From c55c4efaf833a98a26e236048bbe326835012f05 Mon Sep 17 00:00:00 2001 From: szporowolik Date: Mon, 18 Nov 2019 01:48:03 +0100 Subject: [PATCH 1/4] 9.2 final --- 02_Windows_App/Perun_v1/Perun_v1.csproj | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/02_Windows_App/Perun_v1/Perun_v1.csproj b/02_Windows_App/Perun_v1/Perun_v1.csproj index 3a1f758..491cc39 100644 --- a/02_Windows_App/Perun_v1/Perun_v1.csproj +++ b/02_Windows_App/Perun_v1/Perun_v1.csproj @@ -31,7 +31,7 @@ szporwolik Perun Perun.htm - 0 + 1 0.9.2.%2a false true From ca48b4bc0a8698f570bf9d478343ff2b944e59b5 Mon Sep 17 00:00:00 2001 From: szporowolik Date: Mon, 18 Nov 2019 01:49:46 +0100 Subject: [PATCH 2/4] v0.9.3 preparation --- 01_DCS/Hooks/Perun.lua | 2 +- 02_Windows_App/Perun_v1/Perun_v1.csproj | 4 ++-- 02_Windows_App/Perun_v1/Properties/AssemblyInfo.cs | 4 ++-- 03_MySQL/m1081_perun.sql | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/01_DCS/Hooks/Perun.lua b/01_DCS/Hooks/Perun.lua index d9cbc10..41e1224 100644 --- a/01_DCS/Hooks/Perun.lua +++ b/01_DCS/Hooks/Perun.lua @@ -22,7 +22,7 @@ Perun.MOTD_L2 = "Wymagamy obecnosci DCS SRS oraz TeamSpeak - szczegoly na forum" -- ###################### END OF SETTINGS - DO NOT MODIFY OUTSIDE THIS SECTION ###################### -- Variable init -Perun.Version = "v0.9.2" +Perun.Version = "v0.9.3" Perun.StatusData = {} Perun.SlotsData = {} Perun.MissionData = {} diff --git a/02_Windows_App/Perun_v1/Perun_v1.csproj b/02_Windows_App/Perun_v1/Perun_v1.csproj index 491cc39..781def6 100644 --- a/02_Windows_App/Perun_v1/Perun_v1.csproj +++ b/02_Windows_App/Perun_v1/Perun_v1.csproj @@ -31,8 +31,8 @@ szporwolik Perun Perun.htm - 1 - 0.9.2.%2a + 0 + 0.9.3.%2a false true true diff --git a/02_Windows_App/Perun_v1/Properties/AssemblyInfo.cs b/02_Windows_App/Perun_v1/Properties/AssemblyInfo.cs index 0506b92..f481289 100644 --- a/02_Windows_App/Perun_v1/Properties/AssemblyInfo.cs +++ b/02_Windows_App/Perun_v1/Properties/AssemblyInfo.cs @@ -33,7 +33,7 @@ using System.Runtime.InteropServices; // Możesz określić wszystkie wartości lub użyć domyślnych numerów kompilacji i poprawki // przy użyciu symbolu „*”, tak jak pokazano poniżej: // [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("0.9.2.0")] -[assembly: AssemblyFileVersion("0.9.2.0")] +[assembly: AssemblyVersion("0.9.3.0")] +[assembly: AssemblyFileVersion("0.9.3.0")] [assembly: NeutralResourcesLanguage("en")] diff --git a/03_MySQL/m1081_perun.sql b/03_MySQL/m1081_perun.sql index 1d53df4..a901a81 100644 --- a/03_MySQL/m1081_perun.sql +++ b/03_MySQL/m1081_perun.sql @@ -17,7 +17,7 @@ CREATE TABLE IF NOT EXISTS `pe_Config` ( ) ENGINE=InnoDB DEFAULT CHARSET=utf8; INSERT INTO `pe_Config` (`pe_Config_id`, `pe_Config_payload`) VALUES -(1, 'v0.9.1'); +(1, 'v0.9.3'); DROP TABLE IF EXISTS `pe_DataMissionHashes`; CREATE TABLE IF NOT EXISTS `pe_DataMissionHashes` ( From c36befd5a060f2795c495e58c57f87e8fe301656 Mon Sep 17 00:00:00 2001 From: szporowolik Date: Mon, 23 Dec 2019 13:43:19 +0100 Subject: [PATCH 3/4] Changes related to #27 . This shall prevent SQL injection. --- .../Perun_v1/01_Classes/DatabaseController.cs | 38 +++++++++++++++---- 1 file changed, 30 insertions(+), 8 deletions(-) diff --git