The Arcive of Official vBulletin Modifications Site.

KGodel · #11 11-12-2014, 04:34 PM

Alright. Here is my final code. It seems to be working, but I want to make sure I didn't leave any space for an injection.

PHP Code:


			
// Get the UserID of the Staff member accessing the page
$staffid = $vbulletin->userinfo['userid'];

print_cp_header();
echo "<div class='pagetitle'>In Game Activity System</div>";

//Possible Point Values
$pointreasons = array("Attended a Gamenight (+10)", "Attended a Gamenight (+15)", "Attended a Gamenight (+20)", "Attended a Contest/Torunament (+30)");

// Get Divisions //
$sql = "SELECT gamename, ingamename, profilefield FROM " . TABLE_PREFIX . "gamelist ORDER BY gamename ASC";
$result = $db->query_read_slave($sql);
$divisions = array();
while ( $a = mysql_fetch_array($result) ) {
    $divisions[] = $a;
    $divnames[] = $a[0];
}

/////////////////////// front page
if ( empty($_POST['do']) ) {
    
    ////////////////////// add points via division
    print_form_header($this_script, 'div');
    print_table_header('Add Points via Division');
    print_label_row('Notice:', 'Select the division you are entering activity for.');
    print_select_row('Divisions', 'division', $divnames);
    print_submit_row('Select Division');
    
    ////////////////////// add points text area
    print_form_header($this_script, 'add');
    print_table_header('Add Points');
    print_label_row('Notice:', 'Select the point value based on the event.');
    print_select_row('Points', 'points', $pointreasons);
    print_label_row('Users:', 'Input the usernames of all the users you wish to give the above points to. You must separate names using a semicolon (;).');
    print_textarea_row('Users', 'users','',12,100,false,false);
    print_submit_row('Add Points');
    
    ////////////////////// edit points
    print_form_header($this_script, 'edit');
    print_table_header('Edit Points');
    print_label_row('Username:', 'Enter the username of who you want to edit the points value of.');
    print_input_row('Username', 'username');
    print_submit_row('Edit Points');
}

/////////////////////// div selected
if ( $_POST['do'] == 'div' ) {
   
    if ( !isset($_POST['division']) ) { rpm_print_stop_back('Please select a division.'); }
   
    $vbulletin->input->clean_array_gpc('p', array(
        'division'         => TYPE_UNIT
        ));
    
    // Division Name //
    $n = $vbulletin->GPC['division'];
    $divname = $divisions[$n][0];
    $divign = $divisions[$n][1];
    $divfield = $divisions[$n][2];
    $+++++eck = 1<<$n;
    
    // Get Main Members
    $mainusers = $db->query_read_slave("SELECT user.userid, user.username, userfield. " . $divfield ." FROM " . TABLE_PREFIX . "user AS user LEFT JOIN " . TABLE_PREFIX . "userfield as userfield ON (userfield.userid = user.userid) WHERE (userfield.field5='" . $divname . "') AND (user.username != '') AND (user.usergroupid NOT IN (1,3,4,7,8,20,21,23,45)) ORDER BY username");
    if (!$mainusers){ die('Invalid query: ' . mysql_error()); }
    // Set the Users Array
    $maingameusers = array();
    while ($user = mysql_fetch_array($mainusers)) {
        if ($user[2] == null) { $ign = "N/A"; } else { $ign = $user[2]; }
        $maingameusers[$user[0]] = $user[1] . "  -  " . $divign . ": " . $ign;
    }

    // Get Other Game Members
    $otherusers = $db->query_read_slave("SELECT user.userid, user.username, userfield. " . $divfield . " FROM " . TABLE_PREFIX . "user AS user LEFT JOIN " . TABLE_PREFIX . "userfield as userfield ON (userfield.userid = user.userid) WHERE (userfield.field5 != '" . $divname . "') AND (userfield.field6 & " . $+++++eck . ") AND (user.username != '') AND (user.usergroupid NOT IN (1,3,4,7,8,20,21,23,45)) ORDER BY username");
    if (!$otherusers){ die('Invalid query: ' . mysql_error()); }
    // Set the Users Aray
    $othergameusers = array();
    while ($user = mysql_fetch_array($otherusers)) {
        if ($user[2] == null) { $ign = "N/A"; } else { $ign = $user[2]; }
        $othergameusers[$user[0]] = $user[1] . "  -  " . $divign . ": " . $ign;
    }
    
