Threaded Mode | Linear Mode

Leonidas · 09-15-2013 01:53 PM

Hello, I've been trying to setup account creation for my server on my site, and of course im stuck. Here is my sphere_web.scp

Code:

//****************************************************************************

//SPHERE by : Menasoft ©1997-2000

//www.sphereserver.com

// All SPHERE script files and formats are copyright Menasoft & Partners.

// This file may be freely edited for personal use, but may not be distributed

// in whole or in part, in any format without express written permission from

// Menasoft & Partners.  All donations and contributions

// become the property of Menasoft & Partners.

//****************************************************************************

// FILE LAST UPDATED: Friday, April 28, 2000

VERSION=0.54

[WEBPAGE w_login]

WEBPAGESRC=scripts\web\spherelogin.htm

ON=1

    src.login <ARGTXT1> <ARGTXT2>

    if ! <src.account.>

        webpage spherelogfail.htm

    elif <src.account.plevel> >= 5

        webpage sphereconfig.htm

    else

        webpage sphereaccount.htm

    endif

    return 1

[WEBPAGE w_account]

WEBPAGESRC=scripts\web\sphereaccount.htm

PLEVEL=1

[WEBPAGE w_config]

WEBPAGESRC=scripts\web\sphereconfig.htm

PLEVEL=5

[WEBPAGE w_configgame]

WEBPAGESRC=scripts\web\sphereconfiggame.htm

PLEVEL=5

ON=1

    if ! <src.account.>

        webpage spherelogfail.htm

        return 1

    endif

    if <src.account.plevel> < 5

        webpage sphereaccount.htm

        return 1

    endif

    serv.MAXCHARSPERACCOUNT=<ARGTXT1> //T1MAXCHARSPERACCOUNT

    serv.CLIENTLINGER=<ARGTXT2> //T2CLIENTLINGER

    serv.MINCHARDELETETIME=<ARGTXT3> //T3MINCHARDELETETIME

    serv.DECAYTIMER=<ARGTXT4> //T4DECAYTIMER

    serv.CORPSEPLAYERDECAY=<ARGTXT5> //T5CORPSEPLAYERDECAY

    serv.CORPSENPCDECAY=<ARGTXT6> //T6CORPSENPCDECAY

    serv.ARRIVEDEPARTMSG=<ARGCHK1> //C1ARRIVEDEPARTMSG

    serv.GAMEMINUTELENGTH=<ARGTXT7> //T7GAMEMINUTELENGTH

    serv.NOWEATHER=<ARGCHK2> //C2NOWEATHER

    serv.FLIPDROPPEDITEMS=<ARGCHK3> //C3FLIPDROPPEDITEMS

    serv.PLAYERNEUTRAL=<ARGTXT9> //T9PLAYERNEUTRAL

    serv.HITPOINTPERCENTONREZ=<ARGTXT10> //T10HITPOINTPERCENTONREZ

    serv.BANKMAXITEMS=<ARGTXT11> //T11BANKMAXITEMS

    serv.BANKMAXWEIGHT=<ARGTXT12> //T12BANKMAXWEIGHT

    serv.REAGENTSREQUIRED=<ARGCHK4> //C4REAGENTSREQUIRED

    serv.REAGENTLOSSFAIL=<ARGCHK5> //C5REAGENTLOSSFAIL

    serv.EQUIPPEDCAST=<ARGCHK6> //C6EQUIPPEDCAST

    serv.WOPPLAYER=<ARGCHK7> //C7WOPPLAYER

    serv.WOPSTAFF=<ARGCHK8> //C8WOPSTAFF

    serv.LIGHTNIGHT=<ARGTXT13> //T13LIGHTNIGHT

    serv.DUNGEONLIGHT=<ARGTXT14> //T14DUNGEONLIGHT

    serv.MONSTERFIGHT=<ARGCHK9> //C9MONSTERFIGHT

    serv.MONSTERFEAR=<ARGCHK10> //C10MONSTERFEAR

    serv.MURDERMINCOUNT=<ARGTXT15> //T15MURDERMINCOUNT

    serv.MURDERDECAYTIME=<ARGTXT16> //T16MURDERDECAYTIME

    serv.CRIMINALTIMER=<ARGTXT17> //T17CRIMINALTIMER

    serv.SNOOPCRIMINAL=<ARGTXT18> //T18SNOOPCRIMINAL

    serv.GUARDSINSTANTKILL=<ARGCHK11> //C11GUARDSINSTANTKILL

    serv.GUARDLINGER=<ARGTXT19> //T19GUARDLINGER

    serv.LOOTINGISACRIME=<ARGCHK12> //C12LOOTINGISACRIME

    serv.CHARTAGS=<ARGCHK13> //C13CHARTAGS

    serv.NPCTRAINMAX=<ARGTXT20> //T20NPCTRAINMAX

    serv.NPCTRAINPERCENT=<ARGTXT21> //T21NPCTRAINPERCENT

    serv.VENDORMAXSELL=<ARGTXT22> //T22VENDORMAXSELL

    serv.MAXCOMPLEXITY=<ARGTXT23> //T23MAXCOMPLEXITY

    serv.MAGICUNLOCKDOOR=<ARGTXT24> //T24MAGICUNLOCKDOOR

    webpage sphereconfig.htm

    serv.saveini

    return 1

[WEBPAGE w_configserv]

