This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace smtech\StMarksReflexiveCanvasLTI; |
||
| 4 | |||
| 5 | use LTI_Tool_Consumer; |
||
| 6 | use LTI_Data_Connector; |
||
| 7 | |||
| 8 | use Battis\HierarchicalSimpleCache; |
||
| 9 | use Battis\DataUtilities; |
||
| 10 | use Battis\BootstrapSmarty\NotificationMessage; |
||
| 11 | |||
| 12 | use smtech\StMarksSmarty\StMarksSmarty; |
||
| 13 | use smtech\ReflexiveCanvasLTI\Exception\ConfigurationException; |
||
| 14 | |||
| 15 | /** |
||
| 16 | * Add HTML templating and basic caching to the ReflexiveCanvasLTI Toolbox |
||
| 17 | * |
||
| 18 | * @author Seth Battis <[email protected]> |
||
| 19 | * @version v0.1 |
||
| 20 | */ |
||
| 21 | class Toolbox extends \smtech\ReflexiveCanvasLTI\Toolbox |
||
| 22 | { |
||
| 23 | |||
| 24 | /** |
||
| 25 | * Cache manager |
||
| 26 | * @var HierarchicalSimpleCache |
||
| 27 | */ |
||
| 28 | protected $cache; |
||
| 29 | |||
| 30 | /** |
||
| 31 | * St. Mark's-styled HTML templating |
||
| 32 | * @var StMarksSmarty |
||
| 33 | */ |
||
| 34 | protected $smarty; |
||
| 35 | |||
| 36 | /** |
||
| 37 | * Update a Toolbox instance from a configuration file |
||
| 38 | * |
||
| 39 | * Extends the inherited `Toolbox::loadConfiguration()` to add two |
||
| 40 | * additional pieces of configuration metadata: |
||
| 41 | * |
||
| 42 | * - `APP_PATH` is the path to the Tool Provider app |
||
| 43 | * - `APP_URL` is the URL of the Tool Provider app |
||
| 44 | * |
||
| 45 | * Also stores the API access token acquired by `interactiveGetAccessToken()`. |
||
| 46 | * |
||
| 47 | * @see interactiveGetAccessToken() `interactiveGetAccessToken()` |
||
| 48 | * @link https://htmlpreview.github.io/?https://raw.githubusercontent.com/smtech/reflexive-canvas-lti/master/doc/classes/smtech.ReflexiveCanvasLTI.Toolbox.html#method_loadConfiguration `smtech\ReflexiveCanvasLTI\Toolbox::loadConfiguration()` |
||
| 49 | * |
||
| 50 | * @param string $configFilePath |
||
| 51 | * @param boolean $forceRecache (Optional, default `false`) |
||
| 52 | * @return void |
||
| 53 | */ |
||
| 54 | protected function loadConfiguration($configFilePath, $forceRecache = false) |
||
| 55 | { |
||
| 56 | parent::loadConfiguration($configFilePath, $forceRecache); |
||
| 57 | |||
| 58 | /* patch in passed back API access token, if present */ |
||
| 59 | if (!empty($_SESSION['TOOL_CANVAS_API'])) { |
||
| 60 | $this->metadata['TOOL_CANVAS_API'] = $_SESSION['TOOL_CANVAS_API']; |
||
| 61 | unset($_SESSION['TOOL_CANVAS_API']); |
||
| 62 | } |
||
| 63 | |||
| 64 | if ($forceRecache || empty($this->config('APP_PATH'))) { |
||
| 65 | $this->config('APP_PATH', dirname($this->config('TOOL_CONFIG_FILE'))); |
||
| 66 | } |
||
| 67 | |||
| 68 | if ($forceRecache || empty($this->config('APP_URL'))) { |
||
| 69 | $this->config('APP_URL', DataUtilities::URLfromPath($this->config('APP_PATH'))); |
||
| 70 | } |
||
| 71 | } |
||
| 72 | |||
| 73 | /** |
||
| 74 | * Interactively acquire an API access token |
||
| 75 | * |
||
| 76 | * `/config/canvas/key` and `/config/canvas/secret` must be defined in |
||
| 77 | * `config.xml` for this to work! |
||
| 78 | * |
||
| 79 | * @param string $reason Explanation of why an API access token is necessary |
||
