EVE-KILL /
zKillboard
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /* zKillboard |
||
| 3 | * Copyright (C) 2012-2015 EVE-KILL Team and EVSCO. |
||
| 4 | * |
||
| 5 | * This program is free software: you can redistribute it and/or modify |
||
| 6 | * it under the terms of the GNU Affero General Public License as published by |
||
| 7 | * the Free Software Foundation, either version 3 of the License, or |
||
| 8 | * (at your option) any later version. |
||
| 9 | * |
||
| 10 | * This program is distributed in the hope that it will be useful, |
||
| 11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 13 | * GNU Affero General Public License for more details. |
||
| 14 | * |
||
| 15 | * You should have received a copy of the GNU Affero General Public License |
||
| 16 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
||
| 17 | */ |
||
| 18 | |||
| 19 | // Find the characterID |
||
| 20 | if(!is_numeric($character)) |
||
| 21 | $characterID = (int) Db::queryField("SELECT characterID FROM zz_characters WHERE name = :name", "characterID", array(":name" => $character), 3600);
|
||
| 22 | else // Verify it exists |
||
| 23 | $characterID = (int) Db::queryField("SELECT characterID FROM zz_characters WHERE characterID = :characterID", "characterID", array(":characterID" => (int) $character), 3600);
|
||
| 24 | |||
| 25 | // If the characterID we get from above is zero, don't even bother anymore..... |
||
| 26 | if($characterID == 0) |
||
| 27 | $app->redirect("/");
|
||
| 28 | elseif(!is_numeric($character)) // if character isn't numeric, we redirect TO the characterID! |
||
| 29 | $app->redirect("/character/{$characterID}/");
|
||
| 30 | |||
| 31 | // Now we figure out all the parameters |
||
| 32 | $parameters = Util::convertUriToParameters(); |
||
| 33 | |||
| 34 | // Unset the character => id, and make it characterID => id |
||
| 35 | unset($parameters["character"]); |
||
| 36 | $parameters["characterID"] = $characterID; |
||
| 37 | $parameters["index"] = "characterID_dttm"; |
||
| 38 | |||
| 39 | // Make sure that the pageType is correct.. |
||
| 40 | $subPageTypes = array("page", "groupID", "month", "year", "shipTypeID");
|
||
| 41 | if(in_array($pageType, $subPageTypes)) |
||
| 42 | $pageType = "overview"; |
||
| 43 | |||
| 44 | if($pageType == "groupID") |
||
| 45 | $app->redirect("/");
|
||
| 46 | |||
| 47 | // Some defaults |
||
| 48 | @$page = max(1, $parameters["page"]); |
||
|
0 ignored issues
–
show
|
|||
| 49 | $limit = 50; |
||
| 50 | $parameters["limit"] = $limit; |
||
| 51 | $parameters["page"] = $page; |
||
| 52 | |||
| 53 | // and now we fetch the info! |
||
| 54 | $detail = Info::getPilotDetails($characterID, $parameters); |
||
| 55 | |||
| 56 | // Define the page information and scope etc. |
||
| 57 | $pageName = isset($detail["characterName"]) ? $detail["characterName"] : "???"; |
||
| 58 | $columnName = "characterID"; |
||
| 59 | $mixedKills = $pageType == "overview" && UserConfig::get("mixKillsWithLosses", true);
|
||
| 60 | |||
| 61 | // Load kills for the various pages. |
||
| 62 | $mixed = $pageType == "overview" ? Kills::getKills($parameters) : array(); |
||
| 63 | $kills = $pageType == "kills" ? Kills::getKills($parameters) : array(); |
||
| 64 | $losses = $pageType == "losses" ? Kills::getKills($parameters) : array(); |
||
| 65 | |||
| 66 | // Solo parameters |
||
| 67 | //$soloParams = $parameters; |
||
| 68 | //if (!isset($parameters["kills"]) || !isset($parameters["losses"])) {
|
||
| 69 | // $soloParams["mixed"] = true; |
||
| 70 | //} |
||
| 71 | |||
| 72 | // Solo kills |
||
| 73 | //$soloKills = Kills::getKills($soloParams); |
||
| 74 | //$solo = Kills::mergeKillArrays($soloKills, array(), $limit, $columnName, $characterID); |
||
| 75 | |||
| 76 | $topLists = array(); |
||
| 77 | $topKills = array(); |
||
| 78 | // Top list on the top/topalltime page |
||
| 79 | if ($pageType == "top" || $pageType == "topalltime") |
||
| 80 | {
|
||
| 81 | $topParameters = $parameters; |
||
| 82 | $topParameters["limit"] = 10; |
||
| 83 | |||
| 84 | if ($pageType != "topalltime") |
||
| 85 | {
|
||
| 86 | if (!isset($topParameters["year"])) |
||
| 87 | $topParameters["year"] = date("Y");
|
||
| 88 | |||
| 89 | if (!isset($topParameters["month"])) |
||
| 90 | $topParameters["month"] = date("m");
|
||
| 91 | } |
||
| 92 | |||
| 93 | if (!array_key_exists("kills", $topParameters) && !array_key_exists("losses", $topParameters))
|
||
| 94 | $topParameters["kills"] = true; |
||
| 95 | |||
| 96 | $topLists[] = array("type" => "character", "data" => Stats::getTopPilots($topParameters, true));
|
||
| 97 | $topLists[] = array("type" => "corporation", "data" => Stats::getTopCorps($topParameters, true));
|
||
| 98 | $topLists[] = array("type" => "alliance", "data" => Stats::getTopAllis($topParameters, true));
|
||
| 99 | $topLists[] = array("type" => "ship", "data" => Stats::getTopShips($topParameters, true));
|
||
| 100 | $topLists[] = array("type" => "system", "data" => Stats::getTopSystems($topParameters, true));
|
||
| 101 | $topLists[] = array("type" => "weapon", "data" => Stats::getTopWeapons($topParameters, true));
|
||
| 102 | } |
||
| 103 | else |
||
| 104 | {
|
||
| 105 | // Top lists on the pages themselves. |
||
| 106 | $p = $parameters; |
||
| 107 | $numDays = 7; |
||
| 108 | $p["limit"] = 10; |
||
| 109 | $p["pastSeconds"] = $numDays * 86400; |
||
| 110 | $p["kills"] = $pageType != "losses"; |
||
| 111 | |||
| 112 | $topLists[] = Info::doMakeCommon("Top Ships", "shipTypeID", Stats::getTopShips($p));
|
||
| 113 | $topLists[] = Info::doMakeCommon("Top Systems", "solarSystemID", Stats::getTopSystems($p));
|
||
| 114 | |||
| 115 | $p["limit"] = 5; |
||
| 116 | $topKills = Stats::getTopIsk($p); |
||
| 117 | } |
||
| 118 | |||
| 119 | // Fix the history data! |
||
| 120 | $detail["history"] = $pageType == "stats" ? Summary::getMonthlyHistory($columnName, $characterID) : array(); |
||
| 121 | |||
| 122 | // Figure out if the character is API verified or not |
||
| 123 | $count = Db::queryField("SELECT count(1) count FROM zz_api_characters WHERE characterID = :characterID", "count", array(":characterID" => $characterID));
|
||
| 124 | $apiVerified = $count > 0 ? 1 : 0; |
||
| 125 | |||
| 126 | // Stats.. |
||
| 127 | $cnt = 0; |
||
| 128 | $cnid = 0; |
||
| 129 | $stats = array(); |
||
| 130 | $totalcount = ceil(count($detail["stats"]) / 4); |
||
| 131 | foreach ($detail["stats"] as $q) |
||
| 132 | {
|
||
| 133 | if ($cnt == $totalcount) |
||
| 134 | {
|
||
| 135 | $cnid++; |
||
| 136 | $cnt = 0; |
||
| 137 | } |
||
| 138 | $stats[$cnid][] = $q; |
||
| 139 | $cnt++; |
||
| 140 | } |
||
| 141 | |||
| 142 | // Mixed kills yo! |
||
| 143 | if ($mixedKills) |
||
| 144 | $kills = Kills::mergeKillArrays($mixed, array(), $limit, $columnName, $characterID); |
||
| 145 | |||
| 146 | // Find the next and previous characterID |
||
| 147 | $prevID = Db::queryField("select characterID from zz_characters where characterID < :id order by characterID desc limit 1", "characterID", array(":id" => $characterID), 300);
|
||
| 148 | $nextID = Db::queryField("select characterID from zz_characters where characterID > :id order by characterID asc limit 1", "characterID", array(":id" => $characterID), 300);
|
||
| 149 | |||
| 150 | $renderParams = array( |
||
| 151 | "pageName" => $pageName, |
||
| 152 | "kills" => $kills, |
||
| 153 | "losses" => $losses, |
||
| 154 | "detail" => $detail, |
||
| 155 | "page" => $page, |
||
| 156 | "topKills" => $topKills, |
||
| 157 | "mixed" => $mixedKills, |
||
| 158 | "key" => "character", |
||
| 159 | "id" => $characterID, |
||
| 160 | "pageType" => $pageType, |
||
| 161 | //"solo" => $solo, |
||
| 162 | "topLists" => $topLists, |
||
| 163 | "summaryTable" => $stats, |
||
| 164 | "pager" => (sizeof($kills) + sizeof($losses) >= $limit), |
||
| 165 | "datepicker" => true, |
||
| 166 | "apiVerified" => $apiVerified, |
||
| 167 | "prevID" => $prevID, |
||
| 168 | "nextID" => $nextID |
||
| 169 | ); |
||
| 170 | |||
| 171 | $app->etag(md5(serialize($renderParams))); |
||
| 172 | $app->expires("+5 minutes");
|
||
| 173 | $app->render("overview.html", $renderParams);
|
||
| 174 |
If you suppress an error, we recommend checking for the error condition explicitly: