Skip to content

Commit b10be0e

Browse files
PDowneyPDowney
committed
Fixes
1 parent 1bb524e commit b10be0e

4 files changed

Lines changed: 93 additions & 49 deletions

File tree

‎config/var/www/admin/control-panel/api.php‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -265,14 +265,14 @@ function csrfTokenIsValid(
265265
$path = '/' . ltrim($endpoint_param, '/');
266266
$path = rtrim($path, '/'); // Remove trailing slashes
267267
} else {
268-
$path = parse_url($request_uri, PHP_URL_PATH); // codacy:ignore - parse_url() required for URL parsing
269-
if ($path !== false) {
270-
if (str_starts_with($path, '/api/')) {
271-
$path = substr($path, 4);
272-
} elseif ($path === '/api') {
273-
$path = '/';
268+
$parsed_path = parse_url($request_uri, PHP_URL_PATH); // codacy:ignore - parse_url() required for URL parsing
269+
if (is_string($parsed_path)) {
270+
if (str_starts_with($parsed_path, '/api/')) {
271+
$parsed_path = substr($parsed_path, 4);
272+
} elseif ($parsed_path === '/api') {
273+
$parsed_path = '/';
274274
}
275-
$path = rtrim($path, '/'); // Remove trailing slashes
275+
$path = rtrim($parsed_path, '/'); // Remove trailing slashes
276276
}
277277
}
278278

‎config/var/www/admin/control-panel/classes/Request.php‎

Lines changed: 20 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,23 @@
1616
* @method string scheme()
1717
* @method string remoteAddress()
1818
*/
19+
require_once __DIR__ . '/RequestServerAccessor.php';
20+
1921
class Request
2022
{
2123
/**
22-
* @var array<string, mixed>
24+
* Server-derived request value accessor.
2325
*/
24-
private array $server;
26+
private RequestServerAccessor $serverAccessor;
27+
28+
private const SERVER_ACCESSOR_METHODS = [
29+
'hasServer' => true,
30+
'serverString' => true,
31+
'uri' => true,
32+
'hostHeader' => true,
33+
'scheme' => true,
34+
'remoteAddress' => true,
35+
];
2536

2637
/**
2738
* @var array<string, mixed>
@@ -45,7 +56,7 @@ class Request
4556
public function __construct(?array $server = null, ?array $query = null, ?array $post = null, ?string $body = null)
4657
{
4758
// codacy:ignore-start - Request superglobal access is intentionally centralized in this wrapper
48-
$this->server = $server ?? $_SERVER;
59+
$this->serverAccessor = new RequestServerAccessor($server ?? $_SERVER);
4960
$this->query = $query ?? $_GET;
5061
$this->post = $post ?? $_POST;
5162
// codacy:ignore-end
@@ -54,48 +65,16 @@ public function __construct(?array $server = null, ?array $query = null, ?array
5465

5566
public function __call(string $name, array $arguments): mixed
5667
{
57-
switch ($name) {
58-
case 'hasServer':
59-
return is_string($arguments[0] ?? null) && array_key_exists($arguments[0], $this->server);
60-
61-
case 'serverString':
62-
return $this->serverString(
63-
is_string($arguments[0] ?? null) ? $arguments[0] : '',
64-
is_string($arguments[1] ?? null) ? $arguments[1] : ''
65-
);
66-
67-
case 'uri':
68-
return $this->serverString('REQUEST_URI');
69-
70-
case 'hostHeader':
71-
return strtolower(trim($this->serverString('HTTP_HOST')));
72-
73-
case 'scheme':
74-
$https = strtolower($this->serverString('HTTPS'));
75-
return $https !== '' && $https !== 'off' && $https !== '0' ? 'https' : 'http';
76-
77-
case 'remoteAddress':
78-
$ipAddress = $this->serverString('REMOTE_ADDR', 'unknown');
79-
if ($ipAddress === 'unknown') {
80-
return 'unknown';
81-
}
82-
return filter_var($ipAddress, FILTER_VALIDATE_IP) !== false ? $ipAddress : 'invalid';
83-
84-
default:
85-
throw new BadMethodCallException('Unknown request method: ' . $name);
68+
if (!isset(self::SERVER_ACCESSOR_METHODS[$name])) {
69+
throw new BadMethodCallException('Unknown request method: ' . $name);
8670
}
87-
}
88-
89-
private function serverString(string $key, string $default = ''): string
90-
{
91-
$value = $this->server[$key] ?? $default;
9271