| 80 | * @param string $redirectURL (Optional, defaults to |
||
| 81 | * `$_SERVER['REQUEST_URI']`) URL of page to redirect to after |
||
| 82 | * acquiring access token |
||
| 83 | * @param string $errorURL (Optional) URL of page to redirect to on error |
||
| 84 | * @return void |
||
| 85 | */ |
||
| 86 | public function interactiveGetAccessToken($reason = null, $redirectURL = null, $errorURL = null) |
||
| 87 | { |
||
| 88 | $redirectURL = ( |
||
| 89 | empty($redirectURL) ? |
||
| 90 | $_SERVER['REQUEST_URI'] : |
||
| 91 | $redirectURL |
||
| 92 | ); |
||
| 93 | $errorURL = ( |
||
| 94 | empty($errorURL) ? |
||
| 95 | DataUtilities::URLfromPath(__DIR__ . '/../error.php') : |
||
| 96 | $errorURL |
||
| 97 | ); |
||
| 98 | $canvas = $this->metadata['TOOL_CANVAS_API']; |
||
| 99 | if (!empty($canvas['key']) && !empty($canvas['secret'])) { |
||
| 100 | /* if so, request an API access token interactively */ |
||
| 101 | if (session_status() !== PHP_SESSION_ACTIVE) { |
||
| 102 | session_start(); |
||
| 103 | } |
||
| 104 | $_SESSION['oauth'] = [ |
||
| 105 | 'purpose' => $this->metadata['TOOL_NAME'], |
||
| 106 | 'key' => $canvas['key'], |
||
| 107 | 'secret' => $canvas['secret'] |
||
| 108 | ]; |
||
| 109 | header( |
||
| 110 | 'Location: ' . DataUtilities::URLfromPath(__DIR__ . '/../oauth.php') . |
||
| 111 | '?' . http_build_query([ |
||
| 112 | 'oauth-return' => $redirectURL, |
||
| 113 | 'oauth-error' => $errorURL, |
||
| 114 | 'reason' => $reason |
||
| 115 | ]) |
||
| 116 | ); |
||
| 117 | return; |
||
| 118 | } else { /* no (understandable) API credentials available -- doh! */ |
||
| 119 | throw new ConfigurationException( |
||
| 120 | 'Missing OAuth key/secret pair in configuration, which is ' . |
||
| 121 | 'required to interactively acquire an API access token', |
||
| 122 | ConfigurationException::CANVAS_API_MISSING |
||
| 123 | ); |
||
| 124 | } |
||
| 125 | } |
||
| 126 | |||
| 127 | /** |
||
| 128 | * Create a (potentially new) LTI_Tool_Consumer |
||
| 129 | * |
||
| 130 | * @param string $key (Optional) |
||
| 131 | * @return LTI_Tool_Consumer |
||
| 132 | */ |
||
| 133 | private function interactiveConsumersControlPanel_loadConsumer($key = null) |
||
| 134 | { |
||
| 135 | /* |
||
| 136 | * load an existing consumer (if we have a consumer_key) or create a blank |
||
| 137 | * that we will fill in |
||
| 138 | */ |
||
| 139 | $consumer = new LTI_Tool_Consumer( |
||
| 140 | (empty($key) ? LTI_Data_Connector::getRandomString(32) : $key), |
||
| 141 | $this->getToolProvider()->data_connector, |
||
| 142 | true // wicked confusing _not_ to autoenable |
||
| 143 | ); |
||
| 144 | |||
| 145 | /* pre-fill secret if not editing an existing consumer */ |
||
| 146 | if (empty($key)) { |
||
| 147 | $consumer->secret = LTI_Data_Connector::getRandomString(32); |
||
| 148 | } |
||
| 149 | |||
| 150 | return $consumer; |
||
| 151 | } |
||
| 152 | |||
| 153 | /** |
||
| 154 | * Handle tool consumer management interactively |
||
| 155 | * |
||
| 156 | * Display and manage a control panel for managing Tool Consumers |
||
| 157 | * interactively. |
||
| 158 | * |
||
| 159 | * @uses interactiveConsumersControlPanel_loadConsumer() `interactiveConsumersControlPanel_loadConsumer()` |
||
| 160 | * @return void |
||
