Issues in Player.php (master) - Issues in master - heal25/ced - Measure and Improve Code Quality continuously with Scrutinizer

Issues (1020)

Security Analysis no vulnerabilities found

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

models/Player.php (28 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/**
 * @property integer $uid
 * @property string $user
 * @property string $registered
 * @property integer $level
 * @property integer $status_points
 * @property integer $energy
 * @property integer $energy_max
 * @property integer $energy_missing
 * @property integer $energyRequiredForDuel
 * @property integer $skill
 * @property integer $strength
 * @property integer $dollar
 * @property integer $gold
 * @property integer $xp_all
 * @property integer $xp_delta
 * @property integer $xp_remaining
 * @property integer $last_location
 * @property integer $owned_items
 * @property integer $owned_baits
 * @property string $found_setitem_time
 * @property integer $found_setitem_xp
 * @property integer $tutorial_mission
 * @property integer $in_club
 * @property integer $level_percent
 * @property integer $refillPerInterval
 * @property integer $energyRefillPerInterval
 * @property integer $remainingTimeToRefill
 * @property integer $justAdvanced
 * @property integer $freeSlots
 * @property boolean $black_market
 * @property integer $skill_extended
 * @property string $clubName
 */
class Player extends CModel implements ISubject
{
    const ENERGY_REFILL_INTERVAL = 300; //5min

    private $uid;
    private $user;
    private $registered;
    private $xp_all;
    private $xp_delta;
    private $xp_recommended;
    private $level;
    private $status_points;
    private $energy_max;
    private $energy_incr_at;
    private $energy;
    private $skill;
    private $skill_extended;
    private $strength;
    private $dollar;
    private $gold;
    private $last_location;
    private $owned_items;
    private $owned_baits;
    private $found_setitem_time;
    private $found_setitem_xp;
    private $duel_points;

    private $tutorial_mission;
    private $in_club;
    private $black_market;

    private $justAdvanced;

    public function attributeNames()
    {
        return [];
    }

    public function getUid()
    {
        return (int)$this->uid;
    }

    public function getUser()

    {
        return $this->user;
    }

    public function getRegistered()

    {
        return $this->registered;
    }

    public function getLevel()
    {
        return (int)$this->level;
    }

    public function getStatus_points()
    {
        return $this->itsMe() ? (int)$this->status_points : 0;
    }

    public function getEnergy()
    {
        return (int)$this->energy;
    }

    public function getEnergy_max()
    {
        return (int)$this->energy_max;
    }

    public function getEnergy_missing()
    {
        return $this->energy_max - $this->energy;
    }

    public function getEnergyRequiredForDuel()
    {
        return round($this->energy_max / 10);
    }

    public function getSkill()
    {
        return (int)$this->skill;
    }

    public function getStrength()
    {
        return (int)$this->strength;
    }

    public function getDollar()
    {
        return (int)$this->dollar;
    }

    public function getGold()
    {
        return (int)$this->gold;
    }

    public function getXp_all()
    {
        return (int)$this->xp_all;
    }

    public function getXp_delta()
    {
        return (int)$this->xp_delta;
    }

    public function getXp_remaining()
    {
        return (int)$this->xp_recommended - (int)$this->xp_delta;
    }

    public function getLast_location()
    {
        return (int)$this->last_location;
    }

    public function getOwned_items()
    {
        return (int)$this->owned_items;
    }

    public function getOwned_baits()
    {
        return (int)$this->owned_baits;
    }

    public function getFound_setitem_time()

    {
        return $this->found_setitem_time > $this->registered ? $this->found_setitem_time : $this->registered;
    }

    public function getFound_setitem_xp()
    {
        return (int)$this->found_setitem_xp;
    }

    public function getTutorial_mission()
    {
        return (int)$this->tutorial_mission;
    }

    public function getIn_club()
    {
        return (int)$this->in_club;
    }

    public function getLevel_percent()
    {
        if (!$this->xp_recommended) {
            return 0;
        }
        $percent = (int)$this->xp_delta / ((int)$this->xp_recommended / 100);

        if ($percent < 0) {
            $percent = 0;
        }
        if ($percent > 100) {
            $percent = 100;
        }
        return $percent;
    }

    public function getRefillPerInterval()
    {
        return round($this->energy_max / 10);
    }

    public function getEnergyRefillInterval()
    {
        return self::ENERGY_REFILL_INTERVAL;
    }

    public function getRemainingTimeToRefill()
    {
        $last = strtotime($this->energy_incr_at);
        if ($last < 0) {
            $last = 0;
        }

