ВЕРСИИ (14)

## xLogin v1.0.9-Pre — Security & MySQL Hotfix ### 🆕 New Features - **`/xlogin migratedb`** — Migrate all player data from H2 to MySQL without losing accounts or passwords. - **Full MySQL compatibility** — `savePlayerData` now uses `INSERT ... ON DUPLICATE KEY UPDATE` for MySQL. ### 🔒 Security Fixes - **Critical impersonation fix**: Cracked clients (TLauncher) could join with a premium username if that player wasn't in the DB yet. Proxy now falls back to Mojang API as a second check. - **`/premium` UUID transition fix**: Searches by username as fallback and auto-updates the UUID in the database. ### 🐛 Bug Fixes - **`AdminCommand` hardcoded H2 removed**: All subcommands now route through `DatabaseManager`. - **Mojang API `User-Agent`**: Added to all requests across Paper, Velocity and BungeeCord to prevent `403` errors. - **`/premium confirm` feedback**: Shows "Verifying with Mojang..." and proper error if not registered.

## xLogin v1.0.8-R (Release) This release focuses on database stability and full network synchronization for large multi-server setups. ### ✨ New Features * **MySQL Support in Backend**: We added a new `database.yml` configuration file for the Spigot/Paper backend. You can now choose between `h2` (local file) and `mysql` (external database). * **Full Network Sync**: By connecting both your Proxy (Velocity/Bungee) and your backend servers to the same MySQL database, premium status and player data are now synced flawlessly across the entire network in real-time. ### 🐛 Bug Fixes & Adjustments * **Fixed H2 Database Conflicts**: Re-engineered the local H2 database connection engine. xLogin now safely isolates its connection, meaning it will no longer crash or lock files (`OverlappingFileLockException`) if you run other plugins that also use shaded H2 drivers. * **Streamlined Multi-Server Setup**: If you run a proxy, the backend `/premium` command now correctly tells the Proxy immediately because they share the exact same database. * Config comments and system logs for the Proxy module have been updated to reflect the new release. ### 🔧 Installation Notes If you are running a BungeeCord/Velocity network with multiple backend servers, we highly recommend switching `type: "h2"` to `type: "mysql"` in your backend's new `database.yml` to take full advantage of this update!

``` Small mistake. Fixed. ```

# 🌟 xLogin v1.0.8-Pre — Universal Authentication System A powerful, all-in-one authentication solution designed for high-performance networks and standalone servers. This update brings full cross-platform compatibility, database-free proxy setups, and critical security fixes. --- ## ✨ Main Features * **Universal Compatibility:** A single `.jar` file works simultaneously across **Paper/Spigot**, **Velocity**, **BungeeCord**, and **Waterfall**. * **Database-Free Proxy Mode:** The proxy module (Velocity/Bungee) can now operate completely **without a MySQL database**. If no database is configured, it automatically falls back to the official Mojang API to detect premium accounts. * **Session Caching:** Players switching between backend servers within the same network won't need to re-authenticate during the configured session lifetime. * **Strict Pre-Auth Restrictions:** Unauthenticated players are completely restricted from moving, moving their camera, chatting, opening inventories, or executing unauthorized commands. * **Login Timeout:** Automatically kicks players who fail to log in within a customizable time limit. * **Message Anti-Spam:** Configurable intervals for login/register reminder messages to keep the player chat clean. * **Dynamic Command Hiding:** Safely hides `/login`, `/register`, and `/captcha` from the tab-complete suggestions immediately after a player authenticates (can be toggled on/off). --- ## 🔧 Security & Fixes * **Premium Registration Fix:** Solved issues regarding `auto-premium-registration`. When disabled, premium players without an existing account must register manually as intended. * **Automatic Message Fallback:** Older `.yml` configuration files will no longer trigger `Missing:` translation strings. The plugin now automatically reads missing keys from the default language files inside the `.jar`. * **Smarter Proxy Communication:** When running in proxy mode, backend Paper servers will no longer query the Mojang API, optimizing performance by trusting the Proxy's UUID generation ($v4$ for premium, $v3$ for offline accounts). --- ## 💻 New Commands & Permissions ### 👥 Player Commands * `/premium` — Safely toggles premium mode (Available on proxy networks). * `/changepassword <old> <new>` — Allows players to change their current password. * `/unregister <password>` — Unregisters the player's own account. ### 🛡️ Admin Commands (`/xlogin`) * `/xlogin delacc <player>` — Permanently deletes a player's account. * `/xlogin forcelogin <player>` — Forces a player into an authenticated state. * `/xlogin blockip <ip>` — Blocks a specific IP address. * `/xlogin unblockip <ip>` — Unblocks a specific IP address.

