Leisuretimedock/blessing-skin-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,402 Commits 10 Branches 89 Tags 24 MiB
7717a1f93f
Commit Graph

83 Commits

Author SHA1 Message Date
shhzhang
3d42aab16d [Security] Dynamic Email Verification & Password Reset Links 
**Problem**
1. **Static Signature Vulnerability**:
   - Email verification links used a static signature algorithm (same link for lifetime), allowing account hijacking if links were leaked.
   - *Worst-case scenario*: Compromised AppKey + leaked link → full-site account under danger.
2. **Overly Long Reset Window**:
   - Password reset links remained valid for 1 hour, enabling attackers to hijack accounts if intercepted.
   - *Worst-case scenario*: Compromised AppKey + leaked link → full-site account account take over.

 **Solution**
- **Email Verification**:
  - Replaced static signatures with **HMAC-SHA256 + timestamp + nonce**.
  - Links are now **one-time-use** and expire immediately after verification.
- **Password Reset**:
  - Reduced validity window from 1h → **5 minutes**.
  - Added rate limiting to prevent brute-force attacks.

 **Impact**
- **Closed Communities**: Critical for real-name systems (e.g., gaming, enterprise).
- **AppKey Leak Mitigation**: Even with leaked AppKey, intercepted links are now useless.

The commit message is translated by Deepseek due to my poor English.
 2026-01-24 23:16:39 +08:00
Steven Qiu
064b0967fc
chore: complete Facade namespaces in use statements 2025-07-02 19:29:19 +08:00
Asnxthaony
a13879f2df
fix: use unique routes name 2023-05-27 00:36:01 +08:00
Pig Fang
bebdea9c20
user menu can be controlled by plugins 2023-01-26 09:37:23 +08:00
Pig Fang
073da66623
support toggling dark mode 2021-06-06 18:07:08 +08:00
Pig Fang
d6ac5eb5d1
support .well-known/change-password 2020-09-07 19:19:16 +08:00
Pig Fang
1d82dcb5df
require submitting email when verifying email 2020-08-31 19:48:31 +08:00
Pig Fang
5b738ffe6f
refactor SkinlibController 2020-08-20 08:48:53 +08:00
Pig Fang
5517e70cda
fix route names duplication (fix #199) 2020-07-19 15:22:03 +08:00
Pig Fang
c8af8ccd3e
update route of notifications 2020-06-30 09:28:22 +08:00
Pig Fang
ffef98ad2e refactor update 2020-06-24 10:49:53 +08:00
Pig Fang
6568ed311d tweak routes of i18n management 2020-06-16 09:50:30 +08:00
Pig Fang
aeb8a0800c extract oauth client as plugin 2020-06-07 23:38:08 +08:00
Pig Fang
88e3ed7a07 add more events for ClosetManagementController 2020-06-07 10:54:26 +08:00
Pig Fang
946896117a refactor SkinlibController 2020-06-05 23:35:49 +08:00
Pig Fang
9141af2a70 refactor fetching texture info 2020-06-04 18:12:58 +08:00
Pig Fang
7ae9a05f0c extract "single-player" function as plugin 2020-06-03 14:47:44 +08:00
Pig Fang
a451c498d6 refactor routes 2020-06-03 09:02:25 +08:00
Pig Fang
5094cff07a generate URLs by codegen 2020-05-30 10:44:36 +08:00
Pig Fang
6f55045f9e refactor routes 2020-05-29 09:09:10 +08:00
Pig Fang
8b2f2db6eb refactor controllers 2020-05-27 17:28:24 +08:00
Pig Fang
291efe730f rewrite reports management page with React 2020-05-15 11:05:04 +08:00
Pig Fang
3e1a10a461 rewrite users management page with React 2020-05-13 18:12:01 +08:00
Pig Fang
fff60b37ac require super admin to download or upload plugin 2020-05-12 18:50:58 +08:00
Pig Fang
15af883976 tiny tweaks 2020-05-10 23:34:04 +08:00
Pig Fang
504d985c8d tweak players API (breaking change) 2020-05-09 10:11:07 +08:00
Pig Fang
5e051eadfe refactor 2020-05-08 23:16:13 +08:00
Pig Fang
af351d211b rewrite players management page with React 2020-04-30 18:47:37 +08:00
Pig Fang
5d9bb28281 attempt to fix "invalid signature" issue 2020-03-28 22:36:27 +08:00
Pig Fang
c219a0f03f rewrite skin library with React 2020-03-24 18:05:46 +08:00
Pig Fang
4c981529e1 add closet command for Web CLI 2020-03-21 17:30:44 +08:00
Pig Fang
271c950ad9 add two new ways to install plugin 2020-03-12 10:41:41 +08:00
Pig Fang
4c066ac38a make user report page be static 2020-01-21 11:07:20 +08:00
Pig Fang
c87d19f258 tweak middlewares 2020-01-13 09:25:07 +08:00
Pig Fang
092eedfdf4 refactor routes 2020-01-13 08:37:57 +08:00
Pig Fang
d7a60a842d remove auto update check 2020-01-05 17:37:56 +08:00
Pig Fang
3c8f820780 remove unreachable code 2020-01-05 11:24:30 +08:00
Pig Fang
2b827cf651 Add more events for authentication 2019-12-24 17:09:30 +08:00
Pig Fang
91fbb42431 Add OAuth client 2019-12-15 11:19:10 +08:00
Pig Fang
65d82fba64 Refactor 2019-12-10 23:40:32 +08:00
Pig Fang
66becb27d0 Detect Readme of plugin automatically 2019-12-08 23:58:44 +08:00
Pig Fang
82140b6893 Blade -> Twig (almost finished) 2019-09-19 22:13:25 +08:00
Pig Fang
3b1866ffba Blade -> Twig 2019-09-18 23:06:48 +08:00
Pig Fang
9403ae356d Blade -> Twig (wip) 2019-09-17 23:10:44 +08:00
Pig Fang
54d3b76c13 Add support of customizing UI text 2019-09-08 18:57:19 +08:00
Pig Fang
98522a5cce
Apply fixes from StyleCI (#96) 
[ci skip] [skip ci]
 2019-09-07 11:00:35 +08:00
Pig Fang
13a2cd9b18 Refactor setup 2019-09-06 23:53:47 +08:00
Pig Fang
1d0ae52c7b Switch to another captcha library 2019-09-05 12:23:46 +08:00
Pig Fang
8bb617623e Add environment status page 2019-08-28 11:39:00 +08:00
Pig Fang
7a7cc2ddd9 Notifications 2019-07-03 16:19:13 +08:00