a/02_Windows_App/Perun_v1/01_Classes/DatabaseController.cs b/02_Windows_App/Perun_v1/01_Classes/DatabaseController.cs index 38af228..dc15e24 100644 --- a/02_Windows_App/Perun_v1/01_Classes/DatabaseController.cs +++ b/02_Windows_App/Perun_v1/01_Classes/DatabaseController.cs @@ -48,17 +48,17 @@ public class DatabaseController { // Add entry to chat log SQLQueryTxt = "INSERT INTO `pe_DataPlayers` (`pe_DataPlayers_ucid`) SELECT '" + TCPFrame.payload.ucid + "' FROM DUAL WHERE NOT EXISTS (SELECT * FROM `pe_DataPlayers` where `pe_DataPlayers_ucid` = '" + TCPFrame.payload.ucid + "' );"; - SQLQueryTxt += "UPDATE `pe_DataPlayers` SET `pe_DataPlayers_updated` = " + TCPFrameTimestamp + ",`pe_DataPlayers_lastname`='" + TCPFrame.payload.player + "' WHERE `pe_DataPlayers_ucid`='" + TCPFrame.payload.ucid + "' ;"; + SQLQueryTxt += "UPDATE `pe_DataPlayers` SET `pe_DataPlayers_updated` = " + TCPFrameTimestamp + ",`pe_DataPlayers_lastname`=@PAR_payload_player WHERE `pe_DataPlayers_ucid`='" + TCPFrame.payload.ucid + "' ;"; SQLQueryTxt += "INSERT INTO `pe_DataMissionHashes` (`pe_DataMissionHashes_hash`,`pe_DataMissionHashes_instance`) SELECT '" + TCPFrame.payload.missionhash + "','" + TCPFrameInstance + "' FROM DUAL WHERE NOT EXISTS (SELECT * FROM `pe_DataMissionHashes` where `pe_DataMissionHashes_hash` ='" + TCPFrame.payload.missionhash + "' AND `pe_DataMissionHashes_instance`=" + TCPFrameInstance + ");"; SQLQueryTxt += "UPDATE `pe_DataMissionHashes` SET `pe_DataMissionHashes_datetime` = " + TCPFrameTimestamp + " WHERE `pe_DataMissionHashes_hash` = '" + TCPFrame.payload.missionhash + "' AND `pe_DataMissionHashes_instance`=" + TCPFrameInstance + " ;"; - SQLQueryTxt += "INSERT INTO `pe_LogChat` (`pe_LogChat_id`,`pe_LogChat_datetime`, `pe_LogChat_playerid`, `pe_LogChat_msg`, `pe_LogChat_all`,`pe_LogChat_missionhash_id`) VALUES (NULL,'" + TCPFrame.payload.datetime + "', (SELECT `pe_DataPlayers_id` from `pe_DataPlayers` WHERE `pe_DataPlayers_ucid` = '" + TCPFrame.payload.ucid + "'), '" + TCPFrame.payload.msg + "', '" + TCPFrame.payload.all + "',(SELECT `pe_DataMissionHashes_id` FROM `pe_DataMissionHashes` WHERE `pe_DataMissionHashes_hash` = '" + TCPFrame.payload.missionhash + "'));"; + SQLQueryTxt += "INSERT INTO `pe_LogChat` (`pe_LogChat_id`,`pe_LogChat_datetime`, `pe_LogChat_playerid`, `pe_LogChat_msg`, `pe_LogChat_all`,`pe_LogChat_missionhash_id`) VALUES (NULL,'" + TCPFrame.payload.datetime + "', (SELECT `pe_DataPlayers_id` from `pe_DataPlayers` WHERE `pe_DataPlayers_ucid` = '" + TCPFrame.payload.ucid + "'), @PAR_payload_msg, '" + TCPFrame.payload.all + "',(SELECT `pe_DataMissionHashes_id` FROM `pe_DataMissionHashes` WHERE `pe_DataMissionHashes_hash` = '" + TCPFrame.payload.missionhash + "'));"; } else if (TCPFrameType == "51") { // Add entry to event log SQLQueryTxt = "INSERT INTO `pe_DataMissionHashes` (`pe_DataMissionHashes_hash`,`pe_DataMissionHashes_instance`) SELECT '" + TCPFrame.payload.log_missionhash + "','" + TCPFrameInstance + "' FROM DUAL WHERE NOT EXISTS (SELECT * FROM `pe_DataMissionHashes` where `pe_DataMissionHashes_hash` = '" + TCPFrame.payload.log_missionhash + "' AND `pe_DataMissionHashes_instance`=" + TCPFrameInstance + ");"; SQLQueryTxt += "UPDATE `pe_DataMissionHashes` SET `pe_DataMissionHashes_datetime` = " + TCPFrameTimestamp + " WHERE `pe_DataMissionHashes_hash` = '" + TCPFrame.payload.log_missionhash + "' AND `pe_DataMissionHashes_instance`=" + TCPFrameInstance + ";"; - SQLQueryTxt += "INSERT INTO `pe_LogEvent` (`pe_LogEvent_arg1`,`pe_LogEvent_arg2`,`pe_LogEvent_id`, `pe_LogEvent_datetime`, `pe_LogEvent_type`, `pe_LogEvent_content`,`pe_LogEvent_missionhash_id`) VALUES ('" + TCPFrame.payload.log_arg_1 + "','" + TCPFrame.payload.log_arg_2 + "', NULL, '" + TCPFrame.payload.log_datetime + "', '" + TCPFrame.payload.log_type + "', '" + TCPFrame.payload.log_content + "', (SELECT `pe_DataMissionHashes_id` FROM `pe_DataMissionHashes` WHERE `pe_DataMissionHashes_hash` = '" + TCPFrame.payload.log_missionhash + "'));"; + SQLQueryTxt += "INSERT INTO `pe_LogEvent` (`pe_LogEvent_arg1`,`pe_LogEvent_arg2`,`pe_LogEvent_id`, `pe_LogEvent_datetime`, `pe_LogEvent_type`, `pe_LogEvent_content`,`pe_LogEvent_missionhash_id`) VALUES ('" + TCPFrame.payload.log_arg_1 + "','" + TCPFrame.payload.log_arg_2 + "', NULL, '" + TCPFrame.payload.log_datetime + "', '" + TCPFrame.payload.log_type + "', @PAR_log_content, (SELECT `pe_DataMissionHashes_id` FROM `pe_DataMissionHashes` WHERE `pe_DataMissionHashes_hash` = '" + TCPFrame.payload.log_missionhash + "'));"; } else if (TCPFrameType == "52") { @@ -76,8 +76,8 @@ public class DatabaseController // User logged in to DCS server SQLQueryTxt = "INSERT INTO `pe_DataPlayers` (`pe_DataPlayers_ucid`) SELECT '" + TCPFrame.payload.login_ucid + "' FROM DUAL WHERE NOT EXISTS (SELECT * FROM `pe_DataPlayers` where pe_DataPlayers_ucid='" + TCPFrame.payload.login_ucid + "');"; - SQLQueryTxt += "UPDATE `pe_DataPlayers` SET pe_DataPlayers_lastip='" + TCPFrame.payload.login_ipaddr + "', pe_DataPlayers_lastname='" + TCPFrame.payload.login_name + "',pe_DataPlayers_updated='" + TCPFrame.payload.login_datetime + "' WHERE `pe_DataPlayers_ucid`= '" + TCPFrame.payload.login_ucid + "';"; - SQLQueryTxt += "INSERT INTO `pe_LogLogins` (`pe_LogLogins_datetime`, `pe_LogLogins_playerid`, `pe_LogLogins_name`, `pe_LogLogins_ip`,`pe_LogLogins_instance`) VALUES ('" + TCPFrame.payload.login_datetime + "', (SELECT pe_DataPlayers_id from pe_DataPlayers WHERE pe_DataPlayers_ucid = '" + TCPFrame.payload.login_ucid + "'), '" + TCPFrame.payload.login_name + "', '" + TCPFrame.payload.login_ipaddr + "','" + TCPFrameInstance + "');"; + SQLQueryTxt += "UPDATE `pe_DataPlayers` SET pe_DataPlayers_lastip='" + TCPFrame.payload.login_ipaddr + "', pe_DataPlayers_lastname=@PAR_login_name,pe_DataPlayers_updated='" + TCPFrame.payload.login_datetime + "' WHERE `pe_DataPlayers_ucid`= '" + TCPFrame.payload.login_ucid + "';"; + SQLQueryTxt += "INSERT INTO `pe_LogLogins` (`pe_LogLogins_datetime`, `pe_LogLogins_playerid`, `pe_LogLogins_name`, `pe_LogLogins_ip`,`pe_LogLogins_instance`) VALUES ('" + TCPFrame.payload.login_datetime + "', (SELECT pe_DataPlayers_id from pe_DataPlayers WHERE pe_DataPlayers_ucid = '" + TCPFrame.payload.login_ucid + "'), @PAR_login_name, '" + TCPFrame.payload.login_ipaddr + "','" + TCPFrameInstance + "');"; } else if (TCPFrameType == "-1") { @@ -87,10 +87,10 @@ public class DatabaseController else { // General definition used for 1-10 type packets - TCPFramePayload = JsonConvert.SerializeObject(TCPFrame.payload); // Deserialize payload + SQLQueryTxt = "INSERT INTO `pe_DataRaw` (`pe_dataraw_type`,`pe_dataraw_instance`) SELECT '" + TCPFrameType + "','" + TCPFrameInstance + "' FROM DUAL WHERE NOT EXISTS (SELECT * FROM `pe_DataRaw` WHERE `pe_dataraw_type` = '" + TCPFrameType + "' AND `pe_dataraw_instance` = " + TCPFrameInstance + ");"; - SQLQueryTxt += "UPDATE `pe_DataRaw` SET `pe_dataraw_payload` = JSON_QUOTE('" + TCPFramePayload + "'), `pe_dataraw_updated`=" + TCPFrameTimestamp + " WHERE `pe_dataraw_type`=" + TCPFrameType + " AND `pe_dataraw_instance` = " + TCPFrameInstance + ";"; + SQLQueryTxt += "UPDATE `pe_DataRaw` SET `pe_dataraw_payload` = JSON_QUOTE(@PAR_TCPFramePayload), `pe_dataraw_updated`=" + TCPFrameTimestamp + " WHERE `pe_dataraw_type`=" + TCPFrameType + " AND `pe_dataraw_instance` = " + TCPFrameInstance + ";"; } // Connect to mysql and execute sql @@ -104,7 +104,29 @@ public class DatabaseController DatabaseConnection.Open(); DatabaseStatus = true; MySqlCommand DatabaseCommand = new MySqlCommand(SQLQueryTxt, DatabaseConnection); - MySqlDataReader DatabaseReader = DatabaseCommand.ExecuteReader(); + + // Add parameters - prevent SQL injection + if (TCPFrameType == "50") + { + DatabaseCommand.Parameters.AddWithValue("@PAR_payload_player", TCPFrame.payload.player); + DatabaseCommand.Parameters.AddWithValue("@PAR_payload_msg", TCPFrame.payload.msg); + } + else if (TCPFrameType == "51") + { + DatabaseCommand.Parameters.AddWithValue("@PAR_log_content", TCPFrame.payload.log_content); + } + else if (TCPFrameType == "53") + { + DatabaseCommand.Parameters.AddWithValue("@PAR_login_name", TCPFrame.payload.login_name); + } + else + { + TCPFramePayload = JsonConvert.SerializeObject(TCPFrame.payload); // Deserialize payload + DatabaseCommand.Parameters.AddWithValue("@PAR_TCPFramePayload", TCPFramePayload); + } + // End of add parameters + + MySqlDataReader DatabaseReader = DatabaseCommand.ExecuteReader(); if (DatabaseReader.HasRows) { From a117d37bc01274dc2952f1ef5d8ed1e8cc3b830f Mon Sep 17 00:00:00 2001 From: szporowolik Date: Mon, 23 Dec 2019 13:48:50 +0100 Subject: [PATCH 4/4] Update and sync with 0.9.3 --- 03_MySQL/m1081_perun.sql | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/03_MySQL/m1081_perun.sql b/03_MySQL/m1081_perun.sql index b068485..e4265f4 100644 --- a/03_MySQL/m1081_perun.sql +++ b/03_MySQL/m1081_perun.sql @@ -17,7 +17,7 @@ CREATE TABLE IF NOT EXISTS `pe_Config` ( ) ENGINE=InnoDB DEFAULT CHARSET=utf8; INSERT INTO `pe_Config` (`pe_Config_id`, `pe_Config_payload`) VALUES -(1, 'v0.9.2'); +(1, 'v0.9.3'); DROP TABLE IF EXISTS `pe_DataMissionHashes`; CREATE TABLE IF NOT EXISTS `pe_DataMissionHashes` ( @@ -115,8 +115,7 @@ CREATE TABLE IF NOT EXISTS `pe_LogStats` ( `pe_LogStats_playerid` bigint(20) DEFAULT NULL, `pe_LogStats_typeid` int(11) DEFAULT NULL, `pe_LogStats_masterslot` int(11) DEFAULT NULL, - `pe_LogStats_seat` int(10) UNSIGNED DEFAULT NULL, - `ps_kills_X` int(11) UNSIGNED NOT NULL DEFAULT '0', + `pe_LogStats_seat` int(10) DEFAULT NULL, `ps_pvp` int(11) UNSIGNED NOT NULL DEFAULT '0', `ps_deaths` int(11) UNSIGNED NOT NULL DEFAULT '0', `ps_ejections` int(11) UNSIGNED NOT NULL DEFAULT '0',