> We have patched minor bugs and ensured that users are no longer prompted to log in when returning to the hub from other game modes.

# 🚀 xLogin v1.0.7 - The Ultimate Optimization & Bedrock Update This update focuses on making **xLogin** incredibly smart, lightweight, and 100% dynamic. We rewrote the core security system, perfected Bedrock support, and made sure you never have to restart your server to apply config changes again! ## 📱 Flawless Bedrock Support (Geyser/Floodgate) * **Triple-Layer Detection:** The Bedrock auto-login system has been completely rewritten. It now uses a mathematical UUID version 0 check combined with the Floodgate API, ensuring Bedrock players bypass the login screen instantly and securely. * **Dynamic Toggle:** The `geyser-support.auto-login-bedrock` option is now checked in real-time. You can enable or disable Bedrock auto-login on the fly without restarting! ## 🛡️ Unified & Dynamic Security System * **Master Protection Check:** We removed redundant code and created a centralized `isProtected()` method. Performance is better than ever! * **Ultimate Interaction Blocker:** Unregistered players are now strictly prevented from opening physical menus (chests, crafting tables) or using items in their hands (like lobby compasses/clocks). * **Toggleable Blindness:** The blindness effect upon joining is now fully customizable. You can turn it on or off dynamically via `protection.effects.blindness` in the `config.yml`. * **Dynamic Captcha:** The Captcha system now correctly reads the `captcha.enabled` option from your config in real-time. ## 🌐 Smart Proxy & Network Handling * **Real-Time Proxy Detection:** The plugin no longer locks the proxy state on startup. You can now toggle `proxy-mode: true/false` in your config, use `/xlogin reload`, and the `/premium` command will instantly enable or disable itself! * **Smart IP Tracking:** Removed the strict "Kick on different IP" feature that punished players with dynamic internet providers. Now, if a player's IP changes, they just need to enter their password normally, and the plugin will silently update their new IP in the database. ## ⚙️ Administration & Quality of Life * **Auto-Spawn Teleport:** Players are now automatically teleported to the designated login spawn (`/xlogin setspawn`) the exact millisecond they join the server, preventing them from falling into the void or glitching out. * **Fixed `/xlogin reload`:** The reload command now properly reloads *both* your `config.yml` and your language file (`messages_es.yml` / `messages_en.yml`) at the same time. * **Fixed Account Deletion:** Fixed an SQL parameter error when admins used `/xlogin unregister <player>`. * **Player Self-Unregister:** Added the `/unregister` command so regular non-premium players can delete their own accounts using their password. --- **⚠️ Note for Server Admins:** Thanks to the new dynamic core, you can now change almost any setting in your `config.yml` and simply type `/xlogin reload` in the console to apply it instantly!

> Addon for Velocity * It is mandatory to download the normal version to your auth/lobby and configure it.

We've fixed several issues and improved the /premium system for proxy networks and Bedrock players.

> Addon for BungeeCord = WaterFall * It is mandatory to download the normal version to your auth/lobby and configure it.

