mambax7 /
chess
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||
| 2 | |||
| 3 | // $Id$ |
||
| 4 | // ------------------------------------------------------------------------ // |
||
| 5 | // XOOPS - PHP Content Management System // |
||
| 6 | // Copyright (c) 2000 XOOPS.org // |
||
| 7 | // <https://xoops.org> // |
||
| 8 | // ------------------------------------------------------------------------- // |
||
| 9 | // This program is free software; you can redistribute it and/or modify // |
||
| 10 | // it under the terms of the GNU General Public License as published by // |
||
| 11 | // the Free Software Foundation; either version 2 of the License, or // |
||
| 12 | // (at your option) any later version. // |
||
| 13 | // // |
||
| 14 | // You may not change or alter any portion of this comment or credits // |
||
| 15 | // of supporting developers from this source code or any supporting // |
||
| 16 | // source code which is considered copyrighted (c) material of the // |
||
| 17 | // original comment or credit authors. // |
||
| 18 | // // |
||
| 19 | // This program is distributed in the hope that it will be useful, // |
||
| 20 | // but WITHOUT ANY WARRANTY; without even the implied warranty of // |
||
| 21 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // |
||
| 22 | // GNU General Public License for more details. // |
||
| 23 | // // |
||
| 24 | // You should have received a copy of the GNU General Public License // |
||
| 25 | // along with this program; if not, write to the Free Software // |
||
| 26 | // Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA // |
||
| 27 | // ------------------------------------------------------------------------ // |
||
| 28 | |||
| 29 | /** |
||
| 30 | * Generates main chess page, which displays lists of games and challenges. |
||
| 31 | * |
||
| 32 | * @package chess |
||
| 33 | * @subpackage index |
||
| 34 | */ |
||
| 35 | |||
| 36 | use Xmf\Request; |
||
| 37 | |||
| 38 | /**#@+ |
||
| 39 | */ |
||
| 40 | |||
| 41 | $GLOBALS['xoopsOption']['template_main'] = 'chess_games.tpl'; |
||
| 42 | require __DIR__ . '/header.php'; |
||
| 43 | |||
| 44 | require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||
| 45 | require_once XOOPS_ROOT_PATH . '/class/pagenav.php'; |
||
| 46 | require_once XOOPS_ROOT_PATH . '/modules/chess/include/constants.inc.php'; |
||
| 47 | require_once XOOPS_ROOT_PATH . '/modules/chess/include/functions.php'; |
||
| 48 | |||
| 49 | #var_dump($_REQUEST);#*#DEBUG# |
||
| 50 | |||
| 51 | global $xoopsDB, $xoopsTpl; |
||
| 52 | |||
| 53 | // ---------- |
||
| 54 | |||
| 55 | // user input |
||
| 56 | |||
| 57 | // ---------- |
||
| 58 | |||
| 59 | // offset of first row of challenges table to display (default to 0) |
||
| 60 | $cstart = Request::getInt('cstart', 0); |
||
| 61 | //$cstart = intval(isset($_POST['cstart']) ? $_POST['cstart'] : @$_GET['cstart']); |
||
| 62 | // offset of first row of games table to display (default to 0) |
||
| 63 | $gstart = Request::getInt('gstart', 0); |
||
| 64 | //$gstart = intval(isset($_POST['gstart']) ? $_POST['gstart'] : @$_GET['gstart']); |
||
| 65 | // challenges display option |
||
| 66 | $cshow = Request::getInt('cshow', 0); |
||
| 67 | //$cshow = intval(isset($_POST['cshow']) ? $_POST['cshow'] : @$_GET['cshow']); |
||
| 68 | // games display option 1 |
||
| 69 | $gshow1 = Request::getInt('gshow1', 0); |
||
| 70 | //$gshow1 = intval(isset($_POST['gshow1']) ? $_POST['gshow1'] : @$_GET['gshow1']); |
||
| 71 | // games display option 2 |
||
| 72 | $gshow2 = Request::getInt('gshow2', 0); |
||
| 73 | //$gshow2 = intval(isset($_POST['gshow2']) ? $_POST['gshow2'] : @$_GET['gshow2']); |
||
| 74 | |||
| 75 | // set show-options to default if undefined |
||
| 76 | |||
| 77 | if (!$cshow) { |
||
| 78 | $cshow = _CHESS_SHOW_CHALLENGES_BOTH; |
||
| 79 | } |
||
| 80 | |||
| 81 | if (!$gshow1) { |
||
| 82 | $gshow1 = _CHESS_SHOW_GAMES_BOTH; |
||
| 83 | } |
||
| 84 | |||
| 85 | if (!$gshow2) { |
||
| 86 | $gshow2 = _CHESS_SHOW_GAMES_UNRATED; |
||
| 87 | } |
||
| 88 | |||
| 89 | // get maximum number of items to display on a page, and constrain it to a reasonable value |
||
| 90 | |||
| 91 | $max_items_to_display = chess_moduleConfig('max_items'); |
||
| 92 | |||
| 93 | $max_items_to_display = min(max($max_items_to_display, 1), 1000); |
||
| 94 | |||
| 95 | $xoopsTpl->assign('chess_date_format', _MEDIUMDATESTRING); |
||
| 96 | |||
| 97 | // user IDs that will require mapping to usernames |
||
| 98 | |||
| 99 | $userids = []; |
||
| 100 | |||
| 101 | // ----- |
||
| 102 | |||
| 103 | // games |
||
| 104 | |||
| 105 | // ----- |
||
| 106 | |||
| 107 | // Two queries are performed, one without a limit clause to count the total number of rows for the page navigator, |
||
| 108 | |||
| 109 | // and one with a limit clause to get the data for display on the current page. |
||
| 110 | |||
| 111 | // SQL_CALC_FOUND_ROWS and FOUND_ROWS(), available in MySQL 4.0.0, provide a more efficient way of doing this. |
||
| 112 | |||
| 113 | $games_table = $xoopsDB->prefix('chess_games'); |
||
| 114 | |||
| 115 | $where = 'white_uid != black_uid'; |
||
| 116 | |||
| 117 | switch ($gshow1) { |
||
| 118 | case 1: |
||
| 119 | $where .= " AND pgn_result = '*'"; |
||
| 120 | break; |
||
| 121 | case 2: |
||
| 122 | $where .= " AND pgn_result != '*'"; |
||
| 123 | break; |
||
| 124 | } |
||
| 125 | |||
| 126 | if (1 == $gshow2) { |
||
| 127 | $where .= " AND is_rated = '1'"; |
||
| 128 | } |
||
| 129 | |||
| 130 | $result = $xoopsDB->query("SELECT COUNT(*) FROM $games_table WHERE $where"); |
||
| 131 | |||
| 132 | [$num_games] = $xoopsDB->fetchRow($result); |
||
| 133 | |||
| 134 | $xoopsDB->freeRecordSet($result); |
||
| 135 | |||
| 136 | $result = $xoopsDB->query( |
||
| 137 | trim( |
||
| 138 | " |
||
| 139 | SELECT game_id, fen_active_color, white_uid, black_uid, pgn_result, is_rated, |
||
| 140 | UNIX_TIMESTAMP(GREATEST(create_date,start_date,last_date)) AS last_activity |
||
| 141 | FROM $games_table |
||
| 142 | WHERE $where |
||
| 143 | ORDER BY last_activity DESC |
||
| 144 | LIMIT $gstart, $max_items_to_display |
||
| 145 | " |
||
| 146 | ) |
||
| 147 | ); |
||
| 148 | |||
| 149 | $games = []; |
||
| 150 | |||
| 151 | while (false !== ($row = $xoopsDB->fetchArray($result))) { |
||
| 152 | $games[] = [ |
||
| 153 | 'game_id' => $row['game_id'], |
||
| 154 | 'white_uid' => $row['white_uid'], |
||
| 155 | 'black_uid' => $row['black_uid'], |
||
| 156 | 'last_activity' => $row['last_activity'], |
||
| 157 | 'fen_active_color' => $row['fen_active_color'], |
||
| 158 | 'pgn_result' => $row['pgn_result'], |
||
| 159 | 'is_rated' => $row['is_rated'], |
||
| 160 | ]; |
||
| 161 | |||
| 162 | // save user IDs that will require mapping to usernames |
||
| 163 | |||
| 164 | if ($row['white_uid']) { |
||
| 165 | $userids[$row['white_uid']] = 1; |
||
| 166 | } |
||
| 167 | |||
| 168 | if ($row['black_uid']) { |
||
| 169 | $userids[$row['black_uid']] = 1; |
||
| 170 | } |
||
| 171 | } |
||
| 172 | |||
| 173 | $xoopsDB->freeRecordSet($result); |
||
| 174 | |||
