Download File

## Changelog ### Highlights This release focuses on making the project reproducible, improving account security, fixing email recovery, and cleaning up legacy configuration behavior. ### Added * Added a fully reproducible project structure, including `pom.xml`, `src/main/java`, resources, `README`, `LICENSE`, `CHANGELOG`, and CI setup. * Added versioned password hashing using **PBKDF2-HMAC-SHA256**. * Added unique salts, safe password comparison, and automatic migration from legacy SHA-256 password hashes. * Added real SMTP email delivery with TLS/STARTTLS, authentication, UTF-8 HTML support, timeouts, a dedicated executor, and reload support. * Added recovery-code expiration, maximum attempt limits, and cooldowns per player/IP. * Added `schema-version` support to persisted data. * Added automatic backups before destructive data operations. * Added UUID/IP-based lockout protection. * Added blindness effect support for pre-login protection. ### Changed * Updated `/email confirm` to correctly use `args[1]`. * Email recovery is now allowed before login. * Recovery codes now use `SecureRandom`. * Password recovery no longer sends or stores temporary plain-text passwords. * Players now set a new password directly using: ```txt /email confirm <code> <new-password> <confirm-password> ``` or: ```txt /resetpassword own ... ``` * Pre-login command protection now uses exact command matching. * Player visibility and effects are now properly cleaned up on quit and plugin disable. * `DataManager.java` now properly removes `players.<uuid>` entries and saves a clean data snapshot. ### Removed * Removed the plain-text temporary password recovery flow. * Removed MySQL and captcha settings from the default configuration. * Legacy captcha settings are now automatically disabled if found in old configuration files. ### Fixed * Fixed destructive persistence operations not fully removing player data. * Fixed stale or unsafe recovery behavior from the old password reset flow. * Fixed legacy configuration compatibility issues by enforcing valid YAML handling.