Tried claude to make t to run in latest version of PHP.

README.md

@@ -10,6 +10,27 @@ Two accessibility features in the system are text alternatives for all visual el
 
 ## Installation
 
+### System Requirements
+
+- **PHP 8.0+** (tested up to PHP 8.3) with the following extensions:
+  - `mysqli` **(required; the old `mysql` extension was removed in PHP 7)**
+  - `mbstring` **(required for upgrades and multilingual content)**
+  - `zlib`
+  - `gd` (for image processing)
+  - `openssl` (for HTTPS and mail)
+- **MySQL 5.7+** or **MariaDB 10.2+**
+  - MySQL strict mode (`STRICT_TRANS_TABLES`, `NO_ZERO_DATE`) is supported as of this release.
+- A web server such as Apache or Nginx
+
+To install missing PHP extensions on Debian/Ubuntu:
+```bash
+sudo apt-get install php-mbstring php-mysqli php-zlib php-gd php-openssl
+```
+
+> **Note:** This release drops support for PHP 5.x/7.x. If you are upgrading from an older ATutor version, ensure your server is running PHP 8.0 or later.
+
+### Installing ATutor
+
 To install ATutor, point your web browser to the installation directory where ATutor was extracted, and follow the Installer's instructions.
 e.g. http://localhost/ATutor
 
@@ -46,6 +67,13 @@ For additional ATutor documentation, see the ATutor Handbook in ATutor, or at th
 
   - Users:
   https://atutor.github.io/atutor/handbook/users.html
+
+## Compatibility & Known Issues
+
+- **PHP 8.3:** This release includes extensive PHP 8 compatibility fixes for removed functions (`create_function`, `split`, `eregi`, `each`, `set_magic_quotes_runtime`, etc.), strict typing errors, and MySQL strict mode.
+- **MySQL Strict Mode:** Previously caused fatal errors on date columns and null defaults. Resolved by replacing bareword constants, using `NOW()` for timestamps, and guarding `NULL` inserts.
+- **Third-party libraries:** Bundled libraries (nusoap, phpmailer, phpseclib, PEAR XML_HTMLSax) have been patched for PHP 8 survival. Some legacy libraries still emit deprecation warnings but are functional.
+- **Security hardening:** Recent commits fixed reflected XSS, CSRF bypass, open redirect, path traversal, arbitrary file upload, stored XSS, SSRF/LFI, and missing auth checks.
 
 ## Developers
 

admin/error_logging.php

@@ -66,7 +66,7 @@
 			}
 
 			if (is_dir($dir_ . '/' . $file)) {
-				$logdirs{$file} = $file; // store the day log dir
+				$logdirs[$file] = $file; // store the day log dir
 			}
 		}
 		closedir($dir); // clean it up
@@ -99,7 +99,7 @@
 					if (strpos($file, 'profile')	!== false) { // found a profile, store its md5 key identifier
 						$tmp_ = substr($file, strpos($file, '_') + 1);
 						$tmp_ = substr($tmp_, 0, strpos($tmp_, '.log.php'));
-						$log_profiles{$file} = $tmp_;
+						$log_profiles[$file] = $tmp_;
 					}
 
 				}
@@ -142,7 +142,7 @@
 					closedir($dir);
 
 					// store the amount of bugs associated with profile
-					$log_profiles_bug_count{$val}[$val_] = $count;
+					$log_profiles_bug_count[$val][$val_] = $count;
 				}
 				$log_profiles = array();
 			}

admin/error_logging_bundle.php

@@ -38,7 +38,7 @@
 			$date = substr($work, 0, strpos($work, ':'));
 			$id = substr($work, strpos($work, ':') + 1);
 			/* Parse the variable */
-			$profiles{$id} = $date;
+			$profiles[$id] = $date;
 		}
 	}
 
@@ -71,7 +71,7 @@
 
 					// any files mathcing the $elem key correspond to this profile
 					if (strpos($file, $elem)	!== false) { 
-						$store_some{$dir_ . '/'.  $val . '/' . $file} = $file;
+						$store_some[$dir_ . '/'.  $val . '/' . $file] = $file;
 					}
 
 				}
@@ -173,7 +173,7 @@
 			}
 
 			if (is_dir($dir_ . '/' . $file)) {
-				$logdirs{$file} = $file; // store the day log dir
+				$logdirs[$file] = $file; // store the day log dir
 			}
 		}
 		closedir($dir); // clean it up
@@ -206,7 +206,7 @@
 					if (strpos($file, 'profile')	!== false) { // found a profile, store its md5 key identifier
 						$tmp_ = substr($file, strpos($file, '_') + 1);
 						$tmp_ = substr($tmp_, 0, strpos($tmp_, '.log.php'));
-						$log_profiles{$file} = $tmp_;
+						$log_profiles[$file] = $tmp_;
 					}
 
 				}
@@ -249,7 +249,7 @@
 					closedir($dir);
 
 					// store the amount of bugs associated with profile
-					$log_profiles_bug_count{$val}[$val_] = $count;
+					$log_profiles_bug_count[$val][$val_] = $count;
 				}
 				$log_profiles = array();
 			}

admin/error_logging_details.php

@@ -44,7 +44,7 @@
 		}
 
 		if (strpos($file, $key) !== false) { // found a bug associated with our profile key
-			$delete_store{$file} = $file;
+			$delete_store[$file] = $file;
 		} else {
 			$cnt++;
 		}
@@ -115,7 +115,7 @@
 			}
 
 			if (strpos($file, $key) !== false) { // found a bug associated with our profile key
-				$log_profile_bugs{$file} = $file;
+				$log_profile_bugs[$file] = $file;
 			}
 
 		}
@@ -177,7 +177,7 @@
 		}
 
 		if (strpos($file, $key) !== false) { // found a bug associated with our profile key
-			$delete_store{$file} = $file;
+			$delete_store[$file] = $file;
 		}
 
 	}

bounce.php

@@ -162,12 +162,15 @@ function get_groups($course_id) {
 	}
 } elseif (!empty($_REQUEST['p'])) {
 	//For search
-    //p is a relative path, check that.  #4773
-    if (strpos($_REQUEST['p'], 'http') !== false) {
-        //if not relative, reset it.
-        $_REQUEST['p'] = "";
-    }
+	//p is a relative path, check that.  #4773
+	if (preg_match('#^(\/\/|[a-zA-Z][a-zA-Z0-9+.-]*:)#', $_REQUEST['p'])) {
+		//if not relative, reset it.
+		$_REQUEST['p'] = "";
+	}
 	$page = urldecode($_REQUEST['p']);
+	if (preg_match('#^(\/\/|[a-zA-Z][a-zA-Z0-9+.-]*:)#', $page)) {
+		$page = "";
+	}
 } elseif (($_config['pretty_url'] > 0) && preg_match('/bounce.php\?course=([\d]+)$/', $_SERVER['REQUEST_URI'])==1) {
 	//for browse, and my start page url rewrite.	
 	$page = url_rewrite($_SERVER['REQUEST_URI'], AT_PRETTY_URL_NOT_HEADER, true).'/index.php';	//force overwrite
@@ -292,6 +295,8 @@ function get_groups($course_id) {
 $owner_id = $row['member_id'];
 $_SESSION['packaging'] = $row['content_packaging'];
 
+error_log('[ATUTOR-BOUNCE-DIAG] entry course='.$course.' access='.$row['access'].' valid_user='.var_export($_SESSION['valid_user']??null,true).' member_id='.var_export($_SESSION['member_id']??null,true).' owner_id='.$owner_id.' release='.var_export($row['u_release_date'],true).' end='.var_export($row['u_end_date'],true).' pretty_url='.var_export($_config['pretty_url']??null,true));
+
 $_SESSION['groups'] = array();
 unset($_SESSION['fs_owner_type']);
 unset($_SESSION['fs_owner_id']);
@@ -388,6 +393,7 @@ function get_groups($course_id) {
 
 		$_SESSION['groups'] = get_groups($course);
 
+		error_log('[ATUTOR-BOUNCE-DIAG] PUBLIC-final course_id='.var_export($_SESSION['course_id']??null,true).' is_admin='.var_export($_SESSION['is_admin']??null,true).' member_id='.var_export($_SESSION['member_id']??null,true).' dest='.$dest);
 		header('Location: '.$dest, TRUE, 301);
 		exit;
 
@@ -450,6 +456,7 @@ function get_groups($course_id) {
 			header('Location: ./'.$page.'?f='.$addslashes($_GET['f']));
 			exit;
 		} /* else */
+		error_log('[ATUTOR-BOUNCE-DIAG] PROTECTED-final course_id='.var_export($_SESSION['course_id']??null,true).' is_admin='.var_export($_SESSION['is_admin']??null,true).' member_id='.var_export($_SESSION['member_id']??null,true).' dest=./'.$page);
 		header('Location: ./'.$addslashes($page));
 		exit;
 

content.php

@@ -281,9 +281,17 @@
 // Mauro Donadio
 //
 
-$fp	= @file_get_contents($content_row['text']);
+$fp = false;
+// Restrict file_get_contents to valid paths within AT_CONTENT_DIR to prevent SSRF/LFI
+if ($content_row['text'] && file_exists($content_row['text'])) {
+	$real_text_path = realpath($content_row['text']);
+	$content_dir_real = realpath(AT_CONTENT_DIR);
+	if ($real_text_path !== false && $content_dir_real !== false && strpos($real_text_path, $content_dir_real) === 0) {
+		$fp = @file_get_contents($content_row['text']);
+	}
+}
 // just for AContent content
-if(strstr($fp, 'AContentXX')){
+if($fp && strstr($fp, 'AContentXX')){
 
 	//$fp		= str_ireplace('<head>','<MAURO>',$fp);
 	//<base href="http://www.w3schools.com/images/" target="_blank" />