Passed
Push — development ( 84f3da...e98ef3 )
by Nils
04:52
created

cleanFields()   A

Complexity

Conditions 5
Paths 6

Size

Total Lines 16
Code Lines 10

Duplication

Lines 0
Ratio 0 %

Importance

Changes 22
Bugs 0 Features 0
Metric Value
cc 5
eloc 10
c 22
b 0
f 0
nc 6
nop 1
dl 0
loc 16
rs 9.6111
1
<?php
2
/**
3
 * @package       upgrade.ajax.php
4
 * @author        Nils Laumaillé <[email protected]>
5
 * @version       2.1.27
6
 * @copyright     2009-2018 Nils Laumaillé
7
 * @license       GNU GPL-3.0
8
 * @link          https://www.teampass.net
9
 *
10
 * This library is distributed in the hope that it will be useful,
11
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13
 */
14
15
/*
16
** Upgrade script for release 2.1.27
17
*/
18
require_once('../sources/SecureHandler.php');
19
session_start();
20
error_reporting(E_ERROR | E_PARSE);
21
$_SESSION['db_encoding'] = "utf8";
22
$_SESSION['CPM'] = 1;
23
24
25
//include librairies
26
require_once '../includes/language/english.php';
27
require_once '../includes/config/include.php';
28
require_once '../includes/config/settings.php';
29
require_once '../sources/main.functions.php';
30
require_once '../includes/libraries/Tree/NestedTree/NestedTree.php';
31
32
$_SESSION['settings']['loaded'] = "";
33
//define pbkdf2 iteration count
34
@define('ITCOUNT', '2072');
35
$return_error = "";
36
$res = "";
37
38
39
//Build tree
40
$tree = new Tree\NestedTree\NestedTree(
41
    $pre.'nested_tree',
42
    'id',
43
    'parent_id',
44
    'title'
45
);
46
47
48
// Prepare POST variables
49
$post_no_maintenance_mode = filter_input(INPUT_POST, 'no_maintenance_mode', FILTER_SANITIZE_NUMBER_INT);
50
$post_index = filter_input(INPUT_POST, 'index', FILTER_SANITIZE_NUMBER_INT);
51
$post_multiple = filter_input(INPUT_POST, 'multiple', FILTER_SANITIZE_STRING);
52
53
// DataBase
54
// Test DB connexion
55
$pass = defuse_return_decrypted($pass);
56
if (mysqli_connect(
57
    $server,
58
    $user,
59
    $pass,
60
    $database,
61
    $port
62
)
63
) {
64
    $db_link = mysqli_connect(
65
        $server,
66
        $user,
67
        $pass,
68
        $database,
69
        $port
70
    );
71
} else {
72
    $res = "Impossible to get connected to server. Error is: ".addslashes(mysqli_connect_error());
73
    echo '[{"finish":"1", "msg":"", "error":"Impossible to get connected to server. Error is: '.addslashes(mysqli_connect_error()).'!"}]';
74
    mysqli_close($db_link);
75
    exit();
76
}
77
78
// Load libraries
79
require_once '../includes/libraries/protect/SuperGlobal/SuperGlobal.php';
80
$superGlobal = new protect\SuperGlobal\SuperGlobal();
81
82
// Set Session
83
$superGlobal->put("db_encoding", "utf8", "SESSION");
84
$_SESSION['settings']['loaded'] = "";
85
$superGlobal->put("fullurl", $post_fullurl, "SESSION");
86
$superGlobal->put("abspath", $abspath, "SESSION");
87
88
// Get Sessions
89
$session_tp_defuse_installed = $superGlobal->get("tp_defuse_installed", "SESSION");
90
91
/**
92
 * Generates a random key
93
 *
94
 * @return void
95
 */
96
function generateRandomKey()
97
{
98
    // load passwordLib library
99
    $path = '../includes/libraries/PasswordGenerator/Generator/';
100
    include_once $path.'ComputerPasswordGenerator.php';
101
102
    $generator = new PasswordGenerator\Generator\ComputerPasswordGenerator();
103
104
    $generator->setLength(40);
105
    $generator->setSymbols(false);
106
    $generator->setLowercase(true);
107
    $generator->setUppercase(true);
108
    $generator->setNumbers(true);
109
110
	$key = $generator->generatePasswords();
111
112
    return $key[0];
113
}
114
115
/**
116
 * Function permits to get the value from a line
117
 * @param  string $val [description]
118
 * @return string      [description]
119
 */
120
function getSettingValue($val)
121
{
122
    $val = trim(strstr($val, "="));
123
    return trim(str_replace('"', '', substr($val, 1, strpos($val, ";") - 1)));
124
}
125
126
/**
127
 * Function permits to check if a column exists, and if not to add it
128
 * @param string $dbname     [description]
129
 * @param string $column     [description]
130
 * @param string $columnAttr [description]
131
 */
132
function addColumnIfNotExist($dbname, $column, $columnAttr = "VARCHAR(255) NULL")
133
{
134
    global $db_link;
135
    $exists = false;
136
    $columns = mysqli_query($db_link, "show columns from $dbname");
137
    while ($col = mysqli_fetch_assoc($columns)) {
0 ignored issues
show
Bug introduced by
It seems like $columns can also be of type boolean; however, parameter $result of mysqli_fetch_assoc() does only seem to accept mysqli_result, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

137
    while ($col = mysqli_fetch_assoc(/** @scrutinizer ignore-type */ $columns)) {
Loading history...
138
        if ($col['Field'] == $column) {
139
            $exists = true;
0 ignored issues
show
Unused Code introduced by
The assignment to $exists is dead and can be removed.
Loading history...
140
            return true;
141
        }
142
    }
143
    if (!$exists) {
0 ignored issues
show
introduced by
The condition $exists is always false.
Loading history...
144
        return mysqli_query($db_link, "ALTER TABLE `$dbname` ADD `$column`  $columnAttr");
145
    }
146
147
    return false;
148
}
149
150
/**
151
 * [cleanFields description]
152
 * @param  [type] $txt [description]
0 ignored issues
show
Documentation Bug introduced by
The doc comment [type] at position 0 could not be parsed: Unknown type name '[' at position 0 in [type].
Loading history...
153
 * @return [type]      [description]
0 ignored issues
show
Documentation Bug introduced by
The doc comment [type] at position 0 could not be parsed: Unknown type name '[' at position 0 in [type].
Loading history...
154
 */
155
function cleanFields($txt)
156
{
157
    $tmp = str_replace(",", ";", trim($txt));
158
    if (empty($tmp)) {
159
        return $tmp;
160
    }
161
    if ($tmp === ";") {
162
        return "";
163
    }
164
    if (strpos($tmp, ';') === 0) {
165
        $tmp = substr($tmp, 1);
166
    }
167
    if (substr($tmp, -1) !== ";") {
168
        $tmp = $tmp.";";
169
    }
170
    return $tmp;
171
}
172
173
/*
174
** Checks if the column exists in the table
175
*/
176
function columnExists($tablename, $column)
177
{
178
    global $db_link;
179
    $checkcolumn = mysqli_query($db_link, "SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='{$tablename}' AND COLUMN_NAME = '{$column}';");
180
    if (mysqli_num_rows($checkcolumn) > 0) {
0 ignored issues
show
Bug introduced by
It seems like $checkcolumn can also be of type boolean; however, parameter $result of mysqli_num_rows() does only seem to accept mysqli_result, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