    ////////////////////// select users to get points
    print_form_header($this_script, 'divadd');
    print_table_header('Add Points to ' . $divname . ' Members');
    print_label_row('Event Type:', 'Select the event type (and point value) to give.');
    print_select_row('Points', 'points', $pointreasons);
    print_label_row('Main Users:', 'Select the Main-Game users who attended the event.');
    print_select_row('Main Users', 'mainusers[]', $maingameusers,null,false,10,true);
    print_label_row('Other Users:', 'Select the Other-Game users who attended the event.');
    print_select_row('Other Users', 'otherusers[]', $othergameusers,null,false,10,true);
    print_label_row('Note:', 'Hold the control key while clicking to select multiple names.');
    print_submit_row('Add Points to Selected Users','Reset');
    
} 

/////////////////////// add
if ( $_POST['do'] == 'add' ) {
   
    if ( !isset($_POST['points']) OR empty($_POST['users']) ) { rpm_print_stop_back('Please be sure every required field is filled out before submitting.'); }
   
    $vbulletin->input->clean_array_gpc('p', array(
        'points'         => TYPE_UNIT,
        'users'          => TYPE_STR
        ));
    
    $apoints = $vbulletin->GPC['points'];
    if ($apoints == 0) { $addpoints = 10; }
    if ($apoints == 1) { $addpoints = 15; }
    if ($apoints == 2) { $addpoints = 20; }
    if ($apoints == 3) { $addpoints = 30; }
    $ausers = $db->escape_string($vbulletin->GPC['users']);
    $addusers = explode(";",$ausers);
    $allusers = "";
    //$adate = date("Y-m-d");
    
    foreach ($addusers as &$u) {
        $user = trim($u);
        $sql = "UPDATE " . TABLE_PREFIX . "user SET iga_points = iga_points + $addpoints, iga_lastpointsdate = NOW() WHERE username='$user'";
        $db->query_write($sql);
        $allusers .= "'$user',";
    }
    
    // Get the userIDs
    $allusers = rtrim($allusers,",");
    $alluserids = $db->query_read_slave("SELECT userid FROM " . TABLE_PREFIX . "user WHERE username IN ($allusers)");
    if (!$alluserids){ die('Invalid query: ' . mysql_error()); }
    
    while ($u = mysql_fetch_array($alluserids)) {
        $userids[] = $u[0];
    }
    
    $allids = serialize($userids);
    
    // Add the Log
    $sql = "INSERT INTO " . TABLE_PREFIX . "igpointslog (date,staffid,type,points,userids) VALUES (NOW(),'$staffid','add',$addpoints,'$allids')";
    $db->query_write($sql);
   
    define('CP_REDIRECT', 'iga_points.php');
    print_stop_message('iga_points_added');
}  

/////////////////////// add via division
if ( $_POST['do'] == 'divadd' ) {
   
    if ( !isset($_POST['points']) OR empty($_POST['mainusers']) ) { rpm_print_stop_back('Please be sure every required field is filled out before submitting.'); }
   
    $vbulletin->input->clean_array_gpc('p', array(
        'points'         => TYPE_UNIT,
        'mainusers'      => TYPE_ARRAY,
        'otherusers'     => TYPE_ARRAY
        ));
    
    $apoints = $vbulletin->GPC['points'];
    if ($apoints == 0) { $addpoints = 10; }
    if ($apoints == 1) { $addpoints = 15; }
    if ($apoints == 2) { $addpoints = 20; }
    if ($apoints == 3) { $addpoints = 30; }
    $addmain = $addother = array();
    $addmain = $vbulletin->GPC['mainusers'];
    $addother = $vbulletin->GPC['otherusers'];
    $allusers = serialize(array_merge($addmain,$addother));
    //$adate = date("Y-m-d");
    
