Skip to content

Commit 980b3c7

Browse files
bbdocbbdoc
authored
Merge develop into main
Merge Develop
2 parents 2ae66c3 + c7cb04b commit 980b3c7

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+692
-333
lines changed

‎.github/workflows/php.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,12 @@ jobs:
1616
- "7.3"
1717
- "7.4"
1818
- "8.0"
19+
- "8.1"
1920

2021
name: PHP ${{ matrix.php-versions }} test
2122
steps:
2223
- name: Checkout
23-
uses: actions/checkout@v2
24+
uses: actions/checkout@v4
2425

2526
- name: Setup PHP
2627
uses: shivammathur/setup-php@v2

‎.github/workflows/publish.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,22 +14,22 @@ jobs:
1414
packages: write
1515
steps:
1616
- name: Checkout repository
17-
uses: actions/checkout@v3
17+
uses: actions/checkout@v4
1818
- name: Log in to the Container registry
19-
uses: docker/login-action@v2
19+
uses: docker/login-action@v3
2020
with:
2121
registry: ${{ env.REGISTRY }}
2222
username: ${{ github.actor }}
2323
password: ${{ secrets.GITHUB_TOKEN }}
2424
- name: Extract metadata (tags, labels) for Docker
2525
id: meta
26-
uses: docker/metadata-action@v4
26+
uses: docker/metadata-action@v5
2727
with:
2828
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
2929
- name: Build and push Docker image
30-
uses: docker/build-push-action@v3
30+
uses: docker/build-push-action@v6
3131
with:
3232
context: .
3333
push: true
3434
tags: ${{ steps.meta.outputs.tags }}
35-
labels: ${{ steps.meta.outputs.labels }}
35+
labels: ${{ steps.meta.outputs.labels }}

‎actions/channel_sync.php‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,21 @@
55

66
if (isset($_POST['sync'])) {
77

8-
foreach ($_POST as $key => $value) {
8+
foreach ($_POST as $key => $value) {
99
if (substr($key, 0, 7) == "target_") {
1010
$target = ltrim($key, 'target_');
1111
$target_fields = explode("|", $target);
1212
$target_db=$target_fields[0];
1313
$target_id=$target_fields[1];
1414
$target_id=str_replace("_com", ".com", $target_id);
1515

16+
// Database names cannot be parameterized in prepared statements (they are identifiers, not values)
17+
// so we use a whitelist to validate the database name before using string interpolation
18+
$allowed_dbs = explode(",", $dbname);
19+
if (!in_array($target_db, $allowed_dbs)) {
20+
die("Invalid database");
21+
}
22+
1623
// Delete All Previous Trackings
1724
$stmt = $conn->prepare("DELETE FROM ".$target_db.".monsters WHERE id = ?");
1825
$rs = $stmt->bind_param("s", $target_id);

‎actions/raids.php‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -184,13 +184,14 @@
184184
$level = ltrim($key, 'egg_');
185185
$gym_id = ($_POST['gym_id'] != 'ALL') ? $_POST['gym_id'] : NULL;
186186

187-
$stmt = $conn->prepare("INSERT INTO egg ( id, ping, clean, template, distance, team, level, profile_no, gym_id)
188-
VALUES ( ?, ?, ? , ?, ?, 4, ?, ?, ?)");
187+
$stmt = $conn->prepare("INSERT INTO egg ( id, ping, clean, template, distance, team, level, profile_no, gym_id, rsvp_changes)
188+
VALUES ( ?, ?, ?, ?, ?, 4, ?, ?, ?, ?)");
189189
if (false === $stmt) {
190190
header("Location: $redirect_url?type=display&page=raid&return=sql_error&phase=AE1&sql=$stmt->error");
191191
exit();
192-
}
193-
$rs = $stmt->bind_param("ssisiiis", $_SESSION['id'], $_POST['content'], $clean, $template, $_POST['distance'], $level, $_SESSION['profile'], $gym_id);
192+
}
193+
194+
$rs = $stmt->bind_param("ssisiiisi", $_SESSION['id'], $_POST['content'], $clean, $template, $_POST['distance'], $level, $_SESSION['profile'], $gym_id, $_POST['rsvp']);
194195
if (false === $rs) {
195196
header("Location: $redirect_url?type=display&page=raid&return=sql_error&phase=AE2&sql=$stmt->error");
196197
exit();
@@ -213,13 +214,13 @@
213214
$level = ltrim($key, 'raid_');
214215
$gym_id = ($_POST['gym_id'] != 'ALL') ? $_POST['gym_id'] : NULL;
215216

