From 3228583df7ebef202ea79e1a1bdca683303f63b9 Mon Sep 17 00:00:00 2001
From: GGGuenni <leonard@eynck.de>
Date: Thu, 2 Mar 2023 15:16:50 +0100
Subject: [PATCH] Fixed setPassword body is compressed

+ Updated server to also use the correct Basic implementation
---
 .../storage/UncivServerFileStorage.kt         |  3 +-
 .../src/com/unciv/app/server/UncivServer.kt   | 32 ++++++++++++-------
 2 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/core/src/com/unciv/logic/multiplayer/storage/UncivServerFileStorage.kt b/core/src/com/unciv/logic/multiplayer/storage/UncivServerFileStorage.kt
index 30c90ee524d42..f823fd0d6de0f 100644
--- a/core/src/com/unciv/logic/multiplayer/storage/UncivServerFileStorage.kt
+++ b/core/src/com/unciv/logic/multiplayer/storage/UncivServerFileStorage.kt
@@ -2,7 +2,6 @@ package com.unciv.logic.multiplayer.storage
 
 import com.badlogic.gdx.Net
 import com.badlogic.gdx.utils.Base64Coder
-import com.unciv.ui.screens.savescreens.Gzip
 import com.unciv.utils.debug
 import kotlin.Exception
 
@@ -82,7 +81,7 @@ object UncivServerFileStorage : FileStorage {
             return false
 
         var setSuccessful = false
-        SimpleHttp.sendRequest(Net.HttpMethods.PUT, "$serverUrl/auth", content=Gzip.zip(newPassword), timeout=timeout, header=authHeader) {
+        SimpleHttp.sendRequest(Net.HttpMethods.PUT, "$serverUrl/auth", content=newPassword, timeout=timeout, header=authHeader) {
                 success, result, code ->
             if (!success) {
                 debug("Error from UncivServer during password set: %s", result)
diff --git a/server/src/com/unciv/app/server/UncivServer.kt b/server/src/com/unciv/app/server/UncivServer.kt
index 7d4ef34b6bb40..0101977a69a24 100644
--- a/server/src/com/unciv/app/server/UncivServer.kt
+++ b/server/src/com/unciv/app/server/UncivServer.kt
@@ -18,6 +18,7 @@ import io.ktor.utils.io.jvm.javaio.*
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import java.io.File
+import java.util.*
 import java.util.concurrent.TimeUnit
 
 
@@ -74,15 +75,11 @@ private class UncivServerRunner : CliktCommand() {
      * or the password is correct
      */
     private fun validateGameAccess(file: File, authString: String?): Boolean {
-        if (!authV1Enabled || !file.exists())
+        if (!file.exists())
             return true
 
-        // If auth is enabled, an auth string is required
-        if (authString == null || !authString.startsWith("Basic "))
-            return false
-
         // Extract the user id and password from the auth string
-        val (userId, password) = authString.drop(6).split(":")
+        val (userId, password) = extractAuth(authString) ?: return false
 
         if (authMap[userId] == null || authMap[userId] == password)
             return true
@@ -95,15 +92,28 @@ private class UncivServerRunner : CliktCommand() {
     private fun validateAuth(authString: String?): Boolean {
         if (!authV1Enabled)
             return true
-        // If auth is enabled a auth string is required
-        if (authString == null || !authString.startsWith("Basic "))
-            return false
 
-        val (userId, password) = authString.drop(6).split(":")
+        val (userId, password) = extractAuth(authString) ?: return false
         if (authMap[userId] == null || authMap[userId] == password)
             return true
         return false
     }
+
+    private fun extractAuth(authString: String?): Pair<String, String>? {
+        if (!authV1Enabled)
+            return null
+
+        // If auth is enabled a auth string is required
+        if (authString == null || !authString.startsWith("Basic "))
+            return null
+
+        val decodedString = String(Base64.getDecoder().decode(authString.drop(6)))
+        val splitAuthString = decodedString.split(":", limit=2)
+        if (splitAuthString.size != 2)
+            return null
+
+        return splitAuthString.let { it[0] to it[1] }
+    }
     // endregion Auth
 
     private fun serverRun(serverPort: Int, fileFolderName: String) {
@@ -159,7 +169,7 @@ private class UncivServerRunner : CliktCommand() {
                         log.info("Received auth password set from ${call.request.local.remoteHost}")
                         val authHeader = call.request.headers["Authorization"]
                         if (validateAuth(authHeader)) {
-                            val userId = authHeader?.drop(6)?.split(":")?.get(0)
+                            val (userId, _) = extractAuth(authHeader) ?: Pair(null, null)
                             if (userId != null) {
                                 authMap[userId] = call.receiveText()
                                 call.respond(HttpStatusCode.OK)