From 2a9d4360f1b2e6cfbe5a089d984cc91374004d23 Mon Sep 17 00:00:00 2001
From: Julio <gugli100@gmail.com>
Date: Thu, 26 Dec 2019 15:11:40 +0100
Subject: [PATCH] Fix PHP erro in LP view

---
 public/main/forum/viewforum.php        |   9 +-
 public/main/inc/lib/UnserializeApi.php |   6 +-
 public/main/lp/lp_controller.php       | 122 +++++++++++++++----------
 public/main/lp/lp_view.php             |   8 +-
 4 files changed, 89 insertions(+), 56 deletions(-)

diff --git a/public/main/forum/viewforum.php b/public/main/forum/viewforum.php
index dceb6179d4..1b9efbe55b 100644
--- a/public/main/forum/viewforum.php
+++ b/public/main/forum/viewforum.php
@@ -95,15 +95,15 @@ if (!empty($groupId)) {
 }
 
 /* Header and Breadcrumbs */
-$my_search = isset($_GET['search']) ? $_GET['search'] : '';
-$my_action = isset($_GET['action']) ? $_GET['action'] : '';
+$my_search = $_GET['search'] ?? '';
+$my_action = $_GET['action'] ?? '';
 
 $logInfo = [
     'tool' => TOOL_FORUM,
     'tool_id' => $my_forum,
     'tool_id_detail' => 0,
     'action' => !empty($my_action) ? $my_action : 'list-threads',
-    'action_details' => isset($_GET['content']) ? $_GET['content'] : '',
+    'action_details' => $_GET['content'] ?? '',
 ];
 Event::registerLog($logInfo);
 
@@ -147,7 +147,8 @@ if (!empty($groupId)) {
 }
 
 if ('learnpath' == $origin) {
-    Display::display_reduced_header();
+    //Display::display_reduced_header();
+    Display::display_no_header();
 } else {
     // The last element of the breadcrumb navigation is already set in interbreadcrumb, so give empty string.
     Display::display_header();
diff --git a/public/main/inc/lib/UnserializeApi.php b/public/main/inc/lib/UnserializeApi.php
index e99ce56c7e..086280f739 100644
--- a/public/main/inc/lib/UnserializeApi.php
+++ b/public/main/inc/lib/UnserializeApi.php
@@ -100,6 +100,10 @@ class UnserializeApi
                         scormResource::class,
                         Link::class,
                         LpItem::class,
+                        \Chamilo\CourseBundle\Entity\CLp::class,
+                        \Chamilo\CoreBundle\Entity\Course::class,
+                        \Chamilo\CoreBundle\Entity\Resource\ResourceNode::class,
+                        \Chamilo\CoreBundle\Entity\Resource\ResourceType::class,
                     ]
                 );
                 break;
@@ -115,7 +119,7 @@ class UnserializeApi
             );
         }
 
-        return Unserialize::unserialize(
+        return @Unserialize::unserialize(
             $serialized,
             ['allowed_classes' => $allowedClasses]
         );
diff --git a/public/main/lp/lp_controller.php b/public/main/lp/lp_controller.php
index 69a6b8b711..ed34191de7 100644
--- a/public/main/lp/lp_controller.php
+++ b/public/main/lp/lp_controller.php
@@ -47,10 +47,8 @@ $(window).on("load", function () {
     setFocus();
 });
 </script>';
-$cidReq = api_get_cidreq();
-
-$ajax_url = api_get_path(WEB_AJAX_PATH).'lp.ajax.php?'.$cidReq;
-$listUrl = api_get_self().'?action=list&'.$cidReq;
+$ajax_url = api_get_path(WEB_AJAX_PATH).'lp.ajax.php?'.api_get_cidreq();
+$listUrl = api_get_self().'?action=list&'.api_get_cidreq();
 $htmlHeadXtra[] = '
 <script>
     /*
@@ -279,6 +277,8 @@ $htmlHeadXtra[] = '
                             "title" : title
                         };
 
+                        console.log(params);
+
                         $.ajax({
                             type: "GET",
                             url: "'.$ajax_url.'",
@@ -309,14 +309,24 @@ if ($refresh == 1) {
     $myrefresh = 1;
 }
 
