Merge branch 'master' of https://github.com/ParadiseSS13/Paradise into turfs

# Conflicts: # paradise.dme
2026-08-29 15:08:02 +01:00 · 2019-05-31 05:48:49 +02:00
parent eec0d30e85 6582f22be5
commit 2c1ccf6786
24 changed files with 525 additions and 148 deletions
@@ -266,6 +266,8 @@ CREATE TABLE `player` (
  `exp` mediumtext,
  `clientfps` smallint(4) DEFAULT '0',
  `atklog` smallint(4) DEFAULT '0',
+  `fuid` BIGINT(20) NULL DEFAULT NULL,
+  `fupdate` SMALLINT(4) NULL DEFAULT 0,
  PRIMARY KEY (`id`),
  UNIQUE KEY `ckey` (`ckey`)
 ) ENGINE=InnoDB AUTO_INCREMENT=32446 DEFAULT CHARSET=latin1;
@@ -523,15 +525,27 @@ CREATE TABLE `memo` (
 /*!40101 SET character_set_client = @saved_cs_client */;

 --
-- Table structure for table `discord`
+-- Table structure for table `ipintel`
 --
-DROP TABLE IF EXISTS `discord`;
+DROP TABLE IF EXISTS `ipintel`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
-CREATE TABLE IF NOT EXISTS `discord` (
-  `ckey` varchar(32) NOT NULL,
-  `discord_id` bigint(20) NOT NULL,
-  `notify` int(11) NOT NULL,
-  PRIMARY KEY (`ckey`)
-) ENGINE=InnoDB DEFAULT CHARSET=latin1;
+CREATE TABLE  `ipintel` (
+`ip` INT UNSIGNED NOT NULL ,
+`date` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP NOT NULL ,
+`intel` REAL NOT NULL DEFAULT  '0',
+PRIMARY KEY (  `ip` )
+) ENGINE = INNODB;
 /*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Table structure for table `vpn_whitelist`
+--
+DROP TABLE IF EXISTS `vpn_whitelist`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!40101 SET character_set_client = utf8 */;
+CREATE TABLE `vpn_whitelist` (
+  `ckey` VARCHAR(32) NOT NULL,
+  `reason` text
+  PRIMARY KEY (`ckey`)
+) ENGINE=INNODB;
@@ -265,6 +265,8 @@ CREATE TABLE `SS13_player` (
  `exp` mediumtext,
  `clientfps` smallint(4) DEFAULT '0',
  `atklog` smallint(4) DEFAULT '0',
+  `fuid` BIGINT(20) NULL DEFAULT NULL,
+  `fupdate` SMALLINT(4) NULL DEFAULT 0,
  PRIMARY KEY (`id`),
  UNIQUE KEY `ckey` (`ckey`)
 ) ENGINE=InnoDB AUTO_INCREMENT=32446 DEFAULT CHARSET=latin1;
@@ -522,15 +524,27 @@ CREATE TABLE `SS13_memo` (
 /*!40101 SET character_set_client = @saved_cs_client */;

 --
-- Table structure for table `SS13_discord`
+-- Table structure for table `SS13_ipintel`
 --
-DROP TABLE IF EXISTS `SS13_discord`;
+DROP TABLE IF EXISTS `SS13_ipintel`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
-CREATE TABLE IF NOT EXISTS `SS13_discord` (
-  `ckey` varchar(32) NOT NULL,
-  `discord_id` bigint(20) NOT NULL,
-  `notify` int(11) NOT NULL,
-  PRIMARY KEY (`ckey`)
-) ENGINE=InnoDB DEFAULT CHARSET=latin1;
+CREATE TABLE  `SS13_ipintel` (
+`ip` INT UNSIGNED NOT NULL ,
+`date` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP NOT NULL ,
+`intel` REAL NOT NULL DEFAULT  '0',
+PRIMARY KEY (  `ip` )
+) ENGINE = INNODB;
 /*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Table structure for table `SS13_vpn_whitelist`
+--
+DROP TABLE IF EXISTS `SS13_vpn_whitelist`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!40101 SET character_set_client = utf8 */;
+CREATE TABLE `SS13_vpn_whitelist` (
+  `ckey` VARCHAR(32) NOT NULL,
+  `reason` text,
+  PRIMARY KEY (`ckey`)
+) ENGINE=INNODB;
@@ -0,0 +1,34 @@
+#Updating the SQL from version 5 to version 6. -Kyep
+
+#Make a table to track the results of VPN/proxy lookups for IPs (IPINTEL, TG PORT)
+CREATE TABLE  `ipintel` (
+`ip` INT UNSIGNED NOT NULL ,
+`date` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP NOT NULL ,
+`intel` REAL NOT NULL DEFAULT  '0',
+PRIMARY KEY (  `ip` )
+) ENGINE = INNODB;
+
+#Make a table to track which ckeys are whitelisted for use of VPNs (IPINTEL, CUSTOM)
+CREATE TABLE `vpn_whitelist` (
+  `ckey` VARCHAR(32) NOT NULL,
+  `reason` text,
+  PRIMARY KEY (`ckey`)
+) ENGINE=INNODB;
+
+# Add fuid (forum userid) which enables quick lookup of which ckey is associated with a specific forum account. (FORUM LINK)
+ALTER TABLE `player` ADD `fuid` BIGINT(20) NULL DEFAULT NULL;
+ALTER TABLE `player` ADD INDEX(`fuid`);
+
+# Add fupdate (forum update required) which flags specific ckeys as having been banned/unbanned, which requires an update of their forum/etc permissions (FORUM LINK)
+ALTER TABLE `player` ADD `fupdate` SMALLINT(4) NULL DEFAULT 0;
+ALTER TABLE `player` ADD INDEX(`fupdate`);
+
+#Make a table to track oauth tokens for linking forum/web accounts (FORUM LINK)
+CREATE TABLE `oauth_tokens` (
+  `ckey` VARCHAR(32) NOT NULL,
+  `token` VARCHAR(32) NOT NULL,
+  PRIMARY KEY (`token`)
+) ENGINE=INNODB;
+
+#Drop the old 'discord' table that is not used anymore
+DROP TABLE `discord`;
@@ -326,7 +326,7 @@
 #define INVESTIGATE_BOMB "bombs"

