Salut,
enregistrement d'un utilisateur
[ruby]
def try_register(username, password)
# try to find user
check = RMXOS.server.sql.query("SELECT COUNT(*) AS count FROM users WHERE username = '#{RMXOS.fix_string(username)}'")
hash = check.fetch_hash
# user already exists
return RMXOS::RESULT_FAIL if hash['count'].to_i > 0
# get user count
check = RMXOS.server.sql.query("SELECT COUNT(*) AS count FROM users")
hash = check.fetch_hash
RMXOS.server.sql.query("START TRANSACTION")
# first registered user becomes admin
group = (hash['count'].to_i == 0 ? RMXOS::GROUP_ADMIN : RMXOS::GROUP_PLAYER)
# register new user
# Insertion dans la base du nouvel utilisateur
RMXOS.server.sql.query("INSERT INTO users (username, password, usergroup) VALUES ('#{RMXOS.fix_string(username)}', '#{password}', #{group})")
# get new user ID
check = RMXOS.server.sql.query("SELECT user_id FROM users WHERE username = '#{RMXOS.fix_string(username)}'")
hash = check.fetch_hash
user_id = hash['user_id'].to_i
# Log de la dernière connexion
RMXOS.server.sql.query("INSERT INTO user_data (user_id, lastlogin) VALUES (#{user_id}, '#{RMXOS.get_sqltime(Time.now.getutc)}')")
# get client's IP address
ip = @client.socket.peeraddr[3]
# record IP
# Log de l'ip : Attention avec ça il s'agit d'une donnée perso il y a des règles qui encadre ce stockage
RMXOS.server.sql.query("REPLACE INTO ips(user_id, ip) VALUES (#{user_id}, '#{ip}')")
RMXOS.server.sql.query("COMMIT")
return RMXOS::RESULT_SUCCESS
end[/ruby]
Code de connexion
[ruby]def try_login(username, password)
# find this user
#Selection de l'utilisateur : username avec le mot de passe : password
check = RMXOS.server.sql.query("SELECT user_id, usergroup, banned FROM users WHERE username = " +
"'#{RMXOS.fix_string(username)}' AND password = '#{password}'")
# either username or password is incorrect
return RMXOS::RESULT_FAIL if check.num_rows == 0
hash = check.fetch_hash
# this user is banned
return RMXOS::RESULT_DENIED if hash['banned'] != '0'
user_id = hash['user_id'].to_i
# get client's IP address
ip = @client.socket.peeraddr[3]
# if using IP banning
if USE_IP_BANNING
# match against recorded IPs
check = RMXOS.server.sql.query("SELECT DISTINCT users.user_id FROM users JOIN ips ON users.user_id = ips.user_id " +
"WHERE banned = 1 AND ips.ip = '#{ip}'")
# IP matches with IP of a banned user
return RMXOS::RESULT_DENIED if check.num_rows > 0
end
# this user is already logged in
return RMXOS::RESULT_ALTFAIL if $clients.any? {|client| client.player.user_id == user_id}
# get user main data
@client.player.user_id = user_id
@client.player.username = username
@client.player.usergroup = hash['usergroup'].to_i
# log last login time
RMXOS.server.sql.query("UPDATE user_data SET lastlogin = '#{RMXOS.get_sqltime(Time.now.getutc)}' WHERE user_id = #{@client.player.user_id}")
# record IP
RMXOS.server.sql.query("REPLACE INTO ips(user_id, ip) VALUES (#{user_id}, '#{ip}')")
# find all buddies
self.setup_buddies
# get other user data
check = RMXOS.server.sql.query("SELECT guild_id FROM user_data WHERE user_id = #{user_id}")
hash = check.fetch_hash
# set all guild related data if player is in a guild
self.setup_guild_data(hash['guild_id'].to_i) if hash['guild_id'] != nil
# notify if new PMs in the inbox
check = RMXOS.server.sql.query("SELECT COUNT(*) AS count FROM inbox WHERE recipient_id = #{@client.player.user_id} AND unread = 1")
hash = check.fetch_hash
@client.send("CHT#{RMXOS::Data::ColorInfo}\t0\t#{RMXOS::Data::NewPMs}") if hash['count'].to_i > 0
# notify if inbox is full
check = RMXOS.server.sql.query("SELECT COUNT(*) AS count FROM inbox WHERE recipient_id = #{@client.player.user_id}")
hash = check.fetch_hash
if hash['count'].to_i >= INBOX_SIZE
@client.send("CHT#{RMXOS::Data::ColorInfo}\t0\t#{RMXOS::Data::InboxFull}")
end
return RMXOS::RESULT_SUCCESS
end
[/ruby]
Le code modification du mot de passe
[ruby]
def execute_password_change
# change password
user_id, newpass, username = @current.data
RMXOS.server.sql.query("UPDATE users SET password = '#{newpass}' WHERE user_id = #{user_id}")
@client.send("CHT#{RMXOS::Data::ColorOK}\t0\t#{RMXOS::Data::PasswordChanged}")
# log this action if action log is turned on
if RMXOS.server.options.log_actions
RMXOS.log(@client.player, 'Action', "user password change: #{user_id} (#{username})")
end
end
[/ruby]
Dans ces 3 cas il n'y a nul part l''utilisation d'un quelconque hash, donc c'est fait avant soit dans le SGBD, mais les trigger ce n'est pas sur un select, donc j'ai l'impression que les mots de passe sont en clair dans la base (sauf si l'encodage est fait avant cette classe, celle qui l'utilise).
Donc deux solutions :
- Utilisation des possibilités indiquées dans mon 1er message
- Utilisation des possibilités offertes par MySQL, a savoir un trigger before insert / update qui fait le hash avant ajout / modification (histoire de pas l'oublier), et utiliser une procédure stockée pour le select afin de masquer le comportement, d'ailleurs tu peux utiliser des procédure stockée pour tout si tu le souhaite.
PS : si tu met ruby au lieu de code dans le bbcode tu auras la colorisation de la syntaxe
@+
edit : arf trop lent ^^
donc encodage fait avant XD