180
    if (mysqli_num_rows(/** @scrutinizer ignore-type */ $checkcolumn) > 0) {
Loading history...
181
        return true;
182
    } else {
183
        return false;
184
    }
185
}
186
187
// 2.1.27 introduce new encryption protocol with DEFUSE library.
188
// Now evaluate if current instance has already this version
189
$tmp = mysqli_fetch_row(mysqli_query($db_link, "SELECT valeur FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'teampass_version'"));
0 ignored issues
show
Bug introduced by
It seems like mysqli_query($db_link, '... = 'teampass_version'') can also be of type boolean; however, parameter $result of mysqli_fetch_row() does only seem to accept mysqli_result, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

189
$tmp = mysqli_fetch_row(/** @scrutinizer ignore-type */ mysqli_query($db_link, "SELECT valeur FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'teampass_version'"));
Loading history...
190
if (count($tmp[0]) === 0 || empty($tmp[0])) {
191
    mysqli_query(
192
        $db_link,
193
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'teampass_version', '".$SETTINGS_EXT['version']."')"
194
    );
195
} else {
196
    mysqli_query(
197
        $db_link,
198
        "UPDATE `".$pre."misc`
199
        SET `valeur` = '".$SETTINGS_EXT['version']."'
200
        WHERE intitule = 'teampass_version' AND type = 'admin'"
201
    );
202
}
203
204
// add new admin setting "migration_to_2127"
205
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'migration_to_2127'"));
0 ignored issues
show
Bug introduced by
It seems like mysqli_query($db_link, '...= 'migration_to_2127'') can also be of type boolean; however, parameter $result of mysqli_num_rows() does only seem to accept mysqli_result, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

205
$tmp = mysqli_num_rows(/** @scrutinizer ignore-type */ mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'migration_to_2127'"));
Loading history...
206
if (intval($tmp) === 0) {
207
    mysqli_query(
208
        $db_link,
209
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'migration_to_2127', '0')"
210
    );
211
}
212
213
214
// check if library defuse already on-going here
215
// if yes, then don't execute re-encryption
216
if (isset($session_tp_defuse_installed) === false) {
217
    $superGlobal->put("tp_defuse_installed", false, "SESSION");
0 ignored issues
show
Bug introduced by
false of type false is incompatible with the type string expected by parameter $value of protect\SuperGlobal\SuperGlobal::put(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

217
    $superGlobal->put("tp_defuse_installed", /** @scrutinizer ignore-type */ false, "SESSION");
Loading history...
218
    if (columnExists($pre."items", "encryption_type") === true) {
219
        $superGlobal->put("tp_defuse_installed", true, "SESSION");
0 ignored issues
show
Bug introduced by
true of type true is incompatible with the type string expected by parameter $value of protect\SuperGlobal\SuperGlobal::put(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

219
        $superGlobal->put("tp_defuse_installed", /** @scrutinizer ignore-type */ true, "SESSION");
Loading history...
220
    }
221
}
222
223
// alter table Items
224
mysqli_query($db_link, "ALTER TABLE `".$pre."items` MODIFY pw_len INT(5) NOT NULL DEFAULT '0'");
225
226
// alter table MISC - rename ID is exists
227
$res = addColumnIfNotExist(
228
    $pre."misc",
229
    "increment_id",
230
    "INT(12) NOT NULL AUTO_INCREMENT, ADD PRIMARY KEY (`increment_id`)"
231
);
232
if ($res === true) {
233
    // Change name of field
234
    mysqli_query($db_link, "ALTER TABLE `".$pre."misc` CHANGE `id` `increment_id` INT(12) NOT NULL AUTO_INCREMENT");
235
} elseif ($res === false) {
236
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding increment_id to table misc! '.mysqli_error($db_link).'!"}]';
237
    mysqli_close($db_link);
238
    exit();
239
}
240
241
242
// alter table misc to add an index
243
mysqli_query(
244
    $db_link,
245
    "ALTER TABLE `".$pre."log_items` ADD `increment_id` INT(12) NOT NULL AUTO_INCREMENT, ADD PRIMARY KEY (`increment_id`)"
246
);
247
// create index
248
mysqli_query(
249
    $db_link,
250
    "CREATE INDEX teampass_log_items_id_item_IDX ON ".$pre."log_items (id_item, date);"
251
);
252
253
// add field agses-usercardid to Users table
254
$res = addColumnIfNotExist(
255
    $pre."users",
256
    "agses-usercardid",
257
    "VARCHAR(12) NOT NULL DEFAULT '0'"
258
);
259
if ($res === false) {
260
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field agses-usercardid to table Users! '.mysqli_error($db_link).'!"}]';
261
    mysqli_close($db_link);
262
    exit();
263
}
264
265
266
// add field encrypted_data to Categories table
267
$res = addColumnIfNotExist(
268
    $pre."categories",
269
    "encrypted_data",
270
    "TINYINT(1) NOT NULL DEFAULT '1'"
271
);
272
if ($res === false) {
273
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field encrypted_data to table categories! '.mysqli_error($db_link).'!"}]';
274
    mysqli_close($db_link);
275
    exit();
276
}
277
278
279
// add field is_mandatory to Categories table
280
$res = addColumnIfNotExist(
281
    $pre."categories",
282
    "is_mandatory",
283
    "BOOLEAN NOT NULL DEFAULT FALSE"
284
);
285
if ($res === false) {
286
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field is_mandatory to table categories! '.mysqli_error($db_link).'!"}]';
287
    mysqli_close($db_link);
288
    exit();
289
}
290
291
292
// alter table USERS - user_language
293
mysqli_query($db_link, "ALTER TABLE `".$pre."users` MODIFY user_language VARCHAR(50) NOT NULL DEFAULT '0'");
294
295
// alter table USERS - just ensure correct naming of IsAdministratedByRole
296
mysqli_query($db_link, "ALTER TABLE `".$pre."users` CHANGE IsAdministratedByRole isAdministratedByRole tinyint(5) NOT NULL DEFAULT '0'");
297
298
// alter table OTV
299
mysqli_query($db_link, "ALTER TABLE `".$pre."otv` CHANGE originator originator int(12) NOT NULL DEFAULT '0'");
300
301
// do clean of users table
302
$fieldsToUpdate = ['groupes_visibles', 'fonction_id', 'groupes_interdits'];
303
$result = mysqli_query($db_link, "SELECT id, groupes_visibles, fonction_id, groupes_interdits FROM `".$pre."users`");
304
while ($row = mysqli_fetch_assoc($result)) {
0 ignored issues
show
Bug introduced by
It seems like $result can also be of type boolean; however, parameter $result of mysqli_fetch_assoc() does only seem to accept mysqli_result, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

