ucfopen · clpetersonucf · Oct 31, 2022 · Oct 19, 2022
diff --git a/composer.lock b/composer.lock
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
@@ -33,6 +33,9 @@ services:
       - BOOL_LTI_LOG_FOR_DEBUGGING=true
       - CACHE_DRIVER=memcached
       - CIPHER_KEY=${DEV_ONLY_SECRET_CIPHER_KEY}
+      - CRYPTO_HMAC=${DEV_ONLY_SECRET_CIPHER_KEY}
+      - CRYPTO_IV=${DEV_ONLY_SECRET_CIPHER_KEY}
+      - CRYPTO_KEY=${DEV_ONLY_SECRET_CIPHER_KEY}
       - DATABASE_URL=mysql://${MYSQL_USER}:${MYSQL_PASSWORD}@mysql/${MYSQL_DATABASE}
       - FUEL_ENV=development
       - FUEL_LOG_THRESHOLD=100

diff --git a/fuel/app/classes/materia/session/playdataexporter.php b/fuel/app/classes/materia/session/playdataexporter.php
@@ -108,7 +108,7 @@ protected static function storage($inst, $semesters)
 				$len = count($storage_data[$semester_str]);
 				for ($i = 0; $i < $len; $i++)
 				{
-					$d =& $storage_data[$semester_str][$i];
+					$d = &$storage_data[$semester_str][$i];
 					$d['data'] = $d['data'] + $fields;
 					ksort($d['data']);
 

diff --git a/fuel/app/classes/materia/utils.php b/fuel/app/classes/materia/utils.php
@@ -1,13 +1,4 @@
 <?php
-/**
- * NEEDS DOCUMENTATION
- *
- * General utilities that are needed but don't fit anywhere else
- *
- * @package	    Main
- * @subpackage  scoring
- * @author      ggalperi
- */
 
 namespace Materia;
 
@@ -27,6 +18,11 @@ public static function get_date_ranges()
 			->as_array();
 	}
 
+	public static function safeTrim($value)
+	{
+		return is_string($value) ? trim($value) : $value;
+	}
+
 	public static function get_avatar($size=35, $user=false)
 	{
 		$default = \Config::get('materia.urls.static').'/img/default-avatar.jpg';

diff --git a/fuel/app/classes/materia/widget/question.php b/fuel/app/classes/materia/widget/question.php
@@ -1,12 +1,4 @@
 <?php
-/**
- * NEEDS DOCUMENTATION
- *
- * The widget managers for the Materia package.
- *
- * @package	    Main
- * @author      ADD NAME HERE
- */
 
 namespace Materia;
 
@@ -43,7 +35,7 @@ public function __construct($properties=[])
 					foreach ($q as $q_prop => &$q_val)
 					{
 						if ( ! in_array($q_prop, $this->_question_properties)) unset($q[$q_prop]);
-						if (is_string($q_val)) $q_val = trim($q_val); // trim all strings
+						$q_val = Utils::safeTrim($q_val); // trim all strings
 					}
 				}
 			}
@@ -54,7 +46,7 @@ public function __construct($properties=[])
 					foreach ($a as $a_prop => &$a_val)
 					{
 						if ( ! in_array($a_prop, $this->_answer_properties)) unset($a[$a_prop]);
-						if (is_string($a_val)) $a_val = trim($a_val); // trim all strings
+						$a_val = Utils::safeTrim($a_val); // trim all strings
 					}
 				}
 			}

diff --git a/fuel/app/classes/materia/widget/question/manager.php b/fuel/app/classes/materia/widget/question/manager.php
@@ -23,7 +23,7 @@ class Widget_Question_Manager
 	static public function get_users_questions($user_id, $q_type=null)
 	{
 		//q_type is a urlencoded string containing the types of questions to search for
-		$q_type = urldecode($q_type);
+		$q_type = is_null($q_type) ? '' : urldecode($q_type);
 		$q_type = str_replace('Question/Answer', 'QA', $q_type);
 		$q_type = str_replace('Multiple Choice', 'MC', $q_type);
 

diff --git a/fuel/app/config/oil.php b/fuel/app/config/oil.php
@@ -3,7 +3,6 @@
 	'phpunit' => array(
 		// we're not using any autoloading paths, this is only here to prevent oil from erroring when it can't load this file
 		'autoload_path' => APPPATH.'classes'.DS.'materia'.DS.'log.php' ,
-		# Load phpunit from the vendor path
 		# and turn on the zend_extension for xdebug so we can get code coverage
 		'binary_path' => 'php -dzend_extension=xdebug.so '.VENDORPATH.'bin/phpunit',
 	),

diff --git a/fuel/app/modules/lti/classes/ltilaunch.php b/fuel/app/modules/lti/classes/ltilaunch.php
@@ -1,6 +1,7 @@
 <?php
 
 namespace Lti;
+use \Materia\Utils;
 
 class LtiLaunch
 {
@@ -19,26 +20,26 @@ public static function from_request()
 		$remote_user_field = $config['remote_username'] ?? 'user_id';
 
