정적 분석기 결과 반영. 빠진 POST 인자 입력 등

hwe/c_chiefboard.php

@@ -7,6 +7,7 @@ include "func.php";
 $title = Util::getReq('title');
 $msg = Util::getReq('msg');
 $num = Util::getReq('num');
+$reply = Util::getReq('reply');
 // $title, $msg, $num
 
 //로그인 검사

hwe/c_double.php

@@ -40,7 +40,7 @@ if($command == 46) {
     ], 'owner=%i', $userID);
 
     $count = count($turn);
-    $query = ['con'=>$db->eval('con')];
+    $query = ['con'=>$db->sqleval('con')];
     foreach($turn as $turnIdx){
         $query['turn'.$turnIdx] = $comStr;
     }

hwe/preprocessing.php

@@ -10,9 +10,16 @@ $userID = Session::getUserID();
 $db = DB::db();
 $connect=$db->get();
 
+$turn = Util::getReq('turn', 'array_int');
+$commandtype = Util::getReq('commandtype', 'int');
 
 increaseRefresh("턴입력", 1);
 
+if(!$turn || $commandtype === null){
+    header('location:index.php');
+    die();
+}
+
 $query = "select conlimit from game limit 1";
 $result = MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
 $admin = MYDB_fetch_array($result);

hwe/process_war.php

@@ -428,8 +428,8 @@ function processWar($general, $city) {
             $deadAmount['def'] = $deadAmount['def'] + $mykillnum;
 
             // 도시쌀 소모 계산
-            $opexp = round($opexp / 50 * 0.8);
-            $rice = round($opexp * 5 * getCrewtypeRice($game, 0, 0) * ($game['city_rate']/100 - 0.2));
+            $opexp = intval(round($opexp / 50 * 0.8));
+            $rice = intval(round($opexp * 5 * getCrewtypeRice($game, 0, 0) * ($game['city_rate']/100 - 0.2)));
             $destnation['rice'] -= $rice;
             if($destnation['rice'] < 0) { $destnation['rice'] = 0; }
             $query = "update nation set rice='{$destnation['rice']}' where nation='{$destnation['nation']}'";
@@ -438,8 +438,8 @@ function processWar($general, $city) {
             pushAdminLog(["성벽 쌀 소모 : $rice"]);
 
             //원래대로 스케일링
-            $city['def'] = round($city['def'] / 10);
-            $city['wall'] = round($city['wall'] / 10);
+            $city['def'] = intval(round($city['def'] / 10));
+            $city['wall'] = intval(round($city['wall'] / 10));
             //내정 감소
             $dec = round($cityCrew / 10);
             $city['agri'] -= $dec;
@@ -455,7 +455,7 @@ function processWar($general, $city) {
             addGenDex($general['no'], $general['crewtype'], $mykillnum);
             addGenDex($general['no'], 40, $mydeathnum);
             // 죽은수 기술로 누적
-            $num = round($mydeathnum * 0.01);
+            $num = intval(round($mydeathnum * 0.01));
             // 국가보정
             if($nation['type'] == 3 || $nation['type'] == 13)                                                                   { $num *= 1.1; }
             if($nation['type'] == 5 || $nation['type'] == 6 || $nation['type'] == 7 || $nation['type'] == 8 || $nation['type'] == 12) { $num *= 0.9; }

hwe/select_npc_post.php

@@ -41,11 +41,19 @@ if(!$npc){
 
 ########## 동일 정보 존재여부 확인. ##########
 
-$admin = $db->queryFirstRow('SELECT year,month,maxgeneral,turnterm,genius,npcmode from game limit 1');
+list(
+    $year,
+    $month,
+    $maxgeneral,
+    $turnterm,
+    $genius,
+    $npcmode
+) = $db->queryFirstList('SELECT year,month,maxgeneral,turnterm,genius,npcmode from game limit 1');
+
 $gencount = $db->queryFirstField('SELECT count(`no`) FROM general WHERE noc<2');
 $oldGeneral = $db->queryFirstField('SELECT `no` FROM general WHERE `owner`=%i', $userID);
 
-if($admin['npcmode'] != 1) {
+if($npcmode != 1) {
     echo "<script>alert('잘못된 접근입니다!');</script>";
     echo "<script>history.go(-1);</script>";
     exit();
@@ -57,7 +65,7 @@ if($oldGeneral) {
       </script>");
     exit;
 }
-if($admin['maxgeneral'] <= $gencount) {
+if($maxgeneral <= $gencount) {
     echo("<script>
       window.alert('더이상 등록할 수 없습니다!')
       history.go(-1)
@@ -110,13 +118,11 @@ $me = [
     'no'=>$npcID
 ];
 