 // The SQL version required by this version of the code
-#define SQL_VERSION 5
+#define SQL_VERSION 6

 // Vending machine stuff
 #define CAT_NORMAL 1
@@ -129,6 +129,18 @@
 	var/slime_delay = 0
 	var/animal_delay = 0

+	//IP Intel vars
+	var/ipintel_email
+	var/ipintel_rating_bad = 1
+	var/ipintel_save_good = 12
+	var/ipintel_save_bad = 1
+	var/ipintel_domain = "check.getipintel.net"
+	var/ipintel_maxplaytime = 0
+	var/ipintel_whitelist = 0
+	var/ipintel_detailsurl = "https://iphub.info/?ip="
+
+	var/forum_link_url
+
 	var/admin_legacy_system = 0	//Defines whether the server uses the legacy admin system with admins.txt or the SQL system. Config option in config.txt
 	var/ban_legacy_system = 0	//Defines whether the server uses the legacy banning system with the files in /data or the SQL system. Config option in config.txt
 	var/use_age_restriction_for_jobs = 0 //Do jobs use account age restrictions? --requires database
@@ -304,10 +316,30 @@

 				if("auto_cryo_ssd_mins")
 					config.auto_cryo_ssd_mins = text2num(value)
-
 				if("ssd_warning")
 					config.ssd_warning = 1

+				if("ipintel_email")
+					if(value != "ch@nge.me")
+						config.ipintel_email = value
+				if("ipintel_rating_bad")
+					config.ipintel_rating_bad = text2num(value)
+				if("ipintel_domain")
+					config.ipintel_domain = value
+				if("ipintel_save_good")
+					config.ipintel_save_good = text2num(value)
+				if("ipintel_save_bad")
+					config.ipintel_save_bad = text2num(value)
+				if("ipintel_maxplaytime")
+					config.ipintel_maxplaytime = text2num(value)
+				if("ipintel_whitelist")
+					config.ipintel_whitelist = 1
+				if("ipintel_detailsurl")
+					config.ipintel_detailsurl = value
+
+				if("forum_link_url")
+					config.forum_link_url = value
+
 				if("log_ooc")
 					config.log_ooc = 1

@@ -0,0 +1,15 @@
+SUBSYSTEM_DEF(ipintel)
+	name = "XKeyScore"
+	wait = 1
+	flags = SS_NO_FIRE
+	init_order = INIT_ORDER_XKEYSCORE // 10
+	var/enabled = 0 //disable at round start to avoid checking reconnects
+	var/throttle = 0
+	var/errors = 0
+
+	var/list/cache = list()
+
+/datum/controller/subsystem/ipintel/Initialize(timeofday, zlevel)
+	enabled = 1
+	. = ..()
+
@@ -150,6 +150,8 @@ datum/admins/proc/DB_ban_record(var/bantype, var/mob/banned_mob, var/duration =

 	if(isjobban)
 		jobban_client_fullban(ckey, job)
+	else
+		flag_account_for_forum_sync(ckey)

 datum/admins/proc/DB_ban_unban(var/ckey, var/bantype, var/job = "")

@@ -228,6 +230,8 @@ datum/admins/proc/DB_ban_unban(var/ckey, var/bantype, var/job = "")
 	DB_ban_unban_by_id(ban_id)
 	if(isjobban)
 		jobban_unban_client(ckey, job)
+	else
+		flag_account_for_forum_sync(ckey)

 datum/admins/proc/DB_ban_edit(var/banid = null, var/param = null)

@@ -333,6 +337,8 @@ datum/admins/proc/DB_ban_unban_by_id(var/id)
 	var/DBQuery/query_update = dbcon.NewQuery(sql_update)
 	query_update.Execute()

+	flag_account_for_forum_sync(pckey)
+

 /client/proc/DB_ban_panel()
 	set category = "Admin"
@@ -566,4 +572,12 @@ datum/admins/proc/DB_ban_unban_by_id(var/id)

 			output += "</table></div>"

-	usr << browse(output,"window=lookupbans;size=900x700")
+	usr << browse(output,"window=lookupbans;size=900x700")
+
+/proc/flag_account_for_forum_sync(ckey)
+	if(!dbcon)
+		return
+	var/skey = sanitizeSQL(ckey)
+	var/sql = "UPDATE [format_table_name("player")] SET fupdate = 1 WHERE ckey = '[skey]'"
+	var/DBQuery/adm_query = dbcon.NewQuery(sql)
+	adm_query.Execute()
@@ -1,5 +1,12 @@
 //Blocks an attempt to connect before even creating our client datum thing.
-world/IsBanned(key,address,computer_id)
+world/IsBanned(key, address, computer_id, check_ipintel = TRUE)
+
+	if(!config.ban_legacy_system)
+		if(address)
+			address = sanitizeSQL(address)
+		if(computer_id)
+			computer_id = sanitizeSQL(computer_id)
+
 	if(!key || !address || !computer_id)
 		log_adminwarn("Failed Login (invalid data): [key] [address]-[computer_id]")
 		return list("reason"="invalid login data", "desc"="Error: Could not check ban status, please try again. Error message: Your computer provided invalid or blank information to the server on connection (BYOND Username, IP, and Computer ID). Provided information for reference: Username: '[key]' IP: '[address]' Computer ID: '[computer_id]'. If you continue to get this error, please restart byond or contact byond support.")
@@ -31,6 +38,14 @@ world/IsBanned(key,address,computer_id)
 			mistakemessage = "\nIf you believe this is a mistake, please request help at [config.banappeals]."
 		return list("reason"="using Tor", "desc"="\nReason: The network you are using to connect has been banned.[mistakemessage]")

