/// Ban an account or ban an IP address, duration will be parsed using TimeStringToSecs if it is positive, otherwise permbanuint8 World::BanAccount(std::string type, std::string nameOrIP, std::string duration, std::string reason, std::string author){ loginDatabase.escape_string(nameOrIP); loginDatabase.escape_string(reason); std::string safe_author=author; loginDatabase.escape_string(safe_author); normalizePlayerName(nameOrIP); uint32 duration_secs = TimeStringToSecs(duration); QueryResult *resultAccounts = NULL; //used for kicking ///- Update the database with ban information if(type=="ip") { //No SQL injection as strings are escaped resultAccounts = loginDatabase.PQuery("SELECT `id` FROM `account` WHERE `last_ip` = '%s'",nameOrIP.c_str()); loginDatabase.PExecute("INSERT INTO `ip_banned` VALUES ('%s',UNIX_TIMESTAMP(),UNIX_TIMESTAMP()+%u,'%s','%s')",nameOrIP.c_str(),duration_secs,safe_author.c_str(),reason.c_str()); } else if(type=="account") { //No SQL injection as string is escaped resultAccounts = loginDatabase.PQuery("SELECT `id` FROM `account` WHERE `username` = '%s'",nameOrIP.c_str()); } else if(type=="character") { //No SQL injection as string is escaped resultAccounts = CharacterDatabase.PQuery("SELECT `account` FROM `character` WHERE `name` = '%s'",nameOrIP.c_str()); } else return BAN_SYNTAX_ERROR; //Syntax problem if(!resultAccounts) if(type=="ip") return BAN_SUCCESS; // ip correctly banned but nobody affected (yet) else return BAN_NOTFOUND; // Nobody to ban ///- Disconnect all affected players (for IP it can be several) do { Field* fieldsAccount = resultAccounts->Fetch(); uint32 account = fieldsAccount->GetUInt32(); if(type != "ip") //No SQL injection as strings are escaped loginDatabase.PExecute("INSERT INTO `account_banned` VALUES ('%u', UNIX_TIMESTAMP(), UNIX_TIMESTAMP()+%u, '%s', '%s', '1')",account,duration_secs,safe_author.c_str(),reason.c_str()); WorldSession* sess = FindSession(account); if( sess ) if(std::string(sess->GetPlayerName()) != author) sess->KickPlayer(); } while( resultAccounts->NextRow() ); delete resultAccounts; return BAN_SUCCESS;}