Blackdoor · published
connect() bypassed authentication - calling connect(ip, port) without credentials gave full filesystem access: list_files, read_file, download, write_file, delete_file, scrub_log, and decrypt all worked without cracking a user first. This was unintended. All filesystem API functions now require an authenticated session. Thanks second_hand
crack() didn't authenticate after success - cracking a user stored the credentials but didn't log you in. Previously you had to reconnect as user@host to actually authenticate. crack() now logs you in immediately on success, which is what the docs implied it did.
connect() now accepts SSH key auth - pass an id_rsa path as the third argument to authenticate via key file: connect("user@host", 22, "~/.ssh/id_rsa"). The third argument can be a key path or a plain password.
boards name could be set without confirmation - the handle is permanent and appears on leaderboards, in live chat, and on the boards site. It now prompts for confirmation (y/n) before committing. Existing handles are unaffected.
Player profile showed own data after a 404 - browsing to a handle that didn't exist on boards.blackdoor.tools briefly showed your own profile instead of the not-found message. Fixed.
#lounge: blocked messages gave no feedback - messages caught by the Steam content filter, or rejected for being banned or muted, silently failed. Specific inline errors now appear for each case.
Founding badge required boards handle to be set - the launch-week «FOUNDING» badge is awarded on first game launch, not on first boards interaction. Players who launch during the window get it regardless of whether they've set a handle yet.
Note: if you have scripts that call list_files(), read_file(), download(), or other filesystem functions without cracking first, they will now fail with an auth error. Add a crack() loop before your first filesystem call. Since crack() now authenticates on success, the fix is minimal - one loop, no reconnect needed.
- Static