This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | require_once('common.inc.php'); |
||
4 | |||
5 | use Battis\BootstrapSmarty\NotificationMessage; |
||
6 | |||
7 | $MANUALLY_CREATED_COURSES_ACCOUNT = 96; |
||
8 | $DEFAULT_TERM = 195; |
||
9 | $CACHE_LIFETIME = 20 * 60; // 20 minutes |
||
10 | |||
11 | $toolbox->cache_pushKey(basename(__FILE__, '.php')); |
||
12 | |||
13 | $STEP_INSTRUCTIONS = 1; |
||
14 | $STEP_CONFIRM = 2; |
||
15 | $STEP_ENROLL = 3; |
||
16 | |||
17 | $step = (empty($_REQUEST['step']) ? $STEP_INSTRUCTIONS : $_REQUEST['step']); |
||
18 | |||
19 | $toolbox->smarty_assign('role', (empty($_REQUEST['role']) ? 218 /* Student */ : $_REQUEST['role'])); |
||
20 | |||
21 | try { |
||
22 | $roles = $toolbox->cache_get('roles'); |
||
23 | if ($roles === false) { |
||
24 | $roles = $toolbox->api_get('accounts/1/roles'); // TODO handle specific accounts |
||
25 | $toolbox->cache_set('roles', $roles); |
||
26 | } |
||
27 | } catch (Pest_Exception $e) { |
||
28 | $toolbox->exceptionErrorMessage($e); |
||
29 | $toolbox->smarty_display(); |
||
30 | exit; |
||
31 | } |
||
32 | |||
33 | switch ($step) { |
||
34 | case $STEP_CONFIRM: |
||
35 | try { |
||
36 | $users = $toolbox->explodeCommaAndNewlines($_REQUEST['users']); |
||
37 | |||
38 | if (empty($_REQUEST['course'])) { |
||
39 | $toolbox->smarty_addMessage( |
||
40 | 'Course', |
||
41 | 'was not selected, so no enrollments can happen', |
||
42 | NotificationMessage::ERROR |
||
0 ignored issues
–
show
|
|||
43 | ); |
||
44 | $step = $STEP_INSTRUCTIONS; |
||
45 | } else { |
||
46 | $sections = $toolbox->cache_get("courses/{$_REQUEST['course']}"); |
||
47 | if (empty($sections)) { |
||
48 | $section = array(); |
||
49 | $courses = $toolbox->api_get( |
||
50 | 'accounts/1/courses', |
||
51 | array( |
||
52 | 'search_term' => $_REQUEST['course'] |
||
53 | ) |
||
54 | ); |
||
55 | foreach ($courses as $course) { |
||
56 | $courseSections = $toolbox->api_get("courses/{$course['id']}/sections"); |
||
57 | if ($courseSections->count() == 0) { |
||
58 | /* we have only the "magic" default section */ |
||
59 | $sections[] = array('course' => $course); |
||
60 | } else { |
||
61 | foreach ($courseSections as $section) { |
||
62 | $sections[] = array( |
||
63 | 'course' => $course, |
||
64 | 'section' => $section |
||
65 | ); |
||
66 | } |
||
67 | } |
||
68 | } |
||
69 | $toolbox->cache_set("courses/{$_REQUEST['course']}", $sections, $CACHE_LIFETIME); |
||
70 | } |
||
71 | |||
72 | if (empty($sections)) { |
||
73 | $toolbox->smarty_addMessage( |
||
74 | 'No Courses', |
||
75 | "matched your search term '{$_REQUEST['course']}'.", |
||
76 | NotificationMessage::WARNING |
||
77 | ); |
||
78 | $step = $STEP_INSTRUCTIONS; |
||
79 | } |
||
80 | } |
||
81 | |||
82 | if ($step == $STEP_CONFIRM) { |
||
83 | if (!empty($users)) { |
||
84 | $confirm = array(); |
||
85 | foreach ($users as $term) { |
||
86 | $confirm[$term] = $toolbox->cache_get("users/$term"); |
||
87 | if ($confirm[$term] === false) { |
||
88 | $found = $toolbox->api_get( |
||
89 | 'accounts/1/users', |
||
90 | [ |
||
91 | 'search_term' => $term, |
||
92 | 'include[]' => 'term' |
||
93 | ] |
||
94 | ); |
||
95 | foreach ($found as $user) { |
||
96 | if (!stripos($user['sis_user_id'], '-advisor')) { |
||
97 | $confirm[$term][] = $user; |
||
98 | } |
||
99 | } |
||
100 | $toolbox->cache_set("users/$term", $confirm[$term], $CACHE_LIFETIME); |
||
101 | } |
||
102 | } |
||
103 | |||
104 | $toolbox->smarty_assign([ |
||
105 | 'sections' => $sections, |
||
106 | 'terms' => $toolbox->getTermList(), |
||
107 | 'accounts' => $toolbox->getAccountList(), |
||
108 | 'confirm' => $confirm, |
||
109 | 'roles' => $toolbox->api_get('accounts/1/roles'), // TODO make this account-specific |
||
110 | 'formHidden'=> [ |
||
111 | 'step' => $STEP_ENROLL |
||
112 | ] |
||
113 | ]); |
||
114 | $toolbox->smarty_display(basename(__FILE__, '.php') . '/confirm.tpl'); |
||
115 | break; |
||
116 | } else { |
||
117 | $toolbox->smarty_addMessage( |
||
118 | 'Users', |
||
119 | 'were not selected, so no enrollments can happen.', |
||
120 | NotificationMessage::ERROR |
||
0 ignored issues
–
show
The constant
Battis\BootstrapSmarty\NotificationMessage::ERROR has been deprecated with message: Use `DANGER` instead for consistency with Bootstrap
This class constant has been deprecated. The supplier of the class has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the constant will be removed from the class and what other constant to use instead. ![]() |
|||
121 | ); |