| 175 | $games_pagenav = new XoopsPageNav($num_games, $max_items_to_display, $gstart, 'gstart', "cstart=$cstart&cshow=$cshow&gshow1=$gshow1&gshow2=$gshow2"); |
||
| 176 | |||
| 177 | $xoopsTpl->assign('chess_games_pagenav', $games_pagenav->renderNav()); |
||
| 178 | |||
| 179 | // ---------- |
||
| 180 | |||
| 181 | // challenges |
||
| 182 | |||
| 183 | // ---------- |
||
| 184 | |||
| 185 | // Two queries are performed, one without a limit clause to count the total number of rows for the page navigator, |
||
| 186 | |||
| 187 | // and one with a limit clause to get the data for display on the current page. |
||
| 188 | |||
| 189 | // SQL_CALC_FOUND_ROWS and FOUND_ROWS(), available in MySQL 4.0.0, provide a more efficient way of doing this. |
||
| 190 | |||
| 191 | $challenges_table = $xoopsDB->prefix('chess_challenges'); |
||
| 192 | |||
| 193 | switch ($cshow) { |
||
| 194 | case _CHESS_SHOW_CHALLENGES_OPEN: |
||
| 195 | $where = "game_type = 'open'"; |
||
| 196 | break; |
||
| 197 | case _CHESS_SHOW_CHALLENGES_USER: |
||
| 198 | $where = "game_type = 'user'"; |
||
| 199 | break; |
||
| 200 | default: |
||
| 201 | $where = 1; |
||
| 202 | break; |
||
| 203 | } |
||
| 204 | |||
| 205 | $result = $xoopsDB->query("SELECT COUNT(*) FROM $challenges_table WHERE $where"); |
||
| 206 | |||
| 207 | [$num_challenges] = $xoopsDB->fetchRow($result); |
||
| 208 | |||
| 209 | $xoopsDB->freeRecordSet($result); |
||
| 210 | |||
| 211 | $result = $xoopsDB->query( |
||
| 212 | trim( |
||
| 213 | " |
||
| 214 | SELECT challenge_id, game_type, color_option, player1_uid, player2_uid, UNIX_TIMESTAMP(create_date) AS create_date, is_rated |
||
| 215 | FROM $challenges_table |
||
| 216 | WHERE $where |
||
| 217 | ORDER BY create_date DESC |
||
| 218 | LIMIT $cstart, $max_items_to_display |
||
| 219 | " |
||
| 220 | ) |
||
| 221 | ); |
||
| 222 | |||
| 223 | $challenges = []; |
||
| 224 | |||
| 225 | while (false !== ($row = $xoopsDB->fetchArray($result))) { |
||
| 226 | $challenges[] = [ |
||
| 227 | 'challenge_id' => $row['challenge_id'], |
||
| 228 | 'game_type' => $row['game_type'], |
||
| 229 | 'color_option' => $row['color_option'], |
||
| 230 | 'player1_uid' => $row['player1_uid'], |
||
| 231 | 'player2_uid' => $row['player2_uid'], |
||
| 232 | 'create_date' => $row['create_date'], |
||
| 233 | 'is_rated' => $row['is_rated'], |
||
| 234 | ]; |
||
| 235 | |||
| 236 | // save user IDs that will require mapping to usernames |
||
| 237 | |||
| 238 | if ($row['player1_uid']) { |
||
| 239 | $userids[$row['player1_uid']] = 1; |
||
| 240 | } |
||
| 241 | |||
| 242 | if ($row['player2_uid']) { |
||
| 243 | $userids[$row['player2_uid']] = 1; |
||
| 244 | } |
||
| 245 | } |
||
| 246 | |||
| 247 | $xoopsDB->freeRecordSet($result); |
||
| 248 | |||
| 249 | $challenges_pagenav = new XoopsPageNav($num_challenges, $max_items_to_display, $cstart, 'cstart', "gstart=$gstart&cshow=$cshow&gshow1=$gshow1&gshow2=$gshow2"); |
||
| 250 | |||
| 251 | $xoopsTpl->assign('chess_challenges_pagenav', $challenges_pagenav->renderNav()); |
||
| 252 | |||
| 253 | // --------- |
||
| 254 | |||
| 255 | // usernames |
||
| 256 | |||
| 257 | // --------- |
||
| 258 | |||
| 259 | // get mapping of user IDs to usernames |
||
| 260 | |||
| 261 | $memberHandler = xoops_getHandler('member'); |
||
| 262 | |||
| 263 | $criteria = new \Criteria('uid', '(' . implode(',', array_keys($userids)) . ')', 'IN'); |
||
| 264 | |||
| 265 | $usernames = $memberHandler->getUserList($criteria); |
||
|
0 ignored issues
–
show
Bug
introduced
by
Loading history...
