SteamWar/SpigotCore
Archiviert
13
0

Rework SQL statements to actually use PreparedStatements for security reasons

Dieser Commit ist enthalten in:
Lixfel 2020-02-07 16:45:02 +01:00
Ursprung a6d5e70f46
Commit 151ec960bb
14 geänderte Dateien mit 96 neuen und 125 gelöschten Zeilen

Datei anzeigen

@ -36,17 +36,13 @@ public class BauweltMember{
} }
public void remove(){ public void remove(){
SQL.update("DELETE FROM BauweltMember WHERE BauweltID = " + bauweltID + " AND MemberID = " + memberID); SQL.update("DELETE FROM BauweltMember WHERE BauweltID = ? AND MemberID = ?", bauweltID, memberID);
members.remove(this); members.remove(this);
} }
private void updateDB(){ private void updateDB(){
SQL.update("INSERT INTO BauweltMember" + SQL.update("INSERT INTO BauweltMember (BauweltID, MemberID, Build, WorldEdit, World) VALUES (?, ?, ?, ?, ?) ON DUPLICATE KEY UPDATE Build = VALUES(Build), WorldEdit = VALUES(WorldEdit), World = VALUES(World)",
" (BauweltID, MemberID, Build, WorldEdit, World)" + bauweltID, memberID, build, worldEdit, world);
" VALUES" +
" ('" + bauweltID + "', '" + memberID + "', '" + SQL.booleanToInt(build) + "', '" + SQL.booleanToInt(worldEdit) + "', '" + SQL.booleanToInt(world) + "')" +
" ON DUPLICATE KEY UPDATE" +
" Build = VALUES(Build), WorldEdit = VALUES(WorldEdit), World = VALUES(World)");
} }
public static BauweltMember getBauMember(UUID ownerID, UUID memberID){ public static BauweltMember getBauMember(UUID ownerID, UUID memberID){
@ -57,7 +53,7 @@ public class BauweltMember{
for(BauweltMember member : members) for(BauweltMember member : members)
if(member.memberID == memberID) if(member.memberID == memberID)
return member; return member;
ResultSet member = SQL.select("SELECT * FROM BauweltMember WHERE BauweltID = '" + ownerID + "' AND MemberID = '" + memberID + "'"); ResultSet member = SQL.select("SELECT * FROM BauweltMember WHERE BauweltID = ? AND MemberID = ?", ownerID, memberID);
try { try {
if(member == null || !member.next()){ if(member == null || !member.next()){
return null; return null;
@ -77,7 +73,7 @@ public class BauweltMember{
public static List<BauweltMember> getMembers(int bauweltID){ public static List<BauweltMember> getMembers(int bauweltID){
try{ try{
ResultSet memberlist = SQL.select("SELECT * FROM BauweltMember WHERE BauweltID = '" + bauweltID + "'"); ResultSet memberlist = SQL.select("SELECT * FROM BauweltMember WHERE BauweltID = ?", bauweltID);
List<BauweltMember> members = new LinkedList<>(); List<BauweltMember> members = new LinkedList<>();
while(memberlist.next()){ while(memberlist.next()){
int memberID = memberlist.getInt("MemberID"); int memberID = memberlist.getInt("MemberID");

