cyberpresidentvanellope/Paradise
1
0
Fork 0
mirror of https://github.com/ParadiseSS13/Paradise.git synced 2026-07-19 19:13:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Conflict resolution and adds sanitization to marking SQL handling.

Browse Source
This commit is contained in:
KasparoVy
2016-08-20 09:26:37 -04:00
parent 44bf253594 ce58dc1366
commit 9bc614a28e
74 changed files with 461 additions and 205 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/modules/client/client procs.dm
+7 -9
View File
@@ -368,9 +368,7 @@
if(!dbcon.IsConnected())
return
var/sql_ckey = sql_sanitize_text(src.ckey)
var/DBQuery/query = dbcon.NewQuery("SELECT id, datediff(Now(),firstseen) as age FROM [format_table_name("player")] WHERE ckey = '[sql_ckey]'")
var/DBQuery/query = dbcon.NewQuery("SELECT id, datediff(Now(),firstseen) as age FROM [format_table_name("player")] WHERE ckey = '[ckey]'")
query.Execute()
var/sql_id = 0
player_age = 0 // New players won't have an entry so knowing we have a connection we set this to zero to be updated if their is a record.
@@ -397,7 +395,7 @@
if(related_accounts_cid.len)
log_access("Alts: [key_name(src)]:[jointext(related_accounts_cid, " - ")]")
var/watchreason = check_watchlist(sql_ckey)
var/watchreason = check_watchlist(ckey)
if(watchreason)
message_admins("<font color='red'><B>Notice: </B></font><font color='blue'>[key_name_admin(src)] is on the watchlist and has just connected - Reason: [watchreason]</font>")
send2adminirc("Watchlist - [key_name(src)] is on the watchlist and has just connected - Reason: [watchreason]")
@@ -413,9 +411,9 @@
if(src.holder)
admin_rank = src.holder.rank
var/sql_ip = sql_sanitize_text(src.address)
var/sql_computerid = sql_sanitize_text(src.computer_id)
var/sql_admin_rank = sql_sanitize_text(admin_rank)
var/sql_ip = sanitizeSQL(address)
var/sql_computerid = sanitizeSQL(computer_id)
var/sql_admin_rank = sanitizeSQL(admin_rank)
if(sql_id)
@@ -424,12 +422,12 @@
query_update.Execute()
else
//New player!! Need to insert all the stuff
var/DBQuery/query_insert = dbcon.NewQuery("INSERT INTO [format_table_name("player")] (id, ckey, firstseen, lastseen, ip, computerid, lastadminrank) VALUES (null, '[sql_ckey]', Now(), Now(), '[sql_ip]', '[sql_computerid]', '[sql_admin_rank]')")
var/DBQuery/query_insert = dbcon.NewQuery("INSERT INTO [format_table_name("player")] (id, ckey, firstseen, lastseen, ip, computerid, lastadminrank) VALUES (null, '[ckey]', Now(), Now(), '[sql_ip]', '[sql_computerid]', '[sql_admin_rank]')")
query_insert.Execute()
//Logging player access
var/serverip = "[world.internet_address]:[world.port]"
var/DBQuery/query_accesslog = dbcon.NewQuery("INSERT INTO `[format_table_name("connection_log")]`(`id`,`datetime`,`serverip`,`ckey`,`ip`,`computerid`) VALUES(null,Now(),'[serverip]','[sql_ckey]','[sql_ip]','[sql_computerid]');")
var/DBQuery/query_accesslog = dbcon.NewQuery("INSERT INTO `[format_table_name("connection_log")]`(`id`,`datetime`,`serverip`,`ckey`,`ip`,`computerid`) VALUES(null,Now(),'[serverip]','[ckey]','[sql_ip]','[sql_computerid]');")
query_accesslog.Execute()
code/modules/client/preference/preferences.dm
+1 -6
View File
@@ -1890,12 +1890,7 @@ var/global/list/special_role_times = list( //minimum age (in days) for accounts
if("be_special")
var/r = href_list["role"]
if(!(r in special_roles))
var/cleaned_r = sql_sanitize_text(r)
if(r != cleaned_r) // up to no good
message_admins("[user] attempted an href exploit! (This could have possibly lead to a \"Bobby Tables\" exploit, so they're probably up to no good). String: [r] ID: [last_id] IP: [last_ip]")
to_chat(user, "<span class='userdanger'>Stop right there, criminal scum</span>")
else
if(r in special_roles)
be_special ^= r
if("name")
code/modules/client/preference/preferences_mysql.dm
+50 -24
View File
@@ -70,7 +70,7 @@
UI_style='[UI_style]',
UI_style_color='[UI_style_color]',
UI_style_alpha='[UI_style_alpha]',
be_role='[list2params(sql_sanitize_text_list(be_special))]',
be_role='[sanitizeSQL(list2params(be_special))]',
default_slot='[default_slot]',
toggles='[toggles]',
sound='[sound]',
@@ -237,6 +237,15 @@
med_record = query.item[54]
sec_record = query.item[55]
gen_record = query.item[56]
// Apparently, the preceding vars weren't always encoded properly...
