정적 분석기 결과 반영. 빠진 POST 인자 입력 등

hwe/c_chiefboard.php

@@ -7,6 +7,7 @@ include "func.php";
 $title = Util::getReq('title');
 $msg = Util::getReq('msg');
 $num = Util::getReq('num');
+$reply = Util::getReq('reply');
 // $title, $msg, $num
 
 //로그인 검사

hwe/c_double.php

@@ -40,7 +40,7 @@ if($command == 46) {
     ], 'owner=%i', $userID);
 
     $count = count($turn);
-    $query = ['con'=>$db->eval('con')];
+    $query = ['con'=>$db->sqleval('con')];
     foreach($turn as $turnIdx){
         $query['turn'.$turnIdx] = $comStr;
     }

hwe/preprocessing.php

@@ -10,9 +10,16 @@ $userID = Session::getUserID();
 $db = DB::db();
 $connect=$db->get();
 
+$turn = Util::getReq('turn', 'array_int');
+$commandtype = Util::getReq('commandtype', 'int');
 
 increaseRefresh("턴입력", 1);
 
+if(!$turn || $commandtype === null){
+    header('location:index.php');
+    die();
+}
+
 $query = "select conlimit from game limit 1";
 $result = MYDB_query($query, $connect) or Error(__LINE__.MYDB_error($connect),"");
 $admin = MYDB_fetch_array($result);

hwe/process_war.php

@@ -428,8 +428,8 @@ function processWar($general, $city) {
             $deadAmount['def'] = $deadAmount['def'] + $mykillnum;
 
             // 도시쌀 소모 계산
-            $opexp = round($opexp / 50 * 0.8);
-            $rice = round($opexp * 5 * getCrewtypeRice($game, 0, 0) * ($game['city_rate']/100 - 0.2));
+            $opexp = intval(round($opexp / 50 * 0.8));
+            $rice = intval(round($opexp * 5 * getCrewtypeRice($game, 0, 0) * ($game['city_rate']/100 - 0.2)));
             $destnation['rice'] -= $rice;
             if($destnation['rice'] < 0) { $destnation['rice'] = 0; }
             $query = "update nation set rice='{$destnation['rice']}' where nation='{$destnation['nation']}'";
@@ -438,8 +438,8 @@ function processWar($general, $city) {
             pushAdminLog(["성벽 쌀 소모 : $rice"]);
 
             //원래대로 스케일링
-            $city['def'] = round($city['def'] / 10);
-            $city['wall'] = round($city['wall'] / 10);
+            $city['def'] = intval(round($city['def'] / 10));
+            $city['wall'] = intval(round($city['wall'] / 10));
             //내정 감소
             $dec = round($cityCrew / 10);
             $city['agri'] -= $dec;
@@ -455,7 +455,7 @@ function processWar($general, $city) {
             addGenDex($general['no'], $general['crewtype'], $mykillnum);
             addGenDex($general['no'], 40, $mydeathnum);
             // 죽은수 기술로 누적
-            $num = round($mydeathnum * 0.01);
+            $num = intval(round($mydeathnum * 0.01));
             // 국가보정
             if($nation['type'] == 3 || $nation['type'] == 13)                                                                   { $num *= 1.1; }
             if($nation['type'] == 5 || $nation['type'] == 6 || $nation['type'] == 7 || $nation['type'] == 8 || $nation['type'] == 12) { $num *= 0.9; }

hwe/select_npc_post.php

@@ -41,11 +41,19 @@ if(!$npc){
 
 ########## 동일 정보 존재여부 확인. ##########
 
-$admin = $db->queryFirstRow('SELECT year,month,maxgeneral,turnterm,genius,npcmode from game limit 1');
+list(
+    $year,
+    $month,
+    $maxgeneral,
+    $turnterm,
+    $genius,
+    $npcmode
+) = $db->queryFirstList('SELECT year,month,maxgeneral,turnterm,genius,npcmode from game limit 1');
+
 $gencount = $db->queryFirstField('SELECT count(`no`) FROM general WHERE noc<2');
 $oldGeneral = $db->queryFirstField('SELECT `no` FROM general WHERE `owner`=%i', $userID);
 
-if($admin['npcmode'] != 1) {
+if($npcmode != 1) {
     echo "<script>alert('잘못된 접근입니다!');</script>";
     echo "<script>history.go(-1);</script>";
     exit();
@@ -57,7 +65,7 @@ if($oldGeneral) {
       </script>");
     exit;
 }
-if($admin['maxgeneral'] <= $gencount) {
+if($maxgeneral <= $gencount) {
     echo("<script>
       window.alert('더이상 등록할 수 없습니다!')
       history.go(-1)
@@ -110,13 +118,11 @@ $me = [
     'no'=>$npcID
 ];
 
-$log[0] = "<C>●</>{$admin['month']}월:<Y>{$npc['name']}</>의 육체에 <Y>{$session->userName}</>(이)가 <S>빙의</>됩니다!";
-pushGeneralHistory($me, "<C>●</>{$admin['year']}년 {$admin['month']}월:<Y>{$npc['name']}</>의 육체에 <Y>{$session->userName}</>(이)가 빙의되다.");
-pushGenLog($me, $mylog);
-pushGeneralPublicRecord($log, $admin['year'], $admin['month']);
+pushGeneralHistory($me, "<C>●</>{$year}년 {$month}월:<Y>{$npc['name']}</>의 육체에 <Y>{$session->userName}</>(이)가 빙의되다.");
+//pushGenLog($me, $mylog);
+pushGeneralPublicRecord(["<C>●</>{$month}월:<Y>{$npc['name']}</>의 육체에 <Y>{$session->userName}</>(이)가 <S>빙의</>됩니다!"], $year, $month);
 
-$adminLog[0] = "가입 : {$session->userName} // {$id} // ".getenv("REMOTE_ADDR");
-pushAdminLog($adminLog);
+pushAdminLog(["가입 : {$session->userName} // {$id} // ".getenv("REMOTE_ADDR")]);
 
 $rootDB->insert('member_log', [
     'member_no' => $userID,