Skip to content
Merged
Show file tree
Hide file tree
Changes from 13 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ if ($var['shareCacheEnabled']!='yes') {
} elseif ($var['shareUser']=='-') {
echo "<p class='notice'>User shares not enabled!</p>";
}
$vars = @parse_ini_file("/var/local/emhttp/var.ini");
$plugin = 'ca.mover.tuning';
$config_file = '/boot/config/plugins/' . $plugin . '/' . $plugin . '.cfg';
$config_default_file = '/usr/local/emhttp/plugins/' . $plugin . '/default.cfg';
Expand All @@ -30,6 +31,7 @@ $sizefDisabled = ($cfg['sizef'] != "yes") ? "disabled" : "";
$sizefSyncDisabled = ($cfg['sizefSync'] != "yes") ? "disabled" : "";
$sparsnessfDisabled = ($cfg['sparsnessf'] != "yes") ? "disabled" : "";
$version = ($cfg['version']);
$moverRunning = file_exists('/var/run/mover.pid');

?>

Expand All @@ -49,15 +51,20 @@ $.fn.toggleAttr = function(attr) {

function updateCron() {
var cron = $("#cronSchedule").val();
var tune_cron = $("#tune_cronSchedule").val();
var cronEnabled = $("#forceCron").val();
var ismoverDisabled = $("#moverDisabled").val();
$.post("/plugins/ca.mover.tuning/updateCron.php",{cronEnabled:cronEnabled,cron:cron,ismoverDisabled:ismoverDisabled});
$.post("/plugins/ca.mover.tuning/updateCron.php",{cronEnabled:cronEnabled,cron:cron,tune_cron:tune_cron,ismoverDisabled:ismoverDisabled});
}

function moveNow() {
$.post("/plugins/ca.mover.tuning/mover.php crond start");
}

function startTuneMover() {
$.post("/plugins/ca.mover.tuning/mover.php", { cmdStartTuneMover: 1 });
}
Comment on lines +65 to +67
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

location.reload() may fire before POST completes.

The startTuneMover() function triggers an async POST but location.reload() is called synchronously in the onclick handler (line 787). This could reload the page before the server processes the request.

Consider using a callback or promise to reload after the POST completes:

 function startTuneMover() {
-$.post("/plugins/ca.mover.tuning/mover.php", { cmdStartTuneMover: 1 });
+$.post("/plugins/ca.mover.tuning/mover.php", { cmdStartTuneMover: 1 }, function() {
+    location.reload();
+});
 }

Then update line 787:

-<input type="button" name="StartTuneMover" value="_(Move now)_" onclick="startTuneMover(); location.reload()" ...>
+<input type="button" name="StartTuneMover" value="_(Move now)_" onclick="startTuneMover()" ...>
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
function startTuneMover() {
$.post("/plugins/ca.mover.tuning/mover.php", { cmdStartTuneMover: 1 });
}
function startTuneMover() {
$.post("/plugins/ca.mover.tuning/mover.php", { cmdStartTuneMover: 1 }, function() {
location.reload();
});
}
🤖 Prompt for AI Agents
In
source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/Mover.tuning.page
around lines 65-67 (and update the onclick at line 787), the startTuneMover()
function issues an async POST but the page is reloaded synchronously in the
onclick handler; change startTuneMover() to wait for the POST to complete and
then reload the page (use the $.post promise callback or $.ajax success/done to
call location.reload()), and remove the immediate synchronous location.reload()
from the onclick so the reload happens only after the POST finishes.


function resetDefaults() {
$.post("/plugins/ca.mover.tuning/reset.php");
}
Expand Down Expand Up @@ -126,6 +133,67 @@ $(function() {
});
</script>

<!-- Condition A: Unraid native Mover schedule enabled -->
<span id="mover_schedule_warning" class="orange-text"
style="display:<?= (!empty($vars['shareMoverSchedule']) && version_compare($vars['version'], '7.2.1', '>=')) ? 'block' : 'none' ?>; font-style:italic;">
<i class="fa fa-warning"></i>
<?= _('Unraid Mover schedule is currently') ?> <b>enabled</b>
(<?= htmlspecialchars($vars['shareMoverSchedule']) ?>). &nbsp;
<?= _('If you want Mover Tuning to fully manage scheduling, disable it in Mover Settings.') ?>
</span>