+	//check if the IP address is a known proxy/vpn, and the user is not whitelisted
+	if(check_ipintel && config.ipintel_email && config.ipintel_whitelist && ipintel_is_banned(key, address))
+		log_adminwarn("Failed Login: [key] [computer_id] [address] - Proxy/VPN")
+		var/mistakemessage = ""
+		if(config.banappeals)
+			mistakemessage = "\nIf you have to use one, request whitelisting at:  [config.banappeals]"
+		return list("reason"="using proxy or vpn", "desc"="\nReason: Proxies/VPNs are not allowed here. [mistakemessage]")
+

 	if(config.ban_legacy_system)
 		//Ban Checking
@@ -276,6 +276,15 @@ var/global/nologevent = 0

 	show_note(key)

+/datum/admins/proc/vpn_whitelist()
+	set category = "Admin"
+	set name = "VPN Ckey Whitelist"
+	if(!check_rights(R_ADMIN))
+		return
+	var/key = stripped_input(usr, "Enter ckey to add/remove, or leave blank to cancel:", "VPN Whitelist add/remove", max_length=32)
+	if(key)
+		vpn_whitelist_panel(key)
+
 /datum/admins/proc/access_news_network() //MARKER
 	set category = "Event"
 	set name = "Access Newscaster Network"
@@ -53,6 +53,7 @@ var/list/admin_verbs_admin = list(
 	/datum/admins/proc/PlayerNotes,
 	/client/proc/cmd_mentor_say,
 	/datum/admins/proc/show_player_notes,
+	/datum/admins/proc/vpn_whitelist,
 	/client/proc/free_slot,			/*frees slot for chosen job*/
 	/client/proc/toggleattacklogs,
 	/client/proc/toggleadminlogs,
@@ -0,0 +1,228 @@
+/datum/ipintel
+	var/ip
+	var/intel = 0
+	var/cache = FALSE
+	var/cacheminutesago = 0
+	var/cachedate = ""
+	var/cacherealtime = 0
+
+/datum/ipintel/New()
+	cachedate = SQLtime()
+	cacherealtime = world.realtime
+
+/datum/ipintel/proc/is_valid()
+	. = FALSE
+	if(intel < 0)
+		return
+	if(intel <= config.ipintel_rating_bad)
+		if(world.realtime < cacherealtime + (config.ipintel_save_good HOURS))
+			return TRUE
+	else
+		if(world.realtime < cacherealtime + (config.ipintel_save_bad HOURS))
+			return TRUE
+
+/proc/get_ip_intel(ip, bypasscache = FALSE, updatecache = TRUE)
+	var/datum/ipintel/res = new()
+	ip = sanitizeSQL(ip)
+	res.ip = ip
+	. = res
+	if(!ip || !config.ipintel_email || !SSipintel.enabled)
+		return
+	if(!bypasscache)
+		var/datum/ipintel/cachedintel = SSipintel.cache[ip]
+		if(cachedintel && cachedintel.is_valid())
+			cachedintel.cache = TRUE
+			return cachedintel
+
+		if(dbcon.IsConnected())
+			var/rating_bad = config.ipintel_rating_bad
+			var/DBQuery/query_get_ip_intel = dbcon.NewQuery({"
+				SELECT date, intel, TIMESTAMPDIFF(MINUTE,date,NOW())
+				FROM [format_table_name("ipintel")]
+				WHERE
+					ip = INET_ATON('[ip]')
+					AND ((
+							intel < [rating_bad]
+							AND
+							date + INTERVAL [config.ipintel_save_good] HOUR > NOW()
+						) OR (
+							intel >= [rating_bad]
+							AND
+							date + INTERVAL [config.ipintel_save_bad] HOUR > NOW()
+					))
+				"})
+			if(!query_get_ip_intel.Execute())
+				qdel(query_get_ip_intel)
+				return
+			if(query_get_ip_intel.NextRow())
+				res.cache = TRUE
+				res.cachedate = query_get_ip_intel.item[1]
+				res.intel = text2num(query_get_ip_intel.item[2])
+				res.cacheminutesago = text2num(query_get_ip_intel.item[3])
+				res.cacherealtime = world.realtime - (text2num(query_get_ip_intel.item[3])*10*60)
+				SSipintel.cache[ip] = res
+				qdel(query_get_ip_intel)
+				return
+			qdel(query_get_ip_intel)
+	res.intel = ip_intel_query(ip)
+	if(updatecache && res.intel >= 0)
+		SSipintel.cache[ip] = res
+		if(dbcon.IsConnected())
+			var/DBQuery/query_add_ip_intel = dbcon.NewQuery("INSERT INTO [format_table_name("ipintel")] (ip, intel) VALUES (INET_ATON('[ip]'), [res.intel]) ON DUPLICATE KEY UPDATE intel = VALUES(intel), date = NOW()")
+			query_add_ip_intel.Execute()
+			qdel(query_add_ip_intel)
+
+
+/proc/ip_intel_query(ip, var/retryed=0)
+	. = -1 //default
+	if(!ip)
+		return
+	if(SSipintel.throttle > world.timeofday)
+		return
+	if(!SSipintel.enabled)
+		return
+
+	var/list/http[] = world.Export("http://[config.ipintel_domain]/check.php?ip=[ip]&contact=[config.ipintel_email]&format=json&flags=b")
+
+	if(http)
+		var/status = text2num(http["STATUS"])
+
+		if(status == 200)
+			var/response = json_decode(file2text(http["CONTENT"]))
+			if(response)
+				if(response["status"] == "success")
+					var/intelnum = text2num(response["result"])
+					if(isnum(intelnum))
+						return text2num(response["result"])
+					else
+						ipintel_handle_error("Bad intel from server: [response["result"]].", ip, retryed)
+						if(!retryed)
+							sleep(25)
+							return .(ip, 1)
+				else
+					ipintel_handle_error("Bad response from server: [response["status"]].", ip, retryed)
+					if(!retryed)
+						sleep(25)
+						return .(ip, 1)
+
+		else if(status == 429)
+			ipintel_handle_error("Error #429: We have exceeded the rate limit.", ip, 1)
+			return
+		else
+			ipintel_handle_error("Unknown status code: [status].", ip, retryed)
+			if(!retryed)
+				sleep(25)
+				return .(ip, 1)
+	else
+		ipintel_handle_error("Unable to connect to API.", ip, retryed)
+		if(!retryed)
+			sleep(25)
+			return .(ip, 1)
+
+
+/proc/ipintel_handle_error(error, ip, retryed)
+	if(retryed)
+		SSipintel.errors++
+		error += " Could not check [ip]. Disabling IPINTEL for [SSipintel.errors] minute[( SSipintel.errors == 1 ? "" : "s" )]"
+		SSipintel.throttle = world.timeofday + (2 * SSipintel.errors MINUTES)
+	else
+		error += " Attempting retry on [ip]."
+	log_ipintel(error)
+
+/proc/log_ipintel(text)
+	log_game("IPINTEL: [text]")
+	log_debug("IPINTEL: [text]")
+
+
+/proc/ipintel_is_banned(t_ckey, t_ip)
+	if(!config.ipintel_email)
+		return FALSE
+	if(!config.ipintel_whitelist)
+		return FALSE
+	if(!dbcon.IsConnected())
+		return FALSE
+	if(!ipintel_badip_check(t_ip))
+		return FALSE
+	if(vpn_whitelist_check(t_ckey))
+		return FALSE
+	return TRUE
+
+/proc/ipintel_badip_check(target_ip)
+	var/rating_bad = config.ipintel_rating_bad
+	if(!rating_bad)
+		log_debug("ipintel_badip_check reports misconfigured rating_bad directive")
+		return FALSE
+	var/valid_hours = config.ipintel_save_bad
+	if(!valid_hours)
+		log_debug("ipintel_badip_check reports misconfigured ipintel_save_bad directive")
+		return FALSE
+	target_ip = sanitizeSQL(target_ip)
+	rating_bad = sanitizeSQL(rating_bad)
+	valid_hours = sanitizeSQL(valid_hours)
+	var/check_sql = {"SELECT * FROM [format_table_name("ipintel")] WHERE ip = INET_ATON('[target_ip]') AND intel >= [rating_bad] AND (date + INTERVAL [valid_hours] HOUR) > NOW()"}
+	var/DBQuery/query_get_ip_intel = dbcon.NewQuery(check_sql)
+	if(!query_get_ip_intel.Execute())
+		log_debug("ipintel_badip_check reports failed query execution")
+		qdel(query_get_ip_intel)
+		return FALSE
+	if(!query_get_ip_intel.NextRow())
+		qdel(query_get_ip_intel)
+		return FALSE
+	qdel(query_get_ip_intel)
+	return TRUE
+
+/proc/vpn_whitelist_check(target_ckey)
+	if(!config.ipintel_whitelist)
+		return FALSE
+	var/target_sql_ckey = ckey(target_ckey)
+	var/DBQuery/query_whitelist_check = dbcon.NewQuery("SELECT * FROM [format_table_name("vpn_whitelist")] WHERE ckey = '[target_sql_ckey]'")
+	if(!query_whitelist_check.Execute())
+		var/err = query_whitelist_check.ErrorMsg()
+		log_debug("SQL ERROR on proc/vpn_whitelist_check for ckey '[target_sql_ckey]'. Error : \[[err]\]\n")
+		return FALSE
+	if(query_whitelist_check.NextRow())
+		return TRUE // At least one row in the whitelist names their ckey. That means they are whitelisted.
+	return FALSE
+
+/proc/vpn_whitelist_add(target_ckey)
+	var/target_sql_ckey = ckey(target_ckey)
+	var/reason_string = input(usr, "Enter link to the URL of their whitelist request on the forum.","Reason required") as message|null
+	if(!reason_string)
+		return FALSE
+	reason_string = sanitizeSQL(reason_string)
+	var/DBQuery/query_whitelist_add = dbcon.NewQuery("INSERT INTO [format_table_name("vpn_whitelist")] (ckey,reason) VALUES ('[target_sql_ckey]','[reason_string]')")
+	if(!query_whitelist_add.Execute())
+		var/err = query_whitelist_add.ErrorMsg()
+		log_debug("SQL ERROR on proc/vpn_whitelist_add for ckey '[target_sql_ckey]'. Error : \[[err]\]\n")
+		return FALSE
+	return TRUE
+
+/proc/vpn_whitelist_remove(target_ckey)
+	var/target_sql_ckey = ckey(target_ckey)
+	var/DBQuery/query_whitelist_remove = dbcon.NewQuery("DELETE FROM [format_table_name("vpn_whitelist")] WHERE ckey = '[target_sql_ckey]'")
+	if(!query_whitelist_remove.Execute())
+		var/err = query_whitelist_remove.ErrorMsg()
+		log_debug("SQL ERROR on proc/vpn_whitelist_remove for ckey '[target_sql_ckey]'. Error : \[[err]\]\n")
+		return FALSE
+	return TRUE
+
+/proc/vpn_whitelist_panel(target_ckey as text)
+	if(!check_rights(R_ADMIN))
+		return
+	if(!target_ckey)
+		return
+	var/is_already_whitelisted = vpn_whitelist_check(target_ckey)
+	if(is_already_whitelisted)
+		var/confirm = alert("[target_ckey] is already whitelisted. Remove them?", "Confirm Removal", "No", "Yes")
+		if(!confirm || confirm != "Yes")
+			to_chat(usr, "VPN whitelist alteration cancelled.")
+			return
+		else if(vpn_whitelist_remove(target_ckey))
+			to_chat(usr, "[target_ckey] was removed from the VPN whitelist.")
+		else
+			to_chat(usr, "VPN whitelist unchanged.")
+	else
+		if(vpn_whitelist_add(target_ckey))
+			to_chat(usr, "[target_ckey] was added to the VPN whitelist.")
+		else
+			to_chat(usr, "VPN whitelist unchanged.")
@@ -72,6 +72,8 @@

