Merge a5a15a54ff into 52833f7fb3

This allows plaintext password auth to be disabled altogether

src/db/Database.hpp

@@ -53,7 +53,7 @@ namespace Database {
 
     void updateAccountLevel(int accountId, int accountLevel);
 
-    // return true if cookie is valid for the account.
+    // return true iff cookie is valid for the account.
     // invalidates the stored cookie afterwards
     bool checkCookie(int accountId, const char *cookie);
 

src/db/login.cpp

@@ -130,8 +130,7 @@ bool Database::checkCookie(int accountId, const char *tryCookie) {
         return false;
     }
 
-    /*
-     * since cookies are immediately invalidated, we don't need to be concerned about
+    /* since cookies are immediately invalidated, we don't need to be concerned about
      * timing-related side channel attacks, so strcmp is fine here
      */
     bool match = (strcmp(cookie, tryCookie) == 0);
@@ -142,7 +141,7 @@ bool Database::checkCookie(int accountId, const char *tryCookie) {
     rc = sqlite3_step(stmt);
     sqlite3_finalize(stmt);
     if (rc != SQLITE_DONE)
-        std::cout << "[WARN] Database fail on checkCookie(): " << sqlite3_errmsg(db) << std::endl;
+        std::cout << "[WARN] Database fail on consumeCookie(): " << sqlite3_errmsg(db) << std::endl;
 
     return match;
 }

src/servers/CNLoginServer.cpp

@@ -682,7 +682,8 @@ bool CNLoginServer::isCharacterNameGood(std::string Firstname, std::string Lastn
 
 bool CNLoginServer::isLoginTypeAllowed(LoginType loginType) {
     // the config file specifies "comma-separated" but tbh we don't care
-    switch (loginType) {
+    switch (loginType)
+    {
     case LoginType::PASSWORD:
         return settings::AUTHMETHODS.find("password") != std::string::npos;
     case LoginType::COOKIE:

vendor/bcrypt/bcrypt.c

@@ -22,14 +22,13 @@
 #endif
 #include <errno.h>
 
+#if defined(_WIN32) || defined(_WIN64)
+// On windows we need to generate random bytes differently.
 #if defined(_WIN32) && !defined(_WIN64)
 typedef __int32 ssize_t;
 #elif defined(_WIN32) && defined(_WIN64)
 typedef __int64 ssize_t;
 #endif
-
-#if defined(_WIN32) || defined(_WIN64)
-// On windows we need to generate random bytes differently.
 #define BCRYPT_HASHSIZE 60
 
 #include "bcrypt.h"