<!-- Breaking changes notice for Unraid 7.2.1+ -->
<div id="mover_tuning_breaking_notice"
style="display:<?= (version_compare($vars['version'], '7.2.1', '>=')) ? 'block' : 'none' ?>;
position:relative;
background-color: var(--title-header-background-color);
border: 1px solid var(--inverse-border-color);
border-radius:10px;
box-shadow: 0.05em 0.2em 0.6em var(--dynamix-awesomplete-list-shadow-color);
padding:15px 40px 15px 15px;
margin-bottom:10px;
font-style:italic;
font-weight:bold;
color:var(--ui-info);
font-size:1.5rem;
line-height:1.5em;">
<i class="fa fa-info-circle" style="margin-right:5px;"></i>
<?= _('Important: Starting with Unraid 7.2.1, Mover Tuning plugin behavior has changed:') ?>
<br><br>
<?= _('• The plugin is now separated from the built-in Unraid mover.') ?>
<br>
<?= _('• “Move Now” in the main Mover Settings runs the built-in Unraid mover.') ?>
<br>
<?= _('• “Move” on the Main page also runs the built-in Unraid mover.') ?>
<br>
<?= _('• “Move Now” in Mover Tuning → Options runs the plugin age_mover (Mover Tuning).') ?>
<br>
<?= _('• To disable the built-in Unraid mover schedule, set “Mover schedule” in Mover Settings to Disabled.') ?>
<br>
<?= _('• Use the “Mover Tuning Schedule” in the plugin settings to schedule Mover Tuning instead.') ?>
<br>
<?= _('• The built-in Unraid mover can still be triggered using “Force move all files on a schedule” (Cron schedule) in Plugin Settings if needed.') ?>

<!-- Close button -->
<span id="close_mover_notice"
style="position:absolute; top:5px; right:10px; cursor:pointer; font-weight:bold; font-size:1.2rem;"
title="Close">&times;</span>
</div>

<script>
document.getElementById('close_mover_notice').addEventListener('click', function() {
var notice = document.getElementById('mover_tuning_breaking_notice');
notice.style.display = 'none';
localStorage.setItem('mover_notice_closed', 'yes');
});

// Hide automatically if previously closed
if (localStorage.getItem('mover_notice_closed') === 'yes') {
var notice = document.getElementById('mover_tuning_breaking_notice');
notice.style.display = 'none';
}
</script>

<div class="title">
<span class="left"><i class="fa fa-cog title"></i>Mover Tuning - Plugin Settings</span>
<span class="right">Version: <?=$version?></span>
Expand All @@ -147,6 +215,16 @@ _(Disable Mover running on a schedule)_:
:end

<div markdown="1" id="moverTuningSettings">
<?php if (version_compare($vars['version'], '7.2.1', '>=')): ?>
_(Mover Tuning schedule)_:
: <input type='text' id='tune_cronSchedule' name='moverTuneCron' size='1' class='tune_mycron' placeholder='0 */4 * * *' value='<?=htmlspecialchars($cfg['moverTuneCron'])?>'>

<blockquote class="inline_help">
<p>Runs the <strong><code>age_mover</code></strong> schedule from the Mover Tuning plugin using your custom cron entry (includes all plugin filters).</p>
<p> Cron Schedule entry example <strong>0 */4 * * *</strong>.&nbsp; To run at <em>every</em><strong> 4 hours</strong>.&nbsp; <a href="https://crontab.guru/" target="_blank" rel="noopener noreferrer"><i class="fa fa-clock-o"></i> What Is Cron</a></p>
</blockquote>
<?php endif; ?>

_(Test Mode (dry run))_:
: <select name='testmode' size='1' id='testmode' onchange="toggleTestModeWarning(this.value)">
<?=mk_option($cfg['testmode'],"no",_('No'))?>
Expand Down Expand Up @@ -704,6 +782,10 @@ _(Resynchronize all Primary files to Secondary)_:
<input type="submit" name="#apply" value="_(Apply)_" id='Apply'>
<input type="button" id="DONE" value="_(Done)_" onclick="done()">
<input type="button" id="Defaults" value="_(Defaults)_" onclick="resetDefaults(); location.reload()">
<?if ($showMoverButton):?>
<input type="button" name="StartTuneMover" value="_(Move now)_" onclick="startTuneMover(); location.reload()" title="Run Mover Tuning ..."<?if ($moverRunning):?> disabled<?endif;?>>
<?if ($moverRunning):?><span>_(Mover is running)_</span><?endif;?>
<?endif;?>
</span>

</form>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -48,4 +48,5 @@ sparsnessv="1"
filetypesv=""
omoverthresh=""
cron=""
moverTuneCron=""
forceParity="no"
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
#!/usr/bin/php
<?PHP
exec("/usr/local/sbin/mover.old start >> /var/log/syslog &", $output, $retval);
$vars = @parse_ini_file("/var/local/emhttp/var.ini");

Check warning on line 3 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/moveNow.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/moveNow.php#L3

The use of function parse_ini_file() is discouraged
if (version_compare($vars['version'], '7.2.1', '<')) {

Check warning on line 4 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/moveNow.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/moveNow.php#L4

Implicit true comparisons prohibited; use === TRUE instead
exec("/usr/local/sbin/mover.old start >> /var/log/syslog &", $output, $retval);
} else {
exec("/usr/local/sbin/mover start >> /var/log/syslog &", $output, $retval);

Check failure on line 7 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/moveNow.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/moveNow.php#L7

System program execution function exec() detected with dynamic parameter
}
Comment on lines +3 to +8
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Add null check for parse_ini_file failure.

If /var/local/emhttp/var.ini is missing or unreadable, $vars will be false, and accessing $vars['version'] will trigger a PHP warning. While version_compare(null, '7.2.1', '<') happens to return true (falling back to mover.old), this should be explicit.

 $vars = @parse_ini_file("/var/local/emhttp/var.ini");
+if (!$vars || !isset($vars['version'])) {
+    exec("/usr/local/sbin/mover.old start >> /var/log/syslog &", $output, $retval);
+    exit;
+}
 if (version_compare($vars['version'], '7.2.1', '<')) {
     exec("/usr/local/sbin/mover.old start >> /var/log/syslog &", $output, $retval);
 } else {
     exec("/usr/local/sbin/mover start >> /var/log/syslog &", $output, $retval);
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
$vars = @parse_ini_file("/var/local/emhttp/var.ini");
if (version_compare($vars['version'], '7.2.1', '<')) {
exec("/usr/local/sbin/mover.old start >> /var/log/syslog &", $output, $retval);
} else {
exec("/usr/local/sbin/mover start >> /var/log/syslog &", $output, $retval);
}
$vars = @parse_ini_file("/var/local/emhttp/var.ini");
if (!$vars || !isset($vars['version'])) {
exec("/usr/local/sbin/mover.old start >> /var/log/syslog &", $output, $retval);
exit;
}
if (version_compare($vars['version'], '7.2.1', '<')) {
exec("/usr/local/sbin/mover.old start >> /var/log/syslog &", $output, $retval);
} else {
exec("/usr/local/sbin/mover start >> /var/log/syslog &", $output, $retval);
}
🧰 Tools
🪛 GitHub Check: Codacy Static Code Analysis

[warning] 3-3: source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/moveNow.php#L3
The use of function parse_ini_file() is discouraged


[warning] 4-4: source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/moveNow.php#L4
Implicit true comparisons prohibited; use === TRUE instead


[failure] 7-7: source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/moveNow.php#L7
System program execution function exec() detected with dynamic parameter

🤖 Prompt for AI Agents
In source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/moveNow.php
around lines 3 to 8, add an explicit null/false check after parse_ini_file to
handle failure: test that $vars is an array (or not false) and that a 'version'
key exists, then set a safe default (e.g. null or '0.0.0') or log an error; use
that vetted value in version_compare so you don't index into a non-array and so
behavior is explicit (fallback to using mover.old when version is missing or
below 7.2.1). Ensure any error logging or default choice is minimal and keeps
the same exec calls unchanged.

?>
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,13 @@
logger("Option 1 set to 'start' due to version < 7.0.0\n");
}
}
// For Unraid v7.2.1+, use $_POST for pressed move now button in plugin page
else if (version_compare($vars['version'], '7.2.1', '>=')) {

Check warning on line 60 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L60

Implicit true comparisons prohibited; use === TRUE instead
if (isset($_POST['cmdStartTuneMover'])) {

Check warning on line 61 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L61

Direct use of $_POST Superglobal detected.

Check warning on line 61 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L61

Implicit true comparisons prohibited; use === TRUE instead

Check failure on line 61 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L61

Processing form data without nonce verification.
$args[0] = 'start';
$option1 = $args[0];
}
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Consider adding nonce verification for POST handling.

