Issues (130)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/main.php (1 issue)

Labels
Severity
1
<?php
2
3
//  ------------------------------------------------------------------------ //
4
//                XOOPS - PHP Content Management System                      //
5
//                    Copyright (c) 2000 XOOPS.org                           //
6
//                       <https://xoops.org>                             //
7
//  ------------------------------------------------------------------------ //
8
//  This program is free software; you can redistribute it and/or modify     //
9
//  it under the terms of the GNU General Public License as published by     //
10
//  the Free Software Foundation; either version 2 of the License, or        //
11
//  (at your option) any later version.                                      //
12
//                                                                           //
13
//  You may not change or alter any portion of this comment or credits       //
14
//  of supporting developers from this source code or any supporting         //
15
//  source code which is considered copyrighted (c) material of the          //
16
//  original comment or credit authors.                                      //
17
//                                                                           //
18
//  This program is distributed in the hope that it will be useful,          //
19
//  but WITHOUT ANY WARRANTY; without even the implied warranty of           //
20
//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            //
21
//  GNU General Public License for more details.                             //
22
//                                                                           //
23
//  You should have received a copy of the GNU General Public License        //
24
//  along with this program; if not, write to the Free Software              //
25
//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA //
26
//  ------------------------------------------------------------------------ //
27
28
/**
29
 * Admin page
30
 *
31
 * @package    chess
32
 * @subpackage admin
33
 */
34
35
/**#@+
36
 */
37
require_once __DIR__ . '/admin_header.php';
38
require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php';
39
require_once XOOPS_ROOT_PATH . '/class/pagenav.php';
40
require_once XOOPS_ROOT_PATH . '/modules/chess/include/functions.php';
41
42
// user input
43
$op    = chess_sanitize(@$_GET['op']);
44
$start = (int)@$_GET['start']; // offset of first row of table to display (default to 0)
45
46
// get maximum number of items to display on a page, and constrain it to a reasonable value
47
$max_items_to_display = chess_moduleConfig('max_items');
48
$max_items_to_display = min(max($max_items_to_display, 1), 1000);
49
50
xoops_cp_header();
51
52
switch ($op) {
53
    case 'suspended_games':
54
        chess_admin_suspended_games();
55
        break;
56
    case 'active_games':
57
        chess_admin_active_games();
58
        break;
59
    case 'challenges':
60
        chess_admin_challenges();
61
        break;
62
    default:
63
        chess_admin_menu();
64
        break;
65
}
66
67
xoops_cp_footer();
68
/**#@-*/
69
70
/**
71
 * Admin menu
72
 */
73
function chess_admin_menu()
74
{
75
    global $xoopsModule;
76
77
    echo '
78
    <h4> ' . _AM_CHESS_CONF . ' </h4>'
79
        //    <table width='100%' border='0' cellspacing='1' class='outer'>
80
        //    <tr>
81
        //        <td><a href='" . XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/admin/index.php?op=suspended_games'>" . _AM_CHESS_SUSPENDED_GAMES . '</a>
82
        //        <td>' . _AM_CHESS_SUSPENDED_GAMES_DES . "</td>
83
        //    </tr>
84
        //    <tr>
85
        //        <td><a href='" . XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/admin/index.php?op=active_games'>" . _AM_CHESS_ACTIVE_GAMES . '</a>
86
        //        <td>' . _AM_CHESS_ACTIVE_GAMES_DES . "</td>
87
        //    </tr>
88
        //    <tr>
89
        //        <td><a href='" . XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/admin/index.php?op=challenges'>" . _AM_CHESS_CHALLENGES . '</a>
90
        //        <td>' . _AM_CHESS_CHALLENGES_DES . "</td>
91
        //    </tr>
92
        //    <tr>
93
        //        <td><a href='" . XOOPS_URL . '/modules/system/admin.php?fct=preferences&amp;op=showmod&amp;mod=' . $xoopsModule->getVar('mid') . "'>" . _AM_CHESS_PREFS . '</a>
94
        //        <td>' . _AM_CHESS_PREFS_DESC . '</td>
95
        //    </tr>
96
        //    </table>
97
        //'
98
    ;
99
}
100
101
/**
102
 * Display suspended games
103
 */
104
function chess_admin_suspended_games()
105
{
106
    global $start, $max_items_to_display, $op, $xoopsDB, $xoopsModule;
107
108
    $memberHandler = xoops_getHandler('member');
109
110
    // Two queries are performed, one without a limit clause to count the total number of rows for the page navigator,
111
112
    // and one with a limit clause to get the data for display on the current page.
