mambax7 /
chess
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||
| 2 | |||
| 3 | // ------------------------------------------------------------------------ // |
||
| 4 | // XOOPS - PHP Content Management System // |
||
| 5 | // Copyright (c) 2000 XOOPS.org // |
||
| 6 | // <https://xoops.org> // |
||
| 7 | // ------------------------------------------------------------------------ // |
||
| 8 | // This program is free software; you can redistribute it and/or modify // |
||
| 9 | // it under the terms of the GNU General Public License as published by // |
||
| 10 | // the Free Software Foundation; either version 2 of the License, or // |
||
| 11 | // (at your option) any later version. // |
||
| 12 | // // |
||
| 13 | // You may not change or alter any portion of this comment or credits // |
||
| 14 | // of supporting developers from this source code or any supporting // |
||
| 15 | // source code which is considered copyrighted (c) material of the // |
||
| 16 | // original comment or credit authors. // |
||
| 17 | // // |
||
| 18 | // This program is distributed in the hope that it will be useful, // |
||
| 19 | // but WITHOUT ANY WARRANTY; without even the implied warranty of // |
||
| 20 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // |
||
| 21 | // GNU General Public License for more details. // |
||
| 22 | // // |
||
| 23 | // You should have received a copy of the GNU General Public License // |
||
| 24 | // along with this program; if not, write to the Free Software // |
||
| 25 | // Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA // |
||
| 26 | // ------------------------------------------------------------------------ // |
||
| 27 | |||
| 28 | /** |
||
| 29 | * Admin page |
||
| 30 | * |
||
| 31 | * @package chess |
||
| 32 | * @subpackage admin |
||
| 33 | */ |
||
| 34 | |||
| 35 | /**#@+ |
||
| 36 | */ |
||
| 37 | require_once __DIR__ . '/admin_header.php'; |
||
| 38 | require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||
| 39 | require_once XOOPS_ROOT_PATH . '/class/pagenav.php'; |
||
| 40 | require_once XOOPS_ROOT_PATH . '/modules/chess/include/functions.php'; |
||
| 41 | |||
| 42 | // user input |
||
| 43 | $op = chess_sanitize(@$_GET['op']); |
||
| 44 | $start = (int)@$_GET['start']; // offset of first row of table to display (default to 0) |
||
| 45 | |||
| 46 | // get maximum number of items to display on a page, and constrain it to a reasonable value |
||
| 47 | $max_items_to_display = chess_moduleConfig('max_items'); |
||
| 48 | $max_items_to_display = min(max($max_items_to_display, 1), 1000); |
||
| 49 | |||
| 50 | xoops_cp_header(); |
||
| 51 | |||
| 52 | switch ($op) { |
||
| 53 | case 'suspended_games': |
||
| 54 | chess_admin_suspended_games(); |
||
| 55 | break; |
||
| 56 | case 'active_games': |
||
| 57 | chess_admin_active_games(); |
||
| 58 | break; |
||
| 59 | case 'challenges': |
||
| 60 | chess_admin_challenges(); |
||
| 61 | break; |
||
| 62 | default: |
||
| 63 | chess_admin_menu(); |
||
| 64 | break; |
||
| 65 | } |
||
| 66 | |||
| 67 | xoops_cp_footer(); |
||
| 68 | /**#@-*/ |
||
| 69 | |||
| 70 | /** |
||
| 71 | * Admin menu |
||
| 72 | */ |
||
| 73 | function chess_admin_menu() |
||
| 74 | { |
||
| 75 | global $xoopsModule; |
||
| 76 | |||
| 77 | echo ' |
||
| 78 | <h4> ' . _AM_CHESS_CONF . ' </h4>' |
||