The $_POST['cmdStartTuneMover'] parameter is used without CSRF/nonce verification. While Unraid provides authentication, a logged-in user could be tricked into triggering the mover via a malicious page. If Unraid provides a nonce mechanism (e.g., via the Wrappers include), consider using it.

If nonce verification isn't available in this plugin context, at minimum validate that the request came from the expected source or document why CSRF protection isn't applicable here.

🧰 Tools
🪛 GitHub Check: Codacy Static Code Analysis

[warning] 60-60: source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L60
Implicit true comparisons prohibited; use === TRUE instead


[warning] 61-61: source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L61
Direct use of $_POST Superglobal detected.


[warning] 61-61: source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L61
Implicit true comparisons prohibited; use === TRUE instead


[failure] 61-61: source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L61
Processing form data without nonce verification.


// Combine all arguments into a single string with spaces
$options = implode(' ', $args);
Expand Down Expand Up @@ -90,7 +97,11 @@
if ($cfg['movenow'] == "yes") {
$mover_str = "/usr/local/emhttp/plugins/ca.mover.tuning/age_mover";
} else {
$mover_str = "/usr/local/sbin/mover.old";
if (version_compare($vars['version'], '7.2.1', '<')) {

Check warning on line 100 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L100

Implicit true comparisons prohibited; use === TRUE instead
$mover_str = "/usr/local/sbin/mover.old";
} else {
$mover_str = "/usr/local/sbin/mover";
}
}

if ($options == "stop") {
Expand All @@ -117,13 +128,13 @@
//Default "move now" button has been hit.
$niceLevel = $cfg['moverNice'] ?: "0";
$ioLevel = $cfg['moverIO'] ?: "-c 2 -n 0";
logger("ionice $ioLevel nice -n $niceLevel /usr/local/sbin/mover.old $options");
passthru("ionice $ioLevel nice -n $niceLevel /usr/local/sbin/mover.old $options");
logger("ionice $ioLevel nice -n $niceLevel $mover_str $options");
passthru("ionice $ioLevel nice -n $niceLevel $mover_str $options");

Check failure on line 132 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L132

Executing non-constant commands.

Check failure on line 132 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L132

Executing non-constant commands.

Check failure on line 132 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/mover.php#L132

System program execution function passthru() detected with dynamic parameter
}
}

if ($cron && $cfg['moverDisabled'] == 'yes') {
logger("Mover schedule disabled");
logger("Mover Tuning schedule disabled");
exit();
}

Expand All @@ -132,7 +143,7 @@
exit();
}

logger("Starting Mover ...");
logger("Starting Mover Tuning ...");

startMover();

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,16 @@
require_once("/usr/local/emhttp/plugins/dynamix/include/Wrappers.php");

$cfg = parse_plugin_cfg("ca.mover.tuning");
$vars = @parse_ini_file("/var/local/emhttp/var.ini") ?: [];

Check warning on line 6 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L6

Implicit true comparisons prohibited; use === TRUE instead

// Get config value of forced cron
$cfg_cronEnabled = $cfg['force'];
// Get cron time of forced cron (normalized)
$cfg_cron = trim($cfg['cron'] ?? '');
// Get config value of mover disabled
$cfg_moverDisabled = $cfg['moverDisabled'];
// Get Mover Tuning cron time (normalized)
$cfg_moverTuneCron = trim($cfg['moverTuneCron'] ?? $vars['shareMoverSchedule'] ?? '');

function logger($string)
{
Expand All @@ -20,9 +23,36 @@
}
}

// Unraid Mover cron for unraid v7.2.1+
function make_unraid_cron()
{
global $vars;

if (!empty($vars['shareMoverSchedule'])) {

Check warning on line 31 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L31

Operator ! prohibited; use === FALSE instead
$moverCron = isset($vars['shareMoverSchedule']) ? trim($vars['shareMoverSchedule']) : '';
$cronMoverFile = "# Generated mover schedule:\n" . $moverCron . " /usr/local/sbin/mover start |& logger -t move\n\n";
file_put_contents("/boot/config/plugins/dynamix/mover.cron", $cronMoverFile);
}
}

// Mover Tuning cron for unraid v7.2.1+
function make_tune_cron()
{
global $vars;

$tuneCron = isset($_POST['tune_cron']) ? trim($_POST['tune_cron']) : '';

Check failure on line 43 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L43

