jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-11-10 03:53:26 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

[Server] Serve password reset from the database interface (#7842)

Browse source 
cmdForgotPasswordRequest, continuePasswordRequest, cmdForgotPasswordReset,
cmdForgotPasswordChallenge, cmdRequestPasswordSalt and cmdSubmitPasswordVerifier
still called Servatrice_DatabaseInterface, and two of them validated the account
token and email through the generic validateTableColumnStringData helper. Add
doesForgotPasswordExist, addForgotPassword and getUsableLegacyBackup to
Server_DatabaseInterface with fail-closed defaults, replace the table/column
probes with userTokenMatches and userEmailMatches using the same statement and
case-insensitive comparison, and let the commands ask the injected interface.
Audit records, check order and every response code are unchanged.
This commit is contained in:
BruebachL 2026-11-10 12:16:26 +01:00 • committed by GitHub
parent d05198101d
commit 9b00972b4d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 54 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

10
servatrice/src/servatrice_database_interface.cpp
View file

@ -3552,6 +3552,16 @@ bool Servatrice_DatabaseInterface::validateTableColumnStringData(const QString &
return false;
}
bool Servatrice_DatabaseInterface::userTokenMatches(const QString &userName, const QString &token)
{
return validateTableColumnStringData("{prefix}_users", "token", userName, token);
}
bool Servatrice_DatabaseInterface::userEmailMatches(const QString &userName, const QString &email)
{
return validateTableColumnStringData("{prefix}_users", "email", userName, email);
}
void Servatrice_DatabaseInterface::addAuditRecord(const QString &user,
const QString &ipaddress,
const QString &clientid,