This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /* zKillboard |
||
3 | * Copyright (C) 2012-2015 EVE-KILL Team and EVSCO. |
||
4 | * |
||
5 | * This program is free software: you can redistribute it and/or modify |
||
6 | * it under the terms of the GNU Affero General Public License as published by |
||
7 | * the Free Software Foundation, either version 3 of the License, or |
||
8 | * (at your option) any later version. |
||
9 | * |
||
10 | * This program is distributed in the hope that it will be useful, |
||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
13 | * GNU Affero General Public License for more details. |
||
14 | * |
||
15 | * You should have received a copy of the GNU Affero General Public License |
||
16 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
||
17 | */ |
||
18 | |||
19 | $involved = array(); |
||
20 | $message = ""; |
||
21 | |||
22 | if($pageview == "comments") |
||
23 | $app->redirect("/detail/$id/#comment", 301); |
||
24 | |||
25 | $info = User::getUserInfo(); |
||
26 | $name = $info["username"]; |
||
27 | $userID = $info["id"]; |
||
28 | $email = $info["email"]; |
||
29 | |||
30 | |||
31 | if($_POST) |
||
32 | { |
||
33 | $report = Util::getPost("report"); |
||
34 | if (isset($report)) |
||
35 | { |
||
36 | if($id < 0) |
||
37 | { |
||
38 | $tags = "Reported Kill"; |
||
39 | Db::execute("INSERT INTO zz_tickets (userid, name, email, tags, ticket, killID) VALUES (:userid, :name, :email, :tags, :ticket, :killid)", |
||
40 | array(":userid" => $userID, ":name" => $name, ":email" => $email, ":tags" => $tags, ":ticket" => $report, ":killid" => $id)); |
||
41 | global $baseAddr; |
||
42 | $reportID = Db::queryField("SELECT id FROM zz_tickets WHERE killID = :killID AND name = :name", "id", array(":killID" => $id, ":name" => $name)); |
||
43 | Log::ircAdmin("Kill Reported by $name: https://$baseAddr/detail/$id/ - https://$baseAddr/moderator/reportedkills/$reportID/"); |
||
44 | $app->redirect("/detail/$id/"); |
||
45 | } |
||
46 | } |
||
47 | } |
||
48 | |||
49 | $killKey = "CacheKill:$id:$pageview"; |
||
50 | $details = Cache::get($killKey); |
||
51 | if($details == null) |
||
52 | { |
||
53 | // Create the details on this kill |
||
54 | $killdata = Kills::getKillDetails($id); |
||
55 | |||
56 | if (sizeof($killdata["victim"]) == 0) { |
||
57 | return $app->render("404.html", array("message" => "KillID $id does not exist."), 404); |
||
58 | } |
||
59 | |||
60 | // create the dropdown involved array |
||
61 | $allinvolved = $killdata["involved"]; |
||
62 | $cnt = 0; |
||
63 | while($cnt < 10) |
||
64 | { |
||
65 | if(isset($allinvolved[$cnt])) |
||
66 | { |
||
67 | $involved[] = $allinvolved[$cnt]; |
||
68 | unset($allinvolved[$cnt]); |
||
69 | } |
||
70 | $cnt++; |
||
71 | continue; |
||
72 | } |
||
73 | $topDamage = $finalBlow = null; |
||
74 | $first = null; |
||
75 | if (sizeof($killdata["involved"]) > 1){ |
||
76 | foreach($killdata["involved"] as $inv) { |
||
77 | if ($first == null) $first = $inv; |
||
78 | if ($inv["finalBlow"] == 1) $finalBlow = $inv; |
||
79 | if ($topDamage == null && $inv["characterID"] != 0) $topDamage = $inv; |
||
80 | } |
||
81 | // If only NPC's are on the mail give them credit for top damage... |
||
82 | if ($topDamage == null) $topDamage = $first; |
||
83 | } |
||
84 | |||
85 | $extra = array(); |
||
86 | // And now give all the arrays and whatnots to twig.. |
||
87 | if($pageview == "overview") |
||
88 | { |
||
89 | $extra["items"] = Detail::combineditems(md5($id), $killdata["items"]); |
||
90 | $extra["invAll"] = involvedCorpsAndAllis(md5($id), $killdata["involved"]); |
||
91 | $extra["involved"] = $involved; |
||
92 | $extra["allinvolved"] = $allinvolved; |
||
93 | } |
||
94 | if($pageview == "comments") |
||
95 | { |
||
96 | $extra["cmtChars"] = Api::getCharacters($userID); |
||
97 | $extra["cmtChars"][] = array("characterID" => 0, "characterName" => "Anonymous"); |
||
98 | } |
||
99 | |||
100 | $extra["droppedisk"] = droppedIsk(md5($id), $killdata["items"]); |
||
101 | $extra["lostisk"] = $killdata["info"]["total_price"] - $extra["droppedisk"]; |
||
102 | $extra["fittedisk"] = fittedIsk(md5($id), $killdata["items"]); |
||
103 | $extra["relatedtime"] = date("YmdH00", strtotime($killdata["info"]["killTime"])); |
||
104 | $extra["fittingwheel"] = Detail::eftarray(md5($id), $killdata["items"], $killdata["victim"]["characterID"]); |
||
105 | $extra["involvedships"] = involvedships($killdata["involved"]); |
||
106 | $extra["involvedshipscount"] = count($extra["involvedships"]); |
||
107 | $extra["totalprice"] = usdeurgbp($killdata["info"]["total_price"]); |
||
108 | $extra["destroyedprice"] = usdeurgbp($extra["lostisk"]); |
||
109 | $extra["droppedprice"] = usdeurgbp($extra["droppedisk"]); |
||
110 | $extra["fittedprice"] = usdeurgbp($extra["fittedisk"]); |
||
111 | $extra["efttext"] = Fitting::EFT($extra["fittingwheel"]); |
||
112 | $extra["dnatext"] = Fitting::DNA($killdata["items"],$killdata["info"]["shipTypeID"]); |
||
113 | $extra["edkrawmail"] = Kills::getRawMail($id); |
||
114 | $extra["zkbrawmail"] = Kills::getRawMail($id, array(), false); |
||
115 | $extra["reports"] = Db::queryField("SELECT count(*) as cnt FROM zz_tickets WHERE killID = :killid", "cnt", array(":killid" => $id), 0); |
||
116 | $extra["slotCounts"] = Info::getSlotCounts($killdata["victim"]["shipTypeID"]); |
||
117 | $extra["commentID"] = $id; |
||
118 | $extra["crest"] = Db::queryRow("select killID, hash from zz_crest_killmail where killID = :killID and processed = 1", array(":killID" => $id), 300); |
||
119 | $extra["prevKillID"] = Db::queryField("select killID from zz_participants where killID < :killID order by killID desc limit 1", "killID", array(":killID" => $id), 300); |
||
120 | $extra["nextKillID"] = Db::queryField("select killID from zz_participants where killID > :killID order by killID asc limit 1", "killID", array(":killID" => $id), 300); |
||
121 | $extra["warInfo"] = War::getKillIDWarInfo($id); |
||
122 | $extra["insertTime"] = Db::queryField("select insertTime from zz_killmails where killID = :killID", "insertTime", array(":killID" => $id), 300); |
||
123 | |||
124 | $systemID = $killdata["info"]["solarSystemID"]; |
||
125 | $data = Info::getWormholeSystemInfo($systemID); |
||
126 | $extra["wormhole"] = $data; |
||
127 | |||
128 | $url = "https://". $_SERVER["SERVER_NAME"] ."/detail/$id/"; |
||
129 | |||
130 | if ($killdata["victim"]["groupID"] == 29) $relatedShip = Db::queryRow("select killID, shipTypeID from zz_participants where killID >= (:killID - 200) and killID < :killID and groupID != 29 and isVictim = 1 and characterID = :charID order by killID desc limit 1", array(":killID" => $id, ":charID" => $killdata["victim"]["characterID"])); |
||
131 | else $relatedShip = Db::queryRow("select killID, shipTypeID from zz_participants where killID <= (:killID + 200) and killID > :killID and groupID = 29 and isVictim = 1 and characterID = :charID order by killID asc limit 1", array(":killID" => $id, ":charID" => $killdata["victim"]["characterID"])); |
||
132 | Info::addInfo($relatedShip); |
||
133 | $killdata["victim"]["related"] = $relatedShip; |
||
134 | |||
135 | $details = array("pageview" => $pageview, "killdata" => $killdata, "extra" => $extra, "message" => $message, "flags" => Info::$effectToSlot, "topDamage" => $topDamage, "finalBlow" => $finalBlow, "url" => $url); |
||
136 | Cache::set($killKey, $details); |
||
137 | } |
||
138 | |||
139 | $app->etag(md5(serialize($details))); |
||
140 | $app->expires("+5 minutes"); |
||
141 | $app->render("detail.html", $details); |
||
142 | function involvedships($array) |
||
143 | { |
||
144 | $involved = array(); |
||
145 | foreach($array as $inv) |
||
146 | { |
||
147 | if(isset($involved[$inv["shipTypeID"]]) && isset($inv["shipName"])) |
||
148 | $involved[$inv["shipTypeID"]] = array("shipName" => $inv["shipName"], "shipTypeID" => $inv["shipTypeID"], "count" => $involved[$inv["shipTypeID"]]["count"] + 1); |
||
149 | elseif(isset($inv["shipTypeID"]) && isset($inv["shipName"])) |
||
150 | { |
||
151 | $involved[$inv["shipTypeID"]] = array("shipName" => $inv["shipName"], "shipTypeID" => $inv["shipTypeID"], "count" => 1); |
||
152 | } |
||
153 | else |
||
154 | continue; |
||
155 | } |
||
156 | |||
157 | usort($involved, "sortByOrder"); |
||
158 | return $involved; |
||
159 | } |
||
160 | |||
161 | function sortByOrder($a, $b) |
||
162 | { |
||
163 | return $a["count"] < $b["count"]; |
||
164 | } |
||
165 | |||
166 | function usdeurgbp($totalprice) |
||
167 | { |
||
168 | $usd = 17; |
||
169 | $eur = 13; |
||
170 | $gbp = 10; |
||
171 | $plex = Price::getItemPrice("29668", date("Ymd")); |
||
172 | $usdval = $plex / $usd; |
||
173 | $eurval = $plex / $eur; |
||
174 | $gbpval = $plex / $gbp; |
||
175 | |||
176 | return array("usd" => $totalprice / $usdval, "eur" => $totalprice / $eurval, "gbp" => $totalprice / $gbpval); |
||
177 | } |
||
178 | |||
179 | function buildItemKey($itm) |
||
180 | { |
||
181 | $key = $itm["typeName"] . ($itm["singleton"] == 2 ? " (Copy)" : ""); |
||
182 | $key .= "|" . ($itm["qtyDropped"] > 0 ? "dropped" : "destroyed"); |
||
183 | if (!isset($itm["flagName"])) $itm["flagName"] = Info::getFlagName($itm["flag"]); |
||
184 | $key .= "|" . $itm["flagName"]; |
||
185 | if ($itm["groupID"] == 649) $key .= microtime() . rand(0, 10000); |
||
186 | return $key; |
||
187 | } |
||
188 | |||
189 | function involvedCorpsAndAllis($md5, $involved) |
||
190 | { |
||
191 | $Cache = Cache::get($md5."involvedCorpsAndAllis"); |
||
192 | if($Cache) return $Cache; |
||
0 ignored issues
–
show
|
|||
193 | |||
194 | $involvedAlliCount = 0; |
||
195 | $involvedCorpCount = 0; |
||
196 | // Create the involved corps / alliances list |
||
197 | $invAll = array(); |
||
198 | foreach($involved as $inv) { |
||
199 | $allianceID = $inv["allianceID"]; |
||
200 | $corporationID = $inv["corporationID"]; |
||
201 | if (!isset($invAll["$allianceID"])) { |
||
202 | $involvedAlliCount++; |
||
203 | $invAll["$allianceID"] = array(); |
||
204 | if ($allianceID != 0) $invAll["$allianceID"]["allianceName"] = $inv["allianceName"]; |
||
205 | if ($allianceID != 0) $invAll["$allianceID"]["name"] = $inv["allianceName"]; |
||
206 | if ($allianceID != 0) $invAll["$allianceID"]["allianceID"] = $allianceID; |
||
207 | $invAll["$allianceID"]["corporations"] = array(); |
||
208 | $invAll["$allianceID"]["involved"] = 0; |
||
209 | } |
||
210 | $involvedCount = $invAll["$allianceID"]["involved"]; |
||
211 | $invAll["$allianceID"]["involved"] = $involvedCount + 1; |
||
212 | |||
213 | if (!isset($invAll["$allianceID"]["corporations"]["$corporationID"])) { |
||
214 | $involvedCorpCount++; |
||
215 | $invAll["$allianceID"]["corporations"]["$corporationID"] = array(); |
||
216 | $invAll["$allianceID"]["corporations"]["$corporationID"]["corporationName"] = isset($inv["corporationName"]) ? $inv["corporationName"] : ""; |
||
217 | $invAll["$allianceID"]["corporations"]["$corporationID"]["name"] = isset($inv["corporationName"]) ? $inv["corporationName"] : ""; |
||
218 | $invAll["$allianceID"]["corporations"]["$corporationID"]["corporationID"] = $corporationID; |
||
219 | $invAll["$allianceID"]["corporations"]["$corporationID"]["involved"] = 0; |
||
220 | } |
||
221 | $involvedCount = $invAll["$allianceID"]["corporations"]["$corporationID"]["involved"]; |
||
222 | $invAll["$allianceID"]["corporations"]["$corporationID"]["involved"] = $involvedCount + 1; |
||
223 | } |
||
224 | uasort($invAll, "involvedSort"); |
||
225 | foreach($invAll as $id=>$alliance) { |
||
226 | $corps = $alliance["corporations"]; |
||
227 | uasort($corps, "involvedSort"); |
||
228 | $invAll["$id"]["corporations"] = $corps; |
||
229 | } |
||
230 | if ($involvedCorpCount <= 1 && $involvedAlliCount <= 1) $invAll = array(); |
||
231 | Cache::set($md5."involvedCorpsAndAllis", $invAll); |
||
232 | return $invAll; |
||
233 | } |
||
234 | |||
235 | function involvedSort($field1, $field2) |
||
236 | { |
||
237 | if ($field1["involved"] == $field2["involved"] && isset($field1["name"]) && isset($field2["name"])) return strcasecmp($field1["name"], $field2["name"]); |
||
238 | return $field2["involved"] - $field1["involved"]; |
||
239 | } |
||
240 | |||
241 | function droppedIsk($md5, $items) |
||
242 | { |
||
243 | $Cache = Cache::get($md5."droppedisk"); |
||
244 | if($Cache) return $Cache; |
||
0 ignored issues
–
show
The expression
$Cache of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using ![]() |
|||
245 | |||
246 | $droppedisk = 0; |
||
247 | foreach($items as $dropped) { |
||
248 | $droppedisk += $dropped["price"] * ($dropped["singleton"] ? $dropped["qtyDropped"] / 100 : $dropped["qtyDropped"]); |
||
249 | } |
||
250 | |||
251 | Cache::set($md5."droppedisk", $droppedisk); |
||
252 | return $droppedisk; |
||
253 | } |
||
254 | |||
255 | function fittedIsk($md5, $items) |
||
256 | { |
||
257 | $key = $md5 . "fittedIsk"; |
||
258 | $cache = Cache::get($key); |
||
259 | if($cache) |
||
0 ignored issues
–
show
The expression
$cache of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using ![]() |
|||
260 | return $cache; |
||
261 | |||
262 | $fittedIsk = 0; |
||
263 | $flags = array("High Slots", "Mid Slots", "Low Slots", "SubSystems", "Rigs", "Drone Bay", "Fuel Bay"); |
||
264 | foreach($items as $item) |
||
265 | { |
||
266 | if(isset($item["flagName"]) && in_array($item["flagName"], $flags)) { |
||
267 | $qty = isset($item["qtyDropped"]) ? $item["qtyDropped"] : 0; |
||
268 | $qty += isset($item["qtyDestroyed"]) ? $item["qtyDestroyed"] : 0; |
||
269 | $fittedIsk = $fittedIsk + ($item["price"] * $qty); |
||
270 | } |
||
271 | } |
||
272 | Cache::set($key, $fittedIsk); |
||
273 | return $fittedIsk; |
||
274 | } |
||
275 |
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.
Consider making the comparison explicit by using
empty(..)
or! empty(...)
instead.