oss/luanti
oss/luanti
1
0
Fork 0
mirror of https://github.com/luanti-org/luanti.git synced 2025-06-27 16:36:03 +00:00
Code Wiki Activity

Add minetest.check_password_entry callback

Browse source 
Gives a convenient way to check a player's password.

This entirely bypasses the SRP protocol, so should be used
with great care.

This function is not intended to be used
in-game, but solely by external protocols, where no
authentication of the minetest engine is provided, and
also only for protocols, in which the user already gives the
server the plaintext password.

Examples for good use are the classical http form, or irc,
an example for a bad use is a password change dialog inside
formspec.

Users should be aware that they lose the advantages of the SRP
protocol if they enter their passwords for servers outside the
normal entry box, like in in-game formspec menus,
or through irc /msg s,

This patch also fixes an auth.h mistake which has mixed up the
order of params inside the decode_srp_verifier_and_salt function.

Zeno-: Added errorstream message for invalid format when I committed
This commit is contained in:
est31 2016-05-30 23:27:48 +10:00 • committed by Craig Robbins
parent 4134d8ad13
commit 27db929252
4 changed files with 43 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

30
src/script/lua_api/l_util.cpp
View file

@ -246,6 +246,35 @@ int ModApiUtil::l_get_hit_params(lua_State *L)
return 1;
}
// check_password_entry(name, entry, password)
int ModApiUtil::l_check_password_entry(lua_State *L)
{
NO_MAP_LOCK_REQUIRED;
std::string name = luaL_checkstring(L, 1);
std::string entry = luaL_checkstring(L, 2);
std::string password = luaL_checkstring(L, 3);
if (base64_is_valid(entry)) {
std::string hash = translate_password(name, password);
lua_pushboolean(L, hash == entry);
return 1;
}
std::string salt;
std::string verifier;
if (!decode_srp_verifier_and_salt(entry, &verifier, &salt)) {
// invalid format
warningstream << "Invalid password format for " << name << std::endl;
lua_pushboolean(L, false);
return 1;
}
std::string gen_verifier = generate_srp_verifier(name, password, salt);
lua_pushboolean(L, gen_verifier == verifier);
return 1;
}
// get_password_hash(name, raw_password)
int ModApiUtil::l_get_password_hash(lua_State *L)
{
@ -449,6 +478,7 @@ void ModApiUtil::Initialize(lua_State *L, int top)
API_FCT(get_dig_params);
API_FCT(get_hit_params);
API_FCT(check_password_entry);
API_FCT(get_password_hash);
API_FCT(is_yes);

3
src/script/lua_api/l_util.h
View file

@ -71,6 +71,9 @@ private:
// get_hit_params(groups, tool_capabilities[, time_from_last_punch])
static int l_get_hit_params(lua_State *L);
// check_password_entry(name, entry, password)
static int l_check_password_entry(lua_State *L);
// get_password_hash(name, raw_password)
static int l_get_password_hash(lua_State *L);