MCCodes - Chapter 9: Security Functions

MCCodes Walkthrough Tutorial

Welcome to Chapter 9! In Chapter 8: Staff Panel & Permissions, we explored how game administrators manage the game using special tools and how access is controlled. Running a game isn't just about managing content and users; it's also crucially about keeping things secure. How do we protect user accounts from being misused? How do we handle sensitive information like passwords? How do we stop automated bots from abusing the system?

This chapter covers the essential Security Functions in MCCodes, focusing on protecting forms, handling passwords safely, and validating user input. Think of these functions as the game's security guards, ID checkers, and form inspectors.

The Problem: Keeping Things Safe and Sound

Imagine you're logged into your bank website in one browser tab. Then, you visit a malicious website in another tab. Could that malicious site somehow trick your browser into sending a request to your bank, like "transfer $1000 to BadGuy", without you realizing it? This is a real type of attack called Cross-Site Request Forgery (CSRF).

Also, how should the game store your password? If it's stored as plain text, anyone who gets access to the database can see it! Even if it's scrambled slightly, hackers have ways to crack common passwords.

And what about automated bots? If they can create thousands of accounts automatically or submit forms repeatedly, they can ruin the game for everyone.

We need mechanisms to:

  1. Prevent CSRF: Make sure form submissions are intentional and initiated by the user on the game's site.
  2. Handle Passwords Securely: Store passwords in a way that even if the database is compromised, the actual passwords are very hard to recover.
  3. Validate Input & Stop Bots: Ensure data entered by users is valid (like email addresses) and block automated scripts from interacting with the game.

The Solution: A Toolkit of Security Guards

MCCodes provides several functions and scripts, mostly found in global_func.php and related files, to address these security concerns:

Let's look at each area.

1. CSRF Protection: Foiling the Tricksters

The Problem: How to stop malicious websites from forcing your browser to submit forms on MCCodes without your consent?

The Analogy: Imagine every time you want to perform an important action (like changing your password or donating to a gang), the game gives you a unique, secret handshake code valid only for that specific request. An external attacker won't know the secret handshake for your current session.

The Solution: MCCodes uses CSRF tokens.

How it Helps: An external attacker trying to force your browser to submit the form won't know the secret token stored in your session. When the forged request arrives without the correct token (or with an expired/invalid one), verify_csrf_code returns false, and the script stops processing, preventing the unwanted action. You'll see this check at the beginning of many form processing scripts like authenticate.php, register.php (after username check), preferences.php actions, macro2.php, yourgang.php actions, etc.

2. Password Security: Salting and Hashing

The Problem: How to store passwords so they are secure even if the database is exposed?

The Analogy: Instead of writing your password "secret123" on a note, you: 1. Add a unique random string (your "salt", like "aB3d") to it: "aB3dsecret123". 2. Put the combined string through a one-way scrambler (a "hash function", like MD5 in this case) that turns it into gibberish (e.g., "f4a8..."). Storing the salt ("aB3d") and the gibberish ("f4a8...") is much safer. Even if someone steals the note, they can't easily figure out the original password. They'd have to try scrambling every possible password with your specific salt to find a match.

The Solution: MCCodes uses salting and hashing via functions in global_func.php.

Usage Examples:

Important Note: While salting and hashing significantly improve security over plain text or simple hashing, the MD5 algorithm used in MCCodes is considered outdated and insecure by modern standards. Modern systems use much stronger hashing algorithms like bcrypt or Argon2. If you were building a new system, you would not use MD5 for passwords. However, this is how MCCodes implements it.

3. Input Validation & Anti-Bot Measures

The Problem: How to ensure user input is reasonable (e.g., a valid email format, username not taken) and how to stop automated bots from registering or performing actions?

The Analogy: * Validation: Like a form inspector checking if you filled out all required fields correctly and if your chosen username isn't already painted on someone else's mailbox. * Anti-Bot: Like a doorman asking you to read a wavy line of text that only humans can easily decipher, to prove you're not a robot.

The Solution: MCCodes uses AJAX checks for instant feedback and CAPTCHA challenges.

These validation and anti-bot measures help maintain data integrity and prevent automated abuse.

Under the Hood: How CSRF Protection Works

Let's visualize the CSRF token flow when you change your password.

sequenceDiagram
    participant B as Browser
    participant PF as preferences.php (Form Display)
    participant PP as preferences.php (Processing)
    participant Func as global_func.php
    participant Sess as PHP Session

    B->>PF: Request preferences.php?action=passchange
    PF->>Func: request_csrf_code('prefs_passchange')
    Func->>Func: Generate unique token (e.g., 'abc123')
    Func->>Sess: Store token: $_SESSION['csrf_prefs_passchange'] = {token: 'abc123', issued: time()}
    Func-->>PF: Return token 'abc123'
    PF-->>B: Send HTML form with 

    B->>PP: Submit form (action=passchange2, POST includes verf='abc123')
    PP->>Func: verify_csrf_code('prefs_passchange', 'abc123')
    Func->>Sess: Get stored token for 'prefs_passchange' ({token: 'abc123', ...})
    Func->>Func: Compare 'abc123' (submitted) == 'abc123' (stored)? (Yes)
    Func->>Func: Check expiry time (Assume OK)
    Func->>Sess: Unset $_SESSION['csrf_prefs_passchange']
    Func-->>PP: Return true
    PP->>PP: Proceed with password change logic...
    PP-->>B: Display "Password changed!" message

This shows how the token is generated, stored in the session, placed in the form, sent back, and verified against the session value before the action is allowed.

Key Files and Functions

Conclusion

You've now learned about the essential security functions built into MCCodes! These are vital for protecting the game and its players. We covered:

These functions work together to create a more secure environment for players. Security often relies heavily on correct and safe interactions with the database. Let's explore how MCCodes handles that next.

Next Up: Chapter 10: Database Interaction

Previously: Chapter 8: Staff Panel & Permissions

First published April 21, 2025

Tags: MCCodes Walkthrough Tutorial