PHP - Php Soap Passing Cooking From Authentication Service To Data Access Service

I have service /usr/lib/systemd/system/socketserver.service defined as follows:

[Unit]
Description=Socket Server
After=syslog.target

[Service]
ExecStart=/usr/bin/php /var/www/socket/server.php
Restart=on-abort
Restart=on-failure
RestartSec=10s

[Install]
WantedBy=multi-user.target

When hitting the following lines:

$cmd="tshark -f 'port 1337' -i eno16780032 -a duration:4 -w /var/www/socket/tmp/test.pcap";
$status = exec($cmd, $output);
syslog(LOG_INFO, 'results: '.json_encode($output).' status: '.($status?'success':'false'));

I get the following:

Jun 04 18:58:56 tapmeister.com php[43111]: Running as user "root" and group "root". This could be dangerous.
Jun 04 18:58:56 tapmeister.com php[43111]: Capturing on 'eno16780032'
Jun 04 18:58:56 tapmeister.com kernel: device eno16780032 entered promiscuous mode
Jun 04 18:59:00 tapmeister.com kernel: device eno16780032 left promiscuous mode
Jun 04 18:59:00 tapmeister.com php[43111]: 0 packets captured
Jun 04 18:59:00 tapmeister.com Server[43111]: results: []  status: false

Sure enough, exec('whoami') confirms I am running as root.  Probably shouldn't be.  How would you recommend configuring?

PS.  the three lines shown regarding tshark are executed via an asynchronous request and are not in the main loop.

I've asked this question before but still haven't really figured out how best to implement it, and have found myself hitting another roadblock.

I have multiple types of charts (i.e. bar, pie, etc), and various endpoints to access them.  I like to keep my routing script uncluttered, and feel the following does so.

$app->get('/chart', function (Request $request, Response $response) {
    //List of chart with optional filtering
    $this->chartService->index($request->getQueryParams());
    return $this->chartResponder->index($response, $index);
});

$app->post('/chart', function (Request $request, Response $response) {
    //Create a new chart of type (i.e. bar, pie, etc) specified by type parameter
    $chart=$this->chartService->create($request->getParsedBody());
    return $this->chartResponder->create($response, $chart);
});

$app->get('/chart/{id:[0-9]+}', function (Request $request, Response $response, $args) {
    //View chart of given ID
    $chart=$this->chartService->detail((int)$args['id']);
    return $this->chartResponder->delete($response, $chart);
});

$app->delete('/chart/{id:[0-9]+}', function (Request $request, Response $response, $args) {
    //Delete chart of given ID
    $this->chartService->delete((int)$args['id']);
    return $this->chartResponder->delete($response, null);
});

$app->post('/chart/{id:[0-9]+}/series', function (Request $request, Response $response, $args) {
    //Add a new series to the collection for chart with given ID
    $chart=$this->chartService->addSeries((int)$args['id'], $request->getParsedBody());
    return $this->chartResponder->update($response, $chart);
});

$app->put('/chart/{id:[0-9]+}/series/{seriesPosition:[0-9]+}', function (Request $request, Response $response, $args) {
    //Modify series of given position in the collection for chart with given ID
    $chart=$this->chartService->updateSeries((int)$args['id'], (int)$args['seriesPosition'], $request->getParsedBody());
    return $this->chartResponder->update($response, $chart);
});

//More endpoints for chart of given ID...

I then created the following service to support the endpoints.  Off topic, but is this a service or a controller?

My index() method is chart type agnostic.  My create() method needs a means to determine what type of chart to create, and does so using the received chart "type" passed in the body to get the applicable repository.  All the other methods receive the chart ID in the URL path and use it to first get the chart entity and then get the applicable repository based on the object.  All seems good!

<?php
namespace NotionCommotion\ChartBuilder\Service;
use NotionCommotion\ChartBuilder\Entity\Chart;

class ChartService
{
    protected $em;
    
    public function __construct(\Doctrine\ORM\EntityManager $em)
    {
        $this->em = $em;
    }

    public function index(array $params=[]):array {
        return $this->em->getRepository(Chart::class)->index($params);
    }

    public function create(array $params):Chart {
        //Get the specific repo based on $params['type].  Not perfect, but good enough
        $discriminatorMap=$this->em->getClassMetadata(Chart::class)->discriminatorMap;
        $repo = $this->em->getRepository($discriminatorMap[$params['type']]);
        //Validate data
        $chart=$repo->create($params);
        $this->em->persist($chart);
        $this->em->flush();
        return $chart;
    }

    public function read(int $id):Chart {
        return $this->em->getRepository(Chart::class)->find($id);
    }

    public function delete(int $id):void {
        $this->em->remove($this->read($id));
        $this->em->flush();
    }

    public function addSeries(int $idPublic, array $id):Chart {
        $chart=$this->read($id);
        //Validate data
        $repo=$this->em->getRepository(get_class($chart));
        $repo->addSeries($chart, $params);
        $this->em->persist($chart);
        $this->em->flush();
        return $chart;
    }

    public function updateSeries(int $id, int $position, array $params):Chart {
        $chart=$this->read($id);
        $series=$chart->getSeries();
        $seriesNode=$series->offsetGet($position);
        //Validate data
        $repo=$this->em->getRepository(get_class($seriesNode));
        $repo->update($seriesNode, $params);
        $this->em->persist($chart);
        $this->em->flush();
        return $chart;
    }
}

Until...  I find myself needing to put non-database related functionality in the repository and violating the single responsibility principle.  I am not a complete purist and might be willing to do so, however, there does not appear to be a clean way to inject dependencies in a Doctrine repository.

One thought I had was to create specialized services maybe as follows:

$c['chartService'] = function ($c) {
    return new ChartService(
        $c[EntityManager::class],
        [
            'bar'=>function ($c) {return new BarChartService($c[EntityManager::class]);},
            'pie'=>function ($c) {return new PieChartService($c[EntityManager::class], $c['someOtherObject']);},
            //add more types...
        ]
    );
};

class ChartService
{
    protected $em, $subServices=[];
    
    public function __construct(\Doctrine\ORM\EntityManager $em, $subServices)
    {
        $this->em = $em;
        $this->subServices = $subServices;
    }

    public function index(array $params=[]):array {/* no change */}

    public function create(array $params):Chart {/* maybe no change */}

    public function __call($name, $args) {
        $chart=$this->em->getRepository(Chart::class)->find($args[0]);
        $subservice=$this->getSubservice($chart);
        $args[0]=$chart;
        return $subservice->$name(...$args);
    }
}

abstract class AbstractSpecificChartService
{
    protected $em;
    
    public function __construct(\Doctrine\ORM\EntityManager $em)
    {
        $this->em = $em;
    }

    public function __call($name, $args) {
        throw new \Exception("Method $name not supported");
    }

    protected function getSubservice(Chart $chart):self {
        //Haven't figured out but can do so if needed.
    }

    public function delete(Chart $chart):void {
        //Include methods common to all charts here
        $this->em->remove($chart);
        $this->em->flush();
    }

    protected function helperMethods($foo) {
        //If necessary.
    }
}

class BarChartService extends AbstractSpecificChartService
{
    //Override __construct if necessary

    public function updateSeries(Chart $chart, int $position, array $params):Chart {
        //Note that Chart and not $id is passed.
        //implement code as needed
        return $chart;
    }
}

While this will provide some flexibility, I've been stung more than once using inheritance when injection should be used, and am worried it will lead to no good.  But what would I inject?  I previously suggested injecting a BarChart into a Chart and received a response that doing so is nonsensible.

So, after this long story, how should I implement this?  Thank you

My app just found an error in my login.php file on accident. The app is supposed to get credentials from the user then submit them to my server for verification. I accidentally submitted null credentials (empty strings) and the server returned auth=true. I can't figure out why. 

Server code:

<?php
require_once '../../includes/db_connect.inc';
require_once 'user.php';
$header = "Content-Type: application/json";
$_SESSION['error'] = array();
if (!isset($_GET['secureSubmit']) || $_GET['secureSubmit'] != true){
    die(header("Location: ../access_denied.php"));
}
// check requirements
$required = array('username', 'password');
foreach ($required as $requiredField){
  if (!isset($_GET[$requiredField]) || $_GET[$requiredField] == ""){
    $_SESSION['error'][] = $requiredField . " is incomplete or missing.";
    }
}
  if (count($_SESSION['error']) > 0){
    $errors = array();
    for ($i = 0; $i < count($_SESSION['error']); $i++){
      $errors[]=array(
        'num' => $i,
        'desc' => $_SESSION['error'][$i]
      );
  }
  print json_encode($errors);
  exit;
}else{
  $user = new User;
  if ($user->authenticate($_GET['username'], $_GET['password'])){
    print json_encode(array(
      'auth' => true,
      'call' => "login",
      'sid' => session_id(),
      'credits' => $_SESSION['credits']
      )
    );
  }else{
    print json_encode(array('auth' => false,));
  }
}
?>
	

I went to my browser and entered

http://localhost:10509/login.php?secureSubmit=true&username=%22%22&password=%22%22

and recieved

{auth":true,"call":"login","sid":"29e81981a4709407e2fd8a8f734ad9bc","credits":null}

as a response, can anyone find where the invalid positive is coming from? The initial check for empty username or password should be failing before it ever gets to the check.