Datei anzeigen

@ -21,12 +21,12 @@ public class CheckedSchematic {
private final String declineReason; private final String declineReason;
private CheckedSchematic(String schemName, int schemOwner, int validator, Timestamp startTime, Timestamp endTime, String declineReason, boolean insertDB){ private CheckedSchematic(String schemName, int schemOwner, int validator, Timestamp startTime, Timestamp endTime, String declineReason, boolean insertDB){
this.schemName = SQL.disarmString(schemName); this.schemName = schemName;
this.schemOwner = schemOwner; this.schemOwner = schemOwner;
this.validator = validator; this.validator = validator;
this.startTime = startTime; this.startTime = startTime;
this.endTime = endTime; this.endTime = endTime;
this.declineReason = SQL.disarmString(declineReason); this.declineReason = declineReason;
if(insertDB) if(insertDB)
insertDB(); insertDB();
} }
@ -41,9 +41,8 @@ public class CheckedSchematic {
private void insertDB(){ private void insertDB(){
SQL.update("INSERT INTO CheckedSchematic" + SQL.update("INSERT INTO CheckedSchematic" +
" (SchemName, SchemOwner, Validator, StartTime, EndTime, DeclineReason)" + " (SchemName, SchemOwner, Validator, StartTime, EndTime, DeclineReason) VALUES (?, ?, ?, ?, ?, ?)",
" VALUES" + schemName, schemOwner, validator, startTime, endTime, declineReason);
" ('"+ schemName + "', '" + schemOwner + "', '" + validator + "', '" + startTime.toString() + "', '" + endTime.toString() + "', '" + declineReason + "')");
} }
public static List<CheckedSchematic> getLastDeclined(UUID schemOwner){ public static List<CheckedSchematic> getLastDeclined(UUID schemOwner){
@ -53,7 +52,7 @@ public class CheckedSchematic {
public static List<CheckedSchematic> getLastDelined(int schemOwner){ public static List<CheckedSchematic> getLastDelined(int schemOwner){
List<CheckedSchematic> lastDeclined = new LinkedList<>(); List<CheckedSchematic> lastDeclined = new LinkedList<>();
try{ try{
ResultSet lastRS = SQL.select("SELECT * FROM CheckedSchematic WHERE SchemOwner = '" + schemOwner + "' AND DeclineReason != '' ORDER BY EndTime DESC"); ResultSet lastRS = SQL.select("SELECT * FROM CheckedSchematic WHERE SchemOwner = ? AND DeclineReason != '' ORDER BY EndTime DESC", schemOwner);
while(lastRS.next()){ while(lastRS.next()){
String schemName = lastRS.getString("SchemName"); String schemName = lastRS.getString("SchemName");
int validator = lastRS.getInt("Validator"); int validator = lastRS.getInt("Validator");
@ -69,7 +68,7 @@ public class CheckedSchematic {
} }
public void remove() { public void remove() {
SQL.update("DELETE FROM CheckedSchematic WHERE SchemOwner = " + this.schemOwner + " AND SchemName = '" + this.schemName + "'"); SQL.update("DELETE FROM CheckedSchematic WHERE SchemOwner = ? AND SchemName = ?", schemOwner, schemName);
} }
public String getSchemName() { public String getSchemName() {

Datei anzeigen

@ -13,7 +13,7 @@ public class DownloadSchematic {
private static final String BASE = "https://steamwar.de/download.php?schem="; private static final String BASE = "https://steamwar.de/download.php?schem=";
public static String getLink(Schematic schem){ public static String getLink(Schematic schem){
ResultSet rs = SQL.select("SELECT * FROM SchemDownload WHERE SchemID = " + schem.getSchemID()); ResultSet rs = SQL.select("SELECT * FROM SchemDownload WHERE SchemID = ?", schem.getSchemID());
try { try {
if(rs.next()) if(rs.next())
return BASE + rs.getString("Link"); return BASE + rs.getString("Link");
@ -30,7 +30,7 @@ public class DownloadSchematic {
cript.reset(); cript.reset();
cript.update((Instant.now().toString() + schem.getSchemOwner() + schem.getSchemID()).getBytes()); cript.update((Instant.now().toString() + schem.getSchemOwner() + schem.getSchemID()).getBytes());
String hash = DatatypeConverter.printHexBinary(cript.digest()); String hash = DatatypeConverter.printHexBinary(cript.digest());
SQL.update("INSERT INTO SchemDownload (SchemID, Link) VALUES (" + schem.getSchemID() + ", '" + hash + "')"); SQL.update("INSERT INTO SchemDownload (SchemID, Link) VALUES (?, ?)", schem.getSchemID(), hash);
return BASE + hash; return BASE + hash;
} }
} }

