23804883405

Committed 31 Mar 2026 03:14PM UTC coverage: 11.195% (+1.8%) from 9.347%

Build Type

push

github

Committed by Martian Congress

Commit Message

refactor: Tier 1 — security fixes, route standardization, code style, docs

S9:  File upload path traversal — assert realpath() within allowed dirs,
     sanitize citizen address in file paths
S11: Citizen registry queries capped with LIMIT 100
S12: External HTTP calls — replaced file_get_contents with Http::timeout()
     in CongressController, Wallet/ApiController, AppHelper
A8:  All routes converted to Laravel 9+ array notation
     [Controller::class, 'method']
D2:  Created DEVELOPMENT.md — complete setup guide for contributors
D4:  Laravel Pint code style enforced across 211 files

Tests updated: public route assertions corrected after route syntax
standardization exposed that old string-notation routes never resolved
properly in tests.

127 tests, 251 assertions, 0 PHPStan errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

302 of 3262 new or added lines in 58 files covered. (9.26%)

139 existing lines in 24 files now uncovered.

620 of 5538 relevant lines covered (11.2%)

1.54 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/app/Includes/jsonRPCClient.php

<?php

namespace App\Includes;

use Exception;

/*
                COPYRIGHT

Copyright 2007 Sergio Vaccaro <sergio@inservibile.org>

This file is part of JSON-RPC PHP.

JSON-RPC PHP is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

JSON-RPC PHP is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with JSON-RPC PHP; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
*/

/**
 * The object of this class are generic jsonRPC 1.0 clients
 * http://json-rpc.org/wiki/specification
 *
 * @author sergio <jsonrpcphp@inservibile.org>
 */
class jsonRPCClient
{
    private $debug;

    private $url;

    private $id;

    private $notification = false;

    private $proxy = ''; // Add proxy property

    public function __construct($url, $debug = false)
    {
        $this->url = $url;
        $this->debug = empty($debug) ? false : true;
        $this->id = 1;
    }

    /**
     * Sets the notification state of the object. In this state, notifications are performed, instead of requests.
     *
     * @param  bool  $notification
     */
    public function setRPCNotification($notification)
    {
        empty($notification) ?
                            $this->notification = false
                            :
                            $this->notification = true;
    }

    /**
     * Performs a jsonRCP request and gets the results as an array
     *
     * @param  string  $method
     * @param  array  $params
     * @return array
     */
    public function __call($method, $params)
    {

        // check
        if (! is_scalar($method)) {
            throw new Exception('Method name has no scalar value');
        }

        // check
        if (is_array($params)) {
            // no keys
            $params = array_values($params);
        } else {
            throw new Exception('Params must be given as array');
        }

        // sets notification or request task
        if ($this->notification) {
            $currentId = null;
        } else {
            $currentId = $this->id;
        }

        // prepares the request (method name must be lowercase for Marscoin v28+)
        $request = [
            'jsonrpc' => '1.0',
            'method' => strtolower($method),
            'params' => $params,
            'id' => $currentId,
        ];
        $request = json_encode($request);
        $this->debug && $this->debug .= '***** Request *****'."\n".$request."\n".'***** End Of request *****'."\n\n";

        // performs the HTTP POST using curl (compatible with Marscoin v28+)
        $ch = curl_init($this->url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $request);
        curl_setopt($ch, CURLOPT_HTTPHEADER, [
            'Content-Type: application/json',
            'Connection: close',
        ]);
        curl_setopt($ch, CURLOPT_TIMEOUT, 30);
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);

        // Extract credentials from URL for Basic Auth
        $urlParts = parse_url($this->url);
        if (isset($urlParts['user']) && isset($urlParts['pass'])) {
            curl_setopt($ch, CURLOPT_USERPWD, $urlParts['user'].':'.$urlParts['pass']);
        }

        $responseRaw = curl_exec($ch);
        $curlError = curl_error($ch);
        curl_close($ch);

        if ($responseRaw === false || empty($responseRaw)) {
            throw new Exception('Unable to connect to '.$this->url.($curlError ? ': '.$curlError : ''));
        }

        $this->debug && $this->debug .= '***** Server response *****'."\n".$responseRaw.'***** End of server response *****'."\n";
        $response = json_decode($responseRaw, true);

        if (! is_array($response)) {
            throw new Exception('Invalid JSON response from server');
        }

        // debug output
        if ($this->debug) {
            echo nl2br($this->debug);
        }

        // final checks and return
        if (! $this->notification) {
            // check
            if (isset($response['id']) && $response['id'] != $currentId) {
                throw new Exception('Incorrect response id (request id: '.$currentId.', response id: '.$response['id'].')');
            }
            if (isset($response['error']) && ! is_null($response['error'])) {
                $errorMsg = is_array($response['error']) ? json_encode($response['error']) : $response['error'];
                throw new Exception('Request error: '.$errorMsg);
            }

            return $response['result'];

