Merge lp:~widelands-dev/widelands/bug-1827786-metaserver-login-box-clean-start into lp:widelands

[Toni Förster]

redesigned login box

- renamed to Online game Settings
- limit the possible characters for usernames
- draw a red box around the input field for erroneous input
- tell user were to register their username
- clicking registered checkbox focuses password field
- remove check from registered_ clears password field
- password field is only accessible when checkbox is clicked
- when a password is set, ***** is shown on opening
- login box handles the settings instead of multiplayer

multiplayer login redesign

- only show login dialog when no name or invalid name is set
- Group of 2 buttons for Online Game & Settings
- renamed Internet game to Online game
- moved settings saving to login box

[kaputtnik (franku)]

It would be good to have the registered checkbox above the password field. It would be a more logical ordering, imho.

[Toni Förster (stonerl)]

Your're right. Chnaged it.

[bunnybot (widelandsofficial)]

Continuous integration builds have changed state:

Travis build 4915. State: passed. Details: https://travis-ci.org/widelands/widelands/builds/529968856.
Appveyor build 4696. State: success. Details: https://ci.appveyor.com/project/widelands-dev/widelands/build/_widelands_dev_widelands_bug_1827786_metaserver_login_box-4696.

[Toni Förster (stonerl)]

Will address the strings later. For the others see the diff comments.

[bunnybot (widelandsofficial)]

Continuous integration builds have changed state:

Travis build 4925. State: errored. Details: https://travis-ci.org/widelands/widelands/builds/530433164.
Appveyor build 4706. State: success. Details: https://ci.appveyor.com/project/widelands-dev/widelands/build/_widelands_dev_widelands_bug_1827786_metaserver_login_box-4706.

[kaputtnik (franku)]

As talked on IRC: Can you try to remove the red border around the password editbox and instead show the string 'Password' and the corresponding editbox look sort of grayed out?

I think the text below can also be improved: "You need an account on the widelands website to use a registered account. Please visit ...."

[GunChleoc (gunchleoc)]

Changing editbox styles is implemented in https://code.launchpad.net/~widelands-dev/widelands/font_size-lua/+merge/366938, so we really need somebody to review that branch and make Toni's life easier.

[GunChleoc (gunchleoc)]

The changes string is missing a . after the %

I'll do some testing before I reply to the remaining diff comments.

[Toni Förster (stonerl)]

@kaputtnik

I addressed your comments. The only thing I can't do ATM is, greying out the password field.

[Toni Förster (stonerl)]

But I'm not confident whether we should grey the password field out as well. I would look too similar to an active edit box. Greying out the text "Password" and making the input box not editable should be sufficient, IMHO.

[Toni Förster (stonerl)]

This one gets replaced by the following one:

https://code.launchpad.net/~widelands-dev/widelands/bug-1827786-metaserver-login-box-clean-start/+merge/367312

[GunChleoc (gunchleoc)]

I have pushed a small tweak and added some more comments.

[bunnybot (widelandsofficial)]

Continuous integration builds have changed state:

Travis build 4956. State: passed. Details: https://travis-ci.org/widelands/widelands/builds/531407887.
Appveyor build 4737. State: success. Details: https://ci.appveyor.com/project/widelands-dev/widelands/build/_widelands_dev_widelands_bug_1827786_metaserver_login_box_clean_start-4737.

[kaputtnik (franku)]

Looks good, imho. Graying out the 'Password' is sufficient :-)

The green arrow on the right of 'Internet Game' is always shown now? -> I tried to start widelands with a new homedir, and the green arrow was shown.

Don't forget to remove the 'red border' thing from the commit message please ;)

[GunChleoc (gunchleoc)]

It does not solve comment #1 in the attached bug though:

> We should also add a password mode to the Editbox class that will show *** instead of the actual text.

So, either open a new bug before merging, or fix it in this branch.

[Toni Förster (stonerl)]

Please test again it should address all issues. The only problem is that the caret does not move properly. Help is appreciated. :)

@Gun have a look at the diff comment, please.

[Toni Förster (stonerl)]

Carets are also fixed.

[Toni Förster (stonerl)]

I made the "show login dialog" button a proper button. kaputtnik has second thoughts, though.

here is a screenshot:

https://i.ibb.co/b3W3x3W/internetgame.png

[bunnybot (widelandsofficial)]

Continuous integration builds have changed state:

Travis build 4976. State: errored. Details: https://travis-ci.org/widelands/widelands/builds/532515887.
Appveyor build 4757. State: success. Details: https://ci.appveyor.com/project/widelands-dev/widelands/build/_widelands_dev_widelands_bug_1827786_metaserver_login_box_clean_start-4757.

[Toni Förster (stonerl)]

I could think of another option. We remove the button entirely. The login window is always shown for non registered users. When a user has entered a password, the dialog won't be shown as long as the password is valid.

[GunChleoc (gunchleoc)]

That would not allow different players to use the same computer, because you can never log out when the password is correct.

I'd say revert the changes for now and let's think about having a logout button in the lobby.

Regarding the user name validation, this should be implemented in internet gaming somewhere, not in editbox. The editbox is a UI element and should not care about what a well-formed user name is. That way, you could also get rid of the remaining code duplication.

I have tested the password display and it's working fine :)

[Toni Förster (stonerl)]

I have moved username validation to internet gaming.

I'm currently experimenting with a logout button stay tuned :=)

[Toni Förster (stonerl)]

We have a logout button now :D

The login dialog will be shown only for non registered users. Registered users may log out from their account from within the lobby.

The additional login button from the Multiplayer menu is removed.

[kaputtnik (franku)]

I am not convinced by this solution, it is confusing:

1. We have two places (views) which interact with the same thing now.
2. We have two buttons, 'Logout' and 'Back', in the lobby now, which do the same at first sight: Go back to the 'Multiplayer' view. How will a tooltip, if there were any, look to explain the buttons?

Having it like before is better, imho, although the small icon (button) to show the loginbox is visually disturbing. But better a visually disturbing thing than a confusing UI, especially because the Multiplayer view is mostly open for a short time.

Just my personal opinion :)

[Toni Förster (stonerl)]

Well another solution would be:

We rename the back button to "Leave lobby"
Above the button we have a checkbox "Clear login data"

[kaputtnik (franku)]

> We rename the back button to "Leave lobby"
> Above the button we have a checkbox "Clear login data"

"Leave lobby and clear login data" would be the correct explanation. But it's confusing anyway to have this in the lobby.

Maybe i am too nitpicking ;)

[bunnybot (widelandsofficial)]

Continuous integration builds have changed state:

Travis build 4988. State: passed. Details: https://travis-ci.org/widelands/widelands/builds/532926409.
Appveyor build 4769. State: success. Details: https://ci.appveyor.com/project/widelands-dev/widelands/build/_widelands_dev_widelands_bug_1827786_metaserver_login_box_clean_start-4769.

[Toni Förster (stonerl)]

Hmm, I'm still uncertain. What about this?

https://fosuta.org/pics/multi-settings.png

I have to flesh out the details, though. Bu would this Screen look okay?

[Toni Förster (stonerl)]

I gave it another run. The button is now called “Login settings” and sits in between the “LAN / Direct IP” ans “Back”.[1] The Title of the Login box has be renamed accordingly, also the “Login” button has been renamed to “Save”.[2]

The window opens automatically when no username or an invalid username is set or the wrong password has been entered. Otherwise, the user has to click the button. Clicking on “Save” in the box only closes the window but does not login automatically.

[1]https://fosuta.org/pics/multi-new.png
[2]https://fosuta.org/pics/login-new.png

[kaputtnik (franku)]

Ordering the buttons like here https://i.ibb.co/b3W3x3W/internetgame.png is more logical, imho, because the 'Login settings' belongs to 'Internet Game'. And maybe rename 'Login Settings' to 'Internet Settings'? So a user can directly associate that the two buttons belongs to the same thing.

All the rest is fine for me :-)

[GunChleoc (gunchleoc)]

How abut calling the "Back" button "Leave Lobby" rather than "Log Out"?

[Toni Förster (stonerl)]

I renamed the back button

Reorder button on the multiplayer screen.

I took the liberty to rename “Internet game” because this is the common term nowadays (e.g. Wikipedia redirects form Internet game to Online game). I also renamed the settings button to “Online game Settings”

@Gun is it:

1. Online game settings
2. Online game Settings
2. Online Game Settings

I went for number 2.

[GunChleoc (gunchleoc)]

Buttons use Title Case, so:

Online Game
Online Game Settings

[kaputtnik (franku)]

Hm, there is some inconsistency and an assertion:

1. Start widelands
2. Set a wrong password -> No hint about wrong password -> Login dialog closes
3. Trying to get into the lobby shows now a warning -> Loginbox appear
4. Set a wrong password again -> now the warning appears immediately
5. Close dialog by pressing 'Cancel' (did not test right click to close it)
6. Try to enter the lobby -> Assertion:

widelands: /home/kaputtnik/Quellcode/widelands-repo/bug-1827786-metaserver-login-box-clean-start/src/ui_fsmenu/multiplayer.cc:134: void FullscreenMenuMultiPlayer::internet_login(): Assertion `!auth.empty()' failed.

If feasible the warning about wrong password should appear also in step 2.

I am fine with the wording though :-)

review: Needs Fixing

[Toni Förster (stonerl)]

Can you give it another try?

[kaputtnik (franku)]

Popup if wrong password is set works now. But i can still provoke the Assertion:

1. Open the settings
2. Enter a wrong password and close the popup
3. Click cancel
4. Try to connect with the metaserver (click on Online Game)

Running widelands with a new home directory does not show this error.

[kaputtnik (franku)]

Setting a correct password and clicking on 'Save' connects immediately to the lobby and immediately disconnect again. One can see this in channel #widelands on IRC.

But the assert is gone now :-)

[Toni Förster (stonerl)]

> Setting a correct password and clicking on 'Save' connects immediately to the
> lobby and immediately disconnect again. One can see this in channel #widelands
> on IRC.
>

That is currently the only way to check whether the password was correct or not.

[Toni Förster (stonerl)]

Also, this needs to be resolved on the Metaserver side.

[kaputtnik (franku)]

Ok, we may need to file a bug against the metaserver then.

This branch is ok for me now :-)

review: Approve (testing)

[GunChleoc (gunchleoc)]

Code LGTM.

One tweak I'd like to see after testing:

Error message "The sent password was incorrect!" - call it "Wrong password" or "Wrong password, please try again." The user doesn't care about the technical detail that it was sent. This is coming from the metaserver, so I have opened a but over there. https://github.com/widelands/widelands_metaserver/issues/53

[GunChleoc (gunchleoc)]

@bunnybot merge

review: Approve

=== modified file 'src/network/internet_gaming.cc'
--- src/network/internet_gaming.cc	2019-05-13 02:25:58 +0000
+++ src/network/internet_gaming.cc	2019-05-23 17:11:42 +0000
@@ -947,3 +947,14 @@
 		ingame_system_chat_.push_back(c);
 	}
 }
+
+/**
+ * Check for vaild username characters.
+ */
+bool InternetGaming::valid_username(std::string username) {
+	if (username.empty() || username.find_first_not_of("abcdefghijklmnopqrstuvwxyz"
+			"ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890@.+-_") <= username.size()) {
+				return false;
+	}
+	return true;
+}
 
=== modified file 'src/network/internet_gaming.h'
--- src/network/internet_gaming.h	2019-05-11 22:02:09 +0000
+++ src/network/internet_gaming.h	2019-05-23 17:11:42 +0000
@@ -183,6 +183,8 @@
 	                         bool system,
 	                         const std::string& msg);
 
+	bool valid_username(std::string);
+
 private:
 	InternetGaming();
 
 
=== modified file 'src/ui_basic/editbox.cc'
--- src/ui_basic/editbox.cc	2019-05-13 02:25:58 +0000
+++ src/ui_basic/editbox.cc	2019-05-23 17:11:42 +0000
@@ -19,7 +19,9 @@
 
 #include "ui_basic/editbox.h"
 
+#include <algorithm>
 #include <limits>
+#include <string>
 
 #include <SDL_keycode.h>
 #include <boost/format.hpp>
@@ -86,7 +88,8 @@
      m_(new EditBoxImpl),
      history_active_(false),
      history_position_(-1),
-     warning_(false) {
+	  password_(false),
+	  warning_(false) {
 	set_thinks(false);
 
 	m_->background_style = g_gr->styles().editbox_style(style);
@@ -388,7 +391,8 @@
 	const int max_width = get_w() - 2 * kMarginX;
 
 	std::shared_ptr<const UI::RenderedText> rendered_text =
-	   UI::g_fh->render(as_editorfont(m_->text, m_->fontsize));
+		UI::g_fh->render(as_editorfont(m_->text, m_->fontsize));
+
 
 	const int linewidth = rendered_text->width();
 	const int lineheight = m_->text.empty() ? text_height(m_->fontsize) : rendered_text->height();
@@ -400,31 +404,44 @@
 	UI::center_vertically(lineheight, &point);
 
 	// Crop to max_width while blitting
-	if (max_width < linewidth) {
-		// Fix positioning for BiDi languages.
-		if (UI::g_fh->fontset()->is_rtl()) {
-			point.x = 0.f;
-		}
-		// We want this always on, e.g. for mixed language savegame filenames
-		if (i18n::has_rtl_character(m_->text.c_str(), 100)) {  // Restrict check for efficiency
-			// TODO(GunChleoc): Arabic: Fix scrolloffset
-			rendered_text->draw(dst, point, Recti(linewidth - max_width, 0, linewidth, lineheight));
-		} else {
-			if (m_->align == UI::Align::kRight) {
+	if (!password_) {
+		if (max_width < linewidth) {
+			// Fix positioning for BiDi languages.
+			if (UI::g_fh->fontset()->is_rtl()) {
+				point.x = 0.f;
+			}
+			// We want this always on, e.g. for mixed language savegame filenames
+			if (i18n::has_rtl_character(m_->text.c_str(), 100)) {  // Restrict check for efficiency
 				// TODO(GunChleoc): Arabic: Fix scrolloffset
-				rendered_text->draw(
-				   dst, point, Recti(point.x + m_->scrolloffset + kMarginX, 0, max_width, lineheight));
+				rendered_text->draw(dst, point, Recti(linewidth - max_width, 0, linewidth, lineheight));
 			} else {
-				rendered_text->draw(dst, point, Recti(-m_->scrolloffset, 0, max_width, lineheight));
+				if (m_->align == UI::Align::kRight) {
+					// TODO(GunChleoc): Arabic: Fix scrolloffset
+					rendered_text->draw(
+					   dst, point, Recti(point.x + m_->scrolloffset + kMarginX, 0, max_width, lineheight));
+				} else {
+					rendered_text->draw(dst, point, Recti(-m_->scrolloffset, 0, max_width, lineheight));
+				}
 			}
+		} else {
+			rendered_text->draw(dst, point, Recti(0, 0, max_width, lineheight));
 		}
 	} else {
-		rendered_text->draw(dst, point, Recti(0, 0, max_width, lineheight));
+		std::shared_ptr<const UI::RenderedText> password_text =
+			UI::g_fh->render(as_editorfont(text_to_asterisk(), m_->fontsize));
+		password_text->draw(dst, point, Recti(0, 0, max_width, lineheight));
 	}
 
 	if (has_focus()) {
 		// Draw the caret
-		std::string line_to_caret = m_->text.substr(0, m_->caret);
+		std::string line_to_caret;
+
+		if (password_) {
+			line_to_caret = text_to_asterisk().substr(0, m_->caret);
+		} else {
+			line_to_caret = m_->text.substr(0, m_->caret);
+		}
+
 		// TODO(GunChleoc): Arabic: Fix cursor position for BIDI text.
 		int caret_x = text_width(line_to_caret, m_->fontsize);
 
@@ -471,4 +488,15 @@
 			m_->scrolloffset = 0;
 	}
 }
+
+/**
+ * Return text as asterisks.
+ */
+std::string EditBox::text_to_asterisk() {
+	std::string asterisk;
+	for (int i = 0; i < int (m_->text.size()); i++) {
+		asterisk.append("*");
+	}
+	return asterisk;
+}
 }  // namespace UI
 
=== modified file 'src/ui_basic/editbox.h'
--- src/ui_basic/editbox.h	2019-05-11 22:02:09 +0000
+++ src/ui_basic/editbox.h	2019-05-23 17:11:42 +0000
@@ -72,18 +72,28 @@
 
 	void draw(RenderTarget&) override;
 
+	void set_password(bool pass) {
+		password_ = pass;
+	}
+
 	void set_warning(bool warn) {
 		warning_ = warn;
 	}
 
+	bool is_password() {
+		return password_;
+	}
+
 private:
 	std::unique_ptr<EditBoxImpl> m_;
 
 	void check_caret();
+	std::string text_to_asterisk();
 
 	bool history_active_;
 	int16_t history_position_;
 	std::string history_[CHAT_HISTORY_SIZE];
+	bool password_;
 	bool warning_;
 };
 }  // namespace UI
 
=== modified file 'src/ui_fsmenu/internet_lobby.cc'
--- src/ui_fsmenu/internet_lobby.cc	2019-05-13 02:25:58 +0000
+++ src/ui_fsmenu/internet_lobby.cc	2019-05-23 17:11:42 +0000
@@ -78,7 +78,7 @@
      hostgame_(this,
                "host_game",
                get_w() * 17 / 25,
-               get_h() * 81 / 100,
+               get_h() * 73 / 100,
                butw_,
                buth_,
                UI::ButtonStyle::kFsMenuSecondary,
@@ -90,7 +90,7 @@
            butw_,
            buth_,
            UI::ButtonStyle::kFsMenuSecondary,
-           _("Back")),
+           _("Leave Lobby")),
 
      // Edit boxes
      edit_servername_(
@@ -165,6 +165,7 @@
 
 	// set focus to chat input
 	chat.focus_edit();
+
 }
 
 void FullscreenMenuInternetLobby::layout() {
 
=== modified file 'src/ui_fsmenu/multiplayer.cc'
--- src/ui_fsmenu/multiplayer.cc	2019-05-11 18:50:30 +0000
+++ src/ui_fsmenu/multiplayer.cc	2019-05-23 17:11:42 +0000
@@ -21,7 +21,6 @@
 
 #include "base/i18n.h"
 #include "graphic/text_constants.h"
-#include "network/crypto.h"
 #include "network/internet_gaming.h"
 #include "profile/profile.h"
 #include "random/random.h"
@@ -36,9 +35,10 @@
 
      // Buttons
      metaserver(
-        &vbox_, "metaserver", 0, 0, butw_, buth_, UI::ButtonStyle::kFsMenuMenu, _("Internet game")),
-     showloginbox(nullptr),
+        &vbox_, "metaserver", 0, 0, butw_, buth_, UI::ButtonStyle::kFsMenuMenu, _("Online Game")),
      lan(&vbox_, "lan", 0, 0, butw_, buth_, UI::ButtonStyle::kFsMenuMenu, _("LAN / Direct IP")),
+	  showloginbox(
+		  &vbox_, "lan", 0, 0, butw_, buth_, UI::ButtonStyle::kFsMenuMenu, _("Online Game Settings")),
      back(&vbox_, "back", 0, 0, butw_, buth_, UI::ButtonStyle::kFsMenuMenu, _("Back")) {
 	metaserver.sigclicked.connect(
 	   boost::bind(&FullscreenMenuMultiPlayer::internet_login, boost::ref(*this)));
@@ -47,6 +47,9 @@
 	   boost::bind(&FullscreenMenuMultiPlayer::end_modal<FullscreenMenuBase::MenuTarget>,
 	               boost::ref(*this), FullscreenMenuBase::MenuTarget::kLan));
 
+	showloginbox.sigclicked.connect(
+		boost::bind(&FullscreenMenuMultiPlayer::show_internet_login, boost::ref(*this)));
+
 	back.sigclicked.connect(
 	   boost::bind(&FullscreenMenuMultiPlayer::end_modal<FullscreenMenuBase::MenuTarget>,
 	               boost::ref(*this), FullscreenMenuBase::MenuTarget::kBack));
@@ -54,73 +57,50 @@
 	title.set_fontsize(fs_big());
 
 	vbox_.add(&metaserver, UI::Box::Resizing::kFullSize);
+	vbox_.add(&showloginbox, UI::Box::Resizing::kFullSize);
+	vbox_.add_inf_space();
 	vbox_.add(&lan, UI::Box::Resizing::kFullSize);
 	vbox_.add_inf_space();
+	vbox_.add_inf_space();
+	vbox_.add_inf_space();
 	vbox_.add(&back, UI::Box::Resizing::kFullSize);
 
-	Section& s = g_options.pull_section("global");
-	auto_log_ = s.get_bool("auto_log", false);
-	if (auto_log_) {
-		showloginbox =
-		   new UI::Button(this, "login_dialog", 0, 0, 0, 0, UI::ButtonStyle::kFsMenuSecondary,
-		                  g_gr->images().get("images/ui_basic/continue.png"), _("Show login dialog"));
-		showloginbox->sigclicked.connect(
-		   boost::bind(&FullscreenMenuMultiPlayer::show_internet_login, boost::ref(*this)));
-	}
+	auto_log_ = false;
 	layout();
 }
 
-/// called if the showloginbox button was pressed
+/// called if the user is not registered
 void FullscreenMenuMultiPlayer::show_internet_login() {
-	auto_log_ = false;
-	internet_login();
+	LoginBox lb(*this);
+	if (lb.run<UI::Panel::Returncodes>() == UI::Panel::Returncodes::kOk && auto_log_) {
+		auto_log_ = false;
+		internet_login();
+	}
 }
 
 /**
- * Called if "Internet" button was pressed.
- *
- * IF autologin is not set, a LoginBox is shown and, if the user clicks on
- * 'login' in it's menu, the data is read from the LoginBox and saved in 'this'
- * so wlapplication can read it.
- *
- * IF autologin is set, all data is read from the config file and saved.
- * That data will be used for login to the metaserver.
- *
- * In both cases this fullscreen menu ends it's modality.
+ * Called if "Online Game" button was pressed.
+ *
+ * IF no nickname or a nickname with invalid characters is set, the Online Game Settings
+ * are opened.
+ *
+ * IF at least a name is set, all data is read from the config file
+ *
+ * This fullscreen menu ends it's modality.
  */
 void FullscreenMenuMultiPlayer::internet_login() {
 	Section& s = g_options.pull_section("global");
-	if (auto_log_) {
-		nickname_ = s.get_string("nickname", _("nobody"));
-		password_ = s.get_string("password_sha1", "nobody");
-		register_ = s.get_bool("registered", false);
-	} else {
-		LoginBox lb(*this);
-		if (lb.run<UI::Panel::Returncodes>() == UI::Panel::Returncodes::kOk) {
-			nickname_ = lb.get_nickname();
-			/// NOTE: The password is only stored (in memory and on disk) and transmitted (over the
-			/// network
-			/// to the metaserver) as cryptographic hash. This does NOT mean that the password is
-			/// stored
-			/// securely on the local disk. While the password should be secure while transmitted to
-			/// the
-			/// metaserver (no-one can use the transmitted data to log in as the user) this is not the
-			/// case
-			/// for local storage. The stored hash of the password makes it hard to look at the
-			/// configuration
-			/// file and figure out the plaintext password to, e.g., log in on the forum. However, the
-			/// stored hash can be copied to another system and used to log in as the user on the
-			/// metaserver.
-			// Further note: SHA-1 is considered broken and shouldn't be used anymore. But since the
-			// passwords on the server are protected by SHA-1 we have to use it here, too
-			password_ = crypto::sha1(lb.get_password());
-			register_ = lb.registered();
-
-			s.set_bool("registered", lb.registered());
-			s.set_bool("auto_log", lb.set_automaticlog());
-		} else {
-			return;
-		}
+
+	nickname_ = s.get_string("nickname", "");
+	password_ = s.get_string("password_sha1", "no_password_set");
+	register_ = s.get_bool("registered", false);
+
+	// Checks can be done directly in editbox' by using valid_username().
+	// This is just to be on the safe side, in case the user changed the password in the config file.
+	if (!InternetGaming::ref().valid_username(nickname_)) {
+		auto_log_ = true;
+		show_internet_login();
+		return;
 	}
 
 	// Try to connect to the metaserver
@@ -141,7 +121,8 @@
 
 		// Reset InternetGaming and passwort and show internet login again
 		InternetGaming::ref().reset();
-		s.set_string("password_sha1", "");
+		s.set_string("password_sha1", "no_password_set");
+		auto_log_ = true;
 		show_internet_login();
 	}
 }
@@ -156,12 +137,8 @@
 
 	title.set_pos(Vector2i(0, title_y_));
 
-	metaserver.set_size(butw_, buth_);
-	if (showloginbox) {
-		showloginbox->set_pos(Vector2i(box_x_ + butw_ + padding_ / 2, box_y_));
-		showloginbox->set_size(buth_, buth_);
-	}
 	metaserver.set_desired_size(butw_, buth_);
+	showloginbox.set_desired_size(butw_, buth_);
 	lan.set_desired_size(butw_, buth_);
 	back.set_desired_size(butw_, buth_);
 
 
=== modified file 'src/ui_fsmenu/multiplayer.h'
--- src/ui_fsmenu/multiplayer.h	2019-05-11 18:50:30 +0000
+++ src/ui_fsmenu/multiplayer.h	2019-05-23 17:11:42 +0000
@@ -53,15 +53,15 @@
 
 	UI::Textarea title;
 	UI::Button metaserver;
-	UI::Button* showloginbox;
 	UI::Button lan;
+	UI::Button showloginbox;
 	UI::Button back;
 
 	// Values from internet login window
 	std::string nickname_;
 	std::string password_;
+	bool auto_log_;
 	bool register_;
-	bool auto_log_;
 };
 
 #endif  // end of include guard: WL_UI_FSMENU_MULTIPLAYER_H
 
=== modified file 'src/wui/login_box.cc'
--- src/wui/login_box.cc	2019-05-11 18:50:30 +0000
+++ src/wui/login_box.cc	2019-05-23 17:11:42 +0000
@@ -21,75 +21,89 @@
 
 #include "base/i18n.h"
 #include "graphic/font_handler.h"
+#include "network/crypto.h"
+#include "network/internet_gaming.h"
 #include "profile/profile.h"
 #include "ui_basic/button.h"
 #include "ui_basic/messagebox.h"
 
 LoginBox::LoginBox(Panel& parent)
-   : Window(&parent, "login_box", 0, 0, 500, 220, _("Metaserver login")) {
+   : Window(&parent, "login_box", 0, 0, 500, 280, _("Online Game Settings")) {
 	center_to_parent();
 
 	int32_t margin = 10;
 
 	ta_nickname = new UI::Textarea(this, margin, margin, _("Nickname:"));
-	ta_password = new UI::Textarea(this, margin, 40, _("Password:"));
+	ta_password = new UI::Textarea(this, margin, 70, _("Password:"));
 	eb_nickname = new UI::EditBox(this, 150, margin, 330, 20, 2, UI::PanelStyle::kWui);
-	eb_password = new UI::EditBox(this, 150, 40, 330, 20, 2, UI::PanelStyle::kWui);
-
-	pwd_warning =
-	   new UI::MultilineTextarea(this, margin, 65, 505, 50, UI::PanelStyle::kWui,
-	                             _("WARNING: Password will be shown and saved readable!"));
-
-	cb_register = new UI::Checkbox(this, Vector2i(margin, 110), _("Log in to a registered account"),
+	eb_password = new UI::EditBox(this, 150, 70, 330, 20, 2, UI::PanelStyle::kWui);
+
+	cb_register = new UI::Checkbox(this, Vector2i(margin, 40), _("Log in to a registered account."),
 	                               "", get_inner_w() - 2 * margin);
-	cb_auto_log = new UI::Checkbox(this, Vector2i(margin, 135),
-	                               _("Automatically use this login information from now on."), "",
-	                               get_inner_w() - 2 * margin);
-
-	UI::Button* loginbtn = new UI::Button(
+
+	register_account = new UI::MultilineTextarea(this, margin, 105, 470, 140, UI::PanelStyle::kWui,
+			(boost::format(_("In order to use a registered "
+				"account, you need an account on the widelands website. "
+				"Please log in at %s and set an online "
+				"gaming password on your profile page."))
+				% "\n\nhttps://widelands.org/accounts/register/\n\n").str());
+
+	loginbtn = new UI::Button(
 	   this, "login",
 	   UI::g_fh->fontset()->is_rtl() ? (get_inner_w() / 2 - 200) / 2 :
 	                                   (get_inner_w() / 2 - 200) / 2 + get_inner_w() / 2,
-	   get_inner_h() - 20 - margin, 200, 20, UI::ButtonStyle::kWuiPrimary, _("Login"));
-	loginbtn->sigclicked.connect(boost::bind(&LoginBox::clicked_ok, boost::ref(*this)));
-	UI::Button* cancelbtn = new UI::Button(
+	   get_inner_h() - 20 - margin, 200, 20, UI::ButtonStyle::kWuiPrimary, _("Save"));
+
+	cancelbtn = new UI::Button(
 	   this, "cancel",
 	   UI::g_fh->fontset()->is_rtl() ? (get_inner_w() / 2 - 200) / 2 + get_inner_w() / 2 :
 	                                   (get_inner_w() / 2 - 200) / 2,
 	   loginbtn->get_y(), 200, 20, UI::ButtonStyle::kWuiSecondary, _("Cancel"));
+
+	loginbtn->sigclicked.connect(boost::bind(&LoginBox::clicked_ok, boost::ref(*this)));
 	cancelbtn->sigclicked.connect(boost::bind(&LoginBox::clicked_back, boost::ref(*this)));
+	eb_nickname->changed.connect(boost::bind(&LoginBox::change_playername, this));
+	cb_register->clickedto.connect(boost::bind(&LoginBox::clicked_register, this));
 
 	Section& s = g_options.pull_section("global");
 	eb_nickname->set_text(s.get_string("nickname", _("nobody")));
 	cb_register->set_state(s.get_bool("registered", false));
+	eb_password->set_password(true);
+
+	if (registered()) {
+		eb_password->set_text(s.get_string("password_sha1", ""));
+		loginbtn->set_enabled(false);
+	} else {
+		eb_password->set_can_focus(false);
+		ta_password->set_color(UI_FONT_CLR_DISABLED);
+	}
+
 	eb_nickname->focus();
+
+}
+
+/// think function of the UI (main loop)
+void LoginBox::think() {
+	verify_input();
 }
 
 /**
  * called, if "login" is pressed.
  */
 void LoginBox::clicked_ok() {
-	// Check if all needed input fields are valid
-	if (eb_nickname->text().empty()) {
-		UI::WLMessageBox mb(
-		   this, _("Empty Nickname"), _("Please enter a nickname!"), UI::WLMessageBox::MBoxType::kOk);
-		mb.run<UI::Panel::Returncodes>();
-		return;
-	}
-	if (eb_nickname->text().find(' ') <= eb_nickname->text().size()) {
-		UI::WLMessageBox mb(this, _("Space in Nickname"),
-		                    _("Sorry, but spaces are not allowed in nicknames!"),
-		                    UI::WLMessageBox::MBoxType::kOk);
-		mb.run<UI::Panel::Returncodes>();
-		return;
-	}
-	if (eb_password->text().empty() && cb_register->get_state()) {
-		UI::WLMessageBox mb(this, _("Empty Password"), _("Please enter your password!"),
-		                    UI::WLMessageBox::MBoxType::kOk);
-		mb.run<UI::Panel::Returncodes>();
-		return;
-	}
-	end_modal<UI::Panel::Returncodes>(UI::Panel::Returncodes::kOk);
+	Section& s = g_options.pull_section("global");
+	if (cb_register->get_state()) {
+		if (check_password()) {
+			s.set_string("nickname", eb_nickname->text());
+			s.set_bool("registered", true);
+			end_modal<UI::Panel::Returncodes>(UI::Panel::Returncodes::kOk);
+		}
+	} else {
+		s.set_string("nickname", eb_nickname->text());
+		s.set_bool("registered", false);
+		s.set_string("password_sha1", "");
+		end_modal<UI::Panel::Returncodes>(UI::Panel::Returncodes::kOk);
+	}
 }
 
 /// Called if "cancel" was pressed
@@ -97,6 +111,13 @@
 	end_modal<UI::Panel::Returncodes>(UI::Panel::Returncodes::kBack);
 }
 
+/// Called when nickname was changed
+void LoginBox::change_playername() {
+	cb_register->set_state(false);
+	eb_password->set_can_focus(false);
+	eb_password->set_text("");
+}
+
 bool LoginBox::handle_key(bool down, SDL_Keysym code) {
 	if (down) {
 		switch (code.sym) {
@@ -113,3 +134,80 @@
 	}
 	return UI::Panel::handle_key(down, code);
 }
+
+void LoginBox::clicked_register() {
+	if (cb_register->get_state()) {
+		ta_password->set_color(UI_FONT_CLR_DISABLED);
+		eb_password->set_can_focus(false);
+		eb_password->set_text("");
+	} else {
+		ta_password->set_color(UI_FONT_CLR_FG);
+		eb_password->set_can_focus(true);
+	}
+}
+
+void LoginBox::verify_input() {
+	// Check if all neccessary input fields are valid
+	loginbtn->set_enabled(true);
+	eb_nickname->set_tooltip("");
+	eb_password->set_tooltip("");
+	eb_nickname->set_warning(false);
+
+	if (eb_nickname->text().empty()) {
+		eb_nickname->set_warning(true);
+		eb_nickname->set_tooltip(_("Please enter a nickname!"));
+		loginbtn->set_enabled(false);
+	} else if (!InternetGaming::ref().valid_username(eb_nickname->text())) {
+			eb_nickname->set_warning(true);
+			eb_nickname->set_tooltip(_("Enter a valid nickname. This value may contain only "
+													  "English letters, numbers, and @ . + - _ characters."));
+			loginbtn->set_enabled(false);
+	}
+
+	if (eb_password->text().empty() && cb_register->get_state()) {
+		eb_password->set_tooltip(_("Please enter your password!"));
+		loginbtn->set_enabled(false);
+		eb_password->focus();
+	}
+
+	Section& s = g_options.pull_section("global");
+	if (eb_password->has_focus() && eb_password->text() == s.get_string("password_sha1", "")) {
+		eb_password->set_text("");
+	}
+
+	if (cb_register->get_state() && eb_password->text() == s.get_string("password_sha1", "")) {
+		loginbtn->set_enabled(false);
+	}
+}
+
+/// Check password against metaserver
+bool LoginBox::check_password() {
+	// Try to connect to the metaserver
+	Section& s = g_options.pull_section("global");
+	const std::string& meta = s.get_string("metaserver", INTERNET_GAMING_METASERVER.c_str());
+	uint32_t port = s.get_natural("metaserverport", kInternetGamingPort);
+	std::string password = crypto::sha1(eb_password->text());
+	InternetGaming::ref().login(get_nickname(), password, true, meta, port);
+
+	if (!InternetGaming::ref().logged_in()) {
+		// something went wrong -> show the error message
+		// idealy it is about the wrong password
+		ChatMessage msg = InternetGaming::ref().get_messages().back();
+		UI::WLMessageBox wmb(this, _("Error!"), msg.msg, UI::WLMessageBox::MBoxType::kOk);
+		wmb.run<UI::Panel::Returncodes>();
+		InternetGaming::ref().reset();
+		eb_password->set_text("");
+		eb_password->focus();
+		return false;
+	}
+	// NOTE: The password is only stored (in memory and on disk) and transmitted (over the network to the metaserver) as cryptographic hash.
+	// This does NOT mean that the password is stored securely on the local disk.
+	// While the password should be secure while transmitted to the metaserver (no-one can use the transmitted data to log in as the user) this is not the case for local storage.
+	// The stored hash of the password makes it hard to look at the configuration file and figure out the plaintext password to, e.g., log in on the forum.
+	// However, the stored hash can be copied to another system and used to log in as the user on the metaserver.
+	// Further note: SHA-1 is considered broken and shouldn't be used anymore. But since the
+	// passwords on the server are protected by SHA-1 we have to use it here, too
+	s.set_string("password_sha1", password);
+	InternetGaming::ref().logout();
+	return true;
+}
 
=== modified file 'src/wui/login_box.h'
--- src/wui/login_box.h	2019-05-11 18:50:30 +0000
+++ src/wui/login_box.h	2019-05-23 17:11:42 +0000
@@ -29,6 +29,8 @@
 struct LoginBox : public UI::Window {
 	explicit LoginBox(UI::Panel&);
 
+	void think() override;
+
 	std::string get_nickname() {
 		return eb_nickname->text();
 	}
@@ -38,24 +40,26 @@
 	bool registered() {
 		return cb_register->get_state();
 	}
-	bool set_automaticlog() {
-		return cb_auto_log->get_state();
-	}
 
 	/// Handle keypresses
 	bool handle_key(bool down, SDL_Keysym code) override;
 
 private:
+	void change_playername();
 	void clicked_back();
 	void clicked_ok();
+	void clicked_register();
+	void verify_input();
+	bool check_password();
 
+	UI::Button* loginbtn;
+	UI::Button* cancelbtn;
 	UI::EditBox* eb_nickname;
 	UI::EditBox* eb_password;
 	UI::Checkbox* cb_register;
-	UI::Checkbox* cb_auto_log;
 	UI::Textarea* ta_nickname;
 	UI::Textarea* ta_password;
-	UI::MultilineTextarea* pwd_warning;
+	UI::MultilineTextarea* register_account;
 };
 
 #endif  // end of include guard: WL_WUI_LOGIN_BOX_H