From 6b452ac175a9fa2c6ef5b6ecce5f3894f10e013a Mon Sep 17 00:00:00 2001 From: "baloh.matevz" Date: Sun, 30 Oct 2011 18:57:25 +0000 Subject: [PATCH] Added Sanitized message server input for some injection safety... git-svn-id: http://tgstation13.googlecode.com/svn/trunk@2458 316c924e-a436-60f5-8080-3fe189b3f50e --- code/modules/research/message_server.dm | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/code/modules/research/message_server.dm b/code/modules/research/message_server.dm index 4b7ca85e7d4..f9d992b5489 100644 --- a/code/modules/research/message_server.dm +++ b/code/modules/research/message_server.dm @@ -184,9 +184,18 @@ var/obj/machinery/blackbox_recorder/blackbox dbcon.Disconnect() +// Sanitize inputs to avoid SQL injection attacks +proc/sql_sanitize_text(var/text) + text = dd_replacetext(text, "'", "''") + text = dd_replacetext(text, ";", "") + text = dd_replacetext(text, "&", "") + return text + proc/feedback_set(var/variable,var/value) if(!blackbox) return + variable = sql_sanitize_text(variable) + var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable) if(!FV) return @@ -196,6 +205,8 @@ proc/feedback_set(var/variable,var/value) proc/feedback_inc(var/variable,var/value) if(!blackbox) return + variable = sql_sanitize_text(variable) + var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable) if(!FV) return @@ -205,6 +216,8 @@ proc/feedback_inc(var/variable,var/value) proc/feedback_dec(var/variable,var/value) if(!blackbox) return + variable = sql_sanitize_text(variable) + var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable) if(!FV) return @@ -214,6 +227,9 @@ proc/feedback_dec(var/variable,var/value) proc/feedback_set_details(var/variable,var/details) if(!blackbox) return + variable = sql_sanitize_text(variable) + details = sql_sanitize_text(details) + var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable) if(!FV) return