304
while ($row = mysqli_fetch_assoc(/** @scrutinizer ignore-type */ $result)) {
Loading history...
305
    // check if field contains , instead of ;
306
    foreach ($fieldsToUpdate as $field) {
307
        $tmp = cleanFields($row[$field]);
308
        if ($tmp !== $row[$field]) {
309
            mysqli_query(
310
                $db_link,
311
                "UPDATE `".$pre."users`
312
                SET `".$field."` = '".$tmp."'
313
                WHERE id = '".$row['id']."'"
314
            );
315
        }
316
    }
317
}
318
mysqli_free_result($result);
0 ignored issues
show
Bug introduced by
It seems like $result can also be of type boolean; however, parameter $result of mysqli_free_result() does only seem to accept mysqli_result, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

318
mysqli_free_result(/** @scrutinizer ignore-type */ $result);
Loading history...
319
320
321
// alter table Users
322
mysqli_query($db_link, "ALTER TABLE `".$pre."users` MODIFY groupes_visibles varchar(1000) NOT NULL");
323
mysqli_query($db_link, "ALTER TABLE `".$pre."users` MODIFY fonction_id varchar(1000) NOT NULL");
324
mysqli_query($db_link, "ALTER TABLE `".$pre."users` MODIFY groupes_interdits varchar(1000) NOT NULL");
325
mysqli_query($db_link, "ALTER TABLE `".$pre."users` MODIFY favourites varchar(1000) NOT NULL");
326
mysqli_query($db_link, "ALTER TABLE `".$pre."users` MODIFY latest_items varchar(1000) NOT NULL");
327
mysqli_query($db_link, "ALTER TABLE `".$pre."users` MODIFY avatar varchar(1000) NOT NULL");
328
mysqli_query($db_link, "ALTER TABLE `".$pre."users` MODIFY avatar_thumb varchar(1000) NOT NULL");
329
330
331
// alter table KB_ITEMS
332
mysqli_query($db_link, "ALTER TABLE `".$pre."kb_items` CHANGE `kb_id` `kb_id` INT(12) NOT NULL");
333
mysqli_query($db_link, "ALTER TABLE `".$pre."kb_items` CHANGE `item_id` `item_id` INT(12) NOT NULL");
334
335
336
// Alter table EXPORT - adapt field Label
337
mysqli_query($db_link, "ALTER TABLE `".$pre."export` CHANGE `label` `label` VARCHAR(500) NOT NULL");
338
339
// add field encrypted_data to CATEGORIES table
340
$res = addColumnIfNotExist(
341
    $pre."categories",
342
    "encrypted_data",
343
    "TINYINT(1) NOT NULL DEFAULT '1'"
344
);
345
if ($res === false) {
346
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field encrypted_data to table CATEGORIES! '.mysqli_error($db_link).'!"}]';
347
    mysqli_close($db_link);
348
    exit();
349
}
350
351
mysqli_query(
352
    $db_link,
353
    "UPDATE `".$pre."misc`
354
    SET `valeur` = 'maintenance_mode'
355
    WHERE type = 'admin' AND intitule = '".$post_no_maintenance_mode."'"
356
);
357
358
359
// add field encryption_type to ITEMS table
360
$res = addColumnIfNotExist(
361
    $pre."items",
362
    "encryption_type",
363
    "VARCHAR(20) NOT NULL DEFAULT 'not_set'"
364
);
365
if ($res === false) {
366
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field encryption_type to table ITEMS! '.mysqli_error($db_link).'!"}]';
367
    mysqli_close($db_link);
368
    exit();
369
}
370
371
372
// add field encryption_type to categories_items table
373
$res = addColumnIfNotExist(
374
    $pre."categories_items",
375
    "encryption_type",
376
    "VARCHAR(20) NOT NULL DEFAULT 'not_set'"
377
);
378
if ($res === false) {
379
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field encryption_type to table categories_items! '.mysqli_error($db_link).'!"}]';
380
    mysqli_close($db_link);
381
    exit();
382
}
383
384
385
// add field encryption_type to LOG_ITEMS table
386
$res = addColumnIfNotExist(
387
    $pre."log_items",
388
    "encryption_type",
389
    "VARCHAR(20) NOT NULL DEFAULT 'not_set'"
390
);
391
if ($res === false) {
392
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field encryption_type to table LOG_ITEMS! '.mysqli_error($db_link).'!"}]';
393
    mysqli_close($db_link);
394
    exit();
395
}
396
397
398
// add field URL to CACHE table
399
$res = addColumnIfNotExist(
400
    $pre."cache",
401
    "encryption_type",
402
    "VARCHAR(500) NOT NULL DEFAULT '0'"
403
);
404
if ($res === false) {
405
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field URL to table CACHE! '.mysqli_error($db_link).'!"}]';
406
    mysqli_close($db_link);
407
    exit();
408
}
409
410
411
// add field timestamp to CACHE table
412
$res = addColumnIfNotExist(
413
    $pre."cache",
414
    "timestamp",
415
    "VARCHAR(50) DEFAULT NULL DEFAULT '0'"
416
);
417
if ($res === false) {
418
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field url to table CACHE! '.mysqli_error($db_link).'!"}]';
419
    mysqli_close($db_link);
420
    exit();
421
}
422
423
424
// add field url to CACHE table
425
$res = addColumnIfNotExist(
426
    $pre."cache",
427
    "url",
428
    "VARCHAR(500) DEFAULT NULL"
429
);
430
if ($res === false) {
431
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field timestamp to table CACHE! '.mysqli_error($db_link).'!"}]';
432
    mysqli_close($db_link);
433
    exit();
434
}
435
436
437
// alter table CACHE to add an index
438
mysqli_query(
439
    $db_link,
440
    "ALTER TABLE `".$pre."cache` ADD `increment_id` INT(12) NOT NULL AUTO_INCREMENT, ADD PRIMARY KEY (`increment_id`)"
441
);
442
443
444
// alter table EXPORT to add an index
445
mysqli_query(
446
    $db_link,
447
    "ALTER TABLE `".$pre."export` ADD INDEX `id_idx` (`id`)"
448
);
449
mysqli_query(
450
    $db_link,
451
    "ALTER TABLE `".$pre."export` DROP INDEX `id_idx`"
452
);
453
454
455
// alter table EXPORT to add an index
456
mysqli_query(
457
    $db_link,
458
    "ALTER TABLE `".$pre."export` ADD `increment_id` INT(12) NOT NULL AUTO_INCREMENT, ADD PRIMARY KEY (`increment_id`)"
