EVE-KILL /
zKillboard
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /* zKillboard |
||
| 3 | * Copyright (C) 2012-2015 EVE-KILL Team and EVSCO. |
||
| 4 | * |
||
| 5 | * This program is free software: you can redistribute it and/or modify |
||
| 6 | * it under the terms of the GNU Affero General Public License as published by |
||
| 7 | * the Free Software Foundation, either version 3 of the License, or |
||
| 8 | * (at your option) any later version. |
||
| 9 | * |
||
| 10 | * This program is distributed in the hope that it will be useful, |
||
| 11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 13 | * GNU Affero General Public License for more details. |
||
| 14 | * |
||
| 15 | * You should have received a copy of the GNU Affero General Public License |
||
| 16 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
||
| 17 | */ |
||
| 18 | if(php_sapi_name() != "cli") |
||
| 19 | die("This is a cli script!"); |
||
| 20 | |||
| 21 | $base = dirname(__FILE__); |
||
| 22 | |||
| 23 | function exception_error_handler($errno, $errstr, $errfile, $errline ) |
||
| 24 | { |
||
| 25 | if (error_reporting() === 0) { return; } //error has been suppressed with "@" |
||
| 26 | throw new ErrorException($errstr, $errno, 0, $errfile, $errline); |
||
| 27 | } |
||
| 28 | |||
| 29 | // Force all warnings into errors |
||
| 30 | set_error_handler("exception_error_handler"); |
||
| 31 | |||
| 32 | if (file_exists("$base/../config.php")) |
||
| 33 | { |
||
| 34 | out("|r|Your config.php is already setup, if you want to reinstall please delete it.", true); |
||
| 35 | } |
||
| 36 | |||
| 37 | out("We will prompt you with a few questions. If at any time you are unsure and want to back out of the installation hit |g|CTRL+C.|n| |
||
| 38 | |||
| 39 | Questions will always have a default answer specified in []'s. Example: |g|What is 1+1? [2]|n| |
||
| 40 | Hitting enter will let you select the default answer."); |
||
| 41 | |||
| 42 | $settings = array(); |
||
| 43 | |||
| 44 | // Database |
||
| 45 | $settings["dbuser"] = prompt("Database username?", "zkillboard"); |
||
| 46 | $settings["dbpassword"] = prompt("Database password?", "zkillboard"); |
||
| 47 | $settings["dbname"] = prompt("Database name?", "zkillboard"); |
||
| 48 | $settings["dbhost"] = prompt("Database server?", "localhost"); |
||
| 49 | |||
| 50 | // Memcache |
||
| 51 | $settings["memcache"] = ""; |
||
| 52 | $settings["memcacheport"] = ""; |
||
| 53 | |||
| 54 | $memc = prompt("|g|Do you have memcached installed?|n|", "yes"); |
||
| 55 | if($memc == "yes") |
||
| 56 | { |
||
| 57 | $settings["memcache"] = prompt("Memcache server?", "localhost"); |
||
| 58 | $settings["memcacheport"] = prompt("Memcache port?", "11211"); |
||
| 59 | } |
||
| 60 | |||
| 61 | // Redis |
||
| 62 | $settings["redis"] = ""; |
||
| 63 | $settings["redisport"] = ""; |
||
| 64 | |||
| 65 | $redis = prompt("|g|Do you have Redis and Phpredis installed?|n|", "yes"); |
||
| 66 | if($redis == "yes") |
||
| 67 | { |
||
| 68 | $settings["redis"] = prompt("Redis server?", "localhost"); |
||
| 69 | $settings["redisport"] = prompt("Redis port?", "6379"); |
||
| 70 | } |
||
| 71 | |||
| 72 | // Pheal cache |
||
| 73 | out("|g|It is highly recommended you find a good location other than the default for these files.|n|"); |
||
| 74 | $settings["phealcachelocation"] = prompt("Where do you want to store Pheal's cache files?", "/tmp/"); |
||
| 75 | |||
| 76 | // Server addr |
||
| 77 | out("What is the address of your server? |g|e.g. zkillboard.com|n|"); |
||
| 78 | $settings["baseaddr"] = prompt("Domain name?", "zkillboard.com"); |
||
| 79 | |||
| 80 | // Log |
||
| 81 | $settings["logfile"] = prompt("Log file location?", "/var/log/zkb.log"); |
||
| 82 | touch($settings["logfile"]); // Touch the log file so that it'll actually get created. |
||
| 83 | |||
| 84 | // Image server |
||
| 85 | out("Image and API server."); |
||
| 86 | $settings["apiserver"] = prompt("API Server?", "https://api.eveonline.com/"); |
||
| 87 | $settings["imageserver"] = prompt("Image Server?", "https://image.eveonline.com/"); |
||
| 88 | |||
| 89 | // Secret key for cookies |
||
| 90 | out("A secret key is needed for your cookies to be encrypted."); |
||
| 91 | $cookiesecret = prompt("Secret key for cookies?", uniqid(time())); |
||
| 92 | $settings["cookiesecret"] = sha1($cookiesecret); |
||
| 93 | |||
| 94 | // Set admin password |
||
| 95 | require $base.'/../classes/Password.php'; |
||
| 96 | out("Set password for 'admin' user. It's recommend to change this!"); |
||
| 97 | $admpw = prompt("Password", substr(str_shuffle('abcefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890'), 0, 12)); |
||
| 98 | $admpw = Password::genPassword($admpw); |
||
| 99 | |||
| 100 | // Get default config |
||
| 101 | $configFile = file_get_contents("$base/config.new.php"); |
||
| 102 | |||
| 103 | // Create the new config |
||
| 104 | foreach($settings as $key=>$value) |
||
| 105 | $configFile = str_replace("%$key%", $value, $configFile); |
||
| 106 | |||
| 107 | // Save the file and then attempt to load and initialize from that file |
||
| 108 | $configLocation = "$base/../config.php"; |
||
| 109 | if (file_put_contents($configLocation, $configFile) === false) |
||
| 110 | out("|r|Unable to write configuration file at $configLocation", true); |
||
| 111 | |||
| 112 | try |
||
| 113 | { |
||
| 114 | out("|g|Config file written, now attempting to initialize settings"); |
||
| 115 | require_once( "$base/../config.php" ); |
||
| 116 | |||
| 117 | // Check if composer isn't already installed |
||
| 118 | $location = exec("which composer"); |
||
| 119 | if(!$location) // Composer isn't installed |
||
| 120 | { |
||
| 121 | out("Installing composer:\n"); |
||
| 122 | chdir("$base/.."); |
||
| 123 | |||
| 124 | passthru("php -r \"eval('?>'.file_get_contents('https://getcomposer.org/installer'));\""); |
||
| 125 | |||
| 126 | chdir("$base/.."); |
||
| 127 | out("\nInstalling vendor files"); |
||
| 128 | passthru("php composer.phar install --optimize-autoloader"); |
||
| 129 | |||
| 130 | out("\n|g|composer install complete!"); |
||
| 131 | } |
||
| 132 | else // Composer IS installed |
||
| 133 | { |
||
| 134 | out("Using already installed composer:\n"); |
||
| 135 | chdir("$base/.."); |
||
| 136 | out("\nInstalling vendor files."); |
||
| 137 | passthru("composer install --optimize-autoloader"); |
||
| 138 | out("\n|g|Vendor file installation completed."); |
||
| 139 | } |
||
| 140 | chdir("$base/.."); |
||
| 141 | |||
| 142 | require_once("$base/../init.php" ); |
||
| 143 | |||
| 144 | $one = Db::queryField("select 1 one from dual", "one", array(), 1); |
||
| 145 | if ($one != "1") |
||
| 146 | throw new Exception("We were able to connect but the database did not return the expected '1' for: select 1 one from dual;"); |
||
| 147 | |||
| 148 | out("|g|Success! Database initialized."); |
||
| 149 | } |
||
| 150 | catch (Exception $ex) |
||
| 151 | { |
||
| 152 | out("|r|Error! Removing configuration file."); |
||
| 153 | unlink($configLocation); |
||
| 154 | throw $ex; |
||
| 155 | } |
||
| 156 | |||
| 157 | $ln = false; |
||
| 158 | // Move bash_complete_zkillboard to the bash_complete folder |
||
| 159 | try |
||
| 160 | { |
||
| 161 | file_put_contents("/etc/bash_completion.d/zkillboard", file_get_contents("$base/bash_complete_zkillboard")); |
||
| 162 | exec("chmod +x $base/../cli.php"); |
||
| 163 | $ln = true; |
||
| 164 | } |
||
| 165 | catch (Exception $ex) |
||
| 166 | { |
||
| 167 | out("|r|Error! Couldn't move the bash_complete file into /etc/bash_completion.d/, please do this after the installer is done."); |
||
| 168 | } |
||
| 169 | |||
| 170 | // ln the cli into /usr/sbin/zkillboard |
||
| 171 | if($ln == true) |
||
| 172 | { |
||
| 173 | try |
||
| 174 | { |
||
| 175 | passthru("ln -s $base/../cli.php /usr/sbin/zkillboard"); |
||
| 176 | } |
||
| 177 | catch(Exception $e) |
||
| 178 | { |
||
| 179 | out("|r|Error!|n| file most likely already exists. Check after the installer is done, and if it doesn't, run: ln -s $base/../cli.php /usr/sbin/zkillboard"); |
||
| 180 | } |
||
| 181 | } |
||
| 182 | |||
| 183 | // move cron.overrides to main dir |
||
| 184 | // Save the file and then attempt to load and initialize from that file |
||
| 185 | $cronoverridesLoc = "$base/../cron.overrides"; |
||
| 186 | $cronOverrides = file_get_contents("$base/cronoverrides"); |
||
| 187 | if (file_put_contents($cronoverridesLoc, $cronOverrides) === false) |
||
| 188 | out("|r|Unable to write cron.overrides at $cronoverridesLoc", true); |
||
| 189 | |||
| 190 | // Now install the db structure |
||
| 191 | try |
||
| 192 | { |
||
| 193 | $sqlFiles = scandir("$base/sql"); |
||
| 194 | foreach($sqlFiles as $file) |
||
| 195 | { |
||
| 196 | if (Util::endsWith($file, ".sql")) |
||
| 197 | { |
||
| 198 | $table = str_replace(".sql", "", $file); |
||
| 199 | out("Adding table |g|$table|n| ... ", false, false); |
||
| 200 | $sqlFile = "$base/sql/$file"; |
||
| 201 | loadFile($sqlFile); |
||
| 202 | // Ensure the table starts with base parameters and doesn't inherit anything from zkillboard.com |
||
| 203 | if (!Util::startsWith($table, "ccp_")) |
||
| 204 | Db::execute("truncate table $table"); |
||
| 205 | |||
| 206 | out("|g|done"); |
||
| 207 | } |
||
| 208 | } |
||
| 209 | } |
||
| 210 | catch (Exception $ex) |
||
| 211 | { |
||
| 212 | out("|r|Error! Removing configuration file."); |
||
| 213 | unlink($configLocation); |
||
| 214 | throw $ex; |
||
| 215 | } |
||
| 216 | |||
| 217 | out("Updating CCP tables to the latest version"); |
||
| 218 | passthru("php $base/../cli.php updateCCPData"); |
||
| 219 | |||
| 220 | try |
||
| 221 | { |
||
| 222 | out("|g|Installing default admin user..."); |
||
| 223 | // Install the default admin user |
||
| 224 | Db::execute("INSERT INTO zz_users (username, moderator, admin, password) VALUES ('admin', 1, 1, '".$admpw."')"); |
||
| 225 | } |
||
| 226 | catch (Exception $ex) |
||
| 227 | { |
||
| 228 | out("|r|Error! Unable to add default admin user..."); |
||
| 229 | unlink($configLocation); |
||
| 230 | throw $ex; |
||
| 231 | } |
||
| 232 | |||
| 233 | out("|g|Creating cache directories"); |
||
| 234 | @mkdir($baseDir."cache/"); |
||
| 235 | @mkdir($baseDir."cache/sessions/"); |
||
| 236 | @mkdir($baseDir."cache/pheal/"); |
||
| 237 | |||
| 238 | out("|g|Enjoy your new installation of zKillboard, you may browse to it here: http://" . $settings["baseaddr"] . "\n"); |
||
| 239 | exit; |
||
| 240 | |||
| 241 | function loadFile($file) |
||
| 242 | { |
||
| 243 | if (Util::endsWith($file, ".gz")) $handle = gzopen($file, "r"); |
||
| 244 | else $handle = fopen($file, "r"); |
||
| 245 | |||
| 246 | $query = ""; |
||
| 247 | while ($buffer = fgets($handle)) |
||
| 248 | { |
||
| 249 | $query .= $buffer; |
||
| 250 | if (strpos($query, ";") !== false) |
||
| 251 | { |
||
| 252 | $query = str_replace(";", "", $query); |
||
| 253 | Db::execute($query); |
||
| 254 | $query = ""; |
||
| 255 | } |
||
| 256 | } |
||
| 257 | fclose($handle); |
||
| 258 | } |
||
| 259 | |||
| 260 | function out($message, $die = false, $newline = true) |
||
|
0 ignored issues
–
show
|
|||
| 261 | { |
||
| 262 | $colors = array( |
||
| 263 | "|w|" => "1;37", //White |
||
| 264 | "|b|" => "0;34", //Blue |
||
| 265 | "|g|" => "0;32", //Green |
||
| 266 | "|r|" => "0;31", //Red |
||
| 267 | "|n|" => "0" //Neutral |
||
| 268 | ); |
||
| 269 | |||
| 270 | $message = "$message|n|"; |
||
| 271 | foreach($colors as $color => $value) |
||
| 272 | $message = str_replace($color, "\033[".$value."m", $message); |
||
| 273 | |||
| 274 | if($newline) |
||
| 275 | echo $message.PHP_EOL; |
||
| 276 | else |
||
| 277 | echo $message; |
||
| 278 | |||
| 279 | if($die) die(); |
||
| 280 | } |
||
| 281 | |||
| 282 | function prompt($prompt, $default = "") |
||
| 283 | { |
||
| 284 | out("$prompt [$default] ", false, false); |
||
| 285 | $answer = trim(fgets(STDIN)); |
||
| 286 | if (strlen($answer) == 0) |
||
| 287 | return $default; |
||
| 288 | |||
| 289 | return $answer; |
||
| 290 | } |
||
| 291 | |||
| 292 | // Password prompter kindly borrowed from http://stackoverflow.com/questions/187736/command-line-password-prompt-in-php |
||
| 293 | function prompt_silent($prompt = "Enter Password:") |
||
| 294 | { |
||
| 295 | $command = "/usr/bin/env bash -c 'echo OK'"; |
||
| 296 | if (rtrim(shell_exec($command)) !== 'OK') |
||
| 297 | { |
||
| 298 | trigger_error("Can't invoke bash"); |
||
| 299 | return; |
||
| 300 | } |
||
| 301 | $command = "/usr/bin/env bash -c 'read -s -p \"" |
||
| 302 | . addslashes($prompt) |
||
| 303 | . "\" mypassword && echo \$mypassword'"; |
||
| 304 | $password = rtrim(shell_exec($command)); |
||
| 305 | echo "\n"; |
||
| 306 | return $password; |
||
| 307 | } |
||
| 308 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.