xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-16 08:11:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: remove SQL injections in Admin

Browse Source
This commit is contained in:
Martin Ambrus
2017-10-19 21:17:11 +02:00
parent 529bb2209c
commit 331885a110
74 changed files with 327 additions and 221 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GameEngine/Admin/Mods/addABTroops.php
+2 -2
View File
@@ -13,7 +13,7 @@ if(!isset($_SESSION)) session_start();
if($_SESSION['access'] < 9) die("Access Denied: You are not Admin!");
include_once("../../Database.php");
$id = $_POST['id'];
$id = (int) $_POST['id'];
$village = $database->getVillage($id);
$user = $database->getUserArray($village['owner'],1);
$atech="";
@@ -25,7 +25,7 @@ for($i=1; $i<9; $i++) {
$q = "UPDATE ".TB_PREFIX."abdata SET ".$atech.$btech." WHERE vref = $id";
$database->query($q);
$database->query("Insert into ".TB_PREFIX."admin_log values (0,".$_SESSION['id'].",'Changed troop anmount in village <a href=\'admin.php?p=village&did=$id\'>$id</a> ',".time().")");
$database->query("Insert into ".TB_PREFIX."admin_log values (0,".(int) $_SESSION['id'].",'Changed troop anmount in village <a href=\'admin.php?p=village&did=$id\'>$id</a> ',".time().")");
header("Location: ../../../Admin/admin.php?p=village&did=".$id."&ab");
GameEngine/Admin/Mods/addTroops.php
+3 -3
View File
@@ -27,11 +27,11 @@ $units="";
if($tribe ==6){ $u = 50;}
for($i=1; $i<11; $i++) {
$units.="u".($u+$i)."=".$_POST['u'.($u+$i)].(($i < 10) ? ", " : "");
$units.="u".($u+$i)."=".$database->escape($_POST['u'.($u+$i)].(($i < 10) ? ", " : ""));
}
$q = "UPDATE ".TB_PREFIX."units SET ".$units." WHERE vref = $id";
$q = "UPDATE ".TB_PREFIX."units SET ".$units." WHERE vref = ".(int) $id;
$database->query($q);
$database->query("Insert into ".TB_PREFIX."admin_log values (0,".$_SESSION['id'].",'Changed troop anmount in village <a href=\'admin.php?p=village&did=$id\'>$id</a> ',".time().")");
$database->query("Insert into ".TB_PREFIX."admin_log values (0,".(int) $_SESSION['id'].",'Changed troop anmount in village <a href=\'admin.php?p=village&did=$id\'>$id</a> ',".time().")");
header("Location: ../../../Admin/admin.php?p=village&did=".$id."&d");
?>
GameEngine/Admin/Mods/addUsers.php
+8 -5
View File
@@ -16,12 +16,15 @@ mysqli_select_db($GLOBALS["link"], SQL_DB);
$wgarray=array(1=>1200,1700,2300,3100,4000,5000,6300,7800,9600,11800,14400,17600,21400,25900,31300,37900,45700,55100,66400,80000);
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$id = $_POST['id'];
$id = (int) $_POST['id'];
$baseName = $_POST['users_base_name'];
$amount = (int) $_POST['users_amount'];
$beginnersProtection = $_POST['users_protection'];
$postTribe = $_POST['tribe'];
$postTribe = (int) $_POST['tribe'];
// Some basic error checking
if (strlen($baseName) < 4)
@@ -101,7 +104,7 @@ else
// beginners protection is not checked
// Need a $database function for this
// (assuming we don't already have one as creating Natars also updates this way)
$q = "UPDATE " . TB_PREFIX . "users SET desc2 = '[#0]' WHERE id = $uid";
$q = "UPDATE " . TB_PREFIX . "users SET desc2 = '[#0]' WHERE id = ".(int) $uid;
mysqli_query($GLOBALS["link"], $q) or die(mysqli_error($database->dblink));
if (!$beginnersProtection)
@@ -113,7 +116,7 @@ else
$protection = time();
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET
protect = '".$protection."'
WHERE id = $uid") or die(mysqli_error($database->dblink));
WHERE id = ".(int) $uid) or die(mysqli_error($database->dblink));
}
$database->updateUserField($uid,"act","",1);
@@ -128,7 +131,7 @@ WHERE id = $uid") or die(mysqli_error($database->dblink));
//insert village with all resource and building with random level
$time = time();
$q = "INSERT INTO ".TB_PREFIX."vdata (`wref`,`owner`,`name`,`capital`,`pop`,`cp`,`celebration`,`type`,`wood`,`clay`,`iron`,`maxstore`,`crop`,`maxcrop`,`lastupdate`,`loyalty`,`exp1`,`exp2`,`exp3`,`created`) values ('$wid','$uid','".$userName."\'s village',1,200,1,0,0,$rand_resource,$rand_resource,$rand_resource,$cap_storage,$rand_resource,$cap_storage,$time,100,0,0,0,$time)";
$q = "INSERT INTO ".TB_PREFIX."vdata (`wref`,`owner`,`name`,`capital`,`pop`,`cp`,`celebration`,`type`,`wood`,`clay`,`iron`,`maxstore`,`crop`,`maxcrop`,`lastupdate`,`loyalty`,`exp1`,`exp2`,`exp3`,`created`) values (".(int) $wid.",".(int) $uid.",'".$userName."\'s village',1,200,1,0,0,$rand_resource,$rand_resource,$rand_resource,$cap_storage,$rand_resource,$cap_storage,$time,100,0,0,0,$time)";
mysqli_query($GLOBALS["link"], $q) or die(mysqli_error($database->dblink));
$q = "insert into ".TB_PREFIX."fdata (`vref`,`f1`,`f1t`,`f2`,`f2t`,`f3`,`f3t`,`f4`,`f4t`,`f5`,`f5t`,`f6`,`f6t`,`f7`,`f7t`,`f8`,`f8t`,`f9`,`f9t`,`f10`,`f10t`,`f11`,`f11t`,`f12`,`f12t`,`f13`,`f13t`,`f14`,`f14t`,`f15`,`f15t`,`f16`,`f16t`,`f17`,`f17t`,`f18`,`f18t`,`f19`,`f19t`,`f20`,`f20t`,`f21`,`f21t`,`f22`,`f22t`,`f23`,`f23t`,`f24`,`f24t`,`f25`,`f25t`,`f26`,`f26t`,`f27`,`f27t`,`f28`,`f28t`,`f29`,`f29t`,`f30`,`f30t`,`f31`,`f31t`,`f32`,`f32t`,`f33`,`f33t`,`f34`,`f34t`,`f35`,`f35t`,`f36`,`f36t`,`f37`,`f37t`,`f38`,`f38t`,`f39`,`f39t`,`f40`,`f40t`,`f99`,`f99t`,`wwname`) values ($wid ,".rand(5,10).",1,".rand(5,10).",4,".rand(5,10).",1,".rand(5,10).",3,".rand(5,10).",2,".rand(5,10).",2,".rand(5,10).",3,".rand(5,10).",4,".rand(5,10).",4,".rand(5,10).",3,".rand(5,10).",3,".rand(5,10).",4,".rand(5,10).",4,".rand(5,10).",1,".rand(5,10).",4,".rand(5,10).",2,".rand(5,10).",1,".rand(5,10).",2,".rand(2,5).",8,".rand(5,20).",37,".rand(10,20).",26,".rand(10,20).",22,".rand(10,20).",19,".rand(2,5).",9,$level_storage,11,".rand(10,20).",15,".rand(10,20).",20,0,0,".rand(10,15).",17,$level_storage,10,".rand(5,10).",12,0,0,10,23,0,0,0,0,0,0,0,0,".rand(5,10).",18,".rand(5,10).",16,0,0,0,0,'World Wonder')";
mysqli_query($GLOBALS["link"], $q);
GameEngine/Admin/Mods/additional.php
+16 -12
View File
@@ -14,7 +14,7 @@ if($_SESSION['access'] < 9) die("Access Denied: You are not Admin!");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$id = $_POST['id'];
$id = (int) $_POST['id'];
$admid = $_POST['admid'];
//$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$admid."");
@@ -26,22 +26,26 @@ if (!isset($_SESSION)) {
if($_SESSION['access'] != ADMIN) die("<h1><font color=\"red\">Access Denied: You are not Admin!</font></h1>");
$access = $_POST['access'];
$dur = $_POST['protect'] * 86400;
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$access = (int) $_POST['access'];
$dur = (int) $_POST['protect'] * 86400;
$protection = (time() + $dur);
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET
access = ".$access.",
gold = ".$_POST['gold'].",
sit1 = '".$_POST['sitter1']."',
sit2 = '".$_POST['sitter2']."',
gold = ".(int) $_POST['gold'].",
sit1 = '".(int) $_POST['sitter1']."',
sit2 = '".(int) $_POST['sitter2']."',
protect = '".$protection."',
cp = ".$_POST['cp'].",
ap = '".$_POST['off']."',
dp = '".$_POST['def']."',
RR = '".$_POST['res']."',
apall = '".$_POST['ooff']."',
dpall = '".$_POST['odef']."'