Datei anzeigen

@ -16,22 +16,22 @@ public class Event {
private final int maximumTeamMembers; private final int maximumTeamMembers;
private final boolean publicSchemsOnly; private final boolean publicSchemsOnly;
private Event(int eventID, String eventName, Timestamp start, Timestamp end, int maximumTeamMembers, boolean publicSchemsOnly){ private Event(ResultSet rs) throws SQLException{
this.eventID = eventID; this.eventID = rs.getInt("EventID");
this.eventName = eventName; this.eventName = rs.getString("EventName");
this.start = start; this.start = rs.getTimestamp("Start");
this.end = end; this.end = rs.getTimestamp("End");
this.maximumTeamMembers = maximumTeamMembers; this.maximumTeamMembers = rs.getInt("MaximumTeamMembers");
this.publicSchemsOnly = publicSchemsOnly; this.publicSchemsOnly = rs.getBoolean("PublicSchemsOnly");
} }
public static Event get(int eventID){ public static Event get(int eventID){
ResultSet rs = SQL.select("SELECT * FROM Event WHERE EventID = " + eventID); ResultSet rs = SQL.select("SELECT * FROM Event WHERE EventID = ?", eventID);
try{ try{
if(!rs.next()) if(!rs.next())
throw new IllegalArgumentException(); throw new IllegalArgumentException();
return new Event(eventID, rs.getString("EventName"), rs.getTimestamp("Start"), rs.getTimestamp("End"), rs.getInt("MaximumTeamMembers"), rs.getBoolean("PublicSchemsOnly")); return new Event(rs);
}catch (SQLException e){ }catch (SQLException e){
Bukkit.getLogger().log(Level.SEVERE, "Failed to load Event", e); Bukkit.getLogger().log(Level.SEVERE, "Failed to load Event", e);
throw new SecurityException(); throw new SecurityException();

Datei anzeigen

@ -14,26 +14,20 @@ public class EventFight {
private int kampfleiter; private int kampfleiter;
private int ergebnis; private int ergebnis;
private EventFight(int eventID, int fightID, int teamBlue, int teamRed, int kampfleiter, int ergebnis){ private EventFight(ResultSet rs) throws SQLException{
this.eventID = eventID; this.eventID = rs.getInt("EventID");
this.fightID = fightID; this.fightID = rs.getInt("FightID");
this.teamBlue = teamBlue; this.teamBlue = rs.getInt("TeamBlue");
this.teamRed = teamRed; this.teamRed = rs.getInt("TeamRed");
this.kampfleiter = kampfleiter; this.kampfleiter = rs.getInt("Kampfleiter");
this.ergebnis = ergebnis; this.ergebnis = rs.getInt("Ergebnis");
} }
public static EventFight get(int fightID){ public static EventFight get(int fightID){
ResultSet rs = SQL.select("SELECT * FROM EventFight WHERE FightID = " + fightID); ResultSet rs = SQL.select("SELECT * FROM EventFight WHERE FightID = " + fightID);
try{ try{
rs.next(); rs.next();
return new EventFight( return new EventFight(rs);
rs.getInt("EventID"),
fightID,
rs.getInt("TeamBlue"),
rs.getInt("TeamRed"),
rs.getInt("Kampfleiter"),
rs.getInt("Ergebnis"));
}catch (SQLException e){ }catch (SQLException e){
Bukkit.getLogger().log(Level.SEVERE, "Failed to load EventFight", e); Bukkit.getLogger().log(Level.SEVERE, "Failed to load EventFight", e);
} }
@ -41,7 +35,7 @@ public class EventFight {
} }
public void setErgebnis(int winner){ public void setErgebnis(int winner){
SQL.update("UPDATE EventFight SET Ergebnis = " + winner + " WHERE FightID = " + fightID); SQL.update("UPDATE EventFight SET Ergebnis = ? WHERE FightID = ?", winner, fightID);
} }
public int getTeamBlue() { public int getTeamBlue() {

Datei anzeigen

@ -8,9 +8,8 @@ public class Fight {
private Fight(){} private Fight(){}
public static int create(String gamemode, String arena, Timestamp starttime, int duration, int blueleader, int redleader, int blueschem, int redschem, int win, String wincondition){ public static int create(String gamemode, String arena, Timestamp starttime, int duration, int blueleader, int redleader, int blueschem, int redschem, int win, String wincondition){
SQL.update("INSERT INTO Fight (GameMode, Arena, StartTime, Duration, BlueLeader, RedLeader, BlueSchem, RedSchem, Win, WinCondition) VALUES (" + SQL.update("INSERT INTO Fight (GameMode, Arena, StartTime, Duration, BlueLeader, RedLeader, BlueSchem, RedSchem, Win, WinCondition) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
"'" + SQL.disarmString(gamemode) + "', '" + SQL.disarmString(arena) + "', '" + starttime.toString() + "', " + duration + ", " + blueleader + ", " + redleader + ", " + blueschem + ", " + redschem + ", " + win + ", '" + SQL.disarmString(wincondition) + "'" + gamemode, arena, starttime, duration, blueleader, redleader,blueschem, redschem, win, wincondition);
")");
ResultSet rs = SQL.select("SELECT LAST_INSERT_ID() AS FightID"); ResultSet rs = SQL.select("SELECT LAST_INSERT_ID() AS FightID");
try{ try{
if(!rs.next()) if(!rs.next())