$_POST['tune_cron'] not unslashed before sanitization. Use wp_unslash() or similar

Check failure on line 43 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L43

Processing form data without nonce verification.
$cronTuneFile = "# Generated schedule for Mover Tuning move:\n" . $tuneCron . " /usr/local/emhttp/plugins/ca.mover.tuning/age_mover start |& logger -t move\n\n";
file_put_contents("/boot/config/plugins/ca.mover.tuning/mover.tuning.cron", $cronTuneFile);
}

// Cron for forced move (unraid mover)
function make_cron()
{
$cronFile = "# Generated schedule for forced move\n" . trim($_POST['cron']) . " /usr/local/sbin/mover.old start |& logger -t move\n\n";
global $vars;
$version = $vars['version'] ?? '0.0.0';
$mover = version_compare($version, '7.2.1', '<') ? '/usr/local/sbin/mover.old' : '/usr/local/sbin/mover';

Check warning on line 53 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L53

Implicit true comparisons prohibited; use === TRUE instead
$cron = isset($_POST['cron']) ? trim($_POST['cron']) : '';

Check failure on line 54 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L54

$_POST['cron'] not unslashed before sanitization. Use wp_unslash() or similar

Check warning on line 54 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L54

Direct use of $_POST Superglobal detected.

Check warning on line 54 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L54

Implicit true comparisons prohibited; use === TRUE instead

Check failure on line 54 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L54

Processing form data without nonce verification.
$cronFile = "# Generated schedule for forced move:\n{$cron} {$mover} start |& logger -t move\n\n";
file_put_contents("/boot/config/plugins/ca.mover.tuning/mover.cron", $cronFile);
}

Expand All @@ -45,21 +75,54 @@

// Check if value was changed
if ($cfg_moverDisabled != $_POST["ismoverDisabled"]) {
global $vars;
// If mover schedule is disabled
if ($_POST['ismoverDisabled'] == "yes") {
// Check if the file exists
if (file_exists("/boot/config/plugins/dynamix/mover.cron")) {
@unlink("/boot/config/plugins/dynamix/mover.cron");
logger("Mover schedule disabled successfully.");
} else {
logger("Error: Mover cron file does not exist");
}
if (version_compare($vars['version'], '7.2.1', '>=')) {
// Check if the file exists
if (file_exists("/boot/config/plugins/ca.mover.tuning/mover.tuning.cron")) {
@unlink("/boot/config/plugins/ca.mover.tuning/mover.tuning.cron");
logger("Mover Tuning schedule disabled successfully.");
} else {
logger("Error: Mover Tuning cron file does not exist");
}
}
} else {
// If mover schedule is enabled
if (file_exists("/boot/config/plugins/dynamix/mover.cron")) {
if (!file_exists("/boot/config/plugins/dynamix/mover.cron")) {
make_unraid_cron();
logger("Mover schedule enabled successfully.");
} else {
logger("Error: Mover cron file does not exist");
logger("Error: Unable to create mover cron file — schedule not updated.");
}
if (version_compare($vars['version'], '7.2.1', '>=')) {
// Check if the file exists
if (!file_exists("/boot/config/plugins/ca.mover.tuning/mover.tuning.cron")) {
make_tune_cron();
logger("Mover Tuning schedule enabled successfully.");
} else {
logger("Error: Unable to create Mover Tuning cron file — schedule not updated.");
}
}
}
}

// Handle Mover Tuning custom cron schedule
if ($cfg_moverTuneCron != $_POST['tune_cron']) {

Check warning on line 118 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L118

Direct use of $_POST Superglobal detected.

Check failure on line 118 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L118

Processing form data without nonce verification.

if (trim($_POST['tune_cron']) != "") {

Check failure on line 120 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L120

Detected usage of a possibly undefined superglobal array index: $_POST['tune_cron']. Use isset() or empty() to check the index exists before using it

Check warning on line 120 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L120

Direct use of $_POST Superglobal detected.

Check warning on line 120 in source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

source/ca.mover.tuning/usr/local/emhttp/plugins/ca.mover.tuning/updateCron.php#L120

Operator != prohibited; use !== instead
make_tune_cron();
logger("Mover Tuning cron schedule updated successfully.");
} else {
@unlink("/boot/config/plugins/ca.mover.tuning/mover.tuning.cron");
logger("Mover Tuning cron schedule removed.");
}
}

Expand Down