MAIL HARDENING

NEXT_STEPS.md

@@ -0,0 +1,99 @@
+# Next Steps
+
+- #TODO Unified error strategy (Definition)
+- Aufwand: `M`
+- Labels: `quality`, `api`
+- Ziel: Einheitliches Verhalten bei Fehlern.
+- Akzeptanzkriterien:
+- ADR/kurze Doku: wann `null/false`, wann Exception.
+- `sql.php`, `link-meta.php`, `troy-api.php` folgen derselben Strategie.
+- Mindestens 3 Beispiele in `README.md` dokumentiert.
+- Festlegung:
+- Exceptions fuer interne/unerwartete Fehler (Konfiguration fehlt, DB/HTTP/JSON-Fehler, Parsing-Fehler, invalide Argumente).
+- `null` nur fuer "kein Ergebnis" als erwarteter Zustand (z. B. URL ohne OG-Metadaten).
+- `false` nur fuer boolesche Checks/Operationen mit reinem Erfolg-Flag; keine Detailfehler ueber `false`.
+- Keine Mischung pro Funktion: jede Funktion dokumentiert exakt einen Fehlerkanal in PHPDoc/README.
+- Alle gecatchten Exceptions werden mit Kontext weitergeworfen (ohne Secrets), nicht still geschluckt.
+
+- #TODO Complete `secret.php.example`
+- Aufwand: `S`
+- Labels: `docs`, `config`
+- Ziel: Vollstaendige Vorlagedatei fuer lokale Setups.
+- Akzeptanzkriterien:
+- Alle erwarteten Variablen aus `sql.php`, `mail.php`, `troy-api.php` enthalten.
+- Jede Variable hat kurzen Kommentar.
+- Dateiformat entspricht direkt nutzbarer Vorlage.
+
+- #TODO Remove `@` error suppression incrementally
+- Aufwand: `M`
+- Labels: `quality`, `safety`
+- Ziel: Fehler sichtbar und kontrolliert behandeln.
+- Akzeptanzkriterien:
+- Alle `@`-Operatoren inventarisiert.
+- Ersetzungen mit explizitem Error-Handling umgesetzt.
+- Keine neue `@`-Verwendung in geaenderten Dateien.
+
+- #TODO Sicherheit und Robustheit
+
+- #TODO Harden URL fetching against SSRF
+- Aufwand: `M`
+- Labels: `security`, `network`
+- Akzeptanzkriterien:
+- Private/loopback ranges werden blockiert.
+- Optionales Host-Allowlist-Feature vorhanden.
+- Tests fuer geblockte und erlaubte Ziele vorhanden.
+
+- #TODO Centralize HTTP limits (timeout/redirect/size)
+- Aufwand: `S`
+- Labels: `robustness`, `network`
+- Akzeptanzkriterien:
+- Eine zentrale Konfiguration fuer HTTP-Limits.
+- `og.php` und `link-meta.php` nutzen dieselben Limits.
+- Default-Werte sind in README dokumentiert.
+
+- #TODO Improve SQL error handling + logging
+- Aufwand: `M`
+- Labels: `sql`, `robustness`
+- Akzeptanzkriterien:
+- `prepare()`/`execute()`-Fehler werden explizit behandelt.
+- Fehler enthalten Query-Kontext ohne Secrets.
+- Verhalten entspricht der definierten Error-Strategie.
+
+- #TODO Replace fragile HTML allowlist sanitizer
+- Aufwand: `M`
+- Labels: `security`, `string`
+- Akzeptanzkriterien:
+- `onlySimpleHTML()` wird durch robusteren Ansatz ersetzt.
+- Erlaubte Tags sind konfigurierbar dokumentiert.
+- Regression-Tests fuer typische Eingaben vorhanden.
+
+- #TODO Code-Qualitaet
+
+- Sammel-Issue: Naming-Konvention, SQL-Binding-Refactor, Legacy-Markierung, Markdown-Konsolidierung, klare Modulgrenzen.
+- Aufwand: `L`
+- Empfehlung: in 3-5 Unter-Issues aufteilen.
+
+- #TODO Tests und Tooling
+
+- #TODO Bootstrap test/tooling baseline
+- Aufwand: `M`
+- Labels: `testing`, `ci`
+- Akzeptanzkriterien:
+- PHPUnit laeuft lokal mit ersten Smoke-Tests.
+- PHPStan/Psalm auf niedriger Stufe integriert.
+- CI fuehrt mindestens Lint + Tests bei Push aus.
+
+- #TODO Prepare Composer + namespace migration path
+- Aufwand: `L`
+- Labels: `architecture`
+- Akzeptanzkriterien:
+- Vorschlag fuer Zielstruktur (`src/`, namespaces, autoload).
+- Migrationsplan fuer prozedurale Helfer zu Klassen.
+- Konfigurationsobjekt und HTTP-Adapter als Zielbild beschrieben.
+
+## Empfohlene Reihenfolge
+
+1. `#1` bis `#5` (kurzfristig, hoher Hebel)
+2. `#6` bis `#10` (Sicherheit/Robustheit)
+3. `#11` (Tests + CI als Guardrail)
+4. `#12` und Sammel-Issue aus Abschnitt 3