216-
$stmt = $conn->prepare("INSERT INTO raid ( id, ping, clean, template, pokemon_id, distance, team, level, form, profile_no, gym_id)
217-
VALUES ( ?, ?, ? , ?, 9000, ?, 4, ?, 0, ?, ?)");
217+
$stmt = $conn->prepare("INSERT INTO raid ( id, ping, clean, template, pokemon_id, distance, team, level, form, profile_no, gym_id, rsvp_changes)
218+
VALUES ( ?, ?, ? , ?, 9000, ?, 4, ?, 0, ?, ?, ?)");
218219
if (false === $stmt) {
219220
header("Location: $redirect_url?type=display&page=raid&return=sql_error&phase=AR1&sql=$stmt->error");
220221
exit();
221222
}
222-
$rs = $stmt->bind_param("ssisiiis", $_SESSION['id'], $_POST['content'], $clean, $template, $_POST['distance'], $level, $_SESSION['profile'], $gym_id);
223+
$rs = $stmt->bind_param("ssisiiisi", $_SESSION['id'], $_POST['content'], $clean, $template, $_POST['distance'], $level, $_SESSION['profile'], $gym_id, $_POST['rsvp']);
223224
if (false === $rs) {
224225
header("Location: $redirect_url?type=display&page=raid&return=sql_error&phase=AR2&sql=$stmt->error");
225226
exit();
@@ -245,13 +246,13 @@
245246
if (isset($arr[3])) { $boss_mega = $arr[3];}
246247
$gym_id = ($_POST['gym_id'] != 'ALL') ? $_POST['gym_id'] : NULL;
247248

248-
$stmt = $conn->prepare("INSERT INTO raid ( id, ping, clean, template, pokemon_id, distance, team, level, form, profile_no, gym_id)
249-
VALUES ( ?, '', ? , ?, ? , ?, 4, 9000, ?, ?, ?)");
249+
$stmt = $conn->prepare("INSERT INTO raid ( id, ping, clean, template, pokemon_id, distance, team, level, form, profile_no, gym_id, rsvp_changes)
250+
VALUES ( ?, '', ? , ?, ? , ?, 4, 9000, ?, ?, ?, ?)");
250251
if (false === $stmt) {
251252
header("Location: $redirect_url?type=display&page=raid&return=sql_error&phase=ARM1&sql=$stmt->error");
252253
exit();
253254
}
254-
$rs = $stmt->bind_param("sisiiiis", $_SESSION['id'], $clean, $template, $boss_id, $_POST['distance'], $boss_form, $_SESSION['profile'], $gym_id);
255+
$rs = $stmt->bind_param("sisiiiisi", $_SESSION['id'], $clean, $template, $boss_id, $_POST['distance'], $boss_form, $_SESSION['profile'], $gym_id, $_POST['rsvp']);
255256
if (false === $rs) {
256257
header("Location: $redirect_url?type=display&page=raid&return=sql_error&phase=ARM2&sql=$stmt->error");
257258
exit();

‎actions/set_language.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,10 @@
1111

1212
// Update Language in DB
1313

14-
$sql = "UPDATE humans set language = '".$_GET['lng']."' WHERE id = '" . $_SESSION['id'] . "'";
15-
$result = $conn->query($sql) or die(mysqli_error($conn));
14+
$stmt = $conn->prepare("UPDATE humans SET language = ? WHERE id = ?");
15+
$stmt->bind_param("ss", $_GET['lng'], $_SESSION['id']);
16+
$stmt->execute() or die(mysqli_error($conn));
17+
$stmt->close();
1618

