Issues (130)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

blocks/blocks.php (6 issues)

1
<?php
2
3
//  ------------------------------------------------------------------------ //
4
//                XOOPS - PHP Content Management System                      //
5
//                    Copyright (c) 2000 XOOPS.org                           //
6
//                       <https://xoops.org>                             //
7
//  ------------------------------------------------------------------------ //
8
//  This program is free software; you can redistribute it and/or modify     //
9
//  it under the terms of the GNU General Public License as published by     //
10
//  the Free Software Foundation; either version 2 of the License, or        //
11
//  (at your option) any later version.                                      //
12
//                                                                           //
13
//  You may not change or alter any portion of this comment or credits       //
14
//  of supporting developers from this source code or any supporting         //
15
//  source code which is considered copyrighted (c) material of the          //
16
//  original comment or credit authors.                                      //
17
//                                                                           //
18
//  This program is distributed in the hope that it will be useful,          //
19
//  but WITHOUT ANY WARRANTY; without even the implied warranty of           //
20
//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            //
21
//  GNU General Public License for more details.                             //
22
//                                                                           //
23
//  You should have received a copy of the GNU General Public License        //
24
//  along with this program; if not, write to the Free Software              //
25
//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA //
26
//  ------------------------------------------------------------------------ //
27
28
/**
29
 * Chess module blocks
30
 *
31
 * @package    chess
32
 * @subpackage blocks
33
 *
34
 * @see        $modversion['blocks'] in xoops_version.php
35
 */
36
37
/**#@+
38
 */
39
require_once XOOPS_ROOT_PATH . '/modules/chess/include/constants.inc.php';
40
require_once XOOPS_ROOT_PATH . '/modules/chess/include/functions.php';
41
/**#@-*/
42
43
/**
44
 * Generate Smarty template variables for Recent Games block.
45
 *
46
 * @param array $options
47
 * @return array
48
 */
49
function b_chess_games_show($options)
50
{
51
    global $xoopsModule, $xoopsDB;
52
53
    // don't display this block within owning module
54
55
    if (is_object($xoopsModule) && 'chess' == $xoopsModule->getVar('dirname')) {
56
        return [];
57
    }
58
59
    $table = $xoopsDB->prefix('chess_games');
60
61
    $limit = (int)$options[0]; // sanitize with intval()
62
63
    $where = 'white_uid != black_uid';
64
65
    switch ($options[1]) {
66
        case 1:
67
            $where .= " AND pgn_result = '*'";
68
            break;
69
        case 2:
70
            $where .= " AND pgn_result != '*'";
71
            break;
72
    }
73
74
    if (1 == $options[2]) {
75
        $where .= " AND is_rated = '1'";
76
    }
77
78
    $result = $xoopsDB->query(
79
        trim(
80
            "
81
        SELECT   game_id, fen_active_color, white_uid, black_uid, pgn_result, UNIX_TIMESTAMP(create_date) AS create_date,
82
                 UNIX_TIMESTAMP(start_date) AS start_date, UNIX_TIMESTAMP(last_date) AS last_date,
83
                 UNIX_TIMESTAMP(GREATEST(create_date,start_date,last_date)) AS most_recent_date
84
        FROM     $table
85
        WHERE    $where
86
        ORDER BY most_recent_date DESC
87
        LIMIT    $limit
88
    "
89
        )
90
    );
91
92
    // user IDs that will require mapping to usernames
93
94
    $userids = [];
95
96
    $games = [];
97
98
    while (false !== ($row = $xoopsDB->fetchArray($result))) {
99
        $games[] = [
100
            'game_id'          => $row['game_id'],
101
            'white_uid'        => $row['white_uid'],
102
            'black_uid'        => $row['black_uid'],
103
            'date'             => $row['most_recent_date'],
104
            'fen_active_color' => $row['fen_active_color'],
105
            'pgn_result'       => $row['pgn_result'],
106
        ];
107
108
        // save user IDs that will require mapping to usernames
109
110
        if ($row['white_uid']) {
111
            $userids[$row['white_uid']] = 1;
112
        }
113
114
        if ($row['black_uid']) {
115
            $userids[$row['black_uid']] = 1;
116
        }
117
    }
118
119
    $xoopsDB->freeRecordSet($result);
120
121
    // get mapping of user IDs to usernames
122
123
    $memberHandler = xoops_getHandler('member');
124
125
    $criteria = new \Criteria('uid', '(' . implode(',', array_keys($userids)) . ')', 'IN');
126
127
    $usernames = $memberHandler->getUserList($criteria);
0 ignored issues
show
The method getUserList() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsPersistableObjectHandler. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

127
    /** @scrutinizer ignore-call */ 
128
    $usernames = $memberHandler->getUserList($criteria);
Loading history...
