Core/RA: Calculate password hash internally instead of sending plaintext password to mysql.
Convert tabs to spaces. --HG-- branch : trunk
This commit is contained in:
@@ -28,6 +28,7 @@
|
|||||||
#include "RASocket.h"
|
#include "RASocket.h"
|
||||||
#include "Util.h"
|
#include "Util.h"
|
||||||
#include "World.h"
|
#include "World.h"
|
||||||
|
#include "SHA1.h"
|
||||||
|
|
||||||
RASocket::RASocket()
|
RASocket::RASocket()
|
||||||
{
|
{
|
||||||
@@ -212,9 +213,11 @@ int RASocket::check_password(const std::string& user, const std::string& pass)
|
|||||||
AccountMgr::normalizeString(safe_pass);
|
AccountMgr::normalizeString(safe_pass);
|
||||||
LoginDatabase.escape_string(safe_pass);
|
LoginDatabase.escape_string(safe_pass);
|
||||||
|
|
||||||
|
std::string hash = sAccountMgr.CalculateShaPassHash(safe_user, safe_pass);
|
||||||
|
|
||||||
QueryResult check = LoginDatabase.PQuery(
|
QueryResult check = LoginDatabase.PQuery(
|
||||||
"SELECT 1 FROM account WHERE username = '%s' AND sha_pass_hash=SHA1(CONCAT('%s',':','%s'))",
|
"SELECT 1 FROM account WHERE username = '%s' AND sha_pass_hash = '%s'",
|
||||||
safe_user.c_str(), safe_user.c_str(), safe_pass.c_str());
|
safe_user.c_str(), hash.c_str());
|
||||||
|
|
||||||
if (!check)
|
if (!check)
|
||||||
{
|
{
|
||||||
|
|||||||
Reference in New Issue
Block a user