Core/RA: Calculate password hash internally instead of sending plaintext password to mysql.

Convert tabs to spaces.

--HG--
branch : trunk
This commit is contained in:
Machiavelli
2010-12-10 09:02:59 +01:00
parent e3c68e4ada
commit 4f468f9552
3 changed files with 221 additions and 218 deletions
@@ -28,6 +28,7 @@
#include "RASocket.h"
#include "Util.h"
#include "World.h"
#include "SHA1.h"
RASocket::RASocket()
{
@@ -212,9 +213,11 @@ int RASocket::check_password(const std::string& user, const std::string& pass)
AccountMgr::normalizeString(safe_pass);
LoginDatabase.escape_string(safe_pass);
std::string hash = sAccountMgr.CalculateShaPassHash(safe_user, safe_pass);
QueryResult check = LoginDatabase.PQuery(
"SELECT 1 FROM account WHERE username = '%s' AND sha_pass_hash=SHA1(CONCAT('%s',':','%s'))",
safe_user.c_str(), safe_user.c_str(), safe_pass.c_str());
"SELECT 1 FROM account WHERE username = '%s' AND sha_pass_hash = '%s'",
safe_user.c_str(), hash.c_str());
if (!check)
{