Quote:
Originally Posted by Gambet
Not at all.
You can only have one username per Graal account.
|
Really? All i see on the serverside is this. Doesn't seem to check if the player account already has a bank account. If its on the clientside then youre screwed anyway because someone can always screw with clientside scripts and just trigger the server. This means they could still endlessly flood the database.
PHP Code:
else if (params[0] == "Register")
{
if (gambet_bankDB.(@params[1]) == "")
{
if (gambet_bankDB.counter == "")
{
gambet_bankDB.counter = 1;
} else
{
gambet_bankDB.counter+=1;
}
gambet_bankDB.(@params[1]) = {params[2],params[3],gambet_bankDB.counter,0};
gambet_bankDB.usernames_used.add(params[2]);
this.success = "true";
} else
{
this.success = "failed";
}
player.triggerclient(name,"Registered",params[2],params[3],gambet_bankDB.counter,this.success);
}
Quote:
Originally Posted by Gambet
That doesn't really matter because of the fact that I made it a 10 character limit and I even added a password strength checker.
I don't know about you, but I find it hard to believe that people would use 10 character passwords for things such as emails and so forth.
Besides, why would you use the same password for your personal information on a registration NPC on Graal?
|
I overlooked the password length check. That keeps people from using their graal password, so its a good start. However, even if its not an IDENTICAL password, that ten char password could lead to hints of what they use as passwords elseware. like "hey, i always use butter as my password, so ill use Butter1984 here." someone who can see this can still with a few tricks and turns still crack a password they use elseware. Its still a risk.
Quote:
Originally Posted by Gambet
I don't know about you, but I wouldn't be bothered with having a 10 character password for every site I have to register with. Not to mention it's quite easy to give -r to the DB NPC so that no one except the Manager or so can access it (assuming that right doesn't allow you to access it even via script).
|
Like i said, you dont even need access to it, or even the clientside weapon. You can construct another weapon to add to their account that reads the string in other weapons. its very possible. its still a risk, and one you cant avoid.
Quote:
Originally Posted by Gambet
I don't really understand what you mean by this.
|
You have one big long function serverside. Its good practice to break it up into tasks.
You had things like function onCheckWhatever(temp.stuff,temp.that). On just denotes an event (like onPlayerEnters). you dont need on in your custom declared functions. Also, you dont have to put temp. in the function declaration, they are temp. by default. CheckWhatever(stuff,that) is sufficient. inside that function you can access it as stuff or temp.stuff.
Quote:
Originally Posted by Gambet
This was the only part of the script I did not fully make, the password strength checker. As I stated in my first post, Joey helped me with this part.
Are there better ways to do it? Most of the time there are always better ways of doing something, mostly due to the type of habits that certain scripters have, where they prefer one method over the other and so forth.
|
Yes! I provided a function even!
Quote:
Originally Posted by Gambet
This system isn't perfect, but it's a 'core' system that can be tampered with to be made even greater to fit any server, really.
|
No one expects things to be perfect, however, its a security risk. I cannot just say thats okay.