jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-11-05 09:33:25 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

[Server] Store a scrypt verifier when an admin resets a password (#7679)

Browse source 
The temporary password was written as a legacy salt+hash row, which makes the
next login look like an authentication downgrade. A client holding a saved
verifier refuses that downgrade, so the reset locked the account out of every
modern client.

Store the verifier and, where security/legacy_backup_key is configured, keep a
sealed legacy hash of the same temporary password as the downgrade backup, so
pre-challenge clients keep the credential path the reset used to provide.

Without the key no row shape serves both: the verifier and the legacy hash
cannot share one column, so those clients have no path at all. Warn at reset
time that the new password has no pre-challenge path, and say so in
servatrice.ini.example instead of promising that a reset gets them back in.

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
This commit is contained in:
BruebachL 2026-11-02 07:00:48 +01:00 • committed by GitHub
parent e08402ac94
commit ef4574d2b9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 91 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

8
servatrice/src/servatrice_database_interface.h
View file

@ -62,6 +62,9 @@ private:
bool checkUserIsIpBanned(const QString &ipAddress, QString &banReason, int &banSecondsRemaining);
/** Must be called after checkSql and server is known to be in auth mode. */
bool checkUserIsNameBanned(QString const &userName, QString &banReason, int &banSecondsRemaining);
/** Seal a legacy credential for the account's downgrade backup; empty when the
* backup key is unset or the sealed value does not fit the column. */
QString sealLegacyBackup(const QString &storedName, const QString &credential);
bool isStrictModeEnabled(bool &ok) const;
protected:
@ -192,6 +195,11 @@ public:
const QString &targetName,
const QString &channel = QString()) override;
bool changeUserPassword(const QString &user, const QString &password, bool passwordNeedsHash) override;
/** Replace a credential with an already-derived verifier, keeping a sealed legacy hash of the
* same password as the downgrade backup for pre-challenge clients. */
bool changeUserPasswordWithLegacyBackup(const QString &user,
const QString &passwordVerifier,
const QString &legacyCredential);
bool changeUserPassword(const QString &user,
const QString &oldPassword,
bool oldPasswordNeedsHash,