From 12fe632bf476395fd280bcc4210ed193a6dbe211 Mon Sep 17 00:00:00 2001
From: Martin Ambrus <martin@martinambrus.com>
Date: Fri, 24 Nov 2017 10:17:54 +0100
Subject: [PATCH] fix: prevent reuse of old attacks by re-POSTing same values

---
 GameEngine/Database.php     | 7 +++++++
 GameEngine/Units.php        | 4 ++++
 Templates/a2b/startRaid.tpl | 3 +++
 3 files changed, 14 insertions(+)

diff --git a/GameEngine/Database.php b/GameEngine/Database.php
index f97e3881..a9f40b31 100755
--- a/GameEngine/Database.php
+++ b/GameEngine/Database.php
@@ -5371,6 +5371,13 @@ References: User ID/Message ID, Mode
 		return mysqli_insert_id($this->dblink);
 	}
 
+    function remA2b($id) {
+        $id = (int) $id;
+
+        $q = "DELETE FROM " . TB_PREFIX . "a2b WHERE id = $id";
+        return mysqli_query($this->dblink,$q);
+    }
+
 	// no need to cache this method
 	function getA2b($ckey, $check) {
         list($ckey, $check) = $this->escape_input($ckey, $check);
diff --git a/GameEngine/Units.php b/GameEngine/Units.php
index b64e64e7..a460658f 100755
--- a/GameEngine/Units.php
+++ b/GameEngine/Units.php
@@ -552,6 +552,10 @@ class Units {
                     header( "Location: a2b.php" );
                     exit;
                 }
+
+                // prevent re-use of the same attack via re-POSTing the same data
+                $database->remA2b($data['id']);
+
                 header( "Location: build.php?id=39" );
                 exit;
 
diff --git a/Templates/a2b/startRaid.tpl b/Templates/a2b/startRaid.tpl
index c4dd1024..6d0c0bd8 100644
--- a/Templates/a2b/startRaid.tpl
+++ b/Templates/a2b/startRaid.tpl
@@ -97,6 +97,9 @@
 
 			$database->modifyUnit($getFLData['wref'], $uname2, $amounts, $modes);
 			$database->addMovement(3,$getFLData['wref'],$data['to_vid'],$reference,time(),($time+time()));
+
+            // prevent re-use of the same attack via re-POSTing the same data
+            $database->remA2b($data['id']);
         }    
     }
 	}