cp = ".(int) $_POST['cp'].",
ap = '".(int) $_POST['off']."',
dp = '".(int) $_POST['def']."',
RR = '".(int) $_POST['res']."',
apall = '".(int) $_POST['ooff']."',
dpall = '".(int) $_POST['odef']."'
WHERE id = ".$id."") or die(mysqli_error($database->dblink));
header("Location: ../../../Admin/admin.php?p=player&uid=".$id."");
GameEngine/Admin/Mods/cp.php
+3 -3
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$id = $_POST['id'];
$admid = $_POST['admid'];
$id = (int) $_POST['id'];
$admid = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$admid."");
$access = mysqli_fetch_array($sql);
@@ -24,7 +24,7 @@ $sessionaccess = $access['access'];
if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not Admin!</font></h1>");
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET cp = cp + ".$_POST['cp']." WHERE id = ".$id."");
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET cp = cp + ".(int) $_POST['cp']." WHERE id = ".$id."");
header("Location: ../../../Admin/admin.php?p=player&uid=".$id."");
?>
GameEngine/Admin/Mods/delallymedal.php
+3 -3
View File
@@ -15,9 +15,9 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$delete = $_POST['medalid'];
$aid = $_POST['aid'];
$session = $_POST['admid'];
$delete = (int) $_POST['medalid'];
$aid =(int) $_POST['aid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/delallymedalbyaid.php
+3 -3
View File
@@ -15,9 +15,9 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$allyid = $_POST['allyid'];
$aid = $_POST['aid'];
$session = $_POST['admid'];
$allyid =(int) $_POST['allyid'];
$aid = (int) $_POST['aid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/delallymedalbyweek.php
+2 -2
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$deleteweek = $_POST['deleteweek'];
$session = $_POST['admid'];
$deleteweek = (int) $_POST['deleteweek'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/deletemedalbyuser.php
+2 -2
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$userid = $_POST['userid'];
$session = $_POST['admid'];
$userid = (int) $_POST['userid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/deletemedalbyweek.php
+2 -2
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$deleteweek = $_POST['medalweek'];
$session = $_POST['admid'];
$deleteweek = (int) $_POST['medalweek'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/editAccess.php
+2 -2
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['uid'];
$session = (int) $_POST['admid'];
$id = (int) $_POST['uid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/editAdminInfo.php
+1 -1
View File
@@ -12,7 +12,7 @@
if(!isset($_SESSION)) session_start();
if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
include_once("../../Database.php");
$id = $_POST['id'];
$id = (int) $_POST['id'];
$myFile = "../../config.php";
$fh = fopen($myFile, 'w') or die("<br/><br/><br/>Can't open file: GameEngine\config.php");
GameEngine/Admin/Mods/editBuildings.php
+5 -1
View File
@@ -18,7 +18,11 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$id = $_POST['id'];
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$id = (int) $_POST['id'];
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."fdata SET
f1 = '".$_POST['id1level']."',
GameEngine/Admin/Mods/editExtraSet.php
+1 -1
View File
