"Security" issue with username/database.
FinalStand
Member Posts: 87
How is username stored in NWN:EE? In the past it was a gamespy id. But now users can change it at will?
Also is the way the database storing data based on user name different? It's storing it as 'username charactername' (no space) instead of just 'charactername'.
The problem: say you have a character name 'Lagnar'. You login as username 'grims' with NWN Client. You do a quest and it gives you a 1 in the database. You get your reward.
But then you log out, change your player name in NWN Client and log back in (same CD Key). You change your playername to 'reachpw'. It still finds your character 'Lagnar' based on CD key. But the quest isn't saved since it's keyed from 'username charactername', so player is now logged in and can do quest again.
See here: https://i.imgur.com/1rmOM1Q.png
There is 1 quest completed twice by 1 character with 1 CD Key using 2 different usernames.
From a modders point of view, we can just ignore the optional 'playername' and key our own using substrings in varaname name (ie. store it globally as 'Lagnar-QUEST_TUT_001' and exclude the PLAYERID field).
-=-
Another option, would be to add an optional parameter for username. So everything is keyed by CDKey, but optional can key by player name and/or charactername. I like this idea best.
Another options is just drop the username when storing playing name. I don't think the original did this.
OR lastly, just put a deliminator there so we can parse it.
Also is the way the database storing data based on user name different? It's storing it as 'username charactername' (no space) instead of just 'charactername'.
The problem: say you have a character name 'Lagnar'. You login as username 'grims' with NWN Client. You do a quest and it gives you a 1 in the database. You get your reward.
But then you log out, change your player name in NWN Client and log back in (same CD Key). You change your playername to 'reachpw'. It still finds your character 'Lagnar' based on CD key. But the quest isn't saved since it's keyed from 'username charactername', so player is now logged in and can do quest again.
See here: https://i.imgur.com/1rmOM1Q.png
There is 1 quest completed twice by 1 character with 1 CD Key using 2 different usernames.
From a modders point of view, we can just ignore the optional 'playername' and key our own using substrings in varaname name (ie. store it globally as 'Lagnar-QUEST_TUT_001' and exclude the PLAYERID field).
-=-
Another option, would be to add an optional parameter for username. So everything is keyed by CDKey, but optional can key by player name and/or charactername. I like this idea best.
Another options is just drop the username when storing playing name. I don't think the original did this.
OR lastly, just put a deliminator there so we can parse it.
0