||
122 | $step = $STEP_INSTRUCTIONS; |
||
123 | } |
||
124 | } |
||
125 | } catch (Pest_Exception $e) { |
||
126 | $toolbox->exceptionErrorMessage($e); |
||
127 | } |
||
128 | |||
129 | /* flow into $STEP_ENROLL (and $STEP_INSTRUCTIONS) */ |
||
130 | |||
131 | case $STEP_ENROLL: |
||
132 | try { |
||
133 | if ($step == $STEP_ENROLL) { |
||
134 | $courseEnrollment = false; |
||
135 | if (empty($_REQUEST['section'])) { |
||
136 | if (!empty($_REQUEST['course'])) { |
||
137 | $courseEnrollment = true; |
||
138 | } else { |
||
139 | $toolbox->smarty_addMessage( |
||
140 | 'Course or Section', |
||
141 | 'Missing from enrollment request.', |
||
142 | NotificationMessage::ERROR |
||
0 ignored issues
–
show
The constant
Battis\BootstrapSmarty\NotificationMessage::ERROR has been deprecated with message: Use `DANGER` instead for consistency with Bootstrap
This class constant has been deprecated. The supplier of the class has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the constant will be removed from the class and what other constant to use instead. ![]() |
|||
143 | ); |
||
144 | $step = $STEP_INSTRUCTIONS; |
||
145 | } |
||
146 | } |
||
147 | |||
148 | if (empty($_REQUEST['users'])) { |
||
149 | $toolbox->smarty_addMessage( |
||
150 | 'Users', |
||
151 | 'missing from enrollment request.', |
||
152 | NotificationMessage::ERROR |
||
0 ignored issues
–
show
The constant
Battis\BootstrapSmarty\NotificationMessage::ERROR has been deprecated with message: Use `DANGER` instead for consistency with Bootstrap
This class constant has been deprecated. The supplier of the class has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the constant will be removed from the class and what other constant to use instead. ![]() |
|||
153 | ); |
||
154 | } elseif ($step == $STEP_ENROLL) { |
||
155 | $count = 0; |
||
156 | foreach ($_REQUEST['users'] as $user) { |
||
157 | $enrollment = $toolbox->api_post( |
||
158 | ( |
||
159 | $courseEnrollment ? |
||
160 | "/courses/{$_REQUEST['course']}/enrollments" : |
||
161 | "/sections/{$_REQUEST['section']}/enrollments" |
||
162 | ), |
||
163 | array( |
||
164 | 'enrollment[user_id]' => $user['id'], |
||
165 | 'enrollment[role_id]' => $user['role'], |
||
166 | 'enrollment[enrollment_state]' => 'active', |
||
167 | 'enrollment[notify]' => (empty($user['notify']) ? 'false' : $user['notify']) |
||
168 | ) |
||
169 | ); |
||
170 | if (!empty($enrollment['id'])) { |
||
171 | $count++; |
||
172 | } // FIXME should really list errors, no? |
||
173 | } |
||
174 | |||
175 | if ($courseEnrollment) { |
||
176 | $course = $_REQUEST['course']; |
||
177 | } else { |
||
178 | $section = $toolbox->api_get("sections/{$_REQUEST['section']}"); |
||
179 | $course = $section['course_id']; |
||
180 | } |
||
181 | |||
182 | // FIXME no longer have the course ID… link is broken |
||
183 | $toolbox->smarty_addMessage( |
||
184 | 'Success', |
||
185 | "<a target=\"_top\" href=\"{$_SESSION[CANVAS_INSTANCE_URL]}/courses/$course/users\">$count users enrolled</a>", |
||
186 | NotificationMessage::GOOD |
||
0 ignored issues
–
show
The constant
Battis\BootstrapSmarty\NotificationMessage::GOOD has been deprecated with message: Use `SUCCESS` instead for consistency with Bootstrap
This class constant has been deprecated. The supplier of the class has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the constant will be removed from the class and what other constant to use instead. ![]() |
|||
187 | ); |
||
188 | |||
189 | $_REQUEST = array(); |
||
190 | } |
||
191 | } |
||
192 | } catch (Pest_Exception $e) { |
||
193 | $toolbox->exceptionErrorMessage($e); |
||
194 | } |
||
195 | |||
196 | /* fall through to STEP_INSTRUCTION */ |
||
197 | |||
198 | case $STEP_INSTRUCTIONS: |
||
199 | default: |
||
200 | if (!empty($_REQUEST['users'])) { |
||
201 | $toolbox->smarty_assign('users', $_REQUEST['users']); |
||
202 | } |
||
203 | if (!empty($_REQUEST['course'])) { |
||
204 | $toolbox->smarty_assign('course', $_REQUEST['course']); |
||
205 | } |
||
206 | |||
207 | $toolbox->smarty_assign('roles', $roles); |
||
208 | $toolbox->smarty_assign('formHidden', array('step' => $STEP_CONFIRM)); |
||
209 | $toolbox->smarty_display(basename(__FILE__, '.php') . '/instructions.tpl'); |
||
210 | } |
||
211 |
This class constant has been deprecated. The supplier of the class has supplied an explanatory message.
The explanatory message should give you some clue as to whether and when the constant will be removed from the class and what other constant to use instead.