113
114
    // SQL_CALC_FOUND_ROWS and FOUND_ROWS(), available in MySQL 4.0.0, provide a more efficient way of doing this.
115
116
    $games_table = $xoopsDB->prefix('chess_games');
117
118
    $result = $xoopsDB->query("SELECT COUNT(*) FROM $games_table WHERE suspended != ''");
119
120
    [$num_rows] = $xoopsDB->fetchRow($result);
121
122
    $xoopsDB->freeRecordSet($result);
123
124
    // Sort by date-suspended in ascending order, so that games that were suspended the earliest will be displayed
125
126
    // at the top, and can more easily be arbitrated on a first-come first-serve basis.
127
128
    // Note that the suspended column begins with the date-suspended in the format 'YYYY-MM-DD HH:MM:SS', so the sorting
129
130
    // will work as desired.
131
132
    $result = $xoopsDB->query(
133
        trim(
134
            "
135
        SELECT   game_id, white_uid, black_uid, UNIX_TIMESTAMP(start_date) AS start_date, suspended
136
        FROM     $games_table
137
        WHERE    suspended != ''
138
        ORDER BY suspended
139
        LIMIT    $start, $max_items_to_display
140
    "
141
        )
142
    );
143
144
    if ($xoopsDB->getRowsNum($result) > 0) {
145
        echo '<h3>' . _AM_CHESS_SUSPENDED_GAMES . "</h3>\n";
146
147
        while (false !== ($row = $xoopsDB->fetchArray($result))) {
148
            $user_white = $memberHandler->getUser($row['white_uid']);
0 ignored issues
show
The method getUser() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsAvatarHandler or XoopsPersistableObjectHandler. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

148
            /** @scrutinizer ignore-call */ 
149
            $user_white = $memberHandler->getUser($row['white_uid']);
Loading history...
149
150
            $username_white = is_object($user_white) ? $user_white->getVar('uname') : '(open)';
151
152
            $user_black = $memberHandler->getUser($row['black_uid']);
153
154
            $username_black = is_object($user_black) ? $user_black->getVar('uname') : '(open)';
155
156
            $date = $row['start_date'] ? date('Y.m.d', $row['start_date']) : 'not yet started';
157
158
            $title_text = _AM_CHESS_GAME . " #{$row['game_id']}&nbsp;&nbsp;&nbsp;$username_white " . _AM_CHESS_VS . " $username_black&nbsp;&nbsp;&nbsp;($date)";
159
160
            $form = new XoopsThemeForm($title_text, "game_{$row['game_id']}", XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/game.php?game_id={$row['game_id']}", 'post', true);
161
162
            [$date, $suspender_uid, $type, $explain] = explode('|', $row['suspended']);
163
164
            switch ($type) {
165
                case 'arbiter_suspend':
166
                    $type_display = _AM_CHESS_SUSP_TYPE_ARBITER;
167
                    break;
168
                case 'want_arbitration':
169
                    $type_display = _AM_CHESS_SUSP_TYPE_PLAYER;
170
                    break;
171
                default:
172
                    $type_display = _AM_CHESS_ERROR;
173
                    break;
174
            }
175
176
            $suspender_user = $memberHandler->getUser($suspender_uid);
177
178
            $suspender_username = is_object($suspender_user) ? $suspender_user->getVar('uname') : _AM_CHESS_UNKNOWN_USER;
179
180
            $form->addElement(new XoopsFormLabel(_AM_CHESS_WHEN_SUSPENDED . ':', formatTimestamp(strtotime($date))));
181
182
            $form->addElement(new XoopsFormLabel(_AM_CHESS_SUSPENDED_BY . ':', $suspender_username));
183
184
            $form->addElement(new XoopsFormLabel(_AM_CHESS_SUSPENSION_TYPE . ':', $type_display));
185
186
            $form->addElement(new XoopsFormLabel(_AM_CHESS_SUSPENSION_REASON . ':', $explain));
187
188
            $form->addElement(new XoopsFormButton('', 'submit', _AM_CHESS_ARBITRATE_SUBMIT, 'submit'));