 		// trim all the roles
-		$roles = explode(',', \Input::param('roles'));
-		$roles = array_map( function($role) { return trim($role); }, $roles); // @codingStandardsIgnoreLine
+		$roles = explode(',', \Input::param('roles', ''));
+		$roles = array_map( function($role) { return Utils::safeTrim($role); }, $roles); // @codingStandardsIgnoreLine
 
 		$vars = (object) [
-			'message_type'   => trim(\Input::param('lti_message_type', '')),
-			'source_id'      => trim(\Input::param('lis_result_sourcedid', false)), // the unique id for this course&context&user&launch used for returning scores
-			'service_url'    => trim(\Input::param('lis_outcome_service_url', false)), // where to send score data back to, can be blank if not supported
-			'resource_id'    => trim(\Input::param('resource_link_id', false)), // unique placement of this tool in the consumer
-			'context_id'     => trim(\Input::param('context_id', false)),
-			'context_title'  => trim(\Input::param('context_title', false)),
-			'consumer_id'    => trim(\Input::param('tool_consumer_instance_guid', false)), // unique install id of this tool
-			'consumer'       => trim(\Input::param('tool_consumer_info_product_family_code', false)),
-			'email'          => trim(\Input::param('lis_person_contact_email_primary')),
-			'last'           => trim(\Input::param('lis_person_name_family', '')),
-			'first'          => trim(\Input::param('lis_person_name_given', '')),
-			'fullname'       => trim(\Input::param('lis_person_name_full', '')),
-			'outcome_ext'    => trim(\Input::param('ext_outcome_data_values_accepted'), ''),
+			'message_type'   => Utils::safeTrim(\Input::param('lti_message_type', '')),
+			'source_id'      => Utils::safeTrim(\Input::param('lis_result_sourcedid', false)), // the unique id for this course&context&user&launch used for returning scores
+			'service_url'    => Utils::safeTrim(\Input::param('lis_outcome_service_url', false)), // where to send score data back to, can be blank if not supported
+			'resource_id'    => Utils::safeTrim(\Input::param('resource_link_id', false)), // unique placement of this tool in the consumer
+			'context_id'     => Utils::safeTrim(\Input::param('context_id', false)),
+			'context_title'  => Utils::safeTrim(\Input::param('context_title', false)),
+			'consumer_id'    => Utils::safeTrim(\Input::param('tool_consumer_instance_guid', false)), // unique install id of this tool
+			'consumer'       => Utils::safeTrim(\Input::param('tool_consumer_info_product_family_code', false)),
+			'email'          => Utils::safeTrim(\Input::param('lis_person_contact_email_primary')),
+			'last'           => Utils::safeTrim(\Input::param('lis_person_name_family', '')),
+			'first'          => Utils::safeTrim(\Input::param('lis_person_name_given', '')),
+			'fullname'       => Utils::safeTrim(\Input::param('lis_person_name_full', '')),
+			'outcome_ext'    => Utils::safeTrim(\Input::param('ext_outcome_data_values_accepted'), ''),
 			'roles'          => $roles,
-			'remote_id'      => trim(\Input::param($remote_id_field)),
-			'username'       => trim(\Input::param($remote_user_field)),
+			'remote_id'      => Utils::safeTrim(\Input::param($remote_id_field)),
+			'username'       => Utils::safeTrim(\Input::param($remote_user_field)),
 		];
 
 		static::$launch = $vars;
@@ -60,7 +61,8 @@ public static function config()
 		}
 
 		// determine which config to use
-		$consumer       = trim(\Input::param('tool_consumer_info_product_family_code', null));
+		$consumer       = \Input::param('tool_consumer_info_product_family_code', null);
+		$consumer       = Utils::safeTrim($consumer);
 		$configs        = \Config::get('lti::lti.consumers');
 		$allow_fallback = \Config::get('lti::lti.graceful_fallback_to_default', true);
 		$default        = $allow_fallback ? $configs['default'] : null;

