admin/OpenSimProfile
1
0
Fork 0
mirror of https://github.com/kcozens/OpenSimProfile.git synced 2026-08-14 09:02:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent SQL injection by escaping parcel name when dealing with classifieds.

Browse Source 
git-svn-id: http://forge.opensimulator.org/svn/osprofile/trunk@123 19860011-0018-435d-96ae-4a7b0aaa3128
This commit is contained in:
kcozens
2013-09-12 22:33:00 +00:00
parent df84c73383
commit 674541beaf
2 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
OpenSimProfile/Modules/ProfileModule/OpenProfile.cs
+7 -4
View File
@@ -80,9 +80,6 @@ namespace OpenSimProfile.Modules.OpenProfile
if (!m_Enabled)
return;
// Hook up events
scene.EventManager.OnNewClient += OnNewClient;
// Take ownership of the IProfileModule service
scene.RegisterModuleInterface<IProfileModule>(this);
@@ -99,11 +96,17 @@ namespace OpenSimProfile.Modules.OpenProfile
return;
scene.UnregisterModuleInterface<IProfileModule>(this);
m_Scenes.Remove(scene);
lock(m_Scenes)
{
m_Scenes.Remove(scene);
}
}
public void RegionLoaded(Scene scene)
{
// Hook up events
scene.EventManager.OnNewClient += OnNewClient;
}
public Type ReplaceableInterface
webroot/profile.php
+2 -2
View File
@@ -138,7 +138,7 @@ function classified_update($method_name, $params, $app_data)
"'". mysql_real_escape_string($snapshotuuid) ."',".
"'". mysql_real_escape_string($simname) ."',".
"'". mysql_real_escape_string($globalpos) ."',".
"'". $parcelname ."',".
"'". mysql_real_escape_string($parcelname) ."',".
"". mysql_real_escape_string($classifiedflag) .",".
"". mysql_real_escape_string($priceforlist) .")";
}
@@ -155,7 +155,7 @@ function classified_update($method_name, $params, $app_data)
"`snapshotuuid`='". mysql_real_escape_string($snapshotuuid)."',".
"`simname`='". mysql_real_escape_string($simname)."',".
"`posglobal`='". mysql_real_escape_string($globalpos)."',".
"`parcelname`='". $parcelname."',".
"`parcelname`='". mysql_real_escape_string($parcelname)."',".
"`classifiedflags`=". mysql_real_escape_string($classifiedflag).",".
"`priceforlisting`=". mysql_real_escape_string($priceforlist).
" WHERE ".