diff --git a/.travis.yml b/.travis.yml index 3ba449df6d1..0585204bddd 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,6 @@ language: generic os: linux -dist: xenial +dist: bionic branches: except: @@ -61,23 +61,20 @@ jobs: - gcc-multilib - g++-7 - g++-7-multilib - - libmariadb-client-lgpl-dev:i386 - - libmariadbd-dev + - libssl1.1:i386 + - zlib1g:i386 cache: directories: - $HOME/BYOND - - $HOME/libmariadb install: - tools/travis/install_byond.sh - source $HOME/BYOND/byond/bin/byondsetup - - tools/travis/install_libmariadb.sh - tools/travis/install_rust_g.sh before_script: - mysql -u root -e 'CREATE DATABASE tg_travis;' - mysql -u root tg_travis < SQL/tgstation_schema.sql - mysql -u root -e 'CREATE DATABASE tg_travis_prefixed;' - mysql -u root tg_travis_prefixed < SQL/tgstation_schema_prefixed.sql - - tools/travis/build_bsql.sh script: - tools/travis/dm.sh -DTRAVISBUILDING tgstation.dme || travis_terminate 1 - tools/travis/run_server.sh diff --git a/BSQL.dll b/BSQL.dll deleted file mode 100644 index 861492c8b47..00000000000 Binary files a/BSQL.dll and /dev/null differ diff --git a/code/__DEFINES/bsql.config.dm b/code/__DEFINES/bsql.config.dm deleted file mode 100644 index ce1964c217c..00000000000 --- a/code/__DEFINES/bsql.config.dm +++ /dev/null @@ -1,6 +0,0 @@ -#define BSQL_EXTERNAL_CONFIGURATION -#define BSQL_DEL_PROC(path) ##path/Destroy() -#define BSQL_DEL_CALL(obj) qdel(##obj) -#define BSQL_IS_DELETED(obj) (QDELETED(obj)) -#define BSQL_PROTECT_DATUM(path) GENERAL_PROTECT_DATUM(##path) -#define BSQL_ERROR(message) SSdbcore.ReportError(message) diff --git a/code/__DEFINES/bsql.dm b/code/__DEFINES/bsql.dm deleted file mode 100644 index e5a11f9a32f..00000000000 --- a/code/__DEFINES/bsql.dm +++ /dev/null @@ -1,135 +0,0 @@ -//BSQL - DMAPI -#define BSQL_VERSION "v1.3.0.0" - -//types of connections -#define BSQL_CONNECTION_TYPE_MARIADB "MySql" -#define BSQL_CONNECTION_TYPE_SQLSERVER "SqlServer" - -#define BSQL_DEFAULT_TIMEOUT 5 -#define BSQL_DEFAULT_THREAD_LIMIT 50 - -//Call this before rebooting or shutting down your world to clean up gracefully. This invalidates all active connection and operation datums -/world/proc/BSQL_Shutdown() - return - -/* -Called whenever a library call is made with verbose information, override and do with as you please - message: English debug message -*/ -/world/proc/BSQL_Debug(msg) - return - -/* -Create a new database connection, does not perform the actual connect - connection_type: The BSQL connection_type to use - asyncTimeout: The timeout to use for normal operations, 0 for infinite, defaults to BSQL_DEFAULT_TIMEOUT - blockingTimeout: The timeout to use for blocking operations, must be less than or equal to asyncTimeout, 0 for infinite, defaults to asyncTimeout - threadLimit: The limit of additional threads BSQL will run simultaneously, defaults to BSQL_DEFAULT_THREAD_LIMIT -*/ -/datum/BSQL_Connection/New(connection_type, asyncTimeout, blockingTimeout, threadLimit) - return ..() - -/* -Starts an operation to connect to a database. Should only have 1 successful call - ipaddress: The ip/hostname of the target server - port: The port of the target server - username: The username to login to the target server - password: The password for the target server - database: Optional database to connect to. Must be used when trying to do database operations, `USE x` is not sufficient - Returns: A /datum/BSQL_Operation representing the connection or null if an error occurred -*/ -/datum/BSQL_Connection/proc/BeginConnect(ipaddress, port, username, password, database) - return - -/* -Properly quotes a string for use by the database. The connection must be open for this proc to succeed - str: The string to quote - Returns: The string quoted on success, null on error -*/ -/datum/BSQL_Connection/proc/Quote(str) - return - -/* -Starts an operation for a query - query: The text of the query. Only one query allowed per invocation, no semicolons - Returns: A /datum/BSQL_Operation/Query representing the running query and subsequent result set or null if an error occurred - - Note for MariaDB: The underlying connection is pooled. In order to use connection state based properties (i.e. LAST_INSERT_ID()) you can guarantee multiple queries will use the same connection by running BSQL_DEL_CALL(query) on the finished /datum/BSQL_Operation/Query and then creating the next one with another call to BeginQuery() with no sleeps in between -*/ -/datum/BSQL_Connection/proc/BeginQuery(query) - return - -/* -Checks if the operation is complete. This, in some cases must be called multiple times with false return before a result is present regardless of timespan. For best performance check it once per tick - - Returns: TRUE if the operation is complete, FALSE if it's not, null on error -*/ -/datum/BSQL_Operation/proc/IsComplete() - return - -/* -Blocks the entire game until the given operation completes. IsComplete should not be checked after calling this to avoid potential side effects. - -Returns: TRUE on success, FALSE if the operation wait time exceeded the connection's blockingTimeout setting -*/ -/datum/BSQL_Operation/proc/WaitForCompletion() - return - -/* -Get the error message associated with an operation. Should not be used while IsComplete() returns FALSE - - Returns: The error message, if any. null otherwise -*/ -/datum/BSQL_Operation/proc/GetError() - return - -/* -Get the error code associated with an operation. Should not be used while IsComplete() returns FALSE - - Returns: The error code, if any. null otherwise -*/ -/datum/BSQL_Operation/proc/GetErrorCode() - return - -/* -Gets an associated list of column name -> value representation of the most recent row in the query. Only valid if IsComplete() returns TRUE. If this returns null and no errors are present there are no more results in the query. Important to note that once IsComplete() returns TRUE it must not be called again without checking this or the row values may be lost - - Returns: An associated list of column name -> value for the row. Values will always be either strings or null -*/ -/datum/BSQL_Operation/Query/proc/CurrentRow() - return - - -/* -Code configuration options below - -Define this to avoid modifying this file but the following defines must be declared somewhere else before BSQL/includes.dm is included -*/ -#ifndef BSQL_EXTERNAL_CONFIGURATION - -//Modify this if you disagree with byond's GC schemes. Ensure this is called for all connections and operations when they are deleted or they will leak native resources until /world/proc/BSQL_Shutdown() is called -#define BSQL_DEL_PROC(path) ##path/Del() - -//The equivalent of calling del() in your codebase -#define BSQL_DEL_CALL(obj) del(##obj) - -//Returns TRUE if an object is delete -#define BSQL_IS_DELETED(obj) (obj == null) - -//Modify this to add protections to the connection and query datums -#define BSQL_PROTECT_DATUM(path) - -//Modify this to change up error handling for the library -#define BSQL_ERROR(message) CRASH("BSQL: [##message]") - -#endif - -/* -Copyright 2018 Jordan Brown - -Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -*/ diff --git a/code/__DEFINES/rust_g.dm b/code/__DEFINES/rust_g.dm index aeacdb7c51b..ddb23488a29 100644 --- a/code/__DEFINES/rust_g.dm +++ b/code/__DEFINES/rust_g.dm @@ -1,12 +1,51 @@ // rust_g.dm - DM API for rust_g extension library -#define RUST_G "rust_g" +// +// To configure, create a `rust_g.config.dm` and set what you care about from +// the following options: +// +// #define RUST_G "path/to/rust_g" +// Override the .dll/.so detection logic with a fixed path or with detection +// logic of your own. +// +// #define RUSTG_OVERRIDE_BUILTINS +// Enable replacement rust-g functions for certain builtins. Off by default. + +#ifndef RUST_G +// Default automatic RUST_G detection. +// On Windows, looks in the standard places for `rust_g.dll`. +// On Linux, looks in `.`, `$LD_LIBRARY_PATH`, and `~/.byond/bin` for either of +// `librust_g.so` (preferred) or `rust_g` (old). + +/* This comment bypasses grep checks */ /var/__rust_g + +/proc/__detect_rust_g() + if (world.system_type == UNIX) + if (fexists("./librust_g.so")) + // No need for LD_LIBRARY_PATH badness. + return __rust_g = "./librust_g.so" + else if (fexists("./rust_g")) + // Old dumb filename. + return __rust_g = "./rust_g" + else if (fexists("[world.GetConfig("env", "HOME")]/.byond/bin/rust_g")) + // Old dumb filename in `~/.byond/bin`. + return __rust_g = "rust_g" + else + // It's not in the current directory, so try others + return __rust_g = "librust_g.so" + else + return __rust_g = "rust_g" + +#define RUST_G (__rust_g || __detect_rust_g()) +#endif #define RUSTG_JOB_NO_RESULTS_YET "NO RESULTS YET" #define RUSTG_JOB_NO_SUCH_JOB "NO SUCH JOB" #define RUSTG_JOB_ERROR "JOB PANICKED" #define rustg_dmi_strip_metadata(fname) call(RUST_G, "dmi_strip_metadata")(fname) -#define rustg_dmi_create_png(fname,width,height,data) call(RUST_G, "dmi_create_png")(fname,width,height,data) +#define rustg_dmi_create_png(path, width, height, data) call(RUST_G, "dmi_create_png")(path, width, height, data) + +#define rustg_noise_get_at_coordinates(seed, x, y) call(RUST_G, "noise_get_at_coordinates")(seed, x, y) #define rustg_git_revparse(rev) call(RUST_G, "rg_git_revparse")(rev) #define rustg_git_commit_date(rev) call(RUST_G, "rg_git_commit_date")(rev) @@ -14,14 +53,19 @@ #define rustg_log_write(fname, text, format) call(RUST_G, "log_write")(fname, text, format) /proc/rustg_log_close_all() return call(RUST_G, "log_close_all")() -// RUST-G defines & procs for HTTP component #define RUSTG_HTTP_METHOD_GET "get" -#define RUSTG_HTTP_METHOD_POST "post" #define RUSTG_HTTP_METHOD_PUT "put" #define RUSTG_HTTP_METHOD_DELETE "delete" #define RUSTG_HTTP_METHOD_PATCH "patch" #define RUSTG_HTTP_METHOD_HEAD "head" - +#define RUSTG_HTTP_METHOD_POST "post" #define rustg_http_request_blocking(method, url, body, headers) call(RUST_G, "http_request_blocking")(method, url, body, headers) #define rustg_http_request_async(method, url, body, headers) call(RUST_G, "http_request_async")(method, url, body, headers) #define rustg_http_check_request(req_id) call(RUST_G, "http_check_request")(req_id) + +#define rustg_sql_connect_pool(options) call(RUST_G, "sql_connect_pool")(options) +#define rustg_sql_query_async(handle, query, params) call(RUST_G, "sql_query_async")(handle, query, params) +#define rustg_sql_query_blocking(handle, query, params) call(RUST_G, "sql_query_blocking")(handle, query, params) +#define rustg_sql_connected(handle) call(RUST_G, "sql_connected")(handle) +#define rustg_sql_disconnect_pool(handle) call(RUST_G, "sql_disconnect_pool")(handle) +#define rustg_sql_check_query(job_id) call(RUST_G, "sql_check_query")("[job_id]") diff --git a/code/__HELPERS/roundend.dm b/code/__HELPERS/roundend.dm index c81f9490f7a..753e9e7db37 100644 --- a/code/__HELPERS/roundend.dm +++ b/code/__HELPERS/roundend.dm @@ -616,9 +616,7 @@ var/list/sql_admins = list() for(var/i in GLOB.protected_admins) var/datum/admins/A = GLOB.protected_admins[i] - var/sql_ckey = sanitizeSQL(A.target) - var/sql_rank = sanitizeSQL(A.rank.name) - sql_admins += list(list("ckey" = "'[sql_ckey]'", "rank" = "'[sql_rank]'")) + sql_admins += list(list("ckey" = A.target, "rank" = A.rank.name)) SSdbcore.MassInsert(format_table_name("admin"), sql_admins, duplicate_key = TRUE) var/datum/DBQuery/query_admin_rank_update = SSdbcore.NewQuery("UPDATE [format_table_name("player")] p INNER JOIN [format_table_name("admin")] a ON p.ckey = a.ckey SET p.lastadminrank = a.rank") query_admin_rank_update.Execute() @@ -653,15 +651,20 @@ flags += "can_edit_flags" if(!flags.len) continue - var/sql_rank = sanitizeSQL(R.name) var/flags_to_check = flags.Join(" != [R_EVERYTHING] AND ") + " != [R_EVERYTHING]" - var/datum/DBQuery/query_check_everything_ranks = SSdbcore.NewQuery("SELECT flags, exclude_flags, can_edit_flags FROM [format_table_name("admin_ranks")] WHERE rank = '[sql_rank]' AND ([flags_to_check])") + var/datum/DBQuery/query_check_everything_ranks = SSdbcore.NewQuery( + "SELECT flags, exclude_flags, can_edit_flags FROM [format_table_name("admin_ranks")] WHERE rank = :rank AND ([flags_to_check])", + list("rank" = R.name) + ) if(!query_check_everything_ranks.Execute()) qdel(query_check_everything_ranks) return if(query_check_everything_ranks.NextRow()) //no row is returned if the rank already has the correct flag value var/flags_to_update = flags.Join(" = [R_EVERYTHING], ") + " = [R_EVERYTHING]" - var/datum/DBQuery/query_update_everything_ranks = SSdbcore.NewQuery("UPDATE [format_table_name("admin_ranks")] SET [flags_to_update] WHERE rank = '[sql_rank]'") + var/datum/DBQuery/query_update_everything_ranks = SSdbcore.NewQuery( + "UPDATE [format_table_name("admin_ranks")] SET [flags_to_update] WHERE rank = :rank", + list("rank" = R.name) + ) if(!query_update_everything_ranks.Execute()) qdel(query_update_everything_ranks) return diff --git a/code/__HELPERS/text.dm b/code/__HELPERS/text.dm index 6cb507fa722..dd93212c6a8 100644 --- a/code/__HELPERS/text.dm +++ b/code/__HELPERS/text.dm @@ -13,10 +13,6 @@ * SQL sanitization */ -// Run all strings to be used in an SQL query through this proc first to properly escape out injection attempts. -/proc/sanitizeSQL(t) - return SSdbcore.Quote("[t]") - /proc/format_table_name(table as text) return CONFIG_GET(string/feedback_tableprefix) + table diff --git a/code/controllers/subsystem/blackbox.dm b/code/controllers/subsystem/blackbox.dm index c97ffa7021b..f54ea73d91c 100644 --- a/code/controllers/subsystem/blackbox.dm +++ b/code/controllers/subsystem/blackbox.dm @@ -43,7 +43,17 @@ SUBSYSTEM_DEF(blackbox) return var/playercount = LAZYLEN(GLOB.player_list) var/admincount = GLOB.admins.len - var/datum/DBQuery/query_record_playercount = SSdbcore.NewQuery("INSERT INTO [format_table_name("legacy_population")] (playercount, admincount, time, server_ip, server_port, round_id) VALUES ([playercount], [admincount], '[SQLtime()]', INET_ATON(IF('[world.internet_address]' LIKE '', '0', '[world.internet_address]')), '[world.port]', '[GLOB.round_id]')") + var/datum/DBQuery/query_record_playercount = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("legacy_population")] (playercount, admincount, time, server_ip, server_port, round_id) + VALUES (:playercount, :admincount, :time, INET_ATON(:server_ip), :server_port, :round_id) + "}, list( + "playercount" = playercount, + "admincount" = admincount, + "time" = SQLtime(), + "server_ip" = world.internet_address || "0", + "server_port" = "[world.port]", + "round_id" = GLOB.round_id, + )) query_record_playercount.Execute() qdel(query_record_playercount) @@ -87,18 +97,23 @@ SUBSYSTEM_DEF(blackbox) if (!SSdbcore.Connect()) return + var/list/special_columns = list( + "datetime" = "NOW()" + ) var/list/sqlrowlist = list() - for (var/datum/feedback_variable/FV in feedback) - var/sqlversion = 1 - if(FV.key in versions) - sqlversion = versions[FV.key] - sqlrowlist += list(list("datetime" = "Now()", "round_id" = GLOB.round_id, "key_name" = "'[sanitizeSQL(FV.key)]'", "key_type" = "'[FV.key_type]'", "version" = "[sqlversion]", "json" = "'[sanitizeSQL(json_encode(FV.json))]'")) + sqlrowlist += list(list( + "round_id" = GLOB.round_id, + "key_name" = FV.key, + "key_type" = FV.key_type, + "version" = versions[FV.key] || 1, + "json" = json_encode(FV.json) + )) if (!length(sqlrowlist)) return - SSdbcore.MassInsert(format_table_name("feedback"), sqlrowlist, ignore_errors = TRUE, delayed = TRUE) + SSdbcore.MassInsert(format_table_name("feedback"), sqlrowlist, ignore_errors = TRUE, delayed = TRUE, special_columns = special_columns) /datum/controller/subsystem/blackbox/proc/Seal() if(sealed) @@ -271,20 +286,13 @@ Versioning key_type = new_key_type /datum/controller/subsystem/blackbox/proc/LogAhelp(ticket, action, message, recipient, sender) - if(!SSdbcore.Connect()) return - ticket = sanitizeSQL(ticket) - action = sanitizeSQL(action) - message = sanitizeSQL(message) - recipient = recipient ? "'[sanitizeSQL(recipient)]'" : "NULL" - sender = sender ? "'[sanitizeSQL(sender)]'" : "NULL" - var/server_ip = sanitizeSQL(world.internet_address) - var/server_port = sanitizeSQL(world.port) - var/round_id = sanitizeSQL(GLOB.round_id) - - var/datum/DBQuery/query_log_ahelp = SSdbcore.NewQuery("INSERT INTO [format_table_name("ticket")] (ticket, action, message, recipient, sender, server_ip, server_port, round_id, timestamp) VALUES ('[ticket]', '[action]', '[message]', [recipient], [sender], INET_ATON(IF('[server_ip]' LIKE '', '0', '[server_ip]')), '[server_port]','[round_id]', '[SQLtime()]')") + var/datum/DBQuery/query_log_ahelp = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("ticket")] (ticket, action, message, recipient, sender, server_ip, server_port, round_id, timestamp) + VALUES (:ticket, :action, :message, :recipient, :sender, INET_ATON(:server_ip), :server_port, :round_id, :time) + "}, list("ticket" = ticket, "action" = action, "message" = message, "recipient" = recipient, "sender" = sender, "server_ip" = world.internet_address || "0", "server_port" = world.port, "round_id" = GLOB.round_id, "time" = SQLtime())) query_log_ahelp.Execute() qdel(query_log_ahelp) @@ -303,51 +311,39 @@ Versioning first_death["area"] = "[AREACOORD(L)]" first_death["damage"] = "[L.getBruteLoss()]/[L.getFireLoss()]/[L.getToxLoss()]/[L.getOxyLoss()]/[L.getCloneLoss()]" first_death["last_words"] = L.last_words - var/sqlname = L.real_name - var/sqlkey = L.ckey - var/sqljob = L.mind.assigned_role - var/sqlspecial = L.mind.special_role - var/sqlpod = get_area_name(L, TRUE) - var/laname = L.lastattacker - var/lakey = L.lastattackerckey - var/sqlbrute = L.getBruteLoss() - var/sqlfire = L.getFireLoss() - var/sqlbrain = L.getOrganLoss(ORGAN_SLOT_BRAIN) || BRAIN_DAMAGE_DEATH //getOrganLoss returns null without a brain but a value is required for this column - var/sqloxy = L.getOxyLoss() - var/sqltox = L.getToxLoss() - var/sqlclone = L.getCloneLoss() - var/sqlstamina = L.getStaminaLoss() - var/x_coord = L.x - var/y_coord = L.y - var/z_coord = L.z - var/last_words = L.last_words - var/suicide = L.suiciding - var/map = SSmapping.config.map_name if(!SSdbcore.Connect()) return - sqlname = sanitizeSQL(sqlname) - sqlkey = sanitizeSQL(sqlkey) - sqljob = sanitizeSQL(sqljob) - sqlspecial = sanitizeSQL(sqlspecial) - sqlpod = sanitizeSQL(sqlpod) - laname = sanitizeSQL(laname) - lakey = sanitizeSQL(lakey) - sqlbrute = sanitizeSQL(sqlbrute) - sqlfire = sanitizeSQL(sqlfire) - sqlbrain = sanitizeSQL(sqlbrain) - sqloxy = sanitizeSQL(sqloxy) - sqltox = sanitizeSQL(sqltox) - sqlclone = sanitizeSQL(sqlclone) - sqlstamina = sanitizeSQL(sqlstamina) - x_coord = sanitizeSQL(x_coord) - y_coord = sanitizeSQL(y_coord) - z_coord = sanitizeSQL(z_coord) - last_words = sanitizeSQL(last_words) - suicide = sanitizeSQL(suicide) - map = sanitizeSQL(map) - var/datum/DBQuery/query_report_death = SSdbcore.NewQuery("INSERT INTO [format_table_name("death")] (pod, x_coord, y_coord, z_coord, mapname, server_ip, server_port, round_id, tod, job, special, name, byondkey, laname, lakey, bruteloss, fireloss, brainloss, oxyloss, toxloss, cloneloss, staminaloss, last_words, suicide) VALUES ('[sqlpod]', '[x_coord]', '[y_coord]', '[z_coord]', '[map]', INET_ATON(IF('[world.internet_address]' LIKE '', '0', '[world.internet_address]')), '[world.port]', [GLOB.round_id], '[SQLtime()]', '[sqljob]', '[sqlspecial]', '[sqlname]', '[sqlkey]', '[laname]', '[lakey]', [sqlbrute], [sqlfire], [sqlbrain], [sqloxy], [sqltox], [sqlclone], [sqlstamina], '[last_words]', [suicide])") + var/datum/DBQuery/query_report_death = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("death")] (pod, x_coord, y_coord, z_coord, mapname, server_ip, server_port, round_id, tod, job, special, name, byondkey, laname, lakey, bruteloss, fireloss, brainloss, oxyloss, toxloss, cloneloss, staminaloss, last_words, suicide) + VALUES (:pod, :x_coord, :y_coord, :z_coord, :map, INET_ATON(:internet_address), :port, :round_id, :time, :job, :special, :name, :key, :laname, :lakey, :brute, :fire, :brain, :oxy, :tox, :clone, :stamina, :last_words, :suicide) + "}, list( + "name" = L.real_name, + "key" = L.ckey, + "job" = L.mind.assigned_role, + "special" = L.mind.special_role, + "pod" = get_area_name(L, TRUE), + "laname" = L.lastattacker, + "lakey" = L.lastattackerckey, + "brute" = L.getBruteLoss(), + "fire" = L.getFireLoss(), + "brain" = L.getOrganLoss(ORGAN_SLOT_BRAIN) || BRAIN_DAMAGE_DEATH, //getOrganLoss returns null without a brain but a value is required for this column + "oxy" = L.getOxyLoss(), + "tox" = L.getToxLoss(), + "clone" = L.getCloneLoss(), + "stamina" = L.getStaminaLoss(), + "x_coord" = L.x, + "y_coord" = L.y, + "z_coord" = L.z, + "last_words" = L.last_words, + "sucide" = L.suiciding, + "map" = SSmapping.config.map_name, + "internet_address" = world.internet_address || "0", + "port" = "[world.port]", + "round_id" = GLOB.round_id, + "time" = SQLtime(), + )) if(query_report_death) query_report_death.Execute(async = TRUE) qdel(query_report_death) diff --git a/code/controllers/subsystem/dbcore.dm b/code/controllers/subsystem/dbcore.dm index 462ba609448..b1ef00c7266 100644 --- a/code/controllers/subsystem/dbcore.dm +++ b/code/controllers/subsystem/dbcore.dm @@ -14,8 +14,7 @@ SUBSYSTEM_DEF(dbcore) var/last_error var/list/active_queries = list() - var/datum/BSQL_Connection/connection - var/datum/BSQL_Operation/connectOperation + var/connection // Arbitrary handle returned from rust_g. /datum/controller/subsystem/dbcore/Initialize() //We send warnings to the admins during subsystem init, as the clients will be New'd and messages @@ -40,24 +39,25 @@ SUBSYSTEM_DEF(dbcore) /datum/controller/subsystem/dbcore/Recover() connection = SSdbcore.connection - connectOperation = SSdbcore.connectOperation /datum/controller/subsystem/dbcore/Shutdown() //This is as close as we can get to the true round end before Disconnect() without changing where it's called, defeating the reason this is a subsystem if(SSdbcore.Connect()) - var/datum/DBQuery/query_round_shutdown = SSdbcore.NewQuery("UPDATE [format_table_name("round")] SET shutdown_datetime = Now(), end_state = '[sanitizeSQL(SSticker.end_state)]' WHERE id = [GLOB.round_id]") + var/datum/DBQuery/query_round_shutdown = SSdbcore.NewQuery( + "UPDATE [format_table_name("round")] SET shutdown_datetime = Now(), end_state = :end_state WHERE id = :round_id", + list("end_state" = SSticker.end_state, "round_id" = GLOB.round_id) + ) query_round_shutdown.Execute() qdel(query_round_shutdown) if(IsConnected()) Disconnect() - world.BSQL_Shutdown() //nu /datum/controller/subsystem/dbcore/can_vv_get(var_name) - return var_name != NAMEOF(src, connection) && var_name != NAMEOF(src, active_queries) && var_name != NAMEOF(src, connectOperation) && ..() + return var_name != NAMEOF(src, connection) && var_name != NAMEOF(src, active_queries) && ..() /datum/controller/subsystem/dbcore/vv_edit_var(var_name, var_value) - if(var_name == NAMEOF(src, connection) || var_name == NAMEOF(src, connectOperation)) + if(var_name == NAMEOF(src, connection)) return FALSE return ..() @@ -80,26 +80,28 @@ SUBSYSTEM_DEF(dbcore) var/db = CONFIG_GET(string/feedback_database) var/address = CONFIG_GET(string/address) var/port = CONFIG_GET(number/port) + var/timeout = max(CONFIG_GET(number/async_query_timeout), CONFIG_GET(number/blocking_query_timeout)) + var/thread_limit = CONFIG_GET(number/bsql_thread_limit) - connection = new /datum/BSQL_Connection(BSQL_CONNECTION_TYPE_MARIADB, CONFIG_GET(number/async_query_timeout), CONFIG_GET(number/blocking_query_timeout), CONFIG_GET(number/bsql_thread_limit)) - var/error - if(QDELETED(connection)) - connection = null - error = last_error + var/result = json_decode(rustg_sql_connect_pool(json_encode(list( + "host" = address, + "port" = port, + "user" = user, + "pass" = pass, + "db_name" = db, + "max_threads" = 5, + "read_timeout" = timeout, + "write_timeout" = timeout, + "max_threads" = thread_limit, + )))) + . = (result["status"] == "ok") + if (.) + connection = result["handle"] else - SSdbcore.last_error = null - connectOperation = connection.BeginConnect(address, port, user, pass, db) - if(SSdbcore.last_error) - CRASH(SSdbcore.last_error) - UNTIL(connectOperation.IsComplete()) - error = connectOperation.GetError() - . = !error - if (!.) - last_error = error - log_sql("Connect() failed | [error]") + connection = null + last_error = result["data"] + log_sql("Connect() failed | [last_error]") ++failed_connections - QDEL_NULL(connection) - QDEL_NULL(connectOperation) /datum/controller/subsystem/dbcore/proc/CheckSchemaVersion() if(CONFIG_GET(flag/sql_enabled)) @@ -125,47 +127,46 @@ SUBSYSTEM_DEF(dbcore) /datum/controller/subsystem/dbcore/proc/SetRoundID() if(!Connect()) return - var/datum/DBQuery/query_round_initialize = SSdbcore.NewQuery("INSERT INTO [format_table_name("round")] (initialize_datetime, server_ip, server_port) VALUES (Now(), INET_ATON(IF('[world.internet_address]' LIKE '', '0', '[world.internet_address]')), '[world.port]')") + var/datum/DBQuery/query_round_initialize = SSdbcore.NewQuery( + "INSERT INTO [format_table_name("round")] (initialize_datetime, server_ip, server_port) VALUES (Now(), INET_ATON(:internet_address), :port)", + list("internet_address" = world.internet_address || "0", "port" = "[world.port]") + ) query_round_initialize.Execute(async = FALSE) + GLOB.round_id = "[query_round_initialize.last_insert_id]" qdel(query_round_initialize) - var/datum/DBQuery/query_round_last_id = SSdbcore.NewQuery("SELECT LAST_INSERT_ID()") - query_round_last_id.Execute(async = FALSE) - if(query_round_last_id.NextRow(async = FALSE)) - GLOB.round_id = query_round_last_id.item[1] - qdel(query_round_last_id) /datum/controller/subsystem/dbcore/proc/SetRoundStart() if(!Connect()) return - var/datum/DBQuery/query_round_start = SSdbcore.NewQuery("UPDATE [format_table_name("round")] SET start_datetime = Now() WHERE id = [GLOB.round_id]") + var/datum/DBQuery/query_round_start = SSdbcore.NewQuery( + "UPDATE [format_table_name("round")] SET start_datetime = Now() WHERE id = :round_id", + list("round_id" = GLOB.round_id) + ) query_round_start.Execute() qdel(query_round_start) /datum/controller/subsystem/dbcore/proc/SetRoundEnd() if(!Connect()) return - var/sql_station_name = sanitizeSQL(station_name()) - var/datum/DBQuery/query_round_end = SSdbcore.NewQuery("UPDATE [format_table_name("round")] SET end_datetime = Now(), game_mode_result = '[sanitizeSQL(SSticker.mode_result)]', station_name = '[sql_station_name]' WHERE id = [GLOB.round_id]") + var/datum/DBQuery/query_round_end = SSdbcore.NewQuery( + "UPDATE [format_table_name("round")] SET end_datetime = Now(), game_mode_result = :game_mode_result, station_name = :station_name WHERE id = :round_id", + list("game_mode_result" = SSticker.mode_result, "station_name" = station_name(), "round_id" = GLOB.round_id) + ) query_round_end.Execute() qdel(query_round_end) /datum/controller/subsystem/dbcore/proc/Disconnect() failed_connections = 0 - QDEL_NULL(connectOperation) - QDEL_NULL(connection) + if (connection) + rustg_sql_disconnect_pool(connection) + connection = null /datum/controller/subsystem/dbcore/proc/IsConnected() - if(!CONFIG_GET(flag/sql_enabled)) + if (!CONFIG_GET(flag/sql_enabled)) return FALSE - //block until any connect operations finish - var/datum/BSQL_Connection/_connection = connection - var/datum/BSQL_Operation/op = connectOperation - UNTIL(QDELETED(_connection) || op.IsComplete()) - return !QDELETED(connection) && !op.GetError() - -/datum/controller/subsystem/dbcore/proc/Quote(str) - if(connection) - return connection.Quote(str) + if (!connection) + return FALSE + return json_decode(rustg_sql_connected(connection))["status"] == "online" /datum/controller/subsystem/dbcore/proc/ErrorMsg() if(!CONFIG_GET(flag/sql_enabled)) @@ -175,12 +176,12 @@ SUBSYSTEM_DEF(dbcore) /datum/controller/subsystem/dbcore/proc/ReportError(error) last_error = error -/datum/controller/subsystem/dbcore/proc/NewQuery(sql_query) +/datum/controller/subsystem/dbcore/proc/NewQuery(sql_query, arguments) if(IsAdminAdvancedProcCall()) log_admin_private("ERROR: Advanced admin proc call led to sql query: [sql_query]. Query has been blocked") message_admins("ERROR: Advanced admin proc call led to sql query. Query has been blocked") return FALSE - return new /datum/DBQuery(sql_query, connection) + return new /datum/DBQuery(connection, sql_query, arguments) /datum/controller/subsystem/dbcore/proc/QuerySelect(list/querys, warn = FALSE, qdel = FALSE) if (!islist(querys)) @@ -215,55 +216,60 @@ Delayed insert mode was removed in mysql 7 and only works with MyISAM type table It was included because it is still supported in mariadb. It does not work with duplicate_key and the mysql server ignores it in those cases */ -/datum/controller/subsystem/dbcore/proc/MassInsert(table, list/rows, duplicate_key = FALSE, ignore_errors = FALSE, delayed = FALSE, warn = FALSE, async = TRUE) +/datum/controller/subsystem/dbcore/proc/MassInsert(table, list/rows, duplicate_key = FALSE, ignore_errors = FALSE, delayed = FALSE, warn = FALSE, async = TRUE, special_columns = null) if (!table || !rows || !istype(rows)) return + + // Prepare column list var/list/columns = list() - var/list/sorted_rows = list() - + var/list/has_question_mark = list() for (var/list/row in rows) - var/list/sorted_row = list() - sorted_row.len = columns.len for (var/column in row) - var/idx = columns[column] - if (!idx) - idx = columns.len + 1 - columns[column] = idx - sorted_row.len = columns.len + columns[column] = "?" + has_question_mark[column] = TRUE + for (var/column in special_columns) + columns[column] = special_columns[column] + has_question_mark[column] = findtext(special_columns[column], "?") - sorted_row[idx] = row[column] - sorted_rows[++sorted_rows.len] = sorted_row + // Prepare SQL query full of placeholders + var/list/query_parts = list("INSERT") + if (delayed) + query_parts += " DELAYED" + if (ignore_errors) + query_parts += " IGNORE" + query_parts += " INTO " + query_parts += table + query_parts += "\n([columns.Join(", ")])\nVALUES" + + var/list/arguments = list() + var/has_row = FALSE + for (var/list/row in rows) + if (has_row) + query_parts += "," + query_parts += "\n (" + var/has_col = FALSE + for (var/column in columns) + if (has_col) + query_parts += ", " + if (has_question_mark[column]) + var/name = "p[arguments.len]" + query_parts += replacetext(columns[column], "?", ":[name]") + arguments[name] = row[column] + else + query_parts += columns[column] + has_col = TRUE + query_parts += ")" + has_row = TRUE if (duplicate_key == TRUE) var/list/column_list = list() for (var/column in columns) column_list += "[column] = VALUES([column])" - duplicate_key = "ON DUPLICATE KEY UPDATE [column_list.Join(", ")]\n" - else if (duplicate_key == FALSE) - duplicate_key = null + query_parts += "\nON DUPLICATE KEY UPDATE [column_list.Join(", ")]" + else if (duplicate_key != FALSE) + query_parts += duplicate_key - if (ignore_errors) - ignore_errors = " IGNORE" - else - ignore_errors = null - - if (delayed) - delayed = " DELAYED" - else - delayed = null - - var/list/sqlrowlist = list() - var/len = columns.len - for (var/list/row in sorted_rows) - if (length(row) != len) - row.len = len - for (var/value in row) - if (value == null) - value = "NULL" - sqlrowlist += "([row.Join(", ")])" - - sqlrowlist = " [sqlrowlist.Join(",\n ")]" - var/datum/DBQuery/Query = NewQuery("INSERT[delayed][ignore_errors] INTO [table]\n([columns.Join(", ")])\nVALUES\n[sqlrowlist]\n[duplicate_key]") + var/datum/DBQuery/Query = NewQuery(query_parts.Join(), arguments) if (warn) . = Query.warn_execute(async) else @@ -271,24 +277,33 @@ Delayed insert mode was removed in mysql 7 and only works with MyISAM type table qdel(Query) /datum/DBQuery - var/sql // The sql query being executed. - var/list/item //list of data values populated by NextRow() + // Inputs + var/connection + var/sql + var/arguments + // Status information + var/in_progress + var/last_error var/last_activity var/last_activity_time - var/last_error - var/skip_next_is_complete - var/in_progress - var/datum/BSQL_Connection/connection - var/datum/BSQL_Operation/Query/query + // Output + var/list/list/rows + var/next_row_to_take = 1 + var/affected + var/last_insert_id -/datum/DBQuery/New(sql_query, datum/BSQL_Connection/connection) + var/list/item //list of data values populated by NextRow() + +/datum/DBQuery/New(connection, sql, arguments) SSdbcore.active_queries[src] = TRUE Activity("Created") item = list() + src.connection = connection - sql = sql_query + src.sql = sql + src.arguments = arguments /datum/DBQuery/Destroy() Close() @@ -299,12 +314,6 @@ Delayed insert mode was removed in mysql 7 and only works with MyISAM type table //fuck off kevinz return FALSE -/datum/DBQuery/proc/SetQuery(new_sql) - if(in_progress) - CRASH("Attempted to set new sql while waiting on active query") - Close() - sql = new_sql - /datum/DBQuery/proc/Activity(activity) last_activity = activity last_activity_time = world.time @@ -319,30 +328,18 @@ Delayed insert mode was removed in mysql 7 and only works with MyISAM type table if(in_progress) CRASH("Attempted to start a new query while waiting on the old one") - if(QDELETED(connection)) + if(!SSdbcore.IsConnected()) last_error = "No connection!" return FALSE var/start_time - var/timed_out if(!async) start_time = REALTIMEOFDAY Close() - timed_out = run_query(async) - if(query.GetErrorCode() == 2006) //2006 is the return code for "MySQL server has gone away" time-out error, meaning the connection has been lost to the server (if it's still alive) - log_sql("Executing query encountered returned a lost database connection (2006).") - SSdbcore.Disconnect() - if(SSdbcore.Connect()) //connection was restablished, reattempt the query - log_sql("Connection restablished") - timed_out = run_query(async) - else - log_sql("Executing query failed to restablish database connection.") - skip_next_is_complete = TRUE - var/error = QDELETED(query) ? "Query object deleted!" : query.GetError() - last_error = error - . = !error + . = run_query(async) + var/timed_out = !. && findtext(last_error, "Operation timed out") if(!. && log_error) - log_sql("[error] | Query used: [sql]") + log_sql("[last_error] | Query used: [sql]") if(!async && timed_out) log_query_debug("Query execution started at [start_time]") log_query_debug("Query execution ended at [REALTIMEOFDAY]") @@ -351,52 +348,50 @@ Delayed insert mode was removed in mysql 7 and only works with MyISAM type table slow_query_check() /datum/DBQuery/proc/run_query(async) - query = connection.BeginQuery(sql) - if(!async) - . = !query.WaitForCompletion() - else + var/job_result_str + + if (async) + var/job_id = rustg_sql_query_async(connection, sql, json_encode(arguments)) in_progress = TRUE - UNTIL(query.IsComplete()) + UNTIL((job_result_str = rustg_sql_check_query(job_id)) != RUSTG_JOB_NO_RESULTS_YET) in_progress = FALSE + if (job_result_str == RUSTG_JOB_ERROR) + last_error = job_result_str + return FALSE + else + job_result_str = rustg_sql_query_blocking(connection, sql, json_encode(arguments)) + + var/result = json_decode(job_result_str) + switch (result["status"]) + if ("ok") + rows = result["rows"] + affected = result["affected"] + last_insert_id = result["last_insert_id"] + return TRUE + if ("err") + last_error = result["data"] + return FALSE + if ("offline") + last_error = "offline" + return FALSE + /datum/DBQuery/proc/slow_query_check() message_admins("HEY! A database query timed out. Did the server just hang? \[YES\]|\[NO\]") /datum/DBQuery/proc/NextRow(async = TRUE) Activity("NextRow") - UNTIL(!in_progress) - if(!skip_next_is_complete) - if(!async) - query.WaitForCompletion() - else - in_progress = TRUE - UNTIL(query.IsComplete()) - in_progress = FALSE + + if (rows && next_row_to_take <= rows.len) + item = rows[next_row_to_take] + next_row_to_take++ + return !!item else - skip_next_is_complete = FALSE - - last_error = query.GetError() - var/list/results = query.CurrentRow() - . = results != null - - item.Cut() - //populate item array - for(var/I in results) - item += results[I] + return FALSE /datum/DBQuery/proc/ErrorMsg() return last_error /datum/DBQuery/proc/Close() - item.Cut() - QDEL_NULL(query) - -/world/BSQL_Debug(message) - if(!CONFIG_GET(flag/bsql_debug)) - return - - //strip sensitive stuff - if(findtext(message, ": OpenConnection(")) - message = "OpenConnection CENSORED" - - log_sql("BSQL_DEBUG: [message]") + rows = null + item = null diff --git a/code/controllers/subsystem/discord.dm b/code/controllers/subsystem/discord.dm index 983dcdf1e5a..e77cc8bd24f 100644 --- a/code/controllers/subsystem/discord.dm +++ b/code/controllers/subsystem/discord.dm @@ -82,7 +82,10 @@ SUBSYSTEM_DEF(discord) // Returns ID from ckey /datum/controller/subsystem/discord/proc/lookup_id(lookup_ckey) - var/datum/DBQuery/query_get_discord_id = SSdbcore.NewQuery("SELECT discord_id FROM [format_table_name("player")] WHERE ckey = '[sanitizeSQL(lookup_ckey)]'") + var/datum/DBQuery/query_get_discord_id = SSdbcore.NewQuery( + "SELECT discord_id FROM [format_table_name("player")] WHERE ckey = :ckey", + list("ckey" = lookup_ckey) + ) if(!query_get_discord_id.Execute()) qdel(query_get_discord_id) return @@ -92,7 +95,10 @@ SUBSYSTEM_DEF(discord) // Returns ckey from ID /datum/controller/subsystem/discord/proc/lookup_ckey(lookup_id) - var/datum/DBQuery/query_get_discord_ckey = SSdbcore.NewQuery("SELECT ckey FROM [format_table_name("player")] WHERE discord_id = '[sanitizeSQL(lookup_id)]'") + var/datum/DBQuery/query_get_discord_ckey = SSdbcore.NewQuery( + "SELECT ckey FROM [format_table_name("player")] WHERE discord_id = :discord_id", + list("discord_id" = lookup_id) + ) if(!query_get_discord_ckey.Execute()) qdel(query_get_discord_ckey) return @@ -102,14 +108,20 @@ SUBSYSTEM_DEF(discord) // Finalises link /datum/controller/subsystem/discord/proc/link_account(ckey) - var/datum/DBQuery/link_account = SSdbcore.NewQuery("UPDATE [format_table_name("player")] SET discord_id = '[sanitizeSQL(account_link_cache[ckey])]' WHERE ckey = '[sanitizeSQL(ckey)]'") + var/datum/DBQuery/link_account = SSdbcore.NewQuery( + "UPDATE [format_table_name("player")] SET discord_id = :discord_id WHERE ckey = :ckey", + list("discord_id" = account_link_cache[ckey], "ckey" = ckey) + ) link_account.Execute() qdel(link_account) account_link_cache -= ckey // Unlink account (Admin verb used) /datum/controller/subsystem/discord/proc/unlink_account(ckey) - var/datum/DBQuery/unlink_account = SSdbcore.NewQuery("UPDATE [format_table_name("player")] SET discord_id = NULL WHERE ckey = '[sanitizeSQL(ckey)]'") + var/datum/DBQuery/unlink_account = SSdbcore.NewQuery( + "UPDATE [format_table_name("player")] SET discord_id = NULL WHERE ckey = :ckey", + list("ckey" = ckey) + ) unlink_account.Execute() qdel(unlink_account) diff --git a/code/controllers/subsystem/mapping.dm b/code/controllers/subsystem/mapping.dm index ea78f553041..3b6b03c6ef2 100644 --- a/code/controllers/subsystem/mapping.dm +++ b/code/controllers/subsystem/mapping.dm @@ -253,7 +253,9 @@ SUBSYSTEM_DEF(mapping) LoadGroup(FailedZs, "Station", config.map_path, config.map_file, config.traits, ZTRAITS_STATION) if(SSdbcore.Connect()) - var/datum/DBQuery/query_round_map_name = SSdbcore.NewQuery("UPDATE [format_table_name("round")] SET map_name = '[config.map_name]' WHERE id = [GLOB.round_id]") + var/datum/DBQuery/query_round_map_name = SSdbcore.NewQuery({" + UPDATE [format_table_name("round")] SET map_name = :map_name WHERE id = :round_id + "}, list("map_name" = config.map_name, "round_id" = GLOB.round_id)) query_round_map_name.Execute() qdel(query_round_map_name) diff --git a/code/controllers/subsystem/stickyban.dm b/code/controllers/subsystem/stickyban.dm index 801c1cc5be4..38a12ec0bae 100644 --- a/code/controllers/subsystem/stickyban.dm +++ b/code/controllers/subsystem/stickyban.dm @@ -156,7 +156,10 @@ SUBSYSTEM_DEF(stickyban) if (!ban["message"]) ban["message"] = "Evasion" - var/datum/DBQuery/query_create_stickyban = SSdbcore.NewQuery("INSERT IGNORE INTO [format_table_name("stickyban")] (ckey, reason, banning_admin) VALUES ('[sanitizeSQL(ckey)]', '[sanitizeSQL(ban["message"])]', '[sanitizeSQL(ban["admin"])]')") + var/datum/DBQuery/query_create_stickyban = SSdbcore.NewQuery( + "INSERT IGNORE INTO [format_table_name("stickyban")] (ckey, reason, banning_admin) VALUES (:ckey, :message, :admin)", + list("ckey" = ckey, "message" = ban["message"], "admin" = ban["admin"]) + ) if (!query_create_stickyban.warn_execute()) qdel(query_create_stickyban) return @@ -170,8 +173,8 @@ SUBSYSTEM_DEF(stickyban) var/list/keys = splittext(ban["keys"], ",") for (var/key in keys) var/list/sqlckey = list() - sqlckey["stickyban"] = "'[sanitizeSQL(ckey)]'" - sqlckey["matched_ckey"] = "'[sanitizeSQL(ckey(key))]'" + sqlckey["stickyban"] = ckey + sqlckey["matched_ckey"] = ckey(key) sqlckey["exempt"] = FALSE sqlckeys[++sqlckeys.len] = sqlckey @@ -179,8 +182,8 @@ SUBSYSTEM_DEF(stickyban) var/list/keys = splittext(ban["whitelist"], ",") for (var/key in keys) var/list/sqlckey = list() - sqlckey["stickyban"] = "'[sanitizeSQL(ckey)]'" - sqlckey["matched_ckey"] = "'[sanitizeSQL(ckey(key))]'" + sqlckey["stickyban"] = ckey + sqlckey["matched_ckey"] = ckey(key) sqlckey["exempt"] = TRUE sqlckeys[++sqlckeys.len] = sqlckey @@ -188,26 +191,26 @@ SUBSYSTEM_DEF(stickyban) var/list/cids = splittext(ban["computer_id"], ",") for (var/cid in cids) var/list/sqlcid = list() - sqlcid["stickyban"] = "'[sanitizeSQL(ckey)]'" - sqlcid["matched_cid"] = "'[sanitizeSQL(cid)]'" + sqlcid["stickyban"] = ckey + sqlcid["matched_cid"] = cid sqlcids[++sqlcids.len] = sqlcid if (ban["IP"]) var/list/ips = splittext(ban["IP"], ",") for (var/ip in ips) var/list/sqlip = list() - sqlip["stickyban"] = "'[sanitizeSQL(ckey)]'" - sqlip["matched_ip"] = "'[sanitizeSQL(ip)]'" + sqlip["stickyban"] = ckey + sqlip["matched_ip"] = ip sqlips[++sqlips.len] = sqlip if (length(sqlckeys)) - SSdbcore.MassInsert(format_table_name("stickyban_matched_ckey"), sqlckeys, FALSE, TRUE) + SSdbcore.MassInsert(format_table_name("stickyban_matched_ckey"), sqlckeys, ignore_errors = TRUE) if (length(sqlcids)) - SSdbcore.MassInsert(format_table_name("stickyban_matched_cid"), sqlcids, FALSE, TRUE) + SSdbcore.MassInsert(format_table_name("stickyban_matched_cid"), sqlcids, ignore_errors = TRUE) if (length(sqlips)) - SSdbcore.MassInsert(format_table_name("stickyban_matched_ip"), sqlips, FALSE, TRUE) + SSdbcore.MassInsert(format_table_name("stickyban_matched_ip"), sqlips, ignore_errors = TRUE) return TRUE diff --git a/code/datums/achievements/_achievement_data.dm b/code/datums/achievements/_achievement_data.dm index 52b07472982..641c6559b7d 100644 --- a/code/datums/achievements/_achievement_data.dm +++ b/code/datums/achievements/_achievement_data.dm @@ -32,7 +32,10 @@ set waitfor = FALSE var/list/kv = list() - var/datum/DBQuery/Query = SSdbcore.NewQuery("SELECT achievement_key,value FROM [format_table_name("achievements")] WHERE ckey = '[sanitizeSQL(owner_ckey)]'") + var/datum/DBQuery/Query = SSdbcore.NewQuery( + "SELECT achievement_key,value FROM [format_table_name("achievements")] WHERE ckey = :ckey", + list("ckey" = owner_ckey) + ) if(!Query.Execute()) qdel(Query) return diff --git a/code/datums/achievements/_awards.dm b/code/datums/achievements/_awards.dm index 20b823c0afe..5726efd58e5 100644 --- a/code/datums/achievements/_awards.dm +++ b/code/datums/achievements/_awards.dm @@ -27,14 +27,27 @@ /datum/award/proc/get_changed_rows(key, value) if(!database_id || !key || !name) return - return list("ckey" = "'[sanitizeSQL(key)]'","achievement_key" = "'[sanitizeSQL(database_id)]'", "value" = "'[sanitizeSQL(value)]'") + return list( + "ckey" = key, + "achievement_key" = database_id, + "value" = value, + ) /datum/award/proc/get_metadata_row() - return list("achievement_key" = "'[sanitizeSQL(database_id)]'", "achievement_version" = "'[sanitizeSQL(achievement_version)]'", "achievement_type" = "'award'", "achievement_name" = "'[sanitizeSQL(name)]'", "achievement_description" = "'[sanitizeSQL(desc)]'") + return list( + "achievement_key" = database_id, + "achievement_version" = achievement_version, + "achievement_type" = "award", + "achievement_name" = name, + "achievement_description" = desc, + ) ///Get raw numerical achievement value from the database /datum/award/proc/get_raw_value(key) - var/datum/DBQuery/Q = SSdbcore.NewQuery("SELECT value FROM [format_table_name("achievements")] WHERE ckey = '[sanitizeSQL(key)]' AND achievement_key = '[sanitizeSQL(database_id)]'") + var/datum/DBQuery/Q = SSdbcore.NewQuery( + "SELECT value FROM [format_table_name("achievements")] WHERE ckey = :ckey AND achievement_key = :achievement_key", + list("ckey" = key, "achievement_key" = database_id) + ) if(!Q.Execute(async = TRUE)) qdel(Q) return 0 @@ -58,7 +71,7 @@ /datum/award/achievement/get_metadata_row() . = ..() - .["achievement_type"] = "'achievement'" + .["achievement_type"] = "achievement" /datum/award/achievement/parse_value(raw_value) return raw_value > 0 @@ -83,10 +96,13 @@ /datum/award/score/get_metadata_row() . = ..() - .["achievement_type"] = "'score'" + .["achievement_type"] = "score" /datum/award/score/proc/LoadHighScores() - var/datum/DBQuery/Q = SSdbcore.NewQuery("SELECT ckey,value FROM [format_table_name("achievements")] WHERE achievement_key = '[sanitizeSQL(database_id)]' ORDER BY value DESC LIMIT 50") + var/datum/DBQuery/Q = SSdbcore.NewQuery( + "SELECT ckey,value FROM [format_table_name("achievements")] WHERE achievement_key = :achievement_key ORDER BY value DESC LIMIT 50", + list("achievement_key" = database_id) + ) if(!Q.Execute(async = TRUE)) qdel(Q) return diff --git a/code/game/gamemodes/game_mode.dm b/code/game/gamemodes/game_mode.dm index cc970e2c95c..ef7b7b871ac 100644 --- a/code/game/gamemodes/game_mode.dm +++ b/code/game/gamemodes/game_mode.dm @@ -99,15 +99,20 @@ addtimer(CALLBACK(GLOBAL_PROC, .proc/reopen_roundstart_suicide_roles), delay) if(SSdbcore.Connect()) - var/sql + var/list/to_set = list() + var/arguments = list() if(SSticker.mode) - sql += "game_mode = '[SSticker.mode]'" + to_set += "game_mode = :game_mode" + arguments["game_mode"] = SSticker.mode if(GLOB.revdata.originmastercommit) - if(sql) - sql += ", " - sql += "commit_hash = '[GLOB.revdata.originmastercommit]'" - if(sql) - var/datum/DBQuery/query_round_game_mode = SSdbcore.NewQuery("UPDATE [format_table_name("round")] SET [sql] WHERE id = [GLOB.round_id]") + to_set += "commit_hash = :commit_hash" + arguments["commit_hash"] = GLOB.revdata.originmastercommit + if(to_set.len) + arguments["round_id"] = GLOB.round_id + var/datum/DBQuery/query_round_game_mode = SSdbcore.NewQuery( + "UPDATE [format_table_name("round")] SET [to_set.Join(", ")] WHERE id = :round_id", + arguments + ) query_round_game_mode.Execute() qdel(query_round_game_mode) if(report) diff --git a/code/modules/admin/IsBanned.dm b/code/modules/admin/IsBanned.dm index ada9cc654a7..4e32a5a6747 100644 --- a/code/modules/admin/IsBanned.dm +++ b/code/modules/admin/IsBanned.dm @@ -13,17 +13,17 @@ return FALSE log_access("Failed Login (invalid data): [key] [address]-[computer_id]") return list("reason"="invalid login data", "desc"="Error: Could not check ban status, Please try again. Error message: Your computer provided invalid or blank information to the server on connection (byond username, IP, and Computer ID.) Provided information for reference: Username:'[key]' IP:'[address]' Computer ID:'[computer_id]'. (If you continue to get this error, please restart byond or contact byond support.)") - + if (type == "world") return ..() //shunt world topic banchecks to purely to byond's internal ban system - + var/admin = FALSE var/ckey = ckey(key) - + var/client/C = GLOB.directory[ckey] if (C && ckey == C.ckey && computer_id == C.computer_id && address == C.address) return //don't recheck connected clients. - + //IsBanned can get re-called on a user in certain situations, this prevents that leading to repeated messages to admins. var/static/list/checkedckeys = list() //magic voodo to check for a key in a list while also adding that key to the list without having to do two associated lookups @@ -195,9 +195,18 @@ if (ban["fromdb"]) if(SSdbcore.Connect()) INVOKE_ASYNC(SSdbcore, /datum/controller/subsystem/dbcore/proc.QuerySelect, list( - SSdbcore.NewQuery("INSERT INTO [format_table_name("stickyban_matched_ckey")] (matched_ckey, stickyban) VALUES ('[sanitizeSQL(ckey)]', '[sanitizeSQL(bannedckey)]') ON DUPLICATE KEY UPDATE last_matched = now()"), - SSdbcore.NewQuery("INSERT INTO [format_table_name("stickyban_matched_ip")] (matched_ip, stickyban) VALUES ( INET_ATON('[sanitizeSQL(address)]'), '[sanitizeSQL(bannedckey)]') ON DUPLICATE KEY UPDATE last_matched = now()"), - SSdbcore.NewQuery("INSERT INTO [format_table_name("stickyban_matched_cid")] (matched_cid, stickyban) VALUES ('[sanitizeSQL(computer_id)]', '[sanitizeSQL(bannedckey)]') ON DUPLICATE KEY UPDATE last_matched = now()") + SSdbcore.NewQuery( + "INSERT INTO [format_table_name("stickyban_matched_ckey")] (matched_ckey, stickyban) VALUES (:ckey, :bannedckey) ON DUPLICATE KEY UPDATE last_matched = now()", + list("ckey" = ckey, "bannedckey" = bannedckey) + ), + SSdbcore.NewQuery( + "INSERT INTO [format_table_name("stickyban_matched_ip")] (matched_ip, stickyban) VALUES (INET_ATON(:address), :bannedckey) ON DUPLICATE KEY UPDATE last_matched = now()", + list("address" = address, "bannedckey" = bannedckey) + ), + SSdbcore.NewQuery( + "INSERT INTO [format_table_name("stickyban_matched_cid")] (matched_cid, stickyban) VALUES (:computer_id, :bannedckey) ON DUPLICATE KEY UPDATE last_matched = now()", + list("computer_id" = computer_id, "bannedckey" = bannedckey) + ) ), FALSE, TRUE) diff --git a/code/modules/admin/admin_ranks.dm b/code/modules/admin/admin_ranks.dm index 142705de9e5..a8c8d495f5c 100644 --- a/code/modules/admin/admin_ranks.dm +++ b/code/modules/admin/admin_ranks.dm @@ -117,11 +117,7 @@ GLOBAL_PROTECT(protected_ranks) var/list/sql_ranks = list() for(var/datum/admin_rank/R in GLOB.protected_ranks) - var/sql_rank = sanitizeSQL(R.name) - var/sql_flags = sanitizeSQL(R.include_rights) - var/sql_exclude_flags = sanitizeSQL(R.exclude_rights) - var/sql_can_edit_flags = sanitizeSQL(R.can_edit_rights) - sql_ranks += list(list("rank" = "'[sql_rank]'", "flags" = "[sql_flags]", "exclude_flags" = "[sql_exclude_flags]", "can_edit_flags" = "[sql_can_edit_flags]")) + sql_ranks += list(list("rank" = R.name, "flags" = R.include_rights, "exclude_flags" = R.exclude_rights, "can_edit_flags" = R.can_edit_rights)) SSdbcore.MassInsert(format_table_name("admin_ranks"), sql_ranks, duplicate_key = TRUE) //load our rank - > rights associations diff --git a/code/modules/admin/ipintel.dm b/code/modules/admin/ipintel.dm index 6ce53ac7df4..7faa0edbfa2 100644 --- a/code/modules/admin/ipintel.dm +++ b/code/modules/admin/ipintel.dm @@ -39,17 +39,17 @@ SELECT date, intel, TIMESTAMPDIFF(MINUTE,date,NOW()) FROM [format_table_name("ipintel")] WHERE - ip = INET_ATON('[ip]') + ip = INET_ATON(':ip') AND (( - intel < [rating_bad] + intel < :rating_bad AND - date + INTERVAL [CONFIG_GET(number/ipintel_save_good)] HOUR > NOW() + date + INTERVAL :save_good HOUR > NOW() ) OR ( - intel >= [rating_bad] + intel >= :rating_bad AND - date + INTERVAL [CONFIG_GET(number/ipintel_save_bad)] HOUR > NOW() + date + INTERVAL :save_bad HOUR > NOW() )) - "}) + "}, list("ip" = ip, "rating_bad" = rating_bad, "save_good" = CONFIG_GET(number/ipintel_save_good), "save_bad" = CONFIG_GET(number/ipintel_save_bad))) if(!query_get_ip_intel.Execute()) qdel(query_get_ip_intel) return @@ -67,7 +67,10 @@ if (updatecache && res.intel >= 0) SSipintel.cache[ip] = res if(SSdbcore.Connect()) - var/datum/DBQuery/query_add_ip_intel = SSdbcore.NewQuery("INSERT INTO [format_table_name("ipintel")] (ip, intel) VALUES (INET_ATON('[ip]'), [res.intel]) ON DUPLICATE KEY UPDATE intel = VALUES(intel), date = NOW()") + var/datum/DBQuery/query_add_ip_intel = SSdbcore.NewQuery( + "INSERT INTO [format_table_name("ipintel")] (ip, intel) VALUES (INET_ATON(:ip), :intel) ON DUPLICATE KEY UPDATE intel = VALUES(intel), date = NOW()", + list("ip" = ip, "intel" = res.intel) + ) query_add_ip_intel.Execute() qdel(query_add_ip_intel) diff --git a/code/modules/admin/permissionedit.dm b/code/modules/admin/permissionedit.dm index f320806e75d..e14833241a0 100644 --- a/code/modules/admin/permissionedit.dm +++ b/code/modules/admin/permissionedit.dm @@ -15,21 +15,14 @@ else output += "
\[Log\]
\[Management\]" if(action == 1) - var/list/searchlist = list(" WHERE ") - if(target) - searchlist += "ckey = '[sanitizeSQL(target)]'" - if(operation) - if(target) - searchlist += " AND " - searchlist += "operation = '[sanitizeSQL(operation)]'" - var/search - if(searchlist.len > 1) - search = searchlist.Join("") var/logcount = 0 var/logssperpage = 20 var/pagecount = 0 page = text2num(page) - var/datum/DBQuery/query_count_admin_logs = SSdbcore.NewQuery("SELECT COUNT(id) FROM [format_table_name("admin_log")][search]") + var/datum/DBQuery/query_count_admin_logs = SSdbcore.NewQuery( + "SELECT COUNT(id) FROM [format_table_name("admin_log")] WHERE (:target IS NULL OR adminckey = :target) AND (:operation IS NULL OR operation = :operation)", + list("target" = target, "operation" = operation) + ) if(!query_count_admin_logs.warn_execute()) qdel(query_count_admin_logs) return @@ -43,8 +36,20 @@ logcount -= logssperpage pagecount++ output += "|" - var/limit = " LIMIT [logssperpage * page], [logssperpage]" - var/datum/DBQuery/query_search_admin_logs = SSdbcore.NewQuery("SELECT datetime, round_id, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), operation, IF(ckey IS NULL, target, byond_key), log FROM [format_table_name("admin_log")] LEFT JOIN [format_table_name("player")] ON target = ckey[search] ORDER BY datetime DESC[limit]") + var/datum/DBQuery/query_search_admin_logs = SSdbcore.NewQuery({" + SELECT + datetime, + round_id, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), + operation, + IF(ckey IS NULL, target, byond_key), + log + FROM [format_table_name("admin_log")] + LEFT JOIN [format_table_name("player")] ON target = ckey + WHERE (:target IS NULL OR ckey = :target) AND (:operation IS NULL OR operation = :operation) + ORDER BY datetime DESC + LIMIT :skip, :take + "}, list("target" = target, "operation" = operation, "skip" = logssperpage * page, "take" = logssperpage)) if(!query_search_admin_logs.warn_execute()) qdel(query_search_admin_logs) return @@ -165,7 +170,6 @@ return if(use_db == "Permanent") use_db = TRUE - admin_ckey = sanitizeSQL(admin_ckey) else use_db = FALSE if(QDELETED(usr)) @@ -212,9 +216,11 @@ to_chat(usr, "[admin_key] is already an admin.", confidential = TRUE) return FALSE if(use_db) - . = sanitizeSQL(.) //if an admin exists without a datum they won't be caught by the above - var/datum/DBQuery/query_admin_in_db = SSdbcore.NewQuery("SELECT 1 FROM [format_table_name("admin")] WHERE ckey = '[.]'") + var/datum/DBQuery/query_admin_in_db = SSdbcore.NewQuery( + "SELECT 1 FROM [format_table_name("admin")] WHERE ckey = :ckey", + list("ckey" = .) + ) if(!query_admin_in_db.warn_execute()) qdel(query_admin_in_db) return FALSE @@ -223,12 +229,18 @@ to_chat(usr, "[admin_key] already listed in admin database. Check the Management tab if they don't appear in the list of admins.", confidential = TRUE) return FALSE qdel(query_admin_in_db) - var/datum/DBQuery/query_add_admin = SSdbcore.NewQuery("INSERT INTO [format_table_name("admin")] (ckey, `rank`) VALUES ('[.]', 'NEW ADMIN')") + var/datum/DBQuery/query_add_admin = SSdbcore.NewQuery( + "INSERT INTO [format_table_name("admin")] (ckey, `rank`) VALUES (:ckey, 'NEW ADMIN')", + list("ckey" = .) + ) if(!query_add_admin.warn_execute()) qdel(query_add_admin) return FALSE qdel(query_add_admin) - var/datum/DBQuery/query_add_admin_log = SSdbcore.NewQuery("INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) VALUES ('[SQLtime()]', '[GLOB.round_id]', '[sanitizeSQL(usr.ckey)]', INET_ATON('[sanitizeSQL(usr.client.address)]'), 'add admin', '[.]', 'New admin added: [.]')") + var/datum/DBQuery/query_add_admin_log = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) + VALUES (:time, :round_id, :adminckey, INET_ATON(:adminip), 'add admin', :target, 'New admin added: ' + :target) + "}, list("time" = SQLtime(), "round_id" = "[GLOB.round_id]", "adminckey" = usr.ckey, "adminip" = usr.client.address, "target" = .)) if(!query_add_admin_log.warn_execute()) qdel(query_add_admin_log) return FALSE @@ -243,12 +255,18 @@ var/m1 = "[key_name_admin(usr)] removed [admin_key] from the admins list [use_db ? "permanently" : "temporarily"]" var/m2 = "[key_name(usr)] removed [admin_key] from the admins list [use_db ? "permanently" : "temporarily"]" if(use_db) - var/datum/DBQuery/query_add_rank = SSdbcore.NewQuery("DELETE FROM [format_table_name("admin")] WHERE ckey = '[admin_ckey]'") + var/datum/DBQuery/query_add_rank = SSdbcore.NewQuery( + "DELETE FROM [format_table_name("admin")] WHERE ckey = :ckey", + list("ckey" = admin_ckey) + ) if(!query_add_rank.warn_execute()) qdel(query_add_rank) return qdel(query_add_rank) - var/datum/DBQuery/query_add_rank_log = SSdbcore.NewQuery("INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) VALUES ('[SQLtime()]', '[GLOB.round_id]', '[sanitizeSQL(usr.ckey)]', INET_ATON('[sanitizeSQL(usr.client.address)]'), 'remove admin', '[admin_ckey]', 'Admin removed: [admin_ckey]')") + var/datum/DBQuery/query_add_rank_log = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) + VALUES (:time, :round_id, :adminckey, INET_ATON(:adminip), 'remove admin', :admin_ckey, 'Admin removed: ' + :admin_ckey) + "}, list("time" = SQLtime(), "round_id" = "[GLOB.round_id]", "adminckey" = usr.ckey, "adminip" = usr.client.address, "admin_ckey" = admin_ckey)) if(!query_add_rank_log.warn_execute()) qdel(query_add_rank_log) return @@ -302,10 +320,12 @@ var/m1 = "[key_name_admin(usr)] edited the admin rank of [admin_key] to [new_rank] [use_db ? "permanently" : "temporarily"]" var/m2 = "[key_name(usr)] edited the admin rank of [admin_key] to [new_rank] [use_db ? "permanently" : "temporarily"]" if(use_db) - new_rank = sanitizeSQL(new_rank) //if a player was tempminned before having a permanent change made to their rank they won't yet be in the db var/old_rank - var/datum/DBQuery/query_admin_in_db = SSdbcore.NewQuery("SELECT `rank` FROM [format_table_name("admin")] WHERE ckey = '[admin_ckey]'") + var/datum/DBQuery/query_admin_in_db = SSdbcore.NewQuery( + "SELECT `rank` FROM [format_table_name("admin")] WHERE ckey = :admin_ckey", + list("admin_ckey" = admin_ckey) + ) if(!query_admin_in_db.warn_execute()) qdel(query_admin_in_db) return @@ -316,29 +336,44 @@ old_rank = query_admin_in_db.item[1] qdel(query_admin_in_db) //similarly if a temp rank is created it won't be in the db if someone is permanently changed to it - var/datum/DBQuery/query_rank_in_db = SSdbcore.NewQuery("SELECT 1 FROM [format_table_name("admin_ranks")] WHERE `rank` = '[new_rank]'") + var/datum/DBQuery/query_rank_in_db = SSdbcore.NewQuery( + "SELECT 1 FROM [format_table_name("admin_ranks")] WHERE `rank` = :new_rank", + list("new_rank" = new_rank) + ) if(!query_rank_in_db.warn_execute()) qdel(query_rank_in_db) return if(!query_rank_in_db.NextRow()) QDEL_NULL(query_rank_in_db) - var/datum/DBQuery/query_add_rank = SSdbcore.NewQuery("INSERT INTO [format_table_name("admin_ranks")] (`rank`, flags, exclude_flags, can_edit_flags) VALUES ('[new_rank]', '0', '0', '0')") + var/datum/DBQuery/query_add_rank = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("admin_ranks")] (`rank`, flags, exclude_flags, can_edit_flags) + VALUES (:new_rank, '0', '0', '0') + "}, list("new_rank" = new_rank)) if(!query_add_rank.warn_execute()) qdel(query_add_rank) return qdel(query_add_rank) - var/datum/DBQuery/query_add_rank_log = SSdbcore.NewQuery("INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) VALUES ('[SQLtime()]', '[GLOB.round_id]', '[sanitizeSQL(usr.ckey)]', INET_ATON('[sanitizeSQL(usr.client.address)]'), 'add rank', '[new_rank]', 'New rank added: [new_rank]')") + var/datum/DBQuery/query_add_rank_log = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) + VALUES (:time, :round_id, :adminckey, INET_ATON(:admin_ip), 'add rank', :new_rank, 'New rank added: ' + :new_rank) + "}, list("time" = SQLtime(), "round_id" = "[GLOB.round_id]", "adminckey" = usr.ckey, "adminip" = usr.client.address, "new_rank" = new_rank)) if(!query_add_rank_log.warn_execute()) qdel(query_add_rank_log) return qdel(query_add_rank_log) qdel(query_rank_in_db) - var/datum/DBQuery/query_change_rank = SSdbcore.NewQuery("UPDATE [format_table_name("admin")] SET `rank` = '[new_rank]' WHERE ckey = '[admin_ckey]'") + var/datum/DBQuery/query_change_rank = SSdbcore.NewQuery( + "UPDATE [format_table_name("admin")] SET `rank` = :new_rank WHERE ckey = :admin_ckey", + list("new_rank" = new_rank, "admin_ckey" = admin_ckey) + ) if(!query_change_rank.warn_execute()) qdel(query_change_rank) return qdel(query_change_rank) - var/datum/DBQuery/query_change_rank_log = SSdbcore.NewQuery("INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) VALUES ('[SQLtime()]', '[GLOB.round_id]', '[sanitizeSQL(usr.ckey)]', INET_ATON('[sanitizeSQL(usr.client.address)]'), 'change admin rank', '[admin_ckey]', 'Rank of [admin_ckey] changed from [old_rank] to [new_rank]')") + var/datum/DBQuery/query_change_rank_log = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) + VALUES (:time, :round_id, :adminckey, INET_ATON(:adminip), 'change admin rank', :target, 'Rank of ' + :target + ' changed from ' + :old_rank + ' to ' + :new_rank) + "}, list("time" = SQLtime(), "round_id" = "[GLOB.round_id]", "adminckey" = usr.ckey, "adminip" = usr.client.address, "target" = admin_ckey, "old_rank" = old_rank, new_rank = "new_rank")) if(!query_change_rank_log.warn_execute()) qdel(query_change_rank_log) return @@ -366,11 +401,14 @@ var/m1 = "[key_name_admin(usr)] edited the permissions of [use_db ? " rank [D.rank.name] permanently" : "[admin_key] temporarily"]" var/m2 = "[key_name(usr)] edited the permissions of [use_db ? " rank [D.rank.name] permanently" : "[admin_key] temporarily"]" if(use_db || legacy_only) - var/rank_name = sanitizeSQL(D.rank.name) + var/rank_name = D.rank.name var/old_flags var/old_exclude_flags var/old_can_edit_flags - var/datum/DBQuery/query_get_rank_flags = SSdbcore.NewQuery("SELECT flags, exclude_flags, can_edit_flags FROM [format_table_name("admin_ranks")] WHERE `rank` = '[rank_name]'") + var/datum/DBQuery/query_get_rank_flags = SSdbcore.NewQuery( + "SELECT flags, exclude_flags, can_edit_flags FROM [format_table_name("admin_ranks")] WHERE `rank` = :rank_name", + list("rank_name" = rank_name) + ) if(!query_get_rank_flags.warn_execute()) qdel(query_get_rank_flags) return @@ -379,12 +417,19 @@ old_exclude_flags = text2num(query_get_rank_flags.item[2]) old_can_edit_flags = text2num(query_get_rank_flags.item[3]) qdel(query_get_rank_flags) - var/datum/DBQuery/query_change_rank_flags = SSdbcore.NewQuery("UPDATE [format_table_name("admin_ranks")] SET flags = '[new_flags]', exclude_flags = '[new_exclude_flags]', can_edit_flags = '[new_can_edit_flags]' WHERE `rank` = '[rank_name]'") + var/datum/DBQuery/query_change_rank_flags = SSdbcore.NewQuery( + "UPDATE [format_table_name("admin_ranks")] SET flags = :new_flags, exclude_flags = :new_exclude_flags, can_edit_flags = :new_can_edit_flags WHERE `rank` = :rank_name", + list("new_flags" = new_flags, "new_exclude_flags" = new_exclude_flags, "new_can_edit_flags" = new_can_edit_flags, "rank_name" = rank_name) + ) if(!query_change_rank_flags.warn_execute()) qdel(query_change_rank_flags) return qdel(query_change_rank_flags) - var/datum/DBQuery/query_change_rank_flags_log = SSdbcore.NewQuery("INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) VALUES ('[SQLtime()]', '[GLOB.round_id]', '[sanitizeSQL(usr.ckey)]', INET_ATON('[sanitizeSQL(usr.client.address)]'), 'change rank flags', '[rank_name]', 'Permissions of [rank_name] changed from[rights2text(old_flags," ")][rights2text(old_exclude_flags," ", "-")][rights2text(old_can_edit_flags," ", "*")] to[rights2text(new_flags," ")][rights2text(new_exclude_flags," ", "-")][rights2text(new_can_edit_flags," ", "*")]')") + var/log_message = "Permissions of [rank_name] changed from[rights2text(old_flags," ")][rights2text(old_exclude_flags," ", "-")][rights2text(old_can_edit_flags," ", "*")] to[rights2text(new_flags," ")][rights2text(new_exclude_flags," ", "-")][rights2text(new_can_edit_flags," ", "*")]" + var/datum/DBQuery/query_change_rank_flags_log = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) + VALUES (:time, :round_id, :adminckey, INET_ATON(:adminip), 'change rank flags', :rank_name, :log) + "}, list("time" = SQLtime(), "round_id" = "[GLOB.round_id]", "adminckey" = usr.ckey, "adminip" = usr.client.address, "rank_name" = rank_name, "log" = log_message)) if(!query_change_rank_flags_log.warn_execute()) qdel(query_change_rank_flags_log) return @@ -435,8 +480,10 @@ if(CONFIG_GET(flag/load_legacy_ranks_only)) to_chat(usr, "Rank deletion not permitted while database rank loading is disabled.", confidential = TRUE) return - admin_rank = sanitizeSQL(admin_rank) - var/datum/DBQuery/query_admins_with_rank = SSdbcore.NewQuery("SELECT 1 FROM [format_table_name("admin")] WHERE `rank` = '[admin_rank]'") + var/datum/DBQuery/query_admins_with_rank = SSdbcore.NewQuery( + "SELECT 1 FROM [format_table_name("admin")] WHERE `rank` = :admin_rank", + list("admin_rank" = admin_rank) + ) if(!query_admins_with_rank.warn_execute()) qdel(query_admins_with_rank) return @@ -448,12 +495,18 @@ if(alert("Are you sure you want to remove [admin_rank]?","Confirm Removal","Do it","Cancel") == "Do it") var/m1 = "[key_name_admin(usr)] removed rank [admin_rank] permanently" var/m2 = "[key_name(usr)] removed rank [admin_rank] permanently" - var/datum/DBQuery/query_add_rank = SSdbcore.NewQuery("DELETE FROM [format_table_name("admin_ranks")] WHERE `rank` = '[admin_rank]'") + var/datum/DBQuery/query_add_rank = SSdbcore.NewQuery( + "DELETE FROM [format_table_name("admin_ranks")] WHERE `rank` = :admin_rank", + list("admin_rank" = admin_rank) + ) if(!query_add_rank.warn_execute()) qdel(query_add_rank) return qdel(query_add_rank) - var/datum/DBQuery/query_add_rank_log = SSdbcore.NewQuery("INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) VALUES ('[SQLtime()]', '[GLOB.round_id]', '[sanitizeSQL(usr.ckey)]', INET_ATON('[sanitizeSQL(usr.client.address)]'), 'remove rank', '[admin_rank]', 'Rank removed: [admin_rank]')") + var/datum/DBQuery/query_add_rank_log = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("admin_log")] (datetime, round_id, adminckey, adminip, operation, target, log) + VALUES (:time, :round_id, :adminckey, INET_ATON(:adminip), 'remove rank', :admin_rank, 'Rank removed: ' + :admin_rank) + "}, list("time" = SQLtime(), "round_id" = "[GLOB.round_id]", "adminckey" = usr.ckey, "adminip" = usr.client.address, "admin_rank" = admin_rank)) if(!query_add_rank_log.warn_execute()) qdel(query_add_rank_log) return @@ -464,9 +517,11 @@ /datum/admins/proc/sync_lastadminrank(admin_ckey, admin_key, datum/admins/D) var/sqlrank = "Player" if (D) - sqlrank = sanitizeSQL(D.rank.name) - admin_ckey = sanitizeSQL(admin_ckey) - var/datum/DBQuery/query_sync_lastadminrank = SSdbcore.NewQuery("UPDATE [format_table_name("player")] SET lastadminrank = '[sqlrank]' WHERE ckey = '[admin_ckey]'") + sqlrank = D.rank.name + var/datum/DBQuery/query_sync_lastadminrank = SSdbcore.NewQuery( + "UPDATE [format_table_name("player")] SET lastadminrank = :rank WHERE ckey = :ckey", + list("rank" = sqlrank, "ckey" = admin_ckey) + ) if(!query_sync_lastadminrank.warn_execute()) qdel(query_sync_lastadminrank) return diff --git a/code/modules/admin/poll_management.dm b/code/modules/admin/poll_management.dm index f7062ad1722..16dbaf0d356 100644 --- a/code/modules/admin/poll_management.dm +++ b/code/modules/admin/poll_management.dm @@ -356,7 +356,10 @@ if(!SSdbcore.Connect()) to_chat(usr, "Failed to establish database connection.", confidential = TRUE) return - var/datum/DBQuery/query_delete_poll = SSdbcore.NewQuery("CALL set_poll_deleted('[sanitizeSQL(poll_id)]')") + var/datum/DBQuery/query_delete_poll = SSdbcore.NewQuery( + "CALL set_poll_deleted(:poll_id)", + list("poll_id" = poll_id) + ) if(!query_delete_poll.warn_execute()) qdel(query_delete_poll) return @@ -382,51 +385,46 @@ if(!SSdbcore.Connect()) to_chat(usr, "Failed to establish database connection.", confidential = TRUE) return - var/poll_id_sql = "[sanitizeSQL(poll_id)]" - var/new_poll = FALSE - if(!poll_id_sql) - poll_id_sql = "NULL" - new_poll = TRUE - var/poll_type_sql = sanitizeSQL(poll_type) - var/question_sql = sanitizeSQL(question) - var/subtitle_sql = sanitizeSQL(subtitle) - var/admin_only_sql = sanitizeSQL(admin_only) - var/options_allowed_sql = "[sanitizeSQL(options_allowed)]" + var/new_poll = !poll_id if(poll_type != POLLTYPE_MULTI) - options_allowed_sql = "NULL" - var/dont_show_sql = sanitizeSQL(dont_show) - var/allow_revoting_sql = sanitizeSQL(allow_revoting) - var/admin_ckey = sanitizeSQL(created_by) - var/admin_ip = sanitizeSQL(usr.client.address) + options_allowed = null + var/admin_ckey = created_by + var/admin_ip = usr.client.address + var/end_datetime_sql - if(interval) - end_datetime_sql = "NOW() + INTERVAL [sanitizeSQL(duration)] [sanitizeSQL(interval)]" + if (interval in list("SECOND", "MINUTE", "HOUR", "DAY", "WEEK", "MONTH", "YEAR")) + end_datetime_sql = "NOW() + INTERVAL :duration [interval]" else - end_datetime_sql = "'[sanitizeSQL(duration)]'" - var/start_datetime_sql - if(!start_datetime) - start_datetime_sql = "NOW()" - else - start_datetime_sql = "'[sanitizeSQL(start_datetime)]'" + end_datetime_sql = ":duration" + var/kn = key_name(usr) var/kna = key_name_admin(usr) - var/datum/DBQuery/query_save_poll = SSdbcore.NewQuery("INSERT INTO [format_table_name("poll_question")] (id, polltype, created_datetime, starttime, endtime, question, subtitle, adminonly, multiplechoiceoptions, createdby_ckey, createdby_ip, dontshow, allow_revoting) VALUES ([poll_id_sql], '[poll_type_sql]', NOW(), [start_datetime_sql], [end_datetime_sql], '[question_sql]', '[subtitle_sql]', '[admin_only_sql]', [options_allowed_sql], '[admin_ckey]', INET_ATON('[admin_ip]'), '[dont_show_sql]', '[allow_revoting_sql]') ON DUPLICATE KEY UPDATE starttime = [start_datetime_sql], endtime = [end_datetime_sql], question = '[question_sql]', subtitle = '[subtitle_sql]', adminonly = '[admin_only_sql]', multiplechoiceoptions = [options_allowed_sql], dontshow = '[dont_show_sql]', allow_revoting = '[allow_revoting_sql]'") + var/datum/DBQuery/query_save_poll = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("poll_question")] (id, polltype, created_datetime, starttime, endtime, question, subtitle, adminonly, multiplechoiceoptions, createdby_ckey, createdby_ip, dontshow, allow_revoting) + VALUES (:poll_id, :poll_type, NOW(), COALESCE(:start_datetime, NOW()), [end_datetime_sql], :question, :subtitle, :admin_only, :options_allowed, :admin_ckey, INET_ATON(:admin_ip), :dont_show, :allow_revoting) + ON DUPLICATE KEY UPDATE starttime = :start_datetime, endtime = [end_datetime_sql], question = :question, subtitle = :subtitle, adminonly = :admin_only, multiplechoiceoptions = :options_allowed, dontshow = :dont_show, allow_revoting = :allow_revoting + "}, list( + "poll_id" = poll_id, "poll_type" = poll_type, "start_datetime" = start_datetime, "duration" = duration, + "question" = question, "subtitle" = subtitle, "admin_only" = admin_only, "options_allowed" = options_allowed, + "admin_ckey" = admin_ckey, "admin_ip" = admin_ip, "dont_show" = dont_show, "allow_revoting" = allow_revoting + )) if(!query_save_poll.warn_execute()) qdel(query_save_poll) return + if (!poll_id) + poll_id = query_save_poll.last_insert_id qdel(query_save_poll) - if(poll_id_sql == "NULL") - poll_id_sql = "LAST_INSERT_ID()" - var/datum/DBQuery/query_get_poll_id_start_endtime = SSdbcore.NewQuery("SELECT LAST_INSERT_ID(), starttime, endtime, IF(starttime > NOW(), 1, 0) FROM [format_table_name("poll_question")] WHERE id = [poll_id_sql]") + var/datum/DBQuery/query_get_poll_id_start_endtime = SSdbcore.NewQuery( + "SELECT starttime, endtime, IF(starttime > NOW(), 1, 0) FROM [format_table_name("poll_question")] WHERE id = :poll_id", + list("poll_id" = poll_id) + ) if(!query_get_poll_id_start_endtime.warn_execute()) qdel(query_get_poll_id_start_endtime) return if(query_get_poll_id_start_endtime.NextRow()) - if(!poll_id) - poll_id = text2num(query_get_poll_id_start_endtime.item[1]) - start_datetime = query_get_poll_id_start_endtime.item[2] - end_datetime = query_get_poll_id_start_endtime.item[3] - future_poll = text2num(query_get_poll_id_start_endtime.item[4]) + start_datetime = query_get_poll_id_start_endtime.item[1] + end_datetime = query_get_poll_id_start_endtime.item[2] + future_poll = text2num(query_get_poll_id_start_endtime.item[3]) qdel(query_get_poll_id_start_endtime) if(clear_votes) clear_poll_votes() @@ -453,13 +451,6 @@ for(var/o in options) var/datum/poll_option/option = o option.save_option() - var/datum/DBQuery/query_get_option_id = SSdbcore.NewQuery("SELECT LAST_INSERT_ID()") - if(!query_get_option_id.warn_execute()) - qdel(query_get_option_id) - return - if(query_get_option_id.NextRow()) - option.option_id = text2num(query_get_option_id.item[1]) - qdel(query_get_option_id) /** * Deletes all votes or text replies for this poll, depending on its type. @@ -474,7 +465,10 @@ var/table = "poll_vote" if(poll_type == POLLTYPE_TEXT) table = "poll_textreply" - var/datum/DBQuery/query_clear_poll_votes = SSdbcore.NewQuery("UPDATE [format_table_name("[table]")] SET deleted = 1 WHERE pollid = [sanitizeSQL(poll_id)]") + var/datum/DBQuery/query_clear_poll_votes = SSdbcore.NewQuery( + "UPDATE [format_table_name(table)] SET deleted = 1 WHERE pollid = :poll_id", + list("poll_id" = poll_id) + ) if(!query_clear_poll_votes.warn_execute()) qdel(query_clear_poll_votes) return @@ -649,38 +643,28 @@ if(!SSdbcore.Connect()) to_chat(usr, "Failed to establish database connection.", confidential = TRUE) return - var/list/columns = list("text", "default_percentage_calc", "pollid", "id") - var/list/values = list("'[sanitizeSQL(text)]'", "[sanitizeSQL(default_percentage_calc)]", "[sanitizeSQL(parent_poll.poll_id)]") - if(option_id) - values += "[sanitizeSQL(option_id)]" - else - values += "NULL" + + var/list/values = list("text" = text, "default_percentage_calc" = default_percentage_calc, "pollid" = parent_poll.poll_id, "id" = option_id) if(parent_poll.poll_type == POLLTYPE_RATING) - columns.Add("minval", "maxval", "descmin", "descmid", "descmax") - values.Add("[sanitizeSQL(min_val)]", "[sanitizeSQL(max_val)]") - if(desc_min) - values += "'[sanitizeSQL(desc_min)]'" - else - values += "NULL" - if(desc_mid) - values += "'[sanitizeSQL(desc_mid)]'" - else - values += "NULL" - if(desc_max) - values += "'[sanitizeSQL(desc_max)]'" - else - values += "NULL" - var/list/update_data = list() - var/count = 0 - for(var/i in columns) - count++ - if(i == "pollid" || i == "id") //we don't want to update the pollid or option id so skip including those - continue - update_data += "[i] = [values[count]]" - var/datum/DBQuery/query_update_poll_option = SSdbcore.NewQuery("INSERT INTO [format_table_name("poll_option")] ([jointext(columns, ",")]) VALUES ([jointext(values, ",")]) ON DUPLICATE KEY UPDATE [jointext(update_data, ", ")]") + values["minval"] = min_val + values["maxval"] = max_val + values["descmin"] = desc_min + values["descmid"] = desc_mid + values["descmax"] = desc_max + + var/update_data = list() + for (var/k in values) + update_data += "[k] = VALUES([k])" + + var/datum/DBQuery/query_update_poll_option = SSdbcore.NewQuery( + "INSERT INTO [format_table_name("poll_option")] ([jointext(values, ",")]) VALUES (:[jointext(values, ",:")]) ON DUPLICATE KEY UPDATE [jointext(update_data, ", ")]", + values + ) if(!query_update_poll_option.warn_execute()) qdel(query_update_poll_option) return + if (!option_id) + option_id = query_update_poll_option.last_insert_id qdel(query_update_poll_option) /** @@ -695,7 +679,10 @@ if(!SSdbcore.Connect()) to_chat(usr, "Failed to establish database connection.", confidential = TRUE) return - var/datum/DBQuery/query_delete_poll_option = SSdbcore.NewQuery("UPDATE [format_table_name("poll_option")] AS o INNER JOIN [format_table_name("poll_vote")] AS v ON o.id = v.optionid SET o.deleted = 1, v.deleted = 1 WHERE o.id = [sanitizeSQL(option_id)]") + var/datum/DBQuery/query_delete_poll_option = SSdbcore.NewQuery( + "UPDATE [format_table_name("poll_option")] AS o INNER JOIN [format_table_name("poll_vote")] AS v ON o.id = v.optionid SET o.deleted = 1, v.deleted = 1 WHERE o.id = :option_id", + list("option_id" = option_id) + ) if(!query_delete_poll_option.warn_execute()) qdel(query_delete_poll_option) return diff --git a/code/modules/admin/sql_ban_system.dm b/code/modules/admin/sql_ban_system.dm index 2f4c825bfdd..fe0cc27798b 100644 --- a/code/modules/admin/sql_ban_system.dm +++ b/code/modules/admin/sql_ban_system.dm @@ -3,7 +3,7 @@ //checks client ban cache or DB ban table if ckey is banned from one or more roles //doesn't return any details, use only for if statements -/proc/is_banned_from(player_ckey, roles) +/proc/is_banned_from(player_ckey, list/roles) if(!player_ckey) return var/client/C = GLOB.directory[player_ckey] @@ -17,17 +17,30 @@ else if(roles in C.ban_cache) return TRUE else - player_ckey = sanitizeSQL(player_ckey) - var/admin_where - if(GLOB.admin_datums[player_ckey] || GLOB.deadmins[player_ckey]) - admin_where = " AND applies_to_admins = 1" + var/values = list( + "player_ckey" = player_ckey, + "must_apply_to_admins" = !!(GLOB.admin_datums[player_ckey] || GLOB.deadmins[player_ckey]), + ) var/sql_roles if(islist(roles)) - sql_roles = jointext(roles, "', '") + var/list/sql_roles_list = list() + for (var/i in 1 to roles.len) + values["role[i]"] = roles[i] + sql_roles_list += ":role[i]" + sql_roles = sql_roles_list.Join(", ") else - sql_roles = roles - sql_roles = sanitizeSQL(sql_roles) - var/datum/DBQuery/query_check_ban = SSdbcore.NewQuery("SELECT 1 FROM [format_table_name("ban")] WHERE ckey = '[player_ckey]' AND role IN ('[sql_roles]') AND unbanned_datetime IS NULL AND (expiration_time IS NULL OR expiration_time > NOW())[admin_where]") + values["role"] = roles + sql_roles = ":role" + var/datum/DBQuery/query_check_ban = SSdbcore.NewQuery({" + SELECT 1 + FROM [format_table_name("ban")] + WHERE + ckey = :player_ckey AND + role IN ([sql_roles]) AND + unbanned_datetime IS NULL AND + (expiration_time IS NULL OR expiration_time > NOW()) + AND (NOT :must_apply_to_admins OR applies_to_admins = 1) + "}, values) if(!query_check_ban.warn_execute()) qdel(query_check_ban) return @@ -41,19 +54,26 @@ /proc/is_banned_from_with_details(player_ckey, player_ip, player_cid, role) if(!player_ckey && !player_ip && !player_cid) return - role = sanitizeSQL(role) - var/list/where_list = list() - if(player_ckey) - player_ckey = sanitizeSQL(player_ckey) - where_list += "ckey = '[player_ckey]'" - if(player_ip) - player_ip = sanitizeSQL(player_ip) - where_list += "ip = INET_ATON('[player_ip]')" - if(player_cid) - player_cid = sanitizeSQL(player_cid) - where_list += "computerid = '[player_cid]'" - var/where = "([where_list.Join(" OR ")])" - var/datum/DBQuery/query_check_ban = SSdbcore.NewQuery("SELECT id, bantime, round_id, expiration_time, TIMESTAMPDIFF(MINUTE, bantime, expiration_time), applies_to_admins, reason, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE [format_table_name("player")].ckey = [format_table_name("ban")].ckey), ckey), INET_NTOA(ip), computerid, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE [format_table_name("player")].ckey = [format_table_name("ban")].a_ckey), a_ckey) FROM [format_table_name("ban")] WHERE role = '[role]' AND [where] AND unbanned_datetime IS NULL AND (expiration_time IS NULL OR expiration_time > NOW()) ORDER BY bantime DESC") + var/datum/DBQuery/query_check_ban = SSdbcore.NewQuery({" + SELECT + id, + bantime, + round_id, + expiration_time, + TIMESTAMPDIFF(MINUTE, bantime, expiration_time), + applies_to_admins, + reason, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE [format_table_name("player")].ckey = [format_table_name("ban")].ckey), ckey), + INET_NTOA(ip), + computerid, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE [format_table_name("player")].ckey = [format_table_name("ban")].a_ckey), a_ckey) + FROM [format_table_name("ban")] + WHERE role = :role + AND (ckey = :ckey OR ip = INET_ATON(:ip) OR computerid = :computerid) + AND unbanned_datetime IS NULL + AND (expiration_time IS NULL OR expiration_time > NOW()) + ORDER BY bantime DESC + "}, list("role" = role, "ckey" = player_ckey, "ip" = player_ip, "computerid" = player_cid)) if(!query_check_ban.warn_execute()) qdel(query_check_ban) return @@ -67,11 +87,13 @@ return if(C && istype(C)) C.ban_cache = list() - var/player_key = sanitizeSQL(C.ckey) var/is_admin = FALSE if(GLOB.admin_datums[C.ckey] || GLOB.deadmins[C.ckey]) is_admin = TRUE - var/datum/DBQuery/query_build_ban_cache = SSdbcore.NewQuery("SELECT role, applies_to_admins FROM [format_table_name("ban")] WHERE ckey = '[player_key]' AND unbanned_datetime IS NULL AND (expiration_time IS NULL OR expiration_time > NOW())") + var/datum/DBQuery/query_build_ban_cache = SSdbcore.NewQuery( + "SELECT role, applies_to_admins FROM [format_table_name("ban")] WHERE ckey = :ckey AND unbanned_datetime IS NULL AND (expiration_time IS NULL OR expiration_time > NOW())", + list("ckey" = C.ckey) + ) if(!query_build_ban_cache.warn_execute()) qdel(query_build_ban_cache) return @@ -194,8 +216,15 @@ //there's not always a client to use the bancache of so to avoid many individual queries from using is_banned_form we'll build a cache to use here var/banned_from = list() if(player_key) - var/player_ckey = sanitizeSQL(ckey(player_key)) - var/datum/DBQuery/query_get_banned_roles = SSdbcore.NewQuery("SELECT role FROM [format_table_name("ban")] WHERE ckey = '[player_ckey]' AND role <> 'server' AND unbanned_datetime IS NULL AND (expiration_time IS NULL OR expiration_time > NOW())") + var/datum/DBQuery/query_get_banned_roles = SSdbcore.NewQuery({" + SELECT role + FROM [format_table_name("ban")] + WHERE + ckey = :player_ckey AND + role <> 'server' + AND unbanned_datetime IS NULL + AND (expiration_time IS NULL OR expiration_time > NOW()) + "}, list("player_ckey" = ckey(player_key))) if(!query_get_banned_roles.warn_execute()) qdel(query_get_banned_roles) return @@ -402,11 +431,11 @@ if(!SSdbcore.Connect()) to_chat(usr, "Failed to establish database connection.", confidential = TRUE) return - var/player_ckey = sanitizeSQL(ckey(player_key)) - player_ip = sanitizeSQL(player_ip) - player_cid = sanitizeSQL(player_cid) + var/player_ckey = ckey(player_key) if(player_ckey) - var/datum/DBQuery/query_create_ban_get_player = SSdbcore.NewQuery("SELECT byond_key, INET_NTOA(ip), computerid FROM [format_table_name("player")] WHERE ckey = '[player_ckey]'") + var/datum/DBQuery/query_create_ban_get_player = SSdbcore.NewQuery({" + SELECT byond_key, INET_NTOA(ip), computerid FROM [format_table_name("player")] WHERE ckey = :player_ckey + "}, list("player_ckey" = player_ckey)) if(!query_create_ban_get_player.warn_execute()) qdel(query_create_ban_get_player) return @@ -427,9 +456,17 @@ qdel(query_create_ban_get_player) return qdel(query_create_ban_get_player) - var/admin_ckey = sanitizeSQL(usr.client.ckey) + var/admin_ckey = usr.client.ckey if(applies_to_admins) - var/datum/DBQuery/query_check_adminban_count = SSdbcore.NewQuery("SELECT COUNT(DISTINCT bantime) FROM [format_table_name("ban")] WHERE a_ckey = '[admin_ckey]' AND applies_to_admins = 1 AND unbanned_datetime IS NULL AND (expiration_time IS NULL OR expiration_time > NOW())") + var/datum/DBQuery/query_check_adminban_count = SSdbcore.NewQuery({" + SELECT COUNT(DISTINCT bantime) + FROM [format_table_name("ban")] + WHERE + a_ckey = :admin_ckey AND + applies_to_admins = 1 AND + unbanned_datetime IS NULL AND + (expiration_time IS NULL OR expiration_time > NOW()) + "}, list("admin_ckey" = admin_ckey)) if(!query_check_adminban_count.warn_execute()) //count distinct bantime to treat rolebans made at the same time as one ban qdel(query_check_adminban_count) return @@ -443,18 +480,15 @@ qdel(query_check_adminban_count) return qdel(query_check_adminban_count) - var/admin_ip = sanitizeSQL(usr.client.address) - var/admin_cid = sanitizeSQL(usr.client.computer_id) + var/admin_ip = usr.client.address + var/admin_cid = usr.client.computer_id duration = text2num(duration) - if(interval) - interval = sanitizeSQL(interval) - else + if (!