Issues (130)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

include/install.inc.php (1 issue)

1
<?php
2
// $Id$
3
//  ------------------------------------------------------------------------ //
4
//                XOOPS - PHP Content Management System                      //
5
//                    Copyright (c) 2000 XOOPS.org                           //
6
//                       <https://xoops.org/>                             //
7
// ------------------------------------------------------------------------- //
8
//  This program is free software; you can redistribute it and/or modify     //
9
//  it under the terms of the GNU General Public License as published by     //
10
//  the Free Software Foundation; either version 2 of the License, or        //
11
//  (at your option) any later version.                                      //
12
//                                                                           //
13
//  You may not change or alter any portion of this comment or credits       //
14
//  of supporting developers from this source code or any supporting         //
15
//  source code which is considered copyrighted (c) material of the          //
16
//  original comment or credit authors.                                      //
17
//                                                                           //
18
//  This program is distributed in the hope that it will be useful,          //
19
//  but WITHOUT ANY WARRANTY; without even the implied warranty of           //
20
//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            //
21
//  GNU General Public License for more details.                             //
22
//                                                                           //
23
//  You should have received a copy of the GNU General Public License        //
24
//  along with this program; if not, write to the Free Software              //
25
//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA //
26
//  ------------------------------------------------------------------------ //
27
28
/**
29
 * Module install/update
30
 *
31
 * @package    chess
32
 * @subpackage miscellaneous
33
 */
34
35
/**#@+
36
 */
37
38
// For downward compatibility with XOOPS versions that don't have the function 'xoops_load_lang_file'.
39
function_exists('xoops_load_lang_file') ? xoops_load_lang_file('modinfo', 'chess') : chess_load_lang_file('modinfo', 'chess');
40
41
/**#@-*/
42
43
/**
44
 * Update chess module (pre-processing step).
45
 *
46
 * @param object $module     Module object
47
 * @param int    $oldversion Old version number of module
48
 * @return bool                True if pre-update succeeded, otherwise false
49
 */
50
function xoops_module_pre_update_chess($module, $oldversion)
51
{
52
    global $xoopsDB;
53
54
    // For downward-compatiblity, in case this function doesn't get called by the module handler.
55
    $GLOBALS['chess_module_pre_update_called'] = true;
56
57
    if ($oldversion < 102) { // old version < 1.02: direct update not supported.
58
59
        $docfile = XOOPS_ROOT_PATH . '/modules/chess/docs/INSTALL.TXT';
60
        chess_set_message($module, sprintf(_MI_CHESS_OLD_VERSION, (string)$oldversion, $docfile), true);
61
        return false;
62
    } elseif ($oldversion >= 107) { // old version >= 1.07:  no action needed.
63
64
        return true;
65
    }
66
67
    // 1.02 <= old version < 1.07: perform update.
68
69
    $ratings_table    = $xoopsDB->prefix('chess_ratings');
70
    $challenges_table = $xoopsDB->prefix('chess_challenges');
71
    $games_table      = $xoopsDB->prefix('chess_games');
72
73
    // Check that ratings table does not already exist.
74
    chess_set_message($module, sprintf(_MI_CHESS_RATINGS_TABLE_1, $ratings_table));
75
    $result = $xoopsDB->query("SHOW TABLES LIKE '$ratings_table'");
76
    if (!$result) {
77
        $mysql_errno = $xoopsDB->errno();
78
        $mysql_error = $xoopsDB->error();
79
        chess_set_message($module, sprintf(_MI_CHESS_RATINGS_TABLE_2, $ratings_table, (string)$mysql_errno, $mysql_error), true);
80
        return false;
81
    }
82
    if ($xoopsDB->getRowsNum($result) > 0) {
83
        chess_set_message($module, sprintf(_MI_CHESS_RATINGS_TABLE_3, $ratings_table), true);
84
        return false;
85
    }
86
    $xoopsDB->freeRecordSet($result);
87
    chess_set_message($module, _MI_CHESS_OK);
88
89
    // Check database tables.
90
    chess_set_message($module, _MI_CHESS_CHK_DB_TABLES);
91
    $table_check_messages = chess_check_tables([$challenges_table, $games_table]);
92
