Raised checking level from 5 to 6.

public-legacy/_github-callback.php

@@ -57,6 +57,9 @@ if(empty($config['tokens']['token']))
 $isGitea = isset($_SERVER['HTTP_X_GITEA_DELIVERY']) && isset($_SERVER['HTTP_X_GITEA_EVENT']);
 
 $rawData = file_get_contents('php://input');
+if(!is_string($rawData))
+    die('no input data');
+
 $sigParts = $isGitea
     ? ['sha256', $_SERVER['HTTP_X_GITEA_SIGNATURE']]
     : explode('=', $_SERVER['HTTP_X_HUB_SIGNATURE'] ?? '', 2);
@@ -94,6 +97,11 @@ if($data->repository->full_name !== $repoName)
 if($_SERVER['HTTP_X_GITHUB_EVENT'] !== 'push')
     die('only push event is supported');
 
+if(!property_exists($data, 'commits'))
+    die('commits property missing');
+if(!property_exists($data, 'ref'))
+    die('ref property missing');
+
 $commitCount = count($data->commits);
 if($commitCount < 1)
     die('no commits received');

public-legacy/manage/changelog/change.php

@@ -44,7 +44,7 @@ if($_SERVER['REQUEST_METHOD'] === 'GET' && !empty($_GET['delete'])) {
 }
 
 // make errors not echos lol
-while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) { // @phpstan-ignore-line: this while is just weird, i don't blame it
+while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) {
     $action = trim((string)filter_input(INPUT_POST, 'cl_action'));
     $summary = trim((string)filter_input(INPUT_POST, 'cl_summary'));
     $body = trim((string)filter_input(INPUT_POST, 'cl_body'));

public-legacy/manage/changelog/tag.php

@@ -32,7 +32,7 @@ if($_SERVER['REQUEST_METHOD'] === 'GET' && !empty($_GET['delete'])) {
     return;
 }
 
-while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) { // @phpstan-ignore-line: this while is just weird, i don't blame it
+while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) {
     $name = trim((string)filter_input(INPUT_POST, 'ct_name'));
     $description = trim((string)filter_input(INPUT_POST, 'ct_desc'));
     $archive = !empty($_POST['ct_archive']);

public-legacy/manage/news/category.php

@@ -32,7 +32,7 @@ if($_SERVER['REQUEST_METHOD'] === 'GET' && !empty($_GET['delete'])) {
     return;
 }
 
-while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) { // @phpstan-ignore-line: this while is just weird, i don't blame it
+while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) {
     $name = trim((string)filter_input(INPUT_POST, 'nc_name'));
     $description = trim((string)filter_input(INPUT_POST, 'nc_desc'));
     $hidden = !empty($_POST['nc_hidden']);

public-legacy/manage/news/post.php

@@ -32,7 +32,7 @@ if($_SERVER['REQUEST_METHOD'] === 'GET' && !empty($_GET['delete'])) {
     return;
 }
 
-while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) { // @phpstan-ignore-line: this while is just weird, i don't blame it
+while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) {
     $title = trim((string)filter_input(INPUT_POST, 'np_title'));
     $category = (string)filter_input(INPUT_POST, 'np_category', FILTER_SANITIZE_NUMBER_INT);
     $featured = !empty($_POST['np_featured']);

public-legacy/manage/users/ban.php

@@ -35,7 +35,7 @@ try {
 
 $modInfo = $msz->authInfo->userInfo;
 
-while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) { // @phpstan-ignore-line: this while is just weird, i don't blame it
+while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) {
     $expires = (int)filter_input(INPUT_POST, 'ub_expires', FILTER_SANITIZE_NUMBER_INT);
     $expiresCustom = (string)filter_input(INPUT_POST, 'ub_expires_custom');
     $publicReason = trim((string)filter_input(INPUT_POST, 'ub_reason_pub'));

public-legacy/manage/users/warning.php

@@ -33,7 +33,7 @@ try {
 
 $modInfo = $msz->authInfo->userInfo;
 
-while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) { // @phpstan-ignore-line: this while is just weird, i don't blame it
+while($_SERVER['REQUEST_METHOD'] === 'POST' && CSRF::validateRequest()) {
     $body = trim((string)filter_input(INPUT_POST, 'uw_body'));
     Template::set('warn_value_body', $body);
 

public-legacy/settings/data.php

@@ -13,7 +13,14 @@ if(!$msz->authInfo->isLoggedIn)
 
 $dbConn = $msz->dbConn;
 
-function db_to_zip(ZipArchive $archive, UserInfo $userInfo, string $baseName, array $fieldInfos, string $userIdField = 'user_id'): string {
+/** @param string[] $fieldInfos */
+function db_to_zip(
+    ZipArchive $archive,
+    UserInfo $userInfo,
+    string $baseName,
+    array $fieldInfos,
+    string $userIdField = 'user_id'
+): string {
     global $dbConn;
 
     $userId = $userInfo->id;