phpstan

Author: MyvTsv

composer.json

@@ -5,6 +5,7 @@
     },
     "require-dev": {
         "friendsofphp/php-cs-fixer": "^3.85",
+        "glpi-project/phpstan-glpi": "^1.0",
         "glpi-project/tools": "^0.7",
         "php-parallel-lint/php-parallel-lint": "^1.4",
         "phpstan/extension-installer": "^1.4",

composer.lock

@@ -670,7 +670,11 @@ public function showGraph($opt, $export = false, $forceFormat = null)
         $classname = 'PluginMreporting' . $opt['short_classname'];
 
         //dynamic call of method passed by 'f_name' GET parameter with previously instancied class
-        $obj   = new $classname($config);
+        if (!is_a($classname, PluginMreportingBaseclass::class, true)) {
+            return false;
+        }
+        $obj = new $classname($config);
+
         $datas = $obj->{$opt['f_name']}($config);
 
         //show graph (pgrah type determined by first entry of explode of camelcase of function name
@@ -1124,6 +1128,9 @@ public function export($opt)
                                 //dynamic instanciation of class passed by 'short_classname' GET parameter
                                 $config   = PluginMreportingConfig::initConfigParams($func['function'], $classname);
                                 $class    = 'PluginMreporting' . $func['short_classname'];
+                                if (!is_a($class, PluginMreportingBaseclass::class, true)) {
+                                    return false;
+                                }
                                 $obj      = new $class($config);
                                 $randname = $classname . $func['function'];
                                 if (isset($opt['date1']) && isset($opt['date2'])) {
@@ -1206,6 +1213,9 @@ public function export($opt)
 
             //dynamic instanciation of class passed by 'short_classname' GET parameter
             $classname = 'PluginMreporting' . $opt['short_classname'];
+            if (!is_a($classname, PluginMreportingBaseclass::class, true)) {
+                return false;
+            }
             $obj       = new $classname($config);
 
             //dynamic call of method passed by 'f_name' GET parameter with previously instancied class

inc/common.class.php

@@ -29,7 +29,7 @@
  */
 
 if (!defined('GLPI_ROOT')) {
-    die("Sorry. You can't access directly to this file");
+    throw new \Glpi\Exception\Http\NotFoundHttpException("Sorry. You can't access directly to this file");
 }
 
 class PluginMreportingConfig extends CommonDBTM
@@ -290,6 +290,9 @@ public function createFirstConfig()
             foreach ($functions as $funct_name) {
                 if ($funct_name == 'preconfig') { // If a preconfig exists we construct the class
                     $classConfig = true;
+                    if (!is_a($classname, PluginMreportingBaseclass::class, true)) {
+                        return;
+                    }
                     $classObject = new $classname([]);
                 }
             }
@@ -583,7 +586,7 @@ public function prepareInputForAdd($input)
 
     public function prepareInputForUpdate($input)
     {
-        if (isset($input['classname']) && method_exists(new $input['classname']([]), 'checkConfig')) {
+        if (isset($input['classname']) && is_a($input['classname'], PluginMreportingBaseclass::class, true) && method_exists(new $input['classname']([]), 'checkConfig')) {
             $object      = new $input['classname']([]);
             $checkConfig = $object->checkConfig($input);
             if (!$checkConfig['result']) {

inc/config.class.php

@@ -100,11 +100,6 @@ public function initGraph($options)
 
                 $config = PluginMreportingConfig::initConfigParams($functionname, $classname);
 
-                // We check if a configuration is needed for the graph
-                if (method_exists(new $classname($config), 'needConfig')) {
-                    $object = new $classname();
-                    $object->needConfig($config);
-                }
             }
         }
 

inc/graph.class.php

@@ -33,7 +33,7 @@
 use \Glpi\DBAL\QuerySubQuery;
 
 if (!defined('GLPI_ROOT')) {
-    die("Sorry. You can't access directly to this file");
+    throw new \Glpi\Exception\Http\NotFoundHttpException("Sorry. You can't access directly to this file");
 }
 
 class PluginMreportingHelpdeskplus extends PluginMreportingBaseclass

inc/helpdeskplus.class.php

@@ -29,7 +29,7 @@
  */
 
 if (!defined('GLPI_ROOT')) {
-    die("Sorry. You can't access directly to this file");
+    throw new \Glpi\Exception\Http\NotFoundHttpException("Sorry. You can't access directly to this file");
 }
 
 /**

inc/notificationevent.class.php

@@ -29,7 +29,7 @@
  */
 
 if (!defined('GLPI_ROOT')) {
-    die("Sorry. You can't access directly to this file");
+    throw new \Glpi\Exception\Http\NotFoundHttpException("Sorry. You can't access directly to this file");
 }
 
 /**

inc/notificationmail.class.php

@@ -29,7 +29,7 @@
  */
 
 if (!defined('GLPI_ROOT')) {
-    die("Sorry. You can't access directly to this file");
+    throw new \Glpi\Exception\Http\NotFoundHttpException("Sorry. You can't access directly to this file");
 }
 
 class PluginMreportingPdf extends TCPDF

inc/pdf.class.php

@@ -29,7 +29,7 @@
  */
 
 if (!defined('GLPI_ROOT')) {
-    die("Sorry. You can't access directly to this file");
+    throw new \Glpi\Exception\Http\NotFoundHttpException("Sorry. You can't access directly to this file");
 }
 
 class PluginMreportingProfile extends CommonDBTM
@@ -184,14 +184,16 @@ public static function addRightToProfile($idProfile)
         foreach ($config->find() as $report) {
             // add right for any reports for profile
             // Add manual request because Add function get error : right is set to NULL
-            $DB->updateOrInsert('glpi_plugin_mreporting_profiles', [
+            if (!$DB->updateOrInsert('glpi_plugin_mreporting_profiles', [
                 'profiles_id' => $idProfile,
                 'reports'     => $report['id'],
                 'right'       => READ,
             ], [
                 'profiles_id' => $idProfile,
                 'reports'     => $report['id'],
-            ]) or die('An error occurs during profile initialisation.');
+            ])) {
+                return;
+            }
         }
     }