128
129
    // add usernames to $games
130
131
    foreach ($games as $k => $game) {
132
        $games[$k]['username_white'] = $usernames[$game['white_uid']] ?? '?';
133
134
        $games[$k]['username_black'] = $usernames[$game['black_uid']] ?? '?';
135
    }
136
137
    $block['games'] = $games;
0 ignored issues
show
Comprehensibility Best Practice introduced by
$block was never initialized. Although not strictly required by PHP, it is generally a good practice to add $block = array(); before regardless.
Loading history...
138
139
    $block['date_format'] = _SHORTDATESTRING;
140
141
    return $block;
142
}
143
144
/**
145
 * Generate Smarty template variables for Recent Challenges block.
146
 *
147
 * @param array $options
148
 * @return array
149
 */
150
function b_chess_challenges_show($options)
151
{
152
    global $xoopsModule, $xoopsDB;
153
154
    // don't display this block within owning module
155
156
    if (is_object($xoopsModule) && 'chess' == $xoopsModule->getVar('dirname')) {
157
        return [];
158
    }
159
160
    $table = $xoopsDB->prefix('chess_challenges');
161
162
    $limit = (int)$options[0]; // sanitize with intval()
163
164
    switch ($options[1]) {
165
        case 1:
166
            $where = "game_type = 'open'";
167
            break;
168
        case 2:
169
            $where = "game_type = 'user'";
170
            break;
171
        default:
172
            $where = 1;
173
            break;
174
    }
175
176
    $result = $xoopsDB->query(
177
        trim(
178
            "
179
        SELECT   challenge_id, game_type, player1_uid, player2_uid, UNIX_TIMESTAMP(create_date) AS create_date
180
        FROM     $table
181
        WHERE    $where
182
        ORDER BY create_date DESC
183
        LIMIT    $limit
184
    "
185
        )
186
    );
187
188
    // user IDs that will require mapping to usernames
189
190
    $userids = [];
191
192
    $challenges = [];
193
194
    while (false !== ($row = $xoopsDB->fetchArray($result))) {
195
        $challenges[] = [
196
            'challenge_id' => $row['challenge_id'],
197
            'game_type'    => $row['game_type'],
198
            'player1_uid'  => $row['player1_uid'],
199
            'player2_uid'  => $row['player2_uid'],
200
            'create_date'  => $row['create_date'],
201
        ];
202
203
        // save user IDs that will require mapping to usernames
204
205
        if ($row['player1_uid']) {
206
            $userids[$row['player1_uid']] = 1;
207
        }
208
209
        if ($row['player2_uid']) {
210
            $userids[$row['player2_uid']] = 1;
211
        }
212
    }
213
214
    $xoopsDB->freeRecordSet($result);
215
216
    // get mapping of user IDs to usernames
217
218
    $memberHandler = xoops_getHandler('member');
219
220
    $criteria = new \Criteria('uid', '(' . implode(',', array_keys($userids)) . ')', 'IN');
221
222
    $usernames = $memberHandler->getUserList($criteria);
223
224
    // add usernames to $challenges
225
226
    foreach ($challenges as $k => $challenge) {
227
        $challenges[$k]['username_player1'] = $usernames[$challenge['player1_uid']] ?? '?';
228
229
        $challenges[$k]['username_player2'] = $usernames[$challenge['player2_uid']] ?? '?';
230
    }
231
232
    $block['challenges'] = $challenges;
0 ignored issues
show
Comprehensibility Best Practice introduced by
$block was never initialized. Although not strictly required by PHP, it is generally a good practice to add $block = array(); before regardless.