@@ -12,7 +12,7 @@
if(!isset($_SESSION)) session_start();
if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
include_once("../../Database.php");
$id = $_POST['id'];
$id = (int) $_POST['id'];
$myFile = "../../config.php";
$fh = fopen($myFile, 'w') or die("<br/><br/><br/>Can't open file: GameEngine\config.php");
GameEngine/Admin/Mods/editHero.php
+9 -4
View File
@@ -14,6 +14,11 @@ if(!isset($_SESSION)) session_start();
if($_SESSION['access'] < 9) die("Access Denied: You are not Admin!");
include_once("../../Database.php");
$status="&ce=1";
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
if(isset($_POST['id'])) {
$_POST['hname'] = trim(stripslashes($_POST['hname']));
if ($_POST['hname']=="") {
@@ -23,13 +28,13 @@ if(isset($_POST['id'])) {
include_once("../../Data/hero_full.php");
$id = $_POST['id'];
$id = (int) $_POST['id'];
$q = "UPDATE ".TB_PREFIX."hero SET unit=".$_POST['hunit'].", name='".$_POST['hname']."', level=".$_POST['hlvl'].", points=".$_POST['exp'].", experience=".$hero_levels[$_POST['hlvl']].", health=".$_POST['hhealth'].",
attack=".$_POST['hatk'].", defence=".$_POST['hdef'].", attackbonus=".$_POST['hob'].", defencebonus=".$_POST['hdb'].", regeneration=".$_POST['hrege']." WHERE uid = ".$id;
$q = "UPDATE ".TB_PREFIX."hero SET unit=".(int) $_POST['hunit'].", name='".$_POST['hname']."', level=".(int) $_POST['hlvl'].", points=".(int) $_POST['exp'].", experience=".(int) $hero_levels[$_POST['hlvl']].", health='".$_POST['hhealth']."',
attack=".(int) $_POST['hatk'].", defence=".(int) $_POST['hdef'].", attackbonus=".(int) $_POST['hob'].", defencebonus=".(int) $_POST['hdb'].", regeneration=".(int) $_POST['hrege']." WHERE uid = ".$id;
$return=$database->query($q);
if($return) {
$database->query("Insert into ".TB_PREFIX."admin_log values (0,".$_SESSION['id'].",'Changed hero info',".time().")");
$database->query("Insert into ".TB_PREFIX."admin_log values (0,".(int) $_SESSION['id'].",'Changed hero info',".time().")");
$status="&cs=1";
}
}
GameEngine/Admin/Mods/editLogSet.php
+1 -1
View File
@@ -12,7 +12,7 @@
if(!isset($_SESSION)) session_start();
if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
include_once("../../Database.php");
$id = $_POST['id'];
$id = (int) $_POST['id'];
$myFile = "../../config.php";
$fh = fopen($myFile, 'w') or die("<br/><br/><br/>Can't open file: GameEngine\config.php");
GameEngine/Admin/Mods/editNewsboxSet.php
+1 -1
View File
@@ -12,7 +12,7 @@
if(!isset($_SESSION)) session_start();
if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
include_once("../../Database.php");
$id = $_POST['id'];
$id = (int) $_POST['id'];
$myFile = "../../config.php";
$fh = fopen($myFile, 'w') or die("<br/><br/><br/>Can't open file: GameEngine\config.php");
GameEngine/Admin/Mods/editOverall.php
+4 -4
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['id'];
$session = (int) $_POST['admid'];
$id = (int) $_POST['id'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -25,8 +25,8 @@ $sessionaccess = $access['access'];
if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not Admin!</font></h1>");
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET
apall = '".$_POST['off']."',
dpall = '".$_POST['def']."'
apall = '".(int) $_POST['off']."',
dpall = '".(int) $_POST['def']."'
WHERE id = $id") or die(mysqli_error($database->dblink));
header("Location: ../../../Admin/admin.php?p=player&uid=".$id."");
GameEngine/Admin/Mods/editPassword.php
+2 -2
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['uid'];
$session = (int) $_POST['admid'];
$id = (int) $_POST['uid'];
$pass = md5($_POST['newpw']);
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
GameEngine/Admin/Mods/editPlus.php
+7 -7
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['id'];
$session = (int) $_POST['admid'];
$id = (int) $_POST['id'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -24,11 +24,11 @@ $sessionaccess = $access['access'];
if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not Admin!</font></h1>");
$pdur = $_POST['plus'] * 86400;
$b1dur = $_POST['wood'] * 86400;
$b2dur = $_POST['clay'] * 86400;
$b3dur = $_POST['iron'] * 86400;
$b4dur = $_POST['crop'] * 86400;
$pdur = (int) $_POST['plus'] * 86400;
$b1dur = (int) $_POST['wood'] * 86400;
$b2dur = (int) $_POST['clay'] * 86400;
$b3dur = (int) $_POST['iron'] * 86400;
$b4dur = (int) $_POST['crop'] * 86400;
$sql1 = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$id."");
$user = mysqli_fetch_array($sql1);
GameEngine/Admin/Mods/editPlusSet.php
+1 -1
View File
@@ -13,7 +13,7 @@ if(!isset($_SESSION)) session_start();
if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
include_once("../../Database.php");
include_once("../../config.php");
$id = $_POST['id'];
$id = (int) $_POST['id'];
$myFile = "../../config.php";
$fh = fopen($myFile, 'w') or die("<br/><br/><br/>Can't open file: GameEngine\config.php");
GameEngine/Admin/Mods/editProtection.php
+3 -3
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['id'];
$session = (int) $_POST['admid'];
$id = (int) $_POST['id'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -24,7 +24,7 @@ $sessionaccess = $access['access'];
if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not Admin!</font></h1>");
$dur = $_POST['protect'] * 86400;
$dur = (int) $_POST['protect'] * 86400;
$protection = (time() + $dur);
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET
GameEngine/Admin/Mods/editResources.php
+8 -8
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['did'];
$session = (int) $_POST['admid'];
$id = (int) $_POST['did'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -25,12 +25,12 @@ $sessionaccess = $access['access'];
if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not Admin!</font></h1>");
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."vdata SET
wood = '".$_POST['wood']."',
clay = '".$_POST['clay']."',
iron = '".$_POST['iron']."',
crop = '".$_POST['crop']."',
maxstore = '".$_POST['maxstore']."',
maxcrop = '".$_POST['maxcrop']."'
wood = '".(int) $_POST['wood']."',
clay = '".(int) $_POST['clay']."',
iron = '".(int) $_POST['iron']."',
crop = '".(int) $_POST['crop']."',
maxstore = '".(int) $_POST['maxstore']."',
maxcrop = '".(int) $_POST['maxcrop']."'
WHERE wref = '".$id."'") or die(mysqli_error($database->dblink));
header("Location: ../../../Admin/admin.php?p=village&did=".$id."");
GameEngine/Admin/Mods/editServerSet.php
+1 -1
View File
@@ -12,7 +12,7 @@
if(!isset($_SESSION)) session_start();
if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
include_once("../../Database.php");
$id = $_POST['id'];
$id = (int) $_POST['id'];
$myFile = "../../config.php";
$fh = fopen($myFile, 'w') or die("<br/><br/><br/>Can't open file: GameEngine\config.php");
GameEngine/Admin/Mods/editSitter.php
+2 -2
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['id'];
$session = (int) $_POST['admid'];
$id = (int) $_POST['id'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/editUser.php
+7 -3
View File
@@ -15,8 +15,12 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['id'];
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$session = (int) $_POST['admid'];
$id = (int) $_POST['id'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -26,7 +30,7 @@ if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET
email = '".$_POST['email']."',
tribe = ".$_POST['tribe'].",
tribe = ".(int) $_POST['tribe'].",
location = '".$_POST['location']."',
desc1 = '".$_POST['desc1']."',
desc2 = '".$_POST['desc2']."',
GameEngine/Admin/Mods/editUsername.php
+6 -2
View File
@@ -15,8 +15,12 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$uid = $_POST['uid'];
$session = $_POST['admid'];
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$uid = (int) $_POST['uid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/editVillageOwner.php
+2 -2
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['did'];
$session = (int) $_POST['admid'];
$id = (int) $_POST['did'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/editWeek.php
+5 -5
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['id'];
$session = (int) $_POST['admid'];
$id = (int) $_POST['id'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -25,9 +25,9 @@ $sessionaccess = $access['access'];
if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not Admin!</font></h1>");
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET
ap = '".$_POST['off']."',
dp = '".$_POST['def']."',
RR = '".$_POST['res']."'
ap = '".(int) $_POST['off']."',
dp = '".(int) $_POST['def']."',
RR = '".(int) $_POST['res']."'
WHERE id = $id") or die(mysqli_error($database->dblink));
header("Location: ../../../Admin/admin.php?p=player&uid=".$id."");
GameEngine/Admin/Mods/givePlus.php
+1 -1
View File
@@ -21,7 +21,7 @@ function mysqli_result($res, $row, $field=0) {
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/givePlusRes.php
+5 -5
View File
@@ -21,7 +21,7 @@ function mysqli_result($res, $row, $field=0) {
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -32,10 +32,10 @@ if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not
$sql = "SELECT id FROM ".TB_PREFIX."users ORDER BY ID DESC LIMIT 1";
$loops = mysqli_result(mysqli_query($GLOBALS["link"], $sql), 0);
$wood = $_POST['wood'] * 86400;
$clay = $_POST['clay'] * 86400;
$iron = $_POST['iron'] * 86400;
$crop = $_POST['crop'] * 86400;
$wood = (int) $_POST['wood'] * 86400;
$clay = (int) $_POST['clay'] * 86400;
$iron = (int) $_POST['iron'] * 86400;
$crop = (int) $_POST['crop'] * 86400;
for($i = 0; $i < $loops + 1; $i++)
{
GameEngine/Admin/Mods/giveResBonus.php
+2 -2
View File
@@ -17,7 +17,7 @@ error_reporting(E_ALL);
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -25,7 +25,7 @@ $sessionaccess = $access['access'];
if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not Admin!</font></h1>");
$q = "UPDATE ".TB_PREFIX."users SET gold = gold + ".$_POST['gold']." WHERE id != '0'";
$q = "UPDATE ".TB_PREFIX."users SET gold = gold + ".(int) $_POST['gold']." WHERE id != '0'";
mysqli_query($GLOBALS["link"], $q) or die(mysqli_error($database->dblink));
header("Location: ../../../Admin/admin.php?p=maintenenceResetPlusBonus&g");
GameEngine/Admin/Mods/gold.php
+2 -2
View File
@@ -17,7 +17,7 @@ error_reporting(E_ALL);
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -25,7 +25,7 @@ $sessionaccess = $access['access'];
if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not Admin!</font></h1>");
$q = "UPDATE ".TB_PREFIX."users SET gold = gold + ".$_POST['gold']." WHERE id != '0'";
$q = "UPDATE ".TB_PREFIX."users SET gold = gold + ".(int) $_POST['gold']." WHERE id != '0'";
mysqli_query($GLOBALS["link"], $q) or die(mysqli_error($database->dblink));
header("Location: ../../../Admin/admin.php?p=gold&g");
GameEngine/Admin/Mods/gold_1.php
+3 -3
View File
@@ -15,8 +15,8 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['id'];
$session = (int) $_POST['admid'];
$id = (int) $_POST['id'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -24,7 +24,7 @@ $sessionaccess = $access['access'];
if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not Admin!</font></h1>");
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET gold = gold + ".$_POST['gold']." WHERE id = ".$id."");
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET gold = gold + ".(int) $_POST['gold']." WHERE id = ".$id."");
header("Location: ../../../Admin/admin.php?p=usergold&g");
?>
GameEngine/Admin/Mods/mainteneceBan.php
+7 -3
View File
@@ -15,7 +15,11 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -25,7 +29,7 @@ if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not
$users = mysqli_num_rows(mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users"));
$duration = $_POST['duration'] * 3600;
$duration = (int) $_POST['duration'] * 3600;
$start = $_POST['start'];
$startts = strtotime($start);
$endts = $startts + $duration;
@@ -49,7 +53,7 @@ for($i = 0; $i < $loops + 1; $i++)
$result = mysqli_query($GLOBALS["link"], $query);
while($row = mysqli_fetch_assoc($result))
{
mysqli_query($GLOBALS["link"], "INSERT INTO ".TB_PREFIX."banlist ".$row['id'].", ".$row['username'].", ".$reason.", ".$startts.", ".$endts.", ".$admin.", ".$active."");
mysqli_query($GLOBALS["link"], "INSERT INTO ".TB_PREFIX."banlist VALUES('', ".(int) $row['id'].", '".$row['username']."', '".$reason."', ".(int) $startts.", ".(int) $endts.", ".(int) $admin.", ".(int) $active.")");