    if (!empty($table_check_messages)) {
93
        foreach ($table_check_messages as $message) {
94
            chess_set_message($module, $message, true);
95
        }
96
        return false;
97
    }
98
    chess_set_message($module, _MI_CHESS_OK);
99
100
    // Check that values in column pgn_result of games table are in range.
101
    $pgn_result_values = "'*','1-0','0-1','1/2-1/2'";
102
    chess_set_message($module, sprintf(_MI_CHESS_GAMES_TABLE_1, $games_table));
103
    $result = $xoopsDB->query("SELECT COUNT(*) FROM `$games_table` WHERE `pgn_result` NOT IN ($pgn_result_values)");
104
    if (!$result) {
105
        $mysql_errno = $xoopsDB->errno();
106
        $mysql_error = $xoopsDB->error();
107
        chess_set_message($module, sprintf(_MI_CHESS_GAMES_TABLE_2, $games_table, (string)$mysql_errno, $mysql_error), true);
108
        return false;
109
    }
110
    [$count] = $xoopsDB->fetchRow($result);
111
    if ($count > 0) {
112
        chess_set_message($module, sprintf(_MI_CHESS_GAMES_TABLE_3, 'pgn_result', $games_table, $pgn_result_values), true);
113
        chess_set_message($module, _MI_CHESS_GAMES_TABLE_4, true);
114
        return false;
115
    }
116
    $xoopsDB->freeRecordSet($result);
117
    chess_set_message($module, _MI_CHESS_OK);
118
119
    return true; // successful
120
}
121
122
/**
123
 * Update chess module (post-processing step).
124
 *
125
 * @param object $module     Module object
126
 * @param int    $oldversion Old version number of module
127
 * @return bool                True if update succeeded, otherwise false
128
 */
129
function xoops_module_update_chess($module, $oldversion)
130
{
131
    global $xoopsDB;
132
133
    // Before proceeding, ensure that pre-update processing has been done, and that all the checks pass.
134
    // For downward-compatiblity, in case the "pre_update" function doesn't get called by the module handler.
135
    if (!@$GLOBALS['chess_module_pre_update_called'] && !xoops_module_pre_update_chess($module, $oldversion)) {
136
        return false;
137
    }
138
139
    if ($oldversion >= 107) { // old version >= 1.07:  no action needed.
140
        return true;
141
    }
142
143
    $ratings_table    = $xoopsDB->prefix('chess_ratings');
144
    $challenges_table = $xoopsDB->prefix('chess_challenges');
145
    $games_table      = $xoopsDB->prefix('chess_games');
146
147
    $queries = [
148
149
        "CREATE TABLE `$ratings_table` (
150
            `player_uid` mediumint(8) unsigned NOT NULL default '0',
151
            `rating` smallint(6) unsigned NOT NULL default '1200',
152
            `games_won` smallint(6) unsigned NOT NULL default '0',
153
            `games_lost` smallint(6) unsigned NOT NULL default '0',
154
            `games_drawn` smallint(6) unsigned NOT NULL default '0',
155
            PRIMARY KEY (`player_uid`),
156
            KEY `rating` (`rating`),
157
            KEY `games` (`games_won`,`games_lost`,`games_drawn`)
158
            ) TYPE=MyISAM",
159
160
        "ALTER TABLE `$challenges_table` ADD `is_rated` ENUM('1','0') DEFAULT '1' NOT NULL",
161
        "ALTER TABLE `$challenges_table` ADD INDEX `game_type` (`game_type`)",
162
        "ALTER TABLE `$challenges_table` ADD INDEX `player1_uid` (`player1_uid`)",
163
        "ALTER TABLE `$challenges_table` ADD INDEX `player2_uid` (`player2_uid`)",
164
        "ALTER TABLE `$challenges_table` ADD INDEX `create_date` (`create_date`)",
165
        "ALTER TABLE `$challenges_table` ADD INDEX `is_rated` (`is_rated`)",
166
167
        "ALTER TABLE `$games_table` CHANGE `pgn_result` `pgn_result` ENUM('*','0-1','1-0','1/2-1/2') DEFAULT '*' NOT NULL",
168
        "ALTER TABLE `$games_table` ADD `is_rated` ENUM('1','0') DEFAULT '1' NOT NULL",
169
        "ALTER TABLE `$games_table` ADD INDEX `white_uid` (`white_uid`)",
170
        "ALTER TABLE `$games_table` ADD INDEX `black_uid` (`black_uid`)",
171
        "ALTER TABLE `$games_table` ADD INDEX `date` (`create_date`,`start_date`,`last_date`)",
172
        "ALTER TABLE `$games_table` ADD INDEX `pgn_result` (`pgn_result`)",
173
        "ALTER TABLE `$games_table` ADD INDEX `suspended_date` (`suspended`(19))",
174
        "ALTER TABLE `$games_table` ADD INDEX `is_rated` (`is_rated`)",
175
176
        "UPDATE `$games_table` SET `is_rated` = '0' WHERE `white_uid` = `black_uid`",
177
    ];
178
179
    // Update database tables.
180
    chess_set_message($module, _MI_CHESS_UPDATING_DATABASE);
181
    foreach ($queries as $query) {
182
        chess_set_message($module, "> $query");
183
        $result = $xoopsDB->query($query);
184
        if (!$result) {
