This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | require_once('common.inc.php'); |
||
4 | |||
5 | use Battis\BootstrapSmarty\NotificationMessage; |
||
6 | |||
7 | $MANUALLY_CREATED_COURSES_ACCOUNT = 96; |
||
8 | $DEFAULT_TERM = 195; |
||
9 | $CACHE_LIFETIME = 20 * 60; // 20 minutes |
||
10 | |||
11 | $toolbox->cache_pushKey(basename(__FILE__, '.php')); |
||
12 | |||
13 | $STEP_INSTRUCTIONS = 1; |
||
14 | $STEP_CONFIRM = 2; |
||
15 | $STEP_ENROLL = 3; |
||
16 | |||
17 | $step = (empty($_REQUEST['step']) ? $STEP_INSTRUCTIONS : $_REQUEST['step']); |
||
18 | |||
19 | $toolbox->smarty_assign('role', (empty($_REQUEST['role']) ? 218 /* Student */ : $_REQUEST['role'])); |
||
20 | |||
21 | try { |
||
22 | $roles = $toolbox->cache_get('roles'); |
||
23 | if ($roles === false) { |
||
24 | $roles = $toolbox->api_get('accounts/1/roles'); // TODO handle specific accounts |
||
25 | $toolbox->cache_set('roles', $roles); |
||
26 | } |
||
27 | } catch (Pest_Exception $e) { |
||
0 ignored issues
–
show
|
|||
28 | $toolbox->exceptionErrorMessage($e); |
||
29 | $toolbox->smarty_display(); |
||
30 | exit; |
||
31 | } |
||
32 | |||
33 | switch ($step) { |
||
34 | case $STEP_CONFIRM: |
||
35 | try { |
||
36 | $users = $toolbox->explodeCommaAndNewlines($_REQUEST['users']); |
||
37 | |||
38 | if (empty($_REQUEST['course'])) { |
||
39 | $toolbox->smarty_addMessage( |
||
40 | 'Course', |
||
41 | 'was not selected, so no enrollments can happen', |
||
42 | NotificationMessage::ERROR |
||
43 | ); |
||
44 | $step = $STEP_INSTRUCTIONS; |
||
45 | } else { |
||
46 | $sections = $toolbox->cache_get("courses/{$_REQUEST['course']}"); |
||
47 | if (empty($sections)) { |
||
48 | $section = array(); |
||
49 | $courses = $toolbox->api_get( |
||
50 | 'accounts/1/courses', |
||
51 | array( |
||
52 | 'search_term' => $_REQUEST['course'] |
||
53 | ) |
||
54 | ); |
||
55 | foreach ($courses as $course) { |
||
56 | $courseSections = $toolbox->api_get("courses/{$course['id']}/sections"); |
||
57 | if ($courseSections->count() == 0) { |
||
58 | /* we have only the "magic" default section */ |
||
59 | $sections[] = array('course' => $course); |
||
60 | } else { |
||
61 | foreach ($courseSections as $section) { |
||
62 | $sections[] = array( |
||
63 | 'course' => $course, |
||
64 | 'section' => $section |
||
65 | ); |
||
66 | } |
||
67 | } |
||
68 | } |
||
69 | $toolbox->cache_set("courses/{$_REQUEST['course']}", $sections, $CACHE_LIFETIME); |
||
70 | } |
||
71 | |||
72 | if (empty($sections)) { |
||
73 | $toolbox->smarty_addMessage( |
||
74 | 'No Courses', |
||
75 | "matched your search term '{$_REQUEST['course']}'.", |
||
76 | NotificationMessage::WARNING |
||
77 | ); |
||
78 | $step = $STEP_INSTRUCTIONS; |
||
79 | } |
||
80 | } |
||
81 | |||
82 | if ($step == $STEP_CONFIRM) { |
||
83 | if (!empty($users)) { |
||
84 | $confirm = array(); |
||
85 | foreach ($users as $term) { |
||
86 | $confirm[$term] = $toolbox->cache_get("users/$term"); |
||
87 | if ($confirm[$term] === false) { |
||
88 | $found = $toolbox->api_get( |
||
89 | 'accounts/1/users', |
||
90 | [ |
||
91 | 'search_term' => $term, |
||
92 | 'include[]' => 'term' |
||
93 | ] |
||
94 | ); |
||
95 | foreach ($found as $user) { |
||
96 | if (!stripos($user['sis_user_id'], '-advisor')) { |
||
97 | $confirm[$term][] = $user; |
||
98 | } |
||
99 | } |
||
100 | $toolbox->cache_set("users/$term", $confirm[$term], $CACHE_LIFETIME); |
||
101 | } |
||
102 | } |
||
103 | |||
104 | $toolbox->smarty_assign([ |
||
105 | 'sections' => $sections, |
||
106 | 'terms' => $toolbox->getTermList(), |
||
107 | 'accounts' => $toolbox->getAccountList(), |
||
108 | 'confirm' => $confirm, |
||
109 | 'roles' => $toolbox->api_get('accounts/1/roles'), // TODO make this account-specific |
||
110 | 'formHidden'=> [ |
||
111 | 'step' => $STEP_ENROLL |
||
112 | ] |
||
113 | ]); |
||
114 | $toolbox->smarty_display(basename(__FILE__, '.php') . '/confirm.tpl'); |
||
115 | break; |
||
116 | } else { |
||
117 | $toolbox->smarty_addMessage( |
||
118 | 'Users', |
||
119 | 'were not selected, so no enrollments can happen.', |
||
120 | NotificationMessage::ERROR |
||
121 | ); |
||
122 | $step = $STEP_INSTRUCTIONS; |
||
123 | } |
||
124 | } |
||
125 | } catch (Pest_Exception $e) { |
||
0 ignored issues
–
show
The class
Pest_Exception does not exist. Did you forget a USE statement, or did you not list all dependencies?
