attogram · google-labs-jules · Nov 30, 2025 · Nov 30, 2025 · Nov 30, 2025
diff --git a/include/class/CommonSessionHandler.php b/include/class/CommonSessionHandler.php
@@ -46,6 +46,7 @@ public function open($path, $name)
     #[\ReturnTypeWillChange]
     public function read($id)
     {
+        $out = "";
         $sess_file = $this->path."/sess_$id";
         if(file_exists($sess_file)) $out=@file_get_contents($sess_file);
         return (string) $out;
@@ -63,7 +64,9 @@ static function setup($session_id = null) {
         $handler = new CommonSessionHandler();
         session_set_save_handler($handler, true);
         $sessions_dir = ROOT."/tmp/sessions";
-        @mkdir($sessions_dir);
+        if (!is_dir($sessions_dir)) {
+            @mkdir($sessions_dir, 0755, true);
+        }
         session_save_path($sessions_dir);
         if(!empty($session_id)) {
             session_id($session_id);

diff --git a/include/class/PeerRequest.php b/include/class/PeerRequest.php
@@ -22,7 +22,7 @@ static function processRequest() {
 			$data = json_decode(trim($_POST['data']), true);
 		}
 		global $_config;
-		if ($_POST['coin'] != COIN) {
+		if (!isset($_POST['coin']) || $_POST['coin'] != COIN) {
 			_logf("Invalid coin request=".json_encode($_REQUEST)." server=".json_encode($_SERVER));
 			api_err("Invalid coin ".json_encode($_REQUEST), 3);
 		}
@@ -40,7 +40,7 @@ static function processRequest() {
 		}
 		$ip = Nodeutil::getRemoteAddr();
 
-		if(version_compare($_POST['version'], MIN_VERSION) < 0) {
+		if(!isset($_POST['version']) || version_compare($_POST['version'], MIN_VERSION) < 0) {
 			$peer = Peer::findByIp($ip);
 			if($peer) {
 				Peer::blacklist($peer['id'], "Invalid version ".$_POST['version']);
@@ -49,12 +49,14 @@ static function processRequest() {
 			_logf("Invalid version ".$_POST['version']);
 			api_err("Invalid version ".$_POST['version']);
 		}
-		$requestId = $_POST['requestId'];
-		_log("Peer request from IP = $ip requestId=$requestId q=".$_GET['q']." chainId=".$_POST['chain_id'] ,4);
+		$requestId = $_POST['requestId'] ?? null;
+		$q = $_GET['q'] ?? null;
+		$chain_id = $_POST['chain_id'] ?? null;
+		_log("Peer request from IP = $ip requestId=$requestId q=".$q." chainId=".$chain_id ,4);
 
-		_logp("q=".$_GET['q']);
+		_logp("q=".$q);
 
-		$info = $_POST['info'];
+		$info = $_POST['info'] ?? null;
 
 		$ip = Peer::validateIp($ip);
 		_log("Filtered IP = $ip",4);
@@ -150,7 +152,7 @@ static function peer() {
 		$res = Peer::getSingle($hostname, $ip);
 		if ($res == 1) {
 			_log("$hostname is already in peer db",3);
-			if ($data['repeer'] == 1) {
+			if (isset($data['repeer']) && $data['repeer'] == 1) {
 				$res = peer_post($hostname."/peer.php?q=peer", ["hostname" => $_config['hostname']], 30, $err);
 				if ($res !== false) {
 					api_echo("re-peer-ok");
@@ -169,7 +171,7 @@ static function peer() {
             Peer::updatePeerInfo($ip, $_REQUEST['info']);
         }
 		// re-peer to make sure the peer is valid
-		if ($data['repeer'] == 1) {
+		if (isset($data['repeer']) && $data['repeer'] == 1) {
 			_log("Repeer to $hostname",3);
 			$res = peer_post($hostname . "/peer.php?q=peer", ["hostname" => $_config['hostname']], 30, $err);
 			_log("peer response " . print_r($res,1),4);

diff --git a/web/apps/admin/index.php b/web/apps/admin/index.php
@@ -13,6 +13,7 @@
 
 require_once __DIR__. '/../common/include/top.php';
 
+$msg = [];
 if(isset($_POST['action'])) {
     $action = $_POST['action'];
     if($action == "generate") {
@@ -141,7 +142,7 @@
 }
 
