-
Posts
-
Update: Advanced Rate Limiting Rate limiting is now applied to: Login attempts Account registration Password recovery Email confirmation resends WhatsApp verification Checkout access The system maintains independent counters by IP address and user identity, helping prevent traditional brute-force attacks as well as distributed credential-stuffing attempts using multiple proxies. Brute-Force and Credential-Stuffing Protection Protection is not limited to the visitor's IP address. The system also tracks attempts associated with the account, username, or email address, reducing the effectiveness of attacks performed through rotating IP addresses, proxies, or VPN services. Global HTTP Security Headers Security headers are applied across the entire website: X-Frame-Options X-Content-Type-Options Referrer-Policy HTTP Strict Transport Security These headers help protect the website against clickjacking, MIME-type confusion, insecure referrer exposure, and HTTP downgrade attempts. Secure Error Handling Internal exceptions are recorded in protected security logs while visitors receive sanitized error messages. This prevents the accidental exposure of: Internal file paths Database information SQL errors Server configuration Application stack traces Private Storage Exposure Monitoring The system automatically checks whether the private storage directory is publicly accessible in production. If exposure is detected, a security warning is recorded for the administrator without interrupting the website. This directory may contain licensing information, rate-limit records, and security logs and must never be publicly accessible. OAuth Request Protection Google and Facebook authentication flows use cryptographically random state values stored in the user's session. Returned state values are validated using constant-time comparison, helping prevent OAuth request forgery and unauthorized account-linking attacks. Telegram Authentication Validation Telegram login information is protected through: HMAC signature validation Constant-time hash comparison Authentication timestamp verification Expired-login rejection Secure Verification Tokens Email, password recovery, and WhatsApp verification systems include: Cryptographically secure random tokens Hashed WhatsApp verification codes Automatic expiration Limited verification attempts Resend cooldowns One-time token invalidation Account Activation Protection When email or WhatsApp verification is required, the game account remains restricted until all required verification steps are completed. Unverified users cannot bypass the confirmation process through standard or social login. Secure Upload Processing Administrative image uploads include: Real MIME-type inspection Image-content validation File-size limits Extension allowlists Server-generated random filenames Rejection of invalid or disguised files Original user-provided filenames are never used as the final stored filename. Path Traversal Protection Theme and template identifiers are restricted to validated slugs and must exist in the internal list of allowed themes. This prevents directory traversal and unauthorized local-file access through manipulated template names. Atomic Ticket Transfer Protection Ticket transfers use transactional and durable delivery processing. The balance is conditionally debited, the delivery is recorded before communication with the game database, and failed deliveries remain pending for safe reprocessing. This helps prevent: Free-item delivery Inconsistent balances Duplicate delivery Partial transaction failures Lost transfer records Concurrent Balance Protection Administrative balance adjustments use database transactions and row-level locking. This prevents simultaneous balance operations from overwriting each other or creating inconsistent account balances. Secure Redirect Handling Redirect values are sanitized against header injection, and external redirects are restricted to HTTPS destinations. Password Security Improvements The website uses modern password hashing for player-panel accounts and bcrypt with a configurable cost for supported game-server account systems. Compatibility is included for game-server implementations requiring the $2a$ bcrypt prefix. Duplicate Payment Prevention Built-in protections include: Idempotency control Transaction reference validation Payment status verification Unique external payment references Database transactions and rollback Durable payment history Completed-order verification These protections prevent: Double credits Repeated processing Duplicate payment callbacks Incomplete financial operations Signed Payment Callback Protection Payment callbacks are protected through: HMAC-SHA256 authentication Constant-time signature comparison Signed callback timestamps Callback freshness validation Shared callback secrets This helps prevent forged payment notifications, callback manipulation, and replay attacks. SQL Injection Protection The database layer uses: PDO Prepared statements Parameter binding Controlled internal allowlists for dynamic identifiers User-controlled values are not directly concatenated into SQL queries. XSS Protection Output and form data are protected through: HTML escaping Attribute escaping Input filtering HttpOnly session cookies MIME-sniffing protection Frame embedding restrictions These measures reduce the risk of Cross-Site Scripting, malicious HTML injection, session theft, and clickjacking. CSRF Protection Sensitive forms and administrative operations use session-based CSRF tokens. Requests without a valid token are rejected, helping prevent unauthorized actions performed through malicious external websites. Secure Session Protection The session system includes: HttpOnly cookies Secure cookie support SameSite restrictions Session ID regeneration Authentication state validation Session timeout controls These protections reduce the risks of session fixation, session theft, and unauthorized account reuse. reCAPTCHA Protection Google reCAPTCHA may be enabled on sensitive public forms to reduce: Automated account registrations Spam submissions Bot login attempts Automated password recovery abuse Confirmation Resend Limits Email and WhatsApp confirmation resends are protected through: Cooldown periods Rate limiting Expiring verification codes Attempt counters This prevents verification-message flooding and excessive external API usage. Licensing and Anti-Cloning Protection The website includes centralized licensing controls with: License-key validation Domain binding Signed license responses Cached license validation Temporary offline grace period Circuit-breaker protection Unauthorized-domain rejection These measures help prevent unauthorized installation, cloning, and redistribution of the system. -
Tool that allows you to download the Lineage 2 game client directly from the official publisher CDNs. It fetches the CDN's file list and downloads every patch file, decompresses it (LZMA / Zip) and writes the finished client to disk — and can resume or repair an existing installation instead of starting over. It runs several client downloads at once through a batch queue, so you can prepare multiple regions or versions in a single session. Supported: NCSoft CDNs (TW / KR / JP / NA) and 4game CDNs(RU / EU) Download: https://drive.google.com/file/d/11SDcNASqO2GKOBT79LFu7mqvSRSJZvBS -
-
https://l2avokado.com/ Hello everyone, After some time of development, we've decided to open L2Avokado to the public in its current development stage. We're looking for players who enjoy Interlude and would like to help shape the project before its official release. This isn't a "launch" announcement. Instead, we're inviting the community to log in, explore the server, test the systems we've built, and provide honest feedback. Whether it's bug reports, balance suggestions, progression ideas, or quality-of-life improvements, we'd love to hear them. Our goal has always been to create an Interlude server that feels familiar while offering a fresh progression experience. We've intentionally avoided custom weapons, armor, and client modifications. Instead, we've focused on redesigning progression through reworked hunting grounds, quests, crafting, and gameplay systems while remaining compatible with a clean Interlude client. At this stage, the core progression path has been implemented, including the main hunting grounds, quests, custom systems, and events. However, as the project is still under active development, there will inevitably be bugs, balance issues, and areas that require further polishing. This is exactly why we'd like your help. We're looking for players who are willing to: Test gameplay and progression. Report bugs and exploits. Suggest balance improvements. Share ideas for new features or quality-of-life changes. Help us build a server that the community genuinely enjoys playing. The Client and System downloads are already available on our website, so you can jump straight into the game. We're also working on a dedicated launcher that will simplify installation and future updates. If you're interested in helping develop a unique Interlude project and want your feedback to genuinely influence the direction of the server, we'd love to have you with us. We look forward to seeing you in-game and hearing your thoughts on Discord. https://l2avokado.com/ -
-
-
Topics
-
Recommended Posts