rendered paste bodyIndex: game/AccountMgr.cpp
===================================================================
--- game/AccountMgr.cpp (revision 5449)
+++ game/AccountMgr.cpp (working copy)
@@ -134,7 +134,9 @@
{
loginDatabase.escape_string(username);
- QueryResult *result = loginDatabase.PQuery("SELECT id FROM account WHERE UPPER(username)=UPPER('%s')", username.c_str());
+ std::transform( username.begin(), username.end(), username.begin(), ::toupper );
+
+ QueryResult *result = loginDatabase.PQuery("SELECT id FROM account WHERE username = '%s'", username.c_str());
if(!result)
return 0;
else
Index: game/WorldSocket.cpp
===================================================================
--- game/WorldSocket.cpp (revision 5449)
+++ game/WorldSocket.cpp (working copy)
@@ -253,11 +253,11 @@
sLog.outDebug("Auth: client %u, unk2 %u, account %s, clientseed %u", BuiltNumberClient, unk2, account.c_str(), clientSeed);
///- Get the account information from the realmd database
- std::string safe_account=account; // Duplicate, else will screw the SHA hash verification below
+ std::string safe_account = account; // Duplicate, else will screw the SHA hash verification below
loginDatabase.escape_string(safe_account);
//No SQL injection, username escaped.
// 0 1 2 3 4 5 6 7 8 9 10
- QueryResult *result = loginDatabase.PQuery("SELECT id, gmlevel, sessionkey, last_ip, locked, sha_pass_hash, v, s, tbc, mutetime, locale FROM account WHERE UPPER(username) = '%s'", safe_account.c_str());
+ QueryResult *result = loginDatabase.PQuery("SELECT id, gmlevel, sessionkey, last_ip, locked, sha_pass_hash, v, s, tbc, mutetime, locale FROM account WHERE username = '%s'", safe_account.c_str());
///- Stop if the account is not found
if ( !result )
@@ -295,7 +295,7 @@
const char* sStr = s.AsHexStr(); //Must be freed by OPENSSL_free()
const char* vStr = v.AsHexStr(); //Must be freed by OPENSSL_free()
sLog.outDebug("SOCKET: (s,v) check s: %s v_old: %s v_new: %s", sStr, fields[6].GetString(), vStr );
- loginDatabase.PExecute("UPDATE account SET v = '0', s = '0' WHERE UPPER(username) = '%s'", safe_account.c_str());
+ loginDatabase.PExecute("UPDATE account SET v = '0', s = '0' WHERE username = '%s'", safe_account.c_str());
if ( strcmp(vStr,fields[6].GetString() ) )
{
packet.Initialize( SMSG_AUTH_RESPONSE, 1 );
@@ -416,7 +416,7 @@
//No SQL injection, username escaped.
std::string address = GetRemoteAddress();
loginDatabase.escape_string(address);
- loginDatabase.PExecute("UPDATE account SET last_ip = '%s' WHERE UPPER(username) = '%s'",address.c_str(), safe_account.c_str());
+ loginDatabase.PExecute("UPDATE account SET last_ip = '%s' WHERE username = '%s'",address.c_str(), safe_account.c_str());
// do small delay (10ms) at accepting successful authed connection to prevent droping packets by client
// don't must harm anyone (let login ~100 accounts in 1 sec ;) )
Index: mangosd/RASocket.cpp
===================================================================
--- mangosd/RASocket.cpp (revision 5449)
+++ mangosd/RASocket.cpp (working copy)
@@ -143,11 +143,14 @@
///- Get the gmlevel and password from the account table
std::string login = szLogin;
+
+ // No SQL injection (escaped login)
loginDatabase.escape_string(login);
- // No SQL injection (escaped login)
- QueryResult* result = loginDatabase.PQuery("SELECT gmlevel FROM account WHERE UPPER(username) = UPPER('%s')",login.c_str());
+ std::transform( login.begin(), login.end(), login.begin(), ::toupper );
+ QueryResult* result = loginDatabase.PQuery("SELECT gmlevel FROM account WHERE username = '%s'",login.c_str());
+
///- If the user is not found, deny access
if(!result)
{
@@ -184,7 +187,10 @@
std::string pw = &buff[5];
loginDatabase.escape_string(login);
loginDatabase.escape_string(pw);
- QueryResult *check = loginDatabase.PQuery("SELECT 1 FROM account WHERE UPPER(username)=UPPER('%s') AND sha_pass_hash=SHA1(CONCAT(UPPER(username),':',UPPER('%s')))", login.c_str(), pw.c_str());
+
+ std::transform( login.begin(), login.end(), login.begin(), ::toupper );
+
+ QueryResult *check = loginDatabase.PQuery("SELECT 1 FROM account WHERE username = '%s' AND sha_pass_hash=SHA1(CONCAT(UPPER(username),':',UPPER('%s')))", login.c_str(), pw.c_str());
if(check)
{
delete check;
Index: realmd/AuthSocket.cpp
===================================================================
--- realmd/AuthSocket.cpp (revision 5449)
+++ realmd/AuthSocket.cpp (working copy)
@@ -312,7 +312,7 @@
const char *v_hex, *s_hex;
v_hex = v.AsHexStr();
s_hex = s.AsHexStr();
- dbRealmServer.PExecute("UPDATE account SET v = '%s', s = '%s' WHERE UPPER(username)= UPPER('%s')",v_hex,s_hex, _safelogin.c_str() );
+ dbRealmServer.PExecute("UPDATE account SET v = '%s', s = '%s' WHERE username= '%s'",v_hex,s_hex, _safelogin.c_str() );
OPENSSL_free((void*)v_hex);
OPENSSL_free((void*)s_hex);
}
@@ -385,7 +385,7 @@
///- Get the account details from the account table
// No SQL injection (escaped user name)
- result = dbRealmServer.PQuery("SELECT sha_pass_hash,id,locked,last_ip,gmlevel FROM account WHERE UPPER(username) = '%s'",_safelogin.c_str ());
+ result = dbRealmServer.PQuery("SELECT sha_pass_hash,id,locked,last_ip,gmlevel FROM account WHERE username = '%s'",_safelogin.c_str ());
if( result )
{
///- If the IP is 'locked', check that the player comes indeed from the correct IP address
@@ -624,7 +624,7 @@
///- Update the sessionkey, last_ip and last login time in the account table for this account
// No SQL injection (escaped user name) and IP address as received by socket
const char* K_hex = K.AsHexStr();
- dbRealmServer.PExecute("UPDATE account SET sessionkey = '%s', last_ip = '%s', last_login = NOW(), locale = '%u' WHERE UPPER(username) = '%s'", K_hex, GetRemoteAddress().c_str(), _localization, _safelogin.c_str() );
+ dbRealmServer.PExecute("UPDATE account SET sessionkey = '%s', last_ip = '%s', last_login = NOW(), locale = '%u' WHERE username = '%s'", K_hex, GetRemoteAddress().c_str(), _localization, _safelogin.c_str() );
OPENSSL_free((void*)K_hex);
///- Finish SRP6 and send the final result to the client
@@ -664,7 +664,7 @@
///- Get the user id (else close the connection)
// No SQL injection (escaped user name)
- QueryResult *result = dbRealmServer.PQuery("SELECT id,sha_pass_hash FROM account WHERE UPPER(username) = '%s'",_safelogin.c_str());
+ QueryResult *result = dbRealmServer.PQuery("SELECT id,sha_pass_hash FROM account WHERE username = '%s'",_safelogin.c_str());
if(!result)
{
sLog.outError("[ERROR] user %s tried to login and we cannot find him in the database.",_login.c_str());