Explorar el Código

SQL injection fix

tBKwtWS hace 7 años
padre
commit
2a2840f01c
Se han modificado 1 ficheros con 2 adiciones y 1 borrados
  1. 2 1
      commands/admin.py

+ 2 - 1
commands/admin.py

@@ -256,7 +256,8 @@ def do_command(self, connection, event):
                         return
                     if command.split()[1].lower() == "autojoin" and event.target == self.homechannel:   # Chaning autojoin of homechannel.
                         connection.action(replyto, "will always join it's homechannel " + red + self.homechannel + reset + ", regardless of the autojoin function.")
-                    self.db.run("UPDATE channels SET " + command.split()[1].lower() + "='" + command.split()[2].lower() + "' WHERE name='" + event.target + "' AND network='" + self.network + "'")
+                    #self.db.run("UPDATE channels SET " + command.split()[1].lower() + "='" + command.split()[2].lower() + "' WHERE name='" + event.target + "' AND network='" + self.network + "'")
+                    self.db.run("UPDATE channels SET " + command.split()[1].lower() + "=%s WHERE name='" + event.target + "' AND network='" + self.network + "'", (command.split()[2].lower(), ))
             
             elif len(command.split()) == 4: # Three arguments.
                 if not command.split()[1] in self.channels: # Bot does not inhabit channel to be altered.