Avoid error when a bad `order` parameter is given

[github/wallabag/wallabag.git] / src / Wallabag / CoreBundle / Repository / EntryRepository.php

diff --git a/src/Wallabag/CoreBundle/Repository/EntryRepository.php b/src/Wallabag/CoreBundle/Repository/EntryRepository.php
index ecc159fc0463b8585c75d90e1a8ba53d76e99d80..cebce71474bb534c223c5d0a95740cff8dd8af86 100644 (file)
--- a/src/Wallabag/CoreBundle/Repository/EntryRepository.php
+++ b/src/Wallabag/CoreBundle/Repository/EntryRepository.php
@@ -21,7 +21,7 @@ class EntryRepository extends EntityRepository
     public function getBuilderForAllByUser($userId)
     {
         return $this
-            ->getBuilderByUser($userId)
+            ->getSortedQueryBuilderByUser($userId)
         ;
     }
 
@@ -35,7 +35,7 @@ class EntryRepository extends EntityRepository
     public function getBuilderForUnreadByUser($userId)
     {
         return $this
-            ->getBuilderByUser($userId)
+            ->getSortedQueryBuilderByUser($userId)
             ->andWhere('e.isArchived = false')
         ;
     }
@@ -50,7 +50,7 @@ class EntryRepository extends EntityRepository
     public function getBuilderForArchiveByUser($userId)
     {
         return $this
-            ->getBuilderByUser($userId)
+            ->getSortedQueryBuilderByUser($userId)
             ->andWhere('e.isArchived = true')
         ;
     }
@@ -65,7 +65,7 @@ class EntryRepository extends EntityRepository
     public function getBuilderForStarredByUser($userId)
     {
         return $this
-            ->getBuilderByUser($userId, 'starredAt', 'desc')
+            ->getSortedQueryBuilderByUser($userId, 'starredAt', 'desc')
             ->andWhere('e.isStarred = true')
         ;
     }
@@ -82,7 +82,7 @@ class EntryRepository extends EntityRepository
     public function getBuilderForSearchByUser($userId, $term, $currentRoute)
     {
         $qb = $this
-            ->getBuilderByUser($userId);
+            ->getSortedQueryBuilderByUser($userId);
 
         if ('starred' === $currentRoute) {
             $qb->andWhere('e.isStarred = true');
@@ -102,7 +102,7 @@ class EntryRepository extends EntityRepository
     }
 
     /**
-     * Retrieves untagged entries for a user.
+     * Retrieve a sorted list of untagged entries for a user.
      *
      * @param int $userId
      *
@@ -111,8 +111,21 @@ class EntryRepository extends EntityRepository
     public function getBuilderForUntaggedByUser($userId)
     {
         return $this
-            ->getBuilderByUser($userId)
-            ->andWhere('size(e.tags) = 0');
+            ->sortQueryBuilder($this->getRawBuilderForUntaggedByUser($userId));
+    }
+
+    /**
+     * Retrieve untagged entries for a user.
+     *
+     * @param int $userId
+     *
+     * @return QueryBuilder
+     */
+    public function getRawBuilderForUntaggedByUser($userId)
+    {
+        return $this->getQueryBuilderByUser($userId)
+            ->leftJoin('e.tags', 't')
+            ->andWhere('t.id is null');
     }
 
     /**
@@ -129,11 +142,11 @@ class EntryRepository extends EntityRepository
      *
      * @return Pagerfanta
      */
-    public function findEntries($userId, $isArchived = null, $isStarred = null, $isPublic = null, $sort = 'created', $order = 'ASC', $since = 0, $tags = '')
+    public function findEntries($userId, $isArchived = null, $isStarred = null, $isPublic = null, $sort = 'created', $order = 'asc', $since = 0, $tags = '')
     {
         $qb = $this->createQueryBuilder('e')
             ->leftJoin('e.tags', 't')
-            ->where('e.user =:userId')->setParameter('userId', $userId);
+            ->where('e.user = :userId')->setParameter('userId', $userId);
 
         if (null !== $isArchived) {
             $qb->andWhere('e.isArchived = :isArchived')->setParameter('isArchived', (bool) $isArchived);
@@ -151,12 +164,31 @@ class EntryRepository extends EntityRepository
             $qb->andWhere('e.updatedAt > :since')->setParameter('since', new \DateTime(date('Y-m-d H:i:s', $since)));
         }
 