README.md

@@ -1,2 +1,187 @@
 # php-func-lib
+
+Kleine PHP-Utility-Bibliothek mit wiederverwendbaren Helfern fuer:
+
+- Strings und einfache Sanitization
+- Zahlenformatierung
+- SQL-Zugriffe (mysqli + prepared statements)
+- Mailversand
+- Link/OpenGraph-Metadaten
+- Debug-Helfer
+- Troy-/Gitea-API-Aufrufe
+
+## Installation
+
+Als Git-Submodule in ein Projekt einbinden:
+
+```bash
 git submodule add https://git.seemsleg.it/pub/php-func-lib lib
+```
+
+Danach je nach Bedarf einzelne Dateien einbinden oder zentral ueber `_func.php` laden.
+
+## Schnellstart
+
+```php
+<?php
+include_once __DIR__ . '/_func.php';
+
+echo shortener("Ein sehr langer Text", 10); // "Ein sehr..."
+echo decade(12345);                         // "12.345 K" (je nach PHP-Konvertierung)
+```
+
+## Module
+
+- `string.php`: String-Helfer (`shortener`, `onlyAlpha`, `startsWith`, `endsWith`, `linkify`, ...)
+- `numbers.php`: Zahlen-Helfer (`decade`, `onlyNumeric`)
+- `sql.php`: Klasse `SQL` fuer Datenbankzugriffe (`get`, `single`, `list`, `keyval`, `set`)
+- `mail.php`: Mailfunktionen (`send_mail`, `send_html_mail`, `send_php_mail`)
+- `link-meta.php`: URL-Validierung, Fetching, Meta-Parsing, Bilddownload, Tag-Sanitization
+- `og.php`: Einfacher OG-Scan (`scanOG`)
+- `troy-api.php`: API-Helfer fuer Troy/Gitea (`sendToTroy`, `sendToGitea`)
+- `debug.php`: Cookie-basierte Debug-Ausgabe
+- `markdown.php`: einfache Markdown-nahe Formatierung (`md`)
+
+## Konfiguration
+
+Einige Module erwarten ein lokales `secret.php` (siehe `secret.php.example`).
+Folgende Felder werden verwendet:
+
+- `$_m['host']`, `$_m['user']`, `$_m['pass']`, `$_m['data']`, `$_m['pre']`, `$_m['salt']` fuer `sql.php`
+- `$_sendermail`, optional `$_smtp['srv']`, `$_smtp['user']`, `$_smtp['pw']` fuer `mail.php`
+- `$giteaUrl`, `$giteaOwner`, `$giteaRepo`, `$giteaToken` fuer `troy-api.php`
+
+Beispiel:
+
+```php
+<?php
+// secret.php im selben Verzeichnis wie die Bibliothek ablegen
+if (!defined('SQL_LOG')) define('SQL_LOG', 0);
+$giteaUrl = 'https://git.example.org';
+$giteaOwner = 'org';
+$giteaRepo = 'repo';
+$giteaToken = 'token';
+```
+
+## Runnable Examples
+
+### `string.php`
+
+```php
+<?php
+include_once __DIR__ . '/string.php';
+
+echo shortener('Ein sehr langer Text', 12) . PHP_EOL;
+echo onlyAlpha('Hi! #42?') . PHP_EOL;
+echo linkify('Mehr Infos: https://example.org') . PHP_EOL;
+```
+
+### `numbers.php`
+
+```php
+<?php
+include_once __DIR__ . '/numbers.php';
+
+echo decade(15320) . PHP_EOL;
+echo onlyNumeric('EUR -12.50') . PHP_EOL;
+```
+
+### `sql.php`
+
+```php
+<?php
+if (!defined('SQL_LOG')) define('SQL_LOG', 0);
+include_once __DIR__ . '/sql.php';
+
+$sql = new SQL();
+$row = $sql->single('SELECT 1 AS ok');
+var_export($row);
+```
+
+### `mail.php`
+
+```php
+<?php
+include_once __DIR__ . '/mail.php';
+
+send_mail('user@example.org', 'Test', 'Hallo Welt', 'ok', 'error');
+```
+
+### `link-meta.php`
+
+```php
+<?php
+include_once __DIR__ . '/string.php';
+include_once __DIR__ . '/link-meta.php';
+
+$info = getPageInfo('https://example.org');
+if ($info['ok']) {
+    echo $info['title'] . PHP_EOL;
+    echo $info['description'] . PHP_EOL;
+}
+```
+
+### `og.php`
+
+```php
+<?php
+include_once __DIR__ . '/og.php';
+
+$og = scanOG('https://example.org');
+print_r($og);
+```
+
+### `troy-api.php`
+
+```php
+<?php
+include_once __DIR__ . '/troy-api.php';
+
+$res = sendToTroy(['msg' => 'hello']);
+var_dump($res);
+```
+
+```php
+<?php
+include_once __DIR__ . '/troy-api.php';
+
+try {
+    $issue = sendToGitea('Test issue', 'Automatisch erstellt.');
+    print_r($issue);
+} catch (Exception $e) {
+    echo $e->getMessage();
+}
+```
+
+### `debug.php`
+
+```php
+<?php
+include_once __DIR__ . '/debug.php';
+
+debugCookie(true);
+debug(['foo' => 'bar']);
+```
+
+### `markdown.php`
+
+```php
+<?php
+include_once __DIR__ . '/string.php';
+include_once __DIR__ . '/markdown.php';
+
+echo md("! Titel\n\n* Punkt A\n* Punkt B");
+```
+
+## Known Limitations
+
+- Kein Composer/Autoload; Includes muessen manuell gesetzt werden.
+- `sql.php` erwartet `secret.php` im Bibliotheksverzeichnis und nutzt `mysqli`.
+- Netzwerkfunktionen (`link-meta.php`, `og.php`, `troy-api.php`) nutzen `file_get_contents` und haben keine SSRF-Allowlist.
+- Mehrere Funktionen sind historisch gewachsen und nutzen teils inkonsistentes Error-Handling (`false`, `null`, Exceptions).
+- `markdown.php` und `onlySimpleHTML()` sind einfache Parser/Sanitizer, nicht vollstaendige Markdown- oder HTML-Sicherheitsloesungen.
+
+## Hinweise
+
+- Die Bibliothek ist bewusst leichtgewichtig und ohne Composer-Setup gehalten.
+- Fuer geplante Verbesserungen siehe `NEXT_STEPS.md`.

