cyberpresidentvanellope/Paradise
1
0
Fork 0
mirror of https://github.com/ParadiseSS13/Paradise.git synced 2026-07-17 18:13:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

Makes notes table always use ckeys

Browse Source 
This replaces several sanitizeSQL calls with ckey calls, which
effectively sanitizes on its own.

Admin ckeys are not ckeyized if they don't actually match the admin's
ckey, which only really happens with specific automated notes.
This commit is contained in:
Krausus
2017-02-28 00:49:54 -05:00
parent 0019f13a36
commit 2373aa6194
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/sql_notes.dm
+7 -5
View File
@@ -8,7 +8,7 @@
var/new_ckey = ckey(input(usr,"Who would you like to add a note for?","Enter a ckey",null) as text|null)
if(!new_ckey)
return
new_ckey = sanitizeSQL(new_ckey)
new_ckey = ckey(new_ckey)
var/DBQuery/query_find_ckey = dbcon.NewQuery("SELECT ckey FROM [format_table_name("player")] WHERE ckey = '[new_ckey]'")
if(!query_find_ckey.Execute())
var/err = query_find_ckey.ErrorMsg()
@@ -19,7 +19,7 @@
return
else
target_ckey = new_ckey
var/target_sql_ckey = sanitizeSQL(target_ckey)
var/target_sql_ckey = ckey(target_ckey)
if(!notetext)
notetext = input(usr,"Write your note","Add Note") as message|null
if(!notetext)
@@ -31,6 +31,8 @@
adminckey = usr.ckey
if(!adminckey)
return
else if(usr && (usr.ckey == ckey(adminckey))) // Don't ckeyize special note sources
adminckey = ckey(adminckey)
var/admin_sql_ckey = sanitizeSQL(adminckey)
if(!server)
if(config && config.server_name)
@@ -86,7 +88,7 @@
return
note_id = text2num(note_id)
var/target_ckey
var/sql_ckey = sanitizeSQL(usr.ckey)
var/sql_ckey = usr.ckey
var/DBQuery/query_find_note_edit = dbcon.NewQuery("SELECT ckey, notetext, adminckey FROM [format_table_name("notes")] WHERE id = [note_id]")
if(!query_find_note_edit.Execute())
var/err = query_find_note_edit.ErrorMsg()
@@ -128,7 +130,7 @@
if(!linkless)
output = navbar
if(target_ckey)
var/target_sql_ckey = sanitizeSQL(target_ckey)
var/target_sql_ckey = ckey(target_ckey)
var/DBQuery/query_get_notes = dbcon.NewQuery("SELECT id, timestamp, notetext, adminckey, last_editor, server FROM [format_table_name("notes")] WHERE ckey = '[target_sql_ckey]' ORDER BY timestamp")
if(!query_get_notes.Execute())
var/err = query_get_notes.ErrorMsg()
@@ -179,7 +181,7 @@
usr << browse(output, "window=show_notes;size=900x500")
/proc/show_player_info_irc(var/key as text)
var/target_sql_ckey = sanitizeSQL(key)
var/target_sql_ckey = ckey(key)
var/DBQuery/query_get_notes = dbcon.NewQuery("SELECT timestamp, notetext, adminckey, server FROM [format_table_name("notes")] WHERE ckey = '[target_sql_ckey]' ORDER BY timestamp")
if(!query_get_notes.Execute())
var/err = query_get_notes.ErrorMsg()