Leahnaya/pokemon-showdown-client
1
0
Fork 0
mirror of https://github.com/smogon/pokemon-showdown-client.git synced 2026-10-02 07:42:12 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Verify that source IP is valid for server requests

Browse Source 
Currently, server authentication for updating the ladder and for
uploading replays is done by comparing the hash of the token provided
by the server to the hash on record. This commit adds a second layer
of authentication by also verifying that the request actually
originates from the Pokemon Showdown server in question.

For now, I have also maintained the server token check as a form of
two-factor authentication.
This commit is contained in:
Cathy J. Fitzpatrick
2013-01-31 11:31:35 -07:00
parent e3be0b3ea3
commit 1208dee10f
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
action.php
View File

@@ -164,8 +164,9 @@ foreach ($reqs as $reqData) {
$server = @$PokemonServers[@$reqData['serverid']];
//var_export($users->getUserData($reqData['p1']));
if (!$server || $server['token'] !== md5($reqData['servertoken']))
{
if (!$server ||
($_SERVER['REMOTE_ADDR'] !== gethostbyname($server['server'])) ||
($server['token'] !== md5($reqData['servertoken']))) {
$out = 0;
break;
}
@@ -187,8 +188,9 @@ foreach ($reqs as $reqData) {
$server = @$PokemonServers[@$reqData['serverid']];
//var_export($users->getUserData($reqData['p1']));
if (!$server || $server['token'] !== md5($reqData['servertoken']))
{
if (!$server ||
($_SERVER['REMOTE_ADDR'] !== gethostbyname($server['server'])) ||
($server['token'] !== md5($reqData['servertoken']))) {
$out = 0;
break;
}