if(findtext(flavor_text, "<")) // ... so let's clumsily check for tags!
flavor_text = html_encode(flavor_text)
if(findtext(med_record, "<"))
med_record = html_encode(med_record)
if(findtext(sec_record, "<"))
sec_record = html_encode(sec_record)
if(findtext(gen_record, "<"))
gen_record = html_encode(gen_record)
disabilities = text2num(query.item[57])
player_alt_titles = params2list(query.item[58])
organ_data = params2list(query.item[59])
@@ -276,11 +285,15 @@
r_skin = sanitize_integer(r_skin, 0, 255, initial(r_skin))
g_skin = sanitize_integer(g_skin, 0, 255, initial(g_skin))
b_skin = sanitize_integer(b_skin, 0, 255, initial(b_skin))
for(var/marking_location in m_colours)
m_colours[marking_location] = sanitize_hexcolor(m_colours[marking_location], DEFAULT_MARKING_COLOURS[marking_location])
r_headacc = sanitize_integer(r_headacc, 0, 255, initial(r_headacc))
g_headacc = sanitize_integer(g_headacc, 0, 255, initial(g_headacc))
b_headacc = sanitize_integer(b_headacc, 0, 255, initial(b_headacc))
h_style = sanitize_inlist(h_style, hair_styles_list, initial(h_style))
f_style = sanitize_inlist(f_style, facial_hair_styles_list, initial(f_style))
for(var/marking_location in m_styles)
m_styles[marking_location] = sanitize_inlist(m_styles[marking_location], marking_styles_list, DEFAULT_MARKING_STYLES[marking_location])
ha_style = sanitize_inlist(ha_style, head_accessory_styles_list, initial(ha_style))
alt_head = sanitize_inlist(alt_head, alt_heads_list, initial(alt_head))
r_eyes = sanitize_integer(r_eyes, 0, 255, initial(r_eyes))
@@ -313,8 +326,6 @@
if(!player_alt_titles) player_alt_titles = new()
if(!organ_data) src.organ_data = list()
if(!rlimb_data) src.rlimb_data = list()
if(!m_colours) m_colours = DEFAULT_MARKING_COLOURS
if(!m_styles) m_styles = DEFAULT_MARKING_STYLES
if(!gear) gear = list()
return 1
@@ -324,6 +335,7 @@
var/rlimblist
var/playertitlelist
var/gearlist
var/markingcolourslist = list2params(m_colours)
var/markingstyleslist = list2params(m_styles)
if(!isemptylist(organ_data))
@@ -339,13 +351,13 @@
firstquery.Execute()
while(firstquery.NextRow())
if(text2num(firstquery.item[1]) == default_slot)
var/DBQuery/query = dbcon.NewQuery({"UPDATE [format_table_name("characters")] SET OOC_Notes='[sql_sanitize_text(metadata)]',
real_name='[sql_sanitize_text(real_name)]',
var/DBQuery/query = dbcon.NewQuery({"UPDATE [format_table_name("characters")] SET OOC_Notes='[sanitizeSQL(metadata)]',
real_name='[sanitizeSQL(real_name)]',
name_is_always_random='[be_random_name]',
gender='[gender]',
age='[age]',
species='[sql_sanitize_text(species)]',
language='[sql_sanitize_text(language)]',
species='[sanitizeSQL(species)]',
language='[sanitizeSQL(language)]',
hair_red='[r_hair]',
hair_green='[g_hair]',
hair_blue='[b_hair]',
@@ -362,15 +374,15 @@
skin_red='[r_skin]',
skin_green='[g_skin]',
skin_blue='[b_skin]',
marking_colours='[markingcolourslist]',
marking_colours='[sanitizeSQL(markingcolourslist)]',
head_accessory_red='[r_headacc]',
head_accessory_green='[g_headacc]',
head_accessory_blue='[b_headacc]',
hair_style_name='[sql_sanitize_text(h_style)]',
facial_style_name='[sql_sanitize_text(f_style)]',
marking_styles='[markingstyleslist]',
head_accessory_style_name='[sql_sanitize_text(ha_style)]',
alt_head_name='[sql_sanitize_text(alt_head)]',
hair_style_name='[sanitizeSQL(h_style)]',
facial_style_name='[sanitizeSQL(f_style)]',
marking_styles='[sanitizeSQL(markingstyleslist)]',