| 79 | // <table width='100%' border='0' cellspacing='1' class='outer'> |
||
| 80 | // <tr> |
||
| 81 | // <td><a href='" . XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/admin/index.php?op=suspended_games'>" . _AM_CHESS_SUSPENDED_GAMES . '</a> |
||
| 82 | // <td>' . _AM_CHESS_SUSPENDED_GAMES_DES . "</td> |
||
| 83 | // </tr> |
||
| 84 | // <tr> |
||
| 85 | // <td><a href='" . XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/admin/index.php?op=active_games'>" . _AM_CHESS_ACTIVE_GAMES . '</a> |
||
| 86 | // <td>' . _AM_CHESS_ACTIVE_GAMES_DES . "</td> |
||
| 87 | // </tr> |
||
| 88 | // <tr> |
||
| 89 | // <td><a href='" . XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/admin/index.php?op=challenges'>" . _AM_CHESS_CHALLENGES . '</a> |
||
| 90 | // <td>' . _AM_CHESS_CHALLENGES_DES . "</td> |
||
| 91 | // </tr> |
||
| 92 | // <tr> |
||
| 93 | // <td><a href='" . XOOPS_URL . '/modules/system/admin.php?fct=preferences&op=showmod&mod=' . $xoopsModule->getVar('mid') . "'>" . _AM_CHESS_PREFS . '</a> |
||
| 94 | // <td>' . _AM_CHESS_PREFS_DESC . '</td> |
||
| 95 | // </tr> |
||
| 96 | // </table> |
||
| 97 | //' |
||
| 98 | ; |
||
| 99 | } |
||
| 100 | |||
| 101 | /** |
||
| 102 | * Display suspended games |
||
| 103 | */ |
||
| 104 | function chess_admin_suspended_games() |
||
| 105 | { |
||
| 106 | global $start, $max_items_to_display, $op, $xoopsDB, $xoopsModule; |
||
| 107 | |||
| 108 | $memberHandler = xoops_getHandler('member'); |
||
| 109 | |||
| 110 | // Two queries are performed, one without a limit clause to count the total number of rows for the page navigator, |
||
| 111 | |||
| 112 | // and one with a limit clause to get the data for display on the current page. |
||
| 113 | |||
| 114 | // SQL_CALC_FOUND_ROWS and FOUND_ROWS(), available in MySQL 4.0.0, provide a more efficient way of doing this. |
||
| 115 | |||
| 116 | $games_table = $xoopsDB->prefix('chess_games'); |
||
| 117 | |||
| 118 | $result = $xoopsDB->query("SELECT COUNT(*) FROM $games_table WHERE suspended != ''"); |
||
| 119 | |||
| 120 | [$num_rows] = $xoopsDB->fetchRow($result); |
||
| 121 | |||
| 122 | $xoopsDB->freeRecordSet($result); |
||
| 123 | |||
| 124 | // Sort by date-suspended in ascending order, so that games that were suspended the earliest will be displayed |
||
| 125 | |||
| 126 | // at the top, and can more easily be arbitrated on a first-come first-serve basis. |
||
| 127 | |||
| 128 | // Note that the suspended column begins with the date-suspended in the format 'YYYY-MM-DD HH:MM:SS', so the sorting |
||
| 129 | |||
| 130 | // will work as desired. |
||
| 131 | |||
| 132 | $result = $xoopsDB->query( |
||
| 133 | trim( |
||
| 134 | " |
||
| 135 | SELECT game_id, white_uid, black_uid, UNIX_TIMESTAMP(start_date) AS start_date, suspended |
||
| 136 | FROM $games_table |
||
| 137 | WHERE suspended != '' |
||
| 138 | ORDER BY suspended |
||
| 139 | LIMIT $start, $max_items_to_display |
||
| 140 | " |
||
| 141 | ) |
||
| 142 | ); |
||
| 143 | |||
| 144 | if ($xoopsDB->getRowsNum($result) > 0) { |
||
| 145 | echo '<h3>' . _AM_CHESS_SUSPENDED_GAMES . "</h3>\n"; |
||
| 146 | |||
| 147 | while (false !== ($row = $xoopsDB->fetchArray($result))) { |
||
| 148 | $user_white = $memberHandler->getUser($row['white_uid']); |
||
|
0 ignored issues
–
show
Bug
introduced
by
Loading history...
