The key was a 32 bit number, sent to the client as the MD5 hash of its
decimal text. The client only stores the key and sends it back, so it
is now 16 bytes from the system entropy source written as 32 lowercase
hex characters, which fills the same 33 character field of the login
response.
The auth, master and world servers pass the key itself between them as
a 33 character string in place of the number: SET_SESSION_KEY,
SESSION_KEY_RESPONSE and NEW_SESSION_ALERT keep their IDs and carry the
string where the number was. The master server keeps one key for each
username, and a world server compares the key a client sends with the
one from the master server in constant time. A key stays valid until
the next login of its account replaces it, as before.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Several game messages read a 32 bit length and then read that many
characters without checking it, so the loop ran for the whole length
even after the message had ended. The length now has to fit in the
data the message has left. This covers the activity state, cinematic
path, death type, removed item info and inventory group messages and
the shared wide string reader.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
wchar_t is 16-bit on Windows and 32-bit elsewhere; the game's wide strings
are UTF-16 and already split through the char16_t overload.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bind_ip in sharedconfig.ini picks the local IPv4 address every server's
RakNet sockets listen on (auth, chat, master, world, the dashboard's
connection to master), separate from external_ip, the address players
are sent. Empty or 0.0.0.0 keeps listening on all interfaces; localhost
means 127.0.0.1. Anything that isn't an IPv4 address stops the server
with an error, and each server logs what it bound to.
Fixes#225
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: security vulnerabilities
Tested that all functions related to the touched files work
will test sqlite on a CI build
* fix failing test
* ai feedback
* add buffer size checking
* use c_str
* dont log session key
* Try this for a mac definition
* be quiet apple
* nit
* GeneralUtils const-correctness and minor fixes
* use copy instead of reference for char iteration loops
* fix typo and reorganize some functions
* remove anonymous namespace from GeneralUtils.h
* Put helper functions in nested details namespace to hide from hinting
* rename implementation functions to use lower case, leading underscore and move definitions to source file
* Changed how the TryParse function works (and also did some general cleanup along the way)
* Update noexcept attributes (verified these are correct)
* Add fp overload for MacOS functionality
* resolving some feedback
* Split out unrelated changes to CleanupRoundup branch
* Update in response to feedback
* the consequences of emo's member variable renaming request
* Revert "the consequences of emo's member variable renaming request"
This reverts commit bf318caeda.
* Fully revert renaming attempt
* Revert "the consequences of emo's member variable renaming request"
This reverts commit bf318caeda.
Fully revert renaming attempt
* Created ClientVersion.h and moved the client version defaults to it
* Fix partial parsing and MacOS floating point errors
* attempting fix to MacOS compiler error
* syntax pass (should be the last commit unless the CI fails)
* ah, wait, forgot to uncomment the preprocessor statements for MacOS. THIS should be the last commit pending CI
* Okay, one last thing I noticed: We were including C headers here. Now they're C++ headers. Pinky swear this is it!
* typo and I am OCD. please let this be the last
* hash is usally but not always noexcept, so the specifier should go
* Address MOST of the feedback
* address the claim codes issue
* Implement some trigger event calls
and command handlers
* add zone summary dimissed GM
* break and remove log
* some cleanup in Gather Targets
and blocking out
* fix default value of unlock for play cinematic
* Log on errors
add enum for physics effect type
simplify nipoint3 logic
check arg count
add enum for End behavior
* tryparse for nipoint3
* totally didn't forget to include it
* bleh c++ is blah
* ???
* address feedback
* Fix for #1028
* First iteration of pack reader and interface
* Fix memory leak and remove logs
* Complete packed asset interface and begin on file loading replacement
* Implement proper BinaryIO error
* Improve AssetMemoryBuffer for reading and implement more reading
* Repair more file loading code and improve how navmeshes are loaded
* Missing checks implementation
* Revert addition of Manifest class and migration changes
* Resolved all feedback.
* ASCIIToUTF16: output replacement character instead of failing assert
* Add GeneralUtils::_NextUTF8Char
* Implement GeneralUtils::UTF8ToUTF16
* use string_view everywhere
* use string_view::front instead of begin
* Add PushUTF16CodePoint
