NewLogin

Changelog

Highlights

This release focuses on making the project reproducible, improving account security, fixing email recovery, and cleaning up legacy configuration behavior.

Added

• Added a fully reproducible project structure, including pom.xml, src/main/java, resources, README, LICENSE, CHANGELOG, and CI setup.
• Added versioned password hashing using PBKDF2-HMAC-SHA256.
• Added unique salts, safe password comparison, and automatic migration from legacy SHA-256 password hashes.
• Added real SMTP email delivery with TLS/STARTTLS, authentication, UTF-8 HTML support, timeouts, a dedicated executor, and reload support.
• Added recovery-code expiration, maximum attempt limits, and cooldowns per player/IP.
• Added schema-version support to persisted data.
• Added automatic backups before destructive data operations.
• Added UUID/IP-based lockout protection.
• Added blindness effect support for pre-login protection.

Changed

• Updated /email confirm to correctly use args[1].
• Email recovery is now allowed before login.
• Recovery codes now use SecureRandom.
• Password recovery no longer sends or stores temporary plain-text passwords.
• Players now set a new password directly using:

/email confirm <code> <new-password> <confirm-password>

or:

/resetpassword own ...

• Pre-login command protection now uses exact command matching.
• Player visibility and effects are now properly cleaned up on quit and plugin disable.
• DataManager.java now properly removes players.<uuid> entries and saves a clean data snapshot.

Removed

• Removed the plain-text temporary password recovery flow.
• Removed MySQL and captcha settings from the default configuration.
• Legacy captcha settings are now automatically disabled if found in old configuration files.

Fixed

• Fixed destructive persistence operations not fully removing player data.
• Fixed stale or unsafe recovery behavior from the old password reset flow.
• Fixed legacy configuration compatibility issues by enforcing valid YAML handling.