From 0019f13a365dab5b17b6953f4bd75016f691cc41 Mon Sep 17 00:00:00 2001 From: Krausus Date: Mon, 27 Feb 2017 23:50:40 -0500 Subject: [PATCH 1/2] Makes karma and whitelist tables use ckeys --- code/game/jobs/whitelist.dm | 4 ++-- code/modules/karma/karma.dm | 32 ++++++++++++++++---------------- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/code/game/jobs/whitelist.dm b/code/game/jobs/whitelist.dm index 2a99414cb0b..7c9888ef920 100644 --- a/code/game/jobs/whitelist.dm +++ b/code/game/jobs/whitelist.dm @@ -27,7 +27,7 @@ var/list/whitelist = list() to_chat(usr, "\red Unable to connect to whitelist database. Please try again later.
") return 0 else - var/DBQuery/query = dbcon.NewQuery("SELECT job FROM [format_table_name("whitelist")] WHERE ckey='[M.key]'") + var/DBQuery/query = dbcon.NewQuery("SELECT job FROM [format_table_name("whitelist")] WHERE ckey='[M.ckey]'") query.Execute() @@ -72,7 +72,7 @@ var/list/whitelist = list() to_chat(usr, "\red Unable to connect to whitelist database. Please try again later.
") return 0 else - var/DBQuery/query = dbcon.NewQuery("SELECT species FROM [format_table_name("whitelist")] WHERE ckey='[M.key]'") + var/DBQuery/query = dbcon.NewQuery("SELECT species FROM [format_table_name("whitelist")] WHERE ckey='[M.ckey]'") query.Execute() while(query.NextRow()) diff --git a/code/modules/karma/karma.dm b/code/modules/karma/karma.dm index bdd73533c82..464ecd8ae23 100644 --- a/code/modules/karma/karma.dm +++ b/code/modules/karma/karma.dm @@ -1,8 +1,8 @@ proc/sql_report_karma(var/mob/spender, var/mob/receiver) var/sqlspendername = sanitizeSQL(spender.name) - var/sqlspenderkey = spender.key + var/sqlspenderkey = spender.ckey var/sqlreceivername = sanitizeSQL(receiver.name) - var/sqlreceiverkey = receiver.key + var/sqlreceiverkey = receiver.ckey var/sqlreceiverrole = "None" var/sqlreceiverspecial = "None" @@ -24,7 +24,7 @@ proc/sql_report_karma(var/mob/spender, var/mob/receiver) log_game("SQL ERROR during karma logging. Error : \[[err]\]\n") - query = dbcon.NewQuery("SELECT * FROM [format_table_name("karmatotals")] WHERE byondkey='[receiver.key]'") + query = dbcon.NewQuery("SELECT * FROM [format_table_name("karmatotals")] WHERE byondkey='[receiver.ckey]'") query.Execute() var/karma @@ -34,7 +34,7 @@ proc/sql_report_karma(var/mob/spender, var/mob/receiver) karma = text2num(query.item[3]) if(karma == null) karma = 1 - query = dbcon.NewQuery("INSERT INTO [format_table_name("karmatotals")] (byondkey, karma) VALUES ('[receiver.key]', [karma])") + query = dbcon.NewQuery("INSERT INTO [format_table_name("karmatotals")] (byondkey, karma) VALUES ('[receiver.ckey]', [karma])") if(!query.Execute()) var/err = query.ErrorMsg() log_game("SQL ERROR during karmatotal logging (adding new key). Error : \[[err]\]\n") @@ -55,7 +55,7 @@ var/list/karma_spenders = list() if(!ticker || !player_list.len || (ticker.current_state == GAME_STATE_PREGAME)) to_chat(src, "You can't award karma until the game has started.") return 0 - if(client.karma_spent || (key in karma_spenders)) + if(client.karma_spent || (ckey in karma_spenders)) to_chat(src, "You've already spent your karma for the round.") return 0 return 1 @@ -70,7 +70,7 @@ var/list/karma_spenders = list() if(!M.client) to_chat(src, "That mob has no client connected at the moment.") return 0 - if(key == M.key) + if(ckey == M.ckey) to_chat(src, "You can't spend karma on yourself!") return 0 if(client.address == M.client.address) @@ -128,7 +128,7 @@ var/list/karma_spenders = list() M.client.karma += 1 to_chat(usr, "Good karma spent on [M.name].") client.karma_spent = 1 - karma_spenders += key + karma_spenders += ckey var/special_role = "None" var/assigned_role = "None" @@ -157,7 +157,7 @@ var/list/karma_spenders = list() to_chat(usr, "\red Unable to connect to karma database. Please try again later.