(interval in list("SECOND", "MINUTE", "HOUR", "DAY", "WEEK", "MONTH", "YEAR"))) interval = "MINUTE" var/time_message = "[duration] [lowertext(interval)]" //no DisplayTimeText because our duration is of variable interval type if(duration > 1) //pluralize the interval if necessary time_message += "s" var/note_reason = "Banned from [roles_to_ban[1] == "Server" ? "the server" : " Roles: [roles_to_ban.Join(", ")]"] [isnull(duration) ? "permanently" : "for [time_message]"] - [reason]" - reason = sanitizeSQL(reason) var/list/clients_online = GLOB.clients.Copy() var/list/admins_online = list() for(var/client/C in clients_online) @@ -464,26 +498,34 @@ var/adminwho = admins_online.Join(", ") var/kn = key_name(usr) var/kna = key_name_admin(usr) - var/sql_ban + + var/special_columns = list( + "bantime" = "NOW()", + "server_ip" = "INET_ATON(?)", + "ip" = "INET_ATON(?)", + "a_ip" = "INET_ATON(?)", + "expiration_time" = "IF(? IS NULL, NULL, NOW() + INTERVAL ? [interval])" + ) + var/sql_ban = list() for(var/role in roles_to_ban) - sql_ban += list(list("bantime" = "NOW()", - "server_ip" = "INET_ATON(IF('[world.internet_address]' LIKE '', '0', '[world.internet_address]'))", - "server_port" = sanitizeSQL(world.port), - "round_id" = sanitizeSQL(GLOB.round_id), - "role" = "'[sanitizeSQL(role)]'", - "expiration_time" = "IF('[duration]' LIKE '', NULL, NOW() + INTERVAL [duration ? "[duration]" : "0"] [interval])", - "applies_to_admins" = sanitizeSQL(applies_to_admins), - "reason" = "'[reason]'", - "ckey" = "IF('[player_ckey]' LIKE '', NULL, '[player_ckey]')", - "ip" = "INET_ATON(IF('[player_ip]' LIKE '', NULL, '[player_ip]'))", - "computerid" = "IF('[player_cid]' LIKE '', NULL, '[player_cid]')", - "a_ckey" = "'[admin_ckey]'", - "a_ip" = "INET_ATON(IF('[admin_ip]' LIKE '', NULL, '[admin_ip]'))", - "a_computerid" = "'[admin_cid]'", - "who" = "'[who]'", - "adminwho" = "'[adminwho]'" + sql_ban += list(list( + "server_ip" = world.internet_address || 0, + "server_port" = world.port, + "round_id" = GLOB.round_id, + "role" = role, + "expiration_time" = duration, + "applies_to_admins" = applies_to_admins, + "reason" = reason, + "ckey" = player_ckey || null, + "ip" = player_ip || null, + "computerid" = player_cid || null, + "a_ckey" = admin_ckey, + "a_ip" = admin_ip || null, + "a_computerid" = admin_cid, + "who" = who, + "adminwho" = adminwho, )) - if(!SSdbcore.MassInsert(format_table_name("ban"), sql_ban, warn = 1)) + if(!SSdbcore.MassInsert(format_table_name("ban"), sql_ban, warn = TRUE, special_columns = special_columns)) return var/target = ban_target_string(player_key, player_ip, player_cid) var/msg = "has created a [isnull(duration) ? "permanent" : "temporary [time_message]"] [applies_to_admins ? "admin " : ""][roles_to_ban[1] == "Server" ? "server ban" : "role ban from [roles_to_ban.len] roles"] for [target]." @@ -537,20 +579,23 @@
"} if(player_key || admin_key || player_ip || player_cid) - var/list/searchlist = list() - if(player_key) - searchlist += "ckey = '[sanitizeSQL(ckey(player_key))]'" - if(admin_key) - searchlist += "a_ckey = '[sanitizeSQL(ckey(admin_key))]'" - if(player_ip) - searchlist += "ip = INET_ATON('[sanitizeSQL(player_ip)]')" - if(player_cid) - searchlist += "computerid = '[sanitizeSQL(player_cid)]'" - var/search = searchlist.Join(" AND ") var/bancount = 0 var/bansperpage = 10 page = text2num(page) - var/datum/DBQuery/query_unban_count_bans = SSdbcore.NewQuery("SELECT COUNT(id) FROM [format_table_name("ban")] WHERE [search]") + var/datum/DBQuery/query_unban_count_bans = SSdbcore.NewQuery({" + SELECT COUNT(id) + FROM [format_table_name("ban")] + WHERE + (:player_key IS NULL OR ckey = :player_key) AND + (:admin_key IS NULL OR a_ckey = :admin_key) AND + (:player_ip IS NULL OR ip = INET_ATON(:player_ip)) AND + (:player_cid IS NULL OR computerid = :player_cid) + "}, list( + "player_key" = ckey(player_key), + "admin_key" = ckey(admin_key), + "player_ip" = player_ip, + "player_cid" = player_cid, + )) if(!query_unban_count_bans.warn_execute()) qdel(query_unban_count_bans) return @@ -566,8 +611,53 @@ bancount -= bansperpage pagecount++ output += pagelist.Join(" | ") - var/limit = " LIMIT [bansperpage * page], [bansperpage]" - var/datum/DBQuery/query_unban_search_bans = SSdbcore.NewQuery({"SELECT id, bantime, round_id, role, expiration_time, TIMESTAMPDIFF(MINUTE, bantime, expiration_time), IF(expiration_time < NOW(), 1, NULL), applies_to_admins, reason, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE [format_table_name("player")].ckey = [format_table_name("ban")].ckey), ckey), INET_NTOA(ip), computerid, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE [format_table_name("player")].ckey = [format_table_name("ban")].a_ckey), a_ckey), IF(edits IS NOT NULL, 1, NULL), unbanned_datetime, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE [format_table_name("player")].ckey = [format_table_name("ban")].unbanned_ckey), unbanned_ckey), unbanned_round_id FROM [format_table_name("ban")] WHERE [search] ORDER BY id DESC[limit]"}) + var/datum/DBQuery/query_unban_search_bans = SSdbcore.NewQuery({" + SELECT + id, + bantime, + round_id, + role, + expiration_time, + TIMESTAMPDIFF(MINUTE, bantime, expiration_time), + IF(expiration_time < NOW(), 1, NULL), + applies_to_admins, + reason, + IFNULL(( + SELECT byond_key + FROM [format_table_name("player")] + WHERE [format_table_name("player")].ckey = [format_table_name("ban")].ckey + ), ckey), + INET_NTOA(ip), + computerid, + IFNULL(( + SELECT byond_key + FROM [format_table_name("player")] + WHERE [format_table_name("player")].ckey = [format_table_name("ban")].a_ckey + ), a_ckey), + IF(edits IS NOT NULL, 1, NULL), + unbanned_datetime, + IFNULL(( + SELECT byond_key + FROM [format_table_name("player")] + WHERE [format_table_name("player")].ckey = [format_table_name("ban")].unbanned_ckey + ), unbanned_ckey), + unbanned_round_id + FROM [format_table_name("ban")] + WHERE + (:player_key IS NULL OR ckey = :player_key) AND + (:admin_key IS NULL OR a_ckey = :admin_key) AND + (:player_ip IS NULL OR ip = INET_ATON(:player_ip)) AND + (:player_cid IS NULL OR computerid = :player_cid) + ORDER BY id DESC + LIMIT :skip, :take + "}, list( + "player_key" = ckey(player_key), + "admin_key" = ckey(admin_key), + "player_ip" = player_ip, + "player_cid" = player_cid, + "skip" = bansperpage * page, + "take" = bansperpage, + )) if(!query_unban_search_bans.warn_execute()) qdel(query_unban_search_bans) return @@ -620,13 +710,17 @@ var/target = ban_target_string(player_key, player_ip, player_cid) if(alert(usr, "Please confirm unban of [target] from [role].", "Unban confirmation", "Yes", "No") == "No") return - ban_id = sanitizeSQL(ban_id) - var/admin_ckey = sanitizeSQL(usr.client.ckey) - var/admin_ip = sanitizeSQL(usr.client.address) - var/admin_cid = sanitizeSQL(usr.client.computer_id) var/kn = key_name(usr) var/kna = key_name_admin(usr) - var/datum/DBQuery/query_unban = SSdbcore.NewQuery("UPDATE [format_table_name("ban")] SET unbanned_datetime = NOW(), unbanned_ckey = '[admin_ckey]', unbanned_ip = INET_ATON('[admin_ip]'), unbanned_computerid = '[admin_cid]', unbanned_round_id = '[GLOB.round_id]' WHERE id = [ban_id]") + var/datum/DBQuery/query_unban = SSdbcore.NewQuery({" + UPDATE [format_table_name("ban")] SET + unbanned_datetime = NOW(), + unbanned_ckey = :admin_ckey, + unbanned_ip = INET_ATON(:admin_ip), + unbanned_computerid = :admin_cid, + unbanned_round_id = :round_id + WHERE id = :ban_id + "}, list("ban_id" = ban_id, "admin_ckey" = usr.client.ckey, "admin_ip" = usr.client.address, "admin_cid" = usr.client.computer_id, "round_id" = GLOB.round_id)) if(!query_unban.warn_execute()) qdel(query_unban) return @@ -649,13 +743,18 @@ if(!SSdbcore.Connect()) to_chat(usr, "Failed to establish database connection.", confidential = TRUE) return - ban_id = sanitizeSQL(ban_id) - var/player_ckey = sanitizeSQL(ckey(player_key)) - player_ip = sanitizeSQL(player_ip) - player_cid = sanitizeSQL(player_cid) + var/player_ckey = ckey(player_key) var/bantime if(player_ckey) - var/datum/DBQuery/query_edit_ban_get_player = SSdbcore.NewQuery("SELECT byond_key, (SELECT bantime FROM [format_table_name("ban")] WHERE id = [ban_id]), ip, computerid FROM [format_table_name("player")] WHERE ckey = '[player_ckey]'") + var/datum/DBQuery/query_edit_ban_get_player = SSdbcore.NewQuery({" + SELECT + byond_key, + (SELECT bantime FROM [format_table_name("ban")] WHERE id = :ban_id), + ip, + computerid + FROM [format_table_name("player")] + WHERE ckey = :player_ckey + "}, list("player_ckey" = player_ckey, "ban_id" = ban_id)) if(!query_edit_ban_get_player.warn_execute()) qdel(query_edit_ban_get_player) return @@ -678,8 +777,14 @@ return qdel(query_edit_ban_get_player) if(applies_to_admins && (applies_to_admins != old_applies)) - var/admin_ckey = sanitizeSQL(usr.client.ckey) - var/datum/DBQuery/query_check_adminban_count = SSdbcore.NewQuery("SELECT COUNT(DISTINCT bantime) FROM [format_table_name("ban")] WHERE a_ckey = '[admin_ckey]' AND applies_to_admins = 1 AND unbanned_datetime IS NULL AND (expiration_time IS NULL OR expiration_time > NOW())") + var/datum/DBQuery/query_check_adminban_count = SSdbcore.NewQuery({" + SELECT COUNT(DISTINCT bantime) + FROM [format_table_name("ban")] + WHERE a_ckey = :admin_ckey + AND applies_to_admins = 1 + AND unbanned_datetime IS NULL + AND (expiration_time IS NULL OR expiration_time > NOW()) + "}, list("admin_ckey" = usr.client.ckey)) if(!query_check_adminban_count.warn_execute()) //count distinct bantime to treat rolebans made at the same time as one ban qdel(query_check_adminban_count) return @@ -693,37 +798,63 @@ qdel(query_check_adminban_count) return qdel(query_check_adminban_count) - applies_to_admins = sanitizeSQL(applies_to_admins) - duration = sanitizeSQL(duration) - if(interval) - interval = sanitizeSQL(interval) - else + + if (!(interval in list("SECOND", "MINUTE", "HOUR", "DAY", "WEEK", "MONTH", "YEAR"))) interval = "MINUTE" - reason = sanitizeSQL(reason) - var/kn = key_name(usr) - var/kna = key_name_admin(usr) - var/list/changes_text= list() + + var/list/changes_text = list() var/list/changes_keys = list() for(var/i in changes) - changes_text += "[sanitizeSQL(i)]: [sanitizeSQL(changes[i])]" + changes_text += "[i]: [changes[i]]" changes_keys += i - var/where = "id = [sanitizeSQL(ban_id)]" + var/change_message = "[usr.client.key] edited the following [jointext(changes_text, ", ")]
" + + var/list/arguments = list( + "duration" = duration || null, + "reason" = reason, + "applies_to_admins" = applies_to_admins, + "ckey" = player_ckey || null, + "ip" = player_ip || null, + "cid" = player_cid || null, + "change_message" = change_message, + ) + var/where if(text2num(mirror_edit)) var/list/wherelist = list("bantime = '[bantime]'") if(old_key) - wherelist += "ckey = '[sanitizeSQL(ckey(old_key))]'" + wherelist += "ckey = :old_ckey" + arguments["old_ckey"] = ckey(old_key) if(old_ip) - old_ip = sanitizeSQL(old_ip) - wherelist += "ip = INET_ATON(IF('[old_ip]' LIKE '', NULL, '[old_ip]'))" + wherelist += "ip = INET_ATON(:old_ip)" + arguments["old_ip"] = old_ip || null if(old_cid) - wherelist += "computerid = '[sanitizeSQL(old_cid)]'" + wherelist += "computerid = :old_cid" + arguments["old_cid"] = old_cid where = wherelist.Join(" AND ") - var/datum/DBQuery/query_edit_ban = SSdbcore.NewQuery("UPDATE [format_table_name("ban")] SET expiration_time = IF('[duration]' LIKE '', NULL, bantime + INTERVAL [duration ? "[duration]" : "0"] [interval]), applies_to_admins = [applies_to_admins], reason = '[reason]', ckey = IF('[player_ckey]' LIKE '', NULL, '[player_ckey]'), ip = INET_ATON(IF('[player_ip]' LIKE '', NULL, '[player_ip]')), computerid = IF('[player_cid]' LIKE '', NULL, '[player_cid]'), edits = CONCAT(IFNULL(edits,''),'[sanitizeSQL(usr.client.key)] edited the following [jointext(changes_text, ", ")]
') WHERE [where]") + else + where = "id = :ban_id" + arguments["ban_id"] = ban_id + + var/datum/DBQuery/query_edit_ban = SSdbcore.NewQuery({" + UPDATE [format_table_name("ban")] + SET + expiration_time = IF(:duration IS NULL, NULL, bantime + INTERVAL :duration [interval]) + applies_to_admins = :applies_to_admins, + reason = :reason, + ckey = :ckey, + ip = INET_ATON(:ip), + computerid = :ci + edits = CONCAT(IFNULL(edits,''), :change_message) + WHERE [where] + "}, arguments) if(!query_edit_ban.warn_execute()) qdel(query_edit_ban) return qdel(query_edit_ban) + var/changes_keys_text = jointext(changes_keys, ", ") + var/kn = key_name(usr) + var/kna = key_name_admin(usr) log_admin_private("[kn] has edited the [changes_keys_text] of a ban for [old_key ? "[old_key]" : "[old_ip]-[old_cid]"].") //if a ban doesn't have a key it must have an ip and/or a cid to have reached this point normally message_admins("[kna] has edited the [changes_keys_text] of a ban for [old_key ? "[old_key]" : "[old_ip]-[old_cid]"].") if(changes["Applies to admins"]) @@ -744,8 +875,9 @@ if(!SSdbcore.Connect()) to_chat(usr, "Failed to establish database connection.", confidential = TRUE) return - ban_id = sanitizeSQL(ban_id) - var/datum/DBQuery/query_get_ban_edits = SSdbcore.NewQuery("SELECT edits FROM [format_table_name("ban")] WHERE id = '[ban_id]'") + var/datum/DBQuery/query_get_ban_edits = SSdbcore.NewQuery({" + SELECT edits FROM [format_table_name("ban")] WHERE id = :ban_id + "}, list("ban_id" = ban_id)) if(!query_get_ban_edits.warn_execute()) qdel(query_get_ban_edits) return diff --git a/code/modules/admin/sql_message_system.dm b/code/modules/admin/sql_message_system.dm index f112759944a..e08f29a9c52 100644 --- a/code/modules/admin/sql_message_system.dm +++ b/code/modules/admin/sql_message_system.dm @@ -9,8 +9,11 @@ var/new_key = input(usr,"Who would you like to create a [type] for?","Enter a key or ckey",null) as null|text if(!new_key) return - var/new_ckey = sanitizeSQL(ckey(new_key)) - var/datum/DBQuery/query_find_ckey = SSdbcore.NewQuery("SELECT ckey FROM [format_table_name("player")] WHERE ckey = '[new_ckey]'") + var/new_ckey = ckey(new_key) + var/datum/DBQuery/query_find_ckey = SSdbcore.NewQuery( + "SELECT ckey FROM [format_table_name("player")] WHERE ckey = :ckey", + list("ckey" = new_ckey) + ) if(!query_find_ckey.warn_execute()) qdel(query_find_ckey) return @@ -23,29 +26,24 @@ target_key = new_key if(QDELETED(usr)) return - if(target_ckey) - target_ckey = sanitizeSQL(target_ckey) if(!target_key) target_key = target_ckey if(!admin_ckey) admin_ckey = usr.ckey if(!admin_ckey) return - admin_ckey = sanitizeSQL(admin_ckey) if(!target_ckey) target_ckey = admin_ckey if(!text) text = input(usr,"Write your [type]","Create [type]") as null|message if(!text) return - text = sanitizeSQL(text) if(!timestamp) timestamp = SQLtime() if(!server) var/ssqlname = CONFIG_GET(string/serversqlname) if (ssqlname) server = ssqlname - server = sanitizeSQL(server) if(isnull(secret)) switch(alert("Hide note from being viewed by players?", "Secret note?","Yes","No","Cancel")) if("Yes") @@ -59,8 +57,10 @@ var/expire_time = input("Set expiry time for [type] as format YYYY-MM-DD HH:MM:SS. All times in server time. HH:MM:SS is optional and 24-hour. Must be later than current time for obvious reasons.", "Set expiry time", SQLtime()) as null|text if(!expire_time) return - expire_time = sanitizeSQL(expire_time) - var/datum/DBQuery/query_validate_expire_time = SSdbcore.NewQuery("SELECT IF(STR_TO_DATE('[expire_time]','%Y-%c-%d %T') > NOW(), STR_TO_DATE('[expire_time]','%Y-%c-%d %T'), 0)") + var/datum/DBQuery/query_validate_expire_time = SSdbcore.NewQuery( + "SELECT IF(STR_TO_DATE(:expire_time,'%Y-%c-%d %T') > NOW(), STR_TO_DATE(:expire_time,'%Y-%c-%d %T'), 0)", + list("expire_time" = expire_time) + ) if(!query_validate_expire_time.warn_execute()) qdel(query_validate_expire_time) return @@ -76,8 +76,23 @@ note_severity = input("Set the severity of the note.", "Severity", null, null) as null|anything in list("High", "Medium", "Minor", "None") if(!note_severity) return - note_severity = sanitizeSQL(note_severity) - var/datum/DBQuery/query_create_message = SSdbcore.NewQuery("INSERT INTO [format_table_name("messages")] (type, targetckey, adminckey, text, timestamp, server, server_ip, server_port, round_id, secret, expire_timestamp, severity) VALUES ('[type]', '[target_ckey]', '[admin_ckey]', '[text]', '[timestamp]', '[server]', INET_ATON(IF('[world.internet_address]' LIKE '', '0', '[world.internet_address]')), '[world.port]', '[GLOB.round_id]','[secret]', [expiry ? "'[expiry]'" : "NULL"], [note_severity ? "'[note_severity]'" : "NULL"])") + var/datum/DBQuery/query_create_message = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("messages")] (type, targetckey, adminckey, text, timestamp, server, server_ip, server_port, round_id, secret, expire_timestamp, severity) + VALUES (:type, :target_ckey, :admin_ckey, :text, :timestamp, :server, INET_ATON(:internet_address), :port, :round_id, :secret, :expiry, :note_severity) + "}, list( + "type" = type, + "target_ckey" = target_ckey, + "admin_ckey" = admin_ckey, + "text" = text, + "timestamp" = timestamp, + "server" = server, + "internet_address" = world.internet_address || "0", + "port" = "[world.port]", + "round_id" = GLOB.round_id, + "secret" = secret, + "expiry" = expiry, + "note_severity" = note_severity, + )) var/pm = "[key_name(usr)] has created a [type][(type == "note" || type == "message" || type == "watchlist entry") ? " for [target_key]" : ""]: [text]" var/header = "[key_name_admin(usr)] has created a [type][(type == "note" || type == "message" || type == "watchlist entry") ? " for [target_key]" : ""]" if(!query_create_message.warn_execute()) @@ -106,8 +121,11 @@ var/text var/user_key_name = key_name(usr) var/user_name_admin = key_name_admin(usr) - var/deleted_by_ckey = sanitizeSQL(usr.ckey) - var/datum/DBQuery/query_find_del_message = SSdbcore.NewQuery("SELECT type, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), text FROM [format_table_name("messages")] WHERE id = [message_id] AND deleted = 0") + var/deleted_by_ckey = usr.ckey + var/datum/DBQuery/query_find_del_message = SSdbcore.NewQuery( + "SELECT type, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), text FROM [format_table_name("messages")] WHERE id = :id AND deleted = 0", + list("id" = message_id) + ) if(!query_find_del_message.warn_execute()) qdel(query_find_del_message) return @@ -116,7 +134,10 @@ target_key = query_find_del_message.item[2] text = query_find_del_message.item[3] qdel(query_find_del_message) - var/datum/DBQuery/query_del_message = SSdbcore.NewQuery("UPDATE [format_table_name("messages")] SET deleted = 1, deleted_ckey = '[deleted_by_ckey]' WHERE id = [message_id]") + var/datum/DBQuery/query_del_message = SSdbcore.NewQuery( + "UPDATE [format_table_name("messages")] SET deleted = 1, deleted_ckey = :deleted_ckey WHERE id = :id", + list("deleted_ckey" = deleted_by_ckey, "id" = message_id) + ) if(!query_del_message.warn_execute()) qdel(query_del_message) return @@ -138,11 +159,19 @@ message_id = text2num(message_id) if(!message_id) return - var/editor_ckey = sanitizeSQL(usr.ckey) - var/editor_key = sanitizeSQL(usr.key) + var/editor_ckey = usr.ckey + var/editor_key = usr.key var/kn = key_name(usr) var/kna = key_name_admin(usr) - var/datum/DBQuery/query_find_edit_message = SSdbcore.NewQuery("SELECT type, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), targetckey), text FROM [format_table_name("messages")] WHERE id = [message_id] AND deleted = 0") + var/datum/DBQuery/query_find_edit_message = SSdbcore.NewQuery({" + SELECT + type, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), targetckey), + text + FROM [format_table_name("messages")] + WHERE id = :id AND deleted = 0 + "}, list("id" = message_id)) if(!query_find_edit_message.warn_execute()) qdel(query_find_edit_message) return @@ -155,9 +184,12 @@ if(!new_text) qdel(query_find_edit_message) return - new_text = sanitizeSQL(new_text) - var/edit_text = sanitizeSQL("Edited by [editor_key] on [SQLtime()] from