    // Main Gamers
    foreach ($addmain as &$u) {
        $sql = "UPDATE " . TABLE_PREFIX . "user SET iga_points = iga_points + $addpoints, iga_lastpointsdate = NOW() WHERE userid=$u";
        $db->query_write($sql);
    }
    
    // Other Gamers
    foreach ($addother as &$u) {
        $sql = "UPDATE " . TABLE_PREFIX . "user SET iga_points = iga_points + $addpoints, iga_lastpointsdate = NOW() WHERE userid=$u";
        $db->query_write($sql);
    }
    
    //Log the Entry
    $sql = "INSERT INTO " . TABLE_PREFIX . "igpointslog (date,staffid,type,points,userids) VALUES (NOW(),'$staffid','add',$addpoints,'$allusers')";
    $db->query_write($sql);
   
    define('CP_REDIRECT', 'iga_points.php');
    print_stop_message('iga_points_added');
}  

/////////////////////// edit
if ( $_POST['do'] == 'edit' ) {
   
    if ( !isset($_POST['username']) ) { rpm_print_stop_back('Please be sure every required field is filled out before submitting.'); }
    
   
    $vbulletin->input->clean_array_gpc('p', array(
        'username'      => TYPE_STR
        ));
    
    $edituser = $db->escape_string($vbulletin->GPC['username']);
    
    $sql = "SELECT iga_points FROM " . TABLE_PREFIX . "user WHERE username = '$edituser'";
    $result = $db->query_read_slave($sql);
    $cpoints = mysql_result($result,0);
    
    print_form_header($this_script, 'update');
    print_table_header("Update ".$edituser."'s Points");
    echo "<input type='hidden' name='username' value='$edituser'>";
    print_label_row('Note:', 'Points must be between 0 and 400.');
    print_input_row('Points', 'points', $cpoints);
    print_submit_row('Update Points');
}

/////////////////////// Update
if ( $_POST['do'] == 'update' ) {
   
    if ( empty($_POST['username']) OR !isset($_POST['points']) ) { rpm_print_stop_back('Please be sure every required field is filled out before submitting.'); }
   
    $vbulletin->input->clean_array_gpc('p', array(
        'username'  => TYPE_STR,
        'points'    => TYPE_UNIT
        ));
    
    $uuser = $db->escape_string($vbulletin->GPC['username']);
    $upoints = $vbulletin->GPC['points'];
    
    //$udate = date("Y-m-d");
    
    if ($upoints < 0 or $upoints > 400) {
        define('CP_REDIRECT', 'iga_points.php');
        print_stop_message('iga_points_val_error');
    } else {
        $sql = "UPDATE " . TABLE_PREFIX . "user SET iga_points=$upoints, iga_lastpointsdate=NOW() WHERE username = '$uuser'";
        $db->query_write($sql);
        
        //Get the UserID
        $idquery = $db->query_read_slave("SELECT userid FROM " . TABLE_PREFIX . "user WHERE username = '$uuser' limit 1");
        if (!$idquery){ die('Invalid query: ' . mysql_error()); }
        $userid[] = mysql_result($idquery,0);
        $editid = serialize($userid);
        
        //Log the Entry
        $sql = "INSERT INTO " . TABLE_PREFIX . "igpointslog (date,staffid,type,points,userids) VALUES (NOW(),'$staffid','edit',$upoints,'$editid')";
        $db->query_write($sql);
        
        define('CP_REDIRECT', 'iga_points.php');
        print_stop_message('iga_points_updated'); 
    }
    
}

kh99 · #12 11-12-2014, 05:11 PM

lol, I didn't know you could have a variable named $++++eck. Anyway, the only thing I notice is that you could change the type for cleaning mainusers and otherusers to TYPE_ARRAY_UINT (it looks like they are userids, right?).