##mysqli_query($GLOBALS["link"], "INSERT INTO ".TB_PREFIX."banlist (`uid`, `name`, `reason`, `time`, `end`, `admin`, `active`) VALUES (".$row['id'].", '".$row['username']."' , '$reason', '$startts', '$endts', '$admin', '1')");
}
}
GameEngine/Admin/Mods/mainteneceCleanBanData.php
+1 -1
View File
@@ -15,7 +15,7 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/mainteneceResetGold.php
+1 -1
View File
@@ -15,7 +15,7 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/mainteneceResetPlus.php
+1 -1
View File
@@ -15,7 +15,7 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/mainteneceResetPlusBonus.php
+1 -1
View File
@@ -15,7 +15,7 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/mainteneceUnban.php
+5 -1
View File
@@ -15,7 +15,11 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/medals.php
+4 -3
View File
@@ -18,8 +18,9 @@ mysqli_select_db($GLOBALS["link"], SQL_DB);
if (!isset($_SESSION)) session_start();
if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
$medalid = $_POST['medalid'];
$uid = $_POST['uid'];
$medalid = (int) $_POST['medalid'];
$uid = (int) $_POST['uid'];
$admid = (int) $_POST['admid'];
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."medal set del = 1 WHERE id = ".$medalid."");
@@ -29,7 +30,7 @@ $name = mysqli_result($name, 0);
mysqli_query($GLOBALS["link"], "Insert into ".TB_PREFIX."admin_log values (0,$admid,'Deleted medal id [#".$medalid."] from the user <a href=\'admin.php?p=player&uid=$uid\'>$name</a> ',".time().")");
$deleteweek = $_POST['medalweek'];
$deleteweek = (int) $_POST['medalweek'];
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."medal set del = 1 WHERE week = ".$deleteweek."");
header("Location: ../../../Admin/admin.php?p=player&uid=".$uid."");
GameEngine/Admin/Mods/natarbuildingplan.php
+2 -2
View File
@@ -15,8 +15,8 @@ include_once("../../Automation.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$id = $_POST['id'];
$amt = $_POST['vill_amount'];
$id = (int) $_POST['id'];
$amt = (int) $_POST['vill_amount'];
for($i=1;$i<=$amt;$i++) {
GameEngine/Admin/Mods/natarend.php
+2 -2
View File
@@ -15,8 +15,8 @@ include_once("../../Automation.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$id = $_POST['id'];
$amt = $_POST['vill_amount'];
$id = (int) $_POST['id'];
$amt = (int) $_POST['vill_amount'];
for($i=1;$i<=$amt;$i++) {
GameEngine/Admin/Mods/recalcWH.php
+6 -2
View File
@@ -12,11 +12,15 @@ if (!isset($_SESSION)) session_start();
if($_SESSION['access'] < 9) die("Access Denied: You are not Admin!");
include_once("../../config.php");
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$id = $_POST['id'];
$session = (int) $_POST['admid'];
$id = (int) $_POST['id'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
GameEngine/Admin/Mods/renameVillage.php
+9 -3
View File
@@ -15,9 +15,15 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$did = $_POST['did'];
$nameorig = $_POST['villagename'];
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$did = (int) $_POST['did'];
$name = $_POST['villagename'];
$session = $_POST['admid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");
$access = mysqli_fetch_array($sql);
@@ -28,5 +34,5 @@ if($sessionaccess != 9) die("<h1><font color=\"red\">Access Denied: You are not
$sql = "UPDATE ".TB_PREFIX."vdata SET name = '$name' WHERE wref = $did";
mysqli_query($GLOBALS["link"], $sql);
header("Location: ../../../Admin/admin.php?p=village&did=".$did."&name=".$name."");
header("Location: ../../../Admin/admin.php?p=village&did=".$did."&name=".$nameorig."");
?>
GameEngine/Admin/Mods/sendMessage.php
+1 -1
View File
@@ -15,7 +15,7 @@ include_once("../../config.php");
$GLOBALS["link"] = mysqli_connect(SQL_SERVER, SQL_USER, SQL_PASS);
mysqli_select_db($GLOBALS["link"], SQL_DB);
$session = $_POST['admid'];
$session = (int) $_POST['admid'];
$sql = mysqli_query($GLOBALS["link"], "SELECT * FROM ".TB_PREFIX."users WHERE id = ".$session."");