Loading history...
233
234
    $block['date_format'] = _SHORTDATESTRING;
235
236
    return $block;
237
}
238
239
/**
240
 * Generate Smarty template variables for Highest-rated Players block.
241
 *
242
 * @param array $options
243
 * @return array
244
 */
245
function b_chess_players_show($options)
246
{
247
    global $xoopsModule, $xoopsDB;
248
249
    // don't display this block within owning module
250
251
    if (is_object($xoopsModule) && 'chess' == $xoopsModule->getVar('dirname')) {
252
        return [];
253
    }
254
255
    require_once XOOPS_ROOT_PATH . '/modules/chess/include/ratings.php';
256
257
    $moduleHandler = xoops_getHandler('module');
258
259
    $module = $moduleHandler->getByDirname('chess');
0 ignored issues
show
The method getByDirname() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsModuleHandler or XoopsPersistableObjectHandler. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

259
    /** @scrutinizer ignore-call */ 
260
    $module = $moduleHandler->getByDirname('chess');
Loading history...
260
261
    $configHandler = xoops_getHandler('config');
262
263
    $moduleConfig = $configHandler->getConfigsByCat(0, $module->getVar('mid'));
0 ignored issues
show
The method getConfigsByCat() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsPersistableObjectHandler. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

263
    /** @scrutinizer ignore-call */ 
264
    $moduleConfig = $configHandler->getConfigsByCat(0, $module->getVar('mid'));
Loading history...
264
265
    $block['rating_system'] = $moduleConfig['rating_system'];
0 ignored issues
show
Comprehensibility Best Practice introduced by
$block was never initialized. Although not strictly required by PHP, it is generally a good practice to add $block = array(); before regardless.
Loading history...
266
267
    $block['provisional_games'] = chess_ratings_num_provisional_games();
268
269
    // if ratings disabled, nothing else to do
270
271
    if ('none' == $moduleConfig['rating_system']) {
272
        return $block;
273
    }
274
275
    $table = $xoopsDB->prefix('chess_ratings');
276
277
    $limit = (int)$options[0]; // sanitize with intval()
278
279
    switch ($options[1]) {
280
        case 1:
281
            $block['show_provisional_ratings'] = false;
282
            $where                             = "(games_won+games_lost+games_drawn) >= '{$block['provisional_games']}'";
283
            break;
284
        case 2:
285
        default:
286
            $block['show_provisional_ratings'] = true;
287
            $where                             = 1;
288
            break;
289
    }
290
291
    $result = $xoopsDB->query(
292
        trim(
293
            "
294
        SELECT   player_uid, rating, (games_won+games_lost+games_drawn) AS games_played
295
        FROM     $table
296
        WHERE    $where
297
        ORDER BY rating DESC, player_uid ASC
298
        LIMIT    $limit
299
    "
300
        )
301
    );
302
303
    // user IDs that will require mapping to usernames
304
305
    $userids = [];
306
307
    $players = [];
308
309
    while (false !== ($row = $xoopsDB->fetchArray($result))) {
310
        $players[] = [
311
            'player_uid'   => $row['player_uid'],
312
            'rating'       => $row['rating'],
313
            'games_played' => $row['games_played'],
314
        ];
315
316
        // save user IDs that will require mapping to usernames
317
318
        if ($row['player_uid']) {
319
            $userids[$row['player_uid']] = 1;
320
        }
321
    }
322
323
    $xoopsDB->freeRecordSet($result);
324
325
    // get mapping of user IDs to usernames
326
327
    if (!empty($userids)) {
328
        $memberHandler = xoops_getHandler('member');
329
330
        $criteria = new \Criteria('uid', '(' . implode(',', array_keys($userids)) . ')', 'IN');
331
332
        $usernames = $memberHandler->getUserList($criteria);
333
    }
334
335
    // add usernames to $players
336
337
    foreach ($players as $k => $player) {
338
        $players[$k]['player_uname'] = $usernames[$player['player_uid']] ?? '?';
339
    }
340
341
    $block['players'] = $players;
342
343
    return $block;
344
}
345
346
/**
347
 * Generate HTML form fragment for editing settings of Recent Games block.