        $remaining = self::ENERGY_REFILL_INTERVAL - (time() - $last);
        if ($remaining < 0) {
            $remaining = 0;
        }

        return $remaining;
    }

    public function getJustAdvanced()
    {
        return (int)$this->justAdvanced;
    }

    public function getFreeSlots()
    {
        return $this->strength - ($this->owned_items + $this->owned_baits);
    }

    public function getBlack_market()
    {
        return (bool)(strtotime($this->black_market) >= time());
    }

    public function itsMe()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        return $this->uid == @$_SESSION['uid'];
    }

    public function getSkill_extended()

    {
        return $this->skill_extended>0 ? $this->skill_extended : 1;
    }

    public function getClubName()

    {
        if (!$this->in_club) {
            return false;
        }

        $club = new Club;
$a = "a";
$ab = "ab";
$abc = "abc";
        $club->id = $this->in_club;

        $club->fetchName();
        return $club->name;

    }

    public function setSubjectId($id)
    {
        $this->uid = (int)$id;
    }

    public function setOwned_baits($baits)
    {
        $this->owned_baits = (int)$baits;
    }

    public function setOwned_items($items)
    {
        $this->owned_items = (int)$items;
    }

    public function activateDuelShield()
    {
        Yii::trace($this->uid . ': activate duelShield.');
        $this->energy = 0;
    }

    public function fetchUser()
    {
        $user = Yii::app()->db->cache(86400)->createCommand()
            ->select('user')
            ->from('main')
            ->where('uid=:uid', [':uid'=>$this->uid])
            ->queryScalar();
        if (!$user) {
            $user = '???';
        }
        $this->user = $user;
    }

    public function getSubjectName()

    {
        $name = Yii::app()->db->cache(86400)->createCommand()
            ->select('user')
            ->from('main')
            ->where('uid=:uid', [':uid'=>$this->uid])
            ->queryScalar();
        if (!$name) {
            $name = '???';
        }
        return $name;
    }

    public function setAllAttributes($uid = 0)
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        $this->setSubjectId( $uid ? $uid : @$_SESSION['uid'] );

        if (!$this->uid) {
            return false;
        }

        //read all from db
        $res = Yii::app()->db->createCommand()
            ->select('*')
            ->from('main')
            ->where('uid=:uid', [':uid'=>$this->uid])
            ->queryRow();

        if (!is_array($res)) {
            $this->uid = 0;
            return false;
        }

        foreach ($res as $k => $v) {
            $this->$k = $v;
        }
    }

    public function rest()
    {
        $refillable = $this->energy_max - $this->energy;
        if (!$refillable) {
            return false; //don't need to rest
        }

        $now = time();
$a = "a";
$ab = "ab";
$abc = "abc";
        $last = strtotime($this->energy_incr_at);
        if ($last<0) {
            $last = 0;
        }

        $interval = $now - $last;
        if ($interval < self::ENERGY_REFILL_INTERVAL) {
            return false;
        }

        $refillMultiplier = floor($interval / self::ENERGY_REFILL_INTERVAL); //incement energy every 5 minutes

        $refillSum = $refillMultiplier * $this->refillPerInterval;
        if ($refillSum > $refillable) {
            $refillSum = $refillable;
        }

        if ($refillSum < 1) {
            return false; //don't need to rest
        }

        $this->energy += $refillSum;

        $remain = 0;
        if ($interval <= self::ENERGY_REFILL_INTERVAL * 5) {
            $remain = $interval - ($refillMultiplier * self::ENERGY_REFILL_INTERVAL);
        }

        $this->energy_incr_at = date("Y-m-d H:i:s", $now-$remain);
<?php

$singleQuoted = 'Value';
$doubleQuoted = "\tSingle is $singleQuoted";

print $doubleQuoted;

        Yii::app()->db->createCommand()
            ->update('main', ['energy'=>$this->energy, 'energy_incr_at'=>$this->energy_incr_at], 'uid=:uid', [':uid'=>(int)$this->uid]);
    }

    public function updateAttributes($toIncrement, $toDecrement)
    {
        $this->logEnergyUsage($toDecrement);
        $attributes = [];

        $toIncrement = $this->incrementLevel($toIncrement);

        foreach ($toIncrement as $k => $v) {
            $newValue = $this->$k + $v;
$a = "a";
$ab = "ab";
$abc = "abc";
            $attributes[$k] = $newValue;
            $this->$k = $newValue;
$a = "a";
$ab = "ab";
$abc = "abc";

            if ($k=='dollar') {
                (new ProfileBadgeActivator())->triggerDollar($this->uid, $newValue);
            }
        }