") return else - var/DBQuery/query = dbcon.NewQuery("SELECT karma, karmaspent FROM [format_table_name("karmatotals")] WHERE byondkey='[src.key]'") + var/DBQuery/query = dbcon.NewQuery("SELECT karma, karmaspent FROM [format_table_name("karmatotals")] WHERE byondkey='[src.ckey]'") query.Execute() var/totalkarma @@ -258,7 +258,7 @@ You've gained [totalkarma] total karma in your time here.
"} return /client/proc/DB_job_unlock(var/job,var/cost) - var/DBQuery/query = dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.key]'") + var/DBQuery/query = dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.ckey]'") query.Execute() var/dbjob @@ -267,7 +267,7 @@ You've gained [totalkarma] total karma in your time here.
"} dbckey = query.item[2] dbjob = query.item[3] if(!dbckey) - query = dbcon.NewQuery("INSERT INTO [format_table_name("whitelist")] (ckey, job) VALUES ('[usr.key]','[job]')") + query = dbcon.NewQuery("INSERT INTO [format_table_name("whitelist")] (ckey, job) VALUES ('[usr.ckey]','[job]')") if(!query.Execute()) var/err = query.ErrorMsg() log_game("SQL ERROR during whitelist logging (adding new key). Error: \[[err]\]\n") @@ -298,7 +298,7 @@ You've gained [totalkarma] total karma in your time here.
"} return /client/proc/DB_species_unlock(var/species,var/cost) - var/DBQuery/query = dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.key]'") + var/DBQuery/query = dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.ckey]'") query.Execute() var/dbspecies @@ -307,7 +307,7 @@ You've gained [totalkarma] total karma in your time here.
"} dbckey = query.item[2] dbspecies = query.item[4] if(!dbckey) - query = dbcon.NewQuery("INSERT INTO [format_table_name("whitelist")] (ckey, species) VALUES ('[usr.key]','[species]')") + query = dbcon.NewQuery("INSERT INTO [format_table_name("whitelist")] (ckey, species) VALUES ('[usr.ckey]','[species]')") if(!query.Execute()) var/err = query.ErrorMsg() log_game("SQL ERROR during whitelist logging (adding new key). Error : \[[err]\]\n") @@ -338,7 +338,7 @@ You've gained [totalkarma] total karma in your time here.
"} return /client/proc/karmacharge(var/cost,var/refund = 0) - var/DBQuery/query = dbcon.NewQuery("SELECT * FROM [format_table_name("karmatotals")] WHERE byondkey='[usr.key]'") + var/DBQuery/query = dbcon.NewQuery("SELECT * FROM [format_table_name("karmatotals")] WHERE byondkey='[usr.ckey]'") query.Execute() while(query.NextRow()) @@ -347,7 +347,7 @@ You've gained [totalkarma] total karma in your time here.
"} spent -= cost else spent += cost - query = dbcon.NewQuery("UPDATE [format_table_name("karmatotals")] SET karmaspent=[spent] WHERE byondkey='[usr.key]'") + query = dbcon.NewQuery("UPDATE [format_table_name("karmatotals")] SET karmaspent=[spent] WHERE byondkey='[usr.ckey]'") if(!query.Execute()) var/err = query.ErrorMsg() log_game("SQL ERROR during karmaspent updating (updating existing entry). Error: \[[err]\]\n") @@ -383,7 +383,7 @@ You've gained [totalkarma] total karma in your time here.