[old_text]
to
[new_text]
") - var/datum/DBQuery/query_edit_message = SSdbcore.NewQuery("UPDATE [format_table_name("messages")] SET text = '[new_text]', lasteditor = '[editor_ckey]', edits = CONCAT(IFNULL(edits,''),'[edit_text]') WHERE id = [message_id] AND deleted = 0") + var/edit_text = "Edited by [editor_key] on [SQLtime()] from
[old_text]
to
[new_text]
" + var/datum/DBQuery/query_edit_message = SSdbcore.NewQuery({" + UPDATE [format_table_name("messages")] + SET text = :text, lasteditor = :lasteditor, edits = CONCAT(IFNULL(edits,''),:edit_text) + WHERE id = :id AND deleted = 0 + "}, list("text" = new_text, "lasteditor" = editor_ckey, "edit_text" = edit_text, "id" = message_id)) if(!query_edit_message.warn_execute()) qdel(query_edit_message) return @@ -177,11 +209,19 @@ message_id = text2num(message_id) if(!message_id) return - var/editor_ckey = sanitizeSQL(usr.ckey) - var/editor_key = sanitizeSQL(usr.key) + var/editor_ckey = usr.ckey + var/editor_key = usr.key var/kn = key_name(usr) var/kna = key_name_admin(usr) - var/datum/DBQuery/query_find_edit_expiry_message = SSdbcore.NewQuery("SELECT type, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), expire_timestamp FROM [format_table_name("messages")] WHERE id = [message_id] AND deleted = 0") + var/datum/DBQuery/query_find_edit_expiry_message = SSdbcore.NewQuery({" + SELECT + type, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), + expire_timestamp + FROM [format_table_name("messages")] + WHERE id = :id AND deleted = 0 + "}, list("id" = message_id)) if(!query_find_edit_expiry_message.warn_execute()) qdel(query_find_edit_expiry_message) return @@ -198,8 +238,9 @@ if(expire_time == "-1") new_expiry = "non-expiring" else - expire_time = sanitizeSQL(expire_time) - var/datum/DBQuery/query_validate_expire_time_edit = SSdbcore.NewQuery("SELECT IF(STR_TO_DATE('[expire_time]','%Y-%c-%d %T') > NOW(), STR_TO_DATE('[expire_time]','%Y-%c-%d %T'), 0)") + var/datum/DBQuery/query_validate_expire_time_edit = SSdbcore.NewQuery({" + SELECT IF(STR_TO_DATE(:expire_time,'%Y-%c-%d %T') > NOW(), STR_TO_DATE(:expire_time,'%Y-%c-%d %T'), 0) + "}, list("expire_time" = expire_time)) if(!query_validate_expire_time_edit.warn_execute()) qdel(query_validate_expire_time_edit) qdel(query_find_edit_expiry_message) @@ -213,8 +254,12 @@ return new_expiry = query_validate_expire_time_edit.item[1] qdel(query_validate_expire_time_edit) - var/edit_text = sanitizeSQL("Expiration time edited by [editor_key] on [SQLtime()] from [old_expiry] to [new_expiry]
") - var/datum/DBQuery/query_edit_message_expiry = SSdbcore.NewQuery("UPDATE [format_table_name("messages")] SET expire_timestamp = [expire_time == "-1" ? "NULL" : "'[new_expiry]'"], lasteditor = '[editor_ckey]', edits = CONCAT(IFNULL(edits,''),'[edit_text]') WHERE id = [message_id] AND deleted = 0") + var/edit_text = "Expiration time edited by [editor_key] on [SQLtime()] from [old_expiry] to [new_expiry]
" + var/datum/DBQuery/query_edit_message_expiry = SSdbcore.NewQuery({" + UPDATE [format_table_name("messages")] + SET expire_timestamp = :expire_time, lasteditor = :lasteditor, edits = CONCAT(IFNULL(edits,''),:edit_text) + WHERE id = :id AND deleted = 0 + "}, list("expire_time" = (expire_time == "-1" ? null : new_expiry), "lasteditor" = editor_ckey, "edit_text" = edit_text, "id" = message_id)) if(!query_edit_message_expiry.warn_execute()) qdel(query_edit_message_expiry) qdel(query_find_edit_expiry_message) @@ -237,7 +282,15 @@ return var/kn = key_name(usr) var/kna = key_name_admin(usr) - var/datum/DBQuery/query_find_edit_note_severity = SSdbcore.NewQuery("SELECT type, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), severity FROM [format_table_name("messages")] WHERE id = [message_id] AND deleted = 0") + var/datum/DBQuery/query_find_edit_note_severity = SSdbcore.NewQuery({" + SELECT + type, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), + severity + FROM [format_table_name("messages")] + WHERE id = :id AND deleted = 0 + "}, list("id" = message_id)) if(!query_find_edit_note_severity.warn_execute()) qdel(query_find_edit_note_severity) return @@ -248,15 +301,19 @@ var/old_severity = query_find_edit_note_severity.item[4] if(!old_severity) old_severity = "NA" - var/editor_key = sanitizeSQL(usr.key) - var/editor_ckey = sanitizeSQL(usr.ckey) + var/editor_key = usr.key + var/editor_ckey = usr.ckey var/new_severity = input("Set the severity of the note.", "Severity", null, null) as null|anything in list("high", "medium", "minor", "none") //lowercase for edit log consistency if(!new_severity) qdel(query_find_edit_note_severity) return - new_severity = sanitizeSQL(new_severity) - var/edit_text = sanitizeSQL("Note severity edited by [editor_key] on [SQLtime()] from [old_severity] to [new_severity]
") - var/datum/DBQuery/query_edit_note_severity = SSdbcore.NewQuery("UPDATE [format_table_name("messages")] SET severity = '[new_severity]', lasteditor = '[editor_ckey]', edits = CONCAT(IFNULL(edits,''),'[edit_text]') WHERE id = [message_id] AND deleted = 0") + new_severity = new_severity + var/edit_text = "Note severity edited by [editor_key] on [SQLtime()] from [old_severity] to [new_severity]
" + var/datum/DBQuery/query_edit_note_severity = SSdbcore.NewQuery({" + UPDATE [format_table_name("messages")] + SET severity = :severity, lasteditor = :lasteditor, edits = CONCAT(IFNULL(edits,''),:edit_text) + WHERE id = :id AND deleted = 0 + "}, list("severity" = new_severity, "lasteditor" = editor_ckey, "edit_text" = edit_text, "id" = message_id)) if(!query_edit_note_severity.warn_execute(async = TRUE)) qdel(query_edit_note_severity) qdel(qdel(query_find_edit_note_severity)) @@ -274,11 +331,19 @@ message_id = text2num(message_id) if(!message_id) return - var/editor_ckey = sanitizeSQL(usr.ckey) - var/editor_key = sanitizeSQL(usr.key) + var/editor_ckey = usr.ckey + var/editor_key = usr.key var/kn = key_name(usr) var/kna = key_name_admin(usr) - var/datum/DBQuery/query_find_message_secret = SSdbcore.NewQuery("SELECT type, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), targetckey), secret FROM [format_table_name("messages")] WHERE id = [message_id] AND deleted = 0") + var/datum/DBQuery/query_find_message_secret = SSdbcore.NewQuery({" + SELECT + type, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), targetckey), + secret + FROM [format_table_name("messages")] + WHERE id = :id AND deleted = 0 + "}, list("id" = message_id)) if(!query_find_message_secret.warn_execute()) qdel(query_find_message_secret) return @@ -288,7 +353,11 @@ var/admin_key = query_find_message_secret.item[3] var/secret = text2num(query_find_message_secret.item[4]) var/edit_text = "Made [secret ? "not secret" : "secret"] by [editor_key] on [SQLtime()]
" - var/datum/DBQuery/query_message_secret = SSdbcore.NewQuery("UPDATE [format_table_name("messages")] SET secret = NOT secret, lasteditor = '[editor_ckey]', edits = CONCAT(IFNULL(edits,''),'[edit_text]') WHERE id = [message_id]") + var/datum/DBQuery/query_message_secret = SSdbcore.NewQuery({" + UPDATE [format_table_name("messages")] + SET secret = NOT secret, lasteditor = :lasteditor, edits = CONCAT(IFNULL(edits,''),:edit_text) + WHERE id = :id + "}, list("lasteditor" = editor_ckey, "edit_text" = edit_text, "id" = message_id)) if(!query_message_secret.warn_execute()) qdel(query_find_message_secret) qdel(query_message_secret) @@ -328,7 +397,20 @@ else output += "Filter offline clients" output += ruler - var/datum/DBQuery/query_get_type_messages = SSdbcore.NewQuery("SELECT id, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), targetckey, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), text, timestamp, server, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = lasteditor), lasteditor), expire_timestamp FROM [format_table_name("messages")] WHERE type = '[type]' AND deleted = 0 AND (expire_timestamp > NOW() OR expire_timestamp IS NULL)") + var/datum/DBQuery/query_get_type_messages = SSdbcore.NewQuery({" + SELECT + id, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), + targetckey, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), + text, + timestamp, + server, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = lasteditor), lasteditor), + expire_timestamp + FROM [format_table_name("messages")] + WHERE type = :type AND deleted = 0 AND (expire_timestamp > NOW() OR expire_timestamp IS NULL) + "}, list("type" = type)) if(!query_get_type_messages.warn_execute()) qdel(query_get_type_messages) return @@ -361,9 +443,24 @@ output += "
[text]
" qdel(query_get_type_messages) if(target_ckey) - target_ckey = sanitizeSQL(target_ckey) var/target_key - var/datum/DBQuery/query_get_messages = SSdbcore.NewQuery("SELECT type, secret, id, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), text, timestamp, server, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = lasteditor), lasteditor), DATEDIFF(NOW(), timestamp), IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), expire_timestamp, severity FROM [format_table_name("messages")] WHERE type <> 'memo' AND targetckey = '[target_ckey]' AND deleted = 0 AND (expire_timestamp > NOW() OR expire_timestamp IS NULL) ORDER BY timestamp DESC") + var/datum/DBQuery/query_get_messages = SSdbcore.NewQuery({" + SELECT + type, + secret, + id, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), + text, + timestamp, + server, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = lasteditor), lasteditor), + DATEDIFF(NOW(), timestamp), + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey), targetckey), + expire_timestamp, severity + FROM [format_table_name("messages")] + WHERE type <> 'memo' AND targetckey = :targetckey AND deleted = 0 AND (expire_timestamp > NOW() OR expire_timestamp IS NULL) + ORDER BY timestamp DESC + "}, list("targetckey" = target_ckey)) if(!query_get_messages.warn_execute()) qdel(query_get_messages) return @@ -441,7 +538,9 @@ notedata += data qdel(query_get_messages) if(!target_key) - var/datum/DBQuery/query_get_message_key = SSdbcore.NewQuery("SELECT byond_key FROM [format_table_name("player")] WHERE ckey = '[target_ckey]'") + var/datum/DBQuery/query_get_message_key = SSdbcore.NewQuery({" + SELECT byond_key FROM [format_table_name("player")] WHERE ckey = :ckey + "}, list("ckey" = target_ckey)) if(!query_get_message_key.warn_execute()) qdel(query_get_message_key) return @@ -478,8 +577,6 @@ var/search output += "
Add messageAdd watchlist entryAdd note
" output += ruler - if(!isnum(index)) - index = sanitizeSQL(index) switch(index) if(1) search = "^." @@ -487,7 +584,17 @@ search = "^\[^\[:alpha:\]\]" else search = "^[index]" - var/datum/DBQuery/query_list_messages = SSdbcore.NewQuery("SELECT DISTINCT targetckey, (SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey) FROM [format_table_name("messages")] WHERE type <> 'memo' AND targetckey REGEXP '[search]' AND deleted = 0 AND (expire_timestamp > NOW() OR expire_timestamp IS NULL) ORDER BY targetckey") + var/datum/DBQuery/query_list_messages = SSdbcore.NewQuery({" + SELECT DISTINCT + targetckey, + (SELECT byond_key FROM [format_table_name("player")] WHERE ckey = targetckey) + FROM [format_table_name("messages")] + WHERE type <> 'memo' + AND targetckey REGEXP :search + AND deleted = 0 + AND (expire_timestamp > NOW() OR expire_timestamp IS NULL) + ORDER BY targetckey + "}, list("search" = search)) if(!query_list_messages.warn_execute()) qdel(query_list_messages) return @@ -516,12 +623,19 @@ if(!type) return var/output - if(target_ckey) - target_ckey = sanitizeSQL(target_ckey) - var/query = "SELECT id, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), text, timestamp, IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = lasteditor), lasteditor) FROM [format_table_name("messages")] WHERE type = '[type]' AND deleted = 0 AND (expire_timestamp > NOW() OR expire_timestamp IS NULL)" - if(type == "message" || type == "watchlist entry") - query += " AND targetckey = '[target_ckey]'" - var/datum/DBQuery/query_get_message_output = SSdbcore.NewQuery(query) + var/datum/DBQuery/query_get_message_output = SSdbcore.NewQuery({" + SELECT + id, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = adminckey), adminckey), + text, + timestamp, + IFNULL((SELECT byond_key FROM [format_table_name("player")] WHERE ckey = lasteditor), lasteditor) + FROM [format_table_name("messages")] + WHERE type = :type + AND deleted = 0 + AND (expire_timestamp > NOW() OR expire_timestamp IS NULL) + AND ((type != 'message' AND type != 'watchlist entry') OR targetckey = :targetckey) + "}, list("targetckey" = target_ckey, "type" = type)) if(!query_get_message_output.warn_execute()) qdel(query_get_message_output) return @@ -535,7 +649,10 @@ if("message") output += "Admin message left by [admin_key] on [timestamp]" output += "
[text]
" - var/datum/DBQuery/query_message_read = SSdbcore.NewQuery("UPDATE [format_table_name("messages")] SET type = 'message sent' WHERE id = [message_id]") + var/datum/DBQuery/query_message_read = SSdbcore.NewQuery( + "UPDATE [format_table_name("messages")] SET type = 'message sent' WHERE id = :id", + list("id" = message_id) + ) if(!query_message_read.warn_execute()) qdel(query_get_message_output) qdel(query_message_read) @@ -575,7 +692,7 @@ var/timestamp = note.group[1] notetext = note.group[2] var/admin_ckey = note.group[3] - var/datum/DBQuery/query_convert_time = SSdbcore.NewQuery("SELECT ADDTIME(STR_TO_DATE('[timestamp]','%d-%b-%Y'), '0')") + var/datum/DBQuery/query_convert_time = SSdbcore.NewQuery("SELECT ADDTIME(STR_TO_DATE(:timestamp,'%d-%b-%Y'), '0')", list("timestamp" = timestamp)) if(!query_convert_time.Execute()) qdel(query_convert_time) return diff --git a/code/modules/admin/stickyban.dm b/code/modules/admin/stickyban.dm index ab185dc2dbb..0cad328a97a 100644 --- a/code/modules/admin/stickyban.dm +++ b/code/modules/admin/stickyban.dm @@ -33,7 +33,10 @@ ban["message"] = "[reason]" if(SSdbcore.Connect()) - var/datum/DBQuery/query_create_stickyban = SSdbcore.NewQuery("INSERT INTO [format_table_name("stickyban")] (ckey, reason, banning_admin) VALUES ('[sanitizeSQL(ckey)]', '[sanitizeSQL(ban["message"])]', '[sanitizeSQL(usr.ckey)]')") + var/datum/DBQuery/query_create_stickyban = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("stickyban")] (ckey, reason, banning_admin) + VALUES (:ckey, :message, :banning_admin) + "}, list("ckey" = ckey, "message" = ban["message"], "banning_admin" = usr.ckey)) if (query_create_stickyban.warn_execute()) ban["fromdb"] = TRUE qdel(query_create_stickyban) @@ -68,10 +71,10 @@ if (SSdbcore.Connect()) SSdbcore.QuerySelect(list( - SSdbcore.NewQuery("DELETE FROM [format_table_name("stickyban")] WHERE ckey = '[sanitizeSQL(ckey)]'"), - SSdbcore.NewQuery("DELETE FROM [format_table_name("stickyban_matched_ckey")] WHERE stickyban = '[sanitizeSQL(ckey)]'"), - SSdbcore.NewQuery("DELETE FROM [format_table_name("stickyban_matched_cid")] WHERE stickyban = '[sanitizeSQL(ckey)]'"), - SSdbcore.NewQuery("DELETE FROM [format_table_name("stickyban_matched_ip")] WHERE stickyban = '[sanitizeSQL(ckey)]'") + SSdbcore.NewQuery("DELETE FROM [format_table_name("stickyban")] WHERE ckey = :ckey", list("ckey" = ckey)), + SSdbcore.NewQuery("DELETE FROM [format_table_name("stickyban_matched_ckey")] WHERE stickyban = :ckey", list("ckey" = ckey)), + SSdbcore.NewQuery("DELETE FROM [format_table_name("stickyban_matched_cid")] WHERE stickyban = :ckey", list("ckey" = ckey)), + SSdbcore.NewQuery("DELETE FROM [format_table_name("stickyban_matched_ip")] WHERE stickyban = :ckey", list("ckey" = ckey)) ), warn = TRUE, qdel = TRUE) @@ -116,7 +119,10 @@ SSstickyban.cache[ckey] = ban if (SSdbcore.Connect()) - var/datum/DBQuery/query_remove_stickyban_alt = SSdbcore.NewQuery("DELETE FROM [format_table_name("stickyban_matched_ckey")] WHERE stickyban = '[sanitizeSQL(ckey)]' AND matched_ckey = '[sanitizeSQL(alt)]'") + var/datum/DBQuery/query_remove_stickyban_alt = SSdbcore.NewQuery( + "DELETE FROM [format_table_name("stickyban_matched_ckey")] WHERE stickyban = :ckey AND matched_ckey = :alt", + list("ckey" = ckey, "alt" = alt) + ) query_remove_stickyban_alt.warn_execute() qdel(query_remove_stickyban_alt) @@ -147,7 +153,10 @@ SSstickyban.cache[ckey] = ban if (SSdbcore.Connect()) - var/datum/DBQuery/query_edit_stickyban = SSdbcore.NewQuery("UPDATE [format_table_name("stickyban")] SET reason = '[sanitizeSQL(reason)]' WHERE ckey = '[sanitizeSQL(ckey)]'") + var/datum/DBQuery/query_edit_stickyban = SSdbcore.NewQuery( + "UPDATE [format_table_name("stickyban")] SET reason = :reason WHERE ckey = :ckey", + list("reason" = reason, "ckey" = ckey) + ) query_edit_stickyban.warn_execute() qdel(query_edit_stickyban) @@ -194,7 +203,10 @@ SSstickyban.cache[ckey] = ban if (SSdbcore.Connect()) - var/datum/DBQuery/query_exempt_stickyban_alt = SSdbcore.NewQuery("UPDATE [format_table_name("stickyban_matched_ckey")] SET exempt = 1 WHERE stickyban = '[sanitizeSQL(ckey)]' AND matched_ckey = '[sanitizeSQL(alt)]'") + var/datum/DBQuery/query_exempt_stickyban_alt = SSdbcore.NewQuery( + "UPDATE [format_table_name("stickyban_matched_ckey")] SET exempt = 1 WHERE stickyban = :ckey AND matched_ckey = :alt", + list("ckey" = ckey, "alt" = alt) + ) query_exempt_stickyban_alt.warn_execute() qdel(query_exempt_stickyban_alt) @@ -241,7 +253,10 @@ SSstickyban.cache[ckey] = ban if (SSdbcore.Connect()) - var/datum/DBQuery/query_unexempt_stickyban_alt = SSdbcore.NewQuery("UPDATE [format_table_name("stickyban_matched_ckey")] SET exempt = 0 WHERE stickyban = '[sanitizeSQL(ckey)]' AND matched_ckey = '[sanitizeSQL(alt)]'") + var/datum/DBQuery/query_unexempt_stickyban_alt = SSdbcore.NewQuery( + "UPDATE [format_table_name("stickyban_matched_ckey")] SET exempt = 0 WHERE stickyban = :ckey AND matched_ckey = :alt", + list("ckey" = ckey, "alt" = alt) + ) query_unexempt_stickyban_alt.warn_execute() qdel(query_unexempt_stickyban_alt) diff --git a/code/modules/admin/topic.dm b/code/modules/admin/topic.dm index e600146579f..3a723dc9d60 100644 --- a/code/modules/admin/topic.dm +++ b/code/modules/admin/topic.dm @@ -575,8 +575,10 @@ else if(href_list["messageedits"]) if(!check_rights(R_ADMIN)) return - var/message_id = sanitizeSQL("[href_list["messageedits"]]") - var/datum/DBQuery/query_get_message_edits = SSdbcore.NewQuery("SELECT edits FROM [format_table_name("messages")] WHERE id = '[message_id]'") + var/datum/DBQuery/query_get_message_edits = SSdbcore.NewQuery( + "SELECT edits FROM [format_table_name("messages")] WHERE id = :message_id", + list("message_id" = href_list["messageedits"]) + ) if(!query_get_message_edits.warn_execute()) qdel(query_get_message_edits) return diff --git a/code/modules/bsql/LICENSE b/code/modules/bsql/LICENSE deleted file mode 100644 index 882f6d45716..00000000000 --- a/code/modules/bsql/LICENSE +++ /dev/null @@ -1,7 +0,0 @@ -Copyright 2018 Jordan Brown - -Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. \ No newline at end of file diff --git a/code/modules/bsql/core/connection.dm b/code/modules/bsql/core/connection.dm deleted file mode 100644 index 7a652607f91..00000000000 --- a/code/modules/bsql/core/connection.dm +++ /dev/null @@ -1,68 +0,0 @@ -/datum/BSQL_Connection - var/id - var/connection_type - -BSQL_PROTECT_DATUM(/datum/BSQL_Connection) - -/datum/BSQL_Connection/New(connection_type, asyncTimeout, blockingTimeout, threadLimit) - if(asyncTimeout == null) - asyncTimeout = BSQL_DEFAULT_TIMEOUT - if(blockingTimeout == null) - blockingTimeout = asyncTimeout - if(threadLimit == null) - threadLimit = BSQL_DEFAULT_THREAD_LIMIT - - src.connection_type = connection_type - - world._BSQL_InitCheck(src) - - var/error = world._BSQL_Internal_Call("CreateConnection", connection_type, "[asyncTimeout]", "[blockingTimeout]", "[threadLimit]") - if(error) - BSQL_ERROR(error) - return - - id = world._BSQL_Internal_Call("GetConnection") - if(!id) - BSQL_ERROR("BSQL library failed to provide connect operation for connection id [id]([connection_type])!") - -BSQL_DEL_PROC(/datum/BSQL_Connection) - var/error - if(id) - error = world._BSQL_Internal_Call("ReleaseConnection", id) - . = ..