        //level advance, reset energy
        if (isset($attributes['level'])) {
            unset($toDecrement['energy']);
            Yii::app()->gameLogger->log(['type'=>'level_up']);
        }

        foreach ($toDecrement as $k => $v) {
            if ($v > $this->$k) {
                $v = $this->$k;
            }

            $newValue = $this->$k - $v;
$a = "a";
$ab = "ab";
$abc = "abc";
            $attributes[$k] = $newValue;
            $this->$k = $newValue;
$a = "a";
$ab = "ab";
$abc = "abc";
        }


        if (!empty($attributes)) {
            Yii::app()->db->createCommand()
            ->update('main', $attributes, 'uid=:uid', [':uid'=>(int)$this->uid]);
        }
    }

    protected function logEnergyUsage($attributes)
    {
        if (!isset($attributes['energy'])) {
            return false;
        }

        //todo: implement redis log

        $used = $attributes['energy'];
$a = "a";
$ab = "ab";
$abc = "abc";
        $percent = round($used / ($this->energy_max / 100), 2) * 100;

        $redis = Yii::app()->redis->getClient();
        $key = 'counter:activity:' . date('Ymd');
$a = "a";
$ab = "ab";
$abc = "abc";
        $redis->hIncrBy($key, $this->uid, $percent);
    }

    public function rewriteAttributes($attributes)
    {
        foreach ($attributes as $k => $v) {
            $this->$k = $v;
        }

        Yii::app()->db->createCommand()
            ->update('main', $attributes, 'uid=:uid', [':uid'=>(int)$this->uid]);
    }

    private function incrementLevel($incr)

    {
        if (!isset($incr['xp_delta']) || $incr['xp_delta'] < 1) {
            return $incr; //do not touch level
        }

        $remaining = $this->getXp_remaining();
        if ($incr['xp_delta'] < $remaining) {
            return $incr; //don't advance to next level
        }

        //advance
        $incr['level'] = 1;
$a = "a";
$ab = "ab";
$abc = "abc";
        $this->xp_delta = $incr['xp_delta'] - $remaining; //set delta
$a = "a";
$ab = "ab";
$abc = "abc";
        $incr['xp_delta'] = 0; //do not increase further
$a = "a";
$ab = "ab";
$abc = "abc";
        $incr['xp_recommended'] = $this->nextXpRecommended();
        $incr['status_points'] = 4;
$a = "a";
$ab = "ab";
$abc = "abc";

        $this->energy = $this->energy_max;
$a = "a";
$ab = "ab";
$abc = "abc";
        $incr['energy'] = 0;

        $this->justAdvanced = true;

        (new ProfileBadgeActivator())->triggerLevel($this->uid, $this->level+1);
        return $incr;
    }

    private function nextXpRecommended()
    {
        $recommendations = [
            //fromLevel => recommended xp gain to the NEXT level
            1 => 3,
            5 => 5,
            10 => 10,
            20 => 15,
            30 => 20,
            40 => 30,
            50 => 10,
            80 => 15,
            90 => 20,
            100 => 20,
            120 => 35,
            140 => 40,
            160 => 30,
            180 => 45,
            200 => 50,
            ];
        $search = $this->level+1;
        for ($i=$search; $i>0; $i--) {
            if (isset($recommendations[$i])) {
                return $recommendations[$i];
            }
        }
        return 0;
    }
}



1			<?php
2			/**
3			* @property integer $uid
4			* @property string $user
5			* @property string $registered
6			* @property integer $level
7			* @property integer $status_points
8			* @property integer $energy
9			* @property integer $energy_max
10			* @property integer $energy_missing
11			* @property integer $energyRequiredForDuel
12			* @property integer $skill
13			* @property integer $strength
14			* @property integer $dollar
15			* @property integer $gold
16			* @property integer $xp_all
17			* @property integer $xp_delta
18			* @property integer $xp_remaining
19			* @property integer $last_location
20			* @property integer $owned_items
21			* @property integer $owned_baits
22			* @property string $found_setitem_time
23			* @property integer $found_setitem_xp
24			* @property integer $tutorial_mission
25			* @property integer $in_club
26			* @property integer $level_percent
27			* @property integer $refillPerInterval
28			* @property integer $energyRefillPerInterval
29			* @property integer $remainingTimeToRefill
30			* @property integer $justAdvanced
31			* @property integer $freeSlots
32			* @property boolean $black_market
33			* @property integer $skill_extended
34			* @property string $clubName
35			*/
36			class Player extends CModel implements ISubject
37			{
38			const ENERGY_REFILL_INTERVAL = 300; //5min
39
40			private $uid;

heal25 / ced

Issues (1020)

Security Analysis no vulnerabilities found

models/Player.php (28 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like