> Addon for Velocity (Required for /premium)

# 🚀 xLogin v1.0.4 - The Ultimate Network & Security Update We are thrilled to announce the biggest update to **xLogin** yet! This version brings massive improvements to server security, full proxy network support, Bedrock edition compatibility, and an entirely new suite of administration tools. Here is everything new in **v1.0.4**: ## 🌐 Smart Network & Proxy Integration (BungeeCord / Velocity) * **Smart Proxy Detection:** xLogin now automatically detects if it is running on a standalone server or behind a Proxy (BungeeCord/Velocity). * **Network-Only Premium Mode:** The `/premium` auto-login system now dynamically enables itself *only* on proxy networks (to ensure 100% secure UUID verification) and safely disables itself on standalone servers. * **Auth-Lobby Redirection:** Added `proxy-redirect` to `config.yml`. You can now automatically send players to a target server (e.g., "Lobby") immediately after a successful login. ## 📱 Bedrock Edition Support (Floodgate / Geyser) * **Bedrock Auto-Login:** Added native support for GeyserMC/Floodgate. Bedrock players authenticated via Xbox Live can now automatically bypass the login screen. * **Fully Configurable:** The Bedrock bypass can be easily toggled on or off using the new `geyser-support.auto-login-bedrock` option in your `config.yml`. ## 🛡️ Advanced Security & Asynchronous Logging * **New Logging System:** Added a fully asynchronous `LogManager`. All successful logins, new registrations, failed password attempts, and admin actions are now safely recorded in `plugins/xLogin/logs/security.log`. * **Premium Name Protection:** Added `prevent-premium-name-impersonation` to the config. If a non-premium player tries to join using the username of an official Premium account, the plugin will automatically kick them to protect the account's identity. * **Thread-Safe Database:** Rewritten H2 database connection handling to prevent memory leaks and database corruption during high-traffic logins. ## ⚙️ Massive Admin Command Expansion We have completely revamped the `/xlogin` administration system! Admins now have ultimate control over the database directly from the game or console: * `+` **`/xlogin backup`**: Safely creates an instant backup of your database inside the `/backups` folder. * `+` **`/xlogin purge <days>`**: Cleans your database by deleting accounts inactive for a specified amount of days. * `+` **`/xlogin forcelogin <user>`**: Instantly forces a pending player into a logged-in state. * `+` **`/xlogin changeuuid <user> <uuid>`**: Easily update a player's UUID. * `+` **`/xlogin changepass <user> <pass>`**: Forcefully change a player's password. * `+` **`/xlogin verify <user>`**: Displays a detailed profile of a player (UUID, IP, Premium status, and Last Login). * `+` **`/xlogin unpremium <user>`**: Removes the premium status from a player's account. * `+` **Dynamic Help Menu:** The `/xlogin help` command now reads directly from your `messages_en.yml` or `messages_es.yml`, allowing you to translate or customize the admin help page! ## 🛠️ General Fixes & Optimizations * Updated `pom.xml` dependencies to the latest secure versions (MySQL Connector, BungeeCord Chat API). * Fixed movement glitching/stuttering for unregistered players in version 1.8.x. * Fixed an issue where the GUI Admin panel arrows would not paginate correctly. --- **⚠️ Important Note for Server Admins:** Please make sure to regenerate or update your `config.yml`, `messages_es.yml`, and `messages_en.yml` files to access all the new features and translations included in this release!

# 📦 v1.0.3 - The "Clean & Secure" Update The biggest update yet! We have rebuilt the plugin's core to be lighter, removing unnecessary dependencies and improving global compatibility from **1.8.8** to **1.20.1+**. ### 🚀 New Features * **💎 Smart Premium System:** Added the `/premium` command with a confirmation system. Users can toggle their original Mojang status for automatic login (Auto-login). * **🔐 Secure Password Change:** New `/changepassword` command using **BCrypt** encryption to update passwords securely. * **🌈 Dynamic Hex Color Support:** Smart system that detects your server version. Use Hex colors (`&#RRGGBB`) on 1.16+ while maintaining classic compatibility on 1.8.8. * **📂 100% Editable Messaging:** All messages are now organized by categories in `messages_en.yml` for full customization. ### 🛠️ Improvements & Optimization * **📦 Migration to Local H2:** Heavy MySQL and Email dependencies have been removed. The plugin is now "Plug & Play", storing everything in an ultra-fast local `data.db` database. * **⚡ Asynchronous Performance:** All save and load operations are now asynchronous to ensure your server's TPS stays at 20.0. * **🛡️ Hardened Security:** * Improved Blindness and movement lock upon joining. * Password change protection for premium users. * Status validation to prevent duplicate messages in commands. ### 🐛 Bug Fixes * **✅ 1.8.8 Compatibility:** Fixed material errors (`SKULL_ITEM` vs `PLAYER_HEAD`) and sound issues that prevented the plugin from loading on older versions. * **✅ Database Fix:** Optimized the connection to prevent H2 file corruption during server shutdowns. * **✅ GUI Fix:** The admin panel now correctly displays player heads across all versions. --- > **Made with ❤️ by xPlugins .**

## Version 1.0.2 - Critical Security Update --- A critical security vulnerability has been fixed that allowed non-premium users to log in using the name of any premium account without being the owner. - ✅ Security Patch: The auto-login system for premium players no longer just checks if the name exists, but now correctly validates the player's session through the server's online-mode. - 🔒 Anti-Impersonation: With this change, it is impossible for a non-premium player to impersonate a premium player. > All server administrators are advised to update to this version as soon as possible to protect their users' accounts.