Reply to thread

Message

<blockquote data-quote="Sledmore" data-source="post: 250453" data-attributes="member: 591">Hey.So I check Habboons log files daily to see if there is anything I can fix and to improve the emulator, well today I'd found a user had accidentally caused an error that lead me on to find this. Well with further inspection I could drop any tables such (just like the old navigator issue, with the search query not being sanitized).So, here are two simple fixes. (both in GroupManager.cs)Replace both methods;<ul>
<li data-xf-list-type="ul">GetGroupUsersByString 
</li>
<li data-xf-list-type="ul">GetGroupRequestsByString</li>
</ul>With:[PHP]&nbsp; &nbsp; &nbsp; &nbsp; internal List&lt;GroupUser&gt; GetGroupUsersByString(Group Group, String SearchVal, uint Req)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var Users = new List&lt;GroupUser&gt;();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (string.IsNullOrWhiteSpace(SearchVal))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (Req == 0)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; foreach (GroupUser U in Group.Members.Values)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Users.Add(U);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; foreach (GroupUser U in Group.Admins.Values)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Users.Add(U);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; using (IQueryAdapter dbClient = PlusEnvironment.GetDatabaseManager().getQueryreactor())&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dbClient.setQuery(&quot;SELECT id FROM users WHERE username LIKE @query&quot;);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dbClient.addParameter(&quot;query&quot;, &quot;%&quot; + SearchVal + &quot;%&quot;);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; DataTable Table = dbClient.getTable();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (Table == null)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (Req == 0)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; foreach (GroupUser U in Group.Members.Values)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Users.Add(U);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; foreach (GroupUser U in Group.Admins.Values)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Users.Add(U);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; foreach (DataRow Row in Table.Rows)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (Group.Members.ContainsKey((uint)Row[0]))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Users.Add(Group.Members[(uint)Row[0]]);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return Users;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; internal List&lt;uint&gt; GetGroupRequestsByString(Group Group, String SearchVal, uint Req)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (string.IsNullOrWhiteSpace(SearchVal))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return Group.Requests;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var Users = new List&lt;uint&gt;();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; using (IQueryAdapter dbClient = PlusEnvironment.GetDatabaseManager().getQueryreactor())&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dbClient.setQuery(&quot;SELECT id FROM users WHERE username LIKE @query&quot;);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dbClient.addParameter(&quot;query&quot;, &quot;%&quot; + SearchVal + &quot;%&quot;);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; DataTable Table = dbClient.getTable();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (Table != null)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; foreach (DataRow Row in Table.Rows)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (Group.Requests.Contains((uint)Row[0]))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Users.Add((uint)Row[0]);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return Users;&nbsp; &nbsp; &nbsp; &nbsp; }[/PHP]You're welcome.</blockquote>

[QUOTE="Sledmore, post: 250453, member: 591"] Hey. So I check Habboons log files daily to see if there is anything I can fix and to improve the emulator, well today I'd found a user had accidentally caused an error that lead me on to find this. Well with further inspection I could drop any tables such (just like the old navigator issue, with the search query not being sanitized). So, here are two simple fixes. ([B]both in GroupManager.cs[/B]) Replace both methods; [LIST] [*]GetGroupUsersByString [*]GetGroupRequestsByString [/LIST] With: [PHP] internal List<GroupUser> GetGroupUsersByString(Group Group, String SearchVal, uint Req) { var Users = new List<GroupUser>(); if (string.IsNullOrWhiteSpace(SearchVal)) { if (Req == 0) foreach (GroupUser U in Group.Members.Values) Users.Add(U); else foreach (GroupUser U in Group.Admins.Values) Users.Add(U); } else { using (IQueryAdapter dbClient = PlusEnvironment.GetDatabaseManager().getQueryreactor()) { dbClient.setQuery("SELECT id FROM users WHERE username LIKE @query"); dbClient.addParameter("query", "%" + SearchVal + "%"); DataTable Table = dbClient.getTable(); if (Table == null) { if (Req == 0) foreach (GroupUser U in Group.Members.Values) Users.Add(U); else foreach (GroupUser U in Group.Admins.Values) Users.Add(U); } else { foreach (DataRow Row in Table.Rows) { if (Group.Members.ContainsKey((uint)Row[0])) Users.Add(Group.Members[(uint)Row[0]]); } } } } return Users; } internal List<uint> GetGroupRequestsByString(Group Group, String SearchVal, uint Req) { if (string.IsNullOrWhiteSpace(SearchVal)) return Group.Requests; var Users = new List<uint>(); using (IQueryAdapter dbClient = PlusEnvironment.GetDatabaseManager().getQueryreactor()) { dbClient.setQuery("SELECT id FROM users WHERE username LIKE @query"); dbClient.addParameter("query", "%" + SearchVal + "%"); DataTable Table = dbClient.getTable(); if (Table != null) { foreach (DataRow Row in Table.Rows) { if (Group.Requests.Contains((uint)Row[0])) Users.Add((uint)Row[0]); } } } return Users; } [/PHP] You're welcome. [/QUOTE]

Verification

Reply to thread

Connect with us

Newest members