bton/matekasse
2
1
Fork 2
Code Issues 7 Pull requests Projects Releases Packages Wiki Activity

fixed sql injektion

Browse source
This commit is contained in:
2000-Trek 2023-07-05 21:17:36 +02:00
parent 29825b8290
commit ebb942a9a2
3 changed files with 12 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

18
main.py
View file

@ -84,7 +84,7 @@ def list():
@app.route("/list/user", methods=['GET'])
def user_info():
id = request.args.get("id")
c.execute(f"SELECT * FROM users WHERE id='{id}'")
c.execute(f"SELECT * FROM users WHERE (id) VALUES (?)", [id])
user_list = c.fetchall()
if user_list != []:
user = user_list[0]
@ -289,14 +289,14 @@ def get_id():
if c.fetchall() != []:
message = "Error: 170"
finished = queue_item
return make_response(json.dumps({"mode":"0","error":"170"}))
return make_response(json.dumps({"mode":"error","error":"170"}))
else:
c.execute(f"INSERT OR IGNORE INTO tags (tagid, userid) VALUES ({tag_id}, {user})")
message = f"Added {tag_id} to {username}"
db_log.info(message)
finished = queue_item
conn.commit()
return make_response(json.dumps({"mode":"2","username":username,"code":"1"}))
return make_response(json.dumps({"mode":"2","username":username,"message":"1"}))
elif state == "remove":
c.execute(f"SELECT * FROM tags WHERE (tagid = {tag_id} AND userid = {user})")
tags = c.fetchall()
@ -306,14 +306,14 @@ def get_id():
db_log.info(message)
finished = queue_item
conn.commit()
return make_response(json.dumps({"mode":"2","username":username,"code":"2"}))
return make_response(json.dumps({"mode":"2","username":username,"message":"2"}))
else:
message = "054"
finished = queue_item
return make_response(json.dumps({"mode":"0","error":"054"}))
return make_response(json.dumps({"mode":"error","error":"054"}))
finished = queue_item
socketio.emit("update", "update")
return make_response(json.dumps({"mode":"0","error":"418"}))
return make_response(json.dumps({"mode":"error","error":"418"}))
elif tag_list != []:
tag = tag_list[0]
@ -328,11 +328,11 @@ def get_id():
user = c.fetchall()[0]
db_log.info(f"Changed the balance from user {user[0]} from {balance_old} to {user[2]}")
socketio.emit("update", "update")
return make_response(json.dumps({"mode":"1", "username":user[1], "balance":user[2]}))
return make_response(json.dumps({"mode":"balance", "username":user[1], "balance":user[2]}))
else:
return make_response(json.dumps({"mode":"0", "error":"043"}))
return make_response(json.dumps({"mode":"error", "error":"043"}))
socketio.emit("update", "update")
return make_response(json.dumps({"mode":"0","error":"054"}))
return make_response(json.dumps({"mode":"error","error":"054"}))
#Documentation
@app.route("/documentation")