Fix deprecations panel empty check, escape variables panel error, reset $data in serialize loop#1072
Merged
Merged
Conversation
…et $data in serialize loop * DeprecationsPanel template: the empty-check sum was missing count($other), and the surrounding condition was inverted -- the "No deprecations" flash showed up exactly when deprecations existed. Include $other and flip to `if (!$hasAny)`. * Variables panel template: $error came through `printf %s` unescaped. The message can carry serializer-exception text that echoes back data from whatever variable failed to serialize, so escape it via h(). * ToolbarService::saveData: $data was declared inside `try`, so when a panel's data() itself threw, the catch block's `gettype($data ?? null)` diagnostic reported the previous iteration's panel data type instead of NULL. Reset $data = null per iteration. Adds integration tests covering each fix (deprecations empty / non-empty / other-only, variables panel error escaping, panel data() throwing).
LordSimal
added a commit
that referenced
this pull request
May 14, 2026
Nits + BC correctness fixes from 5.x audit (followup to #1072)
pmanolak
pushed a commit
to pmanolak/debug_kit
that referenced
this pull request
Jul 10, 2026
Small, fully backwards-compatible corrections collected from the same audit pass that produced PR cakephp#1072: * CredentialsHelper: swap the click handler from `this.innerHTML = this.title` to `this.textContent = this.title` so a credential URL that ever carries HTML-looking bytes cannot render live HTML when revealed. * ToolbarController::clearCache: bail with `NotFoundException` when the posted cache engine name is not configured, instead of returning 200 with `success: false`. The 200/false case was the only way for the endpoint to silently misreport failure. * RequestPanel: collect the GET payload via `$request->getQueryParams()` instead of `$_GET` so the panel reflects the request as middleware sees it. * Templates: escape `$pluginName` in routes_panel, escape the file path in request_panel's "headers already sent" warning, guard `end($timers)` in timer_panel against an empty array, and replace `extract($package)` in packages_panel with explicit destructuring so a future composer.lock schema key cannot clobber template locals. * DebugKitTransport: override the parent `send()` return-type docblock with the actual shape (assoc headers array + text/html parts split) so static analysis stops papering over the LSP gap, and reject construction without a valid `debugKitLog` ArrayObject up front with a clear InvalidArgumentException rather than a downstream TypeError. * ToolbarService::saveData: move `restore_error_handler()` into a `finally` block guarded by an `$handlerInstalled` flag, and narrow the captured error mask to `E_WARNING | E_NOTICE | E_USER_WARNING | E_USER_NOTICE` so non-serialization warnings raised during `serialize()` aren't misreported as panel-serialization failures. * Drop the now-stale DebugKitTransport return-type entry from the PHPStan baseline. Tests added: CredentialsHelper data provider updated for the new onclick; ToolbarControllerTest gains an unknown-engine 404 case; DebugKitTransportTest gains two constructor-rejection cases (missing key, wrong type).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three small correctness fixes surfaced during a 5.x audit:
DeprecationsPanel template -- the empty-check sum was missing
count($other), and the surrounding condition was inverted so the "No deprecations" flash showed up exactly when deprecations existed. Adds$otherto the sum and flips toif (!$hasAny).Variables panel template --
$errorcame throughprintf %sunescaped. That message can carry serializer-exception text echoing back data from whatever variable failed to serialize, so it's now passed throughh(). Ause function Cake\Core\h;was added to match the convention used by sibling templates.ToolbarService::saveData --
$datawas declared inside the per-paneltry. When a panel'sdata()method itself threw (before the innerserialize()), the catch block'sgettype($data ?? null)diagnostic reported the previous panel's data type instead ofNULL. Reset$data = null;per loop iteration.Regression coverage is added in
PanelsControllerTest(empty / non-empty /$other-only deprecations, plus<script>escaping in the variables panel) and inToolbarServiceTest(data()itself throwing, via a newtests/test_app/Panel/ThrowingDataPanel.phpfixture).