This version no longer protects command arguments (for example, previously, LockLogin would hide /account protect under /account *******)
What is new in this version?
Added command protection into BungeeCord
Added join and leave messages
Added locklogin.user.leave and locklogin.user.join, which if present, will hide the join/leave message
Added locklogin.account.close.self permission, by default granted to all users. If not present, the user won't be able to run /account close
Added locklogin.account.remove.self permission, by default granted to all users. If not present, the user won't be able to run /account remove nor /account delete
Fixed the plugin was trying to hook into ProtocolLib even without it
Fixed the plugin was not correctly configuring LockLogin wrapper for BungeeCord servers
TargetServer, the server instance for the use on the LockLogin API was not being correctly detected, as well as the messaging quee. Modules are able to speak betwen plugin instances again
What has been improved in this version?
Improved plugin internal security
The plugin won't allow anymore the access to its classes by non modules. LockLogin will perform a runtime check in order to verify it is being accessed from a module
The plugin will also log every action a module does, such as loggin someone or changing someone's password
Fixed the plugin was not using the correct update urls
Fixed the plugin was not correctly verifying installed KarmaAPI
This version improves the following features:
The plugin will now be able to work without the version updater. This means if the plugin fails to setup the version checker, it will simply work without checking versions
This version adds a memory to the web services, so bungeecord servers remembers the servers they were connected to. Thanks to this, the server is able to reconnect to the spigot server even without a player in the network. The servers are connected on startup.
This version also fixes an issue with inventory GUI setup, throwing exceptions
This version starts the implementation of LockLogin web services, implementing the communication service. The plugin will not longer use the BungeeCord messaging channel
This version removed the now deprecated communication token system, and reverted the legacy key communication system, with the difference that this time the key will be generated by a server and has an expiration of 1 day.
Fixed an issue in where when a player disconnected from a bungeecord server after being switched (from a server to another), the plugin wouldn't promp login request anymore, and would also ignore sessions (or premium module wouldn't be able to auto log the player)
This version fixes the sessions feature was not working correctly, and also implements another security feature. The panic tokens.
The panic token is a feature to prevent brute force attacks, after too many fail login tries, a token will be requested instead, until the token is inserted correctly, the IP of the client who is trying to access the account will be blocked for a limited configurable period of time.
As everything in this plugin, this is a per-user option, to use panic tokens, use the new command /account protect
This version of the plugin changes the way the permissions are managed by the plugin. With a lot of improvements and also an update of the plugin wiki to match the latest version
This version fixes a problem related with BungeeCord comunication.
After updating the plugin file system, some paths in the files changed, which caused the plugin unable to find some required info such as comunication token. This should be fixed now and everything should work again.
This version fixes a big problem related with player accounts and new servers using LockLogin.
This version fixes a problem in where players were not able to join the server and in where the plugin would cause the server to just exit on new plugin installations.
PLEASE DO THIS IF YOU HAD PLAYER DATA IN YOUR SERVER: - Navigate to: plugins/LockLogin/data - Remove: plugins/LockLogin/data/accounts - Rename: plugins/LockLogin/data/accounts_backup to plugins/LockLogin/data/accounts
This version adds support for 1.19 and also implements a feature to protect your users against database leaks. This version implements the "virtual id system". Which hash the password with a virtual ID so even if the player database gets stolen, a brute force attack will fail.
This version also changes the plugin file system to use the new and human-friendly file system KarmaMain
This version fixes a problem related with LockLoginPremium module ( and any other plugin ) that modifies the UUID while the player is joining the server.
This version also adds more version servers for LockLogin
This version fixes a problem with downloading the required module
LockLoginManager, also made LockLogin use oracle bucket data to fetch versions and some other data.
LockLogin is now closer to allow using his own communication channel, which could be a high improvement for how the plugin works
(For developers) Added event UserPostValidationEvent, which is fired after the user is validated by spigot server while in BungeeCord mode. This event has been created to fix a problem with LockLoginPremium pre-authing users causing problems
Note: LockLoginManager module is now optimized for 1.13.6 it should work in 1.13.1 and higher ( under 1.13.6 ) but not as well as in 1.13.6. Remember, LockLoginManager allows you to see the registered commands using $helpme command and update the plugin at runtime.
Fixed a bug in where the player session check would not be valid if he got kicked from game
Fixed a bug in where the player quit event was being processed twice if the player was kicked
Fixed a bug in where the join events of LockLoginAPI were not being processed, fixing modules as LockLoginPremium and LockLoginRateLimiter in Velocity ( BungeeCord and Spigot didn't have this problem )
What's new in this version?