459
);
460
461
// alter table ITEMS_EDITION to add an index
462
mysqli_query(
463
    $db_link,
464
    "ALTER TABLE `".$pre."items_edition` ADD INDEX `item_id_idx` (`item_id`)"
465
);
466
mysqli_query(
467
    $db_link,
468
    "ALTER TABLE `".$pre."items_edition` DROP INDEX `item_id_idx`"
469
);
470
471
// alter table items_edition to add an index
472
mysqli_query(
473
    $db_link,
474
    "ALTER TABLE `".$pre."items_edition` ADD `increment_id` INT(12) NOT NULL AUTO_INCREMENT, ADD PRIMARY KEY (`increment_id`)"
475
);
476
477
478
// alter table restriction_to_roles to add an index
479
mysqli_query(
480
    $db_link,
481
    "ALTER TABLE `".$pre."restriction_to_roles` ADD INDEX `role_id_idx` (`role_id`)"
482
);
483
mysqli_query(
484
    $db_link,
485
    "ALTER TABLE `".$pre."restriction_to_roles` DROP INDEX `role_id_idx`"
486
);
487
488
// alter table restriction_to_roles to add an index
489
mysqli_query(
490
    $db_link,
491
    "ALTER TABLE `".$pre."restriction_to_roles` ADD `increment_id` INT(12) NOT NULL AUTO_INCREMENT, ADD PRIMARY KEY (`increment_id`)"
492
);
493
494
495
// alter table NESTEED_TREE to add an index
496
mysqli_query(
497
    $db_link,
498
    "ALTER TABLE `".$pre."nested_tree` ADD KEY `nested_tree_parent_id` (`parent_id`)"
499
);
500
mysqli_query(
501
    $db_link,
502
    "ALTER TABLE `".$pre."nested_tree` ADD KEY `nested_tree_nleft` (`nleft`)"
503
);
504
mysqli_query(
505
    $db_link,
506
    "ALTER TABLE `".$pre."nested_tree` ADD KEY `nested_tree_nright` (`nright`)"
507
);
508
mysqli_query(
509
    $db_link,
510
    "ALTER TABLE `".$pre."nested_tree` ADD KEY `nested_tree_nlevel` (`nlevel`)"
511
);
512
mysqli_query(
513
    $db_link,
514
    "ALTER TABLE `".$pre."nested_tree` ADD KEY `personal_folder_idx` (`personal_folder`)"
515
);
516
mysqli_query(
517
    $db_link,
518
    "ALTER TABLE `".$pre."nested_tree` ADD KEY `id` (`id`)"
519
);
520
521
522
523
// alter table ROLES_VALUES to add an index
524
mysqli_query(
525
    $db_link,
526
    "ALTER TABLE `".$pre."roles_values` ADD KEY `role_id_idx` (`role_id`)"
527
);
528
529
// alter table ROLES_VALUES to add a primary key
530
mysqli_query(
531
    $db_link,
532
    "ALTER TABLE `".$pre."roles_values` ADD `increment_id` INT(12) NOT NULL AUTO_INCREMENT PRIMARY KEY"
533
);
534
535
536
// alter table KB_ITEMS to add an index
537
mysqli_query(
538
    $db_link,
539
    "ALTER TABLE `".$pre."kb_items` ADD PRIMARY KEY (`kb_id`)"
540
);
541
mysqli_query(
542
    $db_link,
543
    "ALTER TABLE `".$pre."kb_items` DROP PRIMARY KEY"
544
);
545
546
// alter table kb_items to add an index
547
mysqli_query(
548
    $db_link,
549
    "ALTER TABLE `".$pre."kb_items` ADD `increment_id` INT(12) NOT NULL AUTO_INCREMENT, ADD PRIMARY KEY (`increment_id`)"
550
);
551
552
553
// alter table EMAILS to add an index
554
mysqli_query(
555
    $db_link,
556
    "ALTER TABLE `".$pre."emails` ADD `increment_id` INT(12) NOT NULL AUTO_INCREMENT, ADD PRIMARY KEY (`increment_id`)"
557
);
558
559
560
// alter table AUTOMATIC_DEL to add an index
561
mysqli_query(
562
    $db_link,
563
    "ALTER TABLE `".$pre."automatic_del` ADD PRIMARY KEY (`item_id`)"
564
);
565
566
567
// alter table CATEGORY_FOLDERS to add an index
568
mysqli_query(
569
    $db_link,
570
    "ALTER TABLE `".$pre."categories_folders` ADD PRIMARY KEY (`id_category`)"
571
);
572
mysqli_query(
573
    $db_link,
574
    "ALTER TABLE `".$pre."categories_folders` DROP PRIMARY KEY"
575
);
576
577
// alter table categories_folders to add an index
578
mysqli_query(
579
    $db_link,
580
    "ALTER TABLE `".$pre."categories_folders` ADD `increment_id` INT(12) NOT NULL AUTO_INCREMENT, ADD PRIMARY KEY (`increment_id`)"
581
);
582
583
584
//-- generate new DEFUSE key
585
if (isset($session_tp_defuse_installed) === false || $session_tp_defuse_installed === false) {
586
    $filename = "../includes/config/settings.php";
587
    $settingsFile = file($filename);
588
    foreach ($settingsFile as $key => $val) {
589
        if (substr_count($val, 'require_once "') > 0 && substr_count($val, 'sk.php') > 0) {
590
            $superGlobal->put("sk_file", substr($val, 14, strpos($val, '";') - 14), "SESSION");
591
            $session_sk_file = $superGlobal->get("sk_file", "SESSION");
592
        }
593
    }
594
595
    copy(
596
        SECUREPATH."/teampass-seckey.txt",
0 ignored issues
show
Bug introduced by
The constant SECUREPATH was not found. Maybe you did not declare it correctly or list all dependencies?
Loading history...
597
        SECUREPATH."/teampass-seckey.txt".'.'.date("Y_m_d", mktime(0, 0, 0, (int) date('m'), (int) date('d'), (int) date('y'))).".".time()
598
    );
599
    $superGlobal->put("tp_defuse_new_key", true, "SESSION");
600
    $new_salt = defuse_generate_key();
601
    file_put_contents(
602
        SECUREPATH."/teampass-seckey.txt",
603
        $new_salt
604
    );
605
    $superGlobal->put("new_salt", $new_salt, "SESSION");
606
607
    // update sk.php file
608
    copy(
609
        $session_sk_file,
610
        $session_sk_file.'.'.date("Y_m_d", mktime(0, 0, 0, (int) date('m'), (int) date('d'), (int) date('y'))).".".time()
611
    );
612
    $data = file($session_sk_file); // reads an array of lines
613
    function replace_a_line($data)
614
    {
615
        if (stristr($data, "@define('SALT'")) {
616
            return "";
617
        }
618
        return $data;
619
    }
620
    $data = array_map('replace_a_line', $data);
0 ignored issues
show
Bug introduced by
It seems like $data can also be of type false; however, parameter $arr1 of array_map() does only seem to accept array, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