Datei anzeigen

@ -4,8 +4,7 @@ public class FightPlayer {
private FightPlayer(){} private FightPlayer(){}
public static void create(int fightID, int userID, String kit, int kills, boolean isOut){ public static void create(int fightID, int userID, String kit, int kills, boolean isOut){
SQL.update("INSERT INTO FightPlayer (FightID, UserID, Kit, Kills, IsOut) VALUES (" + SQL.update("INSERT INTO FightPlayer (FightID, UserID, Kit, Kills, IsOut) VALUES (?, ?, ?, ?, ?)",
fightID + ", " + userID + ", '" + SQL.disarmString(kit) + "', " + kills + ", " + SQL.booleanToInt(isOut) + fightID, userID, kit, kills, isOut);
")");
} }
} }

Datei anzeigen

@ -23,7 +23,7 @@ public class PersonalKit {
} }
public static PersonalKit get(int userID, String gamemode){ public static PersonalKit get(int userID, String gamemode){
ResultSet rs = SQL.select("SELECT * FROM PersonalKit WHERE UserID = '" + userID + "' AND GameMode = '" + SQL.disarmString(gamemode) + "'"); ResultSet rs = SQL.select("SELECT * FROM PersonalKit WHERE UserID = ? AND GameMode = ?", userID, gamemode);
try { try {
if(!rs.next()) if(!rs.next())
return null; return null;
@ -41,12 +41,8 @@ public class PersonalKit {
YamlConfiguration armorConfig = new YamlConfiguration(); YamlConfiguration armorConfig = new YamlConfiguration();
armorConfig.set("Armor", armor); armorConfig.set("Armor", armor);
SQL.update("INSERT INTO PersonalKit" + SQL.update("INSERT INTO PersonalKit (UserID, GameMode, Inventory, Armor) VALUES (?, ?, ?, ?) ON DUPLICATE KEY UPDATE Inventory = VALUES(Inventory), Armor = VALUES(Armor)",
" (UserID, GameMode, Inventory, Armor)" + userID, gamemode, inventoryConfig.saveToString(), armorConfig.saveToString());
" VALUES" +
" ('" + userID + "', '" + gamemode + "', '" + SQL.disarmString(inventoryConfig.saveToString()) + "', '" + SQL.disarmString(armorConfig.saveToString()) + "')" +
" ON DUPLICATE KEY UPDATE" +
" Inventory = VALUES(Inventory), Armor = VALUES(Armor)");
return get(userID, gamemode); return get(userID, gamemode);
} }

Datei anzeigen

@ -34,13 +34,6 @@ public class SQL {
connect(); connect();
} }
static Integer booleanToInt(boolean b){
if(b)
return 1;
else
return 0;
}
public static void closeConnection() { public static void closeConnection() {
try { try {
con.close(); con.close();
@ -49,44 +42,52 @@ public class SQL {
} }
} }
static Connection getCon(){ static void update(String qry, Object... objects) {
return con;
}
static void update(String qry) {
try { try {
PreparedStatement st = con.prepareStatement(qry); prepare(qry, objects).executeUpdate();
st.executeUpdate();
} catch (SQLException e) { } catch (SQLException e) {
reconnect(); reconnect();
try { try {
PreparedStatement st = con.prepareStatement(qry); prepare(qry, objects).executeUpdate();
st.executeUpdate();
} catch (SQLException ex) { } catch (SQLException ex) {
throw new SecurityException("Could not perform update", ex); throw new SecurityException("Could not perform update", ex);
} }
} }
} }
static ResultSet select(String qry) { static ResultSet select(String qry, Object... objects){
try { try {
PreparedStatement st = con.prepareStatement(qry); return prepare(qry, objects).executeQuery();
return st.executeQuery();
} catch (SQLException e) { } catch (SQLException e) {
reconnect(); reconnect();
try { try {
PreparedStatement st = con.prepareStatement(qry); return prepare(qry, objects).executeQuery();
return st.executeQuery();
} catch (SQLException ex) { } catch (SQLException ex) {
throw new SecurityException("Could not perform select", ex); throw new SecurityException("Could not perform select", ex);
} }
} }
} }
static String disarmString(String s){ static Blob blob(){
return s.replace("'", ""); try {
return con.createBlob();
} catch (SQLException e) {
reconnect();
try {
return con.createBlob();
} catch (SQLException ex) {
throw new SecurityException("Could not create blob", ex);
}
}
} }
private static PreparedStatement prepare(String qry, Object... objects) throws SQLException{
PreparedStatement st = con.prepareStatement(qry);
for(int i = 0; i < objects.length; i++){
st.setObject(i+1, objects[i]);
}
return st;
}
private static void connect() { private static void connect() {
try { try {