+if ($debug > 0) {
+    error_log(' $refresh: '.$refresh);
+    error_log(' $myrefresh: '.$myrefresh);
+}
+
 $lp_controller_touched = 1;
 $lp_found = false;
-$oLP = Session::read('oLP');
-if (!empty($oLP)) {
-    /*var_dump(get_class($lpObject));
+$lpObject = Session::read('lpobject');
+if (!empty($lpObject)) {
+    if ($debug) {
+        error_log(' SESSION[lpobject] is defined');
+    }
     /** @var learnpath $oLP */
-    //$oLP = UnserializeApi::unserialize('lp', $lpObject);
+    $oLP = UnserializeApi::unserialize('lp', $lpObject);
     if (isset($oLP) && is_object($oLP)) {
+        if ($debug) {
+            error_log(' oLP is object');
+        }
         if ($myrefresh == 1 ||
             empty($oLP->cc) ||
             $oLP->cc != api_get_course_id() ||
@@ -349,7 +359,7 @@ if ($debug) {
 
 $course_id = api_get_course_int_id();
 
-if (!$lp_found || (!empty($_REQUEST['lp_id']) && $oLP->get_id() != $_REQUEST['lp_id'])) {
+if (!$lp_found || (!empty($_REQUEST['lp_id']) && $_SESSION['oLP']->get_id() != $_REQUEST['lp_id'])) {
     if ($debug > 0) {
         error_log(' oLP is not object, has changed or refresh been asked, getting new');
     }
@@ -367,13 +377,22 @@ if (!$lp_found || (!empty($_REQUEST['lp_id']) && $oLP->get_id() != $_REQUEST['lp
         $lp_table = Database::get_course_table(TABLE_LP_MAIN);
         if (!empty($lp_id)) {
             $sel = "SELECT iid, lp_type FROM $lp_table WHERE c_id = $course_id AND id = $lp_id";
+            if ($debug > 0) {
+                error_log(' querying '.$sel);
+            }
             $res = Database::query($sel);
             if (Database::num_rows($res)) {
                 $row = Database::fetch_array($res);
                 $lpIid = $row['iid'];
                 $type = $row['lp_type'];
+                if ($debug > 0) {
+                    error_log('Found row type '.$type);
+                    error_log('Calling constructor: '.api_get_course_id().' - '.$lp_id.' - '.api_get_user_id());
+                }
                 $logInfo = [
                     'tool' => TOOL_LEARNPATH,
+                    'tool_id' => 0,
+                    'tool_id_detail' => 0,
                     'action' => 'lp_load',
                 ];
                 Event::registerLog($logInfo);
@@ -405,19 +424,30 @@ if (!$lp_found || (!empty($_REQUEST['lp_id']) && $oLP->get_id() != $_REQUEST['lp
                         break;
                 }
             }
+        } else {
+            if ($debug > 0) {
+                error_log(' Request[lp_id] is not numeric');
+            }
+        }
+    } else {
+        if ($debug > 0) {
+            error_log(' Request[lp_id] and refresh_id were empty');
         }
     }
-
     if ($lp_found) {
         Session::write('oLP', $oLP);
     }
 }
 
+if ($debug > 0) {
+    error_log('Passed oLP creation check');
+}
+
 $is_allowed_to_edit = api_is_allowed_to_edit(false, true, false, false);
 
-if (!empty($oLP)) {
+if (isset($_SESSION['oLP'])) {
     // Reinitialises array used by javascript to update items in the TOC.
-    $oLP->update_queue = [];
+    $_SESSION['oLP']->update_queue = [];
 }
 
 $action = !empty($_REQUEST['action']) ? $_REQUEST['action'] : '';
@@ -428,8 +458,8 @@ if ($debug) {
 
 $eventLpId = $lp_id = !empty($_REQUEST['lp_id']) ? (int) $_REQUEST['lp_id'] : 0;
 if (empty($lp_id)) {
-    if (!empty($oLP)) {
-        $eventLpId = $oLP->get_id();
+    if (isset($_SESSION['oLP'])) {
+        $eventLpId = $_SESSION['oLP']->get_id();
     }
 }
 
@@ -542,7 +572,7 @@ switch ($action) {
                 // If a title was submitted:
 
                 // Updating the lp.modified_on
-                $oLP->set_modified_on();
+                $_SESSION['oLP']->set_modified_on();
 
                 if (isset($_SESSION['post_time']) && $_SESSION['post_time'] == $_POST['post_time']) {
                     // Check post_time to ensure ??? (counter-hacking measure?)
@@ -552,7 +582,7 @@ switch ($action) {
                     $directoryParentId = isset($_POST['directory_parent_id']) ? $_POST['directory_parent_id'] : 0;
                     $courseInfo = api_get_course_info();
                     if (empty($directoryParentId)) {
-                        $oLP->generate_lp_folder($courseInfo);
+                        $_SESSION['oLP']->generate_lp_folder($courseInfo);
                     }
 