1719
header("Location: $redirect_url");
1820

‎actions/set_location.php‎

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,26 @@
1010
$lat = "0.0000000000";
1111
$lon = "0.0000000000";
1212

13-
$sql = "UPDATE monsters set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
14-
$result = $conn->query($sql);
15-
$sql = "UPDATE raid set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
16-
$result = $conn->query($sql);
17-
$sql = "UPDATE egg set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
18-
$result = $conn->query($sql);
19-
$sql = "UPDATE quest set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
20-
$result = $conn->query($sql);
21-
$sql = "UPDATE invasion set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
22-
$result = $conn->query($sql);
13+
$stmt = $conn->prepare("UPDATE monsters set distance = 0 WHERE id = ? AND profile_no = ?");
14+
$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
15+
$stmt->execute();
16+
$stmt->close();
17+
$stmt = $conn->prepare("UPDATE raid set distance = 0 WHERE id = ? AND profile_no = ?");
18+
$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
19+
$stmt->execute();
20+
$stmt->close();
21+
$stmt = $conn->prepare("UPDATE egg set distance = 0 WHERE id = ? AND profile_no = ?");
22+
$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
23+
$stmt->execute();
24+
$stmt->close();
25+
$stmt = $conn->prepare("UPDATE quest set distance = 0 WHERE id = ? AND profile_no = ?");
26+
$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
27+
$stmt->execute();
28+
$stmt->close();
29+
$stmt = $conn->prepare("UPDATE invasion set distance = 0 WHERE id = ? AND profile_no = ?");
30+
$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
31+
$stmt->execute();
32+
$stmt->close();
2333

2434
} else if ( isset($_GET['lat']) && isset($_GET['lon']) ) {
2535

‎actions/switch_profile.php‎

Lines changed: 42 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -11,23 +11,23 @@
1111
$_SESSION['profile'] = $_POST['profile'];
1212
}
1313

14-
if ( isset($_POST['activate']) ) {
15-
16-
$sql = "SELECT area, latitude, longitude from profiles WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_POST['profile']."'";
17-
$result = $conn->query($sql);
18-
while ($row = $result->fetch_assoc()) {
19-
$area = $row['area'];
20-
$latitude = $row['latitude'];
21-
$longitude = $row['longitude'];
14+
if ( isset($_POST['activate']) ) {
15+
16+
$stmt = $conn->prepare("SELECT area, latitude, longitude from profiles WHERE id = ? AND profile_no = ?");
17+
$stmt->bind_param("si", $_SESSION['id'], $_POST['profile']);
18+
$stmt->execute();
19+
$result = $stmt->get_result();
20+
while ($row = $result->fetch_assoc()) {
21+
$area = $row['area'];
22+
$latitude = $row['latitude'];
23+
$longitude = $row['longitude'];
2224
}
25+
$stmt->close();
2326

24-
$sql = "UPDATE humans
25-
SET area = '".$area."',
26-
latitude = '".$latitude."',
27-
longitude = '".$longitude."',
28-
current_profile_no = '".$_POST['profile']."'
29-
WHERE id = '" . $_SESSION['id'] . "'";
30-
$result = $conn->query($sql);
27+
$stmt = $conn->prepare("UPDATE humans SET area = ?, latitude = ?, longitude = ?, current_profile_no = ? WHERE id = ?");
28+
$stmt->bind_param("ssdis", $area, $latitude, $longitude, $_POST['profile'], $_SESSION['id']);
29+
$stmt->execute();
30+
$stmt->close();
3131
header("Location: $redirect_url?type=display&page=profiles&return=success_switch_profile_activate");
3232

3333

@@ -41,27 +41,32 @@
4141

4242
// Get Next Profile Number
4343
#$sql = "SELECT IFNULL(max(profile_no),0)+1 next_profile from profiles WHERE id = '" . $_SESSION['id'] . "'";
44-
$sql = "SELECT MIN(t1.profile_no + 1) AS nextID
45-
FROM (select profile_no from profiles WHERE id = '".$_SESSION['id']."' UNION select 0 profile_no) t1
46-
LEFT JOIN (select profile_no from profiles WHERE id = '".$_SESSION['id']."' UNION select 0 profile_no) t2
44+
$stmt = $conn->prepare("SELECT MIN(t1.profile_no + 1) AS nextID
45+
FROM (select profile_no from profiles WHERE id = ? UNION select 0 profile_no) t1
46+
LEFT JOIN (select profile_no from profiles WHERE id = ? UNION select 0 profile_no) t2
4747
ON t1.profile_no + 1 = t2.profile_no
48-
WHERE t2.profile_no IS NULL";
49-
50-
$result = $conn->query($sql);
48+
WHERE t2.profile_no IS NULL");
49+
$stmt->bind_param("ss", $_SESSION['id'], $_SESSION['id']);
50+
$stmt->execute();
51+
$result = $stmt->get_result();
5152
while ($row = $result->fetch_assoc()) {
5253
$next_profile = $row['nextID'];
5354
}
55+
$stmt->close();
5456

5557
if ( $next_profile == 1 ) {
5658
// Get Info on currently active Profile
57-
$sql = "SELECT area, latitude, longitude from humans WHERE id = '" . $_SESSION['id'] . "'";
58-
$result = $conn->query($sql);
59+
$stmt = $conn->prepare("SELECT area, latitude, longitude from humans WHERE id = ?");
60+
$stmt->bind_param("s", $_SESSION['id']);
61+
$stmt->execute();
62+
$result = $stmt->get_result();
5963
while ($row = $result->fetch_assoc()) {
6064
$area = $row['area'];
6165
$latitude = $row['latitude'];
6266
$longitude = $row['longitude'];
6367
$_SESSION['profile_name'] = $_POST['profile_name'];
6468
}
69+
$stmt->close();
6570
} else {
6671
$area = "[]";
6772
$latitude = "0.0000000000";
@@ -153,26 +158,32 @@
153158

154159
// Change Active Profile if Deleting Active one
155160

156-
$sql = "select current_profile_no FROM humans WHERE id = '" . $_SESSION['id'] . "'";
157-
$result = $conn->query($sql);
161+
$stmt = $conn->prepare("SELECT current_profile_no FROM humans WHERE id = ?");
162+
$stmt->bind_param("s", $_SESSION['id']);
163+
$stmt->execute();
164+
$result = $stmt->get_result();
158165
while ($row = $result->fetch_assoc()) {
159166
$current_profile = $row['current_profile_no'];
160167
}
168+
$stmt->close();
161169

162170
if ( $current_profile == $_SESSION['profile']) {
163-
$sql = "UPDATE humans set current_profile_no =
164-
(select IFNULL(min(profile_no),1) from profiles where id = '".$_SESSION['id']."')
165-
WHERE id = '" . $_SESSION['id'] . "'";
166-
$result = $conn->query($sql);
171+
$stmt = $conn->prepare("UPDATE humans set current_profile_no = (select IFNULL(min(profile_no),1) from profiles where id = ?) WHERE id = ?");
172+
$stmt->bind_param("ss", $_SESSION['id'], $_SESSION['id']);
173+
$stmt->execute();
174+
$stmt->close();
167175
}
168176

169177
// Check for smaller Profiles and redirect
170178

171-
$sql = "select IFNULL(min(profile_no),1) min from profiles WHERE id = '" . $_SESSION['id'] . "'";
172-
$result = $conn->query($sql);
179+
$stmt = $conn->prepare("SELECT IFNULL(min(profile_no),1) min from profiles WHERE id = ?");
180+
$stmt->bind_param("s", $_SESSION['id']);
181+
$stmt->execute();
182+
$result = $stmt->get_result();
173183
while ($row = $result->fetch_assoc()) {
174184
$_SESSION['profile'] = $row['min'];
175185
}
186+
$stmt->close();
176187