620
    $data = array_map('replace_a_line', /** @scrutinizer ignore-type */ $data);
Loading history...
621
    file_put_contents($session_sk_file, implode('', $data));
622
623
    //
624
    //
625
    //-- users need to perform re-encryption of their personal pwds
626
    $result = mysqli_query(
627
        $db_link,
628
        "SELECT valeur FROM `".$pre."misc` WHERE type='admin' AND intitule='encryption_type'"
629
    );
630
    $row = mysqli_fetch_assoc($result);
631
    if ($row['valeur'] !== "defuse") {
632
        $result = mysqli_query(
633
            $db_link,
634
            "SELECT id FROM `".$pre."users`"
635
        );
636
        while ($row_user = mysqli_fetch_assoc($result)) {
637
            $result_items = mysqli_query(
638
                $db_link,
639
                "SELECT i.id AS item_id
640
                FROM `".$pre."nested_tree` AS n
641
                INNER JOIN `".$pre."items` AS i ON (i.id_tree = n.id)
642
                WHERE n.title = ".$row_user['id']
643
            );
644
            if (mysqli_num_rows($result_items) > 0) {
645
                mysqli_query(
646
                    $db_link,
647
                    "UPDATE `".$pre."users`
648
                    SET `upgrade_needed` = '1'
649
                    WHERE id = ".$row_user['id']
650
                );
651
            } else {
652
                mysqli_query(
653
                    $db_link,
654
                    "UPDATE `".$pre."users`
655
                    SET `upgrade_needed` = '0'
656
                    WHERE id = ".$row_user['id']
657
                );
658
            }
659
        }
660
661
        mysqli_query(
662
            $db_link,
663
            "UPDATE `".$pre."misc`
664
            SET `valeur` = 'defuse'
665
            WHERE `type`='admin' AND `initule`='encryption_type'"
666
        );
667
    }
668
} else {
669
    $_SESSION['tp_defuse_new_key'] = false;
670
}
671
//--
672
673
674
// add field encrypted_psk to Users table
675
$res = addColumnIfNotExist(
676
    $pre."users",
677
    "encrypted_psk",
678
    "TEXT NOT NULL"
679
);
680
if ($res === false) {
681
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field encrypted_psk to table Users! '.mysqli_error($db_link).'!"}]';
682
    mysqli_close($db_link);
683
    exit();
684
}
685
686
687
// add new admin setting "manager_move_item"
688
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'manager_move_item'"));
689
if (intval($tmp) === 0) {
690
    mysqli_query(
691
        $db_link,
692
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'manager_move_item', '0')"
693
    );
694
}
695
696
// add new admin setting "create_item_without_password"
697
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'create_item_without_password'"));
698
if (intval($tmp) === 0) {
699
    mysqli_query(
700
        $db_link,
701
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'create_item_without_password', '0')"
702
    );
703
}
704
705
// add new admin setting "send_statistics_items"
706
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'send_statistics_items'"));
707
if (intval($tmp) === 0) {
708
    mysqli_query(
709
        $db_link,
710
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'send_statistics_items', 'stat_country;stat_users;stat_items;stat_items_shared;stat_folders;stat_folders_shared;stat_admins;stat_managers;stat_ro;stat_mysqlversion;stat_phpversion;stat_teampassversion;stat_languages;stat_kb;stat_suggestion;stat_customfields;stat_api;stat_2fa;stat_agses;stat_duo;stat_ldap;stat_syslog;stat_stricthttps;stat_fav;stat_pf;')"
711
    );
712
}
713
714
// add new admin setting "send_stats_time"
715
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'send_stats_time'"));
716
if (intval($tmp) === 0) {
717
    mysqli_query(
718
        $db_link,
719
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'send_stats_time', '".(time() - 2592000)."')"
720
    );
721
}
722
723
// add new admin setting "agses_authentication_enabled"
724
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'agses_authentication_enabled'"));
725
if (intval($tmp) === 0) {
726
    mysqli_query(
727
        $db_link,
728
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'agses_authentication_enabled', '0')"
729
    );
730
}
731
732
// add new admin setting "timezone"
733
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'timezone'"));
734
if (intval($tmp) === 0) {
735
    mysqli_query(
736
        $db_link,
737
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'timezone', 'UTC')"
738
    );
739
}
740
741
// add new admin setting "personal_saltkey_security_level"
742
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'personal_saltkey_security_level'"));
743
if (intval($tmp) === 0) {
744
    mysqli_query(
745
        $db_link,
746
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'personal_saltkey_security_level', '0')"
747
    );
748
}
749
750
// add new admin setting "item_extra_fields"
751
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'item_extra_fields'"));
752
if (intval($tmp) === 0) {
753
    mysqli_query(
754
        $db_link,
755
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'item_extra_fields', '0')"
756
    );
757
}
758
759
// add new admin setting "ldap_new_user_is_administrated_by"
760
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'ldap_new_user_is_administrated_by'"));
761
if (intval($tmp) === 0) {
762
    mysqli_query(
763
        $db_link,
764
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'ldap_new_user_is_administrated_by', '0')"
765
    );
766
}
767
768
769
// add new admin setting "ldap_port"
770
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'ldap_port'"));
771
if (intval($tmp) === 0) {
772
    mysqli_query(
773
        $db_link,
774
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'ldap_port', '389')"
775
    );
776
}
777
778
// add new admin setting "offline_key_level"
779
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'offline_key_level'"));
780
if (intval($tmp) === 0) {
781
    mysqli_query(
782
        $db_link,
783
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'offline_key_level', '0')"
784
    );
785
}
786
787
// add new admin setting "enable_http_request_login"
788
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'enable_http_request_login'"));
789
if (intval($tmp) === 0) {
790
    mysqli_query(
791
        $db_link,
792
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'enable_http_request_login', '0')"
793
    );
794
}
795
796
// add new admin setting "admin_2fa_required"
797
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'admin_2fa_required'"));
798
if (intval($tmp) === 0) {
799
    mysqli_query(
800
        $db_link,
801
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'admin_2fa_required', '1')"
802
    );
803
}
804
805
806
// add new language "portuges_br"
807
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."languages` WHERE name = 'portuguese_br'"));
808
if (intval($tmp) === 0) {
809
    mysqli_query(
810
        $db_link,
811
        "INSERT INTO `".$pre."languages` (`name`, `label`, `code`, `flag`) VALUES ('portuguese_br', 'Portuguese_br', 'pr-bt', 'pr-bt.png')"
812
    );
813
}
814
815
816
// add new language "Ukrainian"
817
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."languages` WHERE name = 'ukrainian'"));
