
{
private const AUTH_FAILURE_MESSAGE = 'Could not connect due to wrong user or password.';
private const DATABASE_NOT_FOUND_MESSAGE = 'Database not found. Try WRKRDBDIRE to check.';
private const CONNECTION_ERROR_PREFIX = 'Could not connect. Error: ';
private const PROGRAM_ERROR_PREFIX = 'Error calling program. Code: ';
private const MESSAGE_SEPARATOR = ' Msg: ';
public static function index(Request $request)
@@ -26,12 +30,12 @@ class userControlController extends Controller
}
$co = $profile->R428CO ?? '';
$whs = $profile->R428WH ?? '';
$ICM428M = Schema::connection($connection)->hasTable('icm428m')
$iCM428M = Schema::connection($connection)->hasTable('icm428m')
? DB::connection($connection)->table('icm428m')->where('R428CO', $co)->where('R428WH', $whs)->get() : collect();
$USER_INFO = Schema::connection($connection)->hasTable('icm428m')
$uSER_INFO = Schema::connection($connection)->hasTable('icm428m')
? DB::connection($connection)->table('icm428m')->selectRaw('R428US as USERPRF, R428STS as STATUS, NULL as DATE_EXPIRED, NULL as EXPIRED')->get()->all() : [];
$power_user = [(object) ['R428PWRUSR' => $profile->R428PWRUSR ?? 'N', 'R428CO' => $co, 'R428PL' => $profile->R428PL ?? '', 'R428WH' => $whs]];
$IC670M = Schema::connection($connection)->hasTable('ic670m')
$iC670M = Schema::connection($connection)->hasTable('ic670m')
? DB::connection($connection)->table('ic670m')->get() : collect();
return view('m3::liberty-theme.pages.userControl', compact('ICM428M', 'IC670M', 'power_user', 'USER_INFO'));
@@ -97,7 +101,7 @@ class userControlController extends Controller
// # $result = $conn->PgmCall(Config::get('eproconf.misc.PGM1'), Config::get('eproconf.misc.libname4'), $params, array(), array());
$result = $conn->PgmCall('ICMUSRPRF', 'EWOBJ', $params, [], []);
if (! $result) {
$PGMERRORS = self::PROGRAM_ERROR_PREFIX . $conn->getErrorCode() . self::MESSAGE_SEPARATOR . $conn->getErrorMsg();
$pGMERRORS = self::PROGRAM_ERROR_PREFIX . $conn->getErrorCode() . self::MESSAGE_SEPARATOR . $conn->getErrorMsg();
return 'error profile2';
} else {
@@ -145,17 +149,17 @@ class userControlController extends Controller
// Update record to ICM428M
$ICM428M = DB::connection(config('m3.connection', 'pgsql'))->select("select * from ICM428M where R428US='$request->R428US'");
$iCM428M = DB::connection(config('m3.connection', 'pgsql'))->select("select * from ICM428M where R428US='$request->R428US'");
DB::connection(config('m3.connection', 'pgsql'))->update("update ICM428M
set R428CO='$request->R428CO', R428PL='$request->R428PL', R428WH='$request->R428WH', R428STS='$request->R428STS', R428FIRST='$request->R428FIRST',
R428FAMILY='$request->R428FAMILY', R428EMAIL='$request->R428EMAIL', R428EMPCDE=$request->R428EMPCDE, R428ADMUSR='$request->R428ADMUSR',
R428PWRUSR='$request->R428PWRUSR',
MENU2OPT='" . substr($ICM428M[0]->MENU2OPT, 0, 2) . $request->MENU2OPT3 . substr($ICM428M[0]->MENU2OPT, 3, 3) . $request->MENU2OPT7 . $request->MENU2OPT8 . "',
MENU3OPT='" . $request->MENU3OPT1 . $request->MENU3OPT2 . substr($ICM428M[0]->MENU3OPT, 2, -1) . "',
MENU4OPT='" . $request->MENU4OPT1 . $request->MENU4OPT2 . $request->MENU4OPT3 . substr($ICM428M[0]->MENU4OPT, 3, -1) . "',
MENU5OPT='" . $request->MENU5OPT1 . $request->MENU5OPT2 . $request->MENU5OPT3 . substr($ICM428M[0]->MENU5OPT, 3, 1) . $request->MENU5OPT5 . substr($ICM428M[0]->MENU5OPT, 5, -1) . "',
MENU6OPT='" . $request->MENU6OPT1 . $request->MENU6OPT2 . $request->MENU6OPT3 . substr($ICM428M[0]->MENU6OPT, 3, -1) . "',
MENU2OPT='" . substr($iCM428M[0]->MENU2OPT, 0, 2) . $request->MENU2OPT3 . substr($iCM428M[0]->MENU2OPT, 3, 3) . $request->MENU2OPT7 . $request->MENU2OPT8 . "',
MENU3OPT='" . $request->MENU3OPT1 . $request->MENU3OPT2 . substr($iCM428M[0]->MENU3OPT, 2, -1) . "',
MENU4OPT='" . $request->MENU4OPT1 . $request->MENU4OPT2 . $request->MENU4OPT3 . substr($iCM428M[0]->MENU4OPT, 3, -1) . "',