 $setAdminPass = !empty($_config['admin_password']);
-$login = $_SESSION['login'];
+$login = $_SESSION['login'] ?? false;
 
 if(isset($_GET['view'])) {
 	$view = $_GET['view'];

diff --git a/web/apps/admin/tabs/server.php b/web/apps/admin/tabs/server.php
@@ -7,21 +7,21 @@
 global $action, $db;
 
 if($action == "task_enable") {
-	$task = $_GET['task'];
+	$task = $_GET['task'] ?? null;
     $task::enable();
 	header("location: ".APP_URL."/?view=server");
 	exit;
 }
 
 if($action == "task_disable") {
-    $task = $_GET['task'];
+    $task = $_GET['task'] ?? null;
     $task::disable();
 	header("location: ".APP_URL."/?view=server");
 	exit;
 }
 
 if($action == "task_stop") {
-    $task = $_GET['task'];
+    $task = $_GET['task'] ?? null;
     $name = $task::$name;
 	$cmd = "php ".ROOT."/cli/$name.php --stop";
 	$res = shell_exec($cmd);

diff --git a/web/apps/admin/tabs/utils.php b/web/apps/admin/tabs/utils.php
@@ -21,8 +21,9 @@
     exit;
 }
 
+$checkBlocksResponse = false;
 if($action == "check_blocks") {
-    $peer = $_POST['peer'];
+    $peer = $_POST['peer'] ?? null;
     $invalid_block = Nodeutil::checkBlocksWithPeer($peer);
     $checkBlocksResponse = true;
 }
@@ -32,14 +33,16 @@
 }
 
 if($action == 'clear_blocks') {
-    $height = $_POST['height'];
+    $height = $_POST['height'] ?? null;
     Nodeutil::deleteFromHeight($height);
     header("location: ".APP_URL."/?view=utils");
     exit;
 }
 
+$accountsHash = false;
+$blocksHash = false;
 if($action == "blocks-hash") {
-    $height = $_POST['height'];
+    $height = $_POST['height'] ?? null;
     $blocksHash = Nodeutil::calculateBlocksHash($height);
 }
 

diff --git a/web/apps/docs/index.php b/web/apps/docs/index.php
@@ -8,7 +8,13 @@
 class ParsedownExt extends Parsedown {
     function inlineLink($Excerpt)
     {
+        if (!isset($Excerpt['text'])) {
+            return null;
+        }
         $link = parent::inlineLink($Excerpt);
+        if (!isset($link['element']['attributes']['href'])) {
+            return $link;
+        }
         $link['element']['attributes']['href'] = "/apps/docs/index.php?link=".urlencode($link['element']['attributes']['href']);
         return $link;
     }

diff --git a/web/apps/explorer/accounts.php b/web/apps/explorer/accounts.php
@@ -19,7 +19,7 @@
 
 <form class="app-search d-block pt-0" method="get" action="">
     <div class="position-relative">
-        <input type="text" class="form-control" placeholder="Search: Address" name="search" value="<?php echo $_GET['search'] ?>">
+        <input type="text" class="form-control" placeholder="Search: Address" name="search" value="<?php echo $_GET['search'] ?? '' ?>">
         <button class="btn btn-primary" type="submit"><i class="bx bx-search-alt align-middle"></i></button>
     </div>
 </form>

diff --git a/web/apps/explorer/txs.php b/web/apps/explorer/txs.php
@@ -68,17 +68,17 @@ function TransactiongetAll($dm) {
 <form class="row mb-3" method="get" action="">
     <div class="col-lg-2">
         <input type="text" class="form-control flatpickr-input p-1 datepicker" placeholder="Date from" name="search[date][from]"
-               value="<?php echo $dm['search']['date']['from']?>">
+               value="<?php echo $dm['search']['date']['from'] ?? '' ?>">
     </div>
     <div class="col-lg-2">
         <input type="text" class="form-control flatpickr-input p-1 datepicker" placeholder="Date to" name="search[date][to]"
-               value="<?php echo $dm['search']['date']['to']?>">
+               value="<?php echo $dm['search']['date']['to'] ?? '' ?>">
     </div>
     <div class="col-lg-2">
-        <input type="text" class="form-control p-1" placeholder="Source" value="<?php echo $dm['search']['src']?>" name="search[src]">
+        <input type="text" class="form-control p-1" placeholder="Source" value="<?php echo $dm['search']['src'] ?? '' ?>" name="search[src]">
     </div>
     <div class="col-lg-2">
-        <input type="text" class="form-control p-1" placeholder="Destination" value="<?php echo $dm['search']['dst']?>" name="search[dst]">
+        <input type="text" class="form-control p-1" placeholder="Destination" value="<?php echo $dm['search']['dst'] ?? '' ?>" name="search[dst]">
     </div>
     <div class="col-lg-2">
         <select class="form-control"