"} to_chat(usr, "\red That job is not refundable.") return - var/DBQuery/query = dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.key]'") + var/DBQuery/query = dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.ckey]'") query.Execute() var/dbjob @@ -423,7 +423,7 @@ You've gained [totalkarma] total karma in your time here.
"} to_chat(usr, "\red Your ckey ([dbckey]) was not found.") /client/proc/checkpurchased(var/name = null) // If the first parameter is null, return a full list of purchases - var/DBQuery/query = dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.key]'") + var/DBQuery/query = dbcon.NewQuery("SELECT * FROM [format_table_name("whitelist")] WHERE ckey='[usr.ckey]'") query.Execute() var/dbjob From 2373aa619426ad8046c85b180cd7810b96fe1749 Mon Sep 17 00:00:00 2001 From: Krausus Date: Tue, 28 Feb 2017 00:49:54 -0500 Subject: [PATCH 2/2] Makes notes table always use ckeys This replaces several sanitizeSQL calls with ckey calls, which effectively sanitizes on its own. Admin ckeys are not ckeyized if they don't actually match the admin's ckey, which only really happens with specific automated notes. --- code/modules/admin/sql_notes.dm | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/code/modules/admin/sql_notes.dm b/code/modules/admin/sql_notes.dm index 338993af58c..7b237db72e5 100644 --- a/code/modules/admin/sql_notes.dm +++ b/code/modules/admin/sql_notes.dm @@ -8,7 +8,7 @@ var/new_ckey = ckey(input(usr,"Who would you like to add a note for?","Enter a ckey",null) as text|null) if(!new_ckey) return - new_ckey = sanitizeSQL(new_ckey) + new_ckey = ckey(new_ckey) var/DBQuery/query_find_ckey = dbcon.NewQuery("SELECT ckey FROM [format_table_name("player")] WHERE ckey = '[new_ckey]'") if(!query_find_ckey.Execute()) var/err = query_find_ckey.ErrorMsg() @@ -19,7 +19,7 @@ return else target_ckey = new_ckey - var/target_sql_ckey = sanitizeSQL(target_ckey) + var/target_sql_ckey = ckey(target_ckey) if(!notetext) notetext = input(usr,"Write your note","Add Note") as message|null if(!notetext) @@ -31,6 +31,8 @@ adminckey = usr.ckey if(!adminckey) return + else if(usr && (usr.ckey == ckey(adminckey))) // Don't ckeyize special note sources + adminckey = ckey(adminckey) var/admin_sql_ckey = sanitizeSQL(adminckey) if(!server) if(config && config.server_name) @@ -86,7 +88,7 @@ return note_id = text2num(note_id) var/target_ckey - var/sql_ckey = sanitizeSQL(usr.ckey) + var/sql_ckey = usr.ckey var/DBQuery/query_find_note_edit = dbcon.NewQuery("SELECT ckey, notetext, adminckey FROM [format_table_name("notes")] WHERE id = [note_id]") if(!query_find_note_edit.Execute()) var/err = query_find_note_edit.ErrorMsg() @@ -128,7 +130,7 @@ if(!linkless) output = navbar if(target_ckey) - var/target_sql_ckey = sanitizeSQL(target_ckey) + var/target_sql_ckey = ckey(target_ckey) var/DBQuery/query_get_notes = dbcon.NewQuery("SELECT id, timestamp, notetext, adminckey, last_editor, server FROM [format_table_name("notes")] WHERE ckey = '[target_sql_ckey]' ORDER BY timestamp") if(!query_get_notes.Execute()) var/err = query_get_notes.ErrorMsg() @@ -179,7 +181,7 @@ usr << browse(output, "window=show_notes;size=900x500") /proc/show_player_info_irc(var/key as text) - var/target_sql_ckey = sanitizeSQL(key) + var/target_sql_ckey = ckey(key) var/DBQuery/query_get_notes = dbcon.NewQuery("SELECT timestamp, notetext, adminckey, server FROM [format_table_name("notes")] WHERE ckey = '[target_sql_ckey]' ORDER BY timestamp") if(!query_get_notes.Execute()) var/err = query_get_notes.ErrorMsg()