|
|||
| 149 | |||
| 150 | $username_white = is_object($user_white) ? $user_white->getVar('uname') : '(open)'; |
||
| 151 | |||
| 152 | $user_black = $memberHandler->getUser($row['black_uid']); |
||
| 153 | |||
| 154 | $username_black = is_object($user_black) ? $user_black->getVar('uname') : '(open)'; |
||
| 155 | |||
| 156 | $date = $row['start_date'] ? date('Y.m.d', $row['start_date']) : 'not yet started'; |
||
| 157 | |||
| 158 | $title_text = _AM_CHESS_GAME . " #{$row['game_id']} $username_white " . _AM_CHESS_VS . " $username_black ($date)"; |
||
| 159 | |||
| 160 | $form = new XoopsThemeForm($title_text, "game_{$row['game_id']}", XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/game.php?game_id={$row['game_id']}", 'post', true); |
||
| 161 | |||
| 162 | [$date, $suspender_uid, $type, $explain] = explode('|', $row['suspended']); |
||
| 163 | |||
| 164 | switch ($type) { |
||
| 165 | case 'arbiter_suspend': |
||
| 166 | $type_display = _AM_CHESS_SUSP_TYPE_ARBITER; |
||
| 167 | break; |
||
| 168 | case 'want_arbitration': |
||
| 169 | $type_display = _AM_CHESS_SUSP_TYPE_PLAYER; |
||
| 170 | break; |
||
| 171 | default: |
||
| 172 | $type_display = _AM_CHESS_ERROR; |
||
| 173 | break; |
||
| 174 | } |
||
| 175 | |||
| 176 | $suspender_user = $memberHandler->getUser($suspender_uid); |
||
| 177 | |||
| 178 | $suspender_username = is_object($suspender_user) ? $suspender_user->getVar('uname') : _AM_CHESS_UNKNOWN_USER; |
||
| 179 | |||
| 180 | $form->addElement(new XoopsFormLabel(_AM_CHESS_WHEN_SUSPENDED . ':', formatTimestamp(strtotime($date)))); |
||
| 181 | |||
| 182 | $form->addElement(new XoopsFormLabel(_AM_CHESS_SUSPENDED_BY . ':', $suspender_username)); |
||
| 183 | |||
| 184 | $form->addElement(new XoopsFormLabel(_AM_CHESS_SUSPENSION_TYPE . ':', $type_display)); |
||
| 185 | |||
| 186 | $form->addElement(new XoopsFormLabel(_AM_CHESS_SUSPENSION_REASON . ':', $explain)); |
||
| 187 | |||
| 188 | $form->addElement(new XoopsFormButton('', 'submit', _AM_CHESS_ARBITRATE_SUBMIT, 'submit')); |
||
| 189 | |||
| 190 | $form->addElement(new XoopsFormHidden('show_arbiter_ctrl', 1)); |
||
| 191 | |||
| 192 | $form->display(); |
||
| 193 | } |
||
| 194 | |||
| 195 | $pagenav = new XoopsPageNav($num_rows, $max_items_to_display, $start, 'start', "op=$op"); |
||
| 196 | |||
| 197 | echo '<div align="center">' . $pagenav->renderNav() . " </div>\n"; |
||
| 198 | } else { |
||
| 199 | echo '<h3>' . _AM_CHESS_NO_SUSPENDED_GAMES . "</h3>\n"; |
||
| 200 | } |
||
| 201 | |||
| 202 | $xoopsDB->freeRecordSet($result); |
||
| 203 | } |
||
| 204 | |||
| 205 | /** |
||
| 206 | * Display active games |
||
| 207 | */ |
||
| 208 | function chess_admin_active_games() |
||
| 209 | { |
||
| 210 | global $start, $max_items_to_display, $op, $xoopsDB, $xoopsModule; |
||
| 211 | |||
| 212 | $memberHandler = xoops_getHandler('member'); |
||
| 213 | |||
| 214 | // Two queries are performed, one without a limit clause to count the total number of rows for the page navigator, |
