Mirage Source

Originally posted by GodSentDeath

Originaly Posted By: Jobs

This was made by Danny

On server side
in modServerTCP
in the



add


I figured this should be here. As it's actually something all games/engines need.

Sorry for the Necro, but what does this actually do?

It only allows certain characters for the person to use in their name. This needs to be done wherever there's an input for character data (guild, password, whatever) because you can easily get Access=4 or whatever you want with something like Name & vbNewLine & Access=4 and so on.

_________________

With default Mirage, and in any game that has not added this fix, you can login with your username and password, for example:

ID: MyName
Pass: 1234

Then you can open the client again and login again, on the same account, by using this:

ID: /MyName
Pass: 1234

Again, and again. Dropping your items on one client, picking them up on another, then logging out with the empty account first. Then logging out on the account with all the items, saving all your duped, illgotten items, money, etc.

^_^

Well I just figured out the admin thing on Labmonkey's game by having the source and sending the guild name packet

_________________

Thanks, I understand now

If you use MySQL, I don't think any of these injection type attacks would work. But is the account duping still present or does it depend on using ini files?

_________________

I have no idea. Give it a try on your game.

you can sql inject

lol, it was reposted by like 4 people.

_________________

I have some scrubbing code that cleans out injection methods whenever the server touches the database. It's not enough to prevent a dedicated hacker I suppose, but it gets rid of injection attacks through the client and packet architecture.

_________________

Or If Not, not sure what the corect syntax is. But this is way neater.

I think it'd be

If Not

Not 100% sure. Lol. I didn't write this code.

_________________

Why not try my app, ColorEye, on your Android devlce?
Do you like social gaming? Fight it out in Battle Juice!

I am a professional software developer in Salt Lake City, UT.

LOL


Just out of interest, why DOES putting in certain characters/strings have an effect?

As for the /name thing I think it checks if the account is online before it cleans the string of "bad" characters.

As for the admin = 5 thing,

If you write "Name = " and let the person specifiy what comes after that... they can make it say, "Dave & VBNewLine & Access = 5"

Then the file will look like this:
Name = Dave
Access = 5

See the problem?

SQL injections are similar.

_________________

Why not try my app, ColorEye, on your Android devlce?
Do you like social gaming? Fight it out in Battle Juice!

I am a professional software developer in Salt Lake City, UT.

Can't you just check to see if "VbNewLine" is in the textbox?

_________________

Exactly, this is also how you "clean" input data before submitting a query to a MySQL database. look for any characters that would cause this and remove it. I use cleaning code for all MySQL queries in my own game, and everyone should use this dupe fix to prevent people from injection attacks.

I was actually just thinking about this exact comment, getting your name legally changed to this and watch as chaos erupts, lol.

_________________