This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /* zKillboard |
||
3 | * Copyright (C) 2012-2015 EVE-KILL Team and EVSCO. |
||
4 | * |
||
5 | * This program is free software: you can redistribute it and/or modify |
||
6 | * it under the terms of the GNU Affero General Public License as published by |
||
7 | * the Free Software Foundation, either version 3 of the License, or |
||
8 | * (at your option) any later version. |
||
9 | * |
||
10 | * This program is distributed in the hope that it will be useful, |
||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
13 | * GNU Affero General Public License for more details. |
||
14 | * |
||
15 | * You should have received a copy of the GNU Affero General Public License |
||
16 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
||
17 | */ |
||
18 | |||
19 | // Find the characterID |
||
20 | if(!is_numeric($character)) |
||
21 | $characterID = (int) Db::queryField("SELECT characterID FROM zz_characters WHERE name = :name", "characterID", array(":name" => $character), 3600); |
||
22 | else // Verify it exists |
||
23 | $characterID = (int) Db::queryField("SELECT characterID FROM zz_characters WHERE characterID = :characterID", "characterID", array(":characterID" => (int) $character), 3600); |
||
24 | |||
25 | // If the characterID we get from above is zero, don't even bother anymore..... |
||
26 | if($characterID == 0) |
||
27 | $app->redirect("/"); |
||
28 | elseif(!is_numeric($character)) // if character isn't numeric, we redirect TO the characterID! |
||
29 | $app->redirect("/character/{$characterID}/"); |
||
30 | |||
31 | // Now we figure out all the parameters |
||
32 | $parameters = Util::convertUriToParameters(); |
||
33 | |||
34 | // Unset the character => id, and make it characterID => id |
||
35 | unset($parameters["character"]); |
||
36 | $parameters["characterID"] = $characterID; |
||
37 | $parameters["index"] = "characterID_dttm"; |
||
38 | |||
39 | // Make sure that the pageType is correct.. |
||
40 | $subPageTypes = array("page", "groupID", "month", "year", "shipTypeID"); |
||
41 | if(in_array($pageType, $subPageTypes)) |
||
42 | $pageType = "overview"; |
||
43 | |||
44 | if($pageType == "groupID") |
||
45 | $app->redirect("/"); |
||
46 | |||
47 | // Some defaults |
||
48 | @$page = max(1, $parameters["page"]); |
||
0 ignored issues
–
show
|
|||
49 | $limit = 50; |
||
50 | $parameters["limit"] = $limit; |
||
51 | $parameters["page"] = $page; |
||
52 | |||
53 | // and now we fetch the info! |
||
54 | $detail = Info::getPilotDetails($characterID, $parameters); |
||
55 | |||
56 | // Define the page information and scope etc. |
||
57 | $pageName = isset($detail["characterName"]) ? $detail["characterName"] : "???"; |
||
58 | $columnName = "characterID"; |
||
59 | $mixedKills = $pageType == "overview" && UserConfig::get("mixKillsWithLosses", true); |
||
60 | |||
61 | // Load kills for the various pages. |
||
62 | $mixed = $pageType == "overview" ? Kills::getKills($parameters) : array(); |
||
63 | $kills = $pageType == "kills" ? Kills::getKills($parameters) : array(); |
||
64 | $losses = $pageType == "losses" ? Kills::getKills($parameters) : array(); |
||
65 | |||
66 | // Solo parameters |
||
67 | //$soloParams = $parameters; |
||
68 | //if (!isset($parameters["kills"]) || !isset($parameters["losses"])) { |
||
69 | // $soloParams["mixed"] = true; |
||
70 | //} |
||
71 | |||
72 | // Solo kills |
||
73 | //$soloKills = Kills::getKills($soloParams); |
||
74 | //$solo = Kills::mergeKillArrays($soloKills, array(), $limit, $columnName, $characterID); |
||
75 | |||
76 | $topLists = array(); |
||
77 | $topKills = array(); |
||
78 | // Top list on the top/topalltime page |
||
79 | if ($pageType == "top" || $pageType == "topalltime") |
||
80 | { |
||
81 | $topParameters = $parameters; |
||
82 | $topParameters["limit"] = 10; |
||
83 | |||
84 | if ($pageType != "topalltime") |
||
85 | { |
||
86 | if (!isset($topParameters["year"])) |
