Knuckle Cracker

Knuckle Cracker => Support => Topic started by: Karsten75 on March 21, 2010, 04:21:29 PM

Title: Custom maps page error
Post by: Karsten75 on March 21, 2010, 04:21:29 PM
Click on this link (http://knucklecracker.com/creeperworld/mapcomments.php?page=&sort=&author=&id=967&scores=1).

It should take you to the download page for Rushed, a map by Cap'n Trey.

On that page, click on the link of the map author.

You will get a screen with no maps.

Use the drop-down to select the map author and select Cap'n Trey from the list of authors.  A screen with 6 maps will show.
Title: Re: Custom maps page error
Post by: UpperKEES on March 21, 2010, 04:28:23 PM
It's caused by the quote in the author name. The same happens for .Alb'

The SQL parser has a problem with this.
Title: Re: Custom maps page error
Post by: Karsten75 on March 21, 2010, 04:31:32 PM
I know, but if we don't report it, &V cant fix it...
Title: Re: Custom maps page error
Post by: knucracker on March 22, 2010, 08:26:51 PM
Should be all fixed up now....
Title: Re: Custom maps page error
Post by: Karsten75 on March 22, 2010, 10:11:50 PM
Quote from: UpperKEES on March 21, 2010, 04:28:23 PM
It's caused by the quote in the author name. The same happens for .Alb'

The SQL parser has a problem with this.

Actually, FWIW, this is a manifestation of the "SQL injection problem."  If a map author had uploaded a map and had chosen a malicious name, they could have gotten access to the tables, deleted the tables or any other kind of naughtiness.

http://xkcd.com/327/
Title: Re: Custom maps page error
Post by: knucracker on March 22, 2010, 10:52:14 PM
In this instance, it was a simple problem with me not stripping slashes on the query args.  I make sure to sanitized any inputs before they get built into query strings.  In this case, there was just an extra slash before the single quote in some author names.