|
|||
| 266 | |||
| 267 | // add usernames to $games |
||
| 268 | |||
| 269 | foreach ($games as $k => $game) { |
||
| 270 | $games[$k]['username_white'] = $usernames[$game['white_uid']] ?? '?'; |
||
| 271 | |||
| 272 | $games[$k]['username_black'] = $usernames[$game['black_uid']] ?? '?'; |
||
| 273 | } |
||
| 274 | |||
| 275 | // add usernames to $challenges |
||
| 276 | |||
| 277 | foreach ($challenges as $k => $challenge) { |
||
| 278 | $challenges[$k]['username_player1'] = $usernames[$challenge['player1_uid']] ?? '?'; |
||
| 279 | |||
| 280 | $challenges[$k]['username_player2'] = $usernames[$challenge['player2_uid']] ?? '?'; |
||
| 281 | } |
||
| 282 | |||
| 283 | $xoopsTpl->assign('chess_games', $games); |
||
| 284 | |||
| 285 | $xoopsTpl->assign('chess_challenges', $challenges); |
||
| 286 | |||
| 287 | $xoopsTpl->assign('chess_rating_system', chess_moduleConfig('rating_system')); |
||
| 288 | |||
| 289 | // ----- |
||
| 290 | |||
| 291 | // forms |
||
| 292 | |||
| 293 | // ----- |
||
| 294 | |||
| 295 | // security token not needed for this form |
||
| 296 | |||
| 297 | $form1 = new XoopsThemeForm('', 'form1', 'index.php'); |
||
| 298 | |||
| 299 | $form1->addElement(new XoopsFormButton('', 'submit', _MD_CHESS_SUBMIT_BUTTON, 'submit')); |
||
| 300 | |||
| 301 | $menu_cshow = new XoopsFormSelect('', 'cshow', $cshow, 1, false); |
||
| 302 | |||
| 303 | $menu_cshow->addOption(_CHESS_SHOW_CHALLENGES_OPEN, _MD_CHESS_SHOW_CHALLENGES_OPEN); |
||
| 304 | |||
| 305 | $menu_cshow->addOption(_CHESS_SHOW_CHALLENGES_USER, _MD_CHESS_SHOW_CHALLENGES_USER); |
||
| 306 | |||
| 307 | $menu_cshow->addOption(_CHESS_SHOW_CHALLENGES_BOTH, _MD_CHESS_SHOW_CHALLENGES_BOTH); |
||
| 308 | |||
| 309 | $form1->addElement($menu_cshow); |
||
| 310 | |||
| 311 | $form1->addElement(new XoopsFormHidden('gstart', $gstart)); |
||
| 312 | |||
| 313 | $form1->addElement(new XoopsFormHidden('gshow1', $gshow1)); |
||
| 314 | |||
| 315 | $form1->addElement(new XoopsFormHidden('gshow2', $gshow2)); |
||
| 316 | |||
| 317 | $form1->assign($xoopsTpl); |
||
| 318 | |||
| 319 | // security token not needed for this form |
||
| 320 | |||
| 321 | $form2 = new XoopsThemeForm('', 'form2', 'index.php'); |
||
| 322 | |||
| 323 | $form2->addElement(new XoopsFormButton('', 'submit', _MD_CHESS_SUBMIT_BUTTON, 'submit')); |
||
| 324 | |||
| 325 | $menu_gshow1 = new XoopsFormSelect('', 'gshow1', $gshow1, 1, false); |
||
| 326 | |||
| 327 | $menu_gshow1->addOption(_CHESS_SHOW_GAMES_INPLAY, _MD_CHESS_SHOW_GAMES_INPLAY); |
||
| 328 | |||
| 329 | $menu_gshow1->addOption(_CHESS_SHOW_GAMES_CONCLUDED, _MD_CHESS_SHOW_GAMES_CONCLUDED); |
||
| 330 | |||
| 331 | $menu_gshow1->addOption(_CHESS_SHOW_GAMES_BOTH, _MD_CHESS_SHOW_GAMES_BOTH); |
||
| 332 | |||
| 333 | $form2->addElement($menu_gshow1); |
||
| 334 | |||
| 335 | $menu_gshow2 = new XoopsFormSelect('', 'gshow2', $gshow2, 1, false); |
||
| 336 | |||
| 337 | $menu_gshow2->addOption(_CHESS_SHOW_GAMES_RATED, _MD_CHESS_SHOW_GAMES_RATED); |
||
| 338 | |||
| 339 | $menu_gshow2->addOption(_CHESS_SHOW_GAMES_UNRATED, _MD_CHESS_SHOW_GAMES_UNRATED); |
||
| 340 | |||
| 341 | $form2->addElement($menu_gshow2); |
||
| 342 | |||
| 343 | $form2->addElement(new XoopsFormHidden('cstart', $cstart)); |
||
| 344 | |||
| 345 | $form2->addElement(new XoopsFormHidden('cshow', $cshow)); |
||
| 346 | |||
| 347 | $form2->assign($xoopsTpl); |
||
| 348 | |||
| 349 | #*#DEBUG# - trying something unrelated to the chess module |
||
| 350 | /*** |
||
| 351 | * $configHandler = xoops_getHandler('config'); |
||
| 352 | * $clist = $configHandler->getConfigList(18); |
||
| 353 | * var_dump('clist', $clist); |
||
| 354 | ***/ |
||
| 355 | include_once XOOPS_ROOT_PATH . '/footer.php'; |
||
| 356 |