mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-11-05 09:33:25 -08:00
ef4574d2b9
The temporary password was written as a legacy salt+hash row, which makes the next login look like an authentication downgrade. A client holding a saved verifier refuses that downgrade, so the reset locked the account out of every modern client. Store the verifier and, where security/legacy_backup_key is configured, keep a sealed legacy hash of the same temporary password as the downgrade backup, so pre-challenge clients keep the credential path the reset used to provide. Without the key no row shape serves both: the verifier and the legacy hash cannot share one column, so those clients have no path at all. Warn at reset time that the new password has no pre-challenge path, and say so in servatrice.ini.example instead of promising that a reset gets them back in. Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de> |
||
|---|---|---|
| .. | ||
| docker | ||
| migrations | ||
| mysql-storage | ||
| resources | ||
| scripts | ||
| src | ||
| check_schema_version.sh | ||
| CMakeLists.txt | ||
| servatrice.desktop | ||
| servatrice.ini.example | ||
| servatrice.qrc | ||
| servatrice.rc | ||
| servatrice.sql | ||