Skip to content

Commit 6812576

Browse files
oliveratgithuboliveratgithub
authored
zorg Code v4.9.0
Merge pull request #74 from zorgch/develop
2 parents 9dc8720 + b2ef088 commit 6812576

91 files changed

Lines changed: 3739 additions & 4432 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cron/tag.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525

2626
error_log(sprintf('[%s] [NOTICE] <%s> Try including files...', date('d.m.Y H:i:s',time()), __FILE__));
2727
define('SITE_ROOT', $wwwroot); // Define own SITE_ROOT before loading general zConfigs
28-
require_once( SITE_ROOT.'/includes/config.inc.php');
28+
(!require_once( SITE_ROOT.'/includes/config.inc.php')) ?? error_log(sprintf('[%s] [ERROR] <%s> Including %s failed', date('d.m.Y H:i:s',time()), __FILE__, SITE_ROOT.'/includes/config.inc.php'));
2929
include_once( INCLUDES_DIR.'addle.inc.php');
3030
include_once( INCLUDES_DIR.'hz_game.inc.php');
3131
include_once( INCLUDES_DIR.'peter.inc.php');

‎www/actions/chess.php‎

Lines changed: 83 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,102 +1,114 @@
11
<?php
22
/**
33
* Chess game actions
4+
*
45
* @package zorg\Games\Chess
56
*/
7+
68
/**
79
* File includes
810
*/
9-
require_once dirname(__FILE__).'/../includes/main.inc.php';
11+
require_once __DIR__.'/../includes/config.inc.php';
1012
include_once INCLUDES_DIR.'chess.inc.php';
1113

12-
/** move */
13-
if (isset($_GET['game']) && $_GET['game'] > 0 && isset($_GET['from']) && isset($_GET['to']))
14+
/** Input validation and sanitization */
15+
$doAction = filter_input(INPUT_GET, 'do', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? null; // $_GET['do']
16+
$gameId = filter_input(INPUT_GET, 'game', FILTER_VALIDATE_INT) ?? 0; // $_GET['game']
17+
$fromField = filter_input(INPUT_GET, 'from', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? null; // $_GET['from']
18+
$toField = filter_input(INPUT_GET, 'to', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? null; // $_GET['to']
19+
$viewForm = filter_input(INPUT_POST, 'formid', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? null; // $_POST['formid']
20+
$userId = filter_input(INPUT_POST, 'user', FILTER_VALIDATE_INT) ?? null; // $_POST['user']
21+
22+
if (isset($gameId) && $gameId > 0)
1423
{
15-
$e = $db->query('SELECT *, IF(white=next_turn, "w", "b") player
16-
FROM chess_games
17-
WHERE id='.$_GET['game'].' AND next_turn='.$user->id,
18-
__FILE__, __LINE__, 'move');
19-
$d = $db->fetch($e);
24+
/** move */
25+
if (!empty($fromField) && !empty($toField))
26+
{
27+
$e = $db->query('SELECT *, IF(white=next_turn, "w", "b") player FROM chess_games WHERE id=? AND next_turn=?',
28+
__FILE__, __LINE__, 'move', [$gameId, $user->id]);
29+
$d = $db->fetch($e);
2030

21-
22-
if ($d && Chess::is_valid_position($_GET['from']) && Chess::is_valid_position($_GET['to'])
23-
&& Chess::do_move($d['id'], $d['player'], $_GET['from'], $_GET['to'])
24-
) {
25-
unset($_GET['from']);
26-
unset($_GET['to']);
27-
header('Location: /?'.url_params());
28-
}else{
29-
echo "Invalid chess move: <br /> game = ".$_GET['game']." <br /> from = ".$_GET['from']." <br /> to = ".$_GET['to'];
31+
32+
if ($d && $chess->is_valid_position($fromField) && $chess->is_valid_position($toField)
33+
&& $chess->do_move($d['id'], $d['player'], $fromField, $toField)
34+
) {
35+
unset($_GET['from']);
36+
unset($_GET['to']);
37+
header('Location: /?'.url_params());
38+
}else{
39+
echo "Invalid chess move: <br /> game = ".$gameId." <br /> from = ".$fromField." <br /> to = ".$toField;
40+
}
3041
exit;
3142
}
32-
}
3343

34-
/** offer remis */
35-
if (isset($_GET['game']) && $_GET['game'] > 0 && isset($_GET['do']) && $_GET['do'] == 'offer_remis')
36-
{
37-
$e = $db->query('SELECT * FROM chess_games WHERE id='.$_GET['game'].' AND next_turn='.$user->id, __FILE__, __LINE__, 'offer remis');
38-
$d = $db->fetch($e);
39-
if ($d) {
40-
Chess::do_offer_remis($_GET['game']);
41-
unset($_GET['do']);
42-
header("Location: /?".url_params());
43-
}else{
44-
echo "'offer remis' is not allowed.";
44+
/** offer remis */
45+
if ($doAction === 'offer_remis')
46+
{
47+
$e = $db->query('SELECT * FROM chess_games WHERE id=? AND next_turn=?', __FILE__, __LINE__, 'offer remis', [$gameId, $user->id]);
48+
$d = $db->fetch($e);
49+
if ($d) {
50+
$chess->do_offer_remis($gameId);
51+
52+
unset($_GET['do']);
53+
header("Location: /?".url_params());
54+
}else{
55+
echo "'offer remis' is not allowed.";
56+
}
4557
exit;
4658
}
47-
}
4859

49-
/** accept remis */
50-
if (isset($_GET['game']) && $_GET['game'] > 0 && isset($_GET['do']) && $_GET['do'] == 'accept_remis')
51-
{
52-
$e = $db->query('SELECT *
53-
FROM chess_games
54-
WHERE id='.$_GET['game'].' AND (white='.$user->id.' OR black='.$user->id.') AND next_turn!='.$user->id.' AND offering_remis="1"',
55-
__FILE__, __LINE__, 'accept remis');
56-
$d = $db->fetch($e);
57-
if ($d) {
58-
Chess::do_remis($_GET['game']);
59-
unset($_GET['do']);
60-
header("Location: /?".url_params());
61-
}else{
62-
echo "'accept remis' is not allowed.";
60+
/** accept remis */
61+
if ($doAction === 'accept_remis')
62+
{
63+
$e = $db->query('SELECT * FROM chess_games WHERE id=? AND (white=? OR black=?) AND next_turn!=? AND offering_remis="1"',
64+
__FILE__, __LINE__, 'accept remis', [$gameId, $user->id, $user->id, $user->id]);
65+
$d = $db->fetch($e);
66+
if ($d) {
67+
$chess->do_remis($gameId);
68+
69+
unset($_GET['do']);
70+
header("Location: /?".url_params());
71+
}else{
72+
echo "'accept remis' is not allowed.";
73+
}
6374
exit;
6475
}
65-
}
6676

67-
/** deny remis */
68-
if (isset($_GET['game']) && $_GET['game'] > 0 && isset($_GET['do']) && $_GET['do'] == 'deny_remis')
69-
{
70-
$e = $db->query('SELECT *
71-
FROM chess_games
72-
WHERE id='.$_GET['game'].' AND (white='.$user->id.' OR black='.$user->id.') AND next_turn!='.$user->id.' AND offering_remis="1"',
73-
__FILE__, __LINE__, 'deny remis');
74-
$d = $db->fetch($e);
75-
if ($d) {
76-
Chess::deny_remis($_GET['game']);
77-
header("Location: /?".url_params());
78-
}else{
79-
echo "'deny remis' is not allowed";
77+
/** deny remis */
78+
if ($doAction === 'deny_remis')
79+
{
80+
$e = $db->query('SELECT * FROM chess_games WHERE id=? AND (white=? OR black=?) AND next_turn!=? AND offering_remis="1"',
81+
__FILE__, __LINE__, 'deny remis', [$gameId, $user->id, $user->id, $user->id]);
82+
$d = $db->fetch($e);
83+
if ($d) {
84+
$chess->deny_remis($gameId);
85+
86+
unset($_GET['do']);
87+
header("Location: /?".url_params());
88+
}else{
89+
echo "'deny remis' is not allowed";
90+
}
91+
exit;
92+
}
93+
94+
/** aufgeben */
95+
if ($doAction === 'aufgeben')
96+
{
97+
$chess->aufgabe($gameId);
98+
99+
unset($_GET['do']);
100+
header("Location: /tpl/141?".url_params());
80101
exit;
81102
}
82103
}
83104

