Conflict resolution and adds sanitization to marking SQL handling.

2026-07-20 03:25:49 +01:00 · 2016-08-20 09:26:37 -04:00
parent 44bf253594 ce58dc1366
commit 9bc614a28e
74 changed files with 461 additions and 205 deletions
@@ -1890,12 +1890,7 @@ var/global/list/special_role_times = list( //minimum age (in days) for accounts

 				if("be_special")
 					var/r = href_list["role"]
-					if(!(r in special_roles))
-						var/cleaned_r = sql_sanitize_text(r)
-						if(r != cleaned_r) // up to no good
-							message_admins("[user] attempted an href exploit! (This could have possibly lead to a \"Bobby Tables\" exploit, so they're probably up to no good). String: [r] ID: [last_id] IP: [last_ip]")
-							to_chat(user, "<span class='userdanger'>Stop right there, criminal scum</span>")
-					else
+					if(r in special_roles)
 						be_special ^= r

 				if("name")
@@ -70,7 +70,7 @@
 					UI_style='[UI_style]',
 					UI_style_color='[UI_style_color]',
 					UI_style_alpha='[UI_style_alpha]',
-					be_role='[list2params(sql_sanitize_text_list(be_special))]',
+					be_role='[sanitizeSQL(list2params(be_special))]',
 					default_slot='[default_slot]',
 					toggles='[toggles]',
 					sound='[sound]',
@@ -237,6 +237,15 @@
 		med_record = query.item[54]
 		sec_record = query.item[55]
 		gen_record = query.item[56]
+		// Apparently, the preceding vars weren't always encoded properly...
+		if(findtext(flavor_text, "<")) // ... so let's clumsily check for tags!
+			flavor_text = html_encode(flavor_text)
+		if(findtext(med_record, "<"))
+			med_record = html_encode(med_record)
+		if(findtext(sec_record, "<"))
+			sec_record = html_encode(sec_record)
+		if(findtext(gen_record, "<"))
+			gen_record = html_encode(gen_record)
 		disabilities = text2num(query.item[57])
 		player_alt_titles = params2list(query.item[58])
 		organ_data = params2list(query.item[59])
@@ -276,11 +285,15 @@
 	r_skin			= sanitize_integer(r_skin, 0, 255, initial(r_skin))
 	g_skin			= sanitize_integer(g_skin, 0, 255, initial(g_skin))
 	b_skin			= sanitize_integer(b_skin, 0, 255, initial(b_skin))
+	for(var/marking_location in m_colours)
+		m_colours[marking_location] = sanitize_hexcolor(m_colours[marking_location], DEFAULT_MARKING_COLOURS[marking_location])
 	r_headacc		= sanitize_integer(r_headacc, 0, 255, initial(r_headacc))
 	g_headacc		= sanitize_integer(g_headacc, 0, 255, initial(g_headacc))
 	b_headacc		= sanitize_integer(b_headacc, 0, 255, initial(b_headacc))
 	h_style			= sanitize_inlist(h_style, hair_styles_list, initial(h_style))
 	f_style			= sanitize_inlist(f_style, facial_hair_styles_list, initial(f_style))
+	for(var/marking_location in m_styles)
+		m_styles[marking_location] = sanitize_inlist(m_styles[marking_location], marking_styles_list, DEFAULT_MARKING_STYLES[marking_location])
 	ha_style		= sanitize_inlist(ha_style, head_accessory_styles_list, initial(ha_style))
 	alt_head		= sanitize_inlist(alt_head, alt_heads_list, initial(alt_head))
 	r_eyes			= sanitize_integer(r_eyes, 0, 255, initial(r_eyes))
@@ -313,8 +326,6 @@
 	if(!player_alt_titles) player_alt_titles = new()
 	if(!organ_data) src.organ_data = list()
 	if(!rlimb_data) src.rlimb_data = list()
-	if(!m_colours) m_colours = DEFAULT_MARKING_COLOURS
-	if(!m_styles) m_styles = DEFAULT_MARKING_STYLES
 	if(!gear) gear = list()

