Lobby Website Chat

[Tankado]

Removed.

 

[qet123]

Thanks tt1:
This is good for website, we should develop them more and more

 

[jur13n]

this is **** I like to see

 

[Gunblade]

-

 

[Solaire]

Imagine what would happen if someone used a spambot on your lobby.

Imagine a troll saying "'; DROP TABLE Login;--".

 

[Gunblade]

-

 

[qet123]

Imagine a troll saying "'; DROP TABLE Login;--".

??????? What? Where
Ok ****

 

[Gunblade]

-

 

[qet123]

Inside the chatbox, the string he posted will get executed in the query.

Yeye, not only chatbox. You can name clan or charname and boom

Inside the chatbox, the string he posted will get executed in the query.

Yeye, not only chatbox. You can name clan or charname and boom

 

[Wish Q]

not safe

 

[qet123]

With fake client ofc

 

[Tankado]

Removed.

 

[Solaire]

Yeye, not only chatbox. You can name clan or charname and boom

No.

With fake client ofc

No.

 

[trunksx]

Imagine a troll saying "'; DROP TABLE Login;--".

or this "';shutdown--"

 

[jur13n]

You guys are acting worse then needed..
Add a filter to it..

2

 

[qet123]

You guys are acting worse then needed..
Add a filter to it..

2

We will

 

[qet123]

TCHAR g_szDB_LOBBY_CHAT[] = _T("{CALL spInsertLobbyChat ('%s', '%s')}");
bool MMatchDBMgr::LobbyChat(const TCHAR* szName, const char* szMsg) 
{
	_STATUS_DB_START;
	[COLOR="#FF0000"]if(strstr(szName, ";")) return false;[/COLOR]
	if (!CheckOpen()) return false;

	CString strSQL;

	try {
		strSQL.Format( g_szDB_LOBBY_CHAT, szName, szMsg );
		m_DB.ExecuteSQL( strSQL );
	} 
	catch(CDBException* e) {

		ExceptionHandler(strSQL, e);
		return false;
	}
	_STATUS_DB_END(12);
	return true;
}

Imagine what would happen if someone used a spambot on your lobby.

Our full version that it won't print same message more than 2 times.

 

[Solaire]

TCHAR g_szDB_LOBBY_CHAT[] = _T("{CALL spInsertLobbyChat ('%s', '%s')}");
bool MMatchDBMgr::LobbyChat(const TCHAR* szName, const char* szMsg) 
{
    _STATUS_DB_START;
    [COLOR=#FF0000]if(strstr(szName, ";")) return false;[/COLOR]
    if (!CheckOpen()) return false;

    CString strSQL;

    try {
        strSQL.Format( g_szDB_LOBBY_CHAT, szName, szMsg );
        m_DB.ExecuteSQL( strSQL );
    } 
    catch(CDBException* e) {

        ExceptionHandler(strSQL, e);
        return false;
    }
    _STATUS_DB_END(12);
    return true;
}

Our full version that it won't print same message more than 2 times.

Don't need the ";", I could still use the ' and launch a DoS attack by generating SQL errors.

 

[qet123]

Don't need the ";", I could still use the ' and launch a DoS attack by generating SQL errors.

I knew you gonna answer that, all what I want is to develop gunz and making it active again, but you're making it harder for me and for others, Why you don't just release fixes and help each others ?

 

[Dave]

Don't need the ";", I could still use the ' and launch a DoS attack by generating SQL errors.

You can still use it, if(strstr(szName, ";")) return false;
szName.

Anyway, you'll learn more of your mistakes if you actually find the solution yourself.