84105
/** start new game */
85-
if (isset($_POST['formid']) && $_POST['formid'] == 'chess_start')
106+
elseif ($viewForm === 'chess_start')
86107
{
87-
if (Chess::new_game($_POST['user'])) {
108+
if ($chess->new_game($userId)) {
88109
header("Location: /?tpl=139");
89110
}else{
90-
echo "invalid chess_start: <br /> user = ".$_POST['user'];
91-
exit;
111+
echo "invalid chess_start: <br /> user = ".$userId;
92112
}
93-
}
94-
95-
/** aufgeben */
96-
if (isset($_GET['game']) && $_GET['game'] > 0 && isset($_GET['do']) && $_GET['do'] == 'aufgeben')
97-
{
98-
Chess::aufgabe($_GET['game']);
99-
100-
unset($_GET['do']);
101-
header("Location: /tpl/141?".url_params());
113+
exit;
102114
}

‎www/actions/comment_gotolastunread.php‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
<?php
2-
require_once dirname(__FILE__).'/../includes/main.inc.php';
2+
require_once __DIR__.'/../includes/config.inc.php';
3+
require_once INCLUDES_DIR.'forum.inc.php';
34

4-
if(Forum::getNumunreadposts($user->id) > 0) {
5+
if(Forum::getNumunreadposts($user->id) > 0) {
56
header("Location: ".Forum::getUnreadLink());
6-
die();
7+
exit();
78
} else {
8-
header("Location: ../index.php?".session_name()."=".session_id());
9-
die();
9+
header("Location: /index.php");
10+
exit();
1011
}

‎www/actions/commenting.php‎

Lines changed: 27 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,45 @@
11
<?php
22
/**
33
* Commenting Actions
4+
*
45
* @package zorg\Forum
56
*/
7+
68
/**
79
* File Includes
810
*/
9-
require_once dirname(__FILE__).'/../includes/main.inc.php';
11+
require_once __DIR__.'/../includes/config.inc.php';
1012
require_once INCLUDES_DIR.'mysql.inc.php';
1113
require_once INCLUDES_DIR.'usersystem.inc.php';
1214

15+
/** Input validation & sanitization */
16+
$doAction = filter_input(INPUT_GET, 'do', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? null; // $_GET['do']
17+
$comment = filter_input(INPUT_GET, 'comment_id', FILTER_VALIDATE_INT) ?? 0; // $_GET['comment_id']
18+
$board = filter_input(INPUT_GET, 'board', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? null; // $_GET['board']
19+
$redirect = base64url_decode(filter_input(INPUT_GET, 'url', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR)) ?? null; // $_GET['url']
20+
21+
if (!$user->is_loggedin()) {
22+
http_response_code(403); // Set response code 403 (Access denied)
23+
user_error('Access denied', E_USER_ERROR);
24+
}
25+
if(empty($comment) || $comment <= 0) {
26+
http_response_code(404); // Set response code 404 (Not found)
27+
user_error('Invalid comment: '.$comment, E_USER_ERROR);
28+
}
29+
1330
/** Subscribe */
14-
if(isset($_GET['do']) && $_GET['do'] == 'subscribe')
31+
if($doAction === 'subscribe')
1532
{
16-
$sql = 'INSERT INTO comments_subscriptions (board, comment_id, user_id)
17-
VALUES("'.$_GET['board'].'", '.$_GET['comment_id'].', '.$user->id.')';
18-
$db->query($sql, __FILE__, __LINE__, 'Commenting subscribe');
19-
20-
header("Location: ".base64url_decode($_GET['url']));
21-
exit;
33+
$sql = 'INSERT INTO comments_subscriptions (board, comment_id, user_id) VALUES(?, ?, ?)';
34+
$db->query($sql, __FILE__, __LINE__, 'Commenting subscribe', [$board, $comment, $user->id]);
2235
}
2336

2437
/** Unsubscribe */
25-
if(isset($_GET['do']) && $_GET['do'] == 'unsubscribe')
38+
elseif($doAction === 'unsubscribe' && $user->is_loggedin())
2639
{
27-
$sql = 'DELETE FROM comments_subscriptions
28-
WHERE board = "'.$_GET['board'].'" AND comment_id = '.$_GET['comment_id'].' AND user_id = '.$user->id;
29-
$db->query($sql, __FILE__, __LINE__, 'Commenting unsubscribe');
30-
31-
header("Location: ".base64url_decode($_GET['url']));
32-
exit;
40+
$sql = 'DELETE FROM comments_subscriptions WHERE board=? AND comment_id=? AND user_id=?';
41+
$db->query($sql, __FILE__, __LINE__, 'Commenting unsubscribe', [$board, $comment, $user->id]);
3342
}
43+
44+
header("Location: ".$redirect);
45+
exit;

