Issues (103)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

app/commands/MigrateOldDatabase.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
use Illuminate\Console\Command;
4
use Illuminate\Support\Collection;
5
use Symfony\Component\Console\Input\InputArgument;
6
7
class MigrateOldDatabase extends Command {
0 ignored issues
show
Coding Style Compatibility introduced by
PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions.

You can fix this by adding a namespace to your class:

namespace YourVendor;

class YourClass { }

When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.

Loading history...
8
9
	/**
10
	 * The console command name.
11
	 *
12
	 * @var string
13
	 */
14
	protected $name = 'upgrade:old-database';
15
16
	/**
17
	 * The console command description.
18
	 *
19
	 * @var string
20
	 */
21
	protected $description = 'Upgrade database from alpha.';
22
23
	/**
24
	 * Execute the console command.
25
	 *
26
	 * @return mixed
27
	 */
28
	public function fire() {
29
30
		if (App::environment() == 'production' || ! $this->confirm('Are you sure?')) {
31
			$this->error('Disabled for safety');
32
33
			return;
34
		}
35
36
		$disableForeignKeyChecks = in_array(DB::connection()->getDriverName(), ['mysql']);
37
38
		Eloquent::unguard();
39
		if ($disableForeignKeyChecks) {
40
			DB::statement('SET FOREIGN_KEY_CHECKS=0;');
41
		}
42
43
		DB::beginTransaction();
44
45
		// Users
46
		$users = $this->migrateUsers();
47
		$this->migrateMovies();
48
		$this->migrateMovieEarnings();
49
		$this->migrateLeagues();
50
		$league_movie_by_league_and_movie_id = $this->migrateLeagueMovies();
51
		$team_by_league_and_user_id = $this->migrateLeagueUsers($users);
52
		$this->migrateLeagueMovieUsers($team_by_league_and_user_id, $league_movie_by_league_and_movie_id);
53
54
55
		DB::commit();
56
		if ($disableForeignKeyChecks) {
57
			DB::statement('SET FOREIGN_KEY_CHECKS=1;');
58
		}
59
	}
60
61
	/**
62
	 * Get stuff from old database
63
	 *
64
	 * @return \Illuminate\Database\Connection
65
	 */
66
	public function fromOldDB() {
67
		return DB::connection($this->argument('old-connection'));
68
	}
69
70
	/**
71
	 * Get the console command arguments.
72
	 *
73
	 * @return array
74
	 */
75 9
	protected function getArguments() {
76
		return [
77 9
			['old-connection', InputArgument::REQUIRED, 'The old connection to use'],
78 9
		];
79
	}
80
81
	/**
82
	 * Get the console command options.
83
	 *
84
	 * @return array
85
	 */
86 9
	protected function getOptions() {
87
		return [
88 9
		];
89
	}
90
91
	/**
92
	 * @return Collection Users
93
	 */
94
	protected function migrateUsers() {
95
		$this->info('Migrating users...');
96
		$users = (new Collection($this->fromOldDB()->table('users')->get()))->keyBy('id');
97
		$count = 0;
98
		foreach ($users as $user) {
99
			if (++$count % 1000 == 0) $this->info($count);
100
			DB::table('users')->insert([
101
				'id'          => $user->id,
102
				'username'    => $user->username,
103
				'displayname' => $user->displayname,
104
				'email'       => $user->email ?: null,
105
				'admin'       => $user->admin,
106
				'created_at'  => $user->created_at,
107
				'updated_at'  => $user->updated_at,
108
			]);
109
		}
110
111
		return $users;
112
	}
113
114
	/**
115
	 */
116
	protected function migrateMovies() {
117
		$this->info('Migrating movies...');
118
		$movies = (new Collection($this->fromOldDB()->table('movies')->get()))->keyBy('id');
119
		$count = 0;
120
		foreach ($movies as $movie) {
121
			if (++$count % 1000 == 0) $this->info($count);
122
			DB::table('movies')->insert([
123
				'id'                 => $movie->id,
124
				'name'               => $movie->name,
125
				'boxmojo_id'         => $movie->boxmojo_id,
126
				'release'            => $movie->release,
127
				'latest_earnings_id' => $movie->latest_earnings_id,
128
				'created_at'         => $movie->created_at,
129
			]);
130
		}
131
132
	}
133
134
	/**
135
	 */
136
	protected function migrateMovieEarnings() {
137
		$this->info('Migrating movie_earnings...');
138
		$movie_earnings = (new Collection($this->fromOldDB()->table('movie_earnings')->get()))->keyBy('id');
139
		$count = 0;
140
		foreach ($movie_earnings as $movie_earning) {
141
			if (++$count % 1000 == 0) $this->info($count);
142
			DB::table('movie_earnings')->insert([
143
				'id'         => $movie_earning->id,
144
				'movie_id'   => $movie_earning->movie_id,
145
				'date'       => $movie_earning->date,
146
				'domestic'   => $movie_earning->domestic,
147
				'created_at' => $movie_earning->created_at,
148
				'updated_at' => $movie_earning->updated_at,
149
			]);
150
		}
151
	}
152
153
	/**
154
	 */
155
	protected function migrateLeagues() {
156
		$this->info('Migrating leagues...');
157
		$leagues = (new Collection($this->fromOldDB()->table('leagues')->get()))->keyBy('id');
158
		$count = 0;
159
		foreach ($leagues as $league) {
160
			if (++$count % 1000 == 0) $this->info($count);
161
			DB::table('leagues')->insert([
162
				'id'          => $league->id,
163
				'name'        => $league->name,
164
				'slug'        => $league->slug,
165
				'description' => $league->description,
166
				'url'         => $league->url,
167
				'mode'        => $league->mode,
168
				'money'       => $league->money,
169
				'units'       => $league->units,
170
				'extra_weeks' => $league->extra_weeks,
171
				'start_date'  => $league->start_date,
172
				'end_date'    => $league->end_date,
173
				'active'      => true,
174
				'private'     => $league->private,
175
				'featured'    => $league->featured,
176
				'created_at'  => $league->created_at,
177
				'updated_at'  => $league->updated_at,
178
			]);
179
		}
180
	}
181
182
	/**
183
	 * @return array
184
	 */
185
	protected function migrateLeagueMovies() {
186
		$this->info('Migrating league_movies...');
187
		$league_movies = (new Collection($this->fromOldDB()->table('league_movie')->get()))->keyBy('id');
188
		$league_movie_by_league_and_movie_id = [];
189
190
		$count = 0;
191
		foreach ($league_movies as $league_movie) {
192
			if (++$count % 1000 == 0) $this->info($count);
193
			$league_movie_id = DB::table('league_movies')->insertGetId([
194
				// ID's are skippable here, so getting fresh ones
195
				'league_id'          => $league_movie->league_id,
196
				'movie_id'           => $league_movie->movie_id,
197
				'price'              => $league_movie->price,
198
				'latest_earnings_id' => $league_movie->latest_earnings_id,
199
				'created_at'         => $league_movie->created_at,
200
				'updated_at'         => $league_movie->updated_at,
201
			]);
202
203
			$league_movie_by_league_and_movie_id[$league_movie->league_id][$league_movie->movie_id] = $league_movie_id;
204
		}
205
206
		return $league_movie_by_league_and_movie_id;
207
	}
208
209
	/**
210
	 * @param $users
211
	 *
212
	 * @return array
213
	 */
214
	protected function migrateLeagueUsers(Collection $users) {
215
		$this->info('Migrating league_users...');
216
		$league_users = (new Collection($this->fromOldDB()->table('league_user')->get()))->keyBy('id');
217
		$team_by_league_and_user_id = [];
218
219
		$count = 0;
220
		foreach ($league_users as $league_user) {
221
			if (++$count % 500 == 0) $this->info($count);
222
			// For league admins
223
			if ($league_user->admin) {
224
				DB::table('league_admins')->insert([
225
					// Skip id's
226
					'league_id'  => $league_user->league_id,
227
					'user_id'    => $league_user->user_id,
228
					'created_at' => $league_user->created_at,
229
					'updated_at' => $league_user->updated_at,
230
				]);
231
			}
232
			// For league players create a team named after them
233
			if ($league_user->player) {
234
				$team_id = DB::table('league_teams')->insertGetId([
235
					// Get a new ID
236
					'league_id'  => $league_user->league_id,
237
					'name'       => $users->get($league_user->user_id)->displayname ?: $users->get($league_user->user_id)->username,
238
					'created_at' => $league_user->created_at,
239
					'updated_at' => $league_user->updated_at,
240
				]);
241
				$team_by_league_and_user_id[$league_user->league_id][$league_user->user_id] = $team_id;
242
243
				DB::table('league_team_user')->insert([
244
					// Skip id's
245
					'league_team_id' => $team_id,
246
					'user_id'        => $league_user->user_id,
247
					'created_at'     => $league_user->created_at,
248
					'updated_at'     => $league_user->updated_at,
249
				]);
250
			}
251
		}
252
253
		return $team_by_league_and_user_id;
254
	}
255
256
	/**
257
	 * @param $team_by_league_and_user_id
258
	 * @param $league_movie_by_league_and_movie_id
259
	 */
260
	protected function migrateLeagueMovieUsers($team_by_league_and_user_id, $league_movie_by_league_and_movie_id) {
0 ignored issues
show
Coding Style Naming introduced by
The parameter $team_by_league_and_user_id is not named in camelCase.

This check marks parameter names that have not been written in camelCase.

In camelCase names are written without any punctuation, the start of each new word being marked by a capital letter. Thus the name database connection string becomes databaseConnectionString.

Loading history...
Coding Style Naming introduced by
The parameter $league_movie_by_league_and_movie_id is not named in camelCase.

This check marks parameter names that have not been written in camelCase.

In camelCase names are written without any punctuation, the start of each new word being marked by a capital letter. Thus the name database connection string becomes databaseConnectionString.

Loading history...
261
		$this->info('Migrating league_movie_users...');
262
		$league_movie_users = (new Collection($this->fromOldDB()->table('league_movie_user')->get()))->keyBy('id');
263
		$count = 0;
264
		foreach ($league_movie_users as $league_movie_user) {
265
			if (++$count % 1000 == 0) $this->info($count);
266
267
			$league_id = $league_movie_user->league_id;
268
			$user_id = $league_movie_user->user_id;
269
			$movie_id = $league_movie_user->movie_id;
270
			if (! isset($team_by_league_and_user_id[$league_id][$user_id])
271
				|| ! isset($league_movie_by_league_and_movie_id[$league_id][$movie_id])
272
			) {
273
				$this->error("Movie bugged: - League: {$league_id} - Movie: {$movie_id}");
274
				continue;
275
			}
276
			DB::table('league_team_movies')->insert([
277
				'league_team_id'  => $team_by_league_and_user_id[$league_id][$user_id],
278
				'league_movie_id' => $league_movie_by_league_and_movie_id[$league_id][$movie_id],
279
				'created_at'      => $league_movie_user->created_at,
280
				'updated_at'      => $league_movie_user->updated_at,
281
			]);
282
		}
283
	}
284
285
}
286