 	return 1
@@ -324,6 +335,7 @@
 	var/rlimblist
 	var/playertitlelist
 	var/gearlist
+
 	var/markingcolourslist = list2params(m_colours)
 	var/markingstyleslist = list2params(m_styles)
 	if(!isemptylist(organ_data))
@@ -339,13 +351,13 @@
 	firstquery.Execute()
 	while(firstquery.NextRow())
 		if(text2num(firstquery.item[1]) == default_slot)
-			var/DBQuery/query = dbcon.NewQuery({"UPDATE [format_table_name("characters")] SET OOC_Notes='[sql_sanitize_text(metadata)]',
-												real_name='[sql_sanitize_text(real_name)]',
+			var/DBQuery/query = dbcon.NewQuery({"UPDATE [format_table_name("characters")] SET OOC_Notes='[sanitizeSQL(metadata)]',
+												real_name='[sanitizeSQL(real_name)]',
 												name_is_always_random='[be_random_name]',
 												gender='[gender]',
 												age='[age]',
-												species='[sql_sanitize_text(species)]',
-												language='[sql_sanitize_text(language)]',
+												species='[sanitizeSQL(species)]',
+												language='[sanitizeSQL(language)]',
 												hair_red='[r_hair]',
 												hair_green='[g_hair]',
 												hair_blue='[b_hair]',
@@ -362,15 +374,15 @@
 												skin_red='[r_skin]',
 												skin_green='[g_skin]',
 												skin_blue='[b_skin]',
-												marking_colours='[markingcolourslist]',
+												marking_colours='[sanitizeSQL(markingcolourslist)]',
 												head_accessory_red='[r_headacc]',
 												head_accessory_green='[g_headacc]',
 												head_accessory_blue='[b_headacc]',
-												hair_style_name='[sql_sanitize_text(h_style)]',
-												facial_style_name='[sql_sanitize_text(f_style)]',
-												marking_styles='[markingstyleslist]',
-												head_accessory_style_name='[sql_sanitize_text(ha_style)]',
-												alt_head_name='[sql_sanitize_text(alt_head)]',
+												hair_style_name='[sanitizeSQL(h_style)]',
+												facial_style_name='[sanitizeSQL(f_style)]',
+												marking_styles='[sanitizeSQL(markingstyleslist)]',
+												head_accessory_style_name='[sanitizeSQL(ha_style)]',
+												alt_head_name='[sanitizeSQL(alt_head)]',
 												eyes_red='[r_eyes]',
 												eyes_green='[g_eyes]',
 												eyes_blue='[b_eyes]',
@@ -391,10 +403,10 @@
 												job_karma_high='[job_karma_high]',
 												job_karma_med='[job_karma_med]',
 												job_karma_low='[job_karma_low]',
-												flavor_text='[sql_sanitize_text(html_decode(flavor_text))]',
-												med_record='[sql_sanitize_text(html_decode(med_record))]',
-												sec_record='[sql_sanitize_text(html_decode(sec_record))]',
-												gen_record='[sql_sanitize_text(html_decode(gen_record))]',
+												flavor_text='[sanitizeSQL(flavor_text)]',
+												med_record='[sanitizeSQL(med_record)]',
+												sec_record='[sanitizeSQL(sec_record)]',
+												gen_record='[sanitizeSQL(gen_record)]',
 												player_alt_titles='[playertitlelist]',
 												disabilities='[disabilities]',
 												organ_data='[organlist]',
@@ -425,7 +437,11 @@
 											skin_tone, skin_red, skin_green, skin_blue,
 											marking_colours,
 											head_accessory_red, head_accessory_green, head_accessory_blue,
-											hair_style_name, facial_style_name, marking_styles, head_accessory_style_name, alt_head_name,
+											hair_style_name,
+											facial_style_name,
+											marking_styles,
+											head_accessory_style_name,
+											alt_head_name,
 											eyes_red, eyes_green, eyes_blue,
 											underwear, undershirt,
 											backbag, b_type, alternate_option,
@@ -433,22 +449,29 @@
 											job_medsci_high, job_medsci_med, job_medsci_low,
 											job_engsec_high, job_engsec_med, job_engsec_low,
 											job_karma_high, job_karma_med, job_karma_low,
-											flavor_text, med_record, sec_record, gen_record,
+											flavor_text,
+											med_record,
+											sec_record,
+											gen_record,
 											player_alt_titles,
 											disabilities, organ_data, rlimb_data, nanotrasen_relation, speciesprefs,
 											socks, body_accessory, gear)

 					VALUES
-											('[C.ckey]', '[default_slot]', '[sql_sanitize_text(metadata)]', '[sql_sanitize_text(real_name)]', '[be_random_name]','[gender]',
-											'[age]', '[sql_sanitize_text(species)]', '[sql_sanitize_text(language)]',
+											('[C.ckey]', '[default_slot]', '[sanitizeSQL(metadata)]', '[sanitizeSQL(real_name)]', '[be_random_name]','[gender]',
+											'[age]', '[sanitizeSQL(species)]', '[sanitizeSQL(language)]',
 											'[r_hair]', '[g_hair]', '[b_hair]',
 											'[r_hair_sec]', '[g_hair_sec]', '[b_hair_sec]',
 											'[r_facial]', '[g_facial]', '[b_facial]',
 											'[r_facial_sec]', '[g_facial_sec]', '[b_facial_sec]',
 											'[s_tone]', '[r_skin]', '[g_skin]', '[b_skin]',
-											'[markingcolourslist]',
+											'[sanitizeSQL(markingcolourslist)]',
 											'[r_headacc]', '[g_headacc]', '[b_headacc]',
-											'[sql_sanitize_text(h_style)]', '[sql_sanitize_text(f_style)]', '[markingstyleslist]', '[sql_sanitize_text(ha_style)]', '[sql_sanitize_text(alt_head)]',
+											'[sanitizeSQL(h_style)]',
+											'[sanitizeSQL(f_style)]',
+											'[sanitizeSQL(markingstyleslist)]',
+											'[sanitizeSQL(ha_style)]',
+											'[sanitizeSQL(alt_head)]',
 											'[r_eyes]', '[g_eyes]', '[b_eyes]',
 											'[underwear]', '[undershirt]',
 											'[backbag]', '[b_type]', '[alternate_option]',
@@ -456,7 +479,10 @@
 											'[job_medsci_high]', '[job_medsci_med]', '[job_medsci_low]',
 											'[job_engsec_high]', '[job_engsec_med]', '[job_engsec_low]',
 											'[job_karma_high]', '[job_karma_med]', '[job_karma_low]',
-											'[sql_sanitize_text(html_encode(flavor_text))]', '[sql_sanitize_text(html_encode(med_record))]', '[sql_sanitize_text(html_encode(sec_record))]', '[sql_sanitize_text(html_encode(gen_record))]',
+											'[sanitizeSQL(flavor_text)]',
+											'[sanitizeSQL(med_record)]',
+											'[sanitizeSQL(sec_record)]',
+											'[sanitizeSQL(gen_record)]',
 											'[playertitlelist]',
 											'[disabilities]', '[organlist]', '[rlimblist]', '[nanotrasen_relation]', '[speciesprefs]',
 											'[socks]', '[body_accessory]', '[gearlist]')