Relintai/rcpp_framework
1
0
Fork 0
mirror of https://github.com/Relintai/rcpp_framework.git synced 2025-05-06 17:51:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

Now instead of having an escaped version of the methods that has string parmeters in QueryBuilder, they have an unescaped version, and the base version escapes. Having it like this is a lot safer.

Browse Source
This commit is contained in:
Relintai 2021-11-01 17:23:08 +01:00
parent 6073ef90c9
commit cfb5f877c8
8 changed files with 83 additions and 89 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

69
core/database/query_builder.cpp
View File

@ -41,20 +41,20 @@ QueryBuilder *QueryBuilder::like() {
} }
QueryBuilder *QueryBuilder::select(const std::string &params) { QueryBuilder *QueryBuilder::select(const std::string &params) {
return this; return nselect(escape(params));
} }
QueryBuilder *QueryBuilder::update(const std::string &params) { QueryBuilder *QueryBuilder::update(const std::string &params) {
return this; return nupdate(escape(params));
} }
QueryBuilder *QueryBuilder::del(const std::string &params) { QueryBuilder *QueryBuilder::del(const std::string &params) {
return this; return ndel(escape(params));
} }
QueryBuilder *QueryBuilder::where(const std::string &params) { QueryBuilder *QueryBuilder::where(const std::string &params) {
return this; return nwhere(escape(params));
} }
QueryBuilder *QueryBuilder::from(const std::string &params) { QueryBuilder *QueryBuilder::from(const std::string &params) {
return this; return nfrom(escape(params));
} }
QueryBuilder *QueryBuilder::insert(const std::string &table_name) { QueryBuilder *QueryBuilder::insert(const std::string &table_name) {
@ -64,7 +64,7 @@ QueryBuilder *QueryBuilder::insert(const std::string &table_name, const std::str
return this; return this;
} }
QueryBuilder *QueryBuilder::values(const std::string &params_str) { QueryBuilder *QueryBuilder::values(const std::string &params_str) {
return this; return nvalues(escape(params_str));
} }
QueryBuilder *QueryBuilder::val() { QueryBuilder *QueryBuilder::val() {
@ -72,7 +72,7 @@ QueryBuilder *QueryBuilder::val() {
} }
QueryBuilder *QueryBuilder::val(const std::string &param) { QueryBuilder *QueryBuilder::val(const std::string &param) {
return this; return nval(escape(param));
} }
QueryBuilder *QueryBuilder::val(const char *param) { QueryBuilder *QueryBuilder::val(const char *param) {
@ -87,7 +87,7 @@ QueryBuilder *QueryBuilder::val(const bool param) {
} }
QueryBuilder *QueryBuilder::like(const std::string &str) { QueryBuilder *QueryBuilder::like(const std::string &str) {
return this; return nlike(escape(str));
} }
QueryBuilder *QueryBuilder::set() { QueryBuilder *QueryBuilder::set() {
@ -97,7 +97,7 @@ QueryBuilder *QueryBuilder::cset() {
return this; return this;
} }
QueryBuilder *QueryBuilder::setp(const std::string &col, const std::string &param) { QueryBuilder *QueryBuilder::setp(const std::string &col, const std::string &param) {
return this; return nsetp(col, escape(param));
} }
QueryBuilder *QueryBuilder::setp(const std::string &col, const char *param) { QueryBuilder *QueryBuilder::setp(const std::string &col, const char *param) {
return this; return this;
@ -110,7 +110,7 @@ QueryBuilder *QueryBuilder::setp(const std::string &col, const bool param) {
} }
QueryBuilder *QueryBuilder::wp(const std::string &col, const std::string &param) { QueryBuilder *QueryBuilder::wp(const std::string &col, const std::string &param) {
return this; return nwp(col, escape(param));
} }
QueryBuilder *QueryBuilder::wp(const std::string &col, const char *param) { QueryBuilder *QueryBuilder::wp(const std::string &col, const char *param) {
return this; return this;
@ -122,43 +122,38 @@ QueryBuilder *QueryBuilder::wp(const std::string &col, const bool param) {
return this; return this;
} }
QueryBuilder *QueryBuilder::eselect(const std::string &params) { QueryBuilder *QueryBuilder::nselect(const std::string &params) {
return select(escape(params));
}
QueryBuilder *QueryBuilder::eupdate(const std::string &params) {
return update(escape(params));
}
QueryBuilder *QueryBuilder::edel(const std::string &params) {
return del(escape(params));
}
QueryBuilder *QueryBuilder::ewhere(const std::string &params) {
return where(escape(params));
}
QueryBuilder *QueryBuilder::efrom(const std::string &params) {
return from(escape(params));
}
QueryBuilder *QueryBuilder::einsert(const std::string &table_name) {
return insert(escape(table_name));
return this; return this;
} }
QueryBuilder *QueryBuilder::elike(const std::string &str) { QueryBuilder *QueryBuilder::nupdate(const std::string &params) {
return like(escape(str)); return this;
} }
QueryBuilder *QueryBuilder::evalues(const std::string &params_str) { QueryBuilder *QueryBuilder::ndel(const std::string &params) {
return values(escape(params_str)); return this;
} }
QueryBuilder *QueryBuilder::eval(const std::string &param) { QueryBuilder *QueryBuilder::nwhere(const std::string &params) {
return this;
}
QueryBuilder *QueryBuilder::nfrom(const std::string &params) {
return this;
}
QueryBuilder *QueryBuilder::nlike(const std::string &str) {
return this;
}
QueryBuilder *QueryBuilder::nvalues(const std::string &params_str) {
return this;
}
QueryBuilder *QueryBuilder::nval(const std::string &param) {
return val(escape(param)); return val(escape(param));
} }
QueryBuilder *QueryBuilder::esetp(const std::string &col, const std::string &escape_param) { QueryBuilder *QueryBuilder::nsetp(const std::string &col, const std::string &escape_param) {
return setp(col, escape(escape_param)); return setp(col, escape(escape_param));
} }
QueryBuilder *QueryBuilder::ewp(const std::string &col, const std::string &escape_param) { QueryBuilder *QueryBuilder::nwp(const std::string &col, const std::string &escape_param) {
return wp(col, escape(escape_param)); return this;
} }
QueryBuilder *QueryBuilder::limit(const int num) { QueryBuilder *QueryBuilder::limit(const int num) {