() - if(error) - BSQL_ERROR(error) - -/datum/BSQL_Connection/BeginConnect(ipaddress, port, username, password, database) - var/error = world._BSQL_Internal_Call("OpenConnection", id, ipaddress, "[port]", username, password, database) - if(error) - BSQL_ERROR(error) - return - - var/op_id = world._BSQL_Internal_Call("GetOperation") - if(!op_id) - BSQL_ERROR("Library failed to provide connect operation for connection id [id]([connection_type])!") - return - - return new /datum/BSQL_Operation(src, op_id) - - -/datum/BSQL_Connection/BeginQuery(query) - var/error = world._BSQL_Internal_Call("NewQuery", id, query) - if(error) - BSQL_ERROR(error) - return - - var/op_id = world._BSQL_Internal_Call("GetOperation") - if(!op_id) - BSQL_ERROR("Library failed to provide query operation for connection id [id]([connection_type])!") - return - - return new /datum/BSQL_Operation/Query(src, op_id) - -/datum/BSQL_Connection/Quote(str) - if(!str) - return null; - . = world._BSQL_Internal_Call("QuoteString", id, "[str]") - if(!.) - BSQL_ERROR("Library failed to provide quote for [str]!") diff --git a/code/modules/bsql/core/library.dm b/code/modules/bsql/core/library.dm deleted file mode 100644 index 2651d01c826..00000000000 --- a/code/modules/bsql/core/library.dm +++ /dev/null @@ -1,43 +0,0 @@ -/world/proc/_BSQL_Internal_Call(func, ...) - var/list/call_args = args.Copy(2) - BSQL_Debug("_BSQL_Internal_Call: [args[1]]([call_args.Join(", ")])") - . = call(_BSQL_Library_Path(), func)(arglist(call_args)) - BSQL_Debug("Result: [. == null ? "NULL" : "\"[.]\""]") - -/world/proc/_BSQL_Library_Path() - return system_type == MS_WINDOWS ? "BSQL.dll" : "libBSQL.so" - -/world/proc/_BSQL_InitCheck(datum/BSQL_Connection/caller) - var/static/library_initialized = FALSE - if(_BSQL_Initialized()) - return - var/libPath = _BSQL_Library_Path() - if(!fexists(libPath)) - BSQL_DEL_CALL(caller) - BSQL_ERROR("Could not find [libPath]!") - return - - var/version = _BSQL_Internal_Call("Version") - if(version != BSQL_VERSION) - BSQL_DEL_CALL(caller) - BSQL_ERROR("BSQL DMAPI version mismatch! Expected [BSQL_VERSION], got [version == null ? "NULL" : version]!") - return - - var/result = _BSQL_Internal_Call("Initialize") - if(result) - BSQL_DEL_CALL(caller) - BSQL_ERROR(result) - return - _BSQL_Initialized(TRUE) - -/world/proc/_BSQL_Initialized(new_val) - var/static/bsql_library_initialized = FALSE - if(new_val != null) - bsql_library_initialized = new_val - return bsql_library_initialized - -/world/BSQL_Shutdown() - if(!_BSQL_Initialized()) - return - _BSQL_Internal_Call("Shutdown") - _BSQL_Initialized(FALSE) diff --git a/code/modules/bsql/core/operation.dm b/code/modules/bsql/core/operation.dm deleted file mode 100644 index 50dce6ae5f6..00000000000 --- a/code/modules/bsql/core/operation.dm +++ /dev/null @@ -1,47 +0,0 @@ -/datum/BSQL_Operation - var/datum/BSQL_Connection/connection - var/id - -BSQL_PROTECT_DATUM(/datum/BSQL_Operation) - -/datum/BSQL_Operation/New(datum/BSQL_Connection/connection, id) - src.connection = connection - src.id = id - -BSQL_DEL_PROC(/datum/BSQL_Operation) - var/error - if(!BSQL_IS_DELETED(connection)) - error = world._BSQL_Internal_Call("ReleaseOperation", connection.id, id) - . = ..() - if(error) - BSQL_ERROR(error) - -/datum/BSQL_Operation/IsComplete() - if(BSQL_IS_DELETED(connection)) - return TRUE - var/result = world._BSQL_Internal_Call("OpComplete", connection.id, id) - if(!result) - BSQL_ERROR("Error fetching operation [id] for connection [connection.id]!") - return - return result == "DONE" - -/datum/BSQL_Operation/GetError() - if(BSQL_IS_DELETED(connection)) - return "Connection deleted!" - return world._BSQL_Internal_Call("GetError", connection.id, id) - -/datum/BSQL_Operation/GetErrorCode() - if(BSQL_IS_DELETED(connection)) - return -2 - return text2num(world._BSQL_Internal_Call("GetErrorCode", connection.id, id)) - -/datum/BSQL_Operation/WaitForCompletion() - if(BSQL_IS_DELETED(connection)) - return - var/error = world._BSQL_Internal_Call("BlockOnOperation", connection.id, id) - if(error) - if(error == "Operation timed out!") //match this with the implementation - return FALSE - BSQL_ERROR("Error waiting for operation [id] for connection [connection.id]! [error]") - return - return TRUE diff --git a/code/modules/bsql/core/query.dm b/code/modules/bsql/core/query.dm deleted file mode 100644 index 96c3714c715..00000000000 --- a/code/modules/bsql/core/query.dm +++ /dev/null @@ -1,35 +0,0 @@ -/datum/BSQL_Operation/Query - var/last_result_json - var/list/last_result - -BSQL_PROTECT_DATUM(/datum/BSQL_Operation/Query) - -/datum/BSQL_Operation/Query/CurrentRow() - return last_result - -/datum/BSQL_Operation/Query/IsComplete() - //whole different ballgame here - if(BSQL_IS_DELETED(connection)) - return TRUE - var/result = world._BSQL_Internal_Call("ReadyRow", connection.id, id) - switch(result) - if("DONE") - //load the data - LoadQueryResult() - return TRUE - if("NOTDONE") - return FALSE - else - BSQL_ERROR(result) - -/datum/BSQL_Operation/Query/WaitForCompletion() - . = ..() - if(.) - LoadQueryResult() - -/datum/BSQL_Operation/Query/proc/LoadQueryResult() - last_result_json = world._BSQL_Internal_Call("GetRow", connection.id, id) - if(last_result_json) - last_result = json_decode(last_result_json) - else - last_result = null diff --git a/code/modules/bsql/includes.dm b/code/modules/bsql/includes.dm deleted file mode 100644 index ec199a5513a..00000000000 --- a/code/modules/bsql/includes.dm +++ /dev/null @@ -1,4 +0,0 @@ -#include "core\connection.dm" -#include "core\library.dm" -#include "core\operation.dm" -#include "core\query.dm" diff --git a/code/modules/client/client_procs.dm b/code/modules/client/client_procs.dm index 1ef9577ac7f..7693a82ac49 100644 --- a/code/modules/client/client_procs.dm +++ b/code/modules/client/client_procs.dm @@ -505,8 +505,10 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) return if(!SSdbcore.Connect()) return - var/sql_ckey = sanitizeSQL(src.ckey) - var/datum/DBQuery/query_get_related_ip = SSdbcore.NewQuery("SELECT ckey FROM [format_table_name("player")] WHERE ip = INET_ATON('[address]') AND ckey != '[sql_ckey]'") + var/datum/DBQuery/query_get_related_ip = SSdbcore.NewQuery( + "SELECT ckey FROM [format_table_name("player")] WHERE ip = INET_ATON(:address) AND ckey != :ckey", + list("address" = address, "ckey" = ckey) + ) if(!query_get_related_ip.Execute()) qdel(query_get_related_ip) return @@ -514,7 +516,10 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) while(query_get_related_ip.NextRow()) related_accounts_ip += "[query_get_related_ip.item[1]], " qdel(query_get_related_ip) - var/datum/DBQuery/query_get_related_cid = SSdbcore.NewQuery("SELECT ckey FROM [format_table_name("player")] WHERE computerid = '[computer_id]' AND ckey != '[sql_ckey]'") + var/datum/DBQuery/query_get_related_cid = SSdbcore.NewQuery( + "SELECT ckey FROM [format_table_name("player")] WHERE computerid = :computerid AND ckey != :ckey", + list("computerid" = computer_id, "ckey" = ckey) + ) if(!query_get_related_cid.Execute()) qdel(query_get_related_cid) return @@ -528,11 +533,11 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) else if (!GLOB.deadmins[ckey] && check_randomizer(connectiontopic)) return - var/sql_ip = sanitizeSQL(address) - var/sql_computerid = sanitizeSQL(computer_id) - var/sql_admin_rank = sanitizeSQL(admin_rank) var/new_player - var/datum/DBQuery/query_client_in_db = SSdbcore.NewQuery("SELECT 1 FROM [format_table_name("player")] WHERE ckey = '[sql_ckey]'") + var/datum/DBQuery/query_client_in_db = SSdbcore.NewQuery( + "SELECT 1 FROM [format_table_name("player")] WHERE ckey = :ckey", + list("ckey" = ckey) + ) if(!query_client_in_db.Execute()) qdel(query_client_in_db) return @@ -553,9 +558,11 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) return new_player = 1 - account_join_date = sanitizeSQL(findJoinDate()) - var/sql_key = sanitizeSQL(key) - var/datum/DBQuery/query_add_player = SSdbcore.NewQuery("INSERT INTO [format_table_name("player")] (`ckey`, `byond_key`, `firstseen`, `firstseen_round_id`, `lastseen`, `lastseen_round_id`, `ip`, `computerid`, `lastadminrank`, `accountjoindate`) VALUES ('[sql_ckey]', '[sql_key]', Now(), '[GLOB.round_id]', Now(), '[GLOB.round_id]', INET_ATON('[sql_ip]'), '[sql_computerid]', '[sql_admin_rank]', [account_join_date ? "'[account_join_date]'" : "NULL"])") + account_join_date = findJoinDate() + var/datum/DBQuery/query_add_player = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("player")] (`ckey`, `byond_key`, `firstseen`, `firstseen_round_id`, `lastseen`, `lastseen_round_id`, `ip`, `computerid`, `lastadminrank`, `accountjoindate`) + VALUES (:ckey, :key, Now(), :round_id, Now(), :round_id, INET_ATON(:ip), :computerid, :adminrank, :account_join_date) + "}, list("ckey" = ckey, "key" = key, "round_id" = GLOB.round_id, "ip" = address, "computerid" = computer_id, "adminrank" = admin_rank, "account_join_date" = account_join_date || null)) if(!query_add_player.Execute()) qdel(query_client_in_db) qdel(query_add_player) @@ -565,7 +572,10 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) account_join_date = "Error" account_age = -1 qdel(query_client_in_db) - var/datum/DBQuery/query_get_client_age = SSdbcore.NewQuery("SELECT firstseen, DATEDIFF(Now(),firstseen), accountjoindate, DATEDIFF(Now(),accountjoindate) FROM [format_table_name("player")] WHERE ckey = '[sql_ckey]'") + var/datum/DBQuery/query_get_client_age = SSdbcore.NewQuery( + "SELECT firstseen, DATEDIFF(Now(),firstseen), accountjoindate, DATEDIFF(Now(),accountjoindate) FROM [format_table_name("player")] WHERE ckey = :ckey", + list("ckey" = ckey) + ) if(!query_get_client_age.Execute()) qdel(query_get_client_age) return @@ -576,11 +586,14 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) account_join_date = query_get_client_age.item[3] account_age = text2num(query_get_client_age.item[4]) if(!account_age) - account_join_date = sanitizeSQL(findJoinDate()) + account_join_date = findJoinDate() if(!account_join_date) account_age = -1 else - var/datum/DBQuery/query_datediff = SSdbcore.NewQuery("SELECT DATEDIFF(Now(),'[account_join_date]')") + var/datum/DBQuery/query_datediff = SSdbcore.NewQuery( + "SELECT DATEDIFF(Now(), :account_join_date)", + list("account_join_date" = account_join_date) + ) if(!query_datediff.Execute()) qdel(query_datediff) return @@ -589,14 +602,20 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) qdel(query_datediff) qdel(query_get_client_age) if(!new_player) - var/datum/DBQuery/query_log_player = SSdbcore.NewQuery("UPDATE [format_table_name("player")] SET lastseen = Now(), lastseen_round_id = '[GLOB.round_id]', ip = INET_ATON('[sql_ip]'), computerid = '[sql_computerid]', lastadminrank = '[sql_admin_rank]', accountjoindate = [account_join_date ? "'[account_join_date]'" : "NULL"] WHERE ckey = '[sql_ckey]'") + var/datum/DBQuery/query_log_player = SSdbcore.NewQuery( + "UPDATE [format_table_name("player")] SET lastseen = Now(), lastseen_round_id = :round_id, ip = INET_ATON(:ip), computerid = :computerid, lastadminrank = :admin_rank, accountjoindate = :account_join_date WHERE ckey = :ckey", + list("round_id" = GLOB.round_id, "ip" = address, "computerid" = computer_id, "admin_rank" = admin_rank, "account_join_date" = account_join_date || null, "ckey" = ckey) + ) if(!query_log_player.Execute()) qdel(query_log_player) return qdel(query_log_player) if(!account_join_date) account_join_date = "Error" - var/datum/DBQuery/query_log_connection = SSdbcore.NewQuery("INSERT INTO `[format_table_name("connection_log")]` (`id`,`datetime`,`server_ip`,`server_port`,`round_id`,`ckey`,`ip`,`computerid`) VALUES(null,Now(),INET_ATON(IF('[world.internet_address]' LIKE '', '0', '[world.internet_address]')),'[world.port]','[GLOB.round_id]','[sql_ckey]',INET_ATON('[sql_ip]'),'[sql_computerid]')") + var/datum/DBQuery/query_log_connection = SSdbcore.NewQuery({" + INSERT INTO `[format_table_name("connection_log")]` (`id`,`datetime`,`server_ip`,`server_port`,`round_id`,`ckey`,`ip`,`computerid`) + VALUES(null,Now(),INET_ATON(:internet_address),:port,:round_id,:ckey,INET_ATON(:ip),:computerid) + "}, list("internet_address" = world.internet_address || "0", "port" = world.port, "round_id" = GLOB.round_id, "ckey" = ckey, "ip" = address, "computerid" = computer_id)) query_log_connection.Execute() qdel(query_log_connection) @@ -620,9 +639,11 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) CRASH("Age check regex failed for [src.ckey]") /client/proc/validate_key_in_db() - var/sql_ckey = sanitizeSQL(ckey) var/sql_key - var/datum/DBQuery/query_check_byond_key = SSdbcore.NewQuery("SELECT byond_key FROM [format_table_name("player")] WHERE ckey = '[sql_ckey]'") + var/datum/DBQuery/query_check_byond_key = SSdbcore.NewQuery( + "SELECT byond_key FROM [format_table_name("player")] WHERE ckey = :ckey", + list("ckey" = ckey) + ) if(!query_check_byond_key.Execute()) qdel(query_check_byond_key) return @@ -638,8 +659,11 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) if(F) var/regex/R = regex("\\tkey = \"(.+)\"") if(R.Find(F)) - var/web_key = sanitizeSQL(R.group[1]) - var/datum/DBQuery/query_update_byond_key = SSdbcore.NewQuery("UPDATE [format_table_name("player")] SET byond_key = '[web_key]' WHERE ckey = '[sql_ckey]'") + var/web_key = R.group[1] + var/datum/DBQuery/query_update_byond_key = SSdbcore.NewQuery( + "UPDATE [format_table_name("player")] SET byond_key = :byond_key WHERE ckey = :ckey", + list("byond_key" = web_key, "ckey" = ckey) + ) query_update_byond_key.Execute() qdel(query_update_byond_key) else @@ -656,8 +680,10 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) var/static/tokens = list() var/static/cidcheck_failedckeys = list() //to avoid spamming the admins if the same guy keeps trying. var/static/cidcheck_spoofckeys = list() - var/sql_ckey = sanitizeSQL(ckey) - var/datum/DBQuery/query_cidcheck = SSdbcore.NewQuery("SELECT computerid FROM [format_table_name("player")] WHERE ckey = '[sql_ckey]'") + var/datum/DBQuery/query_cidcheck = SSdbcore.NewQuery( + "SELECT computerid FROM [format_table_name("player")] WHERE ckey = :ckey", + list("ckey" = ckey) + ) query_cidcheck.Execute() var/lastcid @@ -732,10 +758,11 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) add_system_note("CID-Error", "Detected as using a cid randomizer.") /client/proc/add_system_note(system_ckey, message) - var/sql_system_ckey = sanitizeSQL(system_ckey) - var/sql_ckey = sanitizeSQL(ckey) //check to see if we noted them in the last day. - var/datum/DBQuery/query_get_notes = SSdbcore.NewQuery("SELECT id FROM [format_table_name("messages")] WHERE type = 'note' AND targetckey = '[sql_ckey]' AND adminckey = '[sql_system_ckey]' AND timestamp + INTERVAL 1 DAY < NOW() AND deleted = 0 AND (expire_timestamp > NOW() OR expire_timestamp IS NULL)") + var/datum/DBQuery/query_get_notes = SSdbcore.NewQuery( + "SELECT id FROM [format_table_name("messages")] WHERE type = 'note' AND targetckey = :targetckey AND adminckey = :adminckey AND timestamp + INTERVAL 1 DAY < NOW() AND deleted = 0 AND (expire_timestamp > NOW() OR expire_timestamp IS NULL)", + list("targetckey" = ckey, "adminckey" = system_ckey) + ) if(!query_get_notes.Execute()) qdel(query_get_notes) return @@ -744,7 +771,10 @@ GLOBAL_LIST_EMPTY(external_rsc_urls) return qdel(query_get_notes) //regardless of above, make sure their last note is not from us, as no point in repeating the same note over and over. - query_get_notes = SSdbcore.NewQuery("SELECT adminckey FROM [format_table_name("messages")] WHERE targetckey = '[sql_ckey]' AND deleted = 0 AND (expire_timestamp > NOW() OR expire_timestamp IS NULL) ORDER BY timestamp DESC LIMIT 1") + query_get_notes = SSdbcore.NewQuery( + "SELECT adminckey FROM [format_table_name("messages")] WHERE targetckey = :targetckey AND deleted = 0 AND (expire_timestamp > NOW() OR expire_timestamp IS NULL) ORDER BY timestamp DESC LIMIT 1", + list("targetckey" = ckey) + ) if(!query_get_notes.Execute()) qdel(query_get_notes) return diff --git a/code/modules/jobs/job_exp.dm b/code/modules/jobs/job_exp.dm index 025e930b45f..8c0e8095804 100644 --- a/code/modules/jobs/job_exp.dm +++ b/code/modules/jobs/job_exp.dm @@ -148,7 +148,7 @@ GLOBAL_PROTECT(exp_to_update) set waitfor = FALSE var/list/old_minutes = GLOB.exp_to_update GLOB.exp_to_update = null - SSdbcore.MassInsert(format_table_name("role_time"), old_minutes, "ON DUPLICATE KEY UPDATE minutes = minutes + VALUES(minutes)") + SSdbcore.MassInsert(format_table_name("role_time"), old_minutes, duplicate_key = "ON DUPLICATE KEY UPDATE minutes = minutes + VALUES(minutes)") //resets a client's exp to what was in the db. /client/proc/set_exp_from_db() @@ -156,7 +156,10 @@ GLOBAL_PROTECT(exp_to_update) return -1 if(!SSdbcore.Connect()) return -1 - var/datum/DBQuery/exp_read = SSdbcore.NewQuery("SELECT job, minutes FROM [format_table_name("role_time")] WHERE ckey = '[sanitizeSQL(ckey)]'") + var/datum/DBQuery/exp_read = SSdbcore.NewQuery( + "SELECT job, minutes FROM [format_table_name("role_time")] WHERE ckey = :ckey", + list("ckey" = ckey) + ) if(!exp_read.Execute(async = TRUE)) qdel(exp_read) return -1 @@ -188,7 +191,10 @@ GLOBAL_PROTECT(exp_to_update) else prefs.db_flags |= newflag - var/datum/DBQuery/flag_update = SSdbcore.NewQuery("UPDATE [format_table_name("player")] SET flags = '[prefs.db_flags]' WHERE ckey='[sanitizeSQL(ckey)]'") + var/datum/DBQuery/flag_update = SSdbcore.NewQuery( + "UPDATE [format_table_name("player")] SET flags=:flags WHERE ckey=:ckey", + list("flags" = "[prefs.db_flags]", "ckey" = ckey) + ) if(!flag_update.Execute()) qdel(flag_update) @@ -256,8 +262,8 @@ GLOBAL_PROTECT(exp_to_update) CRASH("invalid job value [jtype]:[jvalue]") LAZYINITLIST(GLOB.exp_to_update) GLOB.exp_to_update.Add(list(list( - "job" = "'[sanitizeSQL(jtype)]'", - "ckey" = "'[sanitizeSQL(ckey)]'", + "job" = jtype, + "ckey" = ckey, "minutes" = jvalue))) prefs.exp[jtype] += jvalue addtimer(CALLBACK(SSblackbox,/datum/controller/subsystem/blackbox/proc/update_exp_db),20,TIMER_OVERRIDE|TIMER_UNIQUE) @@ -268,7 +274,10 @@ GLOBAL_PROTECT(exp_to_update) if(!SSdbcore.Connect()) return FALSE - var/datum/DBQuery/flags_read = SSdbcore.NewQuery("SELECT flags FROM [format_table_name("player")] WHERE ckey='[ckey]'") + var/datum/DBQuery/flags_read = SSdbcore.NewQuery( + "SELECT flags FROM [format_table_name("player")] WHERE ckey=:ckey", + list("ckey" = ckey) + ) if(!flags_read.Execute(async = TRUE)) qdel(flags_read) diff --git a/code/modules/library/lib_machines.dm b/code/modules/library/lib_machines.dm index 5378fe5496c..9b1540718a4 100644 --- a/code/modules/library/lib_machines.dm +++ b/code/modules/library/lib_machines.dm @@ -45,9 +45,6 @@ else dat += "" dat += "" - author = sanitizeSQL(author) - title = sanitizeSQL(title) - category = sanitizeSQL(category) var/SQLsearch = "isnull(deleted) AND " if(category == "Any") SQLsearch += "author LIKE '%[author]%' AND title LIKE '%[title]%'" @@ -55,7 +52,13 @@ SQLsearch += "author LIKE '%[author]%' AND title LIKE '%[title]%' AND category='[category]'" var/bookcount = 0 var/booksperpage = 20 - var/datum/DBQuery/query_library_count_books = SSdbcore.NewQuery("SELECT COUNT(id) FROM [format_table_name("library")] WHERE [SQLsearch]") + var/datum/DBQuery/query_library_count_books = SSdbcore.NewQuery({" + SELECT COUNT(id) FROM [format_table_name("library")] + WHERE isnull(deleted) + AND author LIKE '%' + :author + '%' + AND title LIKE '%' + :title + '%' + AND (:category = 'Any' OR category = :category) + "}, list("author" = author, "title" = title, "category" = category)) if(!query_library_count_books.warn_execute()) qdel(query_library_count_books) return @@ -71,9 +74,16 @@ bookcount -= booksperpage pagecount++ dat += pagelist.Join(" | ") - search_page = text2num(sanitizeSQL(search_page)) - var/limit = " LIMIT [booksperpage * search_page], [booksperpage]" - var/datum/DBQuery/query_library_list_books = SSdbcore.NewQuery("SELECT author, title, category, id FROM [format_table_name("library")] WHERE [SQLsearch][limit]") + search_page = text2num(search_page) + var/datum/DBQuery/query_library_list_books = SSdbcore.NewQuery({" + SELECT author, title, category, id + FROM [format_table_name("library")] + WHERE isnull(deleted) + AND author LIKE '%' + :author + '%' + AND title LIKE '%' + :title + '%' + AND (:category = 'Any' OR category = :category) + LIMIT :skip, :take + "}, list("author" = author, "title" = title, "category" = category, "skip" = booksperpage * search_page, "take" = booksperpage)) if(!query_library_list_books.Execute()) dat += "ERROR: Unable to retrieve book listings. Please contact your system administrator for assistance.
