Fix Business Logic Errors in Phalcon

Business logic flaws in Phalcon aren't about syntax errors; they are about broken assumptions in your application flow. If your controller trusts the client to define the state of a transaction—like the price of an item or the status of an account—you've already lost. In Phalcon's MVC architecture, these errors typically manifest when developers bypass the Model's integrity or fail to validate state transitions against the database 'source of truth'.

The Vulnerable Pattern

public function updateOrderAction() {
    $orderId = $this->request->getPost('id');
    $newPrice = $this->request->getPost('price'); // CRITICAL: Trusting client-side price
    $status = $this->request->getPost('status');
$order = Orders::findFirstById($orderId);
if ($order) {
    $order->price = $newPrice;
    $order->status = $status;
    $order->save();
}
}

The Secure Implementation

The vulnerable snippet suffers from Parameter Tampering. By accepting 'price' directly from the POST body, an attacker can modify the cost of an item via intercepting the request. The secure version implements three defensive layers: 1. Server-side Source of Truth: It ignores the price sent by the client and fetches the actual price from the Product model. 2. State Machine Validation: It prevents modifying orders that are already 'COMPLETED'. 3. Strict Whitelisting: It ensures the 'status' field can only be changed to predefined, safe values. Always treat the Request object as untrusted input and use the ORM to verify the current state before applying updates.

public function updateOrderAction() {
    $orderId = $this->request->getPost('id', 'int');
    $order = Orders::findFirstById($orderId);
if (!$order || $order->status === 'COMPLETED') {
    return $this->response->setStatusCode(403, 'Illegal State Transition');
}

// Fetch the real price from the Product model, never the Request
$product = $order->getProduct();
$order->price = $product->price;

// Use a whitelist for status transitions
$allowedStatus = ['PENDING', 'SHIPPED'];
$requestedStatus = $this->request->getPost('status', 'string');

if (in_array($requestedStatus, $allowedStatus)) {
    $order->status = $requestedStatus;
}

if (!$order->update()) {
    foreach ($order->getMessages() as $message) {
        $this->flash->error($message);
    }
}
}