 	control_freak = CONTROL_FREAK_ALL | CONTROL_FREAK_SKIN | CONTROL_FREAK_MACROS

+	var/ip_intel = "Disabled"
+
 	var/datum/click_intercept/click_intercept = null

 	//datum that controls the displaying and hiding of tooltips
@@ -229,7 +229,8 @@
 	if(href_list["ssdwarning"])
 		ssd_warning_acknowledged = TRUE
 		to_chat(src, "<span class='notice'>SSD warning acknowledged.</span>")
-
+	if(href_list["link_forum_account"])
+		link_forum_account()
 	switch(href_list["action"])
 		if("openLink")
 			src << link(href_list["link"])
@@ -320,8 +321,7 @@
 	//Admin Authorisation
 	// Automatically makes localhost connection an admin
 	if(!config.disable_localhost_admin)
-		var/localhost_addresses = list("127.0.0.1", "::1") // Adresses
-		if(!isnull(address) && address in localhost_addresses)
+		if(is_connecting_from_localhost())
 			new /datum/admins("!LOCALHOST!", R_HOST, ckey) // Makes localhost rank
 	holder = admin_datums[ckey]
 	if(holder)
@@ -370,8 +370,9 @@
 			to_chat(src, message)
 		clientmessages.Remove(ckey)

-	donator_check()

+	donator_check()
+	check_ip_intel()
 	send_resources()

 	if(prefs.toggles & UI_DARKMODE) // activates dark mode if its flagged. -AA07
@@ -393,6 +394,8 @@
 	generate_clickcatcher()
 	apply_clickcatcher()

+	check_forum_link()
+
 	if(custom_event_msg && custom_event_msg != "")
 		to_chat(src, "<h1 class='alert'>Custom Event</h1>")
 		to_chat(src, "<h2 class='alert'>A custom event is taking place. OOC Info:</h2>")
@@ -409,6 +412,12 @@

 	Master.UpdateTickRate()

+/client/proc/is_connecting_from_localhost()
+	var/localhost_addresses = list("127.0.0.1", "::1") // Adresses
+	if(!isnull(address) && address in localhost_addresses)
+		return TRUE
+	return FALSE
+
 //////////////
 //DISCONNECT//
 //////////////
@@ -539,6 +548,81 @@
 	var/DBQuery/query_accesslog = dbcon.NewQuery("INSERT INTO `[format_table_name("connection_log")]`(`id`,`datetime`,`serverip`,`ckey`,`ip`,`computerid`) VALUES(null,Now(),'[serverip]','[ckey]','[sql_ip]','[sql_computerid]');")
 	query_accesslog.Execute()

