Subj : webv4 telnet window
To   : DesotoFireflite
From : echicken
Date : Thu Mar 03 2022 04:52:47

  Re: webv4 telnet window
  By: DesotoFireflite to echicken on Wed Mar 02 2022 17:26:42

 De> No, I missunderstood you, but I just logged in from syncterm using Rlogin,
 De> with the correct name, but wrong password, and it let me in. I'm assuming

 De> it just made a new account in gameserver, as there are 3 for me in there
 De> now. The logs didn't show anything, but here is the log where I just

Okay, I think I understand. Gamesrv doesn't require unique usernames. If you supply the username and password of an existing account, you get logged in as that user. If the username + password that you provide don't match an existing account, a new one is created.

Seems like authentication failure is basically impossible, barring any rules surrounding username/password validity (bad characters, too long, too short, etc.)

 ec>> ,user.alias // client-name
 ec> ,user.security.password // server-name

 De> It would not allow me in with these, but you do have it correct, as I
 De> changed the lines around, and it passed the wrong info to the other games.

This pretty much rules out an authentication problem. 

 De> correct, it just fails, but doesn't kick you out of the website, you can
 De> choose another game and play it. 

I just tried it and saw different behaviour - after a bit of output from Synchronet's rlogin server, fTelnet got disconnected and the page refreshed.
I think that's as it should be. Maybe it's different for the sysop.

I'm stumped for now. I'll ponder it a bit and let you know if I come up with anything. Workarounds are possible, but really shouldn't be necessary.
  
---  
echicken   
electronic chicken bbs - bbs.electronicchicken.com
---
 þ Synchronet þ electronic chicken bbs - bbs.electronicchicken.com
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.