diff options
| author | Dehravor <dehravor@gmail.com> | 2014-01-12 00:12:38 +0000 |
|---|---|---|
| committer | DDuarte <dnpd.dd@gmail.com> | 2014-01-12 00:12:38 +0000 |
| commit | a1f079879204518413f0fc391eb8e970f084c65f (patch) | |
| tree | 15c5d10443816192d390b78011b235f66ccad57d | |
| parent | 0b5728f8a7cc7e9119ee684fb21f014e83c900d0 (diff) | |
DB/Guild: Fix incorrect input length limits
There is one incorrect field length related to guilds in the database, which can be used to cause an overflow client-side, by sending CMSG_GUILD_INFO_TEXT with long strings.
The guild information has the same 500 characters client-side limit as the guild bank tab information, but on server-side it can be 65k characters long. A lengthy guild info makes the whole Guild panel unusable.
Length of the other fields match the client's limits in the database: guild bank tab name (16), public note (31), officer note (31), motd (128), guild bank tab info (500).
Closes #11395
Signed-off-by: DDuarte <dnpd.dd@gmail.com>
| -rw-r--r-- | sql/base/characters_database.sql | 2 | ||||
| -rw-r--r-- | sql/updates/characters/2014_01_14_00_characters_guild.sql | 1 |
2 files changed, 2 insertions, 1 deletions
diff --git a/sql/base/characters_database.sql b/sql/base/characters_database.sql index f414424cfd3..f880f009893 100644 --- a/sql/base/characters_database.sql +++ b/sql/base/characters_database.sql @@ -1662,7 +1662,7 @@ CREATE TABLE `guild` ( `BorderStyle` tinyint(3) unsigned NOT NULL DEFAULT '0', `BorderColor` tinyint(3) unsigned NOT NULL DEFAULT '0', `BackgroundColor` tinyint(3) unsigned NOT NULL DEFAULT '0', - `info` text NOT NULL, + `info` VARCHAR(500) NOT NULL DEFAULT '', `motd` varchar(128) NOT NULL DEFAULT '', `createdate` int(10) unsigned NOT NULL DEFAULT '0', `BankMoney` bigint(20) unsigned NOT NULL DEFAULT '0', diff --git a/sql/updates/characters/2014_01_14_00_characters_guild.sql b/sql/updates/characters/2014_01_14_00_characters_guild.sql new file mode 100644 index 00000000000..23a2cada153 --- /dev/null +++ b/sql/updates/characters/2014_01_14_00_characters_guild.sql @@ -0,0 +1 @@ +ALTER TABLE `guild` CHANGE `info` `info` VARCHAR(500) NOT NULL DEFAULT ''; |