search

FlippAcademy / StarGamesControlPanel

StarGames Control Panel is a Control Panel used for Private Ragnarok Online Servers.
GNU General Public License v3.0
3 stars 14 forks source link

Remove AID / CID / Hash(AID) / Hash(CID) / HASH(password) from the result page #5

Open vthibault opened 11 years ago

vthibault commented 11 years ago

To avoid some future hacks, it's better to remove all account id and character id occurrences in the control panel (code source, url, browser storage) for regular users.

They don't need the account id in the URL, since they can just check/modify their own account. The character id can be replace by the character slot, more secured.

It should also be removed if it's a md5 hash, in the URL OR in the cookie. The cookie should also not contain the md5 of the user password to avoid hack, really.

FlippAcademy commented 11 years ago

That's true. Lets not forget that this code is pretty out-dated to say the least :(

FlippAcademy commented 11 years ago

Sorry for the late reply. I didnt seem to get a notification of this =/