KGodel · #13 11-12-2014, 05:12 PM

Ahh, when I looked up the cleaning stuff it only showed me TYPE_ARRAY. Also, that variable is bit check, the forums censored it because it has a naughty word.

kh99 · #14 11-12-2014, 05:16 PM

Quote:

Originally Posted by KGodel

Also, that variable is bit check, the forums censored it because it has a naughty word.

lol, that's a good one.

KGodel · #15 11-14-2014, 07:23 PM

Alright, so my display code is bunked somehow. Everything shows until right after the table headers are set. I checked the array via print_r and everything looks legit. It counts the entries correctly, so I'm not sure what the issue is.

PHP Code:


			
<?php
/*======================================================================*\
|| #################################################################### ||
|| # ACTIVITY POINTS LOG BY DRMATH
|| #################################################################### ||
\*======================================================================*/

// ######################## SET PHP ENVIRONMENT ###########################
error_reporting(E_ALL & ~E_NOTICE);

// #################### PRE-CACHE TEMPLATES AND DATA ######################
$phrasegroups = array('style');
$specialtemplates = array('products');

// ########################## REQUIRE BACK-END ############################
require_once('./global.php');
require_once(DIR . '/includes/adminfunctions_template.php');

// ########################## USERNAME FUNCTION ###########################
function get_username($userid) {
    $sql = "SELECT username FROM " . TABLE_PREFIX . "user WHERE userid = $userid";
    $result = $db->query_read_slave($sql);
    $username = mysql_result($result,0);
    
    return $username;
}

// ######################## CHECK ADMIN PERMISSIONS #######################
if (!can_administer('canadminusers'))
{
    print_cp_no_permission();
}

// ######################## GET PAGE START ################################
$page = filter_input(INPUT_GET,'page',FILTER_SANITIZE_NUMBER_INT);

print_cp_header();
echo "<div class='pagetitle'>In Game Activity Points Log</div>";

// Get Points Logged //
$sql = "SELECT logid, staffid, type, points, userids, date FROM " . TABLE_PREFIX . "igpointslog";
$result = $db->query_read_slave($sql);
$logs = array();
while ( $a = mysql_fetch_array($result, MYSQL_NUM) ) {
    $logs[] = $a;
}
mysql_free_result($result);

// Page Variables
if (($page == null) OR ($page == 1)) {$i = 0; $page = 1;} else {$i = (($page - 1) * 15);}
$totallogs = count($logs);
$maxpages = ceil($totallogs / 15);
$prevpage = $page - 1;
$nextpage = $page + 1;

////////////////////// Begin Log
echo "<br/><br/>";
echo "<table cellpadding='4' cellspacing='0' border='0' align='center' width='90%' style='border-collapse:separate' class='tborder' id='cpform_table'>
        <tbody>
          <tr valign='top'>
            <td class='thead' colspan='6' align='right'> <a href='pointslog.php?'>[Restart]</a> </td>
          </tr>
          <tr>
            <td class='tcat' align='center' colspan='6'>
                <b>In-Game Points Log Viewer (page $page/$maxpages) | There are $totallogs total log entries.</b>
            </td>
          </tr>
          <tr>
            <td class='thead' align='left'>Log ID</td>
            <td class='thead'>Staff Username</td>
            <td class='thead'>Date</td>
            <td class='thead'>Action</td>
            <td class='thead'>Points</td>
            <td class='thead'>User(s)</td>
          </tr>";

////////////////////// Fill out 15 entries
foreach ($logs as &$l) {
    if ($i < ($page * 15) ) {
        
        // Set Variables
        $logid = $l[0];
        $staff = "<a href='user.php?do=edit&u=$l[1]'><b>" . get_username($l[1]) . "</b></a>";
        if ($l[2] = "add") { $type = "Added Points"; } elseif ($l[2] = "edit") { $type = "Edited Points"; }
        $points = $l[3];
        $uarray = unserialize($l[4]);
        $users = "";
        foreach ($uarray as $u) {
            $users .= " <a href='user.php?do=edit&u=$u'>" . get_username($u) . "</a>,";
        }
        $users = rtrim(trim($users), ",");
        //$date = new DateTime;//
        $date = $l[5];
       
