Remove SQL command from QuickShop

[Andre601]

There is absolutely NO reason to allow people to use an SQL command in a plugin to modify the database.
The fact that you have a warning telling them about potential risks (Including that it could apparently modify other plugin's data) should be clear enough here.

This has been criticized before and shouldn't be used under any circumstances.

So, please... For the safety of everyone, remove the command. Its inclusion is pointless and the risk of damage towards a server is too high to make it worth it.

See Minecraft Security | Part 2; The exploit chain from Mr.Dienns for why such stuff is not only bad, but simply stupid.
Don't fall in the same holes as others did (In this case dev of LiteBans).

[Ghost-chu]

Disabled raw SQL execute ability by default.
49f810c

[Andre601]

Still believe this shouldn't be a thing to begin with. Security risks are too high for a feature nobody ever needs.

[Ghost-chu]

Still believe this shouldn't be a thing to begin with. Security risks are too high for a feature nobody ever needs.

I think it is enough. To change the properties, attacker must have full-control -of victim machine to add startup flag OR install a malware plugin.

[Andre601]

There are two things that are infinite: The universe and the stupidity of humankind. And I'm not so sure about the first one.
- Albert Einstein

There will be issues like this and YOU will be the one that gets blamed.
Like... Answer me this question: Why should QuickShop allow SQL manipulation through commands? What is the overall "benefit" for this compared to just modifying the database itself through PHPMyAdmin or similar?

If your only response is, "It's easier/more convenient" then that's a lazy excuse. There is absolutely no justification for allowing SQL statements to be executable through a plugin. Period!

[Ghost-chu]

There are two things that are endless: The universe and the stupidity of humankind. And I'm not so sure about the first one.

• Albert Einstein

There will be issues like this and YOU will be the one that gets blamed. Like... Answer me this question: Why should QuickShop allow SQL manipulation through commands? What is the overall "benefit" for this compared to just modifying the database itself through PHPMyAdmin or similar?

If your only response is, "It's easier/more convenient" then that's a lazy excuse. There is absolutely no justification for allowing SQL statements to be executable through a plugin. Period!

I thought about it, and I think if user really need execute the SQL on Minecraft server, they can install a dedicated plugin for that.
So I will unregister that command in next release.

[MrDienns]

Thank you