Inactive [SEC] xAuth v2.0.10 - Extra Authentication [1.2.5-R1.3+]

xAuth v2.0.10 - (CraftBukkit build: [1.2.5-R1.3+])
Download v2.0.10

lycano is taking over the development of xAuth as I no longer have the time nor the will to continue working on it. Please see the BukkitDev page: http://dev.bukkit.org/server-mods/xauth/

Thanks to everyone who has showed support for me and xAuth over the past 17 months. It's been 'fun'. If for any reason you need to contact me, stop by my IRC channel (irc.rizon.net #LoveDespite) or toss me a message at http://love-despite.com/forum. Until we meet again, stay gold. Bang.

------------------------------------------------------------------​

xAuth is a plugin designed with a single task in mind: protect a server and its players while running in offline-mode. The basic idea of this protection is allowing players to register an account based on their player name and a supplied password. When a registered player connects to the server, that player will be prompted to authenticate his or herself by logging in. If and only if a valid password is supplied, they will regain full control of their account until their session expires.

Video Tutorial | Commands & Permissions | Configuration | Messages | Translations | Source | Donate!​

Features

• Before registering/logging in, players cannot:
  • Chat, execute commands, interact with objects (levers, chests, etc.), move, or pickup items.
  • Break or place blocks
  • Receive or give damage, be targeted (followed) by hostile mobs
• Inventory and location protection
• In-depth setting and message configuration
• Persistent login sessions through server restarts
• Player name filter and password complexity configuration
• Kick non-logged in (but registered) players after a configurable amount of time
• Bukkit Permissions support
• Kick or temporarily lockout the IP address of a player who fails to log in after a configurable amount of tries
• Custom, highly secure password hashing
• H2 and MySQL support
• Authentication over URL (AuthURL) allows for connection to forum or website databases

Changelog (click for full changelog)

• Version 2.0.10
  • [Fixed] Exploit to completely bypass login system.
  • [Fixed] xAuth commands not working with Rcon
  • [Fixed] Exploiting login system to avoid fire & drowning damage.
  • [Fixed] NPE caused by player connecting & disconnecting during same server tick.
  • [Fixed] 'Table "SESSIONS" not found' error when a player uses /logout while session length is set to zero.
  • [Fixed] Exploiting location protection after dieing to return to the spot of death.
• Version 2.0.9
  • Added several reverse single session configuration options.
  • Fixed registration.forced: false not working.
  • Updated version check and H2 download links.

xAuth Importer
xAuth Importer is a tool used to import accounts from previous versions of xAuth as well as other authentication plugins. Click here for more information.

 

It's my current strings.yml.

Code:

register:
    err:
        registered: '&cVous êtes déjà inscrit.'
        disabled: '&Les inscriptions sont actuellement désactivées.'
    usage: '&cCorrect Usage: /register <password>'
    login: '&cVous devez vous enregistrer en utilisant /register <mot de passe>.'
    success2: '&aLe code choisi est : &f%1'
    success1: '&aVous vous êtes enregistré avec succès !'
...

My text is already surrounded with single quotes.

(sorry, i'm french)

 

@CypherX
Thanks for your reply.
Just thought i'd mention that the .jar doesn't seem to be generating the xAuth folder.
So i took the xAuth folder out of the zip.
Also, yes misc.protect-location is set to 'protect-location: true'
I'm getting the following error:

-DanJames

 

Looks like the problem is:

Code:

disabled: '&Les inscriptions sont actuellement désactivées.'

It seems you forgot to add a color after the &.

Try downloading the Zip in the first post and replacing your config.yml with the one included in there (you'll have to re-configure it) or you can add:

Code:

protect-location: true

below:

Code:

autosave: true

so it looks like this:

Code:

misc:
    allow-changepw: true
    allowed-cmds:
    - /register
    - /login
    autosave: true
    protect-location: true

 

My problem isn't resolved. I've tried with a new xAuth folder. No error. When i replace any character by a special character, i've this problem again.

 

@CypherX
I'm sorry I think you mis-understood my post.
I said that the jar didnt include the xAuth folder so I took the whole xAuth folder from the zip and placed it in plugins (which inluded the config.yml)
This already has the protect-location: true inserted.
Do you have any other ideas why I might be getting this error?
-DanJames
My xAuth/config.yml
http://pastebin.com/En1W1rX0

 

What special characters are you using?

Ah, sorry, I did misread it. I've just spent some time testing various things and it seems your problem is caused when using the /reload command while online-mode is set to true in server.properties and at least one player is online. This happens because xAuth is designed to only work while the server is in offline-mode, so while it is enabling it performs a check to see if online-mode is set to true. If it is, it automatically disables itself executing the onDisable code which is meant to return all players to their original location, but since it has yet to save their locations it errors out with a NullPointerException.

This can be fixed by setting online-mode to false in server.properties (which is the mode xAuth was created for).

 

If I replace 'a' by 'à' or 'e' by 'é'/'è'/'ê'/'ë'.
Any accentued characters cause this error.

(again, sorry for my english )

Edit : would you a video capture ?

 

Oh i'm such an idiot! I read that! And i thought it was good that it disabled itself when online mode was true. Thanks so much for looking into it.
I feel silly
-DanJames

@CypherX
Is it possible to set where you are when your not logged in?
I wanted a 'login room' which is just a small hut that players are sent to when they are not logged in, then when logged in they just go back to where they were when they logged out.
Does that make sense?
If its not a feature, can it be?
-DanJames

EDIT by Moderator: merged posts, please use the edit button instead of double posting.

 

At the moment, no, it's not possible, but it has already been implemented as a feature in xAuth 2 (which is currently in development).

 

@CypherX ah kwl thanks.
-DanJames

 

It's a short capture with my problem :

 

i think you cant use those letters in yaml files.

 

@Pyraah

After doing some searching and testing, it seems that the problem is due to the fact the strings file is encoded in ANSI when it should be encoded in UTF-8. You can change the encoding using Notepad++ by opening the file, going to Encoding on the menu bar and clicking "Encode in UTF-8 without BOM" then saving it.

 

...
Thanks !

 

@Pyraah

Try to encode your yml file on utf-8 (BOM), maybe it resole your problem with specials character, i'll try it on an other plugin and it will be ok, but i don't try for this plugin.

Allez en Français:

""Essaye d'encoder ton fichier en utf-8 (Bom), peut être que cela résoudra ton problème pour les accents, personnellement je l'ai fait pour un autre plugin et sa marche ^^, mais pour d'autres ce n'est pas le cas. Je n'ai pas testé pour ce dernier donc je n'ai pas de feedback à te donner.""


Oops i don't see CypherX's post ^^

 

@Navigateur
Merci quand même. J'ai choisi l'encodage sans Bom et ça a fonctionné aussi.

 

Can you please support MySQL? ...

 

I'm Having an issue with this plugin could be me messing something up like usual but when the plugin is loaded at first it makes you login then after you have logged in Once when you leave and come back it dosen't give you the option to login again ? Any help would be apreciated?

 

Hi,

In config.yml, change "timeout" value to 0 for to disconnect immediatly. 30 is a good value, if your game is crashed you have just the time for to relaunch it.


(sorry, i'm french)

 

Thank you soo much Pyraah!
Worked like a charm
And your english is very good

 

Sometimes players lost theyr equipment why ?

 

I've just been informed of this 'exploit' on my server, due to the xAuth plugin:

It allows players that have died to 'respawn' in the exact same location of their death, any ideas?

 

That happens because it saves the exact location of a player joining the server then returns them to that location upon logging in. If I do another update before xAuth 2 is released a fix will be included in that (already put the fix in xAuth 2).

 

Hi!
ran into a problem
both this plugin and Citizens plugin are using the command: /toggle
will appreciate if you will change the command to something else

 

Hi

Because of some Griefers on an offline-Server I disabled registration. But now I have to go to the server console to registrate a player or enable registration again.
Is it possible to add the "/register <name> <password>" command for Ops ingame?

Or better would be a registration with moderation. Players can register but they are only enabled if an op says yes.

 

xAuth 2 will include an in-game command to register other players when it's released. I do want to point out that you can use /toggle reg to enable or disable registration without having to do so through the console or modifying the config file. Registration moderation seems like a pretty cool feature and might make it's way into xAuth 2 as well.

 

I Installed the Plugin on my Server but it wont work
If a new Player come on my server he can play without regrestration

Some one know how to fixx ? :/

Fixxed : Forgot to add a Group "Member"

 

Hey not to sure if this can be fixed But when people are logging in
The server gets lag for like 5-10 seconds any chance of adding MySQL support ? or another way of fixing the lag ??

 

please fix that!!

 

cipxerx can u read this and think?
http://forums.bukkit.org/threads/automaticaly-ip.20290/