diff --git a/web/apps/wallet/login.php b/web/apps/wallet/login.php
@@ -2,9 +2,9 @@
 require_once dirname(__DIR__)."/apps.inc.php";
 
 if(isset($_GET['action']) && $_GET['action']=="login-link") {
-	$login_code = $_GET['login_code'];
-	$public_key = $_GET['public_key'];
-	$login_key = $_GET['login_key'];
+	$login_code = $_GET['login_code'] ?? null;
+	$public_key = $_GET['public_key'] ?? null;
+	$login_key = $_GET['login_key'] ?? null;
 
 	if(empty($login_code) || empty($public_key) || empty($login_key)) {
 		$_SESSION['msg']=[['icon'=>'warning', 'text'=>'Invalid data received']];

diff --git a/web/mine.php b/web/mine.php
@@ -26,7 +26,7 @@
 */
 require_once dirname(__DIR__).'/include/init.inc.php';
 set_time_limit(360);
-$q = $_GET['q'];
+$q = $_GET['q'] ?? null;
 
 if(!Nodeutil::miningEnabled()) {
 	api_err("mining-not-enabled");
@@ -60,6 +60,9 @@ function readGeneratorStat() {
             'reject-reasons'=>[]
         ];
     }
+	if (!isset($generator_stat['miners'])) {
+		$generator_stat['miners'] = [];
+	}
 	return $generator_stat;
 }
 
@@ -69,8 +72,8 @@ function saveGeneratorStat($generator_stat) {
 }
 
 function checkVersion() {
-    $version = $_POST['version'];
-    $minerInfo = $_POST['minerInfo'];
+    $version = $_POST['version'] ?? null;
+    $minerInfo = $_POST['minerInfo'] ?? null;
     $version_ok = version_compare($version, MIN_MINER_VERSION)>=0;
     _log("checkVersion q=".$_GET['q']. " version=".$version. " MIN_VERSION=".MIN_MINER_VERSION. " minerInfo=$minerInfo version_ok=$version_ok");
     return $version_ok;
@@ -195,8 +198,8 @@ function checkStats($ip) {
 		api_err("no-live-peers");
 	}
 
-	$address = san($_POST['address']);
-	$height = san($_POST['height']);
+	$address = san($_POST['address'] ?? null);
+	$height = san($_POST['height'] ?? null);
 
 	if(empty($height) || empty($address)) {
 		_logf("rejected: missing-parameters height=$height address=$address", 0);
@@ -213,12 +216,12 @@ function checkStats($ip) {
 
 	_logp(" minerInfo=$minerInfo ");
 
-	$nonce = san($_POST['nonce']);
+	$nonce = san($_POST['nonce'] ?? null);
 	$version = Block::versionCode($height);
-	$address = san($_POST['address']);
-	$elapsed = intval($_POST['elapsed']);
-	$difficulty = san($_POST['difficulty']);
-	$argon = $_POST['argon'];
+	$address = san($_POST['address'] ?? null);
+	$elapsed = intval($_POST['elapsed'] ?? 0);
+	$difficulty = san($_POST['difficulty'] ?? null);
+	$argon = $_POST['argon'] ?? null;
 
 	_logp(" height=$height address=$address elapsed=$elapsed argon=$argon");
 
@@ -347,7 +350,7 @@ function checkStats($ip) {
 			_log("Accepted block from miner $ip address=$address block_height=$height elapsed=$elapsed block_id=" . $block->id);
 			_logf(" ACCEPTED", 0);
 			$generator_stat['accepted']++;
-			$generator_stat['miners'][$address]++;
+			$generator_stat['miners'][$address] = ($generator_stat['miners'][$address] ?? 0) + 1;
 			saveGeneratorStat($generator_stat);
 			api_echo("accepted");
 		} else {

diff --git a/web/peer.php b/web/peer.php
@@ -27,12 +27,12 @@
 require_once dirname(__DIR__).'/include/init.inc.php';
 header('Content-Type: application/json');
 
-$q = $_GET['q'];
+$q = $_GET['q'] ?? null;
 
 $t1=microtime(true);
 
 $info = "";
-$data = json_decode(trim($_POST['data']), true);
+$data = json_decode(trim($_POST['data'] ?? ''), true);
 
 $lock_name = false;
 $lock_filename = false;