189
190
            $form->addElement(new XoopsFormHidden('show_arbiter_ctrl', 1));
191
192
            $form->display();
193
        }
194
195
        $pagenav = new XoopsPageNav($num_rows, $max_items_to_display, $start, 'start', "op=$op");
196
197
        echo '<div align="center">' . $pagenav->renderNav() . "&nbsp;</div>\n";
198
    } else {
199
        echo '<h3>' . _AM_CHESS_NO_SUSPENDED_GAMES . "</h3>\n";
200
    }
201
202
    $xoopsDB->freeRecordSet($result);
203
}
204
205
/**
206
 * Display active games
207
 */
208
function chess_admin_active_games()
209
{
210
    global $start, $max_items_to_display, $op, $xoopsDB, $xoopsModule;
211
212
    $memberHandler = xoops_getHandler('member');
213
214
    // Two queries are performed, one without a limit clause to count the total number of rows for the page navigator,
215
216
    // and one with a limit clause to get the data for display on the current page.
217
218
    // SQL_CALC_FOUND_ROWS and FOUND_ROWS(), available in MySQL 4.0.0, provide a more efficient way of doing this.
219
220
    $games_table = $xoopsDB->prefix('chess_games');
221
222
    $result = $xoopsDB->query("SELECT COUNT(*) FROM $games_table WHERE pgn_result = '*' and suspended = ''");
223
224
    [$num_rows] = $xoopsDB->fetchRow($result);
225
226
    $xoopsDB->freeRecordSet($result);
227
228
    $result = $xoopsDB->query(
229
        trim(
230
            "
231
        SELECT   game_id, white_uid, black_uid, UNIX_TIMESTAMP(start_date) AS start_date, GREATEST(create_date,start_date,last_date) AS most_recent_date
232
        FROM     $games_table
233
        WHERE    pgn_result = '*' and suspended = ''
234
        ORDER BY most_recent_date DESC
235
        LIMIT    $start, $max_items_to_display
236
    "
237
        )
238
    );
239
240
    if ($xoopsDB->getRowsNum($result) > 0) {
241
        echo '<h3>' . _AM_CHESS_ACTIVE_GAMES . "</h3>\n";
242
243
        while (false !== ($row = $xoopsDB->fetchArray($result))) {
244
            $user_white = $memberHandler->getUser($row['white_uid']);
245
246
            $username_white = is_object($user_white) ? $user_white->getVar('uname') : '(open)';
247
248
            $user_black = $memberHandler->getUser($row['black_uid']);
249
250
            $username_black = is_object($user_black) ? $user_black->getVar('uname') : '(open)';
251
252
            $date = $row['start_date'] ? date('Y.m.d', $row['start_date']) : 'not yet started';
253
254
            $title_text = _AM_CHESS_GAME . " #{$row['game_id']}&nbsp;&nbsp;&nbsp;$username_white " . _AM_CHESS_VS . " $username_black&nbsp;&nbsp;&nbsp;($date)";
255
256
            $form = new XoopsThemeForm($title_text, "game_{$row['game_id']}", XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/game.php?game_id={$row['game_id']}", 'post', true);
257
258
            $form->addElement(new XoopsFormButton('', 'submit', _AM_CHESS_ARBITRATE_SUBMIT, 'submit'));
259
260
            $form->addElement(new XoopsFormHidden('show_arbiter_ctrl', 1));
261
262
            $form->display();
263
        }
264
265
        $pagenav = new XoopsPageNav($num_rows, $max_items_to_display, $start, 'start', "op=$op");
266
267
        echo '<div align="center">' . $pagenav->renderNav() . "&nbsp;</div>\n";
268
    } else {
269
        echo '<h3>' . _AM_CHESS_NO_ACTIVE_GAMES . "</h3>\n";
270
    }
271
272
    $xoopsDB->freeRecordSet($result);
273
}
274
275
/**
276
 * Display challenges
277
 */
278
function chess_admin_challenges()
279
{
280
    global $start, $max_items_to_display, $op, $xoopsDB, $xoopsModule;
281
282
    $memberHandler = xoops_getHandler('member');
283
284
    // Two queries are performed, one without a limit clause to count the total number of rows for the page navigator,
285
286
    // and one with a limit clause to get the data for display on the current page.
