xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-29 22:57:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: remove SQL injections in Admin

Browse Source
This commit is contained in:
Martin Ambrus
2017-10-19 21:17:11 +02:00
parent 529bb2209c
commit 331885a110
74 changed files with 327 additions and 221 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Admin/Mods/addTroops.php
+6 -2
View File
@@ -19,7 +19,7 @@ mysqli_select_db(SQL_DB);
if (!isset($_SESSION)) session_start();
if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
$id = $_POST['id'];
$id = (int) $_POST['id'];
$village = $database->getVillage($id);
$user = $database->getUserArray($village['owner'],1);
$coor = $database->getCoor($village['wref']);
@@ -28,6 +28,10 @@ $type = $database->getVillageType($village['wref']);
$fdata = $database->getResourceLevel($village['wref']);
$units = $database->getUnit($village['wref']);
foreach ($_POST as $key => $value) {
$_POST[$key] = (int) $value;
}
$u1 = $_POST['u1'];
$u2 = $_POST['u2'];
$u3 = $_POST['u3'];
@@ -100,7 +104,7 @@ $q = "UPDATE ".TB_PREFIX."units SET u41 = '$u41', u42 = '$u42', u43 = '$u43', u4
mysqli_query($GLOBALS["link"], $q);
}
mysqli_query($GLOBALS["link"], "Insert into ".TB_PREFIX."admin_log values (0,".$_SESSION['id'].",'Changed troop anmount in village <a href=\'admin.php?p=village&did=$id\'>$id</a> ',".time().")");
mysqli_query($GLOBALS["link"], "Insert into ".TB_PREFIX."admin_log values (0,".(int) $_SESSION['id'].",'Changed troop anmount in village <a href=\'admin.php?p=village&did=$id\'>$id</a> ',".time().")");
header("Location: ../../../Admin/admin.php?p=addTroops&did=".$id."&d");
Admin/Mods/cp.php
+2 -2
View File
@@ -15,8 +15,8 @@ mysqli_select_db(SQL_DB);
if (!isset($_SESSION)) session_start();
if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
$id = $_POST['id'];
$admid = $_POST['admid'];
$id = (int) $_POST['id'];
$admid = (int) $_POST['admid'];
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET cp = cp + ".$_POST['cp']." WHERE id = ".$id."");
$name = $database->getUserField($id,"username",0);
Admin/Mods/deletemedalbyuser.php
+1 -1
View File
@@ -17,7 +17,7 @@ if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
$userid = $_POST['userid'];
$userid = (int) $_POST['userid'];
mysqli_query($GLOBALS["link"], "DELETE FROM ".TB_PREFIX."medal WHERE userid = ".$userid."");
header("Location: ../../../Admin/admin.php?p=player&uid=".$userid."");
Admin/Mods/deletemedalbyweek.php
+1 -1
View File
@@ -17,7 +17,7 @@ if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
$deleteweek = $_POST['medalweek'];
$deleteweek = (int) $_POST['medalweek'];
mysqli_query($GLOBALS["link"], "DELETE FROM ".TB_PREFIX."medal WHERE week = ".$deleteweek."");
header("Location: ../../../Admin/admin.php?p=delmedal");
Admin/Mods/editUser.php
+6 -2
View File
@@ -15,10 +15,14 @@ mysqli_select_db(SQL_DB);
if (!isset($_SESSION)) session_start();
if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$id = $_POST['id'];
$user = $database->getUserArray($id,1);
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET email = '".$_POST['email']."', tribe = ".$_POST['tribe'].", location = '".$_POST['location']."', desc1 = '".$_POST['desc1']."', `desc2` = '".$_POST['desc2']."' WHERE id = ".$_POST['id']."");
mysqli_query($GLOBALS["link"], "Insert into ".TB_PREFIX."admin_log values (0,".$_SESSION['id'].",'Changed <a href=\'admin.php?p=village&did=$id\'>".$user['username']."</a>\'s profile',".time().")");
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET email = '".$_POST['email']."', tribe = ".(int) $_POST['tribe'].", location = '".$_POST['location']."', desc1 = '".$_POST['desc1']."', desc2 = '".$_POST['desc2']."' WHERE id = ".(int) $_POST['id']."");
mysqli_query($GLOBALS["link"], "Insert into ".TB_PREFIX."admin_log values (0,".(int) $_SESSION['id'].",'Changed <a href=\'admin.php?p=village&did=$id\'>".$user['username']."</a>\'s profile',".time().")");
header("Location: ../../../Admin/admin.php?p=player&uid=".$id."");
Admin/Mods/gold.php
+5 -5
View File
@@ -15,12 +15,12 @@ mysqli_select_db(SQL_DB);
if (!isset($_SESSION)) session_start();
if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
$id = $_POST['id'];
$gold = $_POST['gold'];
$id = (int) $_POST['id'];
$gold = (int) $_POST['gold'];
$q = "UPDATE ".TB_PREFIX."users SET gold = gold + ".$_POST['gold']." WHERE id != '0'";
mysqli_query($GLOBALS["link"], $q);
mysqli_query($GLOBALS["link"], "Insert into ".TB_PREFIX."admin_log values (0,$id,'Added <b>$gold</b> gold to all users',".time().")");
$q = "UPDATE ".TB_PREFIX."users SET gold = gold + ".$gold." WHERE id != '0'";
mysqli_query($GLOBALS["link"], $q);
mysqli_query($GLOBALS["link"], "Insert into ".TB_PREFIX."admin_log values (0,$id,'Added <b>$gold</b> gold to all users',".time().")");
header("Location: ../../../Admin/admin.php?p=gold&g");
Admin/Mods/gold_1.php
+3 -3
View File
@@ -16,11 +16,11 @@ if (!isset($_SESSION)) session_start();
if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
$id = $_POST['id'];
$admid = $_POST['admid'];
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET gold = gold + ".$_POST['gold']." WHERE id = ".$id."");
$admid = (int) $_POST['admid'];
mysqli_query($GLOBALS["link"], "UPDATE ".TB_PREFIX."users SET gold = gold + ".(int) $_POST['gold']." WHERE id = ".(int) $id."");
$name = $database->getUserField($id,"username",0);
mysqli_query($GLOBALS["link"], "Insert into ".TB_PREFIX."admin_log values (0,$admid,'Added <b>".$_POST['gold']."</b> gold to user <a href=\'admin.php?p=player&uid=$id\'>$name</a> ',".time().")");
mysqli_query($GLOBALS["link"], "Insert into ".TB_PREFIX."admin_log values (0,$admid,'Added <b>".(int) $_POST['gold']."</b> gold to user <a href=\'admin.php?p=player&uid=$id\'>$name</a> ',".time().")");
header("Location: ../../../Admin/admin.php?p=player&uid=".$id."&g=ok");
?>
Admin/Mods/medals.php
+4 -3
View File
@@ -17,8 +17,9 @@ mysqli_select_db(SQL_DB);
if (!isset($_SESSION)) session_start();
if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
$medalid = $_POST['medalid'];
$uid = $_POST['uid'];
$medalid = (int) $_POST['medalid'];
$uid = (int) $_POST['uid'];
$admid = (int) $_POST['admid'];
mysqli_query($GLOBALS["link"], "DELETE FROM ".TB_PREFIX."medal WHERE id = ".$medalid."");
@@ -28,7 +29,7 @@ $name = mysqli_result($name, 0);
mysqli_query($GLOBALS["link"], "Insert into ".TB_PREFIX."admin_log values (0,$admid,'Deleted medal id [#".$medalid."] from the user <a href=\'admin.php?p=player&uid=$uid\'>$name</a> ',".time().")");
$deleteweek = $_POST['medalweek'];
$deleteweek = (int) $_POST['medalweek'];
mysqli_query($GLOBALS["link"], "DELETE FROM ".TB_PREFIX."medal WHERE week = ".$deleteweek."");
header("Location: ../../../Admin/admin.php?p=player&uid=".$uid."");
Admin/Mods/renameVillage.php
+8 -2
View File
@@ -16,11 +16,17 @@ mysqli_select_db(SQL_DB);
if (!isset($_SESSION)) session_start();
if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
$did = $_POST['did'];
$origname = $_POST['villagename'];
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$did = (int) $_POST['did'];
$name = $_POST['villagename'];
$sql = "UPDATE ".TB_PREFIX."vdata SET name = '$name' WHERE wref = $did";
mysqli_query($GLOBALS["link"], $sql);
header("Location: ../../../Admin/admin.php?p=village&did=".$did."&name=".$name."");
header("Location: ../../../Admin/admin.php?p=village&did=".$did."&name=".$origname."");
?>
Admin/Mods/sendMessage.php
+5 -1
View File
@@ -14,7 +14,11 @@ mysqli_select_db(SQL_DB);
if (!isset($_SESSION)) session_start();
if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
$uid = $_POST['uid'];
foreach ($_POST as $key => $value) {
$_POST[$key] = $database->escape($value);
}
$uid = (int) $_POST['uid'];
$topic = $_POST['topic'];
$message = $_POST['message'];
$time = time();