pw7xsiqt

1SQLiteHelper sqlite = new SQLiteHelper();
2
3if (!sqlite.CheckAdmin())
4{
5[...]
6}
7User login = sqlite.Login(Loginname, HelperClass.MD5Hash(Password));
8	
9class SQLiteHelper
10    {
11        private SQLiteConnection sqlConn;
12        private static string sqliteFile = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "/database.db";  // set folder for database
13        private static string sqlitePw = "databasepw"; // set password for database
14
15        public SQLiteHelper()
16        {
17            // check if database file exist when not create with password
18            if (!File.Exists(sqliteFile))
19            {
20                sqlConn = new SQLiteConnection("Data Source=" + sqliteFile);
21                sqlConn.SetPassword(sqlitePw);
22            }
23            sqlConn = new SQLiteConnection("Data Source=" + sqliteFile + ";Password=" + sqlitePw); // connect to database
24
25            // create tables, when not exist
26            string query =
27                "CREATE TABLE IF NOT EXISTS user (id INTEGER PRIMARY KEY AUTOINCREMENT, 'login' TEXT, 'firstname' TEXT, 'lastname' TEXT, 'persid' TEXT, 'password' Text, 'role' INTEGER, 'first' INTEGER, 'active' INTEGER);" +
28                "CREATE TABLE IF NOT EXISTS userRigths (id INTEGER PRIMARY KEY, 'lwe' INTEGER, 'lwa' INTEGER, 'lwb' INTEGER, 'lwi' INTEGER, 'mwe' INTEGER, 'mwa' INTEGER, 'mwb' INTEGER, 'mwi' INTEGER, 'vacc' INTEGER, 'vadr' INTEGER);" +
29                "CREATE TABLE IF NOT EXISTS admin ('password' Text);";
30            queryNon(query);
31        }
32
33
34        // check if admin password exist
35        public bool CheckAdmin()
36        {
37            sqlConn.Open();
38            var command = sqlConn.CreateCommand();
39            command.CommandText = "SELECT * FROM admin";
40            SQLiteDataReader reader = command.ExecuteReader();
41            bool rows = reader.HasRows;
42            sqlConn.Close();
43            return rows;
44        }
45
46        // login user
47        // if login doesnt match return an empty user
48        public User Login(string login, string pw)
49        {
50            User user = new User();
51
52            sqlConn.Open();
53
54            if (!login.Equals("Admin"))
55            {
56                var command = sqlConn.CreateCommand();
57                command.CommandText = "SELECT * FROM user LEFT JOIN userRigths ON user.id = userRigths.id WHERE user.login = '" + login + "' AND user.password = '" + pw + "'";
58                SQLiteDataReader reader = command.ExecuteReader();
59                if (reader.HasRows)
60                {
61                    while (reader.Read())
62                    {
63                        user.Id = reader.GetInt32(0);
64                        user.Login = reader.GetString(1);
65                        user.Role = reader.GetInt16(6);
66                        break;
67                    }
68                }
69            }
70            else
71            {
72                var command = sqlConn.CreateCommand();
73                command.CommandText = "SELECT * FROM admin WHERE admin.password = '" + pw + "'";
74                SQLiteDataReader reader = command.ExecuteReader();
75                if (reader.HasRows)
76                {
77                    user.Id = 0;
78                    user.Login = "Admin";
79                    user.Role = -1;
80                }
81            }
82
83            sqlConn.Close();
84
85            return user;
86        }
87
88        // methode for querys without response
89        private void queryNon(string query)
90        {
91            sqlConn.Open();
92            var command = sqlConn.CreateCommand();
93            command.CommandText = query;
94            command.ExecuteNonQuery();
95            sqlConn.Close();
96        }
97    }
98	
99command.CommandText = "SELECT * FROM user LEFT JOIN userRigths ON user.id = userRigths.id WHERE user.login = '"
100    + login + "' AND user.password = '" + pw + "'";
101	
102command.CommandText = "SELECT * FROM user LEFT JOIN userRigths ON user.id = userRigths.id"
103                    + "WHERE user.login = @login AND user.password = @password";
104command.Parameters.AddWithValue("@login", login);
105command.Parameters.AddWithValue("@password", pw);
106SQLiteDataReader reader = command.ExecuteReader();
107	
108ApplicationDatabase database = new ApplicationDatabase();
109
110if (!database.CheckAdmin())
111{
112[...]
113}
114User login = database.Login(Loginname, HelperClass.MD5Hash(Password));
115	
116public ApplicationDatabase()
117{
118    if (!DatabaseExists())
119    {
120        CreateDatabase(databaseFile, databasePassword);
121        CreateTables();
122    }
123    ConnectToDatabase();
124}
125
126public User Login(string login, string password)
127{
128    if (!login.Equals("Admin"))
129    {
130        user = GetUser(login, password);
131    }
132    else
133    {
134        user = GetAdmin(login, password);
135    }
136    return user;
137}
138	
139public bool AdminPasswordExists(){}
140private void QueryWithoutResponse(string query){}