818
if (intval($tmp) === 0) {
819
    mysqli_query(
820
        $db_link,
821
        "INSERT INTO `".$pre."languages` (`name`, `label`, `code`, `flag`) VALUES ('ukrainian', 'Ukrainian', 'ua', 'ua.png')"
822
    );
823
}
824
825
826
// add new language "Romanian"
827
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."languages` WHERE name = 'romanian'"));
828
if (intval($tmp) === 0) {
829
    mysqli_query(
830
        $db_link,
831
        "INSERT INTO `".$pre."languages` (`name`, `label`, `code`, `flag`) VALUES ('romanian', 'Romanian', 'ro', 'ro.png')"
832
    );
833
}
834
835
836
// add new language "Polish"
837
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."languages` WHERE name = 'polish'"));
838
if (intval($tmp) === 0) {
839
    mysqli_query(
840
        $db_link,
841
        "INSERT INTO `".$pre."languages` (`name`, `label`, `code`, `flag`) VALUES ('polish', 'Polish', 'po', 'po.png')"
842
    );
843
}
844
845
846
// add new language "Hungarian"
847
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."languages` WHERE name = 'hungarian'"));
848
if (intval($tmp) === 0) {
849
    mysqli_query(
850
        $db_link,
851
        "INSERT INTO `".$pre."languages` (`name`, `label`, `code`, `flag`) VALUES ('hungarian', 'Hungarian', 'hu', 'hu.png')"
852
    );
853
}
854
855
856
// add new language "Greek"
857
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."languages` WHERE name = 'greek'"));
858
if (intval($tmp) === 0) {
859
    mysqli_query(
860
        $db_link,
861
        "INSERT INTO `".$pre."languages` (`name`, `label`, `code`, `flag`) VALUES ('greek', 'Greek', 'gr', 'gr.png')"
862
    );
863
}
864
865
866
// add new language "Bulgarian"
867
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."languages` WHERE name = 'bulgarian'"));
868
if (intval($tmp) === 0) {
869
    mysqli_query(
870
        $db_link,
871
        "INSERT INTO `".$pre."languages` (`name`, `label`, `code`, `flag`) VALUES ('bulgarian', 'Bulgarian', 'bg', 'bg.png')"
872
    );
873
}
874
875
876
// alter table USERS to add a new field "ga_temporary_code"
877
mysqli_query(
878
    $db_link,
879
    "ALTER TABLE `".$pre."users` ADD `ga_temporary_code` VARCHAR(20) NOT NULL DEFAULT 'none' AFTER `ga`;"
880
);
881
882
883
// alter table USERS to add a new field "user_ip"
884
$res = addColumnIfNotExist(
885
    $pre."users",
886
    "user_ip",
887
    "VARCHAR(400) NOT NULL DEFAULT 'none'"
888
);
889
if ($res === true) {
890
    // Change name of field
891
    mysqli_query($db_link, "ALTER TABLE `".$pre."users` CHANGE `user_ip` `user_ip` VARCHAR(400) NOT NULL DEFAULT 'none'");
892
} elseif ($res === false) {
893
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field user_ip to table Users! '.mysqli_error($db_link).'!"}]';
894
    mysqli_close($db_link);
895
    exit();
896
}
897
898
899
// alter table USERS to add a new field "user_api_key"
900
$res = addColumnIfNotExist(
901
    $pre."users",
902
    "user_api_key",
903
    "VARCHAR(500) NOT NULL DEFAULT 'none'"
904
);
905
if ($res === false) {
906
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field user_api_key to table Users! '.mysqli_error($db_link).'!"}]';
907
    mysqli_close($db_link);
908
    exit();
909
}
910
911
912
// alter table USERS to add a new field "yubico_user_key"
913
$res = addColumnIfNotExist(
914
    $pre."users",
915
    "yubico_user_key",
916
    "VARCHAR(100) NOT NULL DEFAULT 'none'"
917
);
918
if ($res === false) {
919
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field yubico_user_key to table Users! '.mysqli_error($db_link).'!"}]';
920
    mysqli_close($db_link);
921
    exit();
922
}
923
924
925
// alter table USERS to add a new field "yubico_user_id"
926
$res = addColumnIfNotExist(
927
    $pre."users",
928
    "yubico_user_id",
929
    "VARCHAR(100) NOT NULL DEFAULT 'none'"
930
);
931
if ($res === false) {
932
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field yubico_user_id to table Users! '.mysqli_error($db_link).'!"}]';
933
    mysqli_close($db_link);
934
    exit();
935
}
936
937
938
// alter table USERS to allow NULL on field "email"
939
mysqli_query(
940
    $db_link,
941
    "ALTER TABLE `".$pre."users` CHANGE `email` `email` VARCHAR(300) NOT NULL DEFAULT 'none';"
942
);
943
944
945
// alter table EXPORT to add a new fields
946
mysqli_query(
947
    $db_link,
948
    "ALTER TABLE `".$pre."export` ADD `email` VARCHAR(500) NOT NULL DEFAULT 'none';"
949
);
950
mysqli_query(
951
    $db_link,
952
    "ALTER TABLE `".$pre."export` ADD `url` VARCHAR(500) NOT NULL DEFAULT 'none';"
953
);
954
mysqli_query(
955
    $db_link,
956
    "ALTER TABLE `".$pre."export` ADD `kbs` VARCHAR(500) NOT NULL DEFAULT 'none';"
957
);
958
mysqli_query(
959
    $db_link,
960
    "ALTER TABLE `".$pre."export` ADD `tags` VARCHAR(500) NOT NULL DEFAULT 'none';"
961
);
962
963
mysqli_query(
964
    $db_link,
965
    "ALTER TABLE `".$pre."misc` CHANGE valeur valeur VARCHAR(500) NOT NULL DEFAULT 'none'"
966
);
967
968
// alter table ITEMS_CHANGE
969
mysqli_query(
970
    $db_link,
971
    "ALTER TABLE `".$pre."items_change` CHANGE user_id user_id INT(12) NOT NULL;"
972
);
973
974
// alter table ITEMS
975
mysqli_query(
976
    $db_link,
977
    "ALTER TABLE `".$pre."items` CHANGE auto_update_pwd_next_date auto_update_pwd_next_date VARCHAR(100) NOT NULL DEFAULT '0';"
978
);
979
980
981
// add new admin setting "otv_is_enabled"
982
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'otv_is_enabled'"));
983
if (intval($tmp) === 0) {
984
    mysqli_query(
985
        $db_link,
986
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'otv_is_enabled', '0')"
987
    );
988
}
989
990
991
// add new admin setting "ldap_and_local_authentication"
992
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'ldap_and_local_authentication'"));
993
if (intval($tmp) === 0) {
994
    mysqli_query(
995
        $db_link,
996
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'ldap_and_local_authentication', '0')"
997
    );
998
}
999
1000
1001
// add new admin setting "secure_display_image"
1002
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'secure_display_image'"));
1003
if (intval($tmp) === 0) {
1004
    mysqli_query(
1005
        $db_link,
1006
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'secure_display_image', '1')"
1007
    );
1008
}
1009
1010
1011
// add new admin setting "upload_zero_byte_file"
1012
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'upload_zero_byte_file'"));
1013
if (intval($tmp) === 0) {
1014
    mysqli_query(
1015
        $db_link,
1016
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'upload_zero_byte_file', '0')"
1017
    );
1018
}
1019
1020
1021
// add new admin setting "upload_all_extensions_file"
1022
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'upload_all_extensions_file'"));
1023
if (intval($tmp) === 0) {
1024
    mysqli_query(
1025
        $db_link,
1026
        "INSERT INTO `".$pre."misc` (`type`, `intitule`, `valeur`) VALUES ('admin', 'upload_all_extensions_file', '0')"
1027
    );
1028
}
1029
1030
1031
// generate new backup key
1032
mysqli_query(
1033
    $db_link,
1034
    "UPDATE `".$pre."misc`
1035
    SET valeur = '".generateRandomKey()."'
0 ignored issues
show
Bug introduced by
Are you sure the usage of generateRandomKey() is correct as it seems to always return null.

