Commit Graph

16 Commits

Author SHA1 Message Date
Guangcong Luo
8562b2f090 Fix misc bugs 2018-08-26 16:18:06 -04:00
Guangcong Luo
f07fad8aaa Improve login session ID system 2017-11-23 01:31:37 -05:00
Guangcong Luo
2dc0f28e78 Use Node library for Google token validation
After lots of tries, the PHP code just couldn't be made to work...
2017-11-17 20:21:24 -05:00
Guangcong Luo
9e35550fc8 Try to fix Google login
Honestly, I have no clue at this point, but setting the PHP timezone to
UTC seems to fix most of the login bugs I've been seeing.
2017-10-29 21:16:05 -04:00
Guangcong Luo
a0570290a8 Fix timezone for Google login validation 2017-10-21 13:10:44 -04:00
Guangcong Luo
6f841a70a3 Fix crash in Google login verification 2017-10-10 23:05:42 -04:00
Guangcong Luo
644d5ccf91 Support Google login (two-factor auth) (#999)
This doesn't support setting accounts up for Google login: that still
has to be manually done via the database by setting the email field to
`username@gmail.com@`, where the second `@` denotes that it's using
Gmail login.

If the email field does end in `@`, `getassertion` will note this by
sending `;;@gmail`, to convey that the server is expecting a Google
login token rather than a password.

Upon receiving `;;@gmail`, the client will replace the password box will
with a Google login button, and then send the resulting Google login
token to the server in the `password` field. The server will validate
the "password" using the Google server libraries, and otherwise handle
the login as normal.

Note that Google login requires various features that a paranoid person
might disable; most notably 3rd-party cookies.

Fixes Zarel/Pokemon-Showdown#3394
2017-09-13 16:20:38 -04:00
Guangcong Luo
0b153268e9 Clarify disabled account message 2017-07-20 20:59:33 -04:00
Guangcong Luo
c0efe4e0a3 Update sim server URL 2017-05-15 05:55:08 -04:00
Guangcong Luo
c5bc304522 Fix style in session library 2017-03-25 14:15:30 -04:00
Guangcong Luo
a7b45d7430 Fix security vulnerability in register 2017-03-13 02:29:09 -04:00
Guangcong Luo
c91cb4d57e Consistently transform new challenge token 2017-01-22 03:17:47 -05:00
Guangcong Luo
f229736b4d Finish converting session lib to prepared statements 2016-12-11 05:34:52 -05:00
Guangcong Luo
638c117db0 Refactor database to use prepared statements
Prepared statements are much better than manually constructing queries,
but PHP's MySQLi prepared statement syntax sucks.

So does PDO's, but we're abstracting it out so we can make it not suck,
and give it the syntax it should always have had. Which is what this
does.

Yay, finally.
2016-10-20 21:12:06 -04:00
Guangcong Luo
9ea444aeea Fix bugs/crashes in ntbb-session 2016-10-20 20:34:07 -04:00
Guangcong Luo
82e7a917ab Move session library inside repository
For too long, ntbb-session and ntbb-database have been maintained
outside of this repo, but no longer! All these files are now part of the
repository, making it significantly more self-contained.

If I had to say why it took this long, I think it was mostly inertia. It
was easier leaving them where they were than having to audit them for
private keys in the wrong places, etc.

I'm starting to think of PS more as sim first, website secondary than
the other way around, now. Especially now that we don't have a forum,
the website itself isn't really important... Maybe one day I'll get rid
of the landing page and make the sim itself the first thing you see when
you hit pokemonshowdown.com... but today is not that day!

The repo is still not "batteries-included" since I am not going to teach
anyone how to set up PHP and MySQL or even get the config files working.
But for anyone who wanted their own client, well, it gets a lot easier
to do now.
2016-10-20 13:16:06 -04:00