Scrutinizer analyzes your It seems like the listed class was neither found in your dependencies, nor was it found in the analyzed files in your repository. If you are using some other form of dependency management, you might want to disable this analysis. ![]() |
|||
126 | $toolbox->exceptionErrorMessage($e); |
||
127 | } |
||
128 | |||
129 | /* flow into $STEP_ENROLL (and $STEP_INSTRUCTIONS) */ |
||
130 | |||
131 | case $STEP_ENROLL: |
||
132 | try { |
||
133 | if ($step == $STEP_ENROLL) { |
||
134 | $courseEnrollment = false; |
||
135 | if (empty($_REQUEST['section'])) { |
||
136 | if (!empty($_REQUEST['course'])) { |
||
137 | $courseEnrollment = true; |
||
138 | } else { |
||
139 | $toolbox->smarty_addMessage( |
||
140 | 'Course or Section', |
||
141 | 'Missing from enrollment request.', |
||
142 | NotificationMessage::ERROR |
||
143 | ); |
||
144 | $step = $STEP_INSTRUCTIONS; |
||
145 | } |
||
146 | } |
||
147 | |||
148 | if (empty($_REQUEST['users'])) { |
||
149 | $toolbox->smarty_addMessage( |
||
150 | 'Users', |
||
151 | 'missing from enrollment request.', |
||
152 | NotificationMessage::ERROR |
||
153 | ); |
||
154 | } elseif ($step == $STEP_ENROLL) { |
||
155 | $count = 0; |
||
156 | foreach ($_REQUEST['users'] as $user) { |
||
157 | $enrollment = $toolbox->api_post( |
||
158 | ( |
||
159 | $courseEnrollment ? |
||
160 | "/courses/{$_REQUEST['course']}/enrollments" : |
||
161 | "/sections/{$_REQUEST['section']}/enrollments" |
||
162 | ), |
||
163 | array( |
||
164 | 'enrollment[user_id]' => $user['id'], |
||
165 | 'enrollment[role_id]' => $user['role'], |
||
166 | 'enrollment[enrollment_state]' => 'active', |
||
167 | 'enrollment[notify]' => (empty($user['notify']) ? 'false' : $user['notify']) |
||
168 | ) |
||
169 | ); |
||
170 | if (!empty($enrollment['id'])) { |
||
171 | $count++; |
||
172 | } // FIXME should really list errors, no? |
||
173 | } |
||
174 | |||
175 | if ($courseEnrollment) { |
||
176 | $course = $_REQUEST['course']; |
||
177 | } else { |
||
178 | $section = $toolbox->api_get("sections/{$_REQUEST['section']}"); |
||
179 | $course = $section['course_id']; |
||
180 | } |
||
181 | |||
182 | // FIXME no longer have the course ID… link is broken |
||
183 | $toolbox->smarty_addMessage( |
||
184 | 'Success', |
||
185 | "<a target=\"_top\" href=\"{$_SESSION[CANVAS_INSTANCE_URL]}/courses/$course/users\">$count users enrolled</a>", |
||
186 | NotificationMessage::GOOD |
||
187 | ); |
||
188 | |||
189 | $_REQUEST = array(); |
||
190 | } |
||
191 | } |
||
192 | } catch (Pest_Exception $e) { |
||
0 ignored issues
–
show
The class
Pest_Exception does not exist. Did you forget a USE statement, or did you not list all dependencies?
Scrutinizer analyzes your It seems like the listed class was neither found in your dependencies, nor was it found in the analyzed files in your repository. If you are using some other form of dependency management, you might want to disable this analysis. ![]() |
|||
193 | $toolbox->exceptionErrorMessage($e); |
||
194 | } |
||
195 | |||
196 | /* fall through to STEP_INSTRUCTION */ |
||
197 | |||
198 | case $STEP_INSTRUCTIONS: |
||
199 | default: |
||
200 | if (!empty($_REQUEST['users'])) { |
||
201 | $toolbox->smarty_assign('users', $_REQUEST['users']); |
||
202 | } |
||
203 | if (!empty($_REQUEST['course'])) { |
||
204 | $toolbox->smarty_assign('course', $_REQUEST['course']); |
||
205 | } |
||
206 | |||
207 | $toolbox->smarty_assign('roles', $roles); |
||
208 | $toolbox->smarty_assign('formHidden', array('step' => $STEP_CONFIRM)); |
||
209 | $toolbox->smarty_display(basename(__FILE__, '.php') . '/instructions.tpl'); |
||
210 | } |
||
211 |
Scrutinizer analyzes your
composer.json
/composer.lock
file if available to determine the classes, and functions that are defined by your dependencies.It seems like the listed class was neither found in your dependencies, nor was it found in the analyzed files in your repository. If you are using some other form of dependency management, you might want to disable this analysis.