-$log[0] = "<C>●</>{$admin['month']}월:<Y>{$npc['name']}</>의 육체에 <Y>{$session->userName}</>(이)가 <S>빙의</>됩니다!";
-pushGeneralHistory($me, "<C>●</>{$admin['year']}년 {$admin['month']}월:<Y>{$npc['name']}</>의 육체에 <Y>{$session->userName}</>(이)가 빙의되다.");
-pushGenLog($me, $mylog);
-pushGeneralPublicRecord($log, $admin['year'], $admin['month']);
+pushGeneralHistory($me, "<C>●</>{$year}년 {$month}월:<Y>{$npc['name']}</>의 육체에 <Y>{$session->userName}</>(이)가 빙의되다.");
+//pushGenLog($me, $mylog);
+pushGeneralPublicRecord(["<C>●</>{$month}월:<Y>{$npc['name']}</>의 육체에 <Y>{$session->userName}</>(이)가 <S>빙의</>됩니다!"], $year, $month);
 
-$adminLog[0] = "가입 : {$session->userName} // {$id} // ".getenv("REMOTE_ADDR");
-pushAdminLog($adminLog);
+pushAdminLog(["가입 : {$session->userName} // {$id} // ".getenv("REMOTE_ADDR")]);
 
 $rootDB->insert('member_log', [
     'member_no' => $userID,

j_updateServer.php

@@ -45,7 +45,8 @@ if(!$v->validate()){
 
 $server = basename($request['server']);
 $target = $request['target'];
-$baseServerName = end(array_keys(AppConf::getList()));
+
+$baseServerName = Util::array_last_key(AppConf::getList());
 
 $targetDir =$target.':'.$baseServerName;
 

oauth_kakao/j_join_process.php

@@ -47,6 +47,8 @@ if(!$username || !$password || !$nickname){
     ]);
 }
 
+'@phan-var-force string $password';
+
 if(strlen($password)!=128){
     Json::die([
         'result'=>false,

src/sammo/StringUtil.php

@@ -37,7 +37,7 @@ class StringUtil
         }
 
         if($currentPos + $width >= $length){
-            return substr($str, $currentPos, null);
+            return substr($str, $currentPos);
         }
 
         for($idx = $currentPos; $idx < count($strings); $idx++){
@@ -74,7 +74,7 @@ class StringUtil
         return $result.$endFill;
     }
 
-    function splitString($str, $l = 0) {
+    public static function splitString($str, $l = 0) {
         //https://php.net/manual/kr/function.str-split.php#107658
         if ($l > 0) {
             $ret = array();
@@ -99,7 +99,7 @@ class StringUtil
         $chLen = mb_strwidth($ch, 'UTF-8');
 
         if($chLen == 0){
-            return padString($str, $maxsize, ' ', $position);
+            return static::padString($str, $maxsize, ' ', $position);
         }
 
         $textLen = mb_strwidth($str, 'UTF-8');

src/sammo/Util.php

@@ -3,6 +3,15 @@ namespace sammo;
 
 class Util extends \utilphp\util
 {
+
+    /**
+     * int 값 반환을 강제하는 부동소수점 반올림
+     * @param numeric $value
+     */
+    public static function round($value) : int{
+        return intval(round($value));
+    }
+
     private static function _parseReq($value, string $type)
     {
         if (is_array($value)) {
@@ -233,7 +242,11 @@ class Util extends \utilphp\util
         }
     }
 
-    public static function eraseNullValue($dict, $depth=512)
+    /**
+     * @param null|mixed|mixed[] $dict
+     * @return null|mixed|mixed[]
+     */
+    public static function eraseNullValue($dict, int $depth=512)
     {
         //TODO:Test 추가
         if ($dict === null) {
@@ -251,13 +264,17 @@ class Util extends \utilphp\util
         foreach ($dict as $key=>$value) {
             if ($value === null) {
                 unset($dict[$key]);
-            } elseif (Util::isDict($value)) {
-                $newValue = Util::eraseNullValue($value, $depth - 1);
-                if ($newValue === null) {
-                    unset($dict[$key]);
-                } else {
-                    $dict[$key] = $newValue;
-                }
+                continue;
+            } 
+            if (!Util::isDict($value)) {
+                continue;
+            }
+
+            $newValue = Util::eraseNullValue($value, $depth - 1);
+            if ($newValue === null) {
+                unset($dict[$key]);
+            } else {
+                $dict[$key] = $newValue;
             }
         }
     

src/sammo/WebUtil.php

@@ -27,6 +27,9 @@ class WebUtil
         }
     }
 
+    /**
+     * @return null|mixed|mixed[]
+     */
     public static function parseJsonPost()
     {
         // http://thisinterestsme.com/receiving-json-post-data-via-php/

tmp_msg/add_msg_dummy.php

@@ -1,4 +1,6 @@
 <?php
+namespace sammo;
+
 require('../hwe/lib.php');