From afbeb03d9fab9bdab27f8a6f8a183062543724cc Mon Sep 17 00:00:00 2001 From: MrStonedOne Date: Wed, 29 Oct 2014 18:19:47 -0700 Subject: [PATCH] Fixes admin only vv related sql injection exploit in feedback reporting. Noticed this while looking over my PR, by storing (and trusting) the escaped version, an admin could edit this in vv and do unspeakable things to the database --- code/modules/research/message_server.dm | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/code/modules/research/message_server.dm b/code/modules/research/message_server.dm index 240e1d144ce..9bcc805b2c6 100644 --- a/code/modules/research/message_server.dm +++ b/code/modules/research/message_server.dm @@ -147,6 +147,8 @@ var/global/list/obj/machinery/message_server/message_servers = list() value = num /datum/feedback_variable/proc/get_value() + if (!isnum(value)) + return 0 return value /datum/feedback_variable/proc/get_variable() @@ -292,7 +294,7 @@ var/obj/machinery/blackbox_recorder/blackbox if (sqlrowlist != "") sqlrowlist += ", " //a comma (,) at the start of the first row to insert will trigger a SQL error - sqlrowlist += "(null, Now(), [round_id], \"[FV.get_variable()]\", [FV.get_value()], \"[FV.get_details()]\")" + sqlrowlist += "(null, Now(), [round_id], \"[sanitizeSQL(FV.get_variable())]\", [FV.get_value()], \"[sanitizeSQL(FV.get_details())]\")" if (sqlrowlist == "") return @@ -304,8 +306,6 @@ var/obj/machinery/blackbox_recorder/blackbox proc/feedback_set(var/variable,var/value) if (!blackbox) return - variable = sanitizeSQL(variable) - var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable) if (!FV) return @@ -315,8 +315,6 @@ proc/feedback_set(var/variable,var/value) proc/feedback_inc(var/variable,var/value) if (!blackbox) return - variable = sanitizeSQL(variable) - var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable) if (!FV) return @@ -326,8 +324,6 @@ proc/feedback_inc(var/variable,var/value) proc/feedback_dec(var/variable,var/value) if (!blackbox) return - variable = sanitizeSQL(variable) - var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable) if (!FV) return @@ -337,9 +333,6 @@ proc/feedback_dec(var/variable,var/value) proc/feedback_set_details(var/variable,var/details) if (!blackbox) return - variable = sanitizeSQL(variable) - details = sanitizeSQL(details) - var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable) if(!FV) return @@ -349,9 +342,6 @@ proc/feedback_set_details(var/variable,var/details) proc/feedback_add_details(var/variable,var/details) if (!blackbox) return - variable = sanitizeSQL(variable) - details = sanitizeSQL(details) - var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable) if (!FV) return