_func.php

@@ -1,4 +1,5 @@
 <?php
+declare(strict_types=1);
 // include ('config.php');
 include_once ('sql.php');
 $sql = new SQL ();
@@ -8,4 +9,4 @@ include_once ('mail.php');
 include_once ('debug.php');
 include_once ('troy-api.php');
 // include_once ('markdown.php');
-?>
+?>

debug.php

@@ -1,14 +1,16 @@
 <?php 
-    function debug($s) {
+    declare(strict_types=1);
+
+    function debug(mixed $s): void {
         if(isset($_COOKIE['debug'])) 
             print_r($s);
     }
     
-    function debugCookie($on=true) {
+    function debugCookie(bool $on = true): void {
         if($on) {
             setcookie('debug','1',time()+(60*60*24*365),"/");
         }else{
             setcookie('debug',null,0,"/");
         }
     }
-?>
+?>

ips/crawler.php

@@ -1,4 +1,6 @@
 <?php
+declare(strict_types=1);
+
 $_ips_crawler = array (
         '34.79.234.76', // google
         '40.77.167.', // bing bot
@@ -28,7 +30,7 @@ $_ips_crawler = array (
         '2a01:4f8:190:4244::2', // mj12bot
         '2a01:4f8:162:43c5::2', // mj12bot
 );
-function checkHuman() {
+function checkHuman(): bool {
   global $_ips_crawler;
   if (stripos ( $_SERVER ['HTTP_USER_AGENT'], 'bot' ) !== false || stripos ( $_SERVER ['HTTP_USER_AGENT'], 'crawler' ) !== false) {
     return false;
@@ -40,4 +42,4 @@ function checkHuman() {
   }
   return true;
 }
-?>
+?>

