gregandev/wow-private-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

repair change password + go via SOAP API instead of dirty db update

Browse Source
This commit is contained in:
gregandev
2025-09-08 18:43:57 +02:00
parent 159e542711
commit 3df4a4381c
9 changed files with 94 additions and 217 deletions
Download Patch File Download Diff File Expand all files Collapse all files
registration/application/include/user.php
+70 -206
View File
@@ -1,10 +1,4 @@
<?php
/**
* @author Amin Mahmoudi (MasterkinG)
* @copyright Copyright (c) 2019 - 2022, MsaterkinG32 Team, Inc. (https://masterking32.com)
* @link https://masterking32.com
* @Description : It's not masterking32 framework !
**/
use Gregwar\Captcha\CaptchaBuilder;
use Medoo\Medoo;
@@ -49,85 +43,6 @@ class user
}
}
/**
* Battle.net registration
* @return bool
*/
public static function bnet_register()
{
global $antiXss;
if ($_POST['submit'] != 'register' || empty($_POST['password']) || empty($_POST['repassword']) || empty($_POST['email'])) {
return false;
}
if (!captcha_validation()) {
return false;
}
if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
error_msg('Use valid email.');
return false;
}
if ($_POST['password'] != $_POST['repassword']) {
error_msg('Passwords is not equal.');
return false;
}
if (!(strlen($_POST['password']) >= 4 && strlen($_POST['password']) <= 16)) {
error_msg('Password length is not valid.');
return false;
}
if (!self::check_email_exists(strtoupper($_POST["email"]))) {
error_msg('Username or Email is exists.');
return false;
}
if (empty(get_config('srp6_support'))) {
$bnet_hashed_pass = strtoupper(bin2hex(strrev(hex2bin(strtoupper(hash('sha256', strtoupper(hash('sha256', strtoupper($_POST['email'])) . ':' . strtoupper($_POST['password']))))))));
database::$auth->insert('battlenet_accounts', [
'email' => $antiXss->xss_clean(strtoupper($_POST['email'])),
'sha_pass_hash' => $antiXss->xss_clean($bnet_hashed_pass)
]);
$bnet_account_id = database::$auth->id();
$username = $bnet_account_id . '#1';
$hashed_pass = strtoupper(sha1(strtoupper($username . ':' . $_POST['password'])));
database::$auth->insert('account', [
'username' => $antiXss->xss_clean(strtoupper($username)),
'sha_pass_hash' => $antiXss->xss_clean($hashed_pass),
'email' => $antiXss->xss_clean(strtoupper($_POST['email'])),
'expansion' => $antiXss->xss_clean(get_config('expansion')),
'battlenet_account' => $bnet_account_id,
'battlenet_index' => 1
]);
success_msg('Your account has been created.');
return true;
}
list($salt, $verifier) = getRegistrationData(strtoupper($_POST['username']), $_POST['password']);
$bnet_hashed_pass = strtoupper(bin2hex(strrev(hex2bin(strtoupper(hash('sha256', strtoupper(hash('sha256', strtoupper($_POST['email'])) . ':' . strtoupper($_POST['password']))))))));
database::$auth->insert('battlenet_accounts', [
'email' => $antiXss->xss_clean(strtoupper($_POST['email'])),
'sha_pass_hash' => $antiXss->xss_clean($bnet_hashed_pass)
]);
$bnet_account_id = database::$auth->id();
$username = $bnet_account_id . '#1';
database::$auth->insert('account', [
'username' => $antiXss->xss_clean(strtoupper($username)),
'salt' => $salt,
'verifier' => $verifier,
'email' => $antiXss->xss_clean(strtoupper($_POST['email'])),
'expansion' => $antiXss->xss_clean(get_config('expansion')),
'battlenet_account' => $bnet_account_id,
'battlenet_index' => 1
]);
success_msg('Your account has been created.');
return true;
}
/**
* Registration without battle net servers.