WEBPAGESRC=scripts\web\sphereconfigserv.htm

PLEVEL=5

ON=1

    if ! <src.account.>

        webpage spherelogfail.htm

        return 1

    endif

    if <src.account.plevel> < 5

        webpage sphereaccount.htm

        return 1

    endif

    serv.SERVNAME=<ARGTXT1>        // T1SERVNAME

    serv.ADMINEMAIL=<ARGTXT2>    // T2ADMINEMAIL

    serv.URL=<ARGTXT3>            // T3URL

    serv.REGISTERSERVER=<ARGCHK1> // C1REGISTERSERVER

    serv.REGPASS=<ARGTXT4>    // T4REGPASS

    serv.SERVIP=<ARGTXT5>    // T5SERVIP

    serv.SERVPORT=<ARGTXT6> // T6SERVPORT

    serv.NTSERVICE=<ARGCHK2> // C2NTSERVICE

    serv.MULFILES=<ARGTXT7> // T7MULFILES

    serv.SCPFILES=<ARGTXT8> // T8SCPFILES

    serv.WORLDSAVE=<ARGTXT9> // T9WORLDSAVE

    serv.ACCTFILES=<ARGTXT10> // T10ACCTFILES

    serv.LOG=<ARGTXT11> // T11LOG

    serv.VERBOSE=<ARGCHK3> // C3VERBOSE

    serv.TIMEZONE=<ARGTXT12> // T12TIMEZONE

    serv.ACCAPP=<ARGTXT13> // T13ACCAPP

    serv.SECURE=<ARGCHK4> // C4SECURE

    serv.HEARALL=<ARGCHK5> // C5HEARALL

    serv.SAVEPERIOD=<ARGTXT14> // T14SAVEPERIOD

    serv.GUESTSMAX=<ARGTXT15> // T15GUESTSMAX

    serv.CLIENTMAX=<ARGTXT16> // T16CLIENTMAX

    serv.LANG=<ARGTXT17> // T17LANG

    webpage sphereconfig.htm

    serv.saveini

    return 1

[WEBPAGE w_join]

WEBPAGESRC=scripts\web\spherejoin.htm

ON=1

//

// Has the ip already tried in the last hour ?

// check if the client has alrady tried to get a password.

[WEBPAGE w_401]

// auth required

WEBPAGESRC=scripts\web\spherelogin.htm

[WEBPAGE w_403]

// forbidden

WEBPAGESRC=scripts\web\spherelogin.htm

[WEBPAGE w_404]

// not found

WEBPAGESRC=scripts\web\sphere404.htm

[EOF]

Pretty sure I need to edit something after ON=1 below w_join, but not quiet sure what I need to add. And besides all that when loading spherejoin.html it's just the page, it doesn't connect to my server.

Rattlehead · 09-15-2013 03:16 PM

i dont see how any of that would work tbh.

php ftw?

Leonidas · 09-15-2013 05:54 PM

Idk, i got my server status to work so im assuming i could get this to work aswell with html

Rattlehead · 09-16-2013 07:19 AM

well, the things i see wrong with this, is that the way it has the [WEBPAGE xxx] section setup, is kinda questionable to start with, that will literally only open a webpage, i see it checks for plevel, BUT thats only in game, it checks the plevel then opens the appropriate page, the issue with that is if someone was to go to the webpage without opening it in game (say the staff page for example) then the browser would take them right to it, since the browser doesnt communicate with the game at all, and therefore cannot check their plevel, which would give ANYONE access to a staff page.

the other issues i see with this is that it requires htm pages that do not come included with sphere, and therefore u will have to code urself without knowing exactly whats supposed to go in those files (unless u have them already) its going to be hard to guess what is supposed to go in them.

and really the biggest part of this whole thing that i see is that it is in no way secure, it would take a complete novice to hack into ur server pages and make ur day go from bad to worse in just seconds, im not a hacker per say but i can already see a few holes i could into with this and make life a living hell for the owner, so im sure if i could get into it a real hacker would have a hayday.

what exactly are you wanting to do with this, expectations?

Leonidas · 09-17-2013 03:43 PM

Hmmm, I see.

The only pages im going to use are spherejoin and status. I just want players to be able to create an account from spherejoin, and have it log there IP and email. Im trying to think back to when I had this working, pretty sure I used mysql but not sure.

I appreciate your help man

Rattlehead · 09-17-2013 05:11 PM

http://forum.spherecommunity.net/Thread-...o-to-MySQL

Threaded Mode \| Linear Mode Spherejoin
Author	Message