| 161 | */ |
||
| 162 | public function interactiveConsumersControlPanel() |
||
| 163 | { |
||
| 164 | /* clean request values */ |
||
| 165 | $name = (empty($_POST['name']) ? null : trim($_POST['name'])); |
||
| 166 | $key = (empty($_POST['key']) ? null : trim($_POST['key'])); |
||
| 167 | $secret = (empty($_POST['secret']) ? null : trim($_POST['secret'])); |
||
| 168 | $enabled = (empty($_POST['enabled']) ? false : (boolean) $_POST['enabled']); |
||
| 169 | $action = (empty($_POST['action']) ? false : strtolower(trim($_POST['action']))); |
||
| 170 | |||
| 171 | /* load requested consumer (or create new if none requested) */ |
||
| 172 | $consumer = $this->interactiveConsumersControlPanel_loadConsumer($key); |
||
| 173 | |||
| 174 | /* what are we asked to do with this consumer? */ |
||
| 175 | switch ($action) { |
||
| 176 | case 'update': |
||
| 177 | case 'insert': |
||
| 178 | $consumer->name = $name; |
||
| 179 | $consumer->secret = $secret; |
||
| 180 | $consumer->enabled = $enabled; |
||
| 181 | if (!$consumer->save()) { |
||
| 182 | $this->smarty_addMessage( |
||
| 183 | 'Error saving consumer', |
||
| 184 | 'There was an error attempting to save your new or ' . |
||
| 185 | 'updated consumer information to the database.', |
||
| 186 | NotificationMessage::DANGER |
||
| 187 | ); |
||
| 188 | } |
||
| 189 | break; |
||
| 190 | case 'delete': |
||
| 191 | $consumer->delete(); |
||
| 192 | break; |
||
| 193 | case 'select': |
||
| 194 | $this->smarty_assign('key', $key); |
||
| 195 | break; |
||
| 196 | } |
||
| 197 | |||
| 198 | /* |
||
| 199 | * if action was anything other than 'select', create a new empty |
||
| 200 | * consumer to fill the form with |
||
| 201 | */ |
||
| 202 | if ($action && $action !== 'select') { |
||
| 203 | $consumer = $this->interactiveConsumersControlPanel_loadConsumer(); |
||
| 204 | } |
||
| 205 | |||
| 206 | /* display a list of consumers */ |
||
| 207 | $consumers = $this->lti_getConsumers(); |
||
| 208 | $this->smarty_assign([ |
||
|
0 ignored issues
–
show
|
|||
| 209 | 'name' => 'Consumers', |
||
| 210 | 'category' => 'Control Panel', |
||
| 211 | 'consumers' => $consumers, |
||
| 212 | 'consumer' => $consumer, |
||
| 213 | 'formAction' => $_SERVER['PHP_SELF'], |
||
| 214 | 'appUrl' => $this->metadata['APP_URL'] |
||
| 215 | ]); |
||
| 216 | $this->smarty_display('consumers-control-panel.tpl'); |
||
| 217 | } |
||
| 218 | |||
| 219 | /** |
||
| 220 | * Update the cache manager |
||
| 221 | * |
||
| 222 | * @param HierarchicalSimpleCache $cache |
||
| 223 | */ |
||
| 224 | public function setCache(HierarchicalSimpleCache $cache) |
||
| 225 | { |
||
| 226 | $this->cache = $cache; |
||
| 227 | } |
||
| 228 | |||
| 229 | /** |
||
| 230 | * Get the cache manager |
||
| 231 | * |
||
| 232 | * @return HierarchicalSimpleCache |
||
| 233 | */ |
||
| 234 | public function getCache() |
||
| 235 | { |
||
| 236 | if (empty($this->cache)) { |
||
| 237 | $this->cache = new HierarchicalSimpleCache($this->getMySQL(), basename(__FILE__, '.php')); |
||
| 238 | } |
||
| 239 | return $this->cache; |
||
| 240 | } |
||
| 241 | |||
| 242 | /** |
||
| 243 | * Push a hierarchical layer to the cache |
||
| 244 | * |
||
