omnilight / yii2-finance Goto Github PK

I've reviewed your code a bit and noticed you do not use any database transactions when inserting a new Transaction into the database. This is very dangerous as it can lead to dirty reads, non-repeatable reads or even phantom reads which will break your entire transaction chain by causing the balance_before and balance_after to end up with incorrect values!

You need to read the current balance from your purse and then store the Transaction both inside a database transaction! Not only that, but it has to be specifically a SERIALIZABLE transaction. Databases typically use "repeatable read" transactions by default which are not safe from phantom reads. Unfortunately though while Yii2 does have built-in ActiveRecord transactions it does not let us set the isolation level in advance, so for now you may need to override the insert() method. :(