                     $parent = isset($_POST['parent']) ? $_POST['parent'] : '';
@@ -568,7 +598,7 @@ switch ($action) {
                             $document_id = $_POST['path'];
                         } else {
                             if ($_POST['content_lp']) {
-                                $document_id = $oLP->create_document(
+                                $document_id = $_SESSION['oLP']->create_document(
                                     $_course,
                                     $_POST['content_lp'],
                                     $_POST['title'],
@@ -578,7 +608,7 @@ switch ($action) {
                             }
                         }
 
-                        $oLP->add_item(
+                        $_SESSION['oLP']->add_item(
                             $parent,
                             $previous,
                             $type,
@@ -591,7 +621,7 @@ switch ($action) {
                         if (isset($_POST['path']) && $_GET['edit'] != 'true') {
                             $document_id = $_POST['path'];
                         } else {
-                            $document_id = $oLP->createReadOutText(
+                            $document_id = $_SESSION['oLP']->createReadOutText(
                                 $_course,
                                 $_POST['content_lp'],
                                 $_POST['title'],
@@ -599,7 +629,7 @@ switch ($action) {
                             );
                         }
 
-                        $oLP->add_item(
+                        $_SESSION['oLP']->add_item(
                             $parent,
                             $previous,
                             TOOL_READOUT_TEXT,
@@ -622,7 +652,7 @@ switch ($action) {
                             $maxTimeAllowed
                         );
                     }
-                    $url = api_get_self().'?action=add_item&type=step&lp_id='.$oLP->lp_id.'&'.$cidReq;
+                    $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id).'&'.api_get_cidreq();
                     header('Location: '.$url);
                     exit;
                 }
@@ -654,7 +684,7 @@ switch ($action) {
                 if (isset($_GET['delete_file']) && $_GET['delete_file'] == 1) {
                     $lp_item_obj->remove_audio();
 
-                    $url = api_get_self().'?action=add_audio&lp_id='.intval($_SESSION['oLP']->lp_id).'&id='.$lp_item_obj->get_id().'&'.$cidReq;
+                    $url = api_get_self().'?action=add_audio&lp_id='.intval($_SESSION['oLP']->lp_id).'&id='.$lp_item_obj->get_id().'&'.api_get_cidreq();
                     header('Location: '.$url);
                     exit;
                 }
@@ -774,7 +804,7 @@ switch ($action) {
                     $accumulateScormTime = isset($_REQUEST['accumulate_scorm_time']) ? $_REQUEST['accumulate_scorm_time'] : 'true';
                     $_SESSION['oLP']->setAccumulateScormTime($accumulateScormTime);
 
-                    $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($new_lp_id).'&'.$cidReq;
+                    $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($new_lp_id).'&'.api_get_cidreq();
                     header("Location: $url&isStudentView=false");
                     exit;
                 }
@@ -817,7 +847,7 @@ switch ($action) {
             require 'lp_list.php';
         } else {
             Session::write('refresh', 1);
-            $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id).'&'.$cidReq;
+            $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id).'&'.api_get_cidreq();
             header('Location: '.$url);
             exit;
         }
@@ -861,7 +891,7 @@ switch ($action) {
                     $_SESSION['oLP']->edit_document($_course);
                 }
                 Display::addFlash(Display::return_message(get_lang('Update successful')));
-                $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id).'&'.$cidReq;
+                $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id).'&'.api_get_cidreq();
                 header('Location: '.$url);
                 exit;
             }
@@ -894,7 +924,7 @@ switch ($action) {
                 );
 
