Skip to content

Commit ce7869d

Browse files
simonLeary42simonLeary42
authored
phpstan for webroot (#426)
1 parent 28604cc commit ce7869d

File tree

9 files changed

+51
-37
lines changed

9 files changed

+51
-37
lines changed

‎phpstan.neon‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ parameters:
22
level: 4
33
paths:
44
- resources
5+
- webroot
56
- test
67
ignoreErrors:
78
# $this, $data comes from UnityMailer
@@ -35,3 +36,8 @@ parameters:
3536
- '#Property UnityWebPortal\\lib\\UnityWebhook::\$Subject is never written, only read\.#'
3637
paths:
3738
- resources/lib/UnityWebhook.php
39+
# init.php sets these when the user is logged in
40+
- messages:
41+
- '#Variable \$(LDAP|SQL|MAILER|WEBHOOK|GITHUB|SSO|OPERATOR|USER|SEND_PIMESG_TO_ADMINS|LOC_HEADER|LOC_FOOTER) might not be defined.#'
42+
paths:
43+
- webroot/*

‎resources/lib/UnityHTTPD.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ public static function errorHandler(int $severity, string $message, string $file
228228
return false;
229229
}
230230

231-
public static function getPostData(string $key): mixed
231+
public static function getPostData(string $key): string
232232
{
233233
if (!array_key_exists("REQUEST_METHOD", $_SERVER)) {
234234
throw new RuntimeException('$_SERVER has no array key "REQUEST_METHOD"');
@@ -243,7 +243,7 @@ public static function getPostData(string $key): mixed
243243
}
244244

245245
/* returns null if not found and not $throw_if_not_found */
246-
public static function getQueryParameter(string $key, bool $throw_if_not_found = true): mixed
246+
public static function getQueryParameter(string $key, bool $throw_if_not_found = true): ?string
247247
{
248248
if (!array_key_exists($key, $_GET)) {
249249
if ($throw_if_not_found) {

‎test/functional/PIMemberRequestTest.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,8 @@ public function testRequestMembership()
4848
$this->requestMembership("asdlkjasldkj");
4949
$this->assertMessageExists(
5050
UnityHTTPDMessageLevel::ERROR,
51+
"/^This PI Doesn't Exist$/",
5152
"/.*/",
52-
"/^This PI doesn't exist$/",
5353
);
5454
$this->requestMembership($pi_group->getOwner()->getMail());
5555
$this->assertTrue($SQL->requestExists($uid, $gid));

‎webroot/admin/ajax/get_group_members.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
use UnityWebPortal\lib\UnityGroup;
66
use UnityWebPortal\lib\UnityHTTPD;
7+
use UnityWebPortal\lib\UserFlag;
78

89
if (!$USER->getFlag(UserFlag::ADMIN)) {
910
UnityHTTPD::forbidden("not an admin");

‎webroot/admin/ajax/get_page_contents.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
require_once __DIR__ . "/../../../resources/autoload.php";
44

55
use UnityWebPortal\lib\UnityHTTPD;
6+
use UnityWebPortal\lib\UserFlag;
67

78
if (!$USER->getFlag(UserFlag::ADMIN)) {
89
UnityHTTPD::forbidden("not an admin");

‎webroot/admin/pi-mgmt.php‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,36 +12,37 @@
1212
UnityHTTPD::forbidden("not an admin");
1313
}
1414

15+
$getUserFromPost = function () {
16+
global $LDAP, $SQL, $MAILER, $WEBHOOK;
17+
return new UnityUser(UnityHTTPD::getPostData("uid"), $LDAP, $SQL, $MAILER, $WEBHOOK);
18+
};
19+
1520
if ($_SERVER["REQUEST_METHOD"] == "POST") {
1621
UnityHTTPD::validatePostCSRFToken();
17-
if (isset($_POST["uid"])) {
18-
$form_user = new UnityUser($_POST["uid"], $LDAP, $SQL, $MAILER, $WEBHOOK);
19-
}
20-
2122
switch ($_POST["form_type"]) {
2223
case "req":
24+
$form_user = $getUserFromPost();
2325
if ($_POST["action"] == "Approve") {
2426
$group = $form_user->getPIGroup();
2527
$group->approveGroup($OPERATOR);
2628
} elseif ($_POST["action"] == "Deny") {
2729
$group = $form_user->getPIGroup();
2830
$group->denyGroup($OPERATOR);
2931
}
30-
3132
break;
3233
case "reqChild":
34+
$form_user = $getUserFromPost();
3335
$parent_group = new UnityGroup($_POST["pi"], $LDAP, $SQL, $MAILER, $WEBHOOK);
3436
if ($_POST["action"] == "Approve") {
3537
$parent_group->approveUser($form_user);
3638
} elseif ($_POST["action"] == "Deny") {
3739
$parent_group->denyUser($form_user);
3840
}
39-
4041
break;
4142
case "remUserChild":
43+
$form_user = $getUserFromPost();
4244
$parent = new UnityGroup($_POST["pi"], $LDAP, $SQL, $MAILER, $WEBHOOK);
4345
$parent->removeUser($form_user);
44-
4546
break;
4647
}
4748
}

‎webroot/admin/user-mgmt.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
case "viewAsUser":
1616
$_SESSION["viewUser"] = $_POST["uid"];
1717
UnityHTTPD::redirect(getURL("panel/account.php"));
18-
break;
18+
break; /** @phpstan-ignore deadCode.unreachable */
1919
}
2020
}
2121

‎webroot/panel/groups.php‎

Lines changed: 24 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -6,29 +6,30 @@
66
use UnityWebPortal\lib\UnityGroup;
77
use UnityWebPortal\lib\UnityHTTPD;
88

9+
$getPIGroupFromPost = function () {
10+
global $LDAP, $SQL, $MAILER, $WEBHOOK;
11+
$gid_or_mail = UnityHTTPD::getPostData("pi");
12+
if (substr($gid_or_mail, 0, 3) !== "pi_" && str_contains($gid_or_mail, "@")) {
13+
try {
14+
$gid_or_mail = UnityGroup::ownerMail2GID($gid_or_mail);
15+
} catch (EntryNotFoundException) {
16+
// oh well, we tried
17+
}
18+
}
19+
$pi_group = new UnityGroup($gid_or_mail, $LDAP, $SQL, $MAILER, $WEBHOOK);
20+
if (!$pi_group->exists()) {
21+
UnityHTTPD::messageError("This PI Doesn't Exist", $gid_or_mail);
22+
UnityHTTPD::redirect();
23+
}
24+
return $pi_group;
25+
};
26+
927
if ($_SERVER["REQUEST_METHOD"] == "POST") {
1028
UnityHTTPD::validatePostCSRFToken();
1129
if (isset($_POST["form_type"])) {
12-
if (isset($_POST["pi"])) {
13-
$pi_groupname = $_POST["pi"];
14-
if (substr($pi_groupname, 0, 3) !== "pi_" && str_contains($pi_groupname, "@")) {
15-
try {
16-
$pi_groupname = UnityGroup::ownerMail2GID($pi_groupname);
17-
} catch (EntryNotFoundException) {
18-
}
19-
}
20-
$pi_account = new UnityGroup($pi_groupname, $LDAP, $SQL, $MAILER, $WEBHOOK);
21-
if (!$pi_account->exists()) {
22-
UnityHTTPD::messageError(
23-
"Invalid Group Membership Request",
24-
"This PI doesn't exist"
25-
);
26-
UnityHTTPD::redirect();
27-
}
28-
}
29-
3030
switch ($_POST["form_type"]) {
3131
case "addPIform":
32+
$pi_account = $getPIGroupFromPost();
3233
if (!isset($_POST["tos"]) || $_POST["tos"] != "agree") {
3334
UnityHTTPD::badRequest("user did not agree to terms of service");
3435
}
@@ -50,15 +51,17 @@
5051
}
5152
$pi_account->newUserRequest($USER);
5253
UnityHTTPD::redirect();
53-
break;
54+
break; /** @phpstan-ignore deadCode.unreachable */
5455
case "removePIForm":
56+
$pi_account = $getPIGroupFromPost();
5557
$pi_account->removeUser($USER);
5658
UnityHTTPD::redirect();
57-
break;
59+
break; /** @phpstan-ignore deadCode.unreachable */
5860
case "cancelPIForm":
61+
$pi_account = $getPIGroupFromPost();
5962
$pi_account->cancelGroupJoinRequest($USER);
6063
UnityHTTPD::redirect();
61-
break;
64+
break; /** @phpstan-ignore deadCode.unreachable */
6265
}
6366
}
6467
}

‎webroot/panel/pi.php‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,22 +11,24 @@
1111
UnityHTTPD::forbidden("not a PI");
1212
}
1313

14+
$getUserFromPost = function () {
15+
global $LDAP, $SQL, $MAILER, $WEBHOOK;
16+
return new UnityUser(UnityHTTPD::getPostData("uid"), $LDAP, $SQL, $MAILER, $WEBHOOK);
17+
};
18+
1419
if ($_SERVER["REQUEST_METHOD"] == "POST") {
1520
UnityHTTPD::validatePostCSRFToken();
16-
if (isset($_POST["uid"])) {
17-
$form_user = new UnityUser($_POST["uid"], $LDAP, $SQL, $MAILER, $WEBHOOK);
18-
}
19-
2021
switch ($_POST["form_type"]) {
2122
case "userReq":
23+
$form_user = $getUserFromPost();
2224
if ($_POST["action"] == "Approve") {
2325
$group->approveUser($form_user);
2426
} elseif ($_POST["action"] == "Deny") {
2527
$group->denyUser($form_user);
2628
}
27-
2829
break;
2930
case "remUser":
31+
$form_user = $getUserFromPost();
3032
// remove user button clicked
3133
$group->removeUser($form_user);
3234

0 commit comments

Comments
 (0)