diff --git a/fuel/app/phpunit.xml b/fuel/app/phpunit.xml
@@ -29,9 +29,6 @@
 		</listener>
 	</listeners>
 	<testsuites>
-<!-- 		<testsuite name="core">
-			<directory suffix=".php">../core/tests</directory>
-		</testsuite> -->
 		<testsuite name="packages">
 			<directory suffix=".php">../packages/*/tests</directory>
 			<exclude>../packages/materia/tests/widget_source</exclude>
@@ -57,7 +54,4 @@
 			<directory suffix=".php">../app/tasks</directory>
 		</whitelist>
 	</filter>
-<!-- 	<logging>
-		<log type="coverage-html" target="../../coverage"/>
-	</logging> -->
 </phpunit>
diff --git a/fuel/app/tests/classes/materia/perm/manager.php b/fuel/app/tests/classes/materia/perm/manager.php
@@ -66,14 +66,14 @@ public function test_get_user_ids_with_role()
 		$newSuperUser = $this->make_random_super_user();
 		$superUserIds = Perm_Manager::get_user_ids_with_role('super_user');
 
-		$this->assertContains($newSuperUser->id, $superUserIds);
+		$this->assertContains((int)$newSuperUser->id, $superUserIds);
 
 		$newAuthorOne = $this->make_random_author();
 		$newAuthorTwo = $this->make_random_author();
 		$studentIds = Perm_Manager::get_user_ids_with_role('basic_author');
 
-		$this->assertContains($newAuthorOne->id, $studentIds);
-		$this->assertContains($newAuthorTwo->id, $studentIds);
+		$this->assertContains((int)$newAuthorOne->id, $studentIds);
+		$this->assertContains((int)$newAuthorTwo->id, $studentIds);
 		$this->assertCount(2, $studentIds);
 	}
 

diff --git a/fuel/app/tests/model/user.php b/fuel/app/tests/model/user.php
@@ -97,8 +97,8 @@ public function test_find_by_name_search_finds_multiple_matches()
 
 		$ids = [$x[0]->id, $x[1]->id];
 
-		self::assertContains($user1->id, $ids);
-		self::assertContains($user2->id, $ids);
+		self::assertContains((int)$user1->id, $ids);
+		self::assertContains((int)$user2->id, $ids);
 	}
 
 }
diff --git a/fuel/packages/materiaauth/classes/auth/login/materiaauth.php b/fuel/packages/materiaauth/classes/auth/login/materiaauth.php
@@ -53,10 +53,10 @@ public function logout()
 	 */
 	public function create_user($username, $password, $email = '', $group = 1, Array $profile_fields = [], $first_name = '', $last_name = '', $requires_password = true, $requires_email = true)
 	{
-		$first_name = trim($first_name);
-		$last_name  = trim($last_name);
-		$username   = trim($username);
-		$email      = filter_var(trim($email), FILTER_VALIDATE_EMAIL);
+		$first_name = trim($first_name ?? '');
+		$last_name  = trim($last_name ?? '');
+		$username   = trim($username ?? '');
+		$email      = filter_var(trim($email ?? ''), FILTER_VALIDATE_EMAIL);
 
 		if (empty($username) or ($requires_password && empty($password)))
 		{
@@ -145,7 +145,7 @@ public function update_user($values, $username = null)
 
 		if (array_key_exists('email', $values))
 		{
-			$email = filter_var(trim($values['email']), FILTER_VALIDATE_EMAIL);
+			$email = filter_var(trim($values['email'] ?? ''), FILTER_VALIDATE_EMAIL);
 			if ( ! $email)
 			{
 				// currently and empty email, use a default
@@ -177,7 +177,7 @@ public function update_user($values, $username = null)
 
 		if (array_key_exists('first', $values))
 		{
-			$first = trim($values['first']);
+			$first = trim($values['first'] ?? '');
 			if ( ! empty($first) && $current_values['first'] != $first)
 			{
 				$update['first'] = (string) $first;
@@ -187,7 +187,7 @@ public function update_user($values, $username = null)
 
 		if (array_key_exists('last', $values))
 		{
-			$last = trim($values['last']);
+			$last = trim($values['last'] ?? '');
 			if ( ! empty($last) && $current_values['last'] != $last)
 			{
 				$update['last'] = (string) $last;

diff --git a/materia-app.Dockerfile b/materia-app.Dockerfile
@@ -1,7 +1,7 @@
 # =====================================================================================================
 # Base stage used for build and final stages
 # =====================================================================================================
-FROM php:8.0.24-fpm-alpine3.16 AS base_stage
+FROM php:8.1.11-fpm-alpine3.16 AS base_stage
 
 ARG PHP_EXT="bcmath gd pdo_mysql xml zip opcache"
 ARG PHP_MEMCACHED_VERSION="v3.1.5"