From 65e61f8f9def7420121f8e07105f5cbb7bc2416d Mon Sep 17 00:00:00 2001
From: Roland Gruber <post@rolandgruber.de>
Date: Thu, 17 Jul 2025 07:59:28 +0200
Subject: [PATCH] refactoring

---
 lam/lib/config.inc                   |  6 +-
 lam/lib/html.inc                     |  4 +-
 lam/lib/modules.inc                  |  2 +-
 lam/lib/security.inc                 |  6 +-
 lam/templates/changePassword.php     |  5 +-
 lam/templates/config/confmain.php    | 17 ++----
 lam/templates/config/confmodules.php | 60 ++++++++++---------
 lam/templates/config/conftypes.php   | 89 +++++++++++++++-------------
 lam/templates/config/mainmanage.php  | 16 +++--
 phpstan.neon                         |  1 +
 10 files changed, 109 insertions(+), 97 deletions(-)

diff --git a/lam/lib/config.inc b/lam/lib/config.inc
index 48228fba5..575024e5c 100644
--- a/lam/lib/config.inc
+++ b/lam/lib/config.inc
@@ -3517,7 +3517,7 @@ class LAMCfgMain {
 	 * Uploads a new SSL CA cert.
 	 *
 	 * @param String $cert file content in DER/PEM format
-	 * @return mixed TRUE if format is correct, error message if file is not accepted
+	 * @return true|string true if format is correct, error message if file is not accepted
 	 */
 	public function uploadSSLCaCert($cert) {
 		if (!str_contains($cert, '-----BEGIN CERTIFICATE-----')) {
@@ -3680,7 +3680,7 @@ class LAMCfgMain {
 	/**
 	 * Returns the license key as multiple lines.
 	 *
-	 * @return String license
+	 * @return string[] license
 	 */
 	public function getLicenseLines() {
 		return explode(LAMConfig::LINE_SEPARATOR, $this->license);
@@ -3689,7 +3689,7 @@ class LAMCfgMain {
 	/**
 	 * Sets the license key as multiple lines.
 	 *
-	 * @param String[] $licenseLines license lines
+	 * @param string[] $licenseLines license lines
 	 */
 	public function setLicenseLines($licenseLines) {
 		$this->license = implode(LAMConfig::LINE_SEPARATOR, $licenseLines);
diff --git a/lam/lib/html.inc b/lam/lib/html.inc
index 47c7f548b..f0279ecf5 100644
--- a/lam/lib/html.inc
+++ b/lam/lib/html.inc
@@ -3634,8 +3634,8 @@ class htmlSortableList extends htmlElement {
 	/**
 	 * Constructor.
 	 *
-	 * @param string[] $elements list of elements as text (HTML special chars must be escaped already) or htmlElement
-	 * @param string HTML ID
+	 * @param string[]|htmlElement[] $elements list of elements as text (HTML special chars must be escaped already) or htmlElement
+	 * @param string $id HTML ID
 	 */
 	function __construct(array $elements, string $id) {
 		$this->elements = $elements;
diff --git a/lam/lib/modules.inc b/lam/lib/modules.inc
index f5dd4cec8..ba7d17536 100644
--- a/lam/lib/modules.inc
+++ b/lam/lib/modules.inc
@@ -259,7 +259,7 @@ function check_module_depends($selected, $deps) {
  *
  * @param array $selected selected module names
  * @param array $deps module dependencies
- * @return boolean false if no conflict was found,
+ * @return false|array<int, string[]> false if no conflict was found,
  * otherwise an array of array(selected module, conflicting module) if conflicts were found
  */
 function check_module_conflicts($selected, $deps) {
diff --git a/lam/lib/security.inc b/lam/lib/security.inc
index be9e41477..8b8328dbb 100644
--- a/lam/lib/security.inc
+++ b/lam/lib/security.inc
@@ -396,10 +396,10 @@ function checkIfDeleteEntriesIsAllowed($scope) {
 /**
  * Checks if the password fulfills the password policies.
  *
- * @param String $password password
- * @param String|array $userNames user name(s)
+ * @param string $password password
+ * @param string|array|null $userNames user name(s)
  * @param array $otherUserAttrs user's first/last name
- * @return mixed true if ok, string with error message if not valid
+ * @return true|string true if ok, string with error message if not valid
  */
 function checkPasswordStrength($password, $userNames, $otherUserAttrs) {
 	if (($userNames !== null) && !is_array($userNames)) {
diff --git a/lam/templates/changePassword.php b/lam/templates/changePassword.php
index 7817fb61a..06364287d 100644
--- a/lam/templates/changePassword.php
+++ b/lam/templates/changePassword.php
@@ -11,7 +11,7 @@ use htmlStatusMessage;
 /*
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2020 - 2023  Roland Gruber
+  Copyright (C) 2020 - 2025  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -79,13 +79,12 @@ if (isset($_POST['changePassword'])) {
 	}
 	// check password strength
 	$userDn = $_SESSION['ldap']->getUserName();
-	$additionalAttrs = [];
 	$rdnAttr = extractRDNAttribute($userDn);
 	$userName = null;
 	if ($rdnAttr === 'uid') {
 		$userName = extractRDNValue($userDn);
 	}
-	$pwdPolicyResult = checkPasswordStrength($password1, $userName, $additionalAttrs);
+	$pwdPolicyResult = checkPasswordStrength($password1, $userName, []);
 	if ($pwdPolicyResult !== true) {
 		$message = new htmlStatusMessage('ERROR', $pwdPolicyResult);
 		printContent($message);
diff --git a/lam/templates/config/confmain.php b/lam/templates/config/confmain.php
index 08d83eab6..3a8b4b34b 100644
--- a/lam/templates/config/confmain.php
+++ b/lam/templates/config/confmain.php
@@ -3,6 +3,7 @@
 namespace LAM\CONFIG;
 
 use LAM\LIB\TWO_FACTOR\TwoFactorProviderService;
+use LAM\REMOTE\Remote;
 use LAMCfgMain;
 use LAMConfig;
 use htmlTable;
@@ -263,7 +264,7 @@ $loginSelect->setTableRowsToShow([
 $row->add($loginSelect);
 // admin list
 $adminText = implode("\n", explode(";", $conf->get_Adminstring()));
-$adminTextInput = new htmlResponsiveInputTextarea('admins', $adminText, '50', '3', _("List of valid users"), '207');
+$adminTextInput = new htmlResponsiveInputTextarea('admins', $adminText, 50, 3, _("List of valid users"), '207');
 $adminTextInput->setRequired(true);
 $row->add($adminTextInput);
 // search suffix
@@ -360,9 +361,6 @@ foreach ($tools as $tool) {
 	}
 	$hideableTools++;
 	$toolClass = $tool::class;
-	if ($toolClass === false) {
-		continue;
-	}
 	$toolName = substr($toolClass, strrpos($toolClass, '\\') + 1);
 	$selected = false;
 	if (isset($toolSettings['tool_hide_' . $toolName]) && ($toolSettings['tool_hide_' . $toolName] === 'true')) {
@@ -559,7 +557,7 @@ if (extension_loaded('curl')) {
 	$twoFactorUrl = new htmlResponsiveInputField(_("Base URL"), 'twoFactorURL', $conf->getTwoFactorAuthenticationURL(), '515');
 	$twoFactorUrl->setRequired(true);
 	$row->add($twoFactorUrl);
-	$twoFactorUrl = new htmlResponsiveInputTextarea('twoFactorURLs', $conf->getTwoFactorAuthenticationURL(), '80', '4', _("Base URLs"), '515a');
+	$twoFactorUrl = new htmlResponsiveInputTextarea('twoFactorURLs', $conf->getTwoFactorAuthenticationURL(), 80, 4, _("Base URLs"), '515a');
 	$twoFactorUrl->setRequired(true);
 	$row->add($twoFactorUrl);
 	$twoFactorClientId = new htmlResponsiveInputField(_("Client id"), 'twoFactorClientId', $conf->getTwoFactorAuthenticationClientId(), '524');
@@ -572,7 +570,7 @@ if (extension_loaded('curl')) {
 	$row->add($twoFactorLabel);
 	$row->add(new htmlResponsiveInputCheckbox('twoFactorOptional', $conf->getTwoFactorAuthenticationOptional(), _('Optional'), '519'));
 	$row->add(new htmlResponsiveInputCheckbox('twoFactorInsecure', $conf->getTwoFactorAuthenticationInsecure(), _('Disable certificate check'), '516'));
-	$twoFactorCaption = new htmlResponsiveInputTextarea('twoFactorCaption', $conf->getTwoFactorAuthenticationCaption(), '80', '4', _("Caption"));
+	$twoFactorCaption = new htmlResponsiveInputTextarea('twoFactorCaption', $conf->getTwoFactorAuthenticationCaption(), 80, 4, _("Caption"));
 	$twoFactorCaption->setIsRichEdit(true);
 	$row->add($twoFactorCaption);
 	$row->addVerticalSpacer('0.5rem');
@@ -629,7 +627,7 @@ parseHtml(null, $buttonContainer, [], false, 'user');
 /**
  * Checks user input and saves the entered settings.
  *
- * @return array<mixed> list of errors
+ * @return array<int, string[]> list of errors
  */
 function checkInput(): array {
 	$conf = &$_SESSION['conf_config'];
@@ -798,7 +796,7 @@ function checkInput(): array {
 	$conf->setScriptSSHKeyPassword($_POST['scriptkeypassword']);
 	if (!empty($_POST['scriptkey'])) {
 		include_once __DIR__ . '/../../lib/remote.inc';
-		$remote = new \LAM\REMOTE\Remote();
+		$remote = new Remote();
 		try {
 			$remote->loadKey($conf->getScriptSSHKey(), $conf->getScriptSSHKeyPassword());
 		}
@@ -814,9 +812,6 @@ function checkInput(): array {
 	}
 	foreach ($tools as $tool) {
 		$toolClass = $tool::class;
-		if ($toolClass === false) {
-			continue;
-		}
 		$toolName = substr($toolClass, strrpos($toolClass, '\\') + 1);
 		$toolConfigID = 'tool_hide_' . $toolName;
 		$toolSettings[$toolConfigID] = (isset($_POST[$toolConfigID])) && ($_POST[$toolConfigID] == 'on') ? 'true' : 'false';
diff --git a/lam/templates/config/confmodules.php b/lam/templates/config/confmodules.php
index 0de6413f9..cfc54b1b4 100644
--- a/lam/templates/config/confmodules.php
+++ b/lam/templates/config/confmodules.php
@@ -4,23 +4,26 @@ namespace LAM\CONFIG;
 
 use htmlInputField;
 use htmlJavaScript;
-use \htmlTable;
-use \htmlOutputText;
-use \htmlHelpLink;
-use \htmlHiddenInput;
-use \htmlButton;
-use \htmlSpacer;
-use \htmlElement;
-use \htmlImage;
-use \htmlSortableList;
-use \htmlSubTitle;
-use \htmlDiv;
-use \htmlResponsiveRow;
-use \htmlGroup;
+use htmlTable;
+use htmlOutputText;
+use htmlHelpLink;
+use htmlHiddenInput;
+use htmlButton;
+use htmlSpacer;
+use htmlElement;
+use htmlImage;
+use htmlSortableList;
+use htmlSubTitle;
+use htmlDiv;
+use htmlResponsiveRow;
+use htmlGroup;
+use LAM\TYPES\ConfiguredType;
+use LAM\TYPES\TypeManager;
+use LAMConfig;
 
 /*
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2004 - 2024  Roland Gruber
+  Copyright (C) 2004 - 2025  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -78,8 +81,11 @@ if (isset($_POST['cancelSettings'])) {
 }
 
 $conf = &$_SESSION['conf_config'];
+if (!($conf instanceof LAMConfig)) {
+	die();
+}
 
-$errorsToDisplay = checkInput();
+$errorsToDisplay = checkModuleInput($conf);
 
 // check if button was pressed and if we have to save the settings or go to another tab
 if ((isset($_POST['saveSettings']) || isset($_POST['editmodules'])
@@ -129,7 +135,7 @@ echo "<form id=\"inputForm\" action=\"confmodules.php\" method=\"post\" onSubmit
 
 printConfigurationPageTabs(ConfigurationPageTab::MODULES);
 
-$typeManager = new \LAM\TYPES\TypeManager($conf);
+$typeManager = new TypeManager($conf);
 $types = $typeManager->getConfiguredTypes();
 
 $container = new htmlResponsiveRow();
@@ -139,10 +145,10 @@ foreach ($types as $type) {
 
 $legendContainer = new htmlGroup();
 $legendContainer->addElement(new htmlOutputText("* " . _("Base module")));
-$legendContainer->addElement(new \htmlSpacer('2rem', null));
+$legendContainer->addElement(new htmlSpacer('2rem', null));
 $legendContainer->addElement(new htmlHelpLink('237'));
-$container->add($legendContainer, 12);
-$container->add(new htmlHiddenInput('postAvailable', 'yes'), 12);
+$container->add($legendContainer);
+$container->add(new htmlHiddenInput('postAvailable', 'yes'));
 
 parseHtml(null, $container, [], false, 'user');
 
@@ -172,10 +178,10 @@ echo "</html>\n";
 /**
  * Displays the module selection boxes and checks if dependencies are fulfilled.
  *
- * @param \LAM\TYPES\ConfiguredType $type account type
+ * @param ConfiguredType $type account type
  * @param htmlResponsiveRow $container meta HTML container
  */
-function config_showAccountModules($type, &$container): void {
+function config_showAccountModules($type, $container): void {
 	// account modules
 	$available = getAvailableModules($type->getScope(), true);
 	$selected = $type->getModules();
@@ -210,7 +216,7 @@ function config_showAccountModules($type, &$container): void {
 	}
 
 	// add account module selection
-	$container->add(new htmlSubTitle($type->getAlias(), '../../graphics/' . $type->getIcon()), 12);
+	$container->add(new htmlSubTitle($type->getAlias(), '../../graphics/' . $type->getIcon()));
 	if ($selOptions !== []) {
 		$container->add(new htmlOutputText(_("Selected modules")), 12, 6);
 	}
@@ -279,7 +285,7 @@ function config_showAccountModules($type, &$container): void {
 	for ($i = 0; $i < count($selOptions); $i++) {
 		$positions[] = $i;
 	}
-	$container->add(new htmlHiddenInput('positions_' . $type->getId(), implode(',', $positions)), 12);
+	$container->add(new htmlHiddenInput('positions_' . $type->getId(), implode(',', $positions)));
 	// spacer to next account type
 	$container->addVerticalSpacer('2rem');
 }
@@ -287,16 +293,16 @@ function config_showAccountModules($type, &$container): void {
 /**
  * Checks user input and saves the entered settings.
  *
- * @return array<mixed> list of errors
+ * @param LAMConfig $conf config
+ * @return array<int, string[]> list of errors
  */
-function checkInput(): array {
+function checkModuleInput(LAMConfig $conf): array {
 	if (!isset($_POST['postAvailable'])) {
 		return [];
 	}
 	$errors = [];
-	$conf = &$_SESSION['conf_config'];
 	$typeSettings = $conf->get_typeSettings();
-	$typeManager = new \LAM\TYPES\TypeManager($conf);
+	$typeManager = new TypeManager($conf);
 	$accountTypes = $typeManager->getConfiguredTypes();
 	foreach ($accountTypes as $type) {
 		$scope = $type->getScope();
diff --git a/lam/templates/config/conftypes.php b/lam/templates/config/conftypes.php
index 1745232ee..4cd1318d1 100644
--- a/lam/templates/config/conftypes.php
+++ b/lam/templates/config/conftypes.php
@@ -2,22 +2,25 @@
 
 namespace LAM\CONFIG;
 
-use \htmlTable;
-use \htmlSubTitle;
-use \htmlImage;
-use \htmlOutputText;
-use \htmlSpacer;
-use \htmlButton;
-use \htmlGroup;
-use \htmlDiv;
-use \htmlResponsiveInputCheckbox;
-use \LAMConfig;
-use \htmlResponsiveRow;
-use \htmlResponsiveInputField;
+use baseType;
+use htmlTable;
+use htmlSubTitle;
+use htmlImage;
+use htmlOutputText;
+use htmlSpacer;
+use htmlButton;
+use htmlGroup;
+use htmlDiv;
+use htmlResponsiveInputCheckbox;
+use LAM\TYPES\TypeManager;
+use LAMConfig;
+use htmlResponsiveRow;
+use htmlResponsiveInputField;
+use function LAM\TYPES\getTypes;
 
 /*
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2004 - 2023  Roland Gruber
+  Copyright (C) 2004 - 2025  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -74,8 +77,11 @@ if (isset($_POST['cancelSettings'])) {
 }
 
 $conf = &$_SESSION['conf_config'];
+if (!($conf instanceof LAMConfig)) {
+	die();
+}
 
-$errorsToDisplay = checkInput();
+$errorsToDisplay = checkTypeInput($conf);
 
 // check if button was pressed and if we have to save the settings or go to another tab
 if ((isset($_POST['saveSettings']) || isset($_POST['editmodules'])
@@ -120,8 +126,8 @@ if ((isset($_POST['saveSettings']) || isset($_POST['editmodules'])
 }
 
 $typeSettings = $conf->get_typeSettings();
-$allScopes = \LAM\TYPES\getTypes();
-$typeManager = new \LAM\TYPES\TypeManager($conf);
+$allScopes = getTypes();
+$typeManager = new TypeManager($conf);
 $activeTypes = $typeManager->getConfiguredTypes();
 $activeScopes = [];
 foreach ($activeTypes as $activeType) {
@@ -157,7 +163,7 @@ $row = new htmlResponsiveRow();
 
 // show available types
 if ($availableScopes !== []) {
-	$row->add(new htmlSubTitle(_("Available account types")), 12);
+	$row->add(new htmlSubTitle(_("Available account types")));
 	foreach ($availableScopes as $availableScope) {
 		$availableLabelGroup = new htmlGroup();
 		$availableLabelGroup->addElement(new htmlImage('../../graphics/' . $availableScope->getIcon(), '16px', '16px'));
@@ -182,7 +188,7 @@ $container = new htmlResponsiveRow();
 $_SESSION['conftypes_optionTypes'] = [];
 // show active types
 if (count($activeTypes) > 0) {
-	$container->add(new htmlSubTitle(_("Active account types")), 12);
+	$container->add(new htmlSubTitle(_("Active account types")));
 	$index = 0;
 	foreach ($activeTypes as $activeType) {
 		// title
@@ -224,36 +230,31 @@ if (count($activeTypes) > 0) {
 			$suffix = $typeSettings['suffix_' . $activeType->getId()];
 		}
 		$suffixInput = new htmlResponsiveInputField(_("LDAP suffix"), 'suffix_' . $activeType->getId(), $suffix, '202', true);
-		$container->add($suffixInput, 12);
+		$container->add($suffixInput);
 		// list attributes
-		if (isset($typeSettings['attr_' . $activeType->getId()])) {
-			$attributes = $typeSettings['attr_' . $activeType->getId()];
-		}
-		else {
-			$attributes = $activeType->getBaseType()->getDefaultListAttributes();
-		}
+		$attributes = $typeSettings['attr_' . $activeType->getId()] ?? $activeType->getBaseType()->getDefaultListAttributes();
 		$attrsInput = new htmlResponsiveInputField(_("List attributes"), 'attr_' . $activeType->getId(), $attributes, '206');
 		$attrsInput->setFieldMaxLength(1000);
-		$container->add($attrsInput, 12);
+		$container->add($attrsInput);
 		// custom label
 		$customLabel = '';
 		if (isset($typeSettings['customLabel_' . $activeType->getId()])) {
 			$customLabel = $typeSettings['customLabel_' . $activeType->getId()];
 		}
 		$customLabelInput = new htmlResponsiveInputField(_('Custom label'), 'customLabel_' . $activeType->getId(), $customLabel, '264');
-		$container->add($customLabelInput, 12);
+		$container->add($customLabelInput);
 		// LDAP filter
 		$filter = '';
 		if (isset($typeSettings['filter_' . $activeType->getId()])) {
 			$filter = $typeSettings['filter_' . $activeType->getId()];
 		}
 		$filterInput = new htmlResponsiveInputField(_("Additional LDAP filter"), 'filter_' . $activeType->getId(), $filter, '260');
-		$container->add($filterInput, 12);
+		$container->add($filterInput);
 		// type options
 		$typeConfigOptions = $activeType->getBaseType()->get_configOptions();
 		if (!empty($typeConfigOptions)) {
 			foreach ($typeConfigOptions as $typeConfigOption) {
-				$container->add($typeConfigOption, 12);
+				$container->add($typeConfigOption);
 			}
 			// save option types to session
 			ob_start();
@@ -271,29 +272,29 @@ if (count($activeTypes) > 0) {
 			}
 			$readOnly = new htmlResponsiveInputCheckbox('readOnly_' . $activeType->getId(), $isReadOnly, _('Read-only'), '265');
 			$readOnly->setElementsToDisable(['hideNewButton_' . $activeType->getId(), 'hideDeleteButton_' . $activeType->getId()]);
-			$advancedOptions->add($readOnly, 12);
+			$advancedOptions->add($readOnly);
 		}
 		// hidden type
 		$hidden = false;
 		if (isset($typeSettings['hidden_' . $activeType->getId()])) {
 			$hidden = $typeSettings['hidden_' . $activeType->getId()];
 		}
-		$advancedOptions->add(new htmlResponsiveInputCheckbox('hidden_' . $activeType->getId(), $hidden, _('Hidden'), '261'), 12);
+		$advancedOptions->add(new htmlResponsiveInputCheckbox('hidden_' . $activeType->getId(), $hidden, _('Hidden'), '261'));
 		if (isLAMProVersion() && ($conf->getAccessLevel() == LAMConfig::ACCESS_ALL)) {
 			// hide button to create new accounts
 			$hideNewButton = false;
 			if (isset($typeSettings['hideNewButton_' . $activeType->getId()])) {
 				$hideNewButton = $typeSettings['hideNewButton_' . $activeType->getId()];
 			}
-			$advancedOptions->add(new htmlResponsiveInputCheckbox('hideNewButton_' . $activeType->getId(), $hideNewButton, _('No new entries'), '262'), 12);
+			$advancedOptions->add(new htmlResponsiveInputCheckbox('hideNewButton_' . $activeType->getId(), $hideNewButton, _('No new entries'), '262'));
 			// hide button to delete accounts
 			$hideDeleteButton = false;
 			if (isset($typeSettings['hideDeleteButton_' . $activeType->getId()])) {
 				$hideDeleteButton = $typeSettings['hideDeleteButton_' . $activeType->getId()];
 			}
-			$advancedOptions->add(new htmlResponsiveInputCheckbox('hideDeleteButton_' . $activeType->getId(), $hideDeleteButton, _('Disallow delete'), '263'), 12);
+			$advancedOptions->add(new htmlResponsiveInputCheckbox('hideDeleteButton_' . $activeType->getId(), $hideDeleteButton, _('Disallow delete'), '263'));
 		}
-		$container->add($advancedOptions, 12);
+		$container->add($advancedOptions);
 
 		$container->addVerticalSpacer('2rem');
 		$index++;
@@ -330,15 +331,15 @@ echo "</html>\n";
 /**
  * Checks user input and saves the entered settings.
  *
- * @return array<mixed> list of errors
+ * @param LAMConfig $conf config
+ * @return array<int, string[]> list of errors
  */
-function checkInput(): array {
+function checkTypeInput(LAMConfig $conf): array {
 	if (!isset($_POST['postAvailable'])) {
 		return [];
 	}
 	$errors = [];
-	$conf = &$_SESSION['conf_config'];
-	$typeManager = new \LAM\TYPES\TypeManager($conf);
+	$typeManager = new TypeManager($conf);
 	$typeSettings = $conf->get_typeSettings();
 	$accountTypes = $conf->get_ActiveTypes();
 	$postKeys = array_keys($_POST);
@@ -372,6 +373,9 @@ function checkInput(): array {
 		elseif (str_starts_with($key, "suffix_")) {
 			$typeSettings[$key] = trim($_POST[$key]);
 			$type = $typeManager->getConfiguredType(substr($postKeys[$i], 7));
+			if ($type === null) {
+				continue;
+			}
 			if (strlen($_POST[$key]) < 1) {
 				$errors[] = ["ERROR", _("LDAP Suffix is invalid!"), $type->getAlias()];
 			}
@@ -380,6 +384,9 @@ function checkInput(): array {
 		elseif (str_starts_with($key, "attr_")) {
 			$typeSettings[$key] = $_POST[$key];
 			$type = $typeManager->getConfiguredType(substr($postKeys[$i], 5));
+			if ($type === null) {
+				continue;
+			}
 			if (!is_string($_POST[$key]) || !preg_match("/^((#[^:;]+)|([^:;]*:[^:;]+))(;((#[^:;]+)|([^:;]*:[^:;]+)))*$/", $_POST[$key])) {
 				$errors[] = ["ERROR", _("List attributes are invalid!"), $type->getAlias()];
 			}
@@ -449,10 +456,10 @@ function checkInput(): array {
 /**
  * Compares types by alias for sorting.
  *
- * @param \baseType $a first type
- * @param \baseType $b second type
+ * @param baseType $a first type
+ * @param baseType $b second type
  * @return int comparison result
  */
-function compareTypesByAlias(\baseType $a, \baseType $b): int {
+function compareTypesByAlias(baseType $a, baseType $b): int {
 	return strnatcasecmp($a->getAlias(), $b->getAlias());
 }
diff --git a/lam/templates/config/mainmanage.php b/lam/templates/config/mainmanage.php
index da3ccd969..af62c23c6 100644
--- a/lam/templates/config/mainmanage.php
+++ b/lam/templates/config/mainmanage.php
@@ -29,6 +29,7 @@ use htmlResponsiveInputCheckbox;
 use htmlResponsiveInputField;
 use htmlDiv;
 use htmlHiddenInput;
+use LAMConfig;
 use LAMException;
 use LamTemporaryFilesManager;
 use PDO;
@@ -85,6 +86,9 @@ if (!isset($_SESSION['cfgMain'])) {
 	$_SESSION['cfgMain'] = $cfg;
 }
 $cfg = &$_SESSION['cfgMain'];
+if (!($cfg instanceof LAMCfgMain)) {
+    die();
+}
 
 // check if user is logged in
 if (!isset($_SESSION["mainconf_password"]) || (!$cfg->checkPassword($_SESSION["mainconf_password"]))) {
@@ -377,7 +381,7 @@ if (isset($_POST['submitFormData'])) {
 	}
 	foreach (array_keys($_POST) as $key) {
 		if (str_starts_with($key, 'deleteCert_')) {
-			$index = substr($key, strlen('deleteCert_'));
+			$index = (int) substr($key, strlen('deleteCert_'));
 			$cfg->deleteSSLCaCert($index);
 		}
 	}
@@ -509,7 +513,7 @@ if (isset($_POST['submitFormData'])) {
 	// license
 	if (isLAMProVersion()) {
 		$row->add(new htmlSubTitle(_('Licence')));
-		$row->add(new htmlResponsiveInputTextarea('license', implode("\n", $cfg->getLicenseLines()), '30', '10', _('Licence'), '287'));
+		$row->add(new htmlResponsiveInputTextarea('license', implode("\n", $cfg->getLicenseLines()), 30, 10, _('Licence'), '287'));
 		$warningOptions = [
 			_('Screen') => LAMCfgMain::LICENSE_WARNING_SCREEN,
 			_('Email') => LAMCfgMain::LICENSE_WARNING_EMAIL,
@@ -535,7 +539,7 @@ if (isset($_POST['submitFormData'])) {
 		$licenseTo->setRequired(true);
 		$row->add($licenseTo);
 
-		$row->add(new htmlSpacer(null, '1rem'), true);
+		$row->add(new htmlSpacer(null, '1rem'));
 	}
 
 	// security settings
@@ -544,9 +548,9 @@ if (isset($_POST['submitFormData'])) {
 	$row->add(new htmlResponsiveSelect('sessionTimeout', $options, [$cfg->sessionTimeout], _("Session timeout"), '238'));
 	$hideLoginErrorDetails = ($cfg->hideLoginErrorDetails === 'true');
 	$row->add(new htmlResponsiveInputCheckbox('hideLoginErrorDetails', $hideLoginErrorDetails, _('Hide LDAP details on failed login'), '257'));
-	$row->add(new htmlResponsiveInputTextarea('allowedHosts', implode("\n", explode(",", $cfg->allowedHosts)), '30', '7', _("Allowed hosts"), '241'));
+	$row->add(new htmlResponsiveInputTextarea('allowedHosts', implode("\n", explode(",", $cfg->allowedHosts)), 30, 7, _("Allowed hosts"), '241'));
 	if (isLAMProVersion()) {
-		$row->add(new htmlResponsiveInputTextarea('allowedHostsSelfService', implode("\n", explode(",", $cfg->allowedHostsSelfService)), '30', '7', _("Allowed hosts (self service)"), '241'));
+		$row->add(new htmlResponsiveInputTextarea('allowedHostsSelfService', implode("\n", explode(",", $cfg->allowedHostsSelfService)), 30, 7, _("Allowed hosts (self service)"), '241'));
 	}
 	// SSL certificate
 	$row->addVerticalSpacer('1rem');
@@ -578,7 +582,7 @@ if (isset($_POST['submitFormData'])) {
 	$sslUploadBtn->setTitle(_('Upload CA certificate in DER/PEM format.'));
 	$row->addField($sslUploadBtn);
 	if (function_exists('stream_socket_client') && function_exists('stream_context_get_params')) {
-		$sslImportServerUrl = empty($_POST['serverurl']) ? 'ldaps://' : $_POST['serverurl'];
+		$sslImportServerUrl = empty($_POST['serverurl']) ? 'ldaps://' : (string) $_POST['serverurl'];
 		$serverUrlUpload = new htmlInputField('serverurl', $sslImportServerUrl);
 		$row->addLabel($serverUrlUpload);
 		$sslImportBtn = new htmlButton('sslCaCertImport', _('Import from server'));
diff --git a/phpstan.neon b/phpstan.neon
index 005d0a82b..512825629 100644
--- a/phpstan.neon
+++ b/phpstan.neon
@@ -12,6 +12,7 @@ parameters:
 	excludePaths:
 		analyseAndScan:
 			- */3rdParty/*
+			- */lists/changePassword.php
 	ignoreErrors:
 		- '#.* on an unknown class .*#'
 		- '#.* has invalid type .*#'