link-meta.php

@@ -0,0 +1,180 @@
+<?php
+declare(strict_types=1);
+
+function httpContext(int $timeout = 8) {
+    return stream_context_create([
+        'http' => [
+            'timeout' => $timeout,
+            'follow_location' => 1,
+            'max_redirects' => 4,
+            'user_agent' => 'star-citizen.de-linkbot/1.0',
+            'ignore_errors' => true
+        ],
+        'ssl' => [
+            'verify_peer' => true,
+            'verify_peer_name' => true
+        ]
+    ]);
+}
+
+function normalizeUrl(string $url): ?string {
+    $url = trim($url);
+    if (!filter_var($url, FILTER_VALIDATE_URL)) {
+        return null;
+    }
+
+    $parts = parse_url($url);
+    if (!$parts || !isset($parts['scheme'])) {
+        return null;
+    }
+
+    $scheme = strtolower($parts['scheme']);
+    if ($scheme !== 'http' && $scheme !== 'https') {
+        return null;
+    }
+
+    return $url;
+}
+
+function resolveUrl(string $url, string $baseUrl): ?string {
+    $url = trim($url);
+    if (filter_var($url, FILTER_VALIDATE_URL)) {
+        return $url;
+    }
+
+    $baseParts = parse_url($baseUrl);
+    if (!$baseParts || !isset($baseParts['scheme']) || !isset($baseParts['host'])) {
+        return null;
+    }
+
+    if (strpos($url, '//') === 0) {
+        return $baseParts['scheme'] . ':' . $url;
+    }
+
+    $path = '/';
+    if (!empty($baseParts['path'])) {
+        $path = preg_replace('#/[^/]*$#', '/', $baseParts['path']);
+        if ($path === null || $path === '') {
+            $path = '/';
+        }
+    }
+
+    if (strlen($url) && $url[0] === '/') {
+        return $baseParts['scheme'] . '://' . $baseParts['host'] . $url;
+    }
+
+    return $baseParts['scheme'] . '://' . $baseParts['host'] . $path . $url;
+}
+
+function safeFetch(string $url, int $timeout = 8): ?string {
+    $ctx = httpContext($timeout);
+    $content = @file_get_contents($url, false, $ctx);
+    return $content === false ? null : $content;
+}
+
+function downloadImageFromUrl(string $url, string $baseUrl, string $destinationFolder = 'upl/'): ?string {
+    $resolved = resolveUrl($url, $baseUrl);
+    if ($resolved === null) {
+        return null;
+    }
+
+    if (!preg_match('/\.(jpg|jpeg|png|gif|bmp|webp)(?:\?|#|$)/i', $resolved)) {
+        return null;
+    }
+
+    $imageContent = safeFetch($resolved, 10);
+    if ($imageContent === null || strlen($imageContent) === 0 || strlen($imageContent) > (5 * 1024 * 1024)) {
+        return null;
+    }
+
+    $path = parse_url($resolved, PHP_URL_PATH) ?? '';
+    $ext = strtolower(pathinfo($path, PATHINFO_EXTENSION));
+    if ($ext === '' || !preg_match('/^(jpg|jpeg|png|gif|bmp|webp)$/', $ext)) {
+        $ext = 'png';
+    }
+
+    if (!is_dir($destinationFolder)) {
+        @mkdir($destinationFolder, 0775, true);
+    }
+
+    $md5Hash = md5($imageContent);
+    $filePath = rtrim($destinationFolder, '/\\') . '/' . $md5Hash . '.' . $ext;
+    $written = @file_put_contents($filePath, $imageContent);
+    if ($written === false) {
+        return null;
+    }
+
+    return $filePath;
+}
+
+function parseMetaContent(string $html, string $attr, string $name): ?string {
+    $pattern = '/<meta[^>]*' . $attr . '=["\']' . preg_quote($name, '/') . '["\'][^>]*content=["\']([^"\']+)["\'][^>]*>/i';
+    if (preg_match($pattern, $html, $matches) && isset($matches[1])) {
+        return trim(html_entity_decode($matches[1], ENT_QUOTES | ENT_HTML5, 'UTF-8'));
+    }
+    return null;
+}
+
+function getPageInfo(string $url): array {
+    $ret = [
+        'ok' => false,
+        'title' => '',
+        'description' => '',
+        'logo' => null,
+        'error' => null
+    ];
+
+    $normalized = normalizeUrl($url);
+    if ($normalized === null) {
+        $ret['error'] = 'ungueltige_url';
+        return $ret;
+    }
+
+    $html = safeFetch($normalized, 10);
+    if ($html === null) {
+        $ret['error'] = 'seite_nicht_erreichbar';
+        return $ret;
+    }
+
+    $title = parseMetaContent($html, 'property', 'og:title') ?? parseMetaContent($html, 'name', 'title');
+    $description = parseMetaContent($html, 'property', 'og:description') ?? parseMetaContent($html, 'name', 'description');
+    $image = parseMetaContent($html, 'property', 'og:image') ?? parseMetaContent($html, 'name', 'image');
+
+    if ($title === null && preg_match('/<title>\s*(.*?)\s*<\/title>/is', $html, $matchTitle)) {
+        $title = trim(html_entity_decode($matchTitle[1], ENT_QUOTES | ENT_HTML5, 'UTF-8'));
+    }
+
+    $logo = null;
+    if ($image !== null && $image !== '') {
+        $img = downloadImageFromUrl($image, $normalized);
+        if ($img !== null) {
+            $logo = '/' . ltrim($img, '/');
+        }
+    }
+
+    $ret['ok'] = true;
+    $ret['title'] = $title ?? '';
+    $ret['description'] = $description ?? '';
+    $ret['logo'] = $logo;
+    return $ret;
+}
+
+function sanitizeTags(array $input): array {
+    $ret = [];
+    foreach ($input as $tag) {
+        if (!is_string($tag)) {
+            continue;
+        }
+        $clean = onlyAlpha(trim($tag), '_\-');
+        if ($clean === '') {
+            continue;
+        }
+        $clean = ucfirst(substr($clean, 0, 35));
+        $ret[$clean] = true;
+        if (count($ret) >= 20) {
+            break;
+        }
+    }
+    return array_keys($ret);
+}
+

mail.php

@@ -1,5 +1,18 @@
 <?php
-function send_mail($an, $betreff, $text, $ok = '', $error = '') {
+declare(strict_types=1);
+
+function mail_contains_header_injection(string $value): bool {
+  return strpbrk($value, "\r\n\0") !== false;
+}
+
+function mail_is_valid_email(string $value): bool {
+  if (mail_contains_header_injection($value)) {
+    return false;
+  }
+  return filter_var($value, FILTER_VALIDATE_EMAIL) !== false;
+}
+
+function send_mail(string $an, string $betreff, string $text, string $ok = '', string $error = ''): void {
   global $absender;
   $sender = 'noreply@troy-grunt.de';
   if(isset($absender) && $absender) {
@@ -10,6 +23,10 @@ function send_mail($an, $betreff, $text, $ok = '', $error = '') {
       $sender = $_sendermail;
     }
   }
+  if (!mail_is_valid_email($an) || !mail_is_valid_email($sender) || mail_contains_header_injection($betreff)) {
+    echo $error;
+    return;
+  }
   $header = 'From: ' . $sender . "\r\n";
   $header .= 'To: ' . $an . "\r\n";
   $header .= 'Content-Type:text/html' . "\r\n";
@@ -23,7 +40,7 @@ function send_mail($an, $betreff, $text, $ok = '', $error = '') {
   }
 }
 