Datei anzeigen

@ -13,7 +13,7 @@ public class SWException {
if(logDisabled) if(logDisabled)
return; return;
String server = SQL.disarmString(Bukkit.getWorlds().get(0).getName()); String server = Bukkit.getWorlds().get(0).getName();
StringBuilder stacktrace = new StringBuilder(logEvent.getSource().toString()); StringBuilder stacktrace = new StringBuilder(logEvent.getSource().toString());
Throwable throwable = logEvent.getThrown(); Throwable throwable = logEvent.getThrown();
@ -40,6 +40,7 @@ public class SWException {
for(Player player : Bukkit.getOnlinePlayers()) for(Player player : Bukkit.getOnlinePlayers())
message += player.getName() + " "; message += player.getName() + " ";
SQL.update("INSERT INTO Exception (server, message, stacktrace) VALUES ('" + server + "', '" + SQL.disarmString(message) + "', '" + SQL.disarmString(stacktrace.toString()) + "')"); SQL.update("INSERT INTO Exception (server, message, stacktrace) VALUES (?, ?, ?)",
server, message, stacktrace.toString());
} }
} }

Datei anzeigen

@ -4,11 +4,9 @@ import com.sk89q.worldedit.extent.clipboard.Clipboard;
import de.steamwar.core.Core; import de.steamwar.core.Core;
import org.bukkit.entity.Player; import org.bukkit.entity.Player;
import java.io.ByteArrayInputStream;
import java.io.IOException; import java.io.IOException;
import java.io.InputStream; import java.io.InputStream;
import java.sql.Blob; import java.sql.Blob;
import java.sql.PreparedStatement;
import java.sql.ResultSet; import java.sql.ResultSet;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.ArrayList; import java.util.ArrayList;
@ -42,12 +40,8 @@ public class Schematic {
} }
public static void createSchem(String schemName, int schemOwner, String item, SchematicType schemType){ public static void createSchem(String schemName, int schemOwner, String item, SchematicType schemType){
SQL.update("INSERT INTO Schematic" + SQL.update("INSERT INTO Schematic (SchemName, SchemOwner, Item, SchemType) VALUES (?, ?, ?, ?) ON DUPLICATE KEY UPDATE Item = VALUES(Item), SchemType = VALUES(SchemType)",
" (SchemName, SchemOwner, Item, SchemType)" + schemName, schemOwner, item, schemType.toDB());
" VALUES" +
" ('" + schemName + "', '" + schemOwner + "', '" + item + "', '" + schemType.toDB() + "')" +
" ON DUPLICATE KEY UPDATE" +
" Item = VALUES(Item), SchemType = VALUES(SchemType)");
} }
public static Schematic getSchemFromDB(String schemName, UUID schemOwner){ public static Schematic getSchemFromDB(String schemName, UUID schemOwner){
@ -55,8 +49,7 @@ public class Schematic {
} }
public static Schematic getSchemFromDB(String schemName, int schemOwner){ public static Schematic getSchemFromDB(String schemName, int schemOwner){
schemName = SQL.disarmString(schemName); ResultSet schematic = SQL.select("SELECT SchemID, SchemName, SchemOwner, Item, SchemType, SchemFormat FROM Schematic WHERE SchemName = ? AND SchemOwner = ?", schemName, schemOwner);
ResultSet schematic = SQL.select("SELECT SchemID, SchemName, SchemOwner, Item, SchemType, SchemFormat FROM Schematic WHERE SchemName = '" + schemName + "' AND SchemOwner = '" + schemOwner + "'");
try { try {
if(schematic == null || !schematic.next()){ if(schematic == null || !schematic.next()){
SchematicMember member = SchematicMember.getMemberBySchematic(schemName, schemOwner); SchematicMember member = SchematicMember.getMemberBySchematic(schemName, schemOwner);
@ -77,7 +70,7 @@ public class Schematic {
public static List<Schematic> getSchemsAccessibleByUser(int schemOwner){ public static List<Schematic> getSchemsAccessibleByUser(int schemOwner){
try{ try{
ResultSet schematic = SQL.select("SELECT SchemID, SchemName, SchemOwner, Item, SchemType, SchemFormat FROM Schematic WHERE SchemOwner = '" + schemOwner + "' ORDER BY SchemName"); ResultSet schematic = SQL.select("SELECT SchemID, SchemName, SchemOwner, Item, SchemType, SchemFormat FROM Schematic WHERE SchemOwner = ? ORDER BY SchemName", schemOwner);
List<Schematic> schematics = new ArrayList<>(); List<Schematic> schematics = new ArrayList<>();
while(schematic.next()){ while(schematic.next()){
schematics.add(new Schematic(schematic)); schematics.add(new Schematic(schematic));
@ -107,7 +100,7 @@ public class Schematic {
