xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-13 23:01:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix #250

Browse Source 
Fix #250
This commit is contained in:
novgorodschi catalin
2026-06-22 12:34:31 +03:00
parent 561933b23b
commit c250a19f5a
2 changed files with 61 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GameEngine/Profile.php
+24 -9
View File
@@ -136,9 +136,9 @@ class Profile {
$value = trim($value); $value = trim($value);
if (strpos($key, 'linkname') === 0) { if (strpos($key, 'linkname') === 0) {
$links[substr($key, 8)]['name'] = mysqli_real_escape_string($database->dblink, $value); $links[substr($key, 8)]['name'] = $value;
} elseif (strpos($key, 'linkziel') === 0) { } elseif (strpos($key, 'linkziel') === 0) {
$links[substr($key, 8)]['url'] = mysqli_real_escape_string($database->dblink, $value); $links[substr($key, 8)]['url'] = $value;
} elseif (strpos($key, 'nr') === 0) { } elseif (strpos($key, 'nr') === 0) {
$links[substr($key, 2)]['nr'] = (int)$value; $links[substr($key, 2)]['nr'] = (int)$value;
} elseif (strpos($key, 'id') === 0) { } elseif (strpos($key, 'id') === 0) {
@@ -149,21 +149,36 @@ class Profile {
foreach ($links as $link) { foreach ($links as $link) {
$nr = isset($link['nr']) ? (int)$link['nr'] : 0; $nr = isset($link['nr']) ? (int)$link['nr'] : 0;
$id = isset($link['id']) ? (int)$link['id'] : 0; $id = isset($link['id']) ? (int)$link['id'] : 0;
$name = isset($link['name']) ? $link['name'] : '';
$url = isset($link['url']) ? $link['url'] : ''; // --- REMOVE XSS ---
$name_raw = trim($link['name'] ?? '');
$url_raw = trim($link['url'] ?? '');
// name : without HTML, maximum 30 characters (as in the game), filtered through RemoveXSS
$name = $database->RemoveXSS(mb_substr(strip_tags($name_raw), 0, 30));
// url: accepts only http/https, max 120 characters, filtered through RemoveXSS
$url = '';
if ($url_raw !== '' && preg_match('#^https?://#i', $url_raw)) {
$url = $database->RemoveXSS(mb_substr($url_raw, 0, 120));
}
// SQL: escape for SQL (keeping the current TravianZ style used in TravianZ)
$name_sql = mysqli_real_escape_string($database->dblink, $name);
$url_sql = mysqli_real_escape_string($database->dblink, $url);
if ($nr !== 0 && $name !== '' && $url !== '' && $id === 0) { if ($nr !== 0 && $name !== '' && $url !== '' && $id === 0) {
// New link. // New link.
mysqli_query( mysqli_query(
$database->dblink, $database->dblink,
"INSERT INTO `" . TB_PREFIX . "links` (`userid`, `name`, `url`, `pos`) " . "INSERT INTO `" . TB_PREFIX . "links` (`userid`, `name`, `url`, `pos`) " .
"VALUES ($uid, '$name', '$url', $nr)" "VALUES ($uid, '$name_sql', '$url_sql', $nr)"
); );
} elseif ($nr !== 0 && $name !== '' && $url !== '' && $id > 0) { } elseif ($nr !== 0 && $name !== '' && $url !== '' && $id > 0) {
// Update existing link (ownership enforced in the WHERE clause). // Update existing link (ownership enforced in the WHERE clause).
mysqli_query( mysqli_query(
$database->dblink, $database->dblink,
"UPDATE `" . TB_PREFIX . "links` SET `name`='$name', `url`='$url', `pos`=$nr " . "UPDATE `" . TB_PREFIX . "links` SET `name`='$name_sql', `url`='$url_sql', `pos`=$nr " .
"WHERE `id`=$id AND `userid`=$uid" "WHERE `id`=$id AND `userid`=$uid"
); );
} elseif ($nr === 0 && $name === '' && $url === '' && $id > 0) { } elseif ($nr === 0 && $name === '' && $url === '' && $id > 0) {
@@ -204,9 +219,9 @@ class Profile {
$birthday = preg_match('/^\d{4}-\d{1,2}-\d{1,2}$/', $birthday) ? $birthday : '0'; $birthday = preg_match('/^\d{4}-\d{1,2}-\d{1,2}$/', $birthday) ? $birthday : '0';
$mw = (int)($post['mw'] ?? 0); $mw = (int)($post['mw'] ?? 0);
$ort = trim($post['ort'] ?? ''); $ort = $database->RemoveXSS(trim($post['ort'] ?? ''));
$be2 = trim($post['be2'] ?? ''); // descrierea stânga $be1 = $database->RemoveXSS(trim($post['be1'] ?? '')); // right description
$be1 = trim($post['be1'] ?? ''); // descrierea dreapta $be2 = $database->RemoveXSS(trim($post['be2'] ?? '')); // left description
$database->submitProfile($session->uid, $mw, $ort, $birthday, $be2, $be1); $database->submitProfile($session->uid, $mw, $ort, $birthday, $be2, $be1);
img/maintenance.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 455 KiB