185
            $mysql_errno = $xoopsDB->errno();
186
            $mysql_error = $xoopsDB->error();
187
            chess_set_message($module, " ... ($mysql_errno) $mysql_error");
188
            return false;
189
        }
190
        chess_set_message($module, _MI_CHESS_OK);
191
    }
192
193
    /***
194
     * #*#TODO# - Leave this here for now, in case I think of a way to get it to work.
195
     * # This causes an error about the rating_system module configuration parameter not being defined,
196
     * # so I added a note in INSTALL.TXT about manually recalculating the ratings after install.
197
     *
198
     * // Initialize ratings table.
199
     * chess_set_message($module, _MI_CHESS_INIT_RATINGS_TABLE);
200
     * require_once XOOPS_ROOT_PATH . '/modules/chess/include/ratings.inc.php';
201
     * chess_recalc_ratings();
202
     ***/
203
204
    chess_set_message($module, _MI_CHESS_UPDATE_SUCCESSFUL);
205
206
    return true; // successful
207
}
208
209
/**
210
 * Check the specified tables in the currently selected database.
211
 *
212
 * @param array $table_names Names of database tables to check.
213
 * @return array                Diagnostic messages, or empty array if no errors.
214
 */
215
function chess_check_tables($table_names)
216
{
217
    global $xoopsDB;
218
219
    $messages = [];
220
221
    foreach ($table_names as $table_name) {
222
        $query  = "CHECK TABLE `$table_name`";
223
        $result = $xoopsDB->query($query);
224
        if (!$result) {
225
            $mysql_errno = $xoopsDB->errno();
226
            $mysql_error = $xoopsDB->error();
227
            $messages[]  = $query;
228
            $messages[]  = " ... ($mysql_errno) $mysql_error";
229
            continue;
230
        }
231
232
        // Initialize, in case the real table status fails to get retrieved.
233
        $table_status = '*** STATUS UNKNOWN ***';
234
235
        // The query may return multiple rows.  Only the last row is normally of interest, so only that row is saved.
236
        while ($row = $xoopsDB->fetchArray($result)) {
237
            $table_status = $row['Msg_text'];
238
        }
239
240
        $xoopsDB->freeRecordSet($result);
241
242
        if ('OK' != $table_status) {
243
            $messages[] = " ... $table_name: $table_status";
244
        }
245
    }
246
247
    return $messages;
248
}
249
250
/**
251
 * Load the specified localized strings file
252
 *
253
 * For downward compatibility with XOOPS versions that don't have the function 'xoops_load_lang_file'.
254
 *
255
 * @param string $filename Name of language file to include, without the file extension.
256
 * @param string $module   Module directory name.
257
 * @param string $default  Default language subdirectory, used if file for configured language isn't found.
258
 * @return mixed            Return value from including the file.
259
 */
260
function chess_load_lang_file($filename, $module = '', $default = 'english')
261
{
262
    $lang = $GLOBALS['xoopsConfig']['language'];
263
    $path = XOOPS_ROOT_PATH . (empty($module) ? '/' : "/modules/$module/") . 'language';
264
    if (!($ret = @include_once("$path/$lang/$filename.php"))) {
265
        $ret = include_once("$path/$default/$filename.php");
266
    }
267
    return $ret;
268
}
269
270
/**
271
 * Output a message during module install/upgrade
272
 *
273
 * @param object $module Module object
274
 * @param string $text   Text to display
275
 * @param bool   $error  True if text is an error message that should be displayed with emphasis, false otherwise.
276
 */
277
function chess_set_message($module, $text = '', $error = false)
278
{
279
    $text = $error ? "<span style='color:#ff0000;background-color:#ffffff;font-weight:bold;'>$text</span>" : $text;
280
281
    // For downward compatibility with XOOPS versions that don't have the method XoopsModule::setMessage.
282
    if (is_object($module) && method_exists($module, 'setMessage')) {
283
        $module->setMessage($text);
284
    } else {
285
        echo "<code>$text</code><br />\n";
286
    }
287
}
288
289
?>
0 ignored issues
show
It is not recommended to use PHP's closing tag ?> in files other than templates.

Using a closing tag in PHP files that only contain PHP code is not recommended as you might accidentally add whitespace after the closing tag which would then be output by PHP. This can cause severe problems, for example headers cannot be sent anymore.

A simple precaution is to leave off the closing tag as it is not required, and it also has no negative effects whatsoever.

Loading history...
290