Jump to content

Habilis

Members
  • Content Count

    225
  • Joined

  • Last visited

  • Days Won

    20

Posts posted by Habilis


  1. You are running your emulator as root.

    This is unnecessary and more than that, it is illadvised...

     

    If you are using Debian/Ubuntu as operating system for your VPS

    you can check out guide in my signature, a decent way of installing Hercules emulator.


  2. Day 4 2/2: SQL security work takes form

    Spoiler

    wEzz0PA.jpg

    I moved forward with the SQL security work

    So basically here is the main idea of how It works

    cSlXG6u.jpg

     

    and here are some pieces of my SQL code

    DECLARE _ragDBWebUserViewer VARCHAR(32);
    DECLARE _ragDBWebUserViewerPass VARCHAR(32);
    
    SET _ragDBWebUserViewer = 'ragdbwebviewer';
    SET _ragDBWebUserViewerPass = 'huji'
    
    ALTER TABLE login ADD COLUMN emailverrif VARCHAR(32) NOT NULL DEFAULT '' AFTER pincode_change;
    
    
    DELIMITER //
    CREATE PROCEDURE WebRegisterNewRagPlayerOne
    (
    	IN login VARCHAR(23)
    	, IN email VARCHAR(39)
    	, IN password VARCHAR(32)
    	, IN sex ENUM('M','F')
    	, IN emailverrifhash VARCHAR(32)
    	, OUT returnparam INT(1)
    )
    proc_webreg:BEGIN
    	
    	-- -1 Unhandled error
    	DECLARE EXIT HANDLER FOR SQLEXCEPTION SET returnparam = -1;
    
    	SELECT userid 
    	INTO @loginalreadyexists 
    	FROM login 
    	WHERE userid = login;
    	
    	SELECT email 
    	INTO @emailalreadyexists 
    	FROM login 
    	WHERE email = email;
    	
    	IF @loginalreadyexists NOT NULL THEN
    		-- -2 Login already exists
    		SET returnparam = -2;
    		LEAVE proc_webreg;
    	END IF;
    	
    	IF @emailalreadyexists NOT NULL THEN
    		-- -3 Email already exists
    		SET returnparam = -3;
    		LEAVE proc_webreg;
    	END IF;
    	
    	-- 4085943947  (2099-06-24)
    	INSERT INTO login 
    		(userid, email, user_pass, sex, emailverrif, unban_time) 
    	VALUES 
    		(login, email, password, sex, emailverrif, 4085943947);
    END //
    DELIMITER ;
    
    GRANT EXECUTE ON PROCEDURE ragdb.WebRegisterNewRagPlayerOne TO _ragDBWebUserViewer@'localhost';
    
    
    DELIMITER //
    CREATE PROCEDURE WebRegisterNewRagPlayerTwo
    (
    	IN emailverrifhash VARCHAR(32)
    	, OUT returnparam INT(1)
    )
    BEGIN
    	-- Hey it's not a tutorial ;)
    END //
    DELIMITER ;
    
    GRANT EXECUTE ON PROCEDURE ragdb.WebRegisterNewRagPlayerTwo TO _ragDBWebUserViewer@'localhost';
    
    
    
    DELIMITER //
    CREATE PROCEDURE RsetPasswordRagPlayerOne
    (
    	IN login VARCHAR(23)
    	, IN emailverrifhash VARCHAR(32)
    	, OUT email VARCHAR(39)
    )
    BEGIN
    	-- Hey it's not a tutorial ;)
    END //
    DELIMITER ;
    
    GRANT EXECUTE ON PROCEDURE ragdb.RsetPasswordRagPlayerOne TO _ragDBWebUserViewer@'localhost';
    
    
    
    
    
    DELIMITER //
    CREATE PROCEDURE RsetPasswordRagPlayerTwo
    (
    	IN password VARCHAR(32)
    	, IN emailverrifhash VARCHAR(32)
    	, OUT returnparam INT(1)
    )
    BEGIN
    	-- Hey it's not a tutorial ;)
    END //
    DELIMITER ;
    
    GRANT EXECUTE ON PROCEDURE ragdb.RsetPasswordRagPlayerTwo TO _ragDBWebUserViewer@'localhost';
    

    So basically as you can see there is ragdbwebviewer that has access only to the stored procedures and I will add some views

    it will have access to

    like 

    Create View AS SELECT nicnake, level, 

    left join job....

    whatever (note I'm not doing select * nor selecting login, email, passwords)

     

    The password reset part is a security weakness, but if my website is hacked and 

    ragdbwebviewer credentials obtained, hacker will have to know account login to reset the password... in theory

    in real life there will be some more layers of security...


  3. Day 4 1/2: minor adjustments to the graphics

    Improved that banner, even-though, I don't expect to pay $ to the tops to be able to put it....