||
87 | $topParameters["year"] = date("Y"); |
||
88 | |||
89 | if (!isset($topParameters["month"])) |
||
90 | $topParameters["month"] = date("m"); |
||
91 | } |
||
92 | |||
93 | if (!array_key_exists("kills", $topParameters) && !array_key_exists("losses", $topParameters)) |
||
94 | $topParameters["kills"] = true; |
||
95 | |||
96 | $topLists[] = array("type" => "character", "data" => Stats::getTopPilots($topParameters, true)); |
||
97 | $topLists[] = array("type" => "corporation", "data" => Stats::getTopCorps($topParameters, true)); |
||
98 | $topLists[] = array("type" => "alliance", "data" => Stats::getTopAllis($topParameters, true)); |
||
99 | $topLists[] = array("type" => "ship", "data" => Stats::getTopShips($topParameters, true)); |
||
100 | $topLists[] = array("type" => "system", "data" => Stats::getTopSystems($topParameters, true)); |
||
101 | $topLists[] = array("type" => "weapon", "data" => Stats::getTopWeapons($topParameters, true)); |
||
102 | } |
||
103 | else |
||
104 | { |
||
105 | // Top lists on the pages themselves. |
||
106 | $p = $parameters; |
||
107 | $numDays = 7; |
||
108 | $p["limit"] = 10; |
||
109 | $p["pastSeconds"] = $numDays * 86400; |
||
110 | $p["kills"] = $pageType != "losses"; |
||
111 | |||
112 | $topLists[] = Info::doMakeCommon("Top Ships", "shipTypeID", Stats::getTopShips($p)); |
||
113 | $topLists[] = Info::doMakeCommon("Top Systems", "solarSystemID", Stats::getTopSystems($p)); |
||
114 | |||
115 | $p["limit"] = 5; |
||
116 | $topKills = Stats::getTopIsk($p); |
||
117 | } |
||
118 | |||
119 | // Fix the history data! |
||
120 | $detail["history"] = $pageType == "stats" ? Summary::getMonthlyHistory($columnName, $characterID) : array(); |
||
121 | |||
122 | // Figure out if the character is API verified or not |
||
123 | $count = Db::queryField("SELECT count(1) count FROM zz_api_characters WHERE characterID = :characterID", "count", array(":characterID" => $characterID)); |
||
124 | $apiVerified = $count > 0 ? 1 : 0; |
||
125 | |||
126 | // Stats.. |
||
127 | $cnt = 0; |
||
128 | $cnid = 0; |
||
129 | $stats = array(); |
||
130 | $totalcount = ceil(count($detail["stats"]) / 4); |
||
131 | foreach ($detail["stats"] as $q) |
||
132 | { |
||
133 | if ($cnt == $totalcount) |
||
134 | { |
||
135 | $cnid++; |
||
136 | $cnt = 0; |
||
137 | } |
||
138 | $stats[$cnid][] = $q; |
||
139 | $cnt++; |
||
140 | } |
||
141 | |||
142 | // Mixed kills yo! |
||
143 | if ($mixedKills) |
||
144 | $kills = Kills::mergeKillArrays($mixed, array(), $limit, $columnName, $characterID); |
||
145 | |||
146 | // Find the next and previous characterID |
||
147 | $prevID = Db::queryField("select characterID from zz_characters where characterID < :id order by characterID desc limit 1", "characterID", array(":id" => $characterID), 300); |
||
148 | $nextID = Db::queryField("select characterID from zz_characters where characterID > :id order by characterID asc limit 1", "characterID", array(":id" => $characterID), 300); |
||
149 | |||
150 | $renderParams = array( |
||
151 | "pageName" => $pageName, |
||
152 | "kills" => $kills, |
||
153 | "losses" => $losses, |
||
154 | "detail" => $detail, |
||
155 | "page" => $page, |
||
156 | "topKills" => $topKills, |
||
157 | "mixed" => $mixedKills, |
||
158 | "key" => "character", |
||
159 | "id" => $characterID, |
||
160 | "pageType" => $pageType, |
||
161 | //"solo" => $solo, |
||
162 | "topLists" => $topLists, |
||
163 | "summaryTable" => $stats, |
||
164 | "pager" => (sizeof($kills) + sizeof($losses) >= $limit), |
||
165 | "datepicker" => true, |
||
166 | "apiVerified" => $apiVerified, |
||
167 | "prevID" => $prevID, |
||
168 | "nextID" => $nextID |
||
169 | ); |
||
170 | |||
171 | $app->etag(md5(serialize($renderParams))); |
||
172 | $app->expires("+5 minutes"); |
||
173 | $app->render("overview.html", $renderParams); |
||
174 |
If you suppress an error, we recommend checking for the error condition explicitly: