Issues (1020)

Security Analysis    no vulnerabilities found

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

controllers/ClubController.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
class ClubController extends GameController
3
{
4
    private $moderation = [
5
        'fired'=>0,
6
        'approved'=>0,
7
        'deleted'=>0
8
        ];
9
10
    public function actionIndex()
11
    {
12
        $controller = Yii::app()->player->model->in_club ? 'own' : 'list';
13
        $this->redirect('/club/' . $controller);
14
    }
15
16
    public function actionList($page = 0)
17
    {
18
        $this->renderList($page, false);
19
    }
20
21
    public function actionListCompete($page = 0)
22
    {
23
        $this->renderList($page, true);
24
    }
25
26
    /**
27
     * @param integer $page
28
     * @param boolean $compete
29
     */
30
    protected function renderList($page, $compete)
31
    {
32
        $model=new Club;
33
34
        $model->page = $page;
35
        $model->fetchItems($compete);
36
37
        $template = $compete ? 'listcompete' : 'list';
38
        $this->render($template, [
39
            'list'=>$model->items,
40
            'pagination' => $model->pagination,
41
            'count' => $model->count,
42
            'page_size' => Yii::app()->params['listPerPage'],
43
            'page'=>$page,
44
            ]);
45
    }
46
47
    public function actionCreate()
0 ignored issues
show
actionCreate uses the super-global variable $_POST which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
48
    {
49
        $model=new ClubAR;
50
51
        if (isset($_POST['ClubAR'])) {
52
            $model->attributes=$_POST['ClubAR'];
53
            if ($model->validate()) {
54
                if ($model->save()) {
55
                    $this->redirect(['/club/own']);
56
                }
57
            }
58
        }
59
60
        $this->render('create', [
61
            'model'=>$model,
62
            ]);
63
    }
64
65
    public function actionDetails($id)
66
    {
67
        $player = Yii::app()->player->model;
68
69
        $clubID = (int)$id;
70
        $in_club = (int)Yii::app()->player->model->in_club;
71
        if ($in_club == $id) {
72
            $this->redirect('/club/own');
73
        }
74
        //members
75
        $club = new Club;
76
        $club->id = $clubID;
77
        $club->fetch();
78
79
        if (!$club->id) {
80
            throw new CHttpException(404, 'A keresett klub nem található.');
81
        }
82
        $club->fetchMembers();
83
84
        $r = Yii::app()->request;
85
        $join = $r->getParam('join', 0);
86
        if ($join) {
87
            try {
88
                $club->joinRequest($club->id);
89
                Yii::app()->user->setFlash('success', 'A csatlakozási kérelmet elküldted. Amint elfogadja valamelyik klubtag, értesítünk.');
90
            } catch (CFlashException $e) {
91
                Yii::app()->user->setFlash('error', $e->getMessage());
92
            }
93
        }
94
        $delete = $r->getParam('deleteJoin', 0);
95
        if ($delete) {
96
            $club->deleteOwnJoinRequest($club->id);
97
            Yii::app()->user->setFlash('success', 'A csatlakozási kérelmet visszavontad.');
98
        }
99
100
        $forum = new Forum;
101
102
        //challenge
103
        $ch = new Challenge;
104
        $ch->caller = $in_club;
105
        $ch->opponent = $clubID;
106
        $ch->fetchActiveChallenge();
107
108
        $call = $r->getParam('call', 0);
109
        if ($call) {
110
            try {
111
                $ch->caller = $in_club;
112
                $ch->opponent = $clubID;
113
114
                $ch->callToChallenge($club);
115
                Yii::app()->user->setFlash('success', 'Versenyre hívtad a klubot!');
116
117
                $forum->id = $clubID;
118
                $message = $player->user . ' a saját klubja nevében versenyre hívta a klubot.';
119
                $forum->save($message, true);
120
121
                $forum->id = $player->in_club;
122
                $message = $player->user . ' versenyre hívta a következő klubot: ' . $club->name;
123
                $forum->save($message, true);
124
            } catch (CFlashException $e) {
125
                Yii::app()->user->setFlash('error', $e->getMessage());
126
            }
127
        }
128
129
130
        $forum->id = $clubID;
131
        $forum->fetchItems();
132
133
        $this->render('details', [
134
            'clubID'=>$clubID,
135
            'club'=>$club,
136
            'challenge'=>$ch,
137
            'list'=>$forum->items,
138
            'pagination' => $forum->pagination,
139
            'count' => $forum->count,
140
            'page_size' => Yii::app()->params['listPerPage'],
141
            'page'=>0,
142
            'moderation'=>$this->moderation,
143
            ]);
144
    }
145
    public function actionOwn($page = 0)
146
    {
147
        $player = Yii::app()->player->model;
148
        if (!$player->in_club) {
149
            $this->redirect(['/club/list']);
150
        }
151
152
        //forum
153
        $forum = new Forum;
154
        $forum->id = $player->in_club;
155
        $forum->fetchItems();
156
157
        //members
158
        $club = new Club;
159
        $club->id = $player->in_club;
160
        $club->fetch();
161
        $club->fetchMembers();
162
163
        //challenge
164
        $ch = new Challenge;
165
        $ch->opponent = $club->id;
166
        $ch->fetchActiveChallenge();
167
168
        try {
169
            $this->fireMember($club, $ch, $forum);
170
            $this->acceptApproval($club, $forum);
171
            $this->deleteApproval($club, $forum);
172
            $this->switchCompete($club, $ch);
173
174
        } catch (CFlashException $e) {
175
            Yii::app()->user->setFlash('error', $e->getMessage());
176
        }
177
178
        $this->render('own', [
179
            'clubID'=>$player->in_club,
180
            'club'=>$club,
181
            'challenge'=>$ch,
182
            'list'=>$forum->items,
183
            'pagination' => $forum->pagination,
184
            'count' => $forum->count,
185
            'page_size' => Yii::app()->params['listPerPage'],
186
            'page'=>$page,
187
            'moderation'=>$this->moderation,
188
            ]);
189
    }
190
191
    /**
192
     * @param Club $club
193
     * @param Challenge $challenge
194
     * @param Forum $forum
195
     */
196
    private function fireMember($club, $challenge, $forum)
197
    {
198
        $player = Yii::app()->player->model;
199
200
        $fire = (int)Yii::app()->request->getParam('fire', false);
201
        if ($fire) {
202
            if ($challenge->active) {
203
                throw new CFlashException('Verseny közben nem lehet tagot kidobni.');
204
            }
205
206
            $fireUser = isset($club->members[$fire]['user']) ? $club->members[$fire]['user'] : '???';
207
            if ($club->fireMember($fire)) {
208
                $this->moderation['fired'] = $fire;
209
                //forum notice
210
                $message = $fire==$player->uid ? $player->user . ' kilépett a klubból.' : $player->user . ' visszavonta ' . $fireUser . ' tagságát.';
211
                $forum->save($message, true);
212
                //wall notice
213
                $this->wallNotice($club, Wall::TYPE_CLUB_FIRE, $fire);
214
            }
215
        }
216
    }
217
218
    /**
219
     * @param Club $club
220
     * @param Forum $forum
221
     */
222
    private function acceptApproval($club, $forum)
223
    {
224
        $player = Yii::app()->player->model;
225
226
        $approve = (int)Yii::app()->request->getParam('approve', false);
227
        if ($approve) {
228
            if ($club->approveMember($approve)) {
229
                $this->moderation['approved'] = $approve;
230
                //forum notice
231
                $message = $player->user . ' elfogadta ' . $club->members[$approve]['user'] . ' felvételi kérelmét.';
232
                $forum->save($message, true);
233
                //wall notice
234
                $this->wallNotice($club, Wall::TYPE_CLUB_APPROVE, $club->members[$approve]['uid']);
235
            }
236
        }
237
    }
238
239
    /**
240
     * @param Club $club
241
     * @param Forum $forum
242
     */
243
    private function deleteApproval($club, $forum)
244
    {
245
        $player = Yii::app()->player->model;
246
247
        $delete = (int)Yii::app()->request->getParam('delete', false);
248
        if ($delete) {
249
            $deleteUser = isset($club->entrants[$delete]['user']) ? $club->entrants[$delete]['user'] : '???';
250
            if ($club->deleteJoinRequest($delete)) {
251
                $this->moderation['deleted'] = $delete;
252
                //forum notice
253
                $message = $player->user . ' elutasította ' . $deleteUser . ' felvételi kérelmét.';
254
                $forum->save($message, true);
255
                //wall notice
256
                $this->wallNotice($club, Wall::TYPE_CLUB_DELETE, $delete);
257
            }
258
        }
259
    }
260
261
    /**
262
     * @param Club $club
263
     * @param Challenge $challenge
264
     */
265
    private function switchCompete($club, $challenge)
266
    {
267
        $switch = Yii::app()->request->getParam('switch', '');
268
        if ($switch == 'compete') {
269
            if ($club->would_compete & $challenge->underLastCallTimeLimit($club->id)) {
270
                throw new CFlashException('A \'versenyezne\' beállítást csak akkor kapcsolhatod ki, ha legalább '. Challenge::TIME_LIMIT_LASTCALL_HOURS .' óra eltelt azóta, hogy a klubod valakit versenyre hívott.');
271
            }
272
273
            $club->switchCompete();
274
        }
275
    }
276
277
    /**
278
     * @param Club $club
279
     */
280
    private function wallNotice($club, $type, $uid)
281
    {
282
        $player = Yii::app()->player->model;
283
284
        //wall notice
285
        $wall = new Wall;
286
        $wall->content_type = $type;
287
        $wall->uid = $uid;
288
        $wall->add([
289
            'clubID'=>$player->in_club,
290
            'clubName'=>$club->name,
291
            'moderatorUid'=>$player->uid,
292
            'moderator'=>$player->user,
293
            ]);
294
    }
295
296
    public function actionForum($id, $page = 0)
297
    {
298
        $clubID = (int)$id;
299
300
        $forum = new Forum;
301
        $forum->id = $clubID;
302
303
        $r = Yii::app()->request;
304
        $post = $r->getPost('post', false);
305
        if ($post) {
306
            $forum->private = $r->getPost('private', false);
307
            $forum->save($post);
308
        }
309
        $delete = $r->getParam('delete', 0);
310
        if ($delete) {
311
            $forum->delete($delete);
312
        }
313
314
        $forum->page = $page;
315
        $forum->fetchItems();
316
317
        $this->render('forum', [
318
            'clubID'=>$clubID,
319
            'list'=>$forum->items,
320
            'pagination' => $forum->pagination,
321
            'count' => $forum->count,
322
            'page_size' => Yii::app()->params['listPerPage'],
323
            'page'=>$page,
324
            ]);
325
    }
326
327
    public function actionHistory($id = 0)
328
    {
329
        if (!$id) {
330
            $this->redirect(['/club/list']);
331
        }
332
333
        $club = new Club;
334
        $club->id = (int)$id;
335
        $club->fetch();
336
        $club->fetchChallenges();
337
338
        $this->render('history', [
339
            'club'=>$club,
340
            ]);
341
    }
342
343
    public function actionClose()
344
    {
345
        $player = Yii::app()->player->model;
346
        if (!$player->in_club) {
347
            $this->redirect(['/club/list']);
348
        }
349
350
        //members
351
        $club = new Club;
352
        $club->id = $player->in_club;
353
        $club->fetch();
354
        $club->fetchMembers();
355
356
        $pass = Yii::app()->request->getPost('pass', '');
357
        if ($pass) {
358
            try {
359
                if ($club->close($pass)) {
360
                    foreach ($club->members as $member) {
361
                        $this->wallNotice($club, Wall::TYPE_CLUB_CLOSE, $member['uid']);
362
                    }
363
                    Yii::app()->user->setFlash('success', "A klubot megszüntetted.");
364
                    $this->redirect(['/club/list']);
365
                }
366
            } catch (CFlashException $e) {
367
                Yii::app()->user->setFlash('error', $e->getMessage());
368
            }
369
        }
370
371
        $this->render('close', [
372
            'club'=>$club,
373
            ]);
374
    }
375
}
376