arisgames / server Goto Github PK

I'm seeing a number of security vulnerabilities that's preventing us from going production. If you haven't already, please check out the OWASP Top Ten. For example, just looking at resetpassword.php:

SQL Injection

$query = "SELECT user_name FROM players WHERE player_id = ".$_GET['i'];

$rsResult = @mysql_query($query);
$editorRecord = mysql_fetch_array($rsResult);

would be better written as (http://php.net/manual/en/pdo.prepared-statements.php)

$query = "SELECT user_name FROM players WHERE player_id = ?";
$stmt = $dbh->prepare($query);
$stmt->execute($_GET['i']);

$editorRecord = $stmt->fetch(PDO::FETCH_ASSOC);

XSS

echo "<input type = 'hidden' name='accounttype' value='".$_GET['t']."'>";

needs input validation and/or proper escaping, such as:

echo "<input type = 'hidden' name='accounttype' value='" . htmlentities($_GET['t']) . "'>";

Password storage

See http://www.php.net/manual/en/faq.passwords.php#faq.passwords.fasthash

$query = "UPDATE editors
SET password = MD5('{$newpassword}')
WHERE editor_id = $editorid";

That MD5 is only a bit stronger than plain-text, especially for weak passwords. You should look into stronger, salted hashing algorithms.

"Error establishing a database connection" error is currently on the page, can't access the site! Perhaps the updates two days ago to the php broke something?

The readme file has this line "Visit /services/v2/autocrud/index.html". But there is no prior instruction as for how to start the aris server. Please advise.