21
core/database/query_builder.h
View File

@ -56,20 +56,19 @@ public:
virtual QueryBuilder *wp(const std::string &col, const int param); virtual QueryBuilder *wp(const std::string &col, const int param);
virtual QueryBuilder *wp(const std::string &col, const bool param); virtual QueryBuilder *wp(const std::string &col, const bool param);
virtual QueryBuilder *eselect(const std::string &params); virtual QueryBuilder *nselect(const std::string &params);
virtual QueryBuilder *eupdate(const std::string &params); virtual QueryBuilder *nupdate(const std::string &params);
virtual QueryBuilder *edel(const std::string &params); virtual QueryBuilder *ndel(const std::string &params);
virtual QueryBuilder *ewhere(const std::string &params); virtual QueryBuilder *nwhere(const std::string &params);
virtual QueryBuilder *efrom(const std::string &params); virtual QueryBuilder *nfrom(const std::string &params);
virtual QueryBuilder *einsert(const std::string &table_name); virtual QueryBuilder *nlike(const std::string &str);
virtual QueryBuilder *elike(const std::string &str); virtual QueryBuilder *nvalues(const std::string &params_str);
virtual QueryBuilder *evalues(const std::string &params_str); virtual QueryBuilder *nval(const std::string &param);
virtual QueryBuilder *eval(const std::string &param);
//note col is NOT escaped //note col is NOT escaped
virtual QueryBuilder *esetp(const std::string &col, const std::string &escape_param); virtual QueryBuilder *nsetp(const std::string &col, const std::string &escape_param);
//note col is NOT escaped //note col is NOT escaped
virtual QueryBuilder *ewp(const std::string &col, const std::string &escape_param); virtual QueryBuilder *nwp(const std::string &col, const std::string &escape_param);
virtual QueryBuilder *limit(const int num); virtual QueryBuilder *limit(const int num);
virtual QueryBuilder *offset(const int num); virtual QueryBuilder *offset(const int num);

