Possible Block Account ID 1

[SaadPro]

Any way to block 1/1 account access on website?

That way they can change password, delete, create new characters (NOTE: Latest version of myaac, I'm using otx

Post automatically merged: Feb 28, 2024

And keep account manager works {Myaac}

 

[Xikini]

login.php

under

    $characters = [];
    $account = new OTS_Account();

    $inputEmail = $request->email ?? false;
    $inputAccountName = $request->accountname ?? false;
    $inputToken = $request->token ?? false;

add

    // Check if email or account name is "1" and reject login
    if ($inputEmail === "1" || $inputAccountName === "1") {
        sendError("Account name or email '1' is not allowed.", 403); // 403 Forbidden
    }

and idk how strict the login stuff is.. but if someone type "1 " idk if it'd find that account or not..

If whitespace is an issue you could trim the e-mail and account name to remove spaces

$inputEmail = trim($request->email ?? '');
$inputAccountName = trim($request->accountname ?? '');[code]

 

[SaadPro]

Thanks, Going to try

Post automatically merged: Feb 28, 2024

login.php

under

    $characters = [];
    $account = new OTS_Account();

    $inputEmail = $request->email ?? false;
    $inputAccountName = $request->accountname ?? false;
    $inputToken = $request->token ?? false;

add

    // Check if email or account name is "1" and reject login
    if ($inputEmail === "1" || $inputAccountName === "1") {
        sendError("Account name or email '1' is not allowed.", 403); // 403 Forbidden
    }[code]

and idk how strict the login stuff is.. but if someone type "1 " idk if it'd find that account or not..

If whitespace is an issue you could trim the e-mail and account name to remove spaces

$inputEmail = trim($request->email ?? '');
$inputAccountName = trim($request->accountname ?? '');[code]

Like this?

 

[Xikini]

Thanks, Going to try

Post automatically merged: Feb 28, 2024

View attachment 82543

Like this?

yeah, looks good

 

[SaadPro]

yeah, looks good

no working :S

 

[Xikini]

no working :S

sorry it looks like you added [code] in your copy-paste.

I updated my post above. recopy.

 

[SaadPro]

sorry it looks like you added [code] in your copy-paste.

I updated my post above. recopy.

Still No working

 

[Xikini]

Let's try just a string, nothing special?

    // Check if email or account name is "1" and reject login
    if ($inputEmail === "1" || $inputAccountName === "1") {
        sendError("Account name or email 1 is not allowed.");
    }

 

[SaadPro]

Let's try just a string, nothing special?

    // Check if email or account name is "1" and reject login
    if ($inputEmail === "1" || $inputAccountName === "1") {
        sendError("Account name or email 1 is not allowed.");
    }

It doesnt work too, I mean if i am going to login with 1/1 will block you

 

[Xikini]

Is that not what you wanted?

Can't login on website with account 1?

 

[SaadPro]

Is that not what you wanted?

Can't login on website with account 1?

Yes -> Can't login on website with account 1

 

[Xikini]

I don't know why what I posted wouldn't work.

someone else will have to jump in and help

 

[SaadPro]

Solved by adding this code in accountamangement.php

$acc_id = $account_logged->getId();
if($acc_id == 1) die("Access Denied!");

Thanks for who tried to help me

 

[lursky]

myaac/system/login.php at f98332c698eaa5c0506f3b09289748c4acfcfab5 · slawkens/myaac

A free and open-source Automatic Account Creator (AAC) written in PHP - slawkens/myaac

github.com

Never used myaac before but I'd try something like that:

$config_salt_enabled = $db->hasColumn('accounts', 'salt');
$restricted_user_ids = [1];
$login_attempt_possible = (!isset($t) || $t['attempts'] < 5);
$encrypted_password = encrypt(($config_salt_enabled ? $account_logged->getCustomField('salt') : '') . $login_password);
if($account_logged->isLoaded() && !in_array($account_logged->getId(), $restricted_user_ids) && $encrypted_password == $account_logged->getPassword()
   && $login_attempt_possible
  )
{

Or even stop it earlier to save some processing:

$restricted_user_names = ['1'];

if(!empty($login_account) && !in_array($login_account, $restricted_user_names) && !empty($login_password))

You should anyway make it impossible to initialize such session.

 

[SaadPro]

Again
Solved by adding this code in accountamangement.php

$acc_id = $account_logged->getId();
if($acc_id == 1) die("Access Denied!");

Thanks for who tried to help me