177188
header("Location: $redirect_url?type=display&page=profiles&return=success_delete_profile");
178189

‎admin_connect.php‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,10 @@
4646
}
4747

4848
$conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $_SESSION['dbname']);
49-
$sql = "select id, name, type, notes FROM humans WHERE id = '".$search_id."'";
50-
$result = $conn->query($sql);
49+
$stmt = $conn->prepare("SELECT id, name, type, notes FROM humans WHERE id = ?");
50+
$stmt->bind_param("s", $search_id);
51+
$stmt->execute();
52+
$result = $stmt->get_result();
5153

5254
if ($result->num_rows == 0) {
5355
header("Location: $redirect_url?return=user_not_found");
@@ -60,6 +62,7 @@
6062
$_SESSION['type']=$row['type'];
6163
$_SESSION['notes']=$row['notes'];
6264
}
65+
$stmt->close();
6366

6467
// Get Config Items from API and Store in Session Variables
6568

@@ -108,11 +111,14 @@
108111

109112
// Switch to active Profile
110113

111-
$sql = "SELECT current_profile_no FROM humans WHERE id = '" . $_SESSION['id'] . "'";
112-
$result = $conn->query($sql);
114+
$stmt = $conn->prepare("SELECT current_profile_no FROM humans WHERE id = ?");
115+
$stmt->bind_param("s", $_SESSION['id']);
116+
$stmt->execute();
117+
$result = $stmt->get_result();
113118
while ($row = $result->fetch_assoc()) {
114119
$_SESSION['profile'] = $row['current_profile_no'];
115120
}
121+
$stmt->close();
116122

117123
header("Location: $redirect_url");
118124

‎admin_sync.php‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -94,8 +94,10 @@
9494
foreach ($dbnames as &$db) {
9595

9696
$conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $db);
97-
$sql = "select id, name, type FROM humans WHERE type like 'discord:channel' AND id <> '".$_SESSION['id']."' ORDER by name";
98-
$result = $conn->query($sql);
97+
$stmt = $conn->prepare("SELECT id, name, type FROM humans WHERE type like 'discord:channel' AND id <> ? ORDER by name");
98+
$stmt->bind_param("s", $_SESSION['id']);
99+
$stmt->execute();
100+
$result = $stmt->get_result();
99101
?>
100102

101103
<?php if ($result->num_rows <> 0) { ?>
@@ -145,8 +147,10 @@
145147
foreach ($dbnames as &$db) {
146148

147149
$conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $db);
148-
$sql = "select id, name, type FROM humans WHERE type in ('telegram:channel','telegram:group') AND id <> '".$_SESSION['id']."' ORDER by name";
149-
$result = $conn->query($sql);
150+
$stmt = $conn->prepare("SELECT id, name, type FROM humans WHERE type in ('telegram:channel','telegram:group') AND id <> ? ORDER by name");
151+
$stmt->bind_param("s", $_SESSION['id']);
152+
$stmt->execute();
153+
$result = $stmt->get_result();
150154
?>
151155

152156
<?php if ($result->num_rows <> 0) { ?>
@@ -196,8 +200,10 @@
196200
foreach ($dbnames as &$db) {
197201

198202
$conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $db);
199-
$sql = "select id, name, type FROM humans WHERE type like 'webhook' AND id <> '".$_SESSION['id']."' ORDER by name";
200-
$result = $conn->query($sql);
203+
$stmt = $conn->prepare("SELECT id, name, type FROM humans WHERE type like 'webhook' AND id <> ? ORDER by name");
204+
$stmt->bind_param("s", $_SESSION['id']);
205+
$stmt->execute();
206+
$result = $stmt->get_result();
201207
?>
202208

203209
<?php if ($result->num_rows <> 0) { ?>

0 commit comments

Comments
 (0)