||
| 215 | |||
| 216 | // and one with a limit clause to get the data for display on the current page. |
||
| 217 | |||
| 218 | // SQL_CALC_FOUND_ROWS and FOUND_ROWS(), available in MySQL 4.0.0, provide a more efficient way of doing this. |
||
| 219 | |||
| 220 | $games_table = $xoopsDB->prefix('chess_games'); |
||
| 221 | |||
| 222 | $result = $xoopsDB->query("SELECT COUNT(*) FROM $games_table WHERE pgn_result = '*' and suspended = ''"); |
||
| 223 | |||
| 224 | [$num_rows] = $xoopsDB->fetchRow($result); |
||
| 225 | |||
| 226 | $xoopsDB->freeRecordSet($result); |
||
| 227 | |||
| 228 | $result = $xoopsDB->query( |
||
| 229 | trim( |
||
| 230 | " |
||
| 231 | SELECT game_id, white_uid, black_uid, UNIX_TIMESTAMP(start_date) AS start_date, GREATEST(create_date,start_date,last_date) AS most_recent_date |
||
| 232 | FROM $games_table |
||
| 233 | WHERE pgn_result = '*' and suspended = '' |
||
| 234 | ORDER BY most_recent_date DESC |
||
| 235 | LIMIT $start, $max_items_to_display |
||
| 236 | " |
||
| 237 | ) |
||
| 238 | ); |
||
| 239 | |||
| 240 | if ($xoopsDB->getRowsNum($result) > 0) { |
||
| 241 | echo '<h3>' . _AM_CHESS_ACTIVE_GAMES . "</h3>\n"; |
||
| 242 | |||
| 243 | while (false !== ($row = $xoopsDB->fetchArray($result))) { |
||
| 244 | $user_white = $memberHandler->getUser($row['white_uid']); |
||
| 245 | |||
| 246 | $username_white = is_object($user_white) ? $user_white->getVar('uname') : '(open)'; |
||
| 247 | |||
| 248 | $user_black = $memberHandler->getUser($row['black_uid']); |
||
| 249 | |||
| 250 | $username_black = is_object($user_black) ? $user_black->getVar('uname') : '(open)'; |
||
| 251 | |||
| 252 | $date = $row['start_date'] ? date('Y.m.d', $row['start_date']) : 'not yet started'; |
||
| 253 | |||
| 254 | $title_text = _AM_CHESS_GAME . " #{$row['game_id']} $username_white " . _AM_CHESS_VS . " $username_black ($date)"; |
||
| 255 | |||
| 256 | $form = new XoopsThemeForm($title_text, "game_{$row['game_id']}", XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/game.php?game_id={$row['game_id']}", 'post', true); |
||
| 257 | |||
| 258 | $form->addElement(new XoopsFormButton('', 'submit', _AM_CHESS_ARBITRATE_SUBMIT, 'submit')); |
||
| 259 | |||
| 260 | $form->addElement(new XoopsFormHidden('show_arbiter_ctrl', 1)); |
||
| 261 | |||
| 262 | $form->display(); |
||
| 263 | } |
||
| 264 | |||
| 265 | $pagenav = new XoopsPageNav($num_rows, $max_items_to_display, $start, 'start', "op=$op"); |
||
| 266 | |||
| 267 | echo '<div align="center">' . $pagenav->renderNav() . " </div>\n"; |
||
| 268 | } else { |
||
| 269 | echo '<h3>' . _AM_CHESS_NO_ACTIVE_GAMES . "</h3>\n"; |
||
| 270 | } |
||
| 271 | |||
| 272 | $xoopsDB->freeRecordSet($result); |
||
| 273 | } |
||
| 274 | |||
| 275 | /** |
||
| 276 | * Display challenges |
||
| 277 | */ |
||
| 278 | function chess_admin_challenges() |
||
| 279 | { |
||