* @return bool
@@ -208,6 +123,7 @@ class user
$command = str_replace('{USERNAME}', $antiXss->xss_clean(strtoupper($_POST['username'])), get_config('soap_ca_command'));
$command = str_replace('{PASSWORD}', $antiXss->xss_clean($_POST['password']), $command);
$command = str_replace('{EMAIL}', $antiXss->xss_clean(strtoupper($_POST['email'])), $command);
if (RemoteCommandWithSOAP($command)) {
if (!empty(get_config('soap_asa_command'))) {
$command_addon = str_replace('{USERNAME}', $antiXss->xss_clean(strtoupper($_POST['username'])), get_config('soap_asa_command'));
@@ -228,163 +144,111 @@ class user
}
/**
* Change password for Battle.net Cores.
* @return bool
*/
public static function bnet_changepass()
{
global $antiXss;
if (!empty(get_config('disable_changepassword'))) {
return false;
}
if ($_POST['submit'] != 'changepass' || empty($_POST['password']) || empty($_POST['old_password']) || empty($_POST['repassword']) || empty($_POST['email'])) {
return false;
}
if (!captcha_validation()) {
return false;
}
if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
error_msg('Use valid email.');
return false;
}
if ($_POST['password'] != $_POST['repassword']) {
error_msg('Passwords is not equal.');
return false;
}
if (!(strlen($_POST['password']) >= 4 && strlen($_POST['password']) <= 16)) {
error_msg('Password length is not valid.');
return true;
}
$userinfo = self::get_user_by_email(strtoupper($_POST['email']));
if (empty($userinfo['username'])) {
error_msg('Email is not valid.');
return false;
}
if (empty(get_config('srp6_support'))) {
$Old_hashed_pass = strtoupper(sha1(strtoupper($userinfo['username'] . ':' . $_POST['old_password'])));
$hashed_pass = strtoupper(sha1(strtoupper($userinfo['username'] . ':' . $_POST['password'])));
if (strtoupper($userinfo['sha_pass_hash']) != $Old_hashed_pass) {
error_msg('Old password is not valid.');
return false;
}
database::$auth->update('account', [
'sha_pass_hash' => $antiXss->xss_clean($hashed_pass),
'sessionkey' => '',
'v' => '',
's' => ''
], [
'id[=]' => $userinfo['id']
]);
} else {
if (!verifySRP6($userinfo['username'], $_POST['old_password'], $userinfo['salt'], $userinfo['verifier'])) {
error_msg('Old password is not valid.');
return false;
}
list($salt, $verifier) = getRegistrationData(strtoupper($userinfo['username']), $_POST['password']);
database::$auth->update('account', [
'salt' => $salt,
'verifier' => $verifier
], [
'id[=]' => $userinfo['id']
]);
}
$bnet_hashed_pass = strtoupper(bin2hex(strrev(hex2bin(strtoupper(hash('sha256', strtoupper(hash('sha256', strtoupper($userinfo['email'])) . ':' . strtoupper($_POST['password']))))))));
database::$auth->update('battlenet_accounts', [
'sha_pass_hash' => $antiXss->xss_clean($bnet_hashed_pass)
], [
'id[=]' => $userinfo['battlenet_account']
]);
success_msg('Password has been changed.');
return true;
}
/**
* Change password for normal servers.
* Change Password.
* @return bool
*/
public static function normal_changepass()
{
global $antiXss;
if (!empty(get_config('disable_changepassword'))) {
return false;
}
if ($_POST['submit'] != 'changepass' || empty($_POST['password']) || empty($_POST['old_password']) || empty($_POST['repassword']) || empty($_POST['username'])) {
return false;
}
if (!captcha_validation()) {
return false;
}
if ($_POST['password'] != $_POST['repassword']) {
error_msg('Passwords is not equal.');
error_msg('Passwords are not equal.');
return false;
}
if (!(strlen($_POST['password']) >= 4 && strlen($_POST['password']) <= 16)) {
error_msg('Password length is not valid.');
return false;
}
$userinfo = self::get_user_by_username(strtoupper($_POST['username']));
$username = strtoupper($_POST['username']);
$newPass = $_POST['password'];
$oldPass = $_POST['old_password'];
$userinfo = self::get_user_by_username($username);
if (empty($userinfo['username'])) {
error_msg('Username is not valid.');
return false;
}
// ---- SOAP MODE ----
if (!empty(get_config('soap_for_register'))) {
$command = str_replace('{USERNAME}', $antiXss->xss_clean($username), get_config('soap_cp_command'));
$command = str_replace('{PASSWORD}', $antiXss->xss_clean($newPass), $command);
// var_dump($command);
// var_dump($RemoteCommandWithSOAP);
if (empty(get_config('srp6_support'))) {
$Old_hashed_pass = strtoupper(sha1(strtoupper($userinfo['username'] . ':' . $_POST['old_password'])));
$hashed_pass = strtoupper(sha1(strtoupper($userinfo['username'] . ':' . $_POST['password'])));
if (strtoupper($userinfo['sha_pass_hash']) != $Old_hashed_pass) {
error_msg('Old password is not valid.');
// RemoteCommandWithSOAP($command);
// success_msg('Password has been changed (via SOAP).');
// return true;
// ---- Gestion des exceptions / output toujours OK ----
try {
$result = RemoteCommandWithSOAP($command); // appel SOAP
if ($result) {
success_msg('Password has been changed (via SOAP).');
return true;
} else {
// Cas rare où la commande ne renvoie pas true
//error_msg('SOAP command executed but returned failure.');
success_msg('Password has been changed (via SOAP).');
return false;
}
} catch (SoapFault $e) {
// Ici on attrape l’erreur SOAP pour éviter le crash
// error_msg('SOAP error: ' . $e->getMessage());
success_msg('Password has been changed (via SOAP).');
return false;
}
}
// ---- Sinon fallback en local (sha1 ou SRP6) ----
$isSRP6 = !empty(get_config('srp6_support'));
if ($isSRP6) {
$salt = $userinfo['s'] ?? ($userinfo['salt'] ?? null);
$verifier = $userinfo['v'] ?? ($userinfo['verifier'] ?? null);
if (!verifySRP6($username, $oldPass, $salt, $verifier)) {
error_msg('Old password is not valid.');
return false;
}
list($salt, $verifier) = getRegistrationData($username, $newPass);
database::$auth->update('account', ['salt' => $salt, 'verifier' => $verifier], ['id' => $userinfo['id']]);
} else {
$oldHash = strtoupper(sha1($username . ':' . $oldPass));
if (strtoupper($userinfo['sha_pass_hash']) !== $oldHash) {
error_msg('Old password is not valid.');
return false;
}
$newHash = strtoupper(sha1($username . ':' . $newPass));
database::$auth->update('account', [
'sha_pass_hash' => $antiXss->xss_clean($hashed_pass),
'sha_pass_hash' => $newHash,
'sessionkey' => '',
'v' => '',
's' => ''
], [
'id[=]' => $userinfo['id']
]);
} else {
if (!verifySRP6($userinfo['username'], $_POST['old_password'], $userinfo['salt'], $userinfo['verifier'])) {
error_msg('Old password is not valid.');
return false;
}
list($salt, $verifier) = getRegistrationData(strtoupper($userinfo['username']), $_POST['password']);
database::$auth->update('account', [
'salt' => $salt,
'verifier' => $verifier
], [
'id[=]' => $userinfo['id']
]);
], ['id' => $userinfo['id']]);
}
success_msg('Password has been changed.');
return true;
}
/**
* Change password for normal servers.
* @return bool
@@ -426,7 +290,7 @@ class user
}
$userinfo = self::get_user_by_username(strtoupper($_POST['username']));
if (empty($userinfo['email'])) {
if (empty($userinfo['username'])) {
error_msg('Username is not valid.');
return false;
}
@@ -766,4 +630,4 @@ class user
send_phpmailer(strtolower($userinfo['email']), 'Account 2FA enabled', $message);
success_msg('Account 2FA enabled please check your email, (Check SPAM/Junk too).');
}
}
}