| 245 | * @link https://htmlpreview.github.io/?https://raw.githubusercontent.com/battis/simplecache/master/doc/classes/Battis.HierarchicalSimpleCache.html#method_pushKey Pass-through to `HierarchicalSimpleCache::pushKey()` |
||
| 246 | * |
||
| 247 | * @param string $layer |
||
| 248 | * @return string |
||
| 249 | */ |
||
| 250 | public function cache_pushKey($layer) |
||
| 251 | { |
||
| 252 | return $this->getCache()->pushKey($layer); |
||
| 253 | } |
||
| 254 | |||
| 255 | /** |
||
| 256 | * Pop a hierarchical layer off of the cache |
||
| 257 | * |
||
| 258 | * @link https://htmlpreview.github.io/?https://raw.githubusercontent.com/battis/simplecache/master/doc/classes/Battis.HierarchicalSimpleCache.html#method_popKey Pass-through to `HierarchicalSimpleCache::popKey()` |
||
| 259 | * |
||
| 260 | * @return string|null |
||
| 261 | */ |
||
| 262 | public function cache_popKey() |
||
| 263 | { |
||
| 264 | return $this->getCache()->popKey(); |
||
| 265 | } |
||
| 266 | |||
| 267 | /** |
||
| 268 | * Retrieve a cached value |
||
| 269 | * |
||
| 270 | * @link https://htmlpreview.github.io/?https://raw.githubusercontent.com/battis/simplecache/master/doc/classes/Battis.HierarchicalSimpleCache.html#method_getCache Pass-through to `HierarchicalSimpleCache::getCache()` |
||
| 271 | * |
||
| 272 | * @param string $key |
||
| 273 | * @return mixed |
||
| 274 | */ |
||
| 275 | public function cache_get($key) |
||
| 276 | { |
||
| 277 | return $this->getCache()->getCache($key); |
||
| 278 | } |
||
| 279 | |||
| 280 | /** |
||
| 281 | * Set a cached value |
||
| 282 | * |
||
| 283 | * @link https://htmlpreview.github.io/?https://raw.githubusercontent.com/battis/simplecache/master/doc/classes/Battis.HierarchicalSimpleCache.html#method_setCache Pass-through to `HierarchicalSimpleCache::setCache()` |
||
| 284 | * |
||
| 285 | * @param string $key |
||
| 286 | * @param mixed $data |
||
| 287 | * @return boolean |
||
| 288 | */ |
||
| 289 | public function cache_set($key, $data) |
||
| 290 | { |
||
| 291 | return $this->getCache()->setCache($key, $data); |
||
| 292 | } |
||
| 293 | |||
| 294 | /** |
||
| 295 | * Update the HTML templating engine |
||
| 296 | * |
||
| 297 | * @param StMarksSmarty $smarty |
||
| 298 | */ |
||
| 299 | public function setSmarty(StMarksSmarty $smarty) |
||
| 300 | { |
||
| 301 | $this->smarty = $smarty; |
||
| 302 | } |
||
| 303 | |||
| 304 | /** |
||
| 305 | * Get the HTML templating engine |
||
| 306 | * |
||
| 307 | * @return StMarksSmarty |
||
| 308 | */ |
||
| 309 | public function getSmarty() |
||
| 310 | { |
||
| 311 | if (empty($this->smarty)) { |
||
| 312 | $this->smarty = StMarksSmarty::getSmarty(); |
||
| 313 | $this->smarty->prependTemplateDir(realpath(__DIR__ . '/../templates'), __CLASS__); |
||
| 314 | $this->smarty->setFramed(true); |
||
| 315 | } |
||
| 316 | return $this->smarty; |
||
| 317 | } |
||
| 318 | |||
| 319 | /** |
||
| 320 | * Assign a value to a template variables |
||
| 321 | * |
||
| 322 | * @link http://www.smarty.net/docs/en/api.assign.tpl Pass-through to `Smarty::assign()` |
||
| 323 | * |
||
| 324 | * @param string $varname |
||
| 325 | * @param mixed $var |
||
| 326 | * @param boolean $noCache (Optional, default `false`) |
||
| 327 | * @return void |
||
| 328 | */ |
||
