owenvoke/kastatus

A customisable version of the Kickass Torrents Status page.

kastatus

A customisable version of the Kickass Torrents Status page. (Originally up at kastatus.com)

Example: https://kastatus.pxgamer.xyz

kastatus's Issues

[Insight] Database queries should use parameter binding - in login/index.php, line 10

in login/index.php, line 10

If provided by the user, the value of mysqli_real_escape_string($db_conn, $_POST['username']) may allow an SQL injection attack. Avoid concatenating parameters to SQL query strings, and use parameter binding instead.

      include '../head.php';
      include '../backend/funcs.php';
      $db_conn = \funcs\Functions::conn();

      if (isset($_POST['login']) && $_POST['username'] !== '' && $_POST['password'] !== '') {
          $sql = "SELECT password FROM `users` WHERE username='".mysqli_real_escape_string($db_conn, $_POST['username'])."'";
          $res = \funcs\Functions::query($db_conn, $sql);
          while ($row = mysqli_fetch_assoc($res)) {
              $hash = $row['password'];
          }
          $verified = password_verify($_POST['password'], $hash);

---

Posted from SensioLabsInsight

Add php sessions for logging in/using the admin area

Need to add PHP session usage for the login/admin areas.

So, when logging in it sets the session with the following details:

$_SESSION['user'] = (object) [
    "id" => "%USERID%",
    "username" => "%USER%",
    "loginDate" => "%DATE%"
];

And on the admin page, check that $_SESSION['user'] is set and isn't equal to null.

This is quite an easy one, so anyone who wants it, just comment below. 😄

If you need any help, let me know.