This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /* zKillboard |
||
3 | * Copyright (C) 2012-2015 EVE-KILL Team and EVSCO. |
||
4 | * |
||
5 | * This program is free software: you can redistribute it and/or modify |
||
6 | * it under the terms of the GNU Affero General Public License as published by |
||
7 | * the Free Software Foundation, either version 3 of the License, or |
||
8 | * (at your option) any later version. |
||
9 | * |
||
10 | * This program is distributed in the hope that it will be useful, |
||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
13 | * GNU Affero General Public License for more details. |
||
14 | * |
||
15 | * You should have received a copy of the GNU Affero General Public License |
||
16 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
||
17 | */ |
||
18 | if(php_sapi_name() != "cli") |
||
19 | die("This is a cli script!"); |
||
20 | |||
21 | $base = dirname(__FILE__); |
||
22 | |||
23 | if(php_sapi_name() != "cli") |
||
24 | die("This is a cli script!"); |
||
25 | |||
26 | if(!extension_loaded('pcntl')) |
||
27 | die("This script needs the pcntl extension!"); |
||
28 | |||
29 | // Update composer and any vendor products |
||
30 | out("\nUpdating composer..."); |
||
31 | chdir("$base/.."); |
||
32 | passthru("php composer.phar self-update"); |
||
33 | out("\nUpdating vendor files..."); |
||
34 | passthru("php composer.phar update --optimize-autoloader"); |
||
35 | |||
36 | require_once( "config.php" ); |
||
37 | chdir("$base"); |
||
38 | |||
39 | // vendor autoload |
||
40 | require( "$base/../vendor/autoload.php" ); |
||
41 | |||
42 | // zkb class autoloader |
||
43 | spl_autoload_register("zkbautoload"); |
||
44 | |||
45 | function zkbautoload($class_name) |
||
0 ignored issues
–
show
|
|||
46 | { |
||
47 | global $base; |
||
48 | $fileName = "$base/../classes/$class_name.php"; |
||
49 | if (file_exists($fileName)) |
||
50 | { |
||
51 | require_once $fileName; |
||
52 | return; |
||
53 | } |
||
54 | } |
||
55 | |||
56 | Db::execute("SET SESSION wait_timeout = 120000000"); |
||
57 | out("\n|g|Starting maintenance mode...|n|"); |
||
58 | Db::execute("replace into zz_storage values ('maintenance', 'true')"); |
||
59 | out("|b|Waiting 60 seconds for all executing scripts to stop...|n|"); |
||
60 | sleep(60); |
||
61 | |||
62 | // Get a list of all tables |
||
63 | $tableResult = Db::query("show tables", array(), 0, false); |
||
64 | $tables = array(); |
||
65 | foreach($tableResult as $row) |
||
66 | { |
||
67 | $table = array_pop($row); |
||
68 | $tables[$table] = true; |
||
69 | } |
||
70 | |||
71 | // Now install the db structure |
||
72 | try { |
||
73 | $sqlFiles = scandir("$base/sql"); |
||
74 | foreach($sqlFiles as $file) |
||
75 | { |
||
76 | if (Util::endsWith($file, ".sql")) |
||
77 | { |
||
78 | $table = str_replace(".sql", "", $file); |
||
79 | out("Updating table |g|$table|n| ... ", false, false); |
||
80 | $sqlFile = "$base/sql/$file"; |
||
81 | loadFile($sqlFile, $table); |
||
0 ignored issues
–
show
The call to
loadFile() has too many arguments starting with $table .
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. In this case you can add the ![]() |
|||
82 | out("|w|done|n|"); |
||
83 | $tables[$table] = false; |
||
84 | } |
||
85 | } |
||
86 | foreach ($tables as $table=>$drop) |
||
87 | { |
||
88 | if ($drop && Util::startsWith($table, "zz_")) |
||
89 | { |
||
90 | out("|r|Dropping table: |g|$table|n|\n", false, false); |
||
91 | Db::execute("drop table $table"); |
||
92 | } |
||
93 | } |
||
94 | } |
||
95 | catch (Exception $ex) |
||
96 | { |
||
97 | out("|r|Error!|n|"); |
||
98 | throw $ex; |
||
99 | } |
||
100 | |||
101 | $count = Db::execute("INSERT IGNORE INTO zz_users (username, moderator, admin, password) VALUES ('admin', 1, 1, '$2y$10\$maxuZ/qozcjIgr7ZSnrWJemywbThbPiJDYIuOk9eLxF0pGE5SkNNu')"); |
||
102 | if ($count > 0) |
||
103 | out("\n\n|r|*** NOTICE ***\nDefault admin user has been added with password 'admin'\nIt is strongly recommended you change this password!\n*** NOTICE ***\n"); |
||
104 | |||
105 | out("|g|Unsetting maintenance mode|n|"); |
||
106 | Db::execute("delete from zz_storage where locker = 'maintenance'"); |
||
107 | out("All done, enjoy your update!"); |
||
108 | |||
109 | function loadFile($file, $table) |
||
110 | { |
||
111 | if (Util::endsWith($file, ".gz")) |
||
112 | $handle = gzopen($file, "r"); |
||
113 | else |
||
114 | $handle = fopen($file, "r"); |
||
115 | |||
116 | //Check to see if we are adding new tables |
||
117 | if(Db::queryRow("SHOW TABLES LIKE'$table'", array(), 0, false)!= null) |
||
118 | { |
||
119 | if (Util::startsWith($table, "ccp_")) |
||
120 | Db::execute("drop table $table"); |
||
121 | else |
||
122 | Db::execute("alter table $table rename old_$table"); |
||
123 | } |
||
124 | |||
125 | |||
126 | $query = ""; |
||
127 | while ($buffer = fgets($handle)) { |
||
128 | $query .= $buffer; |
||
129 | if (strpos($query, ";") !== false) { |
||
130 | $query = str_replace(";", "", $query); |
||
131 | Db::execute($query); |
||
132 | $query = ""; |
||
133 | } |
||
134 | } |
||
135 | fclose($handle); |
||
136 | |||
137 | if (Db::queryRow("SHOW TABLES LIKE 'old_$table'", array(), 0, false)!= null){ // Check again to see if the old_table is there |
||
138 | if (!Util::startsWith($table, "ccp_")) { |
||
139 | try { |
||
140 | Db::execute("insert ignore into $table select * from old_$table"); |
||
141 | Db::execute("drop table old_$table"); |
||
142 | } catch (Exception $ex) { |
||
143 | Db::execute("drop table $table"); |
||
144 | Db::execute("alter table old_$table rename $table"); |
||
145 | throw $ex; |
||
146 | } |
||
147 | } |
||
148 | } |
||
149 | } |
||
150 | |||
151 | function out($message, $die = false, $newline = true) |
||
0 ignored issues
–
show
The function
out() has been defined more than once; this definition is ignored, only the first definition in install/install.php (L260-280) is considered.
This check looks for functions that have already been defined in other files. Some Codebases, like WordPress, make a practice of defining functions multiple times. This
may lead to problems with the detection of function parameters and types. If you really
need to do this, you can mark the duplicate definition with the /**
* @ignore
*/
function getUser() {
}
function getUser($id, $realm) {
}
See also the PhpDoc documentation for @ignore. ![]() |
|||
152 | { |
||
153 | $colors = array( |
||
154 | "|w|" => "1;37", //White |
||
155 | "|b|" => "0;34", //Blue |
||
156 | "|g|" => "0;32", //Green |
||
157 | "|r|" => "0;31", //Red |
||
158 | "|n|" => "0" //Neutral |
||
159 | ); |
||
160 | |||
161 | $message = "$message|n|"; |
||
162 | foreach($colors as $color => $value) |
||
163 | $message = str_replace($color, "\033[".$value."m", $message); |
||
164 | |||
165 | if($newline) |
||
166 | echo $message.PHP_EOL; |
||
167 | else |
||
168 | echo $message; |
||
169 | } |
||
170 |
This check looks for functions that have already been defined in other files.
Some Codebases, like WordPress, make a practice of defining functions multiple times. This may lead to problems with the detection of function parameters and types. If you really need to do this, you can mark the duplicate definition with the
@ignore
annotation.See also the PhpDoc documentation for @ignore.