" else @@ -438,14 +448,11 @@ GLOBAL_LIST(cachedbooks) // List of our cached book datums if (!SSdbcore.Connect()) alert("Connection to Archive has been severed. Aborting.") else - - var/sqltitle = sanitizeSQL(scanner.cache.name) - var/sqlauthor = sanitizeSQL(scanner.cache.author) - var/sqlcontent = sanitizeSQL(scanner.cache.dat) - var/sqlcategory = sanitizeSQL(upload_category) - var/sqlckey = sanitizeSQL(usr.ckey) var/msg = "[key_name(usr)] has uploaded the book titled [scanner.cache.name], [length(scanner.cache.dat)] signs" - var/datum/DBQuery/query_library_upload = SSdbcore.NewQuery("INSERT INTO [format_table_name("library")] (author, title, content, category, ckey, datetime, round_id_created) VALUES ('[sqlauthor]', '[sqltitle]', '[sqlcontent]', '[sqlcategory]', '[sqlckey]', Now(), '[GLOB.round_id]')") + var/datum/DBQuery/query_library_upload = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("library")] (author, title, content, category, ckey, datetime, round_id_created) + VALUES (:author, :title, :content, :category, :ckey, Now(), :round_id) + "}, list("title" = scanner.cache.name, "author" = scanner.cache.author, "content" = scanner.cache.dat, "category" = upload_category, "ckey" = usr.ckey, "round_id" = GLOB.round_id)) if(!query_library_upload.Execute()) qdel(query_library_upload) alert("Database error encountered uploading to Archive") @@ -476,14 +483,17 @@ GLOBAL_LIST(cachedbooks) // List of our cached book datums href_list["targetid"] = num2text(orderid) if(href_list["targetid"]) - var/sqlid = sanitizeSQL(href_list["targetid"]) + var/id = href_list["targetid"] if (!SSdbcore.Connect()) alert("Connection to Archive has been severed. Aborting.") if(cooldown > world.time) say("Printer unavailable. Please allow a short time before attempting to print.") else cooldown = world.time + PRINTER_COOLDOWN - var/datum/DBQuery/query_library_print = SSdbcore.NewQuery("SELECT * FROM [format_table_name("library")] WHERE id=[sqlid] AND isnull(deleted)") + var/datum/DBQuery/query_library_print = SSdbcore.NewQuery( + "SELECT * FROM [format_table_name("library")] WHERE id=:id AND isnull(deleted)", + list("id" = id) + ) if(!query_library_print.Execute()) qdel(query_library_print) say("PRINTER ERROR! Failed to print document (0x0000000F)") diff --git a/code/modules/library/random_books.dm b/code/modules/library/random_books.dm index f47f7b38d35..c667e38c4fa 100644 --- a/code/modules/library/random_books.dm +++ b/code/modules/library/random_books.dm @@ -49,8 +49,12 @@ return if(prob(25)) category = null - var/sql_category = category? " AND category='[sanitizeSQL(category)]'" :"" - var/datum/DBQuery/query_get_random_books = SSdbcore.NewQuery("SELECT author, title, content FROM [format_table_name("library")] WHERE isnull(deleted)[sql_category] ORDER BY rand() LIMIT [amount];") // isdeleted copyright (c) not me + var/datum/DBQuery/query_get_random_books = SSdbcore.NewQuery({" + SELECT author, title, content + FROM [format_table_name("library")] + WHERE isnull(deleted) AND (:category IS NULL OR category = :category) + ORDER BY rand() LIMIT :limit + "}, list("category" = category, "limit" = amount)) if(query_get_random_books.Execute()) while(query_get_random_books.NextRow()) var/obj/item/book/B diff --git a/code/modules/mob/dead/new_player/new_player.dm b/code/modules/mob/dead/new_player/new_player.dm index 05b57edb073..b8b08c9e50e 100644 --- a/code/modules/mob/dead/new_player/new_player.dm +++ b/code/modules/mob/dead/new_player/new_player.dm @@ -61,8 +61,22 @@ var/isadmin = FALSE if(client?.holder) isadmin = TRUE - var/sql_ckey = sanitizeSQL(ckey) - var/datum/DBQuery/query_get_new_polls = SSdbcore.NewQuery("SELECT id FROM [format_table_name("poll_question")] WHERE [(isadmin ? "" : "adminonly = 0 AND")] Now() BETWEEN starttime AND endtime AND deleted = 0 AND id NOT IN (SELECT pollid FROM [format_table_name("poll_vote")] WHERE ckey = '[sql_ckey]' AND deleted = 0) AND id NOT IN (SELECT pollid FROM [format_table_name("poll_textreply")] WHERE ckey = '[sql_ckey]' AND deleted = 0)") + var/datum/DBQuery/query_get_new_polls = SSdbcore.NewQuery({" + SELECT id FROM [format_table_name("poll_question")] + WHERE (adminonly = 0 OR :isadmin = 1) + AND Now() BETWEEN starttime AND endtime + AND deleted = 0 + AND id NOT IN ( + SELECT pollid FROM [format_table_name("poll_vote")] + WHERE ckey = :ckey + AND deleted = 0 + ) + AND id NOT IN ( + SELECT pollid FROM [format_table_name("poll_textreply")] + WHERE ckey = :ckey + AND deleted = 0 + ) + "}, list("isadmin" = isadmin, "ckey" = ckey)) var/rs = REF(src) if(!query_get_new_polls.Execute()) qdel(query_get_new_polls) diff --git a/code/modules/mob/dead/new_player/poll.dm b/code/modules/mob/dead/new_player/poll.dm index 76d80a3fdee..23f1c721645 100644 --- a/code/modules/mob/dead/new_player/poll.dm +++ b/code/modules/mob/dead/new_player/poll.dm @@ -42,7 +42,10 @@ * */ /mob/dead/new_player/proc/poll_player_option(datum/poll_question/poll) - var/datum/DBQuery/query_option_get_voted = SSdbcore.NewQuery("SELECT optionid FROM [format_table_name("poll_vote")] WHERE pollid = [sanitizeSQL(poll.poll_id)] AND ckey = '[sanitizeSQL(ckey)]' AND deleted = 0") + var/datum/DBQuery/query_option_get_voted = SSdbcore.NewQuery({" + SELECT optionid FROM [format_table_name("poll_vote")] + WHERE pollid = :pollid AND ckey = :ckey AND deleted = 0 + "}, list("pollid" = poll.poll_id, "ckey" = ckey)) if(!query_option_get_voted.warn_execute()) qdel(query_option_get_voted) return @@ -83,7 +86,10 @@ * */ /mob/dead/new_player/proc/poll_player_text(datum/poll_question/poll) - var/datum/DBQuery/query_text_get_replytext = SSdbcore.NewQuery("SELECT replytext FROM [format_table_name("poll_textreply")] WHERE pollid = [sanitizeSQL(poll.poll_id)] AND ckey = '[sanitizeSQL(ckey)]' AND deleted = 0") + var/datum/DBQuery/query_text_get_replytext = SSdbcore.NewQuery({" + SELECT replytext FROM [format_table_name("poll_textreply")] + WHERE pollid = :pollid AND ckey = :ckey AND deleted = 0 + "}, list("pollid" = poll.poll_id, "ckey" = ckey)) if(!query_text_get_replytext.warn_execute()) qdel(query_text_get_replytext) return @@ -117,7 +123,10 @@ * */ /mob/dead/new_player/proc/poll_player_rating(datum/poll_question/poll) - var/datum/DBQuery/query_rating_get_votes = SSdbcore.NewQuery("SELECT optionid, rating FROM [format_table_name("poll_vote")] WHERE pollid = [sanitizeSQL(poll.poll_id)] AND ckey = '[sanitizeSQL(ckey)]' AND deleted = 0") + var/datum/DBQuery/query_rating_get_votes = SSdbcore.NewQuery({" + SELECT optionid, rating FROM [format_table_name("poll_vote")] + WHERE pollid = :pollid AND ckey = :ckey AND deleted = 0 + "}, list("pollid" = poll.poll_id, "ckey" = ckey)) if(!query_rating_get_votes.warn_execute()) qdel(query_rating_get_votes) return @@ -169,7 +178,10 @@ * */ /mob/dead/new_player/proc/poll_player_multi(datum/poll_question/poll) - var/datum/DBQuery/query_multi_get_votes = SSdbcore.NewQuery("SELECT optionid FROM [format_table_name("poll_vote")] WHERE pollid = [sanitizeSQL(poll.poll_id)] AND ckey = '[sanitizeSQL(ckey)]' AND deleted = 0") + var/datum/DBQuery/query_multi_get_votes = SSdbcore.NewQuery({" + SELECT optionid FROM [format_table_name("poll_vote")] + WHERE pollid = :pollid AND ckey = :ckey AND deleted = 0 + "}, list("pollid" = poll.poll_id, "ckey" = ckey)) if(!query_multi_get_votes.warn_execute()) qdel(query_multi_get_votes) return @@ -212,7 +224,10 @@ /mob/dead/new_player/proc/poll_player_irv(datum/poll_question/poll) var/datum/asset/irv_assets = get_asset_datum(/datum/asset/group/IRV) irv_assets.send(src) - var/datum/DBQuery/query_irv_get_votes = SSdbcore.NewQuery("SELECT optionid FROM [format_table_name("poll_vote")] WHERE pollid = [sanitizeSQL(poll.poll_id)] AND ckey = '[sanitizeSQL(ckey)]' AND deleted = 0") + var/datum/DBQuery/query_irv_get_votes = SSdbcore.NewQuery({" + SELECT optionid FROM [format_table_name("poll_vote")] + WHERE pollid = :pollid AND ckey = :ckey AND deleted = 0 + "}, list("pollid" = poll.poll_id, "ckey" = ckey)) if(!query_irv_get_votes.warn_execute()) qdel(query_irv_get_votes) return @@ -310,7 +325,7 @@ return var/admin_rank if(client.holder) - admin_rank = sanitizeSQL(client.holder.rank.name) + admin_rank = client.holder.rank.name else if(poll.admin_only) return @@ -319,9 +334,14 @@ var/table = "poll_vote" if(poll.poll_type == POLLTYPE_TEXT) table = "poll_textreply" - var/sql_poll_id = sanitizeSQL(poll.poll_id) + var/sql_poll_id = poll.poll_id var/vote_id //only used for option and text polls to save needing another query - var/datum/DBQuery/query_validate_poll_vote = SSdbcore.NewQuery("SELECT (SELECT id FROM [format_table_name("[table]")] WHERE ckey = '[sanitizeSQL(ckey)]' AND pollid = [sql_poll_id] AND deleted = 0 LIMIT 1) FROM [format_table_name("poll_question")] WHERE NOW() BETWEEN starttime AND endtime AND deleted = 0 AND id = [sql_poll_id]") + var/datum/DBQuery/query_validate_poll_vote = SSdbcore.NewQuery({" + SELECT + (SELECT id FROM [format_table_name(table)] WHERE ckey = :ckey AND pollid = :pollid AND deleted = 0 LIMIT 1) + FROM [format_table_name("poll_question")] + WHERE NOW() BETWEEN starttime AND endtime AND deleted = 0 AND id = :pollid + "}, list("ckey" = ckey, "pollid" = sql_poll_id)) if(!query_validate_poll_vote.warn_execute()) qdel(query_validate_poll_vote) return @@ -364,18 +384,22 @@ return if(IsAdminAdvancedProcCall()) return - if(vote_id) - vote_id = "[sanitizeSQL(vote_id)]" - else - vote_id = "NULL" var/datum/poll_option/option = locate(href_list["voteoptionref"]) in poll.options if(!option) to_chat(src, "No option was selected.") return - var/sql_option_id = sanitizeSQL(option.option_id) - var/sql_ckey = sanitizeSQL(ckey) - var/sql_ip = sanitizeSQL(client.address) - var/datum/DBQuery/query_vote_option = SSdbcore.NewQuery("INSERT INTO [format_table_name("poll_vote")] (id, datetime, pollid, optionid, ckey, ip, adminrank) VALUES ([vote_id], NOW(), [sql_poll_id], [sql_option_id], '[sql_ckey]', INET_ATON('[sql_ip]'), '[admin_rank]') ON DUPLICATE KEY UPDATE datetime = NOW(), optionid = [sql_option_id], ip = INET_ATON('[sql_ip]'), adminrank = '[admin_rank]'") + var/datum/DBQuery/query_vote_option = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("poll_vote")] (id, datetime, pollid, optionid, ckey, ip, adminrank) + VALUES (:vote_id, NOW(), :poll_id, :option_id, :ckey, INET_ATON(:ip), :admin_rank) + ON DUPLICATE KEY UPDATE datetime = NOW(), optionid = :option_id, ip = INET_ATON(:ip), adminrank = :admin_rank + "}, list( + "vote_id" = vote_id, + "poll_id" = sql_poll_id, + "option_id" = option.option_id, + "ckey" = ckey, + "ip" = client.address, + "admin_rank" = admin_rank, + )) if(!query_vote_option.warn_execute()) qdel(query_vote_option) return @@ -392,17 +416,22 @@ return if(IsAdminAdvancedProcCall()) return - if(vote_id) - vote_id = "[sanitizeSQL(vote_id)]" - else - vote_id = "NULL" - var/reply_text = sanitizeSQL(href_list["replytext"]) + var/reply_text = href_list["replytext"] if(!reply_text || (length(reply_text) > 2048)) to_chat(src, "The text you entered was blank or too long. Please correct the text and submit again.") return - var/sql_ckey = sanitizeSQL(ckey) - var/sql_ip = sanitizeSQL(client.address) - var/datum/DBQuery/query_vote_text = SSdbcore.NewQuery("INSERT INTO [format_table_name("poll_textreply")] (id, datetime, pollid, ckey, ip, replytext, adminrank) VALUES ([vote_id], NOW(), [sql_poll_id], '[sql_ckey]', INET_ATON('[sql_ip]'), '[reply_text]', '[admin_rank]') ON DUPLICATE KEY UPDATE datetime = NOW(), ip = INET_ATON('[sql_ip]'), replytext = '[reply_text]', adminrank = '[admin_rank]'") + var/datum/DBQuery/query_vote_text = SSdbcore.NewQuery({" + INSERT INTO [format_table_name("poll_textreply")] (id, datetime, pollid, ckey, ip, replytext, adminrank) + VALUES (:vote_id, NOW(), :poll_id, :ckey, INET_ATON(:ip), :reply_text, :admin_rank) + ON DUPLICATE KEY UPDATE datetime = NOW(), ip = INET_ATON(:ip), replytext = :reply_text, adminrank = :admin_rank + "}, list( + "vote_id" = vote_id, + "poll_id" = sql_poll_id, + "ckey" = ckey, + "ip" = client.address, + "reply_text" = reply_text, + "admin_rank" = admin_rank, + )) if(!query_vote_text.warn_execute()) qdel(query_vote_text) return @@ -419,9 +448,11 @@ return if(IsAdminAdvancedProcCall()) return - var/sql_ckey = sanitizeSQL(ckey) var/list/votes = list() - var/datum/DBQuery/query_get_rating_votes = SSdbcore.NewQuery("SELECT id, optionid FROM [format_table_name("poll_vote")] WHERE pollid = [sql_poll_id] AND ckey = '[sql_ckey]' AND deleted = 0") + var/datum/DBQuery/query_get_rating_votes = SSdbcore.NewQuery({" + SELECT id, optionid FROM [format_table_name("poll_vote")] + WHERE pollid = :pollid AND ckey = :ckey AND deleted = 0 + "}, list("pollid" = sql_poll_id, "ckey" = ckey)) if(!query_get_rating_votes.warn_execute()) qdel(query_get_rating_votes) return @@ -429,19 +460,25 @@ votes += list("[query_get_rating_votes.item[2]]" = text2num(query_get_rating_votes.item[1])) qdel(query_get_rating_votes) href_list.Cut(1,3) //first two values aren't options + + var/special_columns = list( + "datetime" = "NOW()", + "ip" = "INET_ATON(?)", + ) + var/sql_votes = list() - var/sql_ip = sanitizeSQL(client.address) for(var/h in href_list) var/datum/poll_option/option = locate(h) in poll.options - var/sql_option_id = sanitizeSQL(option.option_id) - var/sql_vote_id - if(votes["[option.option_id]"]) - sql_vote_id = sanitizeSQL(votes["[option.option_id]"]) - else - sql_vote_id = "NULL" - var/sql_rating = sanitizeSQL(href_list[h]) - sql_votes += list(list("id" = "[sql_vote_id]", "datetime" = "Now()", "pollid" = "'[sql_poll_id]'", "optionid" = "'[sql_option_id]'", "ckey" = "'[sql_ckey]'", "ip" = "INET_ATON('[sql_ip]')", "adminrank" = "'[admin_rank]'", "rating" = "'[sql_rating]'")) - SSdbcore.MassInsert(format_table_name("poll_vote"), sql_votes, duplicate_key = TRUE) + sql_votes += list(list( + "id" = votes["[option.option_id]"], + "pollid" = sql_poll_id, + "optionid" = option.option_id, + "ckey" = ckey, + "ip" = client.address, + "adminrank" = admin_rank, + "rating" = href_list[h] + )) + SSdbcore.MassInsert(format_table_name("poll_vote"), sql_votes, duplicate_key = TRUE, special_columns = special_columns) return TRUE /** @@ -454,13 +491,17 @@ return if(IsAdminAdvancedProcCall()) return - var/sql_ckey = sanitizeSQL(ckey) if(length(href_list) > 2) href_list.Cut(1,3) //first two values aren't options else to_chat(src, "No options were selected.") + + var/special_columns = list( + "datetime" = "NOW()", + "ip" = "INET_ATON(?)", + ) + var/sql_votes = list() - var/sql_ip = sanitizeSQL(client.address) var/vote_count = 0 for(var/h in href_list) if(vote_count == poll.options_allowed) @@ -468,16 +509,23 @@ break vote_count++ var/datum/poll_option/option = locate(h) in poll.options - var/sql_option_id = sanitizeSQL(option.option_id) - sql_votes += list(list("datetime" = "Now()", "pollid" = "'[sql_poll_id]'", "optionid" = "'[sql_option_id]'", "ckey" = "'[sql_ckey]'", "ip" = "INET_ATON('[sql_ip]')", "adminrank" = "'[admin_rank]'")) + sql_votes += list(list( + "pollid" = sql_poll_id, + "optionid" = option.option_id, + "ckey" = ckey, + "ip" = client.address, + "adminrank" = admin_rank + )) /*with revoting and poll editing possible there can be an edge case where a poll is changed to allow less multiple choice options than a user has already voted on rather than trying to calculate which options should be updated and which deleted, we just delete all of a user's votes and re-insert as needed*/ - var/datum/DBQuery/query_delete_multi_votes = SSdbcore.NewQuery("UPDATE [format_table_name("poll_vote")] SET deleted = 1 WHERE pollid = [sql_poll_id] AND ckey = '[sql_ckey]'") + var/datum/DBQuery/query_delete_multi_votes = SSdbcore.NewQuery({" + UPDATE [format_table_name("poll_vote")] SET deleted = 1 WHERE pollid = :pollid AND ckey = :ckey + "}, list("pollid" = sql_poll_id, "ckey" = ckey)) if(!query_delete_multi_votes.warn_execute()) qdel(query_delete_multi_votes) return qdel(query_delete_multi_votes) - SSdbcore.MassInsert(format_table_name("poll_vote"), sql_votes) + SSdbcore.MassInsert(format_table_name("poll_vote"), sql_votes, special_columns = special_columns) return TRUE /** @@ -493,18 +541,29 @@ var/list/votelist = splittext(href_list["IRVdata"], ",") if(!length(votelist)) to_chat(src, "No ordering data found. Please try again or contact an administrator.") + + var/list/special_columns = list( + "datetime" = "NOW()", + "ip" = "INET_ATON(?)", + ) + var/sql_votes = list() - var/sql_ip = sanitizeSQL(client.address) - var/sql_ckey = sanitizeSQL(ckey) for(var/o in votelist) var/datum/poll_option/option = locate(o) in poll.options - var/sql_option_id = sanitizeSQL(option.option_id) - sql_votes += list(list("datetime" = "Now()", "pollid" = "'[sql_poll_id]'", "optionid" = "'[sql_option_id]'", "ckey" = "'[sql_ckey]'", "ip" = "INET_ATON('[sql_ip]')", "adminrank" = "'[admin_rank]'")) + sql_votes += list(list( + "pollid" = sql_poll_id, + "optionid" = option.option_id, + "ckey" = ckey, + "ip" = client.address, + "adminrank" = admin_rank + )) //IRV results are calculated based on id order, we delete all of a user's votes to avoid potential errors caused by revoting and option editing - var/datum/DBQuery/query_delete_irv_votes = SSdbcore.NewQuery("UPDATE [format_table_name("poll_vote")] SET deleted = 1 WHERE pollid = [sql_poll_id] AND ckey = '[sql_ckey]'") + var/datum/DBQuery/query_delete_irv_votes = SSdbcore.NewQuery({" + UPDATE [format_table_name("poll_vote")] SET deleted = 1 WHERE pollid = :pollid AND ckey = :ckey + "}, list("pollid" = sql_poll_id, "ckey" = ckey)) if(!query_delete_irv_votes.warn_execute()) qdel(query_delete_irv_votes) return qdel(query_delete_irv_votes) - SSdbcore.MassInsert(format_table_name("poll_vote"), sql_votes) + SSdbcore.MassInsert(format_table_name("poll_vote"), sql_votes, special_columns = special_columns) return TRUE diff --git a/code/modules/shuttle/emergency.dm b/code/modules/shuttle/emergency.dm index c2f5a2bd6b0..44e5b8aca56 100644 --- a/code/modules/shuttle/emergency.dm +++ b/code/modules/shuttle/emergency.dm @@ -283,7 +283,9 @@ set waitfor = FALSE if(!SSdbcore.Connect()) return - var/datum/DBQuery/query_round_shuttle_name = SSdbcore.NewQuery("UPDATE [format_table_name("round")] SET shuttle_name = '[name]' WHERE id = [GLOB.round_id]") + var/datum/DBQuery/query_round_shuttle_name = SSdbcore.NewQuery({" + UPDATE [format_table_name("round")] SET shuttle_name = :name WHERE id = :round_id + "}, list("name" = name, "round_id" = GLOB.round_id)) query_round_shuttle_name.Execute() qdel(query_round_shuttle_name) diff --git a/dependencies.sh b/dependencies.sh index 53d0bb886fd..6cbb291ebb2 100755 --- a/dependencies.sh +++ b/dependencies.sh @@ -11,16 +11,13 @@ export BYOND_MINOR=${LIST[1]} unset LIST #rust_g git tag -export RUST_G_VERSION=0.4.3 - -#bsql git tag -export BSQL_VERSION=v1.4.0.0 +export RUST_G_VERSION=0.4.5 #node version export NODE_VERSION=12 # PHP version -export PHP_VERSION=5.6 +export PHP_VERSION=7.2 # SpacemanDMM git tag export SPACEMAN_DMM_VERSION=suite-1.4 diff --git a/libmariadb.dll b/libmariadb.dll deleted file mode 100644 index 2e185d26576..00000000000 Binary files a/libmariadb.dll and /dev/null differ diff --git a/rust_g.dll b/rust_g.dll index f4be6e730aa..ed07265bf59 100644 Binary files a/rust_g.dll and b/rust_g.dll differ diff --git a/tgstation.dme b/tgstation.dme index 3e96f9d1131..334c74a869e 100644 --- a/tgstation.dme +++ b/tgstation.dme @@ -28,8 +28,6 @@ #include "code\__DEFINES\atom_hud.dm" #include "code\__DEFINES\blackmarket.dm" #include "code\__DEFINES\botany.dm" -#include "code\__DEFINES\bsql.config.dm" -#include "code\__DEFINES\bsql.dm" #include "code\__DEFINES\callbacks.dm" #include "code\__DEFINES\cargo.dm" #include "code\__DEFINES\cinematics.dm" @@ -1606,7 +1604,6 @@ #include "code\modules\awaymissions\mission_code\stationCollision.dm" #include "code\modules\awaymissions\mission_code\undergroundoutpost45.dm" #include "code\modules\awaymissions\mission_code\wildwest.dm" -#include "code\modules\bsql\includes.dm" #include "code\modules\buildmode\bm_mode.dm" #include "code\modules\buildmode\buildmode.dm" #include "code\modules\buildmode\buttons.dm" diff --git a/tools/deploy.sh b/tools/deploy.sh index a4795ea06a4..23711577072 100755 --- a/tools/deploy.sh +++ b/tools/deploy.sh @@ -37,4 +37,3 @@ cp -r strings/* $1/strings/ #dlls on windows cp rust_g* $1/ || true -cp *BSQL.* $1/ || true diff --git a/tools/travis/build_bsql.sh b/tools/travis/build_bsql.sh deleted file mode 100755 index e2b281efc64..00000000000 --- a/tools/travis/build_bsql.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -source dependencies.sh - -mkdir -p BSQL -cd BSQL -git init -git remote add origin https://github.com/tgstation/BSQL -git fetch --depth 1 origin $BSQL_VERSION -git checkout FETCH_HEAD - -mkdir -p artifacts -cd artifacts -export CXX=g++-7 -# The -D will be unnecessary past BSQL v1.4.0.0 -cmake .. -DMARIA_LIBRARY=/usr/lib/i386-linux-gnu/libmariadb.so -make - -mkdir -p ~/.byond/bin -ln -s $PWD/src/BSQL/libBSQL.so ../../libBSQL.so diff --git a/tools/travis/install_libmariadb.sh b/tools/travis/install_libmariadb.sh deleted file mode 100755 index d0ce4adc145..00000000000 --- a/tools/travis/install_libmariadb.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/bash -set -euo pipefail - -# get libmariadb, cache it so limmex doesn't get angery -if [ -f $HOME/libmariadb ]; then - #travis likes to interpret the cache command as it being a file for some reason - rm $HOME/libmariadb -fi -mkdir -p $HOME/libmariadb -if [ ! -f $HOME/libmariadb/libmariadb.so ]; then - wget http://www.byond.com/download/db/mariadb_client-2.0.0-linux.tgz - tar -xvf mariadb_client-2.0.0-linux.tgz - mv mariadb_client-2.0.0-linux/libmariadb.so $HOME/libmariadb/libmariadb.so - rm -rf mariadb_client-2.0.0-linux.tgz mariadb_client-2.0.0-linux -fi diff --git a/tools/travis/install_rust_g.sh b/tools/travis/install_rust_g.sh index 227034af66a..2309f9d952a 100755 --- a/tools/travis/install_rust_g.sh +++ b/tools/travis/install_rust_g.sh @@ -4,5 +4,6 @@ set -euo pipefail source dependencies.sh mkdir -p ~/.byond/bin -wget -O ~/.byond/bin/rust_g "https://github.com/tgstation/rust-g/releases/download/$RUST_G_VERSION/librust_g.so" -chmod +x ~/.byond/bin/rust_g +wget -O ~/.byond/bin/librust_g.so "https://github.com/tgstation/rust-g/releases/download/$RUST_G_VERSION/librust_g.so" +chmod +x ~/.byond/bin/librust_g.so +ldd ~/.byond/bin/librust_g.so
AUTHORTITLECATEGORYSS13BN