fix(rcon): validate room ownership and clothing grants

Emulator/src/main/java/com/eu/habbo/messages/rcon/ChangeRoomOwner.java

@@ -2,6 +2,7 @@ package com.eu.habbo.messages.rcon;
 
 import com.eu.habbo.Emulator;
 import com.eu.habbo.habbohotel.rooms.Room;
+import com.eu.habbo.habbohotel.users.HabboInfo;
 import com.google.gson.Gson;
 
 public class ChangeRoomOwner extends RCONMessage<ChangeRoomOwner.JSON> {
@@ -11,15 +12,33 @@ public class ChangeRoomOwner extends RCONMessage<ChangeRoomOwner.JSON> {
 
     @Override
     public void handle(Gson gson, JSON json) {
+        if (json.room_id <= 0 || json.user_id <= 0) {
+            this.status = RCONMessage.STATUS_ERROR;
+            this.message = "invalid room or user";
+            return;
+        }
+
+        HabboInfo owner = Emulator.getGameEnvironment().getHabboManager().getHabboInfo(json.user_id);
+        if (owner == null) {
+            this.status = RCONMessage.HABBO_NOT_FOUND;
+            this.message = "user not found";
+            return;
+        }
+
         Room room = Emulator.getGameEnvironment().getRoomManager().loadRoom(json.room_id);
 
-        if (room != null) {
-            room.setOwnerId(json.user_id);
-            room.setOwnerName(json.username);
-            room.setNeedsUpdate(true);
-            room.save();
-            Emulator.getGameEnvironment().getRoomManager().unloadRoom(room);
+        if (room == null) {
+            this.status = RCONMessage.ROOM_NOT_FOUND;
+            this.message = "room not found";
+            return;
         }
+
+        room.setOwnerId(owner.getId());
+        room.setOwnerName(owner.getUsername());
+        room.setNeedsUpdate(true);
+        room.save();
+        Emulator.getGameEnvironment().getRoomManager().unloadRoom(room);
+        this.message = "updated room owner";
     }
 
     static class JSON {

Emulator/src/main/java/com/eu/habbo/messages/rcon/GiveUserClothing.java

@@ -12,6 +12,7 @@ import org.slf4j.LoggerFactory;
 
 import java.sql.Connection;
 import java.sql.PreparedStatement;
+import java.sql.ResultSet;
 import java.sql.SQLException;
 
 public class GiveUserClothing extends RCONMessage<GiveUserClothing.JSONGiveUserClothing> {
@@ -23,14 +24,35 @@ public class GiveUserClothing extends RCONMessage<GiveUserClothing.JSONGiveUserC
 
     @Override
     public void handle(Gson gson, GiveUserClothing.JSONGiveUserClothing object) {
+        if (object.user_id <= 0 || object.clothing_id <= 0) {
+            this.status = RCONMessage.STATUS_ERROR;
+            this.message = "invalid user or clothing";
+            return;
+        }
+
+        if (!userExists(object.user_id)) {
+            this.status = RCONMessage.HABBO_NOT_FOUND;
+            this.message = "user not found";
+            return;
+        }
+
+        if (!clothingExists(object.clothing_id)) {
+            this.status = RCONMessage.STATUS_ERROR;
+            this.message = "clothing not found";
+            return;
+        }
+
         Habbo habbo = Emulator.getGameEnvironment().getHabboManager().getHabbo(object.user_id);
 
-        try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement("INSERT INTO users_clothing (user_id, clothing_id) VALUES (?, ?)")) {
+        try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement("INSERT IGNORE INTO users_clothing (user_id, clothing_id) VALUES (?, ?)")) {
             statement.setInt(1, object.user_id);
             statement.setInt(2, object.clothing_id);
-            statement.execute();
+            statement.executeUpdate();
         } catch (SQLException e) {
             LOGGER.error("Caught SQL exception", e);
+            this.status = RCONMessage.SYSTEM_ERROR;
+            this.message = "failed to grant clothing";
+            return;
         }
 
         if (habbo != null) {
@@ -42,6 +64,39 @@ public class GiveUserClothing extends RCONMessage<GiveUserClothing.JSONGiveUserC
                 client.sendResponse(new BubbleAlertComposer(BubbleAlertKeys.FIGURESET_REDEEMED.key));
             }
         }
+
+        this.message = "granted clothing";
+    }
+
+    private static boolean userExists(int userId) {
+        Habbo habbo = Emulator.getGameEnvironment().getHabboManager().getHabbo(userId);
+        if (habbo != null) {
+            return true;
+        }
+
+        try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+             PreparedStatement statement = connection.prepareStatement("SELECT id FROM users WHERE id = ? LIMIT 1")) {
+            statement.setInt(1, userId);
+            try (ResultSet set = statement.executeQuery()) {
+                return set.next();
+            }
+        } catch (SQLException e) {
+            LOGGER.error("Caught SQL exception", e);
+            return false;
+        }
+    }
+
+    private static boolean clothingExists(int clothingId) {
+        try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+             PreparedStatement statement = connection.prepareStatement("SELECT id FROM catalog_clothing WHERE id = ? LIMIT 1")) {
+            statement.setInt(1, clothingId);
+            try (ResultSet set = statement.executeQuery()) {
+                return set.next();
+            }
+        } catch (SQLException e) {
+            LOGGER.error("Caught SQL exception", e);
+            return false;
+        }
     }
 
     static class JSONGiveUserClothing {