fix: PHPStan Level 8 – 0 Fehler (1.0.0-beta2)

[skerbis]

PHPStan Level 8 – vollständige Typbereinigung (1.0.0-beta2)

Alle 113 PHPStan-Level-8-Fehler wurden behoben. Das Addon ist jetzt fehlerfrei auf Level 8.

Geänderte Dateien

Datei	Änderungen
lib/Activity.php	Statische Properties typisiert, Fluent-Methoden → self, new self(), assert()
lib/ActivityClear.php	QuestionHelper-Cast, Validator-Signatur float|int|string
lib/ActivityLogCronjob.php	@return array<int, array<string, mixed>> für getParamFields()
lib/EP/EpTrait.php	callable → string|callable, PHPDoc-Typen für Callbacks
lib/EP/User.php	rex_user-Import, @var-Cast für $params['user']
lib/EP/Yform.php	ignoreErrors via phpstan.neon (optionales Addon, nicht installiert)
fragments/filter-form.php	(string)-Cast für htmlspecialchars() / ucfirst()
pages/system.activity-log.php	rex::getUser()?->isAdmin() ?? false
phpstan.neon	fragments/ als Analyse-Pfad, ignoreErrors für rex_yform_manager_table

Ergebnis

[OK] No errors

PHPStan Level 8, PHP 8.2, phpstan.neon im Addon-Root.

[Copilot]

Pull request overview

Brings the addon to “PHPStan level 8: 0 errors” by tightening types across core logging + EP handlers and adding a repo-local PHPStan configuration; also includes a small backend UI CSS tweak and removes deprecated EP BC stubs.

Changes:

• Add phpstan.neon (level 8, PHP 8.2) and tune ignores for optional YForm dependency.
• Type-cleanup in Activity, EP trait/classes, and console command signatures to satisfy PHPStan.
• Minor UI/CSS update for the activity table’s first column + version/changelog bump; remove deprecated lib/extension_points/* stubs.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scss/styles.scss	Constrains first table column width via nowrap + width: 1%.
assets/css/styles.css	Compiled CSS update reflecting the SCSS change.
phpstan.neon	Adds PHPStan level 8 config + ignore for optional YForm class.
pages/system.activity-log.php	Makes admin check null-safe for unauthenticated backend contexts.
package.yml	Bumps addon version to 1.0.0-beta2.
lib/Activity.php	Adds strict static property/return types and stronger initialization assumptions.
lib/ActivityClear.php	Adds return types and tighter validator typing for console command input.
lib/ActivityLogCronjob.php	Refines PHPDoc return type for parameter fields.
lib/EP/EpTrait.php	Broadens callback type to `string
lib/EP/Article.php	Adds deduped ART_DELETED handling to avoid multi-language double logging.
lib/EP/User.php	Adds rex_user typing via explicit cast for $params['user'].
lib/EP/Yform.php	Adds PHPStan suppression strategy for optional rex_yform_manager_table.
fragments/filter-form.php	Casts option values to string for htmlspecialchars() / ucfirst().
CHANGELOG.md	Adds 1.0.0-beta2 entry describing the PHPStan cleanup.
lib/extension_points/article.php	Removed deprecated RexActivity\\EP\\article BC stub.
lib/extension_points/category.php	Removed deprecated RexActivity\\EP\\category BC stub.
lib/extension_points/clang.php	Removed deprecated RexActivity\\EP\\clang BC stub.
lib/extension_points/ep_trait.php	Removed deprecated RexActivity\\EP\\ep_trait BC stub.
lib/extension_points/media.php	Removed deprecated RexActivity\\EP\\media BC stub.
lib/extension_points/meta.php	Removed deprecated RexActivity\\EP\\meta BC stub.
lib/extension_points/module.php	Removed deprecated RexActivity\\EP\\module BC stub.
lib/extension_points/slice.php	Removed deprecated RexActivity\\EP\\slice BC stub.
lib/extension_points/template.php	Removed deprecated RexActivity\\EP\\template BC stub.
lib/extension_points/user.php	Removed deprecated RexActivity\\EP\\user BC stub.
lib/extension_points/yform.php	Removed deprecated RexActivity\\EP\\yform BC stub.

Comments suppressed due to low confidence (2)

pages/system.activity-log.php:29

• The three POST handlers that perform log deletions (delete_old_logs, delete_all_logs, delete_single_log) are only guarded by $isAdmin and do not verify any CSRF token or origin. This allows a malicious site to trigger cross-site POST requests in an admin's browser that silently delete activity-log entries, undermining the integrity of the audit log. Protect these destructive actions with proper CSRF mitigation (e.g. rex_csrf_token or equivalent) in both the form and the request handling before executing deletions.

if ($isAdmin && rex_post('delete_old_logs') && 1 == rex_post('delete_old_logs')) {
    $now = (new DateTime());
    $now->modify('-7 day');
    $date = $now->format('Y-m-d H:i:s');

    $sql = rex_sql::factory();
    $sql->setTable($table);
    $sql->setWhere("created_at <= '$date'");
    $sql->delete();
}

if ($isAdmin && rex_post('delete_all_logs') && 1 == rex_post('delete_all_logs')) {
    $sql = rex_sql::factory();
    $sql->setTable($table);
    $sql->delete();
}

if ($isAdmin && rex_post('delete_single_log')) {
    $sql = rex_sql::factory();
    $sql->setTable($table);
    $sql->setWhere('id = ' . rex_post('delete_single_log'));
    $sql->delete();

pages/system.activity-log.php:29

• setWhere('id = ' . rex_post('delete_single_log')) concatenates unvalidated POST data directly into an SQL WHERE clause, which allows an attacker to inject arbitrary SQL conditions via the delete_single_log parameter. An attacker who can trigger this endpoint (for example, via a crafted backend request or CSRF against an authenticated admin) can delete arbitrary or all log records instead of a single row. Ensure the ID is strictly validated or cast (for example to an integer) or passed through the database abstraction's escaping/binding API before being used in setWhere.

    $now = (new DateTime());
    $now->modify('-7 day');
    $date = $now->format('Y-m-d H:i:s');

    $sql = rex_sql::factory();
    $sql->setTable($table);
    $sql->setWhere("created_at <= '$date'");
    $sql->delete();
}

if ($isAdmin && rex_post('delete_all_logs') && 1 == rex_post('delete_all_logs')) {
    $sql = rex_sql::factory();
    $sql->setTable($table);
    $sql->delete();
}

if ($isAdmin && rex_post('delete_single_log')) {
    $sql = rex_sql::factory();
    $sql->setTable($table);
    $sql->setWhere('id = ' . rex_post('delete_single_log'));
    $sql->delete();

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.