+/client/proc/check_ip_intel()
+	set waitfor = 0 //we sleep when getting the intel, no need to hold up the client connection while we sleep
+	if(config.ipintel_email)
+		if(config.ipintel_maxplaytime && config.use_exp_tracking)
+			var/living_hours = get_exp_type_num(EXP_TYPE_LIVING) / 60
+			if(living_hours >= config.ipintel_maxplaytime)
+				return
+
+		if(is_connecting_from_localhost())
+			log_debug("check_ip_intel: skip check for player [key_name_admin(src)] connecting from localhost.")
+			return
+
+		if(vpn_whitelist_check(ckey))
+			log_debug("check_ip_intel: skip check for player [key_name_admin(src)] [address] on whitelist.")
+			return
+
+		var/datum/ipintel/res = get_ip_intel(address)
+		ip_intel = res.intel
+		verify_ip_intel()
+
+/client/proc/verify_ip_intel()
+	if(ip_intel >= config.ipintel_rating_bad)
+		var/detailsurl = config.ipintel_detailsurl ? "(<a href='[config.ipintel_detailsurl][address]'>IP Info</a>)" : ""
+		if(config.ipintel_whitelist)
+			spawn(40) // This is necessary because without it, they won't see the message, and addtimer cannot be used because the timer system may not have initialized yet
+				message_admins("<span class='adminnotice'>IPIntel: [key_name_admin(src)] on IP [address] was rejected. [detailsurl]</span>")
+				var/blockmsg = "<B>Error: proxy/VPN detected. Proxy/VPN use is not allowed here. Deactivate it before you reconnect.</B>"
+				if(config.banappeals)
+					blockmsg += "\nIf you are not actually using a proxy/VPN, or have no choice but to use one, request whitelisting at: [config.banappeals]"
+				to_chat(src, blockmsg)
+				qdel(src)
+		else
+			message_admins("<span class='adminnotice'>IPIntel: [key_name_admin(src)] on IP [address] is likely to be using a Proxy/VPN. [detailsurl]</span>")
+
+
+/client/proc/check_forum_link()
+	if(config.forum_link_url && prefs && !prefs.fuid)
+		to_chat(src, "<B>You do not have your forum account linked. <a href='?src=[UID()];link_forum_account=true'>LINK FORUM ACCOUNT</a></B>")
+
+/client/proc/create_oauth_token()
+	var/DBQuery/query_find_token = dbcon.NewQuery("SELECT token FROM [format_table_name("oauth_tokens")] WHERE ckey = '[ckey]' limit 1")
+	if(!query_find_token.Execute())
+		log_debug("create_oauth_token: failed db read")
+		return
+	if(query_find_token.NextRow())
+		return query_find_token.item[1]
+	var/tokenstr = md5("[ckey][rand()]")
+	var/DBQuery/query_insert_token = dbcon.NewQuery("INSERT INTO [format_table_name("oauth_tokens")] (ckey, token) VALUES('[ckey]','[tokenstr]')")
+	if(!query_insert_token.Execute())
+		return
+	return tokenstr
+
+/client/proc/link_forum_account()
+	if(IsGuestKey(key))
+		to_chat(src, "Guest keys cannot be linked.")
+		return
+	if(prefs && prefs.fuid)
+		to_chat(src, "Your forum account is already set.")
+		return
+	var/DBQuery/query_find_link = dbcon.NewQuery("SELECT fuid FROM [format_table_name("player")] WHERE ckey = '[ckey]' limit 1")
+	if(!query_find_link.Execute())
+		log_debug("link_forum_account: failed db read")
+		return
+	if(query_find_link.NextRow())
+		if(query_find_link.item[1])
+			to_chat(src, "Your forum account is already set. (" + query_find_link.item[1] + ")")
+			return
+	var/tokenid = create_oauth_token()
+	if(!tokenid)
+		to_chat(src, "link_forum_account: unable to create token")
+		return
+	var/url = "[config.forum_link_url][tokenid]"
+	to_chat(src, {"Now opening a windows to verify your information with the forums. If the window does not load, please go to: <a href="[url]">[url]</a>."})
+	src << link(url)
+	return

 #undef TOPIC_SPAM_DELAY
 #undef UPLOAD_LIMIT
@@ -92,6 +92,7 @@ var/global/list/special_role_times = list( //minimum age (in days) for accounts
 	var/windowflashing = TRUE
 	var/clientfps = 0
 	var/atklog = ATKLOG_ALL
+	var/fuid							// forum userid

 	//ghostly preferences
 	var/ghost_anonsay = 0
@@ -18,7 +18,8 @@
 					ghost_anonsay,
 					exp,
 					clientfps,
-					atklog
+					atklog,
+					fuid
 					FROM [format_table_name("player")]
 					WHERE ckey='[C.ckey]'"}
 					)
@@ -50,6 +51,7 @@
 		exp = query.item[16]
 		clientfps = text2num(query.item[17])
 		atklog = text2num(query.item[18])
+		fuid = text2num(query.item[19])

 	//Sanitize
 	ooccolor		= sanitize_hexcolor(ooccolor, initial(ooccolor))
@@ -69,6 +71,7 @@
 	exp	= sanitize_text(exp, initial(exp))
 	clientfps = sanitize_integer(clientfps, 0, 1000, initial(clientfps))
 	atklog = sanitize_integer(atklog, 0, 100, initial(atklog))
+	fuid = sanitize_integer(fuid, 0, 10000000, initial(fuid))
 	return 1

