fix: close combat ghost, admin traversal, login throttle, journal double-pay, and quality/economy gaps

2 files changed, 8 insertions, 2 deletions

diff --git a/internal/player/password.go b/internal/player/password.go
index 5a43e1b..de5fe5f 100644
--- a/internal/player/password.go
+++ b/internal/player/password.go
@@ -120,7 +120,7 @@ func CheckPassword(password, stored string) bool {
 			return false
 		}
 		hash := sha256.Sum256(append(salt, []byte(password)...))
-		return legacy[2] == fmt.Sprintf("%x", hash)
+		return subtle.ConstantTimeCompare([]byte(legacy[2]), []byte(fmt.Sprintf("%x", hash))) == 1
 	default:
 		return false
 	}
diff --git a/internal/player/store.go b/internal/player/store.go
index 0b0e70e..5d69ec3 100644
--- a/internal/player/store.go
+++ b/internal/player/store.go
@@ -52,7 +52,13 @@ func writePrivate(path string, data []byte) error {
 	if err := persistence.WriteFile(path, data, 0600); err != nil {
 		return err
 	}
-	return os.Chmod(path, 0600)
+	// The file was already renamed into place; a chmod failure is a
+	// post-replacement durability-uncertain condition, not "nothing
+	// happened".
+	if err := os.Chmod(path, 0600); err != nil {
+		return fmt.Errorf("%w: chmod: %v", persistence.ErrDurabilityUncertain, err)
+	}
+	return nil
 }
 
 // MarshalAccount serializes an account; callers that own the account (the