287
288
    // SQL_CALC_FOUND_ROWS and FOUND_ROWS(), available in MySQL 4.0.0, provide a more efficient way of doing this.
289
290
    $challenges_table = $xoopsDB->prefix('chess_challenges');
291
292
    $result = $xoopsDB->query("SELECT COUNT(*) FROM $challenges_table");
293
294
    [$num_rows] = $xoopsDB->fetchRow($result);
295
296
    $xoopsDB->freeRecordSet($result);
297
298
    $result = $xoopsDB->query(
299
        trim(
300
            "
301
        SELECT   challenge_id, game_type, color_option, player1_uid, player2_uid, UNIX_TIMESTAMP(create_date) AS create_date
302
        FROM     $challenges_table
303
        ORDER BY create_date DESC
304
        LIMIT    $start, $max_items_to_display
305
    "
306
        )
307
    );
308
309
    if ($xoopsDB->getRowsNum($result) > 0) {
310
        echo '<h3>' . _AM_CHESS_CHALLENGES . "</h3>\n";
311
312
        while (false !== ($row = $xoopsDB->fetchArray($result))) {
313
            $user_player1 = $memberHandler->getUser($row['player1_uid']);
314
315
            $username_player1 = is_object($user_player1) ? $user_player1->getVar('uname') : '?';
316
317
            $user_player2 = $memberHandler->getUser($row['player2_uid']);
318
319
            $username_player2 = is_object($user_player2) ? $user_player2->getVar('uname') : '(open)';
320
321
            $date = date('Y.m.d', $row['create_date']);
322
323
            $title_text = _AM_CHESS_CHALLENGE . " #{$row['challenge_id']}&nbsp;&nbsp;&nbsp;$username_player1 " . _AM_CHESS_CHALLENGED . ": $username_player2&nbsp;&nbsp;&nbsp;(" . _AM_CHESS_CREATED . " $date)";
324
325
            $form = new XoopsThemeForm($title_text, "challenge_{$row['challenge_id']}", XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/create.php?challenge_id={$row['challenge_id']}", 'post', true);
326
327
            $form->addElement(new XoopsFormButton('', 'submit', _AM_CHESS_ARBITRATE_SUBMIT, 'submit'));
328
329
            $form->addElement(new XoopsFormHidden('show_arbiter_ctrl', 1));
330
331
            $form->display();
332
        }
333
334
        $pagenav = new XoopsPageNav($num_rows, $max_items_to_display, $start, 'start', "op=$op");
335
336
        echo '<div align="center">' . $pagenav->renderNav() . "&nbsp;</div>\n";
337
    } else {
338
        echo '<h3>' . _AM_CHESS_NO_CHALLENGES . "</h3>\n";
339
    }
340
341
    $xoopsDB->freeRecordSet($result);
342
}
343