head_accessory_style_name='[sanitizeSQL(ha_style)]',
alt_head_name='[sanitizeSQL(alt_head)]',
eyes_red='[r_eyes]',
eyes_green='[g_eyes]',
eyes_blue='[b_eyes]',
@@ -391,10 +403,10 @@
job_karma_high='[job_karma_high]',
job_karma_med='[job_karma_med]',
job_karma_low='[job_karma_low]',
flavor_text='[sql_sanitize_text(html_decode(flavor_text))]',
med_record='[sql_sanitize_text(html_decode(med_record))]',
sec_record='[sql_sanitize_text(html_decode(sec_record))]',
gen_record='[sql_sanitize_text(html_decode(gen_record))]',
flavor_text='[sanitizeSQL(flavor_text)]',
med_record='[sanitizeSQL(med_record)]',
sec_record='[sanitizeSQL(sec_record)]',
gen_record='[sanitizeSQL(gen_record)]',
player_alt_titles='[playertitlelist]',
disabilities='[disabilities]',
organ_data='[organlist]',
@@ -425,7 +437,11 @@
skin_tone, skin_red, skin_green, skin_blue,
marking_colours,
head_accessory_red, head_accessory_green, head_accessory_blue,
hair_style_name, facial_style_name, marking_styles, head_accessory_style_name, alt_head_name,
hair_style_name,
facial_style_name,
marking_styles,
head_accessory_style_name,
alt_head_name,
eyes_red, eyes_green, eyes_blue,
underwear, undershirt,
backbag, b_type, alternate_option,
@@ -433,22 +449,29 @@
job_medsci_high, job_medsci_med, job_medsci_low,
job_engsec_high, job_engsec_med, job_engsec_low,
job_karma_high, job_karma_med, job_karma_low,
flavor_text, med_record, sec_record, gen_record,
flavor_text,
med_record,
sec_record,
gen_record,
player_alt_titles,
disabilities, organ_data, rlimb_data, nanotrasen_relation, speciesprefs,
socks, body_accessory, gear)
VALUES
('[C.ckey]', '[default_slot]', '[sql_sanitize_text(metadata)]', '[sql_sanitize_text(real_name)]', '[be_random_name]','[gender]',
'[age]', '[sql_sanitize_text(species)]', '[sql_sanitize_text(language)]',
('[C.ckey]', '[default_slot]', '[sanitizeSQL(metadata)]', '[sanitizeSQL(real_name)]', '[be_random_name]','[gender]',
'[age]', '[sanitizeSQL(species)]', '[sanitizeSQL(language)]',
'[r_hair]', '[g_hair]', '[b_hair]',
'[r_hair_sec]', '[g_hair_sec]', '[b_hair_sec]',
'[r_facial]', '[g_facial]', '[b_facial]',
'[r_facial_sec]', '[g_facial_sec]', '[b_facial_sec]',
'[s_tone]', '[r_skin]', '[g_skin]', '[b_skin]',
'[markingcolourslist]',
'[sanitizeSQL(markingcolourslist)]',
'[r_headacc]', '[g_headacc]', '[b_headacc]',
'[sql_sanitize_text(h_style)]', '[sql_sanitize_text(f_style)]', '[markingstyleslist]', '[sql_sanitize_text(ha_style)]', '[sql_sanitize_text(alt_head)]',
'[sanitizeSQL(h_style)]',
'[sanitizeSQL(f_style)]',
'[sanitizeSQL(markingstyleslist)]',
'[sanitizeSQL(ha_style)]',
'[sanitizeSQL(alt_head)]',
'[r_eyes]', '[g_eyes]', '[b_eyes]',
'[underwear]', '[undershirt]',
'[backbag]', '[b_type]', '[alternate_option]',
@@ -456,7 +479,10 @@
'[job_medsci_high]', '[job_medsci_med]', '[job_medsci_low]',
'[job_engsec_high]', '[job_engsec_med]', '[job_engsec_low]',
'[job_karma_high]', '[job_karma_med]', '[job_karma_low]',
'[sql_sanitize_text(html_encode(flavor_text))]', '[sql_sanitize_text(html_encode(med_record))]', '[sql_sanitize_text(html_encode(sec_record))]', '[sql_sanitize_text(html_encode(gen_record))]',
'[sanitizeSQL(flavor_text)]',
'[sanitizeSQL(med_record)]',
'[sanitizeSQL(sec_record)]',
'[sanitizeSQL(gen_record)]',
'[playertitlelist]',
'[disabilities]', '[organlist]', '[rlimblist]', '[nanotrasen_relation]', '[speciesprefs]',
'[socks]', '[body_accessory]', '[gearlist]')