[Ken's FIX] Messenger SQL Injection - Disconnect

[FlorinMarian 144]

I think somebody try to use Messenger SQL Injection and server disconnect random players.

Spoiler

void MessengerManager::RemoveFromList(MessengerManager::keyA account, MessengerManager::keyA companion)
{
    if (companion.empty())
        return;

    // Second fix
    if (m_Relation[account].find(companion) == m_Relation[account].end() || m_InverseRelation[companion].find(account) == m_InverseRelation[companion].end())
    {
        LPCHARACTER ch = CHARACTER_MANAGER::Instance().FindPC(account.c_str());
        if (ch)
        {
            sys_err("MessengerManager::RemoveFromList: %s tries to use messenger sql injection", ch->GetName());

            if (ch->GetDesc())
                ch->GetDesc()->DelayedDisconnect(3);
        }
        else
            sys_err("MessengerManager::RemoveFromList: Omg! The ghost tried to use this function!");
        return;
    }

    sys_log(1, "MessengerManager::RemoveFromList: Remove %s %s", account.c_str(), companion.c_str());
    DBManager::instance().Query("DELETE FROM messenger_list%s WHERE account='%s' AND companion = '%s'", get_table_postfix(), account.c_str(), companion.c_str());
    __RemoveFromList(account, companion);
    TPacketGGMessenger p2ppck;
    p2ppck.bHeader = HEADER_GG_MESSENGER_REMOVE;
    strlcpy(p2ppck.szAccount, account.c_str(), sizeof(p2ppck.szAccount));
    strlcpy(p2ppck.szCompanion, companion.c_str(), sizeof(p2ppck.szCompanion));;
    P2P_MANAGER::instance().Send(&p2ppck, sizeof(TPacketGGMessenger));
}

 

Syserr:

Spoiler

0123 20:29:20192 :: GRANNY: r:/granny/rt/granny_file_info.cpp(145): File has run-time type tag of 0x8000000f, which doesn't match this version of Granny (0x80000010).  Automatic conversion will be attempted.
0123 20:29:45170 :: CInstanceBase::AttachTextTail - VID [19978] ALREADY EXIST
0123 20:33:28093 :: 󸮵ÇÁö ¾ÊÀº ÆÐŶ Çì´õ 116, state Game

0123 20:33:31299 :: Unknown packet header: 48, last: 19 116