This check looks for function or method calls that always return null and whose return value is used.

class A
{
    function getObject()
    {
        return null;
    }

}

$a = new A();
if ($a->getObject()) {

The method getObject() can return nothing but null, so it makes no sense to use the return value.

The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes.

Loading history...
Bug introduced by
Are you sure generateRandomKey() of type void can be used in concatenation? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

1035
    SET valeur = '"./** @scrutinizer ignore-type */ generateRandomKey()."'
Loading history...
1036
    WHERE type = 'admin' AND intitule = 'bck_script_passkey'"
1037
);
1038
1039
1040
1041
// alter table NESTEED_TREE to INT(5) on field "renewal_period"
1042
mysqli_query(
1043
    $db_link,
1044
    "ALTER TABLE `".$pre."nested_tree` CHANGE `renewal_period` `renewal_period` INT(5) NOT null DEFAULT '0';"
1045
);
1046
1047
1048
// alter table USERS
1049
mysqli_query(
1050
    $db_link,
1051
    "ALTER TABLE `".$pre."users` CHANGE `avatar` `avatar` VARCHAR(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL, CHANGE `avatar_thumb` `avatar_thumb` VARCHAR(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL;"
1052
);
1053
1054
1055
// alter table NESTED_TREE
1056
mysqli_query(
1057
    $db_link,
1058
    "ALTER TABLE `".$pre."nested_tree` CHANGE `nleft` `nleft` INT(11) NULL DEFAULT NULL, CHANGE `nright` `nright` INT(11) NULL DEFAULT NULL, CHANGE `nlevel` `nlevel` INT(11) NULL DEFAULT NULL;"
1059
);
1060
1061
1062
1063
// add new field for items_change
1064
mysqli_query(
1065
    $db_link,
1066
    "CREATE TABLE IF NOT EXISTS `".$pre."items_change` (
1067
    `id` int(12) NOT NULL AUTO_INCREMENT,
1068
    `item_id` int(12) NOT NULL,
1069
    `label` varchar(255) NOT NULL DEFAULT 'none',
1070
    `pw` text NOT NULL,
1071
    `login` varchar(255) NOT NULL DEFAULT 'none',
1072
    `email` varchar(255) NOT NULL DEFAULT 'none',
1073
    `url` varchar(255) NOT NULL DEFAULT 'none',
1074
    `description` text NOT NULL,
1075
    `comment` text NOT NULL,
1076
    `folder_id` tinyint(12) NOT NULL,
1077
    `user_id` tinyint(12) NOT NULL,
1078
    `timestamp` varchar(50) NOT NULL DEFAULT 'none',
1079
    PRIMARY KEY (`id`)
1080
    ) CHARSET=utf8;"
1081
);
1082
1083
1084
// add field status to FILE table
1085
$res = addColumnIfNotExist(
1086
    $pre."files",
1087
    "content",
1088
    "longblob DEFAULT NULL"
1089
);
1090
if ($res === false) {
1091
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field content to table files! '.mysqli_error($db_link).'!"}]';
1092
    mysqli_close($db_link);
1093
    exit();
1094
}
1095
1096
1097
// add new table for templates
1098
mysqli_query(
1099
    $db_link,
1100
    "CREATE TABLE IF NOT EXISTS `".$pre."templates` (
1101
    `increment_id` int(12) NOT NULL AUTO_INCREMENT,
1102
    `item_id` int(12) NOT NULL,
1103
    `category_id` int(12) NOT NULL,
1104
    PRIMARY KEY (`increment_id`)
1105
    ) CHARSET=utf8;"
1106
);
1107
1108
1109
1110
// File encryption
1111
// add field status to FILE table
1112
$res = addColumnIfNotExist(
1113
    $pre."files",
1114
    "status",
1115
    "VARCHAR(50) NOT NULL DEFAULT '0'"
1116
);
1117
if ($res === false) {
1118
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field agses-usercardid to table Users! '.mysqli_error($db_link).'!"}]';
1119
    mysqli_close($db_link);
1120
    exit();
1121
}
1122
1123
// fill in this new field with the current "encryption-file" status
1124
$tmp = mysqli_fetch_row(mysqli_query($db_link, "SELECT valeur FROM `".$pre."misc` WHERE type = 'admin' AND intitule = 'enable_attachment_encryption'"));
1125
if (!empty($tmp[0])) {
1126
    if ($tmp[0] === "1") {
1127
        $status = "encrypted";
1128
    } else {
1129
        $status = "clear";
1130
    }
1131
    mysqli_query($db_link, "update `".$pre."files` set status = '".$status."' where 1 = 1");
1132
}
1133
1134
1135
// add 2 generic users
1136
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."users` WHERE id = '9999991' AND login = 'OTV'"));
1137
if (intval($tmp) === 0) {
1138
    mysqli_query(
1139
        $db_link,
1140
        "INSERT INTO `".$pre."users` (`id`, `login`, `pw`, `groupes_visibles`, `derniers`, `key_tempo`, `last_pw_change`, `last_pw`, `admin`, `fonction_id`, `groupes_interdits`, `last_connexion`, `gestionnaire`, `email`, `favourites`, `latest_items`, `personal_folder`) VALUES ('9999991', 'OTV', '', '', '', '', '', '', '1', '', '', '', '0', '', '', '', '0')"
1141
    );
1142
}
1143
$tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."users` WHERE id = '9999991' AND login = 'OTV'"));
1144
if (intval($tmp) === 0) {
1145
    mysqli_query(
1146
        $db_link,
1147
        "INSERT INTO `".$pre."users` (`id`, `login`, `pw`, `groupes_visibles`, `derniers`, `key_tempo`, `last_pw_change`, `last_pw`, `admin`, `fonction_id`, `groupes_interdits`, `last_connexion`, `gestionnaire`, `email`, `favourites`, `latest_items`, `personal_folder`) VALUES ('9999999', 'API', '', '', '', '', '', '', '1', '', '', '', '0', '', '', '', '0')"
1148
    );
1149
}
1150
1151
1152
// Update favico to favicon
