Commit Graph

13 Commits

Author SHA1 Message Date
7541a6070f Player: clean up handling of authentication 2018-07-27 18:04:13 +01:00
2907de81ad Apply typehints to more general pocketmine\network namespace 2018-07-05 13:36:23 +01:00
05af87e1d4 Strip empty lines at the end of classes 2018-06-11 13:19:23 +01:00
81957d133d AsyncTask: Rewrite how thread-local storage works, now non-dependent on Server or ServerScheduler
this implementation was god-awful bad and it was entirely avoidable to make it this complicated.

This utilizes the fact that pthreads treats static properties as thread-local. AsyncTask local storage now utilizes a \SplObjectStorage stored in an AsyncTask private static field.
2018-05-29 19:41:00 +01:00
033cb8bd63 oops, wrong namespace 2018-01-28 13:08:11 +00:00
0ed9fcb641 Restrict VerifyLoginTask exception handling to known exceptions
everything else should produce a nice big stack trace for debugging purposes, because everything else is probably bugs

This fixes random exception error messages getting relayed to the client when a user does stupid things like editing the source code without knowing what they are doing.
2018-01-28 13:07:09 +00:00
fd5557861b Changed how login verification is handled, add more useful error messages
closes #1955
2018-01-28 14:13:59 +00:00
4f8e4f0522 Add EOF newlines where missing (bulk) (#1836)
This should solve issues with people making GitHub PRs and having the web editor messing things up. GitHub Web Editor sucks :(
2017-12-20 11:56:36 +00:00
74b074753f Bulk addition of constant visibilities
thanks PhpStorm inspections plugin for annoying the shit out of me until
I did this.
2017-11-21 14:44:10 +00:00
86b76bfcab Fixed trying to get pubkey that doesn't exist in VerifyLoginTask
bug was exposed by previous commit
2017-09-28 18:14:53 +01:00
d0bf0ff083 Imports cleanup 2017-09-28 10:51:05 +01:00
7a77bb0402 Login verification: guilty until proven innocent
assume it's invalid until we've verified everything
2017-09-27 10:29:01 +01:00
03d3e595d6 Implement JWT signature verification and Xbox Live checks, close #315
This can be enabled or disabled using the "online-mode" directive in
server.properties.

NOTE: For safety reasons it is enabled by default, since many naive server owners currently believe that authentication is not needed because "the client is forced to sign-in".
Newsflash for readers: the forced authentication is easily bypassed using a LAN proxy.

Un-authenticated LAN connections will still work fine if the online mode is disabled.

Added the following API methods:
- Server->getOnlineMode() : bool
- Server->requiresAuthentication() : bool
- Player->isAuthenticated() : bool

JWT verification is rather expensive, so it is done in an AsyncTask. Make sure you don't hog your worker threads.
2017-09-25 12:30:58 +01:00