MENU5OPT='" . $request->MENU5OPT1 . $request->MENU5OPT2 . $request->MENU5OPT3 . substr($iCM428M[0]->MENU5OPT, 3, 1) . $request->MENU5OPT5 . substr($iCM428M[0]->MENU5OPT, 5, -1) . "',
MENU6OPT='" . $request->MENU6OPT1 . $request->MENU6OPT2 . $request->MENU6OPT3 . substr($iCM428M[0]->MENU6OPT, 3, -1) . "',
R42811A='" . $request->R42811A . "',R42821A='" . $request->R42821A . "'
where R428US='$request->R428US'");
@@ -167,7 +171,7 @@ class userControlController extends Controller
public static function callCL(Request $request)
{
$PGMERRORS = '';
$pGMERRORS = '';
// connect to toolkit using DB2 credentials (can also leave blank for default authority)
try {
@@ -182,18 +186,17 @@ class userControlController extends Controller
case 8001:
// "Authorization failure on distributed database connection attempt"
// Usually means a wrong DB2 user or password
$PGMERRORS = self::AUTH_FAILURE_MESSAGE;
$pGMERRORS = self::AUTH_FAILURE_MESSAGE;
break;
case 42705:
$PGMERRORS = self::DATABASE_NOT_FOUND_MESSAGE;
$pGMERRORS = self::DATABASE_NOT_FOUND_MESSAGE;
break;
default:
$PGMERRORS = self::CONNECTION_ERROR_PREFIX . $code . ' ' . $msg;
$pGMERRORS = self::CONNECTION_ERROR_PREFIX . $code . ' ' . $msg;
break;
}
}
// Add LIB
// $result = $conn->CLCommand('ADDLIBLE LIB(MPDAT10)');
@@ -209,18 +212,16 @@ class userControlController extends Controller
// Add Delivery Note Param
// $params[] = $conn->AddParameterPackDec('in', 11, 0, 'ParamIn','','00000087125');
// Start Time Tracking
// $start = microtime(true);
// Config::get('eproconf.misc.PGM1'), Config::get('eproconf.misc.libname4')
// ICM700C EWOBJTST ICM700C ICM700CSBM
$result = $conn->PgmCall('ICMCHGPRF', 'EWOBJ', $params, [], []);
if (! $result) {
$PGMERRORS = self::PROGRAM_ERROR_PREFIX . $conn->getErrorCode() . self::MESSAGE_SEPARATOR . $conn->getErrorMsg();
echo "<script>alert($PGMERRORS);</script>";
$pGMERRORS = self::PROGRAM_ERROR_PREFIX . $conn->getErrorCode() . self::MESSAGE_SEPARATOR . $conn->getErrorMsg();
echo "<script>alert($pGMERRORS);</script>";
return 'error';
exit();
@@ -238,9 +239,9 @@ class userControlController extends Controller
echo "<script>window.location.replace('.')</script>";
}
// if ($PGMERRORS!="") {
// // return back()->withMessage('Can not Create PR: '.$PGMERRORS);
// dump($PGMERRORS);
// if ($pGMERRORS!="") {
// // return back()->withMessage('Can not Create PR: '.$pGMERRORS);
// dump($pGMERRORS);
// }
// else{
// // return $AWREQN;
@@ -255,7 +256,7 @@ class userControlController extends Controller
ini_set('max_input_time', Config::get('arrays.PHPTimeOut'));
ini_set('default_socket_timeout', Config::get('arrays.PHPTimeOut'));
$PGMERRORS = '';
$pGMERRORS = '';
// echo "request="; var_dump($request);
@@ -276,13 +277,13 @@ class userControlController extends Controller
case 8001:
// "Authorization failure on distributed database connection attempt"
// Usually means a wrong DB2 user or password
$PGMERRORS = self::AUTH_FAILURE_MESSAGE;
$pGMERRORS = self::AUTH_FAILURE_MESSAGE;
break;
case 42705:
$PGMERRORS = self::DATABASE_NOT_FOUND_MESSAGE;
$pGMERRORS = self::DATABASE_NOT_FOUND_MESSAGE;
break;
default:
$PGMERRORS = self::CONNECTION_ERROR_PREFIX . $code . ' ' . $msg;
$pGMERRORS = self::CONNECTION_ERROR_PREFIX . $code . ' ' . $msg;
break;
}
}
@@ -296,9 +297,9 @@ class userControlController extends Controller
// echo "<script>alert('After CHGUSRPRF');</script>";
if (! $result) {
$PGMERRORS = self::PROGRAM_ERROR_PREFIX . $conn->getErrorCode() . self::MESSAGE_SEPARATOR . $conn->getErrorMsg();
dump($PGMERRORS);
echo "<script>alert($PGMERRORS);</script>";
$pGMERRORS = self::PROGRAM_ERROR_PREFIX . $conn->getErrorCode() . self::MESSAGE_SEPARATOR . $conn->getErrorMsg();
dump($pGMERRORS);
echo "<script>alert($pGMERRORS);</script>";
return 'error pwd';
}
@@ -308,6 +309,7 @@ class userControlController extends Controller
}
}
private static function programBridgeConnectionError(\Throwable $exception): string
{
$code = (int) $exception->getCode();
@@ -318,5 +320,4 @@ class userControlController extends Controller
default => 'error profile5',
};
}
}