‎www/actions/error_action.php‎

Lines changed: 32 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,52 @@
11
<?php
2-
require_once dirname(__FILE__).'/../includes/main.inc.php';
2+
require_once __DIR__.'/../includes/config.inc.php';
3+
require_once INCLUDES_DIR.'mysql.inc.php';
4+
require_once INCLUDES_DIR.'usersystem.inc.php';
35

4-
if(count($_POST) > 0)
6+
if($user->is_loggedin() && count($_POST) > 0)
57
{
8+
/** Input validation & sanitization */
9+
$errorId = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT) ?? null; // $_GET['id']
10+
$tplId = filter_input(INPUT_GET, 'tpl', FILTER_VALIDATE_INT) ?? null; // $_GET['tpl']
11+
$doDelete = filter_input(INPUT_POST, 'del', FILTER_DEFAULT, FILTER_REQUIRE_SCALAR) ?? null; // $_POST['del']
12+
$showQuery = filter_input(INPUT_POST, 'query', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? 0; // $_POST['query']
13+
$del_ids = filter_input(INPUT_POST, 'to_del', FILTER_DEFAULT, FILTER_REQUIRE_ARRAY) ?? []; // $_POST['to_del']
14+
$showNum = filter_input(INPUT_POST, 'num', FILTER_VALIDATE_INT) ?? 0; // $_POST['num']
15+
$urlParams = '';
16+
617
/** Delete SQL-Error */
7-
if($_POST['del'] && !empty($_GET['id']))
18+
if($doDelete === 'delete' && $errorId>0)
819
{
9-
$sql_del = 'DELETE FROM sql_error WHERE id='.$_GET['id'];
10-
$db->query($sql_del, __FILE__, __LINE__, 'Delete SQL-Error');
11-
header('Location: /tpl/'.$_GET['tpl']);
12-
die();
20+
$sql_del = 'DELETE FROM sql_error WHERE id=?';
21+
$db->query($sql_del, __FILE__, __LINE__, 'Delete SQL-Error', [$errorId]);
1322
}
1423

1524
/** Show Query details */
16-
if($_POST['query'])
25+
if(!empty($showQuery))
1726
{
18-
header('Location: /tpl/'.$_GET['tpl'].'&id='.$_GET['id'].'&query='.base64url_encode($_POST['query']));
19-
die();
27+
$urlParams = '?id='.$errorId.'&query='.base64url_encode($showQuery);
2028
}
2129

2230
/** Delete multiple SQL-Errors */
23-
if(count($_POST['to_del']) > 0)
31+
if(count($del_ids) > 0 && $user->type >= USER_MEMBER)
2432
{
25-
$del_ids = implode(',', $_POST['to_del']);
26-
$sql = 'DELETE FROM sql_error WHERE id IN ('.$del_ids.')';
27-
$db->query($sql, __FILE__, __LINE__, 'Delete multiple SQL-Errors');
28-
header('Location: /tpl/'.$_GET['tpl']);
29-
die();
33+
$placeholders = implode(',', array_fill(0, count($del_ids), '?'));
34+
$sql = 'DELETE FROM sql_error WHERE id IN (' . $placeholders . ')';
35+
$params = array_map('intval', $del_ids); // $del_ids must be integers
36+
$db->query($sql, __FILE__, __LINE__, 'Delete multiple SQL-Errors', $params);
3037
}
3138

3239
/** Change displayed number of SQL-Error */
33-
if($_POST['num'])
40+
if($showNum > 0)
3441
{
3542
$_SESSION['error_num'] = $_POST['num'];
36-
header('Location: /tpl/'.$_GET['tpl'].'?error_num='.$_POST['num']);
37-
die();
43+
$urlParams = '?error_num='.$showNum;
3844
}
45+
46+
header('Location: /tpl/'.$tplId.$urlParams);
47+
exit;
48+
}
49+
else {
50+
http_response_code(403); // Set response code 403 (Access denied)
51+
user_error('Access denied', E_USER_ERROR);
3952
}

0 commit comments

Comments
 (0)