fix: more casino, economy, gameplay, security, and world data hardening gaps

1 files changed, 6 insertions, 1 deletions

diff --git a/internal/net/server.go b/internal/net/server.go
index 05a98d1..f56aebb 100644
--- a/internal/net/server.go
+++ b/internal/net/server.go
@@ -233,7 +233,7 @@ func (s *Server) sessionIdleTimeout(sess *Session) time.Duration {
 // anonymous flood targets), everything else gets a generous idle timeout.
 func sessionIdleTimeout(sess *Session) time.Duration {
 	switch sess.State() {
-	case StateAccountName, StatePassword:
+	case StateAccountName, StatePassword, StateNewAccountPass, StateNewAccount:
 		return loginReadTimeout
 	default:
 		return idleReadTimeout
@@ -555,6 +555,11 @@ func NewServer(cfg *config.Config) (*Server, error) {
 }
 
 func loadOrGenerateCert(cfg *config.Config, service string) (tls.Certificate, error) {
+	// A half-configured cert pair must fail loudly: silently falling back to a
+	// self-signed cert makes clients fail verification with a confusing error.
+	if (cfg.TLS.CertFile == "") != (cfg.TLS.KeyFile == "") {
+		return tls.Certificate{}, fmt.Errorf("%s: tls.cert_file and tls.key_file must be set together", service)
+	}
 	if cfg.TLS.CertFile != "" && cfg.TLS.KeyFile != "" {
 		return tls.LoadX509KeyPair(cfg.TLS.CertFile, cfg.TLS.KeyFile)
 	}