cyberpresidentvanellope/Bubberstation
1
0
Fork 0
mirror of https://github.com/Bubberstation/Bubberstation.git synced 2026-08-31 00:58:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

Basic pagination for library visitor console (#50427)

Browse Source 
Fixes #45284

Some simple pagination for the library visitor console to stop it from hanging the server by trying to retrieve too much data.

The UI hasn't been made any better, I just wanted to stop us needing #49065 to be testmerged indefinitely. I went into this thinking I'd improve the UI and code but that was before I had read any of it and lost my motivation.

Bonus points for this code having allowed unsanitized arbitrary queries for at least 10 years.
This commit is contained in:
Jordie
2020-04-07 08:11:16 +12:00
committed by GitHub
parent f31d4e82f1
commit 2fe48855c8
1 changed files with 35 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/library/lib_machines.dm
+35 -15
View File
@@ -25,11 +25,11 @@
var/title
var/category = "Any"
var/author
var/SQLquery
var/search_page = 0
/obj/machinery/computer/libraryconsole/ui_interact(mob/user)
. = ..()
var/dat = "" // <META HTTP-EQUIV='Refresh' CONTENT='10'>
var/list/dat = list() // <META HTTP-EQUIV='Refresh' CONTENT='10'>
switch(screenstate)
if(0)
dat += "<h2>Search Settings</h2><br>"
@@ -42,13 +42,38 @@
dat += "<font color=red><b>ERROR</b>: Unable to contact External Archive. Please contact your system administrator for assistance.</font><BR>"
else if(QDELETED(user))
return
else if(!SQLquery)
dat += "<font color=red><b>ERROR</b>: Malformed search request. Please contact your system administrator for assistance.</font><BR>"
else
dat += "<table>"
dat += "<tr><td>AUTHOR</td><td>TITLE</td><td>CATEGORY</td><td>SS<sup>13</sup>BN</td></tr>"
var/datum/DBQuery/query_library_list_books = SSdbcore.NewQuery(SQLquery)
author = sanitizeSQL(author)
title = sanitizeSQL(title)
category = sanitizeSQL(category)
var/SQLsearch = "isnull(deleted) AND "
if(category == "Any")
SQLsearch += "author LIKE '%[author]%' AND title LIKE '%[title]%'"
else
SQLsearch += "author LIKE '%[author]%' AND title LIKE '%[title]%' AND category='[category]'"
var/bookcount = 0
var/booksperpage = 20
var/datum/DBQuery/query_library_count_books = SSdbcore.NewQuery("SELECT COUNT(id) FROM [format_table_name("library")] WHERE [SQLsearch]")
if(!query_library_count_books.warn_execute())
qdel(query_library_count_books)
return
if(query_library_count_books.NextRow())
bookcount = text2num(query_library_count_books.item[1])
qdel(query_library_count_books)
if(bookcount > booksperpage)
dat += "<b>Page: </b>"
var/pagecount = 1
var/list/pagelist = list()
while(bookcount > 0)
pagelist += "<a href='?src=[REF(src)];bookpagecount=[pagecount - 1]'>[pagecount == search_page + 1 ? "<b>\[[pagecount]\]</b>" : "\[[pagecount]\]"]</a>"
bookcount -= booksperpage
pagecount++
dat += pagelist.Join(" | ")
search_page = text2num(sanitizeSQL(search_page))
var/limit = " LIMIT [booksperpage * search_page], [booksperpage]"
var/datum/DBQuery/query_library_list_books = SSdbcore.NewQuery("SELECT author, title, category, id FROM [format_table_name("library")] WHERE [SQLsearch][limit]")
if(!query_library_list_books.Execute())
dat += "<font color=red><b>ERROR</b>: Unable to retrieve book listings. Please contact your system administrator for assistance.</font><BR>"
else
@@ -64,7 +89,7 @@
dat += "</table><BR>"
dat += "<A href='?src=[REF(src)];back=1'>\[Go Back\]</A><BR>"
var/datum/browser/popup = new(user, "publiclibrary", name, 600, 400)
popup.set_content(dat)
popup.set_content(jointext(dat, ""))
popup.set_title_image(user.browse_rsc_icon(src.icon, src.icon_state))
popup.open()
@@ -81,29 +106,24 @@
title = sanitize(newtitle)
else
title = null
title = sanitizeSQL(title)
if(href_list["setcategory"])
var/newcategory = input("Choose a category to search for:") in list("Any", "Fiction", "Non-Fiction", "Adult", "Reference", "Religion")
if(newcategory)
category = sanitize(newcategory)
else
category = "Any"
category = sanitizeSQL(category)
if(href_list["setauthor"])
var/newauthor = input("Enter an author to search for:") as text|null
if(newauthor)
author = sanitize(newauthor)
else
author = null
author = sanitizeSQL(author)
if(href_list["search"])
SQLquery = "SELECT author, title, category, id FROM [format_table_name("library")] WHERE isnull(deleted) AND "
if(category == "Any")
SQLquery += "author LIKE '%[author]%' AND title LIKE '%[title]%'"
else
SQLquery += "author LIKE '%[author]%' AND title LIKE '%[title]%' AND category='[category]'"
screenstate = 1
if(href_list["bookpagecount"])
search_page = text2num(href_list["bookpagecount"])
if(href_list["back"])
screenstate = 0