jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-11-10 03:53:26 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

[Server] Serve password reset from the database interface (#7842)

Browse source 
cmdForgotPasswordRequest, continuePasswordRequest, cmdForgotPasswordReset,
cmdForgotPasswordChallenge, cmdRequestPasswordSalt and cmdSubmitPasswordVerifier
still called Servatrice_DatabaseInterface, and two of them validated the account
token and email through the generic validateTableColumnStringData helper. Add
doesForgotPasswordExist, addForgotPassword and getUsableLegacyBackup to
Server_DatabaseInterface with fail-closed defaults, replace the table/column
probes with userTokenMatches and userEmailMatches using the same statement and
case-insensitive comparison, and let the commands ask the injected interface.
Audit records, check order and every response code are unchanged.
This commit is contained in:
BruebachL 2026-11-10 12:16:26 +01:00 • committed by GitHub
parent d05198101d
commit 9b00972b4d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 54 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

25
libcockatrice_network/libcockatrice/network/server/remote/server_database_interface.h
View file

@ -404,6 +404,31 @@ public:
{
return false;
}
/** @brief Whether an unexpired forgot-password request exists for the user. */
virtual bool doesForgotPasswordExist(const QString & /* userName */)
{
return false;
}
/** @brief Records a forgot-password request for the user. */
virtual bool addForgotPassword(const QString & /* userName */)
{
return false;
}
/** @brief The sealed legacy password backup of a user, empty when none is usable. */
virtual QString getUsableLegacyBackup(const QString & /* userName */)
{
return {};
}
/** @brief Whether the user's stored token matches, case-insensitively. */
virtual bool userTokenMatches(const QString & /* userName */, const QString & /* token */)
{
return false;
}
/** @brief Whether the user's stored email matches, case-insensitively. */
virtual bool userEmailMatches(const QString & /* userName */, const QString & /* email */)
{
return false;
}
virtual qint64 startSession(const QString & /* userName */,
const QString & /* address */,
const QString & /* clientId */,