| 329 | public function smarty_assign($varname, $var = null, $noCache = false) |
||
| 330 | { |
||
| 331 | return $this->getSmarty()->assign($varname, $var, $noCache); |
||
| 332 | } |
||
| 333 | |||
| 334 | /** |
||
| 335 | * Register another template directory |
||
| 336 | * |
||
| 337 | * @link https://htmlpreview.github.io/?https://raw.githubusercontent.com/battis/BootstrapSmarty/master/doc/classes/Battis.BootstrapSmarty.BootstrapSmarty.html#method_addTemplateDir Pass-through to `BootstrapSmarty::addTemplateDir()` |
||
| 338 | * |
||
| 339 | * @param string $template |
||
| 340 | * @param string $key (Optional, default `null`) |
||
| 341 | * @param boolean $isConfig (Optional, default `false`) |
||
| 342 | */ |
||
| 343 | public function smarty_addTemplateDir($template, $key = null, $isConfig = false) |
||
| 344 | { |
||
| 345 | return $this->getSmarty()->addTemplateDir($template, $key, $isConfig); |
||
| 346 | } |
||
| 347 | |||
| 348 | /** |
||
| 349 | * Prepend an over-riding template directory to Smarty |
||
| 350 | * |
||
| 351 | * @link https://htmlpreview.github.io/?https://raw.githubusercontent.com/battis/BootstrapSmarty/master/doc/classes/Battis.BootstrapSmarty.BootstrapSmarty.html#method_prependTemplateDir Pass-through to `BootstrapSmarty::prependTemplateDir()` |
||
| 352 | * |
||
| 353 | * @param string $template |
||
| 354 | * @param string $key (Optional) |
||
| 355 | */ |
||
| 356 | public function smarty_prependTemplateDir($template, $key = null) { |
||
| 357 | return $this->getSmarty()->prependTemplateDir($template, $key); |
||
| 358 | } |
||
| 359 | |||
| 360 | /** |
||
| 361 | * Add a message to be displayed to the user |
||
| 362 | * |
||
| 363 | * @link https://htmlpreview.github.io/?https://raw.githubusercontent.com/battis/BootstrapSmarty/master/doc/classes/Battis.BootstrapSmarty.BootstrapSmarty.html#method_addMessage Pass-through to `BootstrapSmarty::addMessage()` |
||
| 364 | * |
||
| 365 | * @param string $title |
||
| 366 | * @param string $content |
||
| 367 | * @param string $class (Optional, default `NotificationMessage::INFO`) |
||
| 368 | */ |
||
| 369 | public function smarty_addMessage($title, $content, $class = NotificationMessage::INFO) |
||
| 370 | { |
||
| 371 | return $this->getSmarty()->addMessage($title, $content, $class); |
||
| 372 | } |
||
| 373 | |||
| 374 | /** |
||
| 375 | * Display an HTML template |
||
| 376 | * |
||
| 377 | * @link https://htmlpreview.github.io/?https://raw.githubusercontent.com/battis/BootstrapSmarty/master/doc/classes/Battis.BootstrapSmarty.BootstrapSmarty.html#method_display Pass-through to `BootstrapSmarty::display()` |
||
| 378 | * |
||
| 379 | * @param string $template (Optional, default `page.tpl`) |
||
| 380 | * @param string $cache_id (Optional, default `null`) |
||
| 381 | * @param string $compile_id (Optional, default, `null`) |
||
| 382 | * @param string $parent (Optional, default `null`) |
||
| 383 | * @return void |
||
| 384 | */ |
||
| 385 | public function smarty_display($template = 'page.tpl', $cache_id = null, $compile_id = null, $parent = null) |
||
| 386 | { |
||
| 387 | return $this->getSmarty()->display($template, $cache_id, $compile_id, $parent); |
||
| 388 | } |
||
| 389 | } |
||
| 390 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: