Pocketmine-mp: Name saving issue

[minijaham]

Issue description

Steps will explain.

Steps to reproduce the issue

1. Generate two accounts with same spelling but different capital usage(i.e. minijaham and mInIjaham).
2. Log in with the first account and give op.
3. Log in with second account and you should have op in that account as well.

OS and versions

• PocketMine-MP: First version - 3.17.3 https://github.com/pmmp/PocketMine-MP/commit/b296ae1b872aa0dbb6d118993aaab70913326b13
• PHP: 7.3
• Server OS:
• Game version: PE/Win10

Plugins

• If you remove all plugins, does the issue still occur?
  Yes
• If the issue is not reproducible without plugins:
  
  
  
  • Have you asked for help on our forums before creating an issue?
    
    I have, but I'm still waiting for an answer
  
  
  • Can you provide sample, minimal reproducing code for the issue? If so, paste it in the bottom section
    
    No reproducing code
  
  

Crashdump, backtrace or other files

[AkmalFairuz]

This bug cause from gamertag duplicate when creating account Xbox Live, not from server software.

[minijaham]

This was tested with other usernames as well.

A lot of servers actually had the same issue.

[AkmalFairuz]

Even Fallentech, Hyperlands, etc staff account got hacked by this method.

[minijaham]

Exactly. Thanks to alvin though, he's told me a solution to this...

[AkmalFairuz]

Have you report this bug to Microsoft or Xbox?

[minijaham]

Have you report this bug to Microsoft or Xbox?

Not yet.

[dktapps]

well done, you've just advertised a security vulnerability to hundreds of people...

I'm already aware of this issue thanks to people who informed me in a more responsible manner by emailing [email protected] or otherwise contacting us privately.

[minijaham]

How come the issue hasn't been solved yet, if you were already aware of it?

[AkmalFairuz]

Just wait Microsoft fix this bug. The solution is save real player gamertag without converted to lowercase.

[Ignaciox]

How come the issue hasn't been solved yet, if you were already aware of it?

Because the issue lays with xbox usernames being allowed to have other unicode letters in their names.