1153
$result = mysqli_query($db_link, "SELECT valeur FROM `".$pre."misc` WHERE intitule = 'cpassman_url' AND type = 'admin'");
1154
$rows = mysqli_fetch_assoc($result);
1155
mysqli_free_result($result);
1156
mysqli_query(
1157
    $db_link,
1158
    "UPDATE `".$pre."misc`
1159
    SET `valeur` = '".$rows['valeur']."/favicon.ico'
1160
    WHERE intitule = 'favicon' AND type = 'admin'"
1161
);
1162
1163
1164
// Remove some indexes
1165
mysqli_query($db_link, "ALTER TABLE ".$pre."nested_tree` DROP INDEX `id`;");
1166
mysqli_query($db_link, "ALTER TABLE ".$pre."tags` DROP INDEX `id`;");
1167
1168
1169
// add field masked to CATEGORIES table
1170
$res = addColumnIfNotExist(
1171
    $pre."categories",
1172
    "masked",
1173
    "tinyint(1) NOT NULL default '0'"
1174
);
1175
if ($res === false) {
1176
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field masked to table CATEGORIES! '.mysqli_error($db_link).'!"}]';
1177
    mysqli_close($db_link);
1178
    exit();
1179
}
1180
1181
1182
// add field role_visibility to CATEGORIES table
1183
$res = addColumnIfNotExist(
1184
    $pre."categories",
1185
    "role_visibility",
1186
    "VARCHAR(250) NOT NULL DEFAULT 'all'"
1187
);
1188
if ($res === false) {
1189
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field role_visibility to table CATEGORIES! '.mysqli_error($db_link).'!"}]';
1190
    mysqli_close($db_link);
1191
    exit();
1192
}
1193
1194
1195
// add field is_mandatory to CATEGORIES table
1196
$res = addColumnIfNotExist(
1197
    $pre."categories",
1198
    "is_mandatory",
1199
    "tinyint(1) NOT NULL DEFAULT '0'"
1200
);
1201
if ($res === false) {
1202
    echo '[{"finish":"1", "msg":"", "error":"An error appears when adding field is_mandatory to table CATEGORIES! '.mysqli_error($db_link).'!"}]';
1203
    mysqli_close($db_link);
1204
    exit();
1205
}
1206
1207
1208
// Now perform an operation on table CATEGORIES
1209
// This will change the 'masked' to an attribute of 'text' type
1210
$result = mysqli_query(
1211
    $db_link,
1212
    "SELECT id, type FROM `".$pre."categories` WHERE type = 'masked'"
1213
);
1214
while ($row_field = mysqli_fetch_assoc($result)) {
1215
    mysqli_query(
1216
        $db_link,
1217
        "UPDATE `".$pre."categories`
1218
        SET `type` = 'text', `masked` = '1'
1219
        WHERE id = ".$row_field['id']
1220
    );
1221
}
1222
1223
1224
/*
1225
* Introduce new CONFIG file
1226
*/
1227
$tp_config_file = "../includes/config/tp.config.php";
1228
if (file_exists($tp_config_file)) {
1229
    if (!copy($tp_config_file, $tp_config_file.'.'.date("Y_m_d", mktime(0, 0, 0, (int) date('m'), (int) date('d'), (int) date('y'))))) {
1230
        echo '[{"error" : "includes/config/tp.config.php file already exists and cannot be renamed. Please do it by yourself and click on button Launch.", "result":"", "index" : "'.$post_index.'", "multiple" : "'.$post_multiple.'"}]';
1231
        return false;
1232
    } else {
1233
        unlink($tp_config_file);
1234
    }
1235
}
1236
$file_handler = fopen($tp_config_file, 'w');
1237
$config_text = "";
1238
$any_settings = false;
1239
1240
$result = mysqli_query($db_link, "SELECT * FROM `".$pre."misc` WHERE type = 'admin'");
1241
while ($row = mysqli_fetch_assoc($result)) {
1242
    // append new setting in config file
1243
    $config_text .= "
1244
    '".$row['intitule']."' => '".$row['valeur']."',";
1245
    if ($any_settings === false) {
1246
        $any_settings = true;
1247
    }
1248
}
1249
mysqli_free_result($result);
1250
1251
// write to config file
1252
if ($any_settings === true) {
1253
    $result = fwrite(
1254
        $file_handler,
0 ignored issues
show
Bug introduced by
It seems like $file_handler can also be of type false; however, parameter $handle of fwrite() does only seem to accept resource, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

1254
        /** @scrutinizer ignore-type */ $file_handler,
Loading history...
1255
        utf8_encode(
1256
            "<?php
1257
global \$SETTINGS;
1258
\$SETTINGS = array (" . $config_text."
1259
);"
1260
        )
1261
    );
1262
}
1263
fclose($file_handler);
0 ignored issues
show
Bug introduced by
It seems like $file_handler can also be of type false; however, parameter $handle of fclose() does only seem to accept resource, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

1263
fclose(/** @scrutinizer ignore-type */ $file_handler);
Loading history...
1264
1265
1266
// Generate API key by user
1267
$result = mysqli_query($db_link, "SELECT id FROM `".$pre."users` WHERE login NOT IN ('admin', 'API', 'OTV')");
1268
while ($row = mysqli_fetch_assoc($result)) {
1269
    // Check if key already exists
1270
    $tmp = mysqli_num_rows(mysqli_query($db_link, "SELECT * FROM `".$pre."api` WHERE label = '".$row['id']."'"));
1271
    if (intval($tmp) === 0) {
1272
        mysqli_query(
1273
            $db_link,
1274
            "INSERT INTO `".$pre."api` (`type`, `label`, `value`, `timestamp`) VALUES ('user', '".$row['id']."', '".uniqidReal(39)."', '".time()."')"
1275
        );
1276
    }
1277
}
1278
1279
// Finished
1280
echo '[{"finish":"1" , "next":"", "error":""}]';
1281