public static List<Schematic> getAllSchemsOfType(SchematicType schemType){ public static List<Schematic> getAllSchemsOfType(SchematicType schemType){
try{ try{
ResultSet schematic = SQL.select("SELECT SchemID, SchemName, SchemOwner, Item, SchemType, SchemFormat FROM Schematic WHERE SchemType = '" + schemType.toDB() + "'"); ResultSet schematic = SQL.select("SELECT SchemID, SchemName, SchemOwner, Item, SchemType, SchemFormat FROM Schematic WHERE SchemType = ?", schemType.toDB());
List<Schematic> schematics = new ArrayList<>(); List<Schematic> schematics = new ArrayList<>();
while(schematic.next()){ while(schematic.next()){
schematics.add(new Schematic(schematic)); schematics.add(new Schematic(schematic));
@ -156,7 +149,7 @@ public class Schematic {
if(Core.getVersion() <= 12 && schemFormat) if(Core.getVersion() <= 12 && schemFormat)
throw new WrongVersionException(); throw new WrongVersionException();
ResultSet rs = SQL.select("SELECT SchemData FROM Schematic WHERE SchemID = " + schemID); ResultSet rs = SQL.select("SELECT SchemData FROM Schematic WHERE SchemID = ?", schemID);
try { try {
rs.next(); rs.next();
Blob schemData = rs.getBlob("SchemData"); Blob schemData = rs.getBlob("SchemData");
@ -186,7 +179,7 @@ public class Schematic {
if(Core.getVersion() <= 12 && schemFormat) if(Core.getVersion() <= 12 && schemFormat)
throw new WrongVersionException(); throw new WrongVersionException();
ResultSet rs = SQL.select("SELECT SchemData FROM Schematic WHERE SchemID = " + schemID); ResultSet rs = SQL.select("SELECT SchemData FROM Schematic WHERE SchemID = ?", schemID);
try { try {
rs.next(); rs.next();
Blob blob = rs.getBlob("SchemData"); Blob blob = rs.getBlob("SchemData");
@ -227,34 +220,31 @@ public class Schematic {
private void saveFromPlayer(Player player, boolean newFormat) throws IOException, NoClipboardException { private void saveFromPlayer(Player player, boolean newFormat) throws IOException, NoClipboardException {
try{ try{
PreparedStatement st = SQL.getCon().prepareStatement("UPDATE Schematic SET SchemData = ?, SchemFormat = ? WHERE SchemID = " + schemID); Blob blob = SQL.blob();
byte[] data;
switch(Core.getVersion()){ switch(Core.getVersion()){
case 8: case 8:
newFormat = false; newFormat = false;
data = Schematic_8.getPlayerClipboard(player); blob.setBytes(1, Schematic_8.getPlayerClipboard(player));
break; break;
case 9: case 9:
newFormat = false; newFormat = false;
data = Schematic_9.getPlayerClipboard(player); blob.setBytes(1, Schematic_9.getPlayerClipboard(player));
break; break;
case 10: case 10:
newFormat = false; newFormat = false;
data = Schematic_10.getPlayerClipboard(player); blob.setBytes(1, Schematic_10.getPlayerClipboard(player));
break; break;
case 14: case 14:
data = Schematic_14.getPlayerClipboard(player, newFormat); blob.setBytes(1, Schematic_14.getPlayerClipboard(player, newFormat));
break; break;
case 15: case 15:
data = Schematic_15.getPlayerClipboard(player, newFormat); blob.setBytes(1, Schematic_15.getPlayerClipboard(player, newFormat));
break; break;
default: default:
newFormat = false; newFormat = false;
data = Schematic_12.getPlayerClipboard(player); blob.setBytes(1, Schematic_12.getPlayerClipboard(player));
} }
st.setBlob(1, new ByteArrayInputStream(data)); SQL.update("UPDATE Schematic SET SchemData = ?, SchemFormat = ? WHERE SchemID = ?", blob, newFormat, schemID);
st.setBoolean(2, newFormat);
st.executeUpdate();
schemFormat = newFormat; schemFormat = newFormat;
}catch(SQLException e){ }catch(SQLException e){
throw new IOException(e); throw new IOException(e);
@ -262,8 +252,8 @@ public class Schematic {
} }
public void remove(){ public void remove(){
SQL.update("DELETE FROM SchemMember WHERE SchemOwner = " + schemOwner + " AND SchemName = '" + schemName + "'"); SQL.update("DELETE FROM SchemMember WHERE SchemOwner = ? AND SchemName = ?", schemOwner, schemName);
SQL.update("DELETE FROM Schematic WHERE SchemOwner = " + schemOwner + " AND SchemName = '" + schemName + "'"); SQL.update("DELETE FROM Schematic WHERE SchemOwner = ? AND SchemName = ?", schemOwner, schemName);
} }
public static class WrongVersionException extends Exception{} public static class WrongVersionException extends Exception{}