        // Get Odd or Even Row
         if (($i % 2) == 1) { $class = "alt1"; } else { $class = "alt2"; }
         
        echo "<tr valign='top'>
                <td class='$class'>$logid</td>
                <td class='$class'>$staff</td>
                <td class='$class'>$date</td>
                <td class='$class'>$type</td>
                <td class='$class'>$points</td>
                <td class='$class'>$users</td>
              </tr>";
        $i++;
    }
}

////////////////////// End Log, Page-nation
echo "    <tr>
            <td class='tfoot' colspan='6' align='center'>";
if ($prevpage > 1) { echo "      <input type='button' class='button' value='? First Page' tabindex='1' onclick='window.location='pointslog.php?page=1'> &nbsp; "; }
if ($page > 1) { echo "      <input type='button' class='button' value='< Previous Page' tabindex='1' onclick='window.location='pointslog.php?page=$prevpage'> &nbsp; "; }
if ($page < $maxpages) { echo "      <input type='button' class='button' value='Next Page >' tabindex='1' onclick='window.location='pointslog.php?page=$nextpage'> &nbsp; "; }
if ($nextpage < $maxpages) { echo "      <input type='button' class='button' value='Last Page ?' tabindex='1' onclick='window.location='pointslog.php?page=$maxpages'>"; }
echo "    </td>
    </tr>
  </tbody>
</table>";

print_cp_footer();
?>

After some tinkering, the code stops working at the line:

PHP Code:


			
$staff = "<a href='user.php?do=edit&u=$l[1]'><b>" . get_username($l[1]) . "</b></a>";

I think the issue is with my function. NetBeans is telling me $db isn't defined, so my guess is this is the issue.

Fixed. The function wasn't working so I changed this bit up:

PHP Code:


			
        $staff = "<a href='user.php?do=edit&u=$l[1]'><b>" . fetch_userinfo($l[1])['username'] . "</b></a>";
        if ($l[2] == "add") { $type = "Added Points"; } elseif ($l[2] == "edit") { $type = "Edited Points"; }
        $points = $l[3];
        $uarray = unserialize($l[4]);
        $users = "";
        foreach ($uarray as $u) {
            // get_username($u) //
            $users .= " <a href='user.php?do=edit&u=$u'>" . fetch_userinfo($u)['username'] . "</a>,";
        }

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.06493 seconds Memory Usage 2,386KB Queries Executed 11 (?)
More Information
Template Usage: (1)SHOWTHREAD (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)ad_showthread_beforeqr (1)ad_showthread_firstpost (1)ad_showthread_firstpost_sig (1)ad_showthread_firstpost_start (4)bbcode_php (1)bbcode_quote (1)footer (1)forumjump (1)forumrules (1)gobutton (1)header (1)headinclude (1)navbar (3)navbar_link (120)option (1)pagenav (1)pagenav_curpage (1)pagenav_pagelink (5)post_thanks_box (5)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (5)post_thanks_postbit_info (5)postbit (5)postbit_onlinestatus (5)postbit_wrapper (1)spacer_close (1)spacer_open (1)tagbit_wrapper Phrase Groups Available: global inlinemod postbit posting reputationlevel showthread	Included Files: ./showthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showthread_start showthread_getinfo forumjump showthread_post_start showthread_query_postids showthread_query bbcode_fetch_tags bbcode_create showthread_postbit_create postbit_factory postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end fetch_musername postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_display_complete post_thanks_function_can_thank_this_post_start pagenav_page pagenav_complete tag_fetchbit_complete forumrules navbits navbits_complete showthread_complete
Messages:

The Arcive of Official vBulletin Modifications Site.

It is not a VB3 engine, just a parsed copy!