xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-14 15:21:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix alliance possition in overview

Browse Source 
Fix alliance possition in overview
This commit is contained in:
Catalin Novgorodschi
2026-04-22 10:15:49 +03:00
parent f3591e7281
commit ca541d2204
2 changed files with 30 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GameEngine/Database.php
+23 -30
View File
@@ -3022,42 +3022,35 @@ public function getBestOasisCropBonus($x, $y) {
} }
// no need to cache this method // no need to cache this method
function getAlliancePermission($ref, $field, $mode) {
list($ref, $field, $mode) = $this->escape_input($ref, $field, $mode);
$mode = (int)$mode;
$ref = (int)$ref;
// 🔒 Field validation (indirect SQL injection prevention) function getAlliancePermission($uid, $field, $alliance) {
$allowed_fields = ['ap1', 'ap2', 'ap3', 'ap4', 'ap5', 'ap6', 'ap7', 'ap8', 'ap9', 'ap10', 'owner', 'admin']; $uid = (int)$uid;
if (!in_array($field, $allowed_fields)) { $alliance = (int)$alliance;
error_log("Invalid field in getAlliancePermission: $field");
return false;
}
// Build the query // whitelist câmpuri permise
if (!$mode) { $allowed_fields = ['ap1','ap2','ap3','ap4','ap5','ap6','ap7','ap8','ap9','ap10','owner','admin','rank'];
$q = "SELECT `$field` FROM " . TB_PREFIX . "ali_permission WHERE uid = $ref LIMIT 1";
} else {
$q = "SELECT `$field` FROM " . TB_PREFIX . "ali_permission WHERE username = '$ref' LIMIT 1";
}
// Run query if (!in_array($field, $allowed_fields)) {
$result = mysqli_query($this->dblink, $q); error_log("Invalid field in getAlliancePermission: $field");
return false;
}
// 🔴 Query error check $q = "SELECT `$field` FROM " . TB_PREFIX . "ali_permission WHERE uid = $uid AND alliance = $alliance LIMIT 1";
if (!$result) {
error_log("SQL Error in getAlliancePermission: " . mysqli_error($this->dblink) . " | Query: $q");
return false;
}
// 🔍 No results? $result = mysqli_query($this->dblink, $q);
if (mysqli_num_rows($result) == 0) {
return false;
}
// ✅ Extract and return the value if (!$result) {
$row = mysqli_fetch_array($result); error_log("SQL Error in getAlliancePermission: " . mysqli_error($this->dblink) . " | Query: $q");
return $row[$field]; return false;
}
if (mysqli_num_rows($result) == 0) {
return false;
}
$row = mysqli_fetch_assoc($result);
return $row[$field];
} }
function getAlliance($id, $use_cache = true) { function getAlliance($id, $use_cache = true) {
Templates/Alliance/overview.tpl
+5 -8
View File
@@ -73,11 +73,11 @@ include("alli_menu.tpl");
</tr><tr> </tr><tr>
<td colspan="2" class="empty"></td> <td colspan="2" class="empty"></td>
</tr> </tr>
<?php <?php
foreach($memberlist as $member) { foreach($memberlist as $member) {
//rank name //rank name
$rank = $database->getAlliancePermission($member['id'],"rank",0); $rank = $database->getAlliancePermission($member['id'], "rank", $aid);
//username //username
$name = $database->getUserField($member['id'],"username",0); $name = $database->getUserField($member['id'],"username",0);
@@ -91,19 +91,16 @@ include("alli_menu.tpl");
else if($rank != ''){ else if($rank != ''){
echo "<tr>"; echo "<tr>";
echo "<th>".stripslashes($rank)."</th>"; echo "<th>".stripslashes($rank)."</th>";
echo "<td><a href='spieler.php?uid=".$member['id']."'>".$name."</td>"; echo "<td><a href='spieler.php?uid=".$member['id']."'>".$name."</a></td>";
echo "</tr>"; echo "</tr>";
} }
} }
if($allianceinfo['forumlink'] != '' && $allianceinfo['forumlink'] != '0'){ if($allianceinfo['forumlink'] != '' && $allianceinfo['forumlink'] != '0'){
echo "<tr>"; echo "<tr>";
echo "<td><a href='".$allianceinfo['forumlink']."'>» to the forum</td>"; echo "<td><a href='".$allianceinfo['forumlink']."'>» to the forum</a></td>";
echo "</tr>"; echo "</tr>";
}else{ }else{
?> ?>
<tr>
<td colspan="2" class="emmty"></td>
</tr>
<?php } ?> <?php } ?>
<tr> <tr>
<td class="desc2" colspan="2"> <td class="desc2" colspan="2">