Cyberbyte-Studios /
CyberWorks
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | include("views/templates/head.php"); |
||
| 3 | |||
| 4 | if (isset($_GET['setup'])) { |
||
| 5 | if ($_GET['setup'] == 1) { |
||
| 6 | $message = 'The database has now been setup'; |
||
| 7 | } elseif ($_GET['setup'] == 2) { |
||
| 8 | $message = 'The database has now been upgraded'; |
||
| 9 | } else { |
||
| 10 | $message = $_GET['setup']; |
||
| 11 | } |
||
| 12 | } |
||
| 13 | |||
| 14 | if (isset($_POST['emailed']) && $settings['passreset']) { |
||
| 15 | if (formtoken::validateToken($_POST)) { |
||
| 16 | $to = $_POST['emailed']; |
||
| 17 | $token = tokenGen(32); |
||
| 18 | $sql = "SELECT `user_id` FROM `users` WHERE `user_email` = '" . $to . "';"; |
||
| 19 | $result = $db_connection->query($sql); |
||
| 20 | if ($result->num_rows > 0) { |
||
| 21 | $row = $result->fetch_assoc(); |
||
| 22 | $sql = "UPDATE `users` SET `token` = '" . $token . "' WHERE `user_id` = '" . $row['user_id'] . "';"; |
||
| 23 | $result_of_query = $db_connection->query($sql); |
||
| 24 | |||
| 25 | //Send the reset Email |
||
| 26 | $subject = "Password Reset"; |
||
| 27 | $headers = "MIME-Version: 1.0" . "\r\n"; |
||
| 28 | $headers .= "Content-type:text/html;charset=iso-8859-1" . "\r\n"; |
||
| 29 | //$headers .= "From: Password Reset <[email protected]>\r\n"; |
||
|
0 ignored issues
–
show
|
|||
| 30 | $headers .= "From: " . $settings['community'] . " Panel <" . $email . ">\r\n" . "Reply-To: " . $email . "\r\n"; |
||
| 31 | $msg = "Password reset<br/> token: " . $token . " <br/> url: <a href='" . $settings['url'] . "?token=" . $token . "&uID=" . $row['user_id'] . "'>" . $settings['url'] . "?token=" . $token . "&uID=" . $row['user_id'] . "</a>"; |
||
| 32 | $mail = mail($to, $subject, $msg, $headers); |
||
| 33 | |||
| 34 | $message = "Your password has been reset please check your email"; |
||
| 35 | //$message = $settings['url']."?token=".$token."&uID=".$row['user_id']; // DEBUG ONLY |
||
|
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
62% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
|
|||
| 36 | } |
||
| 37 | } |
||
| 38 | } |
||
| 39 | |||
| 40 | if (isset($_GET['token']) && isset($_GET['uID']) && $settings['passreset']) { |
||
| 41 | if (isset($_POST['user_password_new']) && isset($_POST['user_password_repeat'])) { |
||
| 42 | if ($_POST['user_password_new'] !== $_POST['user_password_repeat']) { |
||
| 43 | $error = 'Password and password repeat are not the same'; |
||
| 44 | } else { |
||
| 45 | $sql = "SELECT `user_id` FROM `users` WHERE `user_id` = '" . $_GET['uID'] . "' AND `token` = '" . $_GET['token'] . "';"; |
||
| 46 | $result_of_query = $db_connection->query($sql); |
||
| 47 | if ($result_of_query->num_rows == 1) { |
||
| 48 | $user_password_hash = password_hash($_POST['user_password_new'], PASSWORD_DEFAULT); |
||
| 49 | $sql = "UPDATE `users` SET `user_password_hash` = '" . $user_password_hash . "', `token` = '' WHERE `user_id` = '" . $_GET['uID'] . "' AND `token` = '" . $_GET['token'] . "';"; |
||
| 50 | $result_of_query = $db_connection->query($sql); |
||