-function send_html_mail($an, $betreff, $text, $ok = '', $error = '') {
+function send_html_mail(string $an, string $betreff, string $text, string $ok = '', string $error = ''): void {
   global $absender;
   $sender = 'noreply@troy-grunt.de';
   if(isset($absender) && $absender) {
@@ -34,6 +51,10 @@ function send_html_mail($an, $betreff, $text, $ok = '', $error = '') {
       $sender = $_sendermail;
     }
   }
+  if (!mail_is_valid_email($an) || !mail_is_valid_email($sender) || mail_contains_header_injection($betreff)) {
+    echo $error;
+    return;
+  }
   $boundary = md5($an.$betreff.$text.time());
 
   $header = 'From: ' . $sender . "\n";
@@ -57,12 +78,16 @@ function send_html_mail($an, $betreff, $text, $ok = '', $error = '') {
   }
 }
 
-function send_php_mail($an, $betreff, $text, $ok = '', $error = '') {
+function send_php_mail(string $an, string $betreff, string $text, string $ok = '', string $error = ''): void {
   global $_sendermail;
   $sender = 'noreply@troy-grunt.de';
   if (isset ( $_sendermail )) {
     $sender = $_sendermail;
   }
+  if (!mail_is_valid_email($an) || !mail_is_valid_email($sender) || mail_contains_header_injection($betreff)) {
+    echo $error;
+    return;
+  }
   include 'php-mailer/PHPMailer.php';
   $mail = new PHPMailer();
 
@@ -78,4 +103,4 @@ function send_php_mail($an, $betreff, $text, $ok = '', $error = '') {
       echo 'Message sent!';
   }
 }
-?>
+?>

markdown.php

@@ -1,6 +1,7 @@
 <?php
+declare(strict_types=1);
 // TODO markdown imple
-function md($str) {
+function md(string $str): string {
   // return nl2br ( $str ); // TODO md problem
   $text = '<p>';
   $lv = 0;
@@ -75,10 +76,10 @@ function md($str) {
   $text .= '</p>';
   return $text;
 }
-function _md_link_replacer($in) {
+function _md_link_replacer(array $in): string {
   // var_dump ( $in );
   $in = explode ( '|', $in [1], 2 );
 
   return '<a href="' . $in [0] . '" target="_blank">' . (isset ( $in [1] ) ? $in [1] : $in [0]) . '</a>';
 }
-?>
+?>

numbers.php

@@ -1,5 +1,7 @@
 <?php
-function decade($zahl)
+declare(strict_types=1);
+
+function decade(int|float|string $zahl): int|float|string
 {
     if (! is_numeric($zahl) || $zahl == 0)
         return $zahl;
@@ -31,7 +33,7 @@ function decade($zahl)
         return $zahl . ' ' . $si[$e];
 }
 
-function onlyNumeric($num) {
+function onlyNumeric(string $num): string {
     return preg_replace("/[^0-9\.\-]+/", "", $num);
 }
-?>
+?>

og.php

@@ -1,5 +1,7 @@
 <?php
-function scanOG($url) {
+declare(strict_types=1);
+
+function scanOG(string $url): array {
   $og = array();
   $html = file_get_contents($url);
 
@@ -12,4 +14,4 @@ function scanOG($url) {
   //print_r($og);
   return $og;
 }
-?>
+?>

secret.php.example

@@ -1,18 +1,17 @@
-<?php
-if (!defined('SQL_LOG')) define ( 'SQL_LOG', 1 ); // schreibt sql querys in eine log
-
-$_m['host'] = 'localhost';
-$_m['user'] = '';
-$_m['pass'] = '';
-$_m['data'] = '';
-$_m['pre']  = '';
-$_m['salt'] = '';
-
-$_sendermail = 'noreply@.de';
-$_smtp['srv'] = 'mail.seemsleg.it';
-$_smtp['user'] = 'noreply@.de';
-$_smtp['pw'] = '';
-
-$_i['host'] = '';
-$_i['secret'] = '';
-?>
+<?php
+declare(strict_types=1);
+
+if (!defined('SQL_LOG')) define ( 'SQL_LOG', 1 ); // schreibt sql querys in eine log
+
+$_m['host'] = 'localhost';
+$_m['user'] = '';
+$_m['pass'] = '';
+$_m['data'] = '';
+$_m['pre']  = '';
+$_m['salt'] = '';
+
+$_sendermail = 'noreply@.de';
+$_smtp['srv'] = 'mail.seemsleg.it';
+$_smtp['user'] = 'noreply@.de';
+$_smtp['pw'] = '';
+?>

sql.php

@@ -1,203 +1,200 @@
 <?php
-$__idata = [];
+declare(strict_types=1);
 
 class SQL {
-    private $h;
-    private $res = false;
-    private $m;
-    public $salt;
-    public $pre;
-    public $cnt_get = 0;
-    public $cnt_set = 0;
-    public function __construct() {
-        global $__idata;
-        require_once ('secret.php');
+  private $h;
+  private $res = false;
+  private $m;
+  public $salt;
+  public $pre;
+  public $cnt_get = 0;
+  public $cnt_set = 0;
+  public function __construct() {
+    require_once ('secret.php');
 
-        $__idata = $_i;
+    $this->m = $_m;
+    $this->pre = $_m ['pre'];
+    $this->salt = $_m ['salt'];
+    if (SQL_LOG)
+      $this->f = fopen ( 'sql.log', 'w' );
 
-        $this->m = $_m;
-        $this->pre = $_m ['pre'];
-        $this->salt = $_m ['salt'];
-        if (SQL_LOG)
-            $this->f = fopen ( 'sql.log', 'w' );
-
-        $this->h = new mysqli ( $_m ['host'], $_m ['user'], $_m ['pass'], $_m ['data'] );
-        if ($this->h->connect_errno) {
-            return false;
-        }
-        return true;
+    $this->h = new mysqli ( $_m ['host'], $_m ['user'], $_m ['pass'], $_m ['data'] );
+    if ($this->h->connect_errno) {
+      return false;
     }
-    public function get($que, $t = '', $p = array ()) {
-      // echo $que;
-      $this->cnt_get ++;
+    return true;
+  }
+  public function get(string $que, string $t = '', mixed $p = array ()): array|false {
+    // echo $que;
+    $this->cnt_get ++;
+    if (SQL_LOG)
+      fputs ( $this->f, str_replace ( array (
+              "\n",
+              "  "
+      ), array (
+              ' ',
+              ''
+      ), $que ) . "\n" . print_r ( $p, true ) . "\n\n" );
+    $statement = $this->h->prepare ( $que );
+    if (is_array ( $p )) {
+      switch (count ( $p )) {
+        case 0 :
+          break;
+        case 1 :
+          $statement->bind_param ( $t, $p [0] );
+          break;
+        case 2 :
+          $statement->bind_param ( $t, $p [0], $p [1] );
+          break;
+        case 3 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2] );
+          break;
+        case 4 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3] );
+          break;
+        case 5 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4] );
+          break;
+        case 6 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5] );
+          break;
+        case 7 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6] );
+          break;
+        case 8 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7] );
+          break;
+        case 9 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8] );
+          break;
+        case 10 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8], $p [9] );
+          break;
+      }
+    } else {
+      $statement->bind_param ( $t, $p );
+    }
+    $statement->execute ();
+
+    $ret = array ();
+
+    // print_r($statement);
+    if (isset ( $statement->error ) && $statement->error != '') {
       if (SQL_LOG)
-        fputs ( $this->f, str_replace ( array (
-                "\n",
-                "  "
-        ), array (
-                ' ',
-                ''
-        ), $que ) . "\n" . print_r ( $p, true ) . "\n\n" );
-      $statement = $this->h->prepare ( $que );
-      if (is_array ( $p )) {
-        switch (count ( $p )) {
-          case 0 :
-            break;
-          case 1 :
-            $statement->bind_param ( $t, $p [0] );
-            break;
-          case 2 :
-            $statement->bind_param ( $t, $p [0], $p [1] );
-            break;
-          case 3 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2] );
-            break;
-          case 4 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3] );
-            break;
-          case 5 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4] );
-            break;
-          case 6 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5] );
-            break;
-          case 7 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6] );
-            break;
-          case 8 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7] );
-            break;
-          case 9 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8] );
-            break;
-          case 10 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8], $p [9] );
-            break;
-        }
-      } else {
-        $statement->bind_param ( $t, $p );
-      }
-      $statement->execute ();
-
+        fputs ( $this->f, $statement->error );
+      return false;
+    }
+    $result = $statement->get_result ();
+    // print_r($result);
+    while ( $row = $result->fetch_assoc () ) {
+      $ret [] = $row;
+    }
+    return $ret;
+  }
+  public function single(string $que, string $t = '', mixed $p = array ()): array|false {
+    $data = $this->get ( $que, $t, $p );
+    if ($data) {
+      return $data [0];
+    }
+    return false;
+  }
+  public function list(string $que, string $t = '', mixed $p = array ()): array|false {
+    $data = $this->get ( $que, $t, $p );
+    if ($data) {
       $ret = array ();
-
-      // print_r($statement);
-      if (isset ( $statement->error ) && $statement->error != '') {
-        if (SQL_LOG)
-          fputs ( $this->f, $statement->error );
-        return false;
-      }
-      $result = $statement->get_result ();
-      // print_r($result);
-      while ( $row = $result->fetch_assoc () ) {
-        $ret [] = $row;
+      foreach ( $data as $d ) {
+        foreach ( $d as $k => $v ) {
+          $ret [] = $v;
+        }
       }
       return $ret;
     }
-    public function single($que, $t = '', $p = array ()) {
-      $data = $this->get ( $que, $t, $p );
-      if ($data) {
-        return $data [0];
+    return false;
+  }
+  public function keyval(string $que, string|int $k, string|int $v, string $t = '', mixed $p = array ()): array|false {
+    $data = $this->get ( $que, $t, $p );
+    if ($data) {
+      $ret = array ();
+      foreach ( $data as $d ) {
+        $ret [$d [$k]] = $d [$v];
       }
-      return false;
+      return $ret;
     }
-    public function list($que, $t = '', $p = array ()) {
-      $data = $this->get ( $que, $t, $p );
-      if ($data) {
-        $ret = array ();
-        foreach ( $data as $d ) {
-          foreach ( $d as $k => $v ) {
-            $ret [] = $v;
-          }
-        }
-        return $ret;
+    return false;
+  }
+  public function set(string $que, string $t = '', mixed $p = array (), bool $id = false): int|false {
+    // echo $que;
+    $this->cnt_set ++;
+    $statement = $this->h->prepare ( $que );
+    if (SQL_LOG)
+      fputs ( $this->f, str_replace ( array (
+              "\n",
+              "  "
+      ), array (
+              ' ',
+              ''
+      ), $que ) . "\n" . print_r ( $p, true ) . "\n\n" );
+    if (is_array ( $p )) {
+      switch (count ( $p )) {
+        case 0 :
+          break;
+        case 1 :
+          $statement->bind_param ( $t, $p [0] );
+          break;
+        case 2 :
+          $statement->bind_param ( $t, $p [0], $p [1] );
+          break;
+        case 3 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2] );
+          break;
+        case 4 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3] );
+          break;
+        case 5 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4] );
+          break;
+        case 6 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5] );
+          break;
+        case 7 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6] );
+          break;
+        case 8 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7] );
+          break;
+        case 9 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8] );
+          break;
+        case 10 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8], $p [9] );
+          break;
+        case 11 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8], $p [9], $p [10] );
+          break;
+        case 12 :
+          $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8], $p [9], $p [10], $p [11] );
+          break;
       }
-      return false;
+    } else {
+      $statement->bind_param ( $t, $p );
     }
-    public function keyval($que, $k, $v, $t = '', $p = array ()) {
-      $data = $this->get ( $que, $t, $p );
-      if ($data) {
-        $ret = array ();
-        foreach ( $data as $d ) {
-          $ret [$d [$k]] = $d [$v];
-        }
-        return $ret;
-      }
-      return false;
-    }
-    public function set($que, $t = '', $p = array (), $id = false) {
-      // echo $que;
-      $this->cnt_set ++;
-      $statement = $this->h->prepare ( $que );
+    $statement->execute ();
+    if (isset ( $statement->error ) && $statement->error != '') {
       if (SQL_LOG)
-        fputs ( $this->f, str_replace ( array (
-                "\n",
-                "  "
-        ), array (
-                ' ',
-                ''
-        ), $que ) . "\n" . print_r ( $p, true ) . "\n\n" );
-      if (is_array ( $p )) {
-        switch (count ( $p )) {
-          case 0 :
-            break;
-          case 1 :
-            $statement->bind_param ( $t, $p [0] );
-            break;
-          case 2 :
-            $statement->bind_param ( $t, $p [0], $p [1] );
-            break;
-          case 3 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2] );
-            break;
-          case 4 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3] );
-            break;
-          case 5 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4] );
-            break;
-          case 6 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5] );
-            break;
-          case 7 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6] );
-            break;
-          case 8 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7] );
-            break;
-          case 9 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8] );
-            break;
-          case 10 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8], $p [9] );
-            break;
-          case 11 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8], $p [9], $p [10] );
-            break;
-          case 12 :
-            $statement->bind_param ( $t, $p [0], $p [1], $p [2], $p [3], $p [4], $p [5], $p [6], $p [7], $p [8], $p [9], $p [10], $p [11] );
-            break;
-        }
-      } else {
-        $statement->bind_param ( $t, $p );
-      }
-      $statement->execute ();
-      if (isset ( $statement->error ) && $statement->error != '') {
-        if (SQL_LOG)
-          fputs ( $this->f, $statement->error );
-        return false;
-      }
+        fputs ( $this->f, $statement->error );
+      return false;
+    }
 
