2
\$\begingroup\$

I'm currently building an application that uses the same models in different controllers. Instead of using the normal way, being loading the model in the controller I've build a "core controller" (Foundation_controller) which can load models all other controllers extend from this controller in a way.

In those extended controllers I load my model the following way:

PHP Code: an example controller extends from Foundation

class Mod_controller extends Foundation_controller
{
 private $list_model;
 public function __construct()
    {
       parent::__construct();
       #function from foundation_controller
       $this->list_model = $this->load_model('list_model', true, false);
     }
 private function get_full_list(){
   $this->list_model->get_list_info();
 }
} 

PHP Code: Foundation controller

#Function to load the models from foundation controller

protected function load_model($model_id, $mandatory = false, $die_on_fail = false)
{

    $model_data = $this->get_model_info($model_id);

    if(empty($model_data['model_alias']) || empty($model_data['model_path'] || empty($model_data['model_class_name']))
    ){
        #outputs simple json fail object..
        api_message_present_simple_failure_message('mi-error-01: ' . $model_id);
    }

    if ($this->model_did_load_check($model_data['model_class_name'])) {
        #model is already loaded return the object
        return $this->get_model_object_from_alias($model_data['model_alias']);
    }

    if ($this->check_model_php_file_exists($model_data['model_path'])) {
        #load the model here based on file path and alias.
        $this->load->model($model_data['model_path'], $model_data['model_alias']);
        if ($mandatory) {
            if (!$this->model_did_load_check($model_data['model_class_name'])) {
                if ($die_on_fail) {
                    #outputs simple json fail object..
                    api_message_present_simple_failure_message('mi-error-02: ' . $model_data['model_alias']);
                }
                return false;
            }
        }
    } else {
        if ($mandatory) {
            if ($die_on_fail) {
                #outputs simple json fail object..
                api_message_present_simple_failure_message('mi-error-03: ' . $model_data['model_alias']);
            }
            return false;
        }
    }
    #model successfully loaded return the object
    return $this->get_model_object_from_alias($model_data['model_alias']);
} 

*It' might look confusing here because I load the model in the constructor, but in some controllers I load a specific model (or get the object) inside of a function or at a certain point in a process.

Everything works and fast but now I'm concerned this could lead to a potential security risk, since the models are being loaded "somewhat" globally.

Some models are in subfolders and some versions of the app require a different version of a model. Or don't have some model files at all. (Lite version)

The main thing is that each controller in the app extends from Foundation_controller to use the load function, some controllers are being used for pages with "public" access and others are behind a authenticated users part. The main reason why I have the load_model function is that I don't want to repeat code to check if the model file exists, a particular function exists and that the class has already loaded. Also this approach has less chance for typos and if a model path changes less work to refactor.

Now I have doubts that this is secure, and I wonder if this can pose a security risk of any kind.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.