Command /login & /register send password into console

Pryaxis / TShock

☕️⚡️TShock provides Terraria servers with server-side characters, anti-cheat, and community management tools.

GNU General Public License v3.0

2.41k stars 377 forks source link

Command /login & /register send password into console #1416

Closed Marcus101RR closed 7 years ago

Marcus101RR commented 7 years ago

TShock: 4.3.23 for Terraria 1.3.4.4 (APIv2.0, OTAPI v2.0.0.16)

Not sure why this never was an issue, making it an issue now. As much as anyone wants to know any server owner can see your password entry for your account and should those people use their real private passwords, you are in bad luck.

This should be fixed so that /login and /register and any auth commands do not pass additional info after it.

sgkoishi commented 7 years ago

It may cause by some plugins you have installed, because the original version will not display it in console.

https://github.com/NyxStudios/TShock/blob/general-devel/TShockAPI/Commands.cs In line 693, only the command with DoLog == true will be logged (by default, it is) In line 229 and 247 (DoLog = false;), it means that executing these commands will not be logged.

Maybe some pugins edit the command or it create a command called "register" too, but didn't set DoLog to false?

Marcus101RR commented 7 years ago

Strange, ill have to look into that, thanks.