 /datum/preferences/proc/save_preferences(client/C)
@@ -1,52 +0,0 @@
-// DONT TOUCH ANYTHING IN HERE UNLESS YOU KNOW WHAT YOU ARE DOING -affected
-/client/verb/linkdiscord()
-    set category = "Special Verbs"
-    set name = "Link Discord Account"
-    set desc = "Link your discord account to your BYOND account."
-    var/user_ckey = sanitizeSQL(usr.ckey) // Probably not neccassary but better safe than sorry
-    if(!config.sql_enabled)
-        to_chat(src, "<span class='warning'>This is feature requires the SQL backend</span>")
-        return
-    var/DBQuery/db_discord_id = dbcon.NewQuery("SELECT discord_id FROM [format_table_name("discord")] WHERE ckey = '[user_ckey]'")
-    if(!db_discord_id.Execute())
-        var/err = db_discord_id.ErrorMsg()
-        log_game("SQL ERROR while selecting discord account. Error : \[[err]\]\n")
-        to_chat(src, "<span class='warning'>Error checking Discord account. Please inform an administrator</span>")
-        return
-    var/stored_id
-    while(db_discord_id.NextRow())
-        stored_id = db_discord_id.item[1]
-    if(!stored_id) // Not linked
-        var/know_how = alert("Do you know how to get a discord user ID? This ID is NOT your discord username and numbers!","Question","Yes","No")
-        if(know_how == "No") // Opens discord support on how to collect IDs
-            src << link("https://support.discordapp.com/hc/en-us/articles/206346498-Where-can-I-find-my-User-Server-Message-ID")
-        var/entered_id = input("Please enter your Discord ID.", "Enter Discord ID", null, null) as text|null
-        var/sql_id = sanitizeSQL(entered_id)
-        var/DBQuery/store_discord_id = dbcon.NewQuery("INSERT INTO [format_table_name("discord")] (ckey, discord_id, notify) VALUES ('[user_ckey]', [sql_id], 0)")
-        if(!store_discord_id.Execute())
-            var/err = db_discord_id.ErrorMsg()
-            log_game("SQL ERROR while linking discord account. Error : \[[err]\]\n")
-            to_chat(src, "<span class='warning'>Error linking Discord account. Please inform an administrator</span>")
-            return
-        to_chat(src, "<span class='notice'>Successfully linked discord account [entered_id] to [user_ckey]</span>")
-    else // Linked
-        var/choice = alert("You already have the Discord Account [stored_id] linked to [user_ckey]. Would you like to unlink or replace","Already Linked","Unlink","Replace")
-        switch(choice)
-            if("Unlink")
-                var/DBQuery/unlink_discord_id = dbcon.NewQuery("DELETE FROM [format_table_name("discord")] WHERE ckey = '[user_ckey]'")
-                if(!unlink_discord_id.Execute())
-                    var/err = unlink_discord_id.ErrorMsg()
-                    log_game("SQL ERROR while unlinking discord account. Error : \[[err]\]\n")
-                    to_chat(src, "<span class='warning'>Error unlinking Discord account. Please inform an administrator</span>")
-                    return
-                to_chat(src, "<span class='notice'>Successfully unlinked discord account</span>")
-            if("Replace")
-                var/entered_id = input("Please enter your Discord ID. Instructions can be found at https://bit.ly/2AfUu40", "Enter Discord ID", null, null) as text|null
-                var/sql_id = sanitizeSQL(entered_id)
-                var/DBQuery/store_discord_id = dbcon.NewQuery("UPDATE [format_table_name("discord")] SET discord_id = '[sql_id]' WHERE ckey='[user_ckey]'")
-                if(!store_discord_id.Execute())
-                    var/err = db_discord_id.ErrorMsg()
-                    to_chat(src, "<span class='warning'>Error replacing Discord account. Please inform an administrator</span>")
-                    log_game("SQL ERROR while linking discord account. Error : \[[err]\]\n")
-                    return
-                to_chat(src, "<span class='notice'>Successfully linked discord account [entered_id] to [user_ckey]</span>")
@@ -1,48 +0,0 @@
-// DONT TOUCH ANYTHING IN HERE UNLESS YOU KNOW WHAT YOU ARE DOING -affected
-/client/verb/notify_restart()
-    set category = "Special Verbs"
-    set name = "Notify Restart"
-    set desc = "Notifies you on Discord when the server restarts."
-    if(!config.sql_enabled)
-        to_chat(src, "<span class='warning'>This is feature requires the SQL backend</span>")
-        return
-    var/DBQuery/db_discord_id = dbcon.NewQuery("SELECT discord_id FROM [format_table_name("discord")] WHERE ckey = '[ckey]'")
-    if(!db_discord_id.Execute())
-        var/err = db_discord_id.ErrorMsg()
-        log_game("SQL ERROR while selecting discord account. Error : \[[err]\]\n")
-        to_chat(src, "<span class='warning'>Error checking Discord account. Please inform an administrator</span>")
-        return
-    var/stored_id
-    while(db_discord_id.NextRow())
-        stored_id = db_discord_id.item[1]
-    if(!stored_id) // Not linked
-        to_chat(src, "<span class='warning'>This requires you to link your Discord account with the \"Link Discord Account\" verb.</span>")
-        return
-    else // Linked
-        var/DBQuery/toggle_status = dbcon.NewQuery("SELECT notify FROM [format_table_name("discord")] WHERE ckey = '[ckey]'")
-        if(!toggle_status.Execute())
-            var/err = toggle_status.ErrorMsg()
-            log_game("SQL ERROR while getting discord account. Error : \[[err]\]\n")
-        var/notify_status
-        while(toggle_status.NextRow())
-            notify_status = toggle_status.item[1]
-        if(notify_status) // Data is there
-            switch(notify_status)
-                if("0")
-                    var/DBQuery/update_notify = dbcon.NewQuery("UPDATE [format_table_name("discord")] SET notify = 1 WHERE ckey='[ckey]'")
-                    if(!update_notify.Execute())
-                        var/err = db_discord_id.ErrorMsg()
-                        to_chat(src, "<span class='warning'>Error updating notify status. Please inform an administrator</span>")
-                        log_game("SQL ERROR while updating notify status. Error : \[[err]\]\n")
-                        return
-                    to_chat(src, "<span class='notice'>You will now be notified on discord when the next round is starting</span>")
-                if("1")
-                    var/DBQuery/update_notify = dbcon.NewQuery("UPDATE [format_table_name("discord")] SET notify = 0 WHERE ckey='[ckey]'")
-                    if(!update_notify.Execute())
-                        var/err = db_discord_id.ErrorMsg()
-                        to_chat(src, "<span class='warning'>Error updating notify status. Please inform an administrator</span>")
-                        log_game("SQL ERROR while updating notify status. Error : \[[err]\]\n")
-                        return
-                    to_chat(src, "<span class='notice'>You will no longer be notified on discord when the next round is starting</span>")
-        else // Oh fuck what the hell happened
-            to_chat(src, "<span class='danger'>Something has gone VERY wrong, or affected cant code.</span>")
@@ -19,20 +19,3 @@
 	if(config.admin_irc)
 		send2irc(config.admin_irc, msg)
 	return
-
-/hook/startup/proc/ircNotify()
-	var/people_to_ping = ""
-	var/DBQuery/pull_notify = dbcon.NewQuery("SELECT discord_id FROM [format_table_name("discord")] WHERE notify = 1")
-	if(!pull_notify.Execute())
-		var/err = pull_notify.ErrorMsg()
-		log_game("SQL ERROR while pulling notify people. Error : \[[err]\]\n")
-	else
-		while(pull_notify.NextRow())
-			people_to_ping += "<@" + pull_notify.item[1] + "> "
-	send2mainirc("Server starting up on [station_name()]. Connect to: <byond://[config.server? "[config.server]" : "[world.address]:[world.port]"]> "+people_to_ping, 7355608)
-	// Set notify to 0 so people arent pinged round after round
-	var/DBQuery/reset_notify = dbcon.NewQuery("UPDATE [format_table_name("discord")] SET notify = 0 WHERE notify = 1")
-	if(!reset_notify.Execute())
-		var/err = reset_notify.ErrorMsg()
-		log_game("SQL ERROR while resetting notify status. Error : \[[err]\]\n")
-	return 1
@@ -182,7 +182,8 @@
 			return 0

 		if(alert(src,"Are you sure you wish to observe? You cannot normally join the round after doing this!","Player Setup","Yes","No") == "Yes")
-			if(!client)	return 1
+			if(!client)
+				return 1
 			var/mob/dead/observer/observer = new()
 			src << browse(null, "window=playersetup")
 			spawning = 1
@@ -220,7 +221,6 @@
 		if(!SSticker || SSticker.current_state != GAME_STATE_PLAYING)
 			to_chat(usr, "<span class='warning'>The round is either not ready, or has already finished...</span>")
 			return
-
 		if(client.prefs.species in GLOB.whitelisted_species)

 			if(!is_alien_whitelisted(src, client.prefs.species) && config.usealienwhitelist)
@@ -185,6 +185,28 @@ GUEST_JOBBAN
 ## Uncomment this to stop people connecting to your server without a registered ckey. (i.e. guest-* are all blocked from connecting)
 GUEST_BAN

+### IPINTEL:
+### This allows you to detect likely proxies by checking ips against getipintel.net
+## Rating to warn at: (0.90 is good, 1 is 100% likely to be a spammer/proxy, 0.8 is 80%, etc) anything equal to or higher then this number triggers an admin warning
+#IPINTEL_RATING_BAD 0.90
+## Contact email, (required to use the service, leaving blank or default disables IPINTEL)
+#IPINTEL_EMAIL ch@nge.me
+## How long to save good matches (ipintel rate limits to 15 per minute and 500 per day. so this shouldn't be too low, getipintel.net suggests 6 hours, time is in hours) (Your ip will get banned if you go over 500 a day too many times)
+#IPINTEL_SAVE_GOOD 72
+## How long to save bad matches (these numbers can change as ips change hands, best not to save these for too long in case somebody gets a new ip used by a spammer/proxy before.)
+#IPINTEL_SAVE_BAD 24
+## Domain name to query (leave commented out for the default, only needed if you pay getipintel.net for more querys)
+#IPINTEL_DOMAIN check.getipintel.net
+## Ignore players with this many hours of playtime. Requires USE_EXP_TRACKING
+#IPINTEL_MAXPLAYTIME 10
+## Require players (except the previous ones with playtime, if enabled) to be whitelisted to use proxies/VPNs.
+#IPINTEL_WHITELIST
+## URL to show to admins to provide more information about an IP address. Leave undefined for default.
+#IPINTEL_DETAILSURL https://iphub.info/?ip=
+
+## URL to use to link forum accounts. If not set, no link option will be offered.
+#FORUM_LINK_URL https://example.com/link.php?token=
+
 ## Comment to disable checking for the cid randomizer dll. (disabled if database isn't enabled or connected)
 CHECK_RANDOMIZER

@@ -9,7 +9,7 @@
 ## This value must be set to the version of the paradise schema in use.
 ## If this value does not match, the SQL database will not be loaded and an error will be generated.
 ## Roundstart will be delayed.
-DB_VERSION 5
+DB_VERSION 6

 ## Server the MySQL database can be found at.
 # Examples: localhost, 200.135.5.43, www.mysqldb.com, etc.
@@ -149,7 +149,7 @@ var/list/chatResources = list(
 				var/list/row = connectionHistory[i]
 				if(!row || row.len < 3 || !(row["ckey"] && row["compid"] && row["ip"]))
 					return
-				if(world.IsBanned(row["ckey"], row["compid"], row["ip"]))
+				if(world.IsBanned(row["ckey"], row["compid"], row["ip"], FALSE))
 					found = row
 					break

@@ -0,0 +1,6 @@
+author: "Kyep"
+delete-after: True
+changes: 
+  - rscadd: "Ported XKeyScore from TG."
+  - rscadd: "New system to securely link ingame/forum accounts"
+  - rscdel: "Removed old insecure 'link discord account' system"
@@ -207,6 +207,7 @@
 #include "code\controllers\subsystem\holiday.dm"
 #include "code\controllers\subsystem\icon_smooth.dm"
 #include "code\controllers\subsystem\idlenpcpool.dm"
+#include "code\controllers\subsystem\ipintel.dm"
 #include "code\controllers\subsystem\jobs.dm"
 #include "code\controllers\subsystem\lighting.dm"
 #include "code\controllers\subsystem\machinery.dm"
@@ -1146,6 +1147,7 @@
 #include "code\modules\admin\create_poll.dm"
 #include "code\modules\admin\create_turf.dm"
 #include "code\modules\admin\holder2.dm"
+#include "code\modules\admin\ipintel.dm"
 #include "code\modules\admin\IsBanned.dm"
 #include "code\modules\admin\machine_upgrade.dm"
 #include "code\modules\admin\NewBan.dm"
@@ -1399,8 +1401,6 @@
 #include "code\modules\detective_work\evidence.dm"
 #include "code\modules\detective_work\footprints_and_rag.dm"
 #include "code\modules\detective_work\scanner.dm"
-#include "code\modules\discord\accountlink.dm"
-#include "code\modules\discord\notify.dm"
 #include "code\modules\economy\Accounts.dm"
 #include "code\modules\economy\Accounts_DB.dm"
 #include "code\modules\economy\ATM.dm"