protecting players from account theft

Elytrium · Jan 2, 2024 · 6939798 · 6939798
1 parent 0f96a38
commit 6939798
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/src/main/java/net/elytrium/limboauth/socialaddon/Settings.java b/src/main/java/net/elytrium/limboauth/socialaddon/Settings.java
@@ -217,6 +217,7 @@ public static class STRINGS {
       public String LINK_CMD_USAGE = "{PRFX} Send '!account link {NICKNAME}' to our Social Bot{NL} VK: vk.com/123{NL} DS: Bot#0000{NL} TG: @bot";
       @Placeholders({"{NICKNAME}"})
       public String LINK_WRONG_CODE = "{PRFX} Wrong code, run '!account link {NICKNAME}' again";
+      public String LINK_CONFIRM = "{PRFX} Type the command again to confirm the account linking. DO NOT TYPE IF ANOTHER PLAYER HAS SENT YOU THIS COMMAND.";
       public String LINK_SUCCESS_GAME = "{PRFX} Social was successfully linked";
       public String LINK_SUCCESS = "✅ Social was successfully linked{NL}Use '!keyboard' to show keyboard";
       public String LINK_ALREADY = "Account is already linked";

diff --git a/src/main/java/net/elytrium/limboauth/socialaddon/command/ValidateLinkCommand.java b/src/main/java/net/elytrium/limboauth/socialaddon/command/ValidateLinkCommand.java
@@ -17,12 +17,16 @@
 
 package net.elytrium.limboauth.socialaddon.command;
 
+import com.google.common.cache.Cache;
+import com.google.common.cache.CacheBuilder;
 import com.velocitypowered.api.command.CommandSource;
 import com.velocitypowered.api.command.SimpleCommand;
 import com.velocitypowered.api.proxy.Player;
 import java.sql.SQLException;
 import java.util.List;
 import java.util.Locale;
+import java.util.concurrent.TimeUnit;
+
 import net.elytrium.commons.config.Placeholders;
 import net.elytrium.limboauth.socialaddon.Addon;
 import net.elytrium.limboauth.socialaddon.Settings;
@@ -31,6 +35,8 @@ public class ValidateLinkCommand implements SimpleCommand {
 
   private final Addon addon;
 
+  private final Cache<String, Boolean> confirmLinking = CacheBuilder.newBuilder().expireAfterWrite(15, TimeUnit.SECONDS).build();
+
   public ValidateLinkCommand(Addon addon) {
     this.addon = addon;
   }
@@ -51,6 +57,12 @@ public void execute(Invocation invocation) {
           Integer validCode = this.addon.getCode(username);
           if (validCode != null) {
             if (validCode == Integer.parseInt(args[0])) {
+              if (confirmLinking.getIfPresent(username) == null) {
+                confirmLinking.put(username, true);
+                source.sendMessage(Addon.getSerializer().deserialize(Placeholders.replace(Settings.IMP.MAIN.STRINGS.LINK_CONFIRM)));
+                return;
+              }
+              confirmLinking.invalidate(username);
               Addon.TempAccount tempAccount = this.addon.getTempAccount(username);
               this.addon.linkSocial(username, tempAccount.getDbField(), tempAccount.getId());
               this.addon.getSocialManager().registerHook(tempAccount.getDbField(), tempAccount.getId());