| 280 | global $start, $max_items_to_display, $op, $xoopsDB, $xoopsModule; |
||
| 281 | |||
| 282 | $memberHandler = xoops_getHandler('member'); |
||
| 283 | |||
| 284 | // Two queries are performed, one without a limit clause to count the total number of rows for the page navigator, |
||
| 285 | |||
| 286 | // and one with a limit clause to get the data for display on the current page. |
||
| 287 | |||
| 288 | // SQL_CALC_FOUND_ROWS and FOUND_ROWS(), available in MySQL 4.0.0, provide a more efficient way of doing this. |
||
| 289 | |||
| 290 | $challenges_table = $xoopsDB->prefix('chess_challenges'); |
||
| 291 | |||
| 292 | $result = $xoopsDB->query("SELECT COUNT(*) FROM $challenges_table"); |
||
| 293 | |||
| 294 | [$num_rows] = $xoopsDB->fetchRow($result); |
||
| 295 | |||
| 296 | $xoopsDB->freeRecordSet($result); |
||
| 297 | |||
| 298 | $result = $xoopsDB->query( |
||
| 299 | trim( |
||
| 300 | " |
||
| 301 | SELECT challenge_id, game_type, color_option, player1_uid, player2_uid, UNIX_TIMESTAMP(create_date) AS create_date |
||
| 302 | FROM $challenges_table |
||
| 303 | ORDER BY create_date DESC |
||
| 304 | LIMIT $start, $max_items_to_display |
||
| 305 | " |
||
| 306 | ) |
||
| 307 | ); |
||
| 308 | |||
| 309 | if ($xoopsDB->getRowsNum($result) > 0) { |
||
| 310 | echo '<h3>' . _AM_CHESS_CHALLENGES . "</h3>\n"; |
||
| 311 | |||
| 312 | while (false !== ($row = $xoopsDB->fetchArray($result))) { |
||
| 313 | $user_player1 = $memberHandler->getUser($row['player1_uid']); |
||
| 314 | |||
| 315 | $username_player1 = is_object($user_player1) ? $user_player1->getVar('uname') : '?'; |
||
| 316 | |||
| 317 | $user_player2 = $memberHandler->getUser($row['player2_uid']); |
||
| 318 | |||
| 319 | $username_player2 = is_object($user_player2) ? $user_player2->getVar('uname') : '(open)'; |
||
| 320 | |||
| 321 | $date = date('Y.m.d', $row['create_date']); |
||
| 322 | |||
| 323 | $title_text = _AM_CHESS_CHALLENGE . " #{$row['challenge_id']} $username_player1 " . _AM_CHESS_CHALLENGED . ": $username_player2 (" . _AM_CHESS_CREATED . " $date)"; |
||
| 324 | |||
| 325 | $form = new XoopsThemeForm($title_text, "challenge_{$row['challenge_id']}", XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/create.php?challenge_id={$row['challenge_id']}", 'post', true); |
||
| 326 | |||
| 327 | $form->addElement(new XoopsFormButton('', 'submit', _AM_CHESS_ARBITRATE_SUBMIT, 'submit')); |
||
| 328 | |||
| 329 | $form->addElement(new XoopsFormHidden('show_arbiter_ctrl', 1)); |
||
| 330 | |||
| 331 | $form->display(); |
||
| 332 | } |
||
| 333 | |||
| 334 | $pagenav = new XoopsPageNav($num_rows, $max_items_to_display, $start, 'start', "op=$op"); |
||
| 335 | |||
| 336 | echo '<div align="center">' . $pagenav->renderNav() . " </div>\n"; |
||
| 337 | } else { |
||
| 338 | echo '<h3>' . _AM_CHESS_NO_CHALLENGES . "</h3>\n"; |
||
| 339 | } |
||
| 340 | |||
| 341 | $xoopsDB->freeRecordSet($result); |
||
| 342 | } |
||
| 343 |