Specific authentication defect
In the supplied iBeast Login-Security code, the row counter advances twice and the final return permits login when multiple allowed-IP rows exist but none matches. M2City r1 replaces that control flow: any matching non-null row permits login; otherwise the request is denied. No rows still means the account has not enabled the optional allowlist.

Other narrowly scoped corrections
Null/empty inputs and a login longer than 64 bytes are denied. A failed database result is denied instead of dereferenced. Login bