View Single Post
  #3  
Old 12-13-2006, 08:55 AM
Aerewen
Hill Giant
 
Join Date: Dec 2006
Posts: 110
Default

oh super...

so uh... i mean i get the whole security risk to all the EQEMU servers out there if the code was released... but then why not release 2 builds of it? one that uses IP address and 1 that uses the userid/password fields to authenticate?

The minilogin system doesnt seem like it's all that complicated... it accesses the mysql db, runs: SELECT * FROM `account` WHERE `minilogin_ip` = 'currentip'; or somethin similar to get the account info... if no result is returned it spits out the invalid account opcode to the client and resumes the process of sitting there being happy till the next client comes along...

wouldnt be all that hard to change it to selecting the row based on userid instead of minilogin_ip and comparing the password with the one returned...

or if we really wanted to be efficient... just select with both the userid and password... then u dont even have to change the rest of the code.

if the dev team is too busy to do it... then lemme know how to get in touch with em and i'll do it
Reply With Quote