| 51 | $message = 'Your password been updated'; |
||
| 52 | } else { |
||
| 53 | $error = 'User not found or token invalid'; |
||
| 54 | } |
||
| 55 | } |
||
| 56 | } else { |
||
| 57 | $sql = "SELECT `user_id` FROM `users` WHERE `user_id` = '" . $_GET['uID'] . "' AND `token` = '" . $_GET['token'] . "';"; |
||
| 58 | $result_of_query = $db_connection->query($sql); |
||
| 59 | if ($result_of_query->num_rows == 1) { |
||
| 60 | ?> |
||
| 61 | <script>$(document).ready(function () { $('#memberModal').modal('show'); });</script> |
||
| 62 | |||
| 63 | <div class="modal fade" id="memberModal" tabindex="-1" role="dialog" aria-labelledby="memberModalLabel" aria-hidden="true"> |
||
| 64 | <div class="modal-dialog"> |
||
| 65 | <div class="modal-content"> |
||
| 66 | <div class="modal-header"> |
||
| 67 | <button type="button" class="close" data-dismiss="modal" aria-hidden="true">×</button> |
||
| 68 | <h4 class="modal-title">Password Reset</h4> |
||
| 69 | </div> |
||
| 70 | <form method="post" action="<?php echo $settings['url'] ?>?token=<?php echo $_GET['token']?>&uID=<?php echo $_GET['uID']?>"> |
||
| 71 | <div class="modal-body"> |
||
| 72 | <div class="form-group"> |
||
| 73 | <p>Password:</p> |
||
| 74 | <input id="user_password_new" placeholder="Password" |
||
| 75 | class=" form-control login_input" type="password" |
||
| 76 | name="user_password_new" required autocorrect="off" autocapitalize="off" autocomplete="off"> |
||
| 77 | </div> |
||
| 78 | <div class="form-group"> |
||
| 79 | <p>Repeat Password:</p> |
||
| 80 | <input id="user_password_repeat" placeholder="Repeat Password" class=" form-control login_input" type="password" name="user_password_repeat" required autocorrect="off" autocapitalize="off" autocomplete="off"> |
||
| 81 | </div> |
||
| 82 | </div> |
||
| 83 | <div class="modal-footer centered"> |
||
| 84 | <button data-dismiss="modal" class="btn btn-theme04" type="button">Cancel</button> |
||
| 85 | <button class="btn btn-theme03" href="index" type="submit" name="pass">Reset Password</button> |
||
| 86 | </div> |
||
| 87 | </form> |
||
| 88 | </div> |
||
| 89 | </div> |
||
| 90 | </div> |
||
| 91 | <?php |
||
| 92 | } else { |
||
| 93 | $error = 'User not found or token invalid'; |
||
| 94 | logAction($_POST['email'], ' ' . $lang['passreset'], 3); |
||
| 95 | } |
||
| 96 | } |
||
| 97 | } |
||
| 98 | |||
| 99 | ?> |
||
| 100 | |||
| 101 | <body onload="getTime()"> |
||
| 102 | |||
| 103 | <div class="container"> |
||
| 104 | <div class="col-lg-4 col-lg-offset-4"> |
||
| 105 | <div class="lock-screen"> |
||
| 106 | <?php |
||
| 107 | if ($login->messages) { |
||
| 108 | foreach ($login->messages as $message) { |
||
| 109 | echo '<div style="margin-top: 120px;" class="alert alert-info animated infinite bounce" role="alert">' . $message . '</div>'; |
||
| 110 | } |
||
| 111 | } elseif ($login->errors) { |
||
| 112 | foreach ($login->errors as $error) { |
||
| 113 | echo '<div style="margin-top: 120px;" class="alert alert-danger animated infinite bounce" role="alert">' . $error . '</div>'; |
||
| 114 | } |
||
| 115 | } elseif (isset($message)) { |
||
| 116 | echo '<div style="margin-top: 120px;" class="alert alert-info animated infinite bounce" role="alert">' . $message . '</div>'; |
||
| 117 | } elseif (isset($error)) { |
||
| 118 | echo '<div style="margin-top: 120px;" class="alert alert-danger animated infinite bounce" role="alert">' . $error . '</div>'; |
||
| 119 | } else { |
||
| 120 | echo '<div style="margin-top: 190px;"></div>'; |
||
| 121 | } ?> |
||
| 122 | |||
| 123 | <div id="showtime"></div> |
||
| 124 | <h2><a data-toggle="modal" href="#login"><i class="fa fa-lock"></i></a></h2> |
||
| 125 | |||
| 126 | <h3>LOGIN</h3> |
||
| 127 | <?php if (isset($settings['steamAPI']) && $settings['steamlogin'] == 'true' && isset($settings['steamdomain'])) { |
||
| 128 | include 'classes/steamlogin.php'; |
||
| 129 | } |
||
| 130 | if ($settings['passreset']) { |
||
| 131 | echo '<a data-toggle="modal" href="#pass"> <span>Password Reset</span></a>'; |
||
| 132 | } ?> |
||
| 133 | <div aria-hidden="true" aria-labelledby="login" role="dialog" tabindex="-1" id="login" class="modal fade"> |
||
| 134 | <div class="modal-dialog"> |
||
| 135 | <div class="modal-content"> |
||
| 136 | <div class="modal-header"> |
||
| 137 | <button type="button" class="close" data-dismiss="modal" aria-hidden="true">×</button> |
||
| 138 | <h4 class="modal-title">LOGIN</h4> |
||
| 139 | </div> |
||
| 140 | <form method="post" action="<?php echo $settings['url'] ?>index"> |
||
| 141 | <div class="modal-body"> |
||
| 142 | <p class="centered"><img class="img-circle" width="80"src="<?php echo $settings['url'] ?>assets/img/profile/2.jpg"> |
||
| 143 | </p> |
||
| 144 | |||
| 145 | <div class="login-wrap"> |
||
| 146 | <input type="text" id="login_input_username" class="form-control" |
||
| 147 | placeholder="Username" name="user_name" required autofocus> |
||
| 148 | <br> |
||
| 149 | <input type="password" id="login_input_password" class="form-control" |
||
| 150 | placeholder="Password" name="user_password" autocorrect="off" |
||
| 151 | autocapitalize="off" required> |
||
| 152 | <br> |
||
| 153 | <?php if ($settings['allowLang'] == 'true') { |
||
| 154 | if (isset($_COOKIE['lang'])) { |
||
| 155 | $tempLang = $_COOKIE['lang']; |
||
| 156 | } elseif (isset($_SESSION['lang'])) { |
||
| 157 | $tempLang = $_SESSION['lang']; |
||
| 158 | } else { |
||
| 159 | $tempLang = 'en'; |
||
| 160 | } |
||
| 161 | echo '<select id = "lang" name = "lang" class="form-control login_input" >'; |
||
| 162 | |||
| 163 | View Code Duplication | foreach ($settings['installedLanguage'] as $language) { |
|
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
|
|||
| 164 | echo '<option value = "' . $language[1] . '" '; |
||
| 165 | if ($tempLang == $language[1]) { |
||
| 166 | echo 'selected'; |
||
| 167 | } |
||
| 168 | echo '> ' . $language[0] . '</option>'; |
||
| 169 | } |
||
| 170 | echo '</select><br>'; |
||
| 171 | } |
||
| 172 | ?> |
||
| 173 | </div> |
||
| 174 | </div> |
||
| 175 | <div class="modal-footer centered"> |
||
| 176 | <button data-dismiss="modal" class="btn btn-theme04" |
||
| 177 | type="button">Cancel</button> |
||
| 178 | <button class="btn btn-theme03" href="index" type="submit" |
||
| 179 | name="login">Login</button> |
||
| 180 | </div> |
||
| 181 | </form> |
||
| 182 | </div> |
||
| 183 | </div> |
||
| 184 | </div> |
||
| 185 | |||
| 186 | <div aria-hidden="true" aria-labelledby="pass" role="dialog" tabindex="-1" id="pass" class="modal fade"> |
||
| 187 | <div class="modal-dialog"> |
||
| 188 | <div class="modal-content"> |
||
| 189 | <div class="modal-header"> |
||
| 190 | <button type="button" class="close" data-dismiss="modal" aria-hidden="true">×</button> |
||
| 191 | <h4 class="modal-title">Password Reset</h4> |
||
| 192 | </div> |
||
| 193 | <form method="post" action="<?php echo $settings['url'] ?>index"> |
||
| 194 | <?php echo formtoken::getField() ?> |
||
| 195 | <div class="modal-body"> |
||
| 196 | <div class="alert alert-danger" role="alert"><strong>Warning</strong> reset password is insecure and will break your passwords</div> |
||
| 197 | <div class="login-wrap"> |
||
| 198 | <input type="text" id="emailed" class="form-control" placeholder="Email Address" name="emailed" required autofocus> |
||
| 199 | </div> |
||
| 200 | </div> |
||
| 201 | <div class="modal-footer centered"> |
||
| 202 | <button data-dismiss="modal" class="btn btn-theme04" |
||
| 203 | type="button">Cancel</button> |
||
| 204 | <button class="btn btn-theme03" href="index" type="submit" |
||
| 205 | name="pass">Reset Password</button> |
||
| 206 | </div> |
||
| 207 | </form> |
||
| 208 | </div> |
||
| 209 | </div> |
||
| 210 | </div> |
||
| 211 | </div> |
||
| 212 | </div> |
||
| 213 | </div> |
||
| 214 | |||
| 215 | <script type="text/javascript" src="<?php echo $settings['url'] ?>assets/js/main.min.js"></script> |
||
| 216 | <script type="text/javascript" src="<?php echo $settings['url'] ?>assets/js/jquery.backstretch.min.js"></script> |
||
| 217 | <script> |
||
| 218 | $.backstretch([ |
||
| 219 | "<?php echo $settings['url'] ?>assets/img/bg/1.jpg", |
||
| 220 | "<?php echo $settings['url'] ?>assets/img/bg/2.jpg", |
||
| 221 | "<?php echo $settings['url'] ?>assets/img/bg/3.jpg", |
||
| 222 | "<?php echo $settings['url'] ?>assets/img/bg/4.jpg", |
||
| 223 | "<?php echo $settings['url'] ?>assets/img/bg/5.jpg" |
||
| 224 | ], {duration: 10000, fade: 800}); |
||
| 225 | </script> |
||
| 226 | <script> |
||
| 227 | function getTime() { |
||
| 228 | var today = new Date(); |
||
| 229 | var h = today.getHours(); |
||
| 230 | var m = today.getMinutes(); |
||
| 231 | var s = today.getSeconds(); |
||
| 232 | m = checkTime(m); |
||
| 233 | s = checkTime(s); |
||
| 234 | document.getElementById('showtime').innerHTML = h + ":" + m + ":" + s; |
||
| 235 | t = setTimeout(function () { |
||
| 236 | getTime() |
||
| 237 | }, 500); |
||
| 238 | } |
||
| 239 | |||
| 240 | function checkTime(i) { |
||
| 241 | if (i < 10) { |
||
| 242 | i = "0" + i; |
||
| 243 | } |
||
| 244 | return i; |
||
| 245 | } |
||
| 246 | </script> |
||
| 247 | </body> |
||
| 248 | </html> |
||
|
0 ignored issues
–
show
|
|||
| 249 |
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.
The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.
This check looks for comments that seem to be mostly valid code and reports them.