Changeset 38

Timestamp:

10/26/06 14:44:15 (14 years ago)

Author:

exi

Message:

Changed alliance pictures to work like the corp-ones (eg: upload ALLIANCE_ID.jpg to img/alliances/)
Fixed Security Issue in Server Synchronization

Location:

dev/common

Files:

• admin_sync.php (modified) (1 diff)
• alliance_detail.php (modified) (2 diffs)
• sync_server.php (modified) (1 diff)

dev/common/admin_sync.php

@@ -97 +97 @@
         for ($i = 0; $i<$results; $i++)
         {
-            $update->execute("update kb3_pilots set plt_externalid='".$matches[2][$i]."' where plt_name='".$matches[1][$i]."'");
+            $update->execute("update kb3_pilots set plt_externalid='".$matches[2][$i]."' where plt_name='".addslashes($matches[1][$i])."' limit 1");
         }
         $html .= "Synchronization complete, got $results new ids from server running version ".$version[0].'.'.$version[1].'.'.$version[2].'.<br>';

dev/common/alliance_detail.php

@@ -28 +28 @@
 $html .= "<table class=kb-table width=\"100%\" border=\"0\" cellspacing=1><tr class=kb-table-row-even><td rowspan=8 width=128 align=center>";
 
-$html .= "<img src=\"" . IMG_URL . "/alliances/default.gif\" border=\"0\">";
-$html .= "</td>";
+if (file_exists("img/alliances/".$alliance->getID().".jpg"))
+{
+    $html .= "<img src=\"".IMG_URL."/alliances/".$alliance->getID().".jpg\" border=\"0\"></td>";
+}
+else
+{
+    $html .= "<img src=\"".IMG_URL."/alliances/default.gif\" border=\"0\"></td>";
+}
 
 $html .= "<td class=kb-table-cell width=180><b>Kills:</b></td><td class=kl-kill>" . $klist->getCount() . "</td></tr>";
@@ -293 +299 @@
 $page->setContent($html);
 $page->generate();
-
 ?>

dev/common/sync_server.php

@@ -66 +66 @@
         // we dont got that one in our database, update
         // TODO: we don't care about missing pilots yet
-        $update->execute("update kb3_pilots set plt_externalid='".$id."' where plt_name='".$name."'");
+        $update->execute("update kb3_pilots set plt_externalid='".$id."' where plt_name='".addslashes($name)."' limit 1");
     }
     else