        } else {
            return true;
        }
    }
}

1	<?php
2
3	namespace App\Includes;
4
5	use Exception;
6
7	/*
8	COPYRIGHT
9
10	Copyright 2007 Sergio Vaccaro <sergio@inservibile.org>
11
12	This file is part of JSON-RPC PHP.
13
14	JSON-RPC PHP is free software; you can redistribute it and/or modify
15	it under the terms of the GNU General Public License as published by
16	the Free Software Foundation; either version 2 of the License, or
17	(at your option) any later version.
18
19	JSON-RPC PHP is distributed in the hope that it will be useful,
20	but WITHOUT ANY WARRANTY; without even the implied warranty of
21	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22	GNU General Public License for more details.
23
24	You should have received a copy of the GNU General Public License
25	along with JSON-RPC PHP; if not, write to the Free Software
26	Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
27	*/
28
29	/**
30	* The object of this class are generic jsonRPC 1.0 clients
31	* http://json-rpc.org/wiki/specification
32	*
33	* @author sergio <jsonrpcphp@inservibile.org>
34	*/
35	class jsonRPCClient
36	{
37	private $debug;
38
39	private $url;
40
41	private $id;
42
43	private $notification = false;
44
45	private $proxy = ''; // Add proxy property
46
NEW 47	public function __construct($url, $debug = false)	×
48	{
49	$this->url = $url;	×
50	$this->debug = empty($debug) ? false : true;	×
51	$this->id = 1;	×
52	}
53
54	/**
55	* Sets the notification state of the object. In this state, notifications are performed, instead of requests.
56	*
57	* @param bool $notification
58	*/
NEW 59	public function setRPCNotification($notification)	×
60	{
NEW 61	empty($notification) ?	×
NEW 62	$this->notification = false	×
NEW 63	:	×
NEW 64	$this->notification = true;	×
65	}
66
67	/**
68	* Performs a jsonRCP request and gets the results as an array
69	*
70	* @param string $method
71	* @param array $params
72	* @return array
73	*/
NEW 74	public function __call($method, $params)	×
75	{
76
77	// check
NEW 78	if (! is_scalar($method)) {	×
NEW 79	throw new Exception('Method name has no scalar value');	×
80	}
81
82	// check
NEW 83	if (is_array($params)) {	×
84	// no keys
NEW 85	$params = array_values($params);	×
86	} else {
NEW 87	throw new Exception('Params must be given as array');	×
88	}
89
90	// sets notification or request task
NEW 91	if ($this->notification) {	×
NEW 92	$currentId = null;	×
93	} else {
NEW 94	$currentId = $this->id;	×
95	}
96
97	// prepares the request (method name must be lowercase for Marscoin v28+)
NEW 98	$request = [	×
NEW 99	'jsonrpc' => '1.0',	×
NEW 100	'method' => strtolower($method),	×
NEW 101	'params' => $params,	×
NEW 102	'id' => $currentId,	×
NEW 103	];	×
NEW 104	$request = json_encode($request);	×
NEW 105	$this->debug && $this->debug .= '*** Request *'."\n".$request."\n".'* End Of request ***'."\n\n";	×
106
107	// performs the HTTP POST using curl (compatible with Marscoin v28+)
NEW 108	$ch = curl_init($this->url);	×
NEW 109	curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);	×
NEW 110	curl_setopt($ch, CURLOPT_POST, true);	×
NEW 111	curl_setopt($ch, CURLOPT_POSTFIELDS, $request);	×
NEW 112	curl_setopt($ch, CURLOPT_HTTPHEADER, [	×
NEW 113	'Content-Type: application/json',	×
NEW 114	'Connection: close',	×
NEW 115	]);	×
NEW 116	curl_setopt($ch, CURLOPT_TIMEOUT, 30);	×
NEW 117	curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);	×
118
119	// Extract credentials from URL for Basic Auth
NEW 120	$urlParts = parse_url($this->url);	×
NEW 121	if (isset($urlParts['user']) && isset($urlParts['pass'])) {	×
NEW 122	curl_setopt($ch, CURLOPT_USERPWD, $urlParts['user'].':'.$urlParts['pass']);	×
123	}
124
NEW 125	$responseRaw = curl_exec($ch);	×
NEW 126	$curlError = curl_error($ch);	×
NEW 127	curl_close($ch);	×
128
NEW 129	if ($responseRaw === false \|\| empty($responseRaw)) {	×
NEW 130	throw new Exception('Unable to connect to '.$this->url.($curlError ? ': '.$curlError : ''));	×
131	}
132
NEW 133	$this->debug && $this->debug .= '*** Server response *'."\n".$responseRaw.'* End of server response ***'."\n";	×
NEW 134	$response = json_decode($responseRaw, true);	×
135
NEW 136	if (! is_array($response)) {	×
NEW 137	throw new Exception('Invalid JSON response from server');	×
138	}
139
140	// debug output
NEW 141	if ($this->debug) {	×
NEW 142	echo nl2br($this->debug);	×
143	}
144
145	// final checks and return
NEW 146	if (! $this->notification) {	×
147	// check
NEW 148	if (isset($response['id']) && $response['id'] != $currentId) {	×
NEW 149	throw new Exception('Incorrect response id (request id: '.$currentId.', response id: '.$response['id'].')');	×
150	}
NEW 151	if (isset($response['error']) && ! is_null($response['error'])) {	×
NEW 152	$errorMsg = is_array($response['error']) ? json_encode($response['error']) : $response['error'];	×
NEW 153	throw new Exception('Request error: '.$errorMsg);	×
154	}
155
NEW 156	return $response['result'];	×
157
158	} else {
NEW 159	return true;	×
160	}
161	}
162	}

marscoin / martianrepublic / 23804883405

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous