Bugfix: #1736 — legacy reqSpecEdit.php refuses unrenderable doAction with a 302 and no Event Viewer noise

Problem

The legacy Requirement Specification editor lib/requirements/reqSpecEdit.php logged 3 E_WARNING rows and answered a 28-byte Can not process RENDERING!!! body for any doAction that was not a reqSpecCommands method. Worse, internal helper methods of reqSpecCommands were being invoked via method_exists() with the wrong argument count or visibility, producing silent HTTP 500 with 0 bytes and 0 log rows. An array-shaped ?doAction[]=x triggered an uncaught TypeError in the shared input layer, also producing a silent 500.

Root cause

• Dispatch used method_exists($commandMgr,$pFn) as a whitelist (24 method_exists-visible members, only 18 GUI actions). The matched method was called with a fixed 2-argument signature regardless of its arity/visibility.
• inputparameter.class.php:295 calls trim() unconditionally on STRING_N values; a non-scalar $_REQUEST['doAction'] causes trim(array) → TypeError before the controller runs.

Fix

All changes in lib/requirements/reqSpecEdit.php:

• reqSpecEditDropShapedAction() unsets a non-scalar $_REQUEST['doAction'] before R_PARAMS().
• reqSpecEditActionWhitelist() returns the exact 18-case list of renderGui()'s GUI-rendering switch and is consulted with is_string($pFn) && $pFn !== '' && isset(...) (only whitelisted names are invoked).
• reqSpecEditRefuseUnknownAction() logs one tLog(..., 'INFO') row with a fixed literal message (attacker-controlled value is deliberately NOT interpolated) and 302s to gui/templates/requirements/reqSpecMgmt.html with tproject_id carried forward. INFO does not persist below WARNING, so crafted URLs cannot write Error/Warning rows.
• renderGui()'s default: branch null-guards $opObj as defence in depth.

Evidence

Pre-fix (unknown doAction=init)

• HTTP 200, 28 bytes, body Can not process RENDERING!!!
• 3 new events rows (all log_level=2, line 147)

Post-fix (unknown doAction=init)

• HTTP 302 → http://localhost:8082/gui/templates/requirements/reqSpecMgmt.html?tproject_id=<TP>
• 0 new events rows

Pre-fix (internal helper ?doAction=simpleCompare)

• HTTP 500, 0 bytes, 0 new events rows

Post-fix (internal helper ?doAction=simpleCompare)

• HTTP 302, 0 new events rows

Unchanged (real form)

• ?doAction=create&parentID=<id> → HTTP 200, real form renders (15646 bytes)
• ?doAction=edit&req_spec_id=<id> → HTTP 200, real form renders (15981 bytes)

Regression

32/32 cases PASS. The whitelist ⇄ renderGui() switch invariant is enforced (18 == 18), and every doAction targeted at reqSpecEdit.php in-repo is whitelisted. Browser verification confirms the 302 lands on the Requirements Specification Management screen with project context intact, while the create form still renders fully.

Notes

The shared trim(array) defect remains in inputparameter.class.php:295 (#1738). Two pre-existing warnings in reqSpecCommands.class.php (deleteFile() missing $argsObj->uploadOp, bulkReqMon() foreach(null) on empty specs) are #1737. The last two method_exists() dispatches (reqEdit.php:41, planMilestonesEdit.php:30) are #1739. None were fixed here (measured identical pre-fix).