Index: index.php
===================================================================
--- index.php	(revision 20181)
+++ index.php	(working copy)
@@ -129,7 +129,8 @@
     //   name:port or name
     // NOTE: We won't use 'nameport' internally. We'll split apart the host/ip
     // and the port here, so we don't have to process it in multiple locations
-    if (isset($_REQUEST['nameport']) && ($input['action'] == 'ADD' || $input['action'] == 'REMOVE'))
+    if (isset($_REQUEST['nameport']) &&
+        ($input['action'] == 'ADD' || $input['action'] == 'REMOVE'))
     {
       $input['nameport'] = smart_strip_slashes($_REQUEST['nameport']);
       
@@ -162,7 +163,8 @@
     // version (ADD, LIST) - Protocol string, specified to filter which
     //   servers are shown in a LIST, in the form BZFSxxxx, where xxxx is a
     //   number; 2.0.x uses BZFS0026, for example
-    if (isset($_REQUEST['version']) && ($input['action'] == 'ADD' || $input['action'] == 'LIST'))
+    if (isset($_REQUEST['version']) &&
+        ($input['action'] == 'ADD' || $input['action'] == 'LIST'))
       $input['version'] = smart_strip_slashes($_REQUEST['version']);
     
     // gameinfo (ADD) - Hex string that defines server configuration and
@@ -177,30 +179,44 @@
     // checktokens (ADD, CHECKTOKENS) - Contains tokens that will be verified;
     //   These will be in the form username0=token or username0@ipaddress=token,
     //   and multiple instances of these can be seperated by \n
-    if (isset($_REQUEST['checktokens']) && ($input['action'] == 'ADD' || $input['action'] == 'CHECKTOKENS'))
+    if (isset($_REQUEST['checktokens']) &&
+        ($input['action'] == 'ADD' || $input['action'] == 'CHECKTOKENS'))
       $input['checktokens'] = smart_strip_slashes($_REQUEST['checktokens']);
     
     // groups (ADD, CHECKTOKENS) - List of groups to check for membership
-    if (isset($_REQUEST['groups']) && ($input['action'] == 'ADD' || $input['action'] == 'CHECKTOKENS'))
+    if (isset($_REQUEST['groups']) &&
+        ($input['action'] == 'ADD' || $input['action'] == 'CHECKTOKENS'))
       $input['groups'] = smart_strip_slashes($_REQUEST['groups']);
     
     // callsign (LIST, GETTOKEN) - Callsign of player
     // DEPRECATED: in favor of 'username'
-    if (isset($_REQUEST['callsign']) && ($input['action'] == 'LIST' || $input['action'] == 'GETTOKEN'))
+    if (isset($_REQUEST['callsign']) &&
+        ($input['action'] == 'LIST' || $input['action'] == 'GETTOKEN'))
       // Store it as username
       $input['username'] = smart_strip_slashes($_REQUEST['callsign']);
       
     // username (LIST, GETTOKEN, REGISTER, CONFIRM) - Username of player
-    if (isset($_REQUEST['username']) && ($input['action'] == 'LIST' || $input['action'] == 'GETTOKEN' || $input['action'] == 'REGISTER' || $input['action'] == 'CONFIRM'))
+    if (isset($_REQUEST['username']) &&
+        ($input['action'] == 'LIST'     ||
+         $input['action'] == 'GETTOKEN' ||
+         $input['action'] == 'REGISTER' ||
+         $input['action'] == 'CONFIRM'  ||
+         (($input['action'] == 'ADD') && ($input['version'] != 'BZFS0026')))) {
       $input['username'] = smart_strip_slashes($_REQUEST['username']);
+    }
     
     // email (REGISTER) - Email for registration
     if (isset($_REQUEST['email']) && ($input['action'] == 'REGISTER'))
       $input['email'] = smart_strip_slashes($_REQUEST['email']);
     
     // password (LIST, GETTOKEN, REGISTER) - User's password
-    if (isset($_REQUEST['password']) && ($input['action'] == 'LIST' || $input['action'] == 'GETTOKEN' || $input['action'] == 'REGISTER'))
+    if (isset($_REQUEST['password']) &&
+        ($input['action'] == 'LIST'     ||
+         $input['action'] == 'GETTOKEN' ||
+         $input['action'] == 'REGISTER' ||
+         (($input['action'] == 'ADD') && ($input['version'] != 'BZFS0026')))) {
       $input['password'] = smart_strip_slashes($_REQUEST['password']);
+    }
     
     // advertgroups (ADD) - Specific groups to advertise the server to
     if (isset($_REQUEST['advertgroups']) && ($input['action'] == 'ADD'))
@@ -231,6 +247,27 @@
     // We need to have a protocol version. If we do not, abort.
     if (!valid_version($input['version']))
       die("ERROR: Invalid version specified. Must begin with 'BZFS' and be followed by a four digit, zero-padded number (e.g. BZFS0026)\n");
+
+    // Load the DataLayer 
+    @include_once('includes/datalayer.class.php');
+    // Make sure the DataLayer class loaded sucessfully
+    if (!class_exists('DataLayer')) die("ERROR: Unable to load DataLayer class.\n");
+    $dl = new DataLayer($config['datalayer']);
+    if ($dl === false) die("ERROR: Unable to connect to database.\n");
+
+    // check the username / password for newer servers (not 2.0.x)
+    if ($input['version'] != 'BZFS0026') {
+      if (!isset($input['username']) || !isset($input['password'])) {
+        die("ERROR: missing required -publicuser fields.");
+      }
+      // Pull the player's information from the database
+      $playerData = $dl->Player_Fetch_ByUsername($input['username']);
+      // Verify that the user exists and that their password is correct
+      if (!$playerData || md5($input['password']) != $playerData['password']) {
+        // If not, they can't register. Inform the server.
+        die("ERROR: invalid username / password.\n");
+      }
+    }
       
     // We need to have the game info. If we do not, abort.
     if (!isset($input['gameinfo']) || empty($input['gameinfo']))
@@ -307,13 +344,6 @@
     // Now that we have the IP address, see if this server is already in our
     // database.  If so, just update, otherwise, insert a new record
     
-    // Load the DataLayer 
-    @include_once('includes/datalayer.class.php');
-    // Make sure the DataLayer class loaded sucessfully
-    if (!class_exists('DataLayer')) die("ERROR: Unable to load DataLayer class.\n");
-    $dl = new DataLayer($config['datalayer']);
-    if ($dl === false) die("ERROR: Unable to connect to database.\n");
-    
     // Server already exists, update it
     if ($dl->Server_Exists_ByIPAddressPort($values) !== false)
     {