348
 *
349
 * @param array $options
350
 * @return string
351
 */
352
function b_chess_games_edit($options)
353
{
354
    $show_inplay = 1 == $options[1] ? 'checked' : '';
355
356
    $show_concluded = 2 == $options[1] ? 'checked' : '';
357
358
    $show_both = 3 == $options[1] ? 'checked' : '';
359
360
    $show_rated_only = 1 == $options[2] ? 'checked' : '';
361
362
    $show_unrated = 2 == $options[2] ? 'checked' : '';
363
364
    return '
365
        ' . _MB_CHESS_NUM_GAMES . ": <input type='text' name='options[0]' value='{$options[0]}' size='3' maxlength='3'>
366
        <br>
367
        <br>
368
        <input type='radio' name='options[1]' value='1' $show_inplay    > " . _MB_CHESS_SHOW_GAMES_INPLAY . "
369
        <input type='radio' name='options[1]' value='2' $show_concluded > " . _MB_CHESS_SHOW_GAMES_CONCLUDED . "
370
        <input type='radio' name='options[1]' value='3' $show_both      > " . _MB_CHESS_SHOW_GAMES_BOTH . "
371
        <br>
372
        <br>
373
        <input type='radio' name='options[2]' value='1' $show_rated_only> " . _MB_CHESS_SHOW_GAMES_RATED . "
374
        <input type='radio' name='options[2]' value='2' $show_unrated   > " . _MB_CHESS_SHOW_GAMES_UNRATED . '
375
    ';
376
}
377
378
/**
379
 * Generate HTML form fragment for editing settings of Recent Challenges block.
380
 *
381
 * @param array $options
382
 * @return string
383
 */
384
function b_chess_challenges_edit($options)
385
{
386
    $show_open = 1 == $options[1] ? 'checked' : '';
387
388
    $show_user = 2 == $options[1] ? 'checked' : '';
389
390
    $show_both = 3 == $options[1] ? 'checked' : '';
391
392
    return '
393
        ' . _MB_CHESS_NUM_CHALLENGES . ": <input type='text' name='options[0]' value='{$options[0]}' size='3' maxlength='3'>
394
        <br>
395
        <input type='radio' name='options[1]' value='1' $show_open> " . _MB_CHESS_SHOW_CHALLENGES_OPEN . "
396
        <input type='radio' name='options[1]' value='2' $show_user> " . _MB_CHESS_SHOW_CHALLENGES_USER . "
397
        <input type='radio' name='options[1]' value='3' $show_both> " . _MB_CHESS_SHOW_CHALLENGES_BOTH . '
398
    ';
399
}
400
401
/**
402
 * Generate HTML form fragment for editing settings of Highest-rated Players block.
403
 *
404
 * @param array $options
405
 * @return string
406
 */
407
function b_chess_players_edit($options)
408
{
409
    $show_nonprovisional = 1 == $options[1] ? 'checked' : '';
410
411
    $show_all = 2 == $options[1] ? 'checked' : '';
412
413
    return '
414
        ' . _MB_CHESS_NUM_PLAYERS . ": <input type='text' name='options[0]' value='{$options[0]}' size='3' maxlength='3'>
415
        <br>
416
        <input type='radio' name='options[1]' value='1' $show_nonprovisional> " . _MB_CHESS_SHOW_NONPROVISIONAL . "
417
        <input type='radio' name='options[1]' value='2' $show_all           > " . _MB_CHESS_SHOW_ALL_RATINGS . '
418
    ';
419
}
420