From b08855d1917ced3ad8947808a4bd75b9ae90fe2c Mon Sep 17 00:00:00 2001 From: Robson112011 Date: Sun, 5 Nov 2017 12:25:55 -0300 Subject: [PATCH] usekey: bug MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit MySQL injection: resolvi apenas no usarkey, devem ser corrigidos em outros. As outras variáveis também devem ser setadas usando setString, inclusive as que não setei no usarkey. Se puderem façam isso em todas. --- src/me/subzero0/vipzero/ThreadVZ.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/me/subzero0/vipzero/ThreadVZ.java b/src/me/subzero0/vipzero/ThreadVZ.java index 4ca3d50..f733dbe 100644 --- a/src/me/subzero0/vipzero/ThreadVZ.java +++ b/src/me/subzero0/vipzero/ThreadVZ.java @@ -241,7 +241,8 @@ else if(plugin.getServer().getPluginManager().getPlugin("PermissionsEx")!=null&& case "usekey": { try { Connection con = DriverManager.getConnection(plugin.mysql_url,plugin.mysql_user,plugin.mysql_pass); - PreparedStatement keyvalida = con.prepareStatement("SELECT * FROM `keys` WHERE `key`='"+key+"';"); + PreparedStatement keyvalida = con.prepareStatement("SELECT * FROM `keys` WHERE `key`=?;"); + keyvalida.setString(1, key); ResultSet keyvalida2 = keyvalida.executeQuery(); if(keyvalida2.next()) { String grupo = keyvalida2.getString("grupo"); @@ -266,13 +267,15 @@ else if(plugin.getServer().getPluginManager().getPlugin("PermissionsEx")!=null&& upp.close(); plugin.DarVip(((Player)sender), dias, grupo.trim()); } - PreparedStatement delkey = con.prepareStatement("DELETE FROM `keys` WHERE `key`='"+key+"';"); + PreparedStatement delkey = con.prepareStatement("DELETE FROM `keys` WHERE `key`=?;"); + delkey.setString(1, key); delkey.executeUpdate(); delkey.close(); if(plugin.getConfig().getBoolean("logging.usekey")) { Calendar now = Calendar.getInstance(); SimpleDateFormat fmt = new SimpleDateFormat("dd/MM/yyyy"); - PreparedStatement addlog = con.prepareStatement("INSERT INTO `vipzero_log` (`comando`, `nome`,`key`,`data`,`grupo`,`dias`) VALUES ('usekey','"+sender.getName()+"','"+key+"','"+fmt.format(now.getTime())+"','"+grupo+"',"+dias+");"); + PreparedStatement addlog = con.prepareStatement("INSERT INTO `vipzero_log` (`comando`, `nome`,`key`,`data`,`grupo`,`dias`) VALUES ('usekey','"+sender.getName()+"',?,'"+fmt.format(now.getTime())+"','"+grupo+"',"+dias+");"); + addlog.setString(1, key); addlog.execute(); addlog.close(); }