                 Display::addFlash(Display::return_message(get_lang('Update successful')));
-                $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id).'&'.$cidReq;
+                $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id).'&'.api_get_cidreq();
                 header('Location: '.$url);
                 exit;
             } else {
@@ -921,7 +951,7 @@ switch ($action) {
                     $post_title,
                     $_POST['description']
                 );
-                $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id).'&'.$cidReq;
+                $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id).'&'.api_get_cidreq();
                 header('Location: '.$url);
                 exit;
             }
@@ -1241,7 +1271,7 @@ switch ($action) {
                 }
             }
             Display::addFlash(Display::return_message(get_lang('Update successful')));
-            $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id).'&'.$cidReq;
+            $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id).'&'.api_get_cidreq();
             header('Location: '.$url);
             exit;
         }
@@ -1275,7 +1305,7 @@ switch ($action) {
             if (!empty($_REQUEST['id'])) {
                 $_SESSION['oLP']->delete_item($_REQUEST['id']);
             }
-            $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_REQUEST['lp_id']).'&'.$cidReq;
+            $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_REQUEST['lp_id']).'&'.api_get_cidreq();
             header('Location: '.$url);
             exit;
         }
@@ -1435,7 +1465,7 @@ switch ($action) {
             $redirectTo = isset($_GET['redirectTo']) ? $_GET['redirectTo'] : '';
             switch ($redirectTo) {
                 case 'lp_list':
-                    $url = 'lp_controller.php?'.$cidReq;
+                    $url = 'lp_controller.php?'.api_get_cidreq();
                     break;
                 case 'my_courses':
                     $url = api_get_path(WEB_PATH).'user_portal.php';
@@ -1466,14 +1496,14 @@ switch ($action) {
         break;
     case 'set_previous_step_as_prerequisite':
         $_SESSION['oLP']->set_previous_step_as_prerequisite_for_all_items();
-        $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id)."&".$cidReq;
+        $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id)."&".api_get_cidreq();
         Display::addFlash(Display::return_message(get_lang('ItemUpdate successful')));
         header('Location: '.$url);
         exit;
         break;
     case 'clear_prerequisites':
         $_SESSION['oLP']->clear_prerequisites();
-        $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id)."&".$cidReq;
+        $url = api_get_self().'?action=add_item&type=step&lp_id='.intval($_SESSION['oLP']->lp_id)."&".api_get_cidreq();
         Display::addFlash(Display::return_message(get_lang('ItemUpdate successful')));
         header('Location: '.$url);
         exit;
@@ -1552,10 +1582,10 @@ switch ($action) {
         }
 
         header('Location:'.api_get_self().'?'.http_build_query([
-            'action' => 'add_item',
-            'type' => 'step',
-            'lp_id' => $_SESSION['oLP']->lp_id,
-        ]));
+                'action' => 'add_item',
+                'type' => 'step',
+                'lp_id' => $_SESSION['oLP']->lp_id,
+            ]));
         exit;
 
         break;
@@ -1582,7 +1612,7 @@ switch ($action) {
             );
 
             if (!empty($forumThread)) {
-                $dissociated = $selectedItem->dissociateForumThread($forumThread->getIid());
+                $dissociated = $selectedItem->dissociateForumThread($forumThread['iid']);
 
                 if ($dissociated) {
                     Display::addFlash(
@@ -1593,10 +1623,10 @@ switch ($action) {
         }
 
         header('Location:'.api_get_self().'?'.http_build_query([
-            'action' => 'add_item',
-            'type' => 'step',
-            'lp_id' => $_SESSION['oLP']->lp_id,
-        ]));
+                'action' => 'add_item',
+                'type' => 'step',
+                'lp_id' => $_SESSION['oLP']->lp_id,
+            ]));
         exit;
         break;
     case 'add_final_item':
@@ -1613,11 +1643,11 @@ switch ($action) {
         }
 
         $_SESSION['oLP']->getFinalItemForm();
-        $redirectTo = api_get_self().'?'.$cidReq.'&'.http_build_query([
-            'action' => 'add_item',
-            'type' => 'step',
-            'lp_id' => intval($_SESSION['oLP']->lp_id),
-        ]);
+        $redirectTo = api_get_self().'?'.api_get_cidreq().'&'.http_build_query([
+                'action' => 'add_item',
+                'type' => 'step',
+                'lp_id' => intval($_SESSION['oLP']->lp_id),
+            ]);
         break;
     default:
         require 'lp_list.php';
diff --git a/public/main/lp/lp_view.php b/public/main/lp/lp_view.php
index cdcf36ab7d..b798a9a84b 100644
--- a/public/main/lp/lp_view.php
+++ b/public/main/lp/lp_view.php
@@ -17,11 +17,6 @@ use ChamiloSession as Session;
  */
 $use_anonymous = true;
 
-if ($lp_controller_touched != 1) {
-    header('Location: lp_controller.php?action=view&item_id='.intval($_REQUEST['item_id']));
-    exit;
-}
-
 require_once __DIR__.'/../inc/global.inc.php';
 
 api_protect_course_script();
@@ -32,6 +27,9 @@ if (isset($_REQUEST['origin']) && $_REQUEST['origin'] === 'learnpath') {
 
 // To prevent the template class
 $lp_id = !empty($_GET['lp_id']) ? (int) $_GET['lp_id'] : 0;
+if (empty($lp_id)) {
+    api_not_allowed();
+}
 $sessionId = api_get_session_id();
 $course_code = api_get_course_id();
 $course_id = api_get_course_int_id();