-        if ('' !== $tags) {
-            foreach (explode(',', $tags) as $tag) {
-                $qb->andWhere('t.label = :label')->setParameter('label', $tag);
+        if (\is_string($tags) && '' !== $tags) {
+            foreach (explode(',', $tags) as $i => $tag) {
+                $entryAlias = 'e' . $i;
+                $tagAlias = 't' . $i;
+
+                // Complexe queries to ensure multiple tags are associated to an entry
+                // https://stackoverflow.com/a/6638146/569101
+                $qb->andWhere($qb->expr()->in(
+                    'e.id',
+                    $this->createQueryBuilder($entryAlias)
+                        ->select($entryAlias . '.id')
+                        ->leftJoin($entryAlias . '.tags', $tagAlias)
+                        ->where($tagAlias . '.label = :label' . $i)
+                        ->getDQL()
+                ));
+
+                // bound parameter to the main query builder
+                $qb->setParameter('label' . $i, $tag);
             }
         }
 
+        if (!\in_array(strtolower($order), ['asc', 'desc'], true)) {
+            throw new \Exception('Order "' . $order . '" parameter is wrong, allowed: asc or desc');
+        }
+
         if ('created' === $sort) {
             $qb->orderBy('e.id', $order);
         } elseif ('updated' === $sort) {
@@ -181,7 +213,7 @@ class EntryRepository extends EntityRepository
             ->innerJoin('e.tags', 't')
             ->innerJoin('e.user', 'u')
             ->addSelect('t', 'u')
-            ->where('e.user=:userId')->setParameter('userId', $userId)
+            ->where('e.user = :userId')->setParameter('userId', $userId)
         ;
 
         return $qb->getQuery()->getResult();
@@ -245,7 +277,7 @@ class EntryRepository extends EntityRepository
      */
     public function removeTag($userId, Tag $tag)
     {
-        $entries = $this->getBuilderByUser($userId)
+        $entries = $this->getSortedQueryBuilderByUser($userId)
             ->innerJoin('e.tags', 't')
             ->andWhere('t.id = :tagId')->setParameter('tagId', $tag->getId())
             ->getQuery()
@@ -281,7 +313,7 @@ class EntryRepository extends EntityRepository
      */
     public function findAllByTagId($userId, $tagId)
     {
-        return $this->getBuilderByUser($userId)
+        return $this->getSortedQueryBuilderByUser($userId)
             ->innerJoin('e.tags', 't')
             ->andWhere('t.id = :tagId')->setParameter('tagId', $tagId)
             ->getQuery()
@@ -305,7 +337,7 @@ class EntryRepository extends EntityRepository
             ->getQuery()
             ->getResult();
 
-        if (count($res)) {
+        if (\count($res)) {
             return current($res);
         }
 
@@ -323,7 +355,7 @@ class EntryRepository extends EntityRepository
     {
         $qb = $this->createQueryBuilder('e')
             ->select('count(e)')
-            ->where('e.user=:userId')->setParameter('userId', $userId)
+            ->where('e.user = :userId')->setParameter('userId', $userId)
         ;
 
         return (int) $qb->getQuery()->getSingleScalarResult();
@@ -399,7 +431,20 @@ class EntryRepository extends EntityRepository
     }
 
     /**
-     * Return a query builder to used by other getBuilderFor* method.
+     * Return a query builder to be used by other getBuilderFor* method.
+     *
+     * @param int $userId
+     *
+     * @return QueryBuilder
+     */
+    private function getQueryBuilderByUser($userId)
+    {
+        return $this->createQueryBuilder('e')
+            ->andWhere('e.user = :userId')->setParameter('userId', $userId);
+    }
+
+    /**
+     * Return a sorted query builder to be used by other getBuilderFor* method.
      *
      * @param int    $userId
      * @param string $sortBy
@@ -407,10 +452,23 @@ class EntryRepository extends EntityRepository
      *
      * @return QueryBuilder
      */
-    private function getBuilderByUser($userId, $sortBy = 'createdAt', $direction = 'desc')
+    private function getSortedQueryBuilderByUser($userId, $sortBy = 'createdAt', $direction = 'desc')
     {
-        return $this->createQueryBuilder('e')
-            ->andWhere('e.user = :userId')->setParameter('userId', $userId)
+        return $this->sortQueryBuilder($this->getQueryBuilderByUser($userId), $sortBy, $direction);
+    }
+
+    /**
+     * Return the given QueryBuilder with an orderBy() call.
+     *
+     * @param QueryBuilder $qb
+     * @param string       $sortBy
+     * @param string       $direction
+     *
+     * @return QueryBuilder
+     */
+    private function sortQueryBuilder(QueryBuilder $qb, $sortBy = 'createdAt', $direction = 'desc')
+    {
+        return $qb
             ->orderBy(sprintf('e.%s', $sortBy), $direction);
     }
 }