10
database/mysql/mysql_query_builder.cpp
View File

@ -34,31 +34,31 @@ QueryBuilder *MysqlQueryBuilder::cvalues() {
return this; return this;
} }
QueryBuilder *MysqlQueryBuilder::select(const std::string &params) { QueryBuilder *MysqlQueryBuilder::nselect(const std::string &params) {
query_result += "SELECT " + params + " "; query_result += "SELECT " + params + " ";
return this; return this;
} }
QueryBuilder *MysqlQueryBuilder::where(const std::string &params) { QueryBuilder *MysqlQueryBuilder::nwhere(const std::string &params) {
query_result += "WHERE " + params + " "; query_result += "WHERE " + params + " ";
return this; return this;
} }
QueryBuilder *MysqlQueryBuilder::from(const std::string &params) { QueryBuilder *MysqlQueryBuilder::nfrom(const std::string &params) {
query_result += "FROM " + params + " "; query_result += "FROM " + params + " ";
return this; return this;
} }
QueryBuilder *MysqlQueryBuilder::insert(const std::string &table_name) { QueryBuilder *MysqlQueryBuilder::ninsert(const std::string &table_name) {
query_result += "INSERT INTO " + table_name + " "; query_result += "INSERT INTO " + table_name + " ";
return this; return this;
} }
QueryBuilder *MysqlQueryBuilder::values(const std::string &params_str) { QueryBuilder *MysqlQueryBuilder::nvalues(const std::string &params_str) {
query_result += "VALUES(" + params_str + ") "; query_result += "VALUES(" + params_str + ") ";
return this; return this;

10
database/mysql/mysql_query_builder.h
View File

@ -18,11 +18,11 @@ public:
QueryBuilder *values(); QueryBuilder *values();
QueryBuilder *cvalues(); QueryBuilder *cvalues();
QueryBuilder *select(const std::string &params); QueryBuilder *nselect(const std::string &params);
QueryBuilder *where(const std::string &params); QueryBuilder *nwhere(const std::string &params);
QueryBuilder *from(const std::string &params); QueryBuilder *nfrom(const std::string &params);
QueryBuilder *insert(const std::string &table_name); QueryBuilder *ninsert(const std::string &table_name);
QueryBuilder *values(const std::string &params_str); QueryBuilder *nvalues(const std::string &params_str);
QueryBuilder *limit(const int num); QueryBuilder *limit(const int num);
QueryBuilder *offset(const int num); QueryBuilder *offset(const int num);

20
database/sqlite/sqlite3_query_builder.cpp
View File

@ -65,29 +65,29 @@ QueryBuilder *SQLite3QueryBuilder::like() {
return this; return this;
} }
QueryBuilder *SQLite3QueryBuilder::select(const std::string &params) { QueryBuilder *SQLite3QueryBuilder::nselect(const std::string &params) {
query_result += "SELECT " + params + " "; query_result += "SELECT " + params + " ";
return this; return this;
} }
QueryBuilder *SQLite3QueryBuilder::update(const std::string &params) { QueryBuilder *SQLite3QueryBuilder::nupdate(const std::string &params) {
query_result += "UPDATE " + params + " "; query_result += "UPDATE " + params + " ";
return this; return this;
} }
QueryBuilder *SQLite3QueryBuilder::del(const std::string &params) { QueryBuilder *SQLite3QueryBuilder::ndel(const std::string &params) {
query_result += "DELETE FROM " + params + " "; query_result += "DELETE FROM " + params + " ";
return this; return this;
} }
QueryBuilder *SQLite3QueryBuilder::where(const std::string &params) { QueryBuilder *SQLite3QueryBuilder::nwhere(const std::string &params) {
query_result += "WHERE " + params + " "; query_result += "WHERE " + params + " ";
return this; return this;
} }
QueryBuilder *SQLite3QueryBuilder::from(const std::string &params) { QueryBuilder *SQLite3QueryBuilder::nfrom(const std::string &params) {
query_result += "FROM " + params + " "; query_result += "FROM " + params + " ";
return this; return this;
@ -103,7 +103,7 @@ QueryBuilder *SQLite3QueryBuilder::insert(const std::string &table_name, const s
return this; return this;
} }
QueryBuilder *SQLite3QueryBuilder::values(const std::string &params_str) { QueryBuilder *SQLite3QueryBuilder::nvalues(const std::string &params_str) {
query_result += "VALUES(" + params_str + ") "; query_result += "VALUES(" + params_str + ") ";
return this; return this;
@ -115,7 +115,7 @@ QueryBuilder *SQLite3QueryBuilder::val() {
return this; return this;
} }
QueryBuilder *SQLite3QueryBuilder::val(const std::string &param) { QueryBuilder *SQLite3QueryBuilder::nval(const std::string &param) {
query_result += "'" + param + "', "; query_result += "'" + param + "', ";
return this; return this;
@ -145,7 +145,7 @@ QueryBuilder *SQLite3QueryBuilder::val(const bool param) {
return this; return this;
} }
QueryBuilder *SQLite3QueryBuilder::like(const std::string &str) { QueryBuilder *SQLite3QueryBuilder::nlike(const std::string &str) {
query_result += "LIKE '" + str + "' "; query_result += "LIKE '" + str + "' ";
return this; return this;
@ -161,7 +161,7 @@ QueryBuilder *SQLite3QueryBuilder::cset() {
return this; return this;
} }
QueryBuilder *SQLite3QueryBuilder::setp(const std::string &col, const std::string &param) { QueryBuilder *SQLite3QueryBuilder::nsetp(const std::string &col, const std::string &param) {
query_result += col + "='" + param + "', "; query_result += col + "='" + param + "', ";
return this; return this;
@ -189,7 +189,7 @@ QueryBuilder *SQLite3QueryBuilder::setp(const std::string &col, const bool param
return this; return this;
} }
QueryBuilder *SQLite3QueryBuilder::wp(const std::string &col, const std::string &param) { QueryBuilder *SQLite3QueryBuilder::nwp(const std::string &col, const std::string &param) {
query_result += col + "='" + param + "' "; query_result += col + "='" + param + "' ";
return this; return this;

