Preciso de um fix 16.09.13 11:31
Aew galera alguém ai teria um SwiftEmu com SQL Injection fixado ou então um fix funcional para este problema
In Navigator.cs search:
internal ServerMessage SerializeSearchResults(string SearchQuery)
And replace all this, by:
[C]internal ServerMessage SerializeSearchResults(string SearchQuery)
{
string ProtectedSearch = ButterflyEnvironment.FilterInjectionChars(SearchQuery);
DataTable table = new DataTable();
using (IQueryAdapter adapter = ButterflyEnvironment.GetDatabaseManager().getQueryreactor())
{
if (SearchQuery.Length > 0)
{
if (SearchQuery.StartsWith("owner:"))
{
adapter.setQuery("SELECT * FROM rooms WHERE owner LIKE '" + ProtectedSearch.Replace("owner:", "") + "' ORDER BY id DESC LIMIT 50");
}
else if (adapter.dbType == DatabaseType.MySQL)
{
adapter.setQuery("SELECT rooms.*, room_active.active_users FROM rooms LEFT JOIN room_active ON (room_active.roomid = rooms.id) WHERE owner = @query AND roomtype = 'private' UNION ALL SELECT rooms.*, room_active.active_users FROM rooms LEFT JOIN room_active ON (room_active.roomid = rooms.id) WHERE caption = @query AND roomtype = 'private' ORDER BY active_users DESC LIMIT 50");
}
else
{
adapter.setQuery("SELECT TOP 50 rooms.*, room_active.active_users FROM rooms LEFT JOIN room_active ON (room_active.roomid = rooms.id) WHERE owner = @query AND roomtype = 'private' UNION ALL SELECT rooms.*, room_active.active_users FROM rooms LEFT JOIN room_active ON (room_active.roomid = rooms.id) WHERE caption = @query AND roomtype = 'private' ORDER BY active_users DESC");
}
adapter.addParameter("query", ProtectedSearch);
table = adapter.getTable();
}
}
List<RoomData> list = new List<RoomData>();
if (table != null)
{
foreach (DataRow row in table.Rows)
{
RoomData item = ButterflyEnvironment.GetGame().GetRoomManager().FetchRoomData(Convert.ToUInt32(row["id"]), row);
list.Add(item);
}
}
ServerMessage message = new ServerMessage(Outgoing.NavigatorPacket);
message.AppendInt32(8);
message.AppendString(SearchQuery);
message.AppendInt32(list.Count);
foreach (RoomData data2 in list)
{
data2.Serialize(message, false);
}
message.AppendBoolean(false);
return message;
}[/PHP]
Recomendamos a BH Servers com proteção DDOS gratuita em Cloud Server de alta performance. Entrega imediata.