    ZdtNAPm.gif

     

    Added a little credit to the graphical content made mostly from Daifuku's graphical content (Will work some more later to make it blend better...)

    Spoiler

    FCG7blK.jpg

     

    Spoiler

    hVKdKl8.jpg

     

    Improved a little Watermark see on screenshot

    Spoiler

    zFpjMw1.jpg

     


  4. 13 minutes ago, meko said:

    @Relman il semble que CeresCP n'a pas été mis à jour depuis 2012 donc c'est possible qu'il soit incompatible avec le protocole actuel

    En fait, les checks comme ca, ya pas de protocole.

    Fonction utiliséé c'est fsockopen

    pas mal standart....

     

    Essai de rouler ce script vraiment minimaliste (Fait par quelq'un pour eAthena OMG...) que j'ai adapté en 2 secondes

    <?php
    
    $Status = ServerStatus();
    
    ?>
    
    <table border="0">
      <tr>
        <td><?php echo $Str_Loginsrv; ?></td>
        <td><?php echo $Status[0]; ?></td>
      </tr>
      <tr>
        <td><?php echo $Str_Charsrv; ?></td>
        <td><?php echo $Status[1]; ?></td>
      </tr>
      <tr>
        <td><?php echo $Str_Mapsrv; ?></td>
        <td><?php echo $Status[2]; ?></td>
      </tr>
    </table>
    
    <?php
    
        /*
         * Server Status (Return Array of Login,Char,Map State)
         */
        function ServerStatus() {
    	
    		$Srv_Host = "127.0.0.1";
    
    		// Login, Char, Map Server Port
    		$Srv_Login = 6900;
    		$Srv_Char = 6121;
    		$Srv_Map = 5121;
    
    		// Status Text
    		$Str_Loginsrv =  "Login Server:";
    		$Str_Charsrv =  "Char Server:";
    		$Str_Mapsrv =   "Map Server:";
    		$Str_onlinepl = "Player Online:";
    
    		$Str_Online = '<font color="green">Online</font>';
    		$Str_Offline = '<font color="red">Offline</font>';
    		
            // Disable Error Reporting (for this function)
            error_reporting(0);
            
            $Status = array();
            $LoginServer = fsockopen($Srv_Host, $Srv_Login, $errno, $errstr, 1);
            $CharServer = fsockopen($Srv_Host, $Srv_Char, $errno, $errstr, 1);
            $MapServer = fsockopen($Srv_Host, $Srv_Map, $errno, $errstr, 1);
            if(!$LoginServer){ $Status[0]= $Str_Offline;  } else { $Status[0] = $Str_Online; };
            if(!$CharServer){ $Status[1] = $Str_Offline;  } else { $Status[1] = $Str_Online; };
            if(!$MapServer){ $Status[2] = $Str_Offline;  } else { $Status[2] = $Str_Online; };
            return $Status;
        }
        
    ?>

    Si la probleme est vraiment la même tu peux commencer a debugger et a jouer avec error_reporting(0);

    Sinon 90% je suis certain que c'est un port qui n'accepte pas de connexions


  5. D'habitude si le serveur est configuré correctement

    Autrement dit, les usagers peuvent se connecter.

    C'est alors lié au probleme avec les  ports il faut assurer que tout les ports sont ouverts de cote de ton serveur RO acceptant les connections entrantes de l'exterieur

     ET de cote de ton ServeurWeb acceptant les connections sortantes sur ces ports...


  6. 47 minutes ago, luan122 said:

    What I want to know is if the way I'm sum it is correct

     

    Ok if it works...

    47 minutes ago, luan122 said:

     I convert the final value in time as h:m:s I tried to find it but didn't

     

     

    You don't at this point ...

    You do it when you retrieve using something like this

    Select @Days = (online_time / 60 / 60 / 24) FROM ... WHERE...

     

    UPD:

    Disregard my last, don't perform any calculations at select just

    do a Simple select into your script

    Select online_time FROM ... WHERE...

    then inside your script convert this logic into Herc scripting

    function GetTimeDiff($online_time) 
    {
        $how_log_ago = '';
        $minutes = (int)($online_time / 60);
        $hours = (int)($minutes / 60);
        $days = (int)($hours / 24);
        if ($days >= 1) {
          $how_log_ago = $days . ' day' . ($days != 1 ? 's' : '');
        } else if ($hours >= 1) {
          $how_log_ago = $hours . ' hour' . ($hours != 1 ? 's' : '');
        } else if ($minutes >= 1) {
          $how_log_ago = $minutes . ' minute' . ($minutes != 1 ? 's' : '');
        } else {
          $how_log_ago = $online_time . ' second' . ($online_time != 1 ? 's' : '');
        }
        return $how_log_ago;
    }

    If you implement 

    it should give you XX day XX hour XX minute XX second

     


  7. Still Day 3:

     

    Alright, I've done one more little thing.

    The banner made from free banner found at RA...

    ALhcLfJ.png

    I din't bother with animations, as most places where this banner would go require $

    But good thing to do if I really have nothing else to do, would be:

    - Scale properly logo (remake it with lower font-weight)

    - Scale features text and animate it

    01PXVbs.jpg

     

    Next-up: SQL Security work....

    Idea to create a tiny SQL script that would create a DataBaseWebUser in my Ragnarok Database.

    - Create few SQL views returning player names, scores, levels (obviously not password nor login) Information to make TOPs

    - Crate 2-3 SQL stored procedures (new user register, password reset, email reset)

    - make password reset, email reset stored procedures tricky so that they cannot be executed to reset password just like that...

     

    and give my DataBaseWebUser  access just to those Stored procedures and SQL views in my ragnarok server databse

     

    This way if a hacker, somehow breaches into my website and obtains usaername and password of  DataBaseWebUser, all he will be able to do to my RO server database is

    - register an account

    - select information that already appears in the tops

    B38cFIv.jpg


  8. 28 minutes ago, Mystery said:

    Honestly, good work so far with the content. That shadowing though lol. Also, is it just me or do the character sprites look a bit more smoothed out? o-o

    Possibly, that's how 2D pic (sprite) might look in high-end 3D environment ?


  9. 6 minutes ago, Cyro said:

    I really love that "humon check" captcha 

     

    Ps- you made it since most of the free web hosting do not support it ?

    I remember makinig my first  website for ragnarok using .tk (was free) domain with free web hosting which had alot if restrictions like using captcha! , so I gave up on free web hosting :P

     

    I've decided not to go with a free hosting as they are all pile of crap.

    What I'm going to do with free hosting is host my patches and patcher news.

    As most free hosting forbid to use their services only for file hosting. I don't care, patcher news page looks like a website to me...


  10. just create a directory 

    inside Hercules/sql-files

    call it something like bak

    mkdir ~/Hercules/sql-files/bak

     

    (I don't know where is your emulator in the filesystem...  so I made a relative path to users home directory...)

    Next, dump your databases in that directory using a user with access to your database(s)

    If you don't know such user or you don't have it, use root (Attention, not the system root, the MySQL root user password)

    Then just dump database(s)

     

    mysqldump -u root -p hercrodb > ~/Hercules/sql-files/bak/hercrodb_backup.sql

    If you store logs in a separate Database you may dump that too:


    mysqldump -u root -p hercrolog > ~/Hercules/sql-files/bak/hercrolog_backup.sql

     

    then just archive your emulator directory with your backup inside of it

    tar -cvf HerculesEmulator.tar ~/Hercules

    I like to use SCP now you can use either SCP or FTP to transfer that archive to your new debian VPS

    On the other side just unarchive it

    tar -xf HerculesEmulator.tar -C ~

     

    And Import files from bak directory in your extracted emulator

    cd ~/Hercules/sql-files/bak

    Import main database

    mysql -u root -p hercrodb < hercrodb_backup.sql

    import logs database if you have it in separate databases

    mysql -u root -p hercrolog < hercrolog_backup.sql

    And like Meko said install all dependencies and recompile...

     

    After you successfully imported your database(s) and tested server is running just 

    rm -rf ~/Hercules/sql-files/bak

    for a good measure....


  11. Day ... Hell if I know:

     

    Using the theme I had

    http://webapplayers.com/homer_admin-v2.0/landing_page.html

     

    I designed the home page (needs some more work like for timer and other) 

    But this how I wanted my home page to look.

    It's completely adaptive.

    And I finally put to use my personally developed Ragnarok captcha,

    at the register section.

    DISCLAIMER : 

    NOT AN ADVERTISMENT

    Server name HabilisRO is fictional, made up for the purpose of this Dev's Diary. All matches with the existing servers are a coincidence. 

    VcW9e91.jpg

     

    Ow and should I mention the Special Thanks ?

    Special thanks to Daifuku for providing free graphical content.

     

    There will be a link to her profile...

     

     


  12. Stick the chat to the forum ok? I don't like Helping in private messages. 

    for 2 reasons

    - In PM no one sees my Awesomeness!

    - If I say BullShit, there is no one to correct me, as opposed to the forum, where people may see it and say "Habilis is bullshitting again".

     

    To update your local repo with sourcetree you need to use Pull button.

    I never worked with this gui, but I think, if there are no conflicts, there will be a silent update.

    And if there are conflicts, it will ask you to resolve them before updating

     

    then you can see what commit hash is your local branch and compare it to the latest commit hash on herc github

    https://github.com/HerculesWS/Hercules/commits/master

     

    If it checks then you are using latest version...

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.