cyberpresidentvanellope/Paradise
1
0
Fork 0
mirror of https://github.com/ParadiseSS13/Paradise.git synced 2026-07-20 03:25:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

SQL sanitization fixes

Browse Source 
- Completely removes sql_sanitize_text
- Fixes inconsistent encoding of flavor and records texts
- Adds some extra sanity checking to sanitizeSQL
This commit is contained in:
Krausus
2016-08-19 19:58:32 -04:00
parent 2e9cd28ad7
commit 98989aa19c
9 changed files with 65 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/admin/DB ban/functions.dm
+5 -5
View File
@@ -113,7 +113,7 @@ datum/admins/proc/DB_ban_record(var/bantype, var/mob/banned_mob, var/duration =
else
adminwho += ", [C]"
reason = sql_sanitize_text(reason)
reason = sanitizeSQL(reason)
if(maxadminbancheck)
var/DBQuery/adm_query = dbcon.NewQuery("SELECT count(id) AS num FROM [format_table_name("ban")] WHERE (a_ckey = '[a_ckey]') AND (bantype = 'ADMIN_PERMABAN' OR (bantype = 'ADMIN_TEMPBAN' AND expiration_time > Now())) AND isnull(unbanned)")
@@ -244,14 +244,14 @@ datum/admins/proc/DB_ban_edit(var/banid = null, var/param = null)
to_chat(usr, "Invalid ban id. Contact the database admin")
return
reason = sql_sanitize_text(reason)
reason = sanitizeSQL(reason)
var/value
switch(param)
if("reason")
if(!value)
value = input("Insert the new reason for [pckey]'s ban", "New Reason", "[reason]", null) as null|text
value = sql_sanitize_text(value)
value = sanitizeSQL(value)
if(!value)
to_chat(usr, "Cancelled")
return
@@ -417,8 +417,8 @@ datum/admins/proc/DB_ban_unban_by_id(var/id)
adminckey = ckey(adminckey)
playerckey = ckey(playerckey)
playerip = sql_sanitize_text(playerip)
playercid = sql_sanitize_text(playercid)
playerip = sanitizeSQL(playerip)
playercid = sanitizeSQL(playercid)
if(adminckey || playerckey || playerip || playercid || dbbantype)
code/modules/admin/banappearance.dm
-15
View File
@@ -92,18 +92,3 @@ DEBUG
appearance_savebanfile()
return 1
return 0
/*
proc/DB_ban_isappearancebanned(var/playerckey)
establish_db_connection()
if(!dbcon.IsConnected())
return
var/sqlplayerckey = sql_sanitize_text(ckey(playerckey))
var/DBQuery/query = dbcon.NewQuery("SELECT id FROM [format_table_name("ban")] WHERE CKEY = '[sqlplayerckey]' AND ((bantype = 'APPEARANCE_BAN') OR (bantype = 'APPEARANCE_TEMPBAN' AND expiration_time > Now())) AND unbanned != 1")
query.Execute()
while(query.NextRow())
return 1
return 0
*/