20
database/sqlite/sqlite3_query_builder.h
View File

@ -25,31 +25,31 @@ public:
QueryBuilder *like(); QueryBuilder *like();
QueryBuilder *select(const std::string &params); QueryBuilder *nselect(const std::string &params);
QueryBuilder *update(const std::string &params); QueryBuilder *nupdate(const std::string &params);
QueryBuilder *del(const std::string &params); QueryBuilder *ndel(const std::string &params);
QueryBuilder *where(const std::string &params); QueryBuilder *nwhere(const std::string &params);
QueryBuilder *from(const std::string &params); QueryBuilder *nfrom(const std::string &params);
QueryBuilder *insert(const std::string &table_name); QueryBuilder *insert(const std::string &table_name);
QueryBuilder *insert(const std::string &table_name, const std::string &columns); QueryBuilder *insert(const std::string &table_name, const std::string &columns);
QueryBuilder *values(const std::string &params_str); QueryBuilder *nvalues(const std::string &params_str);
QueryBuilder *val(); QueryBuilder *val();
QueryBuilder *val(const std::string &param); QueryBuilder *nval(const std::string &param);
QueryBuilder *val(const char *param); QueryBuilder *val(const char *param);
QueryBuilder *val(const int param); QueryBuilder *val(const int param);
QueryBuilder *val(const bool param); QueryBuilder *val(const bool param);
QueryBuilder *like(const std::string &str); QueryBuilder *nlike(const std::string &str);
QueryBuilder *set(); QueryBuilder *set();
QueryBuilder *cset(); QueryBuilder *cset();
QueryBuilder *setp(const std::string &col, const std::string &param); QueryBuilder *nsetp(const std::string &col, const std::string &param);
QueryBuilder *setp(const std::string &col, const char *param); QueryBuilder *setp(const std::string &col, const char *param);
QueryBuilder *setp(const std::string &col, const int param); QueryBuilder *setp(const std::string &col, const int param);
QueryBuilder *setp(const std::string &col, const bool param); QueryBuilder *setp(const std::string &col, const bool param);
QueryBuilder *wp(const std::string &col, const std::string &param); QueryBuilder *nwp(const std::string &col, const std::string &param);
QueryBuilder *wp(const std::string &col, const char *param); QueryBuilder *wp(const std::string &col, const char *param);
QueryBuilder *wp(const std::string &col, const int param); QueryBuilder *wp(const std::string &col, const int param);
QueryBuilder *wp(const std::string &col, const bool param); QueryBuilder *wp(const std::string &col, const bool param);