Optimized a little bit the /locklogin command, it now runs async
Optimized version checker and improved how modules updater system work
Modified some plugin messages
Added minimal distance from spawn required option to save player last location, this will avoid LockLogin#25
Tried to optimize a little bit when the plugin handles connections on BungeeCord, as this has been causing connection timeout errors for too long time now
Tried to optimize a little bit when the plugin handles connections on BungeeCord, as this has been causing connection timeout errors for too long time now
This version does not contain any fix or new feature, but API updates.
These API updates allow advanced module developers to register commands into the plugin API. These commands starts with '$' instead of minecraft's '/', for example, /premium ( while using official advanced module for premium support ) is now '$premium'
This update also has a lot of new events for AdvancedModule and some other changes
Due the recent package name updates, the plugin started to fail when detecting if the server was in bungeecord mode. I published an update a few seconds ago, that should fix the problem, but didn't, this version should now definitively fix this problem.
Published new module API, ( Advanced modules ). These modules are not loaded by bukkit, but by LockLogin inside plugins/LockLogin/modules. If you are about to create a LockLogin module, please read take a look at the end of this update entry...
Fall damage won't be prevented now
What's fixed in this version?
Tried to fix a logger problem when restarting server on legacy versions
Hi! I didn't expect to have to post 3 updates consecutively, but I need to, as this is a fix for an important security issue for BungeeCord that has been secretely present in the latest 3 updates ( excluding this )
This version does not contains any big issue, as there has been not any bug report. In the major changes, there're
Update plugin to use KarmaAPI 1.0.7
Downgrade plugin library Google Authenticator to 1.4.0 to try to fix some invalid token generation ( this may require a google auth token reset on the player account )
What's new?
Players last location are now saved when the plugin is disabled
Players are teleported to spawn when the plugin is enabled
Fixed a new issue, related with "parameter number 8"
The MySQL issues were only present while using Azuriom
BungeeCord
Added an option to toggle "AlreadyPlaying" protection. In BungeeCord, this is disabled by defautl, as BungeeCord already provides protection against that. This option will be removed in a future from BungeeCord
Another exploit which was allowing players to join as server owners and run op-level commands. For obvious reasons, I won't tell how to perform this exploit, thanks to @Goncii for helping me to find the exploit cause, and another discord users who reported this exploit <3
Fixed a bug in where players were always forced to pin GUI, even if they didn't have pin GUI, this problem was only while BungeeCord enabled, but requires an spigot instance update
Fixed a potential exploit. For more info, keep reading
This version fixes a potential exploit ONLY PRESENT IN BUNGEECORD which would allow unlogged players to navigate between server. For obvious reasons, I won't tell how. This is not completely an issue as the player could not run any command or say anything, and he would be kicked for login timeout after a few seconds. But with this epxloit, the player is able to move, place and break blocks. This exploit was also not present if you put LockLogin in all your servers.
Fixed player was not being sent to main lobby after register.
I added support with LoginSecurity migration, you can now migrate from LoginSecurity to LockLogin ( /locklogin migrate loginsecurity ls_players )
AuthMe migration in MySQL is now not automatic
Added a "ignored columns" option in mysql.yml, these columns won't be removed automatically by LockLogin ( by default LockLogin, Azuriom, LoginSecurity columns won't be removed )
Tried to fix some problems with max ip allowed to register
Fixed player skulls in /lookup command were not having player skin
WARNING:
I've changed the way IPs are stored, the plugin will migrate from the old method ( ips_v2.lldb and ips_v3.lldb ) to this new one method, the first time it will lag the server dependning on how much players do you have
Fixed a problem with BungeeCord; wasn't generating mail.yml config file
LockLogin installation media and LockLogin FAT updates: Not everyone knows about, but LockLogin installation media and LockLogin fat will be removed on August 1st, as switching LockLogin source code from jdk 8 to jdk 15 ( STILL SUPPORTING JAVA 8 & 11 SERVERS ) fixed tons of LockLogin flat issues.
As consecuence, LockLogin FAT and LockLogin installation media will be replaced with LockLogin flat.
Can't you do it just now? Yes, but all changes need a time for all users to do it, LockLogin is not the exception, I'm sure a lot of users keep using LockLogin FAT with the idea LockLogin flat keeps having bugs, ERROR. LockLogin flat is now more stable than LockLogin FAT ( as LockLogin FAT is not longer being updated due the reasons mentioned above ).
When will be removed LockLogin IM and LockLogin FAT LockLogin installation media will be replaced 1st of february with LockLogin flat, and LockLogin installation media and LockLogin fat will stop receiving support 1st august.
Why am I still to update LockLogin FAT if you stopped updating it? Updating LockLogin fat will download a LockLogin flat release, so, you are actually switching to LockLogin flat
Added password recovery system using email ( requires extra configuration on email.yml and the user to type /setmail )
Added ip confirmation system using email ( the plugin will check if the player IP is the same as his last IP and ask him to confirm his IP change without affecting player gameplay )
New commands: /setmail - /confirm - /recovery
Re-organized plugin files, message files are now in lang folder
API Changes:
Completely implemented new PlayerAuthEvent in BungeeCord
Fixed some console filter bugs ( only on flat version )
READ THIS: LockLogin fat version will stop being updated at this point, this means LockLogin fat version will stop receiving new features, switch to LockLogin flat version as it is stable now
HEY! LockLogin is now using jdk 15, so it's recommended to you to switch to java 15
After switching LockLogin from jdk 8 to jdk 15, a lot of bugs got fixed, one of them is dependency injection of KarmaAPI, that's why LockLogin fat and LockLogin installation media will stop existing soon, leaving only LockLogin flat, which will be renamed to LockLogin
A command has been added for fat version, to allow LockLogin fat users to switch to flat version
LockLogin will now allow to download plugin updates without update system enabled ( /updateChecker )
Plugin downloads will be now async ( less lag )
Fixes:
Fixed some file problems ( if you still have problems, please report that in our discord, also thanks for everyone who reported file problems and other kind of problems )
PLEASE NOTE LockLogin download will now download LockLogin installation media, which won't update current LockLogin, to update LockLogin remove your current LockLogin installation and install LockLogin again ( YOU DON'T NEED TO REMOVE LockLogin folder )
If you have auto updates enabled, you won't need to do that
This update is just a file type divider, you can choose the fat jar ( compatible with almost most platforms, server.jar and hosts ) or flat one which one will try to download and load dependencies ( some hosts, platforms or server.jar are incompatible with this for unknown reasons )
This version allows the player to login if he's in a nether portal by destroying it, don't worry, it will be restored after player login or disconnects without logging in
I added 2 new API methods to login and register a player, these methods will return an AuthResult object
Code (Java):
PlayerAPI api
=new PlayerAPI
(player
);
AuthResult result
= api.
tryLogin(true);//AuthResult result = api.tryLogin(true, "You've been logged); //Also works with: AuthResult result
= api.
tryRegister("aRandomPassword");
switch(result
){ case OFFLINE
: case CANCELLED
: break; case SUCCESS
: case SUCCESS_TEMP
: System.
out.
printIn("YAY!"); break; case IDLE
: System.
out.
printIn("Processing..."); break; }
2FA and PIN players weren't being blocked ( they were able to act as logged-in players )
Tried to fix a problem related with max accounts registrations
What's new?
When you change or register, if your password is weak, it will send the player a message with a secure password gen
Made public LockLogin source code
Thanks everyone for the support you gave to the plugin, but from now one, I'll stop working on it, only to fix the incomming issues, if you want to fork this plugin you all are free to it as long as you you grant credits to this plugin
Fixed players were able to open and interact with custom inventories (player inventory "e" keeps being accessible, but any interaction will close the inventory)
Fixed a potential problem with max accounts system, I recommend you to completly remove LockLogin/data
This version adds authme bcrypt compatibility, and also improves the auto-updater to disallow LockLogin with invalid plugin.yml or lower LockLogin versions, it also adds a little delay between unload and load when using /applyUpdates | /locklogin applyUpdates to avoid possible errors
I keep trying to optimize LockLogin, this version won't make any relevant performance change, but you should use it, since any performance improvement is good
In this update I tried to optimize even more LockLogin events, with a success result, maybe in the next updates, I'll optimize commands and user account status checker
Optimized even more LockLogin in spigot (keeps being a bit unstable) but the performance is notably better
Added AuthMe sqlite migration to LockLogin mysql
Updated applyUpdates and migration command
New command usages:
/applyUpdates -> /locklogin applyUpdates
/migrate -> /locklogin migrate <MySQL, AuthMe (Only used for sqlite migration, AuthMe mysql migration is automatic by setting LockLogin database the same as AuthMe)>
SQLite migration usage: (If you are using default values from AuthMe database configuration)
/locklogin AuthMe authme (/plugins/AuthMe/authme.db) authme (AuthMe config.yml > mySQLDatabase) realname (AuthMe config.yml > mySQLRealName ) password (AuthMe config.yml > mySQLColumnPassword)
Added pin (GUI) system, it can be used with the default login system, and 2fa, so you will have 3 auth factors, of course, you can disable it, or disable 2fa and use pin system as 2fa
Commands & Usage: /pin <pin> - Sets your pin (must be 4 digits length)
/resetpin <pin> - Removes your pin
This version implements a java version check, since I discovered LockLogin is not fully compatible with Java +1.8, LockLogin will keep working in +1.8 but an alert will be shown
This version just removes unused and not needed dependencies inside the .jar, making it more lightweight and making it able to download from spigot page instead of an external link
For users security, now the IPs will be encrypted inside ips.lldb (LockLogin DataBase) file, by consecuent, the old version (3.1.9) will be removed and not accessible anymore
The new re-coded version came with a lot of bugs, due it was literally, a new plugin, but thanks the community of LockLogin, I'm about to fix them all
THANKS YOU ALL
Fixed spawns in air were causing the player to be kicked
Added a second check to BungeeHack protection to avoid getting kicked in case of "false positive"
Fixed if blinded effect enabled, players were losing their potion effects
New:
Now LockLogin BungeeCord will detect if the auth lobby and main lobby are the same, to avoid errors (LockLogin will use the main as auth lobby if auth doesn't works, and will use the auth lobby as main, if main doesn't works)
Fixed some problems with MySQL in bungeecord and Spigot
Fixed players with fly weren't able to fly after logging in/register or verifying 2fa
Improvements:
Improved how the MySQL migration works
Improvements over plugin security in BungeeCord
What's new?
Added /reg and /log to /register and /login aliases
API: This version includes a new API for BungeeCord and Spigot, brinding support also to plugins using the old API (2.1.5 and 2.1.6 won't support plugins using old API)
The BungeeCord API has PlayerVerifyEvent, witch will be implemented in further versions in Spigot in a not too away future.
Added MySQL support, switch to MySQL by setting
AccountSys: MySQL
LockLogin will migrate automatically yaml players data to MySQL when they join, to migrate MySQL data to Yaml, simply use /ll migrate
Since now, when the plugin loads, if the server is not bungeecord, all the online players will be kicked with the message
"Your session with the server has expired"
That for the players know that hey have to login and to avoid errors if MySQL is enabled and you load the plugin with third-party plugin loaders, like plugman
Now the QR message (that one you can click to go to the url where you can scan the 2fa qr code or get your google authenticator key) doesn't use NMMS or reflection, wich means the plugin uses less server resources.
Also bungeecord doesn't need to send the "send qr message" packet, so the client is also less laggy
Now the update checker is more optimized
Now the alerts system is more optimized
The way the plugin checks if the server is bungeecord or not has been optimized
Fixed IP system (wasn't working as expected)
I noticed that when you try to reply a message (/r) LockLogin takes the command and process it, instead of letting the message plugin do its work. So I made some changes to code and the /r command will execute /reply if the player is logged and registered, in case of 2fa, he must be also verified with 2fa.
I also fixed the "Already registered message" wasn't showing, instead, the verify with 2fa was showing up.
I also made some improvements on the File generator on Spigot.
Unfortunately, the host where I was hosting the update and alerts message system, removed my account. I changed it again, I hope that's the last time I have to do it
Since I saw the plugin was starting generating bugs, I decided to check the whole code.
I fixed an bug in where the config was not regenerating sections correcty, and now, you can choose if the player chat will be cleared when he joins (
ClearChat)
NOTE: Since this update you will have to run (ll reload | locklogin reload) after modifying the config or messages files in spigot
Added insecure passwords, you can also add your unsafe passwords so your users accounts are more protected.
A list of default unsafe passwords is
here and you can't modify it.
This version adds simplified chinese translation and fixes a bug on bungeecord
(
MORE INFO ABOUT THE BUG )
It also adds the option to choose how many minutes the plugin will wait before an update check (min 5 minutes, max 60 minutes) and choose if the plugin will display the changelog
We decided to remove temporally the country block protection due it's giving multiple errors, country fetcher will keep working (player country and country protection will keep working)
This update finally ends with the translations job from English>Spanish, now you can choose if the plugin will be in English or Spanish, also, I removed a debug message (present only on Spigot listener while using bungeecord).
Fixes:
Fixed /change <password <password> was removing your account instead of changing the password
Added:
A console filter, now you won't be able to see player's passwords in console
Auto update checks every 5 minutes
I know the version checks were taking too long to fetch spigot version, so, now the version checkers doesn't fetch version from spigot plugin page, instead, it will be fetched from
an online file