Well, I guess its something i have to discuss with everyone in my individual games. I would like to do my same moves (in part because they were successful) and because even if they had gone wrong if this external event had not occured those would be my orders. I suppose it will be individual for each game, as the conflicting personalities will probably lead to people taking advantage of the situation. A review of the situation will be necessary, but the extent is not so bad for me as I only have 2 games going at the moment. I also would like to know what others think.

Kestas disabled the games to complete back ups. Im not sure what that exactly means, but its something he needs to do.

Finally it's done, let me know if you notice anything odd

kestasjk, and from now you think everything is ok? I must admit that I was working with the similar projects and the problem might be more sophisticated. Many users use their passwords for other things like emails, bank accounts, webservers. Your assurance that passwords are hashed means nothing because the other websites use the same hashing methods like MD5 etc. and can be simply got round. If I were you I'd rather improve the security somehow.

Thank you so much for all your hard work and persistence to do the job right Kestas :)! You are a prince among men, and your efforts for this site are priceless. I would also like to say that this was done very quickly (I was impressed with that) and that I'm glad things were done the right way so everything virtually went back to the way it was before, without even seeming to have changed other than the rolled-back order deadlines. In fact, this may even give those players who were desperately close to going into CD a chance to avoid NMR's and negotiate with other players.

All in all, kudos to you Kestas!

Well done Kestas. Thanks for fixing it.
The games have been reversed a few times now. I keep logging on and seeing the same notices that I have messages from other players. It's been like phpdiplomacy Groundhog Day.

Thank you kestas for the quick fix.

Kwasiu; I think so, there isn't really anywhere in the code that could have done it. There are only so many places that change the number of points players have, and none of them were exploitable, plus there was nothing odd in the logs

So that leaves him/her getting access via a different site I was hosting in the same user account, or through the server itself because of weak permissions. I think through the server because no files were changed, and the permissions allowed read access
Having written the code itself to filter user data carefully etc it feels like locking the doors but then leaving the window open :-(

Regarding md5 and passwords; first off no-one should use their bank passwords on any other site anyway, but there's no real way around md5 hashing. Precomputation attacks like rainbow tables are effective but using a salt means even that wouldn't help

But you're right about improving security in general, I've set better file permissions and restricted database user access, moved all separate sites and databases to separate accounts, and changed all the passwords

Kestasjk: Game ID7168 is a 12-hour game. It's been set back 2 movement turns + retreats because of the quick turns, I assume. I know you must be really busy, so I understand if you can't bring it forward, but if you could update it by a turn or two, that would be great.

Thanks for everything you do for this awesome site!!!

Great work Kestas. Takes me back to the days when rollbacks were fairly routine.

There are always issues with the games, but what can you do? I've got to re-do a successful stab. =/

Hopefully that won't happen again, though I'm sure everyone was temporarily amused with all their points.

Kestas... Thanks for getting this site restored.

Suggestion for the future to think about. IF you need to rollback games, it might make sense for every game rolled back to be put on hold to allow for the faster games to not get out of sync. Or maybe any game where the phase timeframe is < 16 hours.

Thanks again.
Krazick

Thank you Kestas, impressive you sorted it so quickly.

Well, I'm back to my humble four points - I'm a political puppet once again.

I agree with llama's thread about Leagues and the roll back, the only fair thing is to resubmit the same orders, hopefully the honor system works...

Darn it! It was like winning the lottery and suddenly someone takes it away. Well, unfortunately, everything is back to normal.

Thanks for all the good work, Kestas & team!

@diplomat... you still don't get it, do you?

Thanks from me, impressed by the way the problems have been turned around.

I thought Kestas Claus came to town, or phpdiplomacy got an congressional bailout.

Thanks Kestas & admins/Mods! I love the game and I love you guys (in a BROTHERLY way).

: D I'm happy now!

Any clue as to who did this? That is that it was DONE to us on purpose.
Were we specifically targeted or was it one of those auto attacks that seems to lurk in the Net attacking at random on some sicko's virus code.
It really ticks me off the humanity created such a pure thing as the Net and then turns around and creates viruses for it.
As we say in my family: "Mankind is a wonderful idea, the problem is that people stink."

To be fair, I think it was more of a warning. Anyone who has found a way to get database access has the chance to do far more damage than just change your points. They could, had they wanted, have done far more disruptive things.

Kestas - When you rolled everything back to the backup... did that include the forum? I swear there are some posts missing from a conversation I was in, but now I'm questioning my sanity and wondering if I just dreamed those responses and my response to them... (If that's the case I really gotta spend some more time away from the forums!).

Edi; I doubt it, because as fig says someone who knew about this site would probably have abused such power in a different way

DrOct; yup I wanted to move everything back to a clean version; no "you won" messages from games that were rolled back to before the game had ended etc. If I had known that backup was 20 hours old and not 9 hours, and would take so long, I might have tried other ways of undoing the damage

In the next version I'll be trying to add an hour-by-hour incremental backup system so we can backup much more frequently and restore much more quickly, but I think the stable door has been securely bolted now that the horse has fled

Ok, then I'm probably not going crazy! Glad to hear that!

Obviously it would have been nice if this could have been dealt with more easily and less obtrusively, but then again obviously it would have been even better if the problem had never cropped up at all!

(Also please don't read that as me complaining that you lost forum posts in the restore from the back up, I'm really not, I just wanted to be sure I wasn't going crazy. Plus you/we now know of some vulnerabilities/problems that can now be dealt with and will help in other situations in the future! So it's not all bad!)