cyberpresidentvanellope/Paradise
1
0
Fork 0
mirror of https://github.com/ParadiseSS13/Paradise.git synced 2026-07-20 11:34:19 +01:00
Code Issues Packages Projects Releases Wiki Activity

Added Sanitized message server input for some injection safety...

Browse Source 
git-svn-id: http://tgstation13.googlecode.com/svn/trunk@2458 316c924e-a436-60f5-8080-3fe189b3f50e
This commit is contained in:
baloh.matevz
2011-10-30 18:57:25 +00:00
parent 1f9a77c377
commit 6b452ac175
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/research/message_server.dm
+16
View File
@@ -184,9 +184,18 @@ var/obj/machinery/blackbox_recorder/blackbox
dbcon.Disconnect()
// Sanitize inputs to avoid SQL injection attacks
proc/sql_sanitize_text(var/text)
text = dd_replacetext(text, "'", "''")
text = dd_replacetext(text, ";", "")
text = dd_replacetext(text, "&", "")
return text
proc/feedback_set(var/variable,var/value)
if(!blackbox) return
variable = sql_sanitize_text(variable)
var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
if(!FV) return
@@ -196,6 +205,8 @@ proc/feedback_set(var/variable,var/value)
proc/feedback_inc(var/variable,var/value)
if(!blackbox) return
variable = sql_sanitize_text(variable)
var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
if(!FV) return
@@ -205,6 +216,8 @@ proc/feedback_inc(var/variable,var/value)
proc/feedback_dec(var/variable,var/value)
if(!blackbox) return
variable = sql_sanitize_text(variable)
var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
if(!FV) return
@@ -214,6 +227,9 @@ proc/feedback_dec(var/variable,var/value)
proc/feedback_set_details(var/variable,var/details)
if(!blackbox) return
variable = sql_sanitize_text(variable)
details = sql_sanitize_text(details)
var/datum/feedback_variable/FV = blackbox.find_feedback_datum(variable)
if(!FV) return