Datei anzeigen

@ -28,10 +28,7 @@ public class SchematicMember {
} }
private void updateDB(){ private void updateDB(){
SQL.update("INSERT INTO SchemMember" + SQL.update("INSERT INTO SchemMember (SchemName, SchemOwner, Member) VALUES (?, ?, ?)", schemName, schemOwner, member);
" (SchemName, SchemOwner, Member)" +
" VALUES" +
" ('" + schemName + "', '" + schemOwner + "', '" + member + "')");
} }
public static SchematicMember getSchemMemberFromDB(String schemName, UUID schemOwner, UUID schemMember){ public static SchematicMember getSchemMemberFromDB(String schemName, UUID schemOwner, UUID schemMember){
@ -39,7 +36,7 @@ public class SchematicMember {
} }
public static SchematicMember getSchemMemberFromDB(String schemName, int schemOwner, int schemMember){ public static SchematicMember getSchemMemberFromDB(String schemName, int schemOwner, int schemMember){
ResultSet schematicMember = SQL.select("SELECT * FROM SchemMember WHERE SchemName = '" + schemName + "' AND SchemOwner = '" + schemOwner + "' AND Member = '" + schemMember + "'"); ResultSet schematicMember = SQL.select("SELECT * FROM SchemMember WHERE SchemName = ? AND SchemOwner = ? AND Member = ?", schemName, schemOwner, schemMember);
try { try {
if(schematicMember == null || !schematicMember.next()){ if(schematicMember == null || !schematicMember.next()){
return null; return null;
@ -51,7 +48,7 @@ public class SchematicMember {
} }
public static SchematicMember getMemberBySchematic(String schemName, int schemMember){ public static SchematicMember getMemberBySchematic(String schemName, int schemMember){
ResultSet schematicMember = SQL.select("SELECT * FROM SchemMember WHERE SchemName = '" + schemName + "' AND Member = '" + schemMember + "'"); ResultSet schematicMember = SQL.select("SELECT * FROM SchemMember WHERE SchemName = ? AND Member = ?", schemName, schemMember);
try { try {
if(schematicMember == null || !schematicMember.next()){ if(schematicMember == null || !schematicMember.next()){
return null; return null;
@ -68,7 +65,7 @@ public class SchematicMember {
} }
public static List<SchematicMember> getSchemMembers(String schemName, int schemOwner){ public static List<SchematicMember> getSchemMembers(String schemName, int schemOwner){
ResultSet schematicMember = SQL.select("SELECT * FROM SchemMember WHERE SchemName = '" + schemName + "' AND SchemOwner = '" + schemOwner + "'"); ResultSet schematicMember = SQL.select("SELECT * FROM SchemMember WHERE SchemName = ? AND SchemOwner = ?", schemName, schemOwner);
try { try {
List<SchematicMember> schematicMembers = new ArrayList<>(); List<SchematicMember> schematicMembers = new ArrayList<>();
while(schematicMember.next()){ while(schematicMember.next()){
@ -86,7 +83,7 @@ public class SchematicMember {
} }
public static List<SchematicMember> getAccessibleSchems(int schemMember){ public static List<SchematicMember> getAccessibleSchems(int schemMember){
ResultSet schematicMember = SQL.select("SELECT * FROM SchemMember WHERE Member = '" + schemMember + "'"); ResultSet schematicMember = SQL.select("SELECT * FROM SchemMember WHERE Member = ?", schemMember);
try { try {
List<SchematicMember> schematicMembers = new ArrayList<>(); List<SchematicMember> schematicMembers = new ArrayList<>();
while(schematicMember.next()){ while(schematicMember.next()){
@ -113,6 +110,6 @@ public class SchematicMember {
} }
public void remove(){ public void remove(){
SQL.update("DELETE FROM SchemMember WHERE SchemOwner = " + schemOwner + " AND SchemName = '" + schemName + "' AND Member = '" + member + "'"); SQL.update("DELETE FROM SchemMember WHERE SchemOwner = ? AND SchemName = ? AND Member = ?", schemOwner, schemName, member);
} }
} }

