From 2373aa619426ad8046c85b180cd7810b96fe1749 Mon Sep 17 00:00:00 2001 From: Krausus Date: Tue, 28 Feb 2017 00:49:54 -0500 Subject: [PATCH] Makes notes table always use ckeys This replaces several sanitizeSQL calls with ckey calls, which effectively sanitizes on its own. Admin ckeys are not ckeyized if they don't actually match the admin's ckey, which only really happens with specific automated notes. --- code/modules/admin/sql_notes.dm | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/code/modules/admin/sql_notes.dm b/code/modules/admin/sql_notes.dm index 338993af58c..7b237db72e5 100644 --- a/code/modules/admin/sql_notes.dm +++ b/code/modules/admin/sql_notes.dm @@ -8,7 +8,7 @@ var/new_ckey = ckey(input(usr,"Who would you like to add a note for?","Enter a ckey",null) as text|null) if(!new_ckey) return - new_ckey = sanitizeSQL(new_ckey) + new_ckey = ckey(new_ckey) var/DBQuery/query_find_ckey = dbcon.NewQuery("SELECT ckey FROM [format_table_name("player")] WHERE ckey = '[new_ckey]'") if(!query_find_ckey.Execute()) var/err = query_find_ckey.ErrorMsg() @@ -19,7 +19,7 @@ return else target_ckey = new_ckey - var/target_sql_ckey = sanitizeSQL(target_ckey) + var/target_sql_ckey = ckey(target_ckey) if(!notetext) notetext = input(usr,"Write your note","Add Note") as message|null if(!notetext) @@ -31,6 +31,8 @@ adminckey = usr.ckey if(!adminckey) return + else if(usr && (usr.ckey == ckey(adminckey))) // Don't ckeyize special note sources + adminckey = ckey(adminckey) var/admin_sql_ckey = sanitizeSQL(adminckey) if(!server) if(config && config.server_name) @@ -86,7 +88,7 @@ return note_id = text2num(note_id) var/target_ckey - var/sql_ckey = sanitizeSQL(usr.ckey) + var/sql_ckey = usr.ckey var/DBQuery/query_find_note_edit = dbcon.NewQuery("SELECT ckey, notetext, adminckey FROM [format_table_name("notes")] WHERE id = [note_id]") if(!query_find_note_edit.Execute()) var/err = query_find_note_edit.ErrorMsg() @@ -128,7 +130,7 @@ if(!linkless) output = navbar if(target_ckey) - var/target_sql_ckey = sanitizeSQL(target_ckey) + var/target_sql_ckey = ckey(target_ckey) var/DBQuery/query_get_notes = dbcon.NewQuery("SELECT id, timestamp, notetext, adminckey, last_editor, server FROM [format_table_name("notes")] WHERE ckey = '[target_sql_ckey]' ORDER BY timestamp") if(!query_get_notes.Execute()) var/err = query_get_notes.ErrorMsg() @@ -179,7 +181,7 @@ usr << browse(output, "window=show_notes;size=900x500") /proc/show_player_info_irc(var/key as text) - var/target_sql_ckey = sanitizeSQL(key) + var/target_sql_ckey = ckey(key) var/DBQuery/query_get_notes = dbcon.NewQuery("SELECT timestamp, notetext, adminckey, server FROM [format_table_name("notes")] WHERE ckey = '[target_sql_ckey]' ORDER BY timestamp") if(!query_get_notes.Execute()) var/err = query_get_notes.ErrorMsg()