8
modules/rbac/rbac_model.cpp
View File

@ -58,7 +58,7 @@ void RBACModel::save_rank(const Ref<RBACRank> &rank) {
if (rank->id == 0) { if (rank->id == 0) {
qb->insert(RBAC_RANK_TABLE, "name,name_internal,settings,rank_permissions")->values(); qb->insert(RBAC_RANK_TABLE, "name,name_internal,settings,rank_permissions")->values();
qb->eval(rank->name)->eval(rank->name_internal)->eval(rank->settings)->val(rank->rank_permissions); qb->val(rank->name)->val(rank->name_internal)->val(rank->settings)->val(rank->rank_permissions);
qb->cvalues(); qb->cvalues();
qb->select_last_insert_id(); qb->select_last_insert_id();
Ref<QueryResult> res = qb->run(); Ref<QueryResult> res = qb->run();
@ -69,9 +69,9 @@ void RBACModel::save_rank(const Ref<RBACRank> &rank) {
r->id = res->get_last_insert_rowid(); r->id = res->get_last_insert_rowid();
} else { } else {
qb->update(RBAC_RANK_TABLE)->set(); qb->update(RBAC_RANK_TABLE)->set();
qb->esetp("name", rank->name); qb->setp("name", rank->name);
qb->esetp("name_internal", rank->name_internal); qb->setp("name_internal", rank->name_internal);
qb->esetp("settings", rank->settings); qb->setp("settings", rank->settings);
qb->setp("rank_permissions", rank->rank_permissions); qb->setp("rank_permissions", rank->rank_permissions);
qb->cset(); qb->cset();
qb->where()->wp("id", rank->id); qb->where()->wp("id", rank->id);

14
modules/users/user_model.cpp
View File

@ -54,7 +54,7 @@ Ref<User> UserModel::get_user(const std::string &user_name_input) {
b->select("id, email, rank, pre_salt, post_salt, password_hash, banned, password_reset_token, locked"); b->select("id, email, rank, pre_salt, post_salt, password_hash, banned, password_reset_token, locked");
b->from(_table_name); b->from(_table_name);
b->where()->ewp("username", user_name_input); b->where()->wp("username", user_name_input);
b->end_command(); b->end_command();
Ref<QueryResult> r = b->run(); Ref<QueryResult> r = b->run();
@ -87,8 +87,8 @@ void UserModel::save_user(Ref<User> &user) {
b->insert(_table_name, "username, email, rank, pre_salt, post_salt, password_hash, banned, password_reset_token, locked"); b->insert(_table_name, "username, email, rank, pre_salt, post_salt, password_hash, banned, password_reset_token, locked");
b->values(); b->values();
b->eval(user->name_user_input); b->val(user->name_user_input);
b->eval(user->email_user_input); b->val(user->email_user_input);
b->val(user->rank); b->val(user->rank);
b->val(user->pre_salt); b->val(user->pre_salt);
b->val(user->post_salt); b->val(user->post_salt);
@ -107,8 +107,8 @@ void UserModel::save_user(Ref<User> &user) {
} else { } else {
b->update(_table_name); b->update(_table_name);
b->set(); b->set();
b->esetp("username", user->name_user_input); b->setp("username", user->name_user_input);
b->esetp("email", user->email_user_input); b->setp("email", user->email_user_input);
b->setp("rank", user->rank); b->setp("rank", user->rank);
b->setp("pre_salt", user->pre_salt); b->setp("pre_salt", user->pre_salt);
b->setp("post_salt", user->post_salt); b->setp("post_salt", user->post_salt);
@ -161,7 +161,7 @@ std::vector<Ref<User> > UserModel::get_all() {
bool UserModel::is_username_taken(const std::string &user_name_input) { bool UserModel::is_username_taken(const std::string &user_name_input) {
Ref<QueryBuilder> b = DatabaseManager::get_singleton()->ddb->get_query_builder(); Ref<QueryBuilder> b = DatabaseManager::get_singleton()->ddb->get_query_builder();
b->select("id")->from(_table_name)->where("username")->elike(user_name_input)->end_command(); b->select("id")->from(_table_name)->where("username")->like(user_name_input)->end_command();
Ref<QueryResult> r = b->run(); Ref<QueryResult> r = b->run();
@ -170,7 +170,7 @@ bool UserModel::is_username_taken(const std::string &user_name_input) {
bool UserModel::is_email_taken(const std::string &email_input) { bool UserModel::is_email_taken(const std::string &email_input) {
Ref<QueryBuilder> b = DatabaseManager::get_singleton()->ddb->get_query_builder(); Ref<QueryBuilder> b = DatabaseManager::get_singleton()->ddb->get_query_builder();
b->select("id")->from(_table_name)->where("username")->elike(email_input)->end_command(); b->select("id")->from(_table_name)->where("username")->like(email_input)->end_command();
Ref<QueryResult> r = b->run(); Ref<QueryResult> r = b->run();