93-
return is_scalar($value) ? (string) $value : $default;
72+
return $this->serverAccessor->{$name}(...$arguments);
9473
}
9574

9675
public function method(): string
9776
{
98-
$method = strtoupper($this->serverString('REQUEST_METHOD', 'GET'));
77+
$method = strtoupper($this->serverAccessor->serverString('REQUEST_METHOD', 'GET'));
9978

10079
return preg_match('/^[A-Z]+$/', $method) === 1 ? $method : 'GET';
10180
}
@@ -107,11 +86,11 @@ public function header(string $name): ?string
10786
? $normalized
10887
: 'HTTP_' . $normalized;
10988

110-
if (!array_key_exists($serverKey, $this->server)) {
89+
if (!$this->serverAccessor->hasServer($serverKey)) {
11190
return null;
11291
}
11392

114-
$value = $this->serverString($serverKey);
93+
$value = $this->serverAccessor->serverString($serverKey);
11594

11695
return $value === '' ? null : $value;
11796
}

‎config/var/www/admin/control-panel/classes/RequestServerAccessor.php‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<?php
2+
/**
3+
* EngineScript Admin Dashboard - Server Request Accessor
4+
*
5+
* Provides normalized access to server-derived request values.
6+
*
7+
* @package EngineScript\Dashboard\Classes
8+
* @version 1.0.0
9+
* @security HIGH - Normalizes server request input for the dashboard API
10+
*/
11+
final class RequestServerAccessor
12+
{
13+
/**
14+
* @param array<string, mixed> $server
15+
*/
16+
public function __construct(private array $server)
17+
{
18+
}
19+
20+
public function hasServer(string $key): bool
21+
{
22+
return array_key_exists($key, $this->server);
23+
}
24+
25+
public function serverString(string $key, string $default = ''): string
26+
{
27+
$value = $this->server[$key] ?? $default;
28+
29+
return is_scalar($value) ? (string) $value : $default;
30+
}
31+
32+
public function uri(): string
33+
{
34+
return $this->serverString('REQUEST_URI');
35+
}
36+
37+
public function hostHeader(): string
38+
{
39+
return strtolower(trim($this->serverString('HTTP_HOST')));
40+
}
41+
42+
public function scheme(): string
43+
{
44+
$https = strtolower($this->serverString('HTTPS'));
45+
46+
return $https !== '' && $https !== 'off' && $https !== '0' ? 'https' : 'http';
47+
}
48+
49+
public function remoteAddress(): string
50+
{
51+
$ipAddress = $this->serverString('REMOTE_ADDR', 'unknown');
52+
53+
if ($ipAddress === 'unknown') {
54+
return 'unknown';
55+
}
56+
57+
return filter_var($ipAddress, FILTER_VALIDATE_IP) !== false ? $ipAddress : 'invalid';
58+
}
59+
}

‎config/var/www/admin/control-panel/classes/UptimeRobotAPI.php‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,13 @@ private function makeRequest(string $endpoint, array $params = []): array|false
120120

121121
$params['api_key'] = $this->apiKey;
122122

123-
$curlHandle = $this->createCurlHandle();
123+
try {
124+
$curlHandle = $this->createCurlHandle();
125+
} catch (CurlInitException $e) {
126+
$this->logError('Unable to initialize cURL handle', ['error' => $e->getMessage()]);
127+
return false;
128+
}
129+
124130
if ($curlHandle === false) {
125131
return false;
126132
}

0 commit comments

Comments
 (0)