starred/qb-core
1
0
Fork 0
mirror of https://github.com/qbcore-fivem/qb-core.git synced 2026-09-04 17:23:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

[FIX] Security match sql (#925)

Browse Source 
* Added PrepForSQL function

performs a check to a string with expected patterns to be matched.

* Bug Fixes

After talking with Stan I realized that it wasn't testing strings so I set it up to ensure data is a string.

I also reworded the event log.
This commit is contained in:
R0adRa93
2023-01-18 18:53:38 +01:00
committed by GitHub
parent e6f5bf5ab6
commit 01e8597f07
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/functions.lua
+2 -1
View File
@@ -417,11 +417,12 @@ end
--- SQL Pattern Matching --- SQL Pattern Matching
function QBCore.Functions.PrepForSQL(source,data,pattern) function QBCore.Functions.PrepForSQL(source,data,pattern)
data = tostring(data)
local src = source local src = source
local player = QBCore.Functions.GetPlayer(src) local player = QBCore.Functions.GetPlayer(src)
local result = string.match(data, pattern) local result = string.match(data, pattern)
if not result or string.len(result) ~= string.len(data) then if not result or string.len(result) ~= string.len(data) then
TriggerEvent('qb-log:server:CreateLog', 'anticheat', 'SQL Injection Attempted', 'red', string.format('%s Attempted a SQL Exploit!', player.PlayerData.license)) TriggerEvent('qb-log:server:CreateLog', 'anticheat', 'SQL Exploit Attempted', 'red', string.format('%s attempted to exploit SQL!', player.PlayerData.license))
return false return false
end end
return true return true