From e9def19bd95d8fb6b6726585892b9d8c8f1098b3 Mon Sep 17 00:00:00 2001 From: iopietro Date: Sat, 21 Apr 2018 17:53:59 +0200 Subject: [PATCH] Fixed an exploit in the market +Fixed an exploit that permitted to gain an infinite amount of resources --- GameEngine/Database.php | 6 +++--- GameEngine/Market.php | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/GameEngine/Database.php b/GameEngine/Database.php index 966fba18..87d46551 100755 --- a/GameEngine/Database.php +++ b/GameEngine/Database.php @@ -5264,8 +5264,8 @@ References: User ID/Message ID, Mode Made by: Dzoki ***************************/ - function getMarketField($vref, $field, $use_cache = true) { - list($vref, $field) = $this->escape_input($vref, $field); + function getMarketField($vref, $id, $field, $use_cache = true) { + list($vref, $id, $field) = $this->escape_input($vref, $id, $field); // first of all, check if we should be using cache and whether the field // required is already cached @@ -5273,7 +5273,7 @@ References: User ID/Message ID, Mode return $cachedValue; } - $q = "SELECT * FROM " . TB_PREFIX . "market where vref = '$vref' LIMIT 1"; + $q = "SELECT * FROM " . TB_PREFIX . "market WHERE id = $id AND vref = $vref"; $result = mysqli_query($this->dblink,$q); $dbarray = mysqli_fetch_array($result); diff --git a/GameEngine/Market.php b/GameEngine/Market.php index 2701516c..6d1f19f1 100755 --- a/GameEngine/Market.php +++ b/GameEngine/Market.php @@ -45,8 +45,8 @@ class Market else if(isset($get['t']) && $get['t'] == 2 && isset($get['a']) && $get['a'] == 5 && isset($get['del'])) { //GET ALL FIELDS FROM MARKET - $type = $database->getMarketField($village->wid, "gtype"); - $amt = $database->getMarketField($village->wid, "gamt"); + $type = $database->getMarketField($village->wid, $get['del'], "gtype"); + $amt = $database->getMarketField($village->wid, $get['del'], "gamt"); $database->getResourcesBack($village->wid, $type, $amt); $database->addMarket($village->wid, $get['del'], 0, 0, 0, 0, 0, 0, 1); header("Location: build.php?id=".$get['id']."&t=2");