-      if ($id) {
-        return $statement->insert_id;
-      } else {
-        return $statement->affected_rows;
-      }
-    }
-    function __destruct() {
-      if (SQL_LOG)
-        $this->h->close ();
-      // echo 'DESTROY';
+    if ($id) {
+      return $statement->insert_id;
+    } else {
+      return $statement->affected_rows;
     }
+  }
+  function __destruct(): void {
+    if (SQL_LOG)
+      $this->h->close ();
+    // echo 'DESTROY';
+  }
 }
 ?>

string.php

@@ -1,5 +1,7 @@
 <?php
-function umlaute($str) {
+declare(strict_types=1);
+
+function umlaute(string $str): string {
   return str_replace ( array (
           'Ä',
           'Ö',
@@ -20,10 +22,10 @@ function umlaute($str) {
           '&amp;'
   ), $str );
 }
-function chk($str) {
+function chk(string $str): string {
   return str_replace ( "'", '"', $str );
 }
-function noScript($str) {
+function noScript(string $str): string {
   return str_replace ( array (
           '<',
           '>'
@@ -32,7 +34,7 @@ function noScript($str) {
           '&gt;'
   ), $str );
 }
-function random($name_laenge) {
+function random(int $name_laenge): string {
   $zeichen = "abcedfghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRTSUVWXYZ0123456789";
   $name_neu = "";
 