Datei anzeigen

@ -63,8 +63,8 @@ public class SteamwarUser {
return team; return team;
} }
private static SteamwarUser fromDB(String statement){ private static SteamwarUser fromDB(String statement, Object identifier){
ResultSet rs = SQL.select(statement); ResultSet rs = SQL.select(statement, identifier);
try { try {
if(rs.next()) if(rs.next())
return new SteamwarUser(rs); return new SteamwarUser(rs);
@ -75,24 +75,23 @@ public class SteamwarUser {
} }
public static SteamwarUser get(String userName){ public static SteamwarUser get(String userName){
userName = SQL.disarmString(userName);
SteamwarUser user = byName.get(userName.toLowerCase()); SteamwarUser user = byName.get(userName.toLowerCase());
if(user == null) if(user == null)
user = fromDB("SELECT * FROM UserData WHERE lower(UserName) = '" + userName.toLowerCase() + "'"); user = fromDB("SELECT * FROM UserData WHERE lower(UserName) = ?", userName.toLowerCase());
return user; return user;
} }
public static SteamwarUser get(UUID uuid){ public static SteamwarUser get(UUID uuid){
SteamwarUser user = byUUID.get(uuid); SteamwarUser user = byUUID.get(uuid);
if(user == null) if(user == null)
user = fromDB("SELECT * FROM UserData WHERE UUID = '" + uuid.toString() + "'"); user = fromDB("SELECT * FROM UserData WHERE UUID = ?", uuid.toString());
return user; return user;
} }
public static SteamwarUser get(int id) { public static SteamwarUser get(int id) {
SteamwarUser user = byId.get(id); SteamwarUser user = byId.get(id);
if(user == null) if(user == null)
user = fromDB("SELECT * FROM UserData WHERE id = '" + id + "'"); user = fromDB("SELECT * FROM UserData WHERE id = ?", id);
return user; return user;
} }
} }

Datei anzeigen

@ -27,7 +27,7 @@ public class Team {
public static Team get(int id){ public static Team get(int id){
if(id == 0) if(id == 0)
return pub; return pub;
ResultSet rs = SQL.select("SELECT * FROM Team WHERE TeamID = " + id); ResultSet rs = SQL.select("SELECT * FROM Team WHERE TeamID = ?", id);
try { try {
if(!rs.next()) if(!rs.next())
return null; return null;
@ -55,7 +55,7 @@ public class Team {
public List<Integer> getMembers(){ public List<Integer> getMembers(){
try{ try{
ResultSet memberlist = SQL.select("SELECT id FROM UserData WHERE Team = '" + teamId + "'"); ResultSet memberlist = SQL.select("SELECT id FROM UserData WHERE Team = ?", teamId);
List<Integer> members = new LinkedList<>(); List<Integer> members = new LinkedList<>();
while(memberlist.next()) while(memberlist.next())
members.add(memberlist.getInt("id")); members.add(memberlist.getInt("id"));