@@ -43,32 +45,32 @@ function random($name_laenge) {
   }
   return $name_neu;
 }
-function startsWith($haystack, $needle) {
+function startsWith(string $haystack, string $needle): bool {
   $length = strlen ( $needle );
   return (substr ( $haystack, 0, $length ) === $needle);
 }
-function endsWith($haystack, $needle) {
+function endsWith(string $haystack, string $needle): bool {
   $length = strlen ( $needle );
 
   return $length === 0 || (substr ( $haystack, - $length ) === $needle);
 }
-function onlyAlpha($str, $zus = '') {
+function onlyAlpha(string $str, string $zus = ''): string {
   return preg_replace ( "/[^a-zA-Z0-9 \-\{$zus}_]+/", "", $str );
 }
-function shortener($str, $len = 50, $fill = '...') {
+function shortener(string $str, int $len = 50, string $fill = '...'): string {
   if (strlen ( $str ) > $len) {
     $str = substr ( $str, 0, $len - strlen ( $fill ) ) . $fill;
   }
   return $str;
 }
-function isEmail($str) {
+function isEmail(string $str): string|false {
   $match = preg_match ( "/[a-zA-Z0-9\-\_\.]*\@[a-zA-Z0-9\-\_\.]*.[a-z]{2,10}/", $str );
   if ($match) {
     return $str;
   }
   return false;
 }
-function markUp($text) {
+function markUp(string $text): string {
   $r = '';
   $lv = 0;
   foreach ( explode ( "\n", $text ) as $t ) {
@@ -127,7 +129,7 @@ function markUp($text) {
   }
   return $r;
 }
-function onlySimpleHTML($s) {
+function onlySimpleHTML(string $s): string {
   $s = str_replace ( array (
           '<',
           '>'
@@ -259,14 +261,14 @@ function onlySimpleHTML($s) {
 
   return $s;
 }
-function linkify($input) {
+function linkify(string $input): string {
   $pattern = '@(http(s)?://[a-zA-Z0-9/\.\#\-\_]*)@';
   return $output = preg_replace ( $pattern, '<a href="$1">$1</a>', $input );
 }
-function inStr($needle, $haystack) {
+function inStr(string $needle, string $haystack): bool {
   if (strpos ( $haystack, $needle ) !== false) {
     return true;
   }
   return false;
 }
-?>
+?>

troy-api.php

@@ -1,82 +1,51 @@
 <?php
-    function sendToTroy($data) {
-        $url = 'https://troy-grunt.de/api.php';
-        $options = array (
-            'http' => array (
-                'method' => 'POST',
-                'header' => array (
-                    'Content-Type: application/json'
-                ),
-                'content' => json_encode ( $data )
-            )
-        );
-        $context = stream_context_create ( $options );
-        return file_get_contents ( $url, false, $context );
+declare(strict_types=1);
+
+function sendToTroy(array $data): string|false {
+  $url = 'https://troy-grunt.de/api.php';
+  $options = array (
+          'http' => array (
+                  'method' => 'POST',
+                  'header' => array (
+                          'Content-Type: application/json'
+                  ),
+                  'content' => json_encode ( $data )
+          )
+  );
+  $context = stream_context_create ( $options );
+  return file_get_contents ( $url, false, $context );
+}
+
+function sendToGitea(string $title, string $message): array|null {
+    // secret.php liegt in lib/
+    require 'secret.php';
+
+    $url = rtrim($giteaUrl, '/') . "/repos/$giteaOwner/$giteaRepo/issues";
+
+    $data = [
+        "title" => $title,
+        "body"  => $message
+    ];
+
+    $options = [
+        'http' => [
+            'method'  => 'POST',
+            'header'  => [
+                "Content-Type: application/json",
+                "Authorization: token $giteaToken"
+            ],
+            'content' => json_encode($data)
+        ]
+    ];
+
+    $context = stream_context_create($options);
+    $result = file_get_contents($url, false, $context);
+
+    if ($result === FALSE) {
+        throw new Exception("Fehler beim Erstellen der Anfrage");
     }
 
-    function sendIssue($service, $text, $data = []) {
-        global $__idata;
+    return json_decode($result, true);
+}
 
-        $url = 'https://issues.troy-grunt.de/api';
-
-        // Basisdaten für den POST-Request
-        $postData = [
-            'host'   => $__idata['host'],
-            'secret' => $__idata['secret'],
-            'typ'    => $service,
-            'text'   => $text,
-            'data'   => json_encode($data) // Falls 'data' ein Array ist, wird es als JSON gesendet
-        ];
-
-        // cURL initialisieren
-        $ch = curl_init($url);
-        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-        curl_setopt($ch, CURLOPT_POST, true);
-        curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded']);
-        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($postData));
-
-        // Anfrage senden & Antwort erhalten
-        $response = curl_exec($ch);
-        curl_close($ch);
-
-        return $response;
-    }
-
-
-    //TODO
-    function sendSimpleIssue($text,$url){
-        $apiUrl = 'https://issues.troy-grunt.de/api/simple';
-
-        // Die notwendigen Daten
-        $data = [
-            'domain' => 'example.com', // Ersetze mit deiner registrierten Domain
-            'secret' => 'geheimes-passwort', // Ersetze mit deinem Secret
-            'text'   => $text,
-            'url'    => $url
-        ];
-
-        $options = [
-            'http' => [
-                'header'  => "Content-Type: application/json\r\n",
-                'method'  => 'POST',
-                'content' => json_encode($data)
-            ]
-        ];
-
-        $context  = stream_context_create($options);
-        $response = file_get_contents($apiUrl, false, $context);
-
-        if ($response === FALSE) {
-            die('Fehler bei der API-Anfrage');
-        }
-
-        // Antwort dekodieren
-        $result = json_decode($response, true);
-
-        if (isset($result['success']) && $result['success']) {
-            echo "Issue erfolgreich erstellt. ID: " . $result['issue_id'];
-        } else {
-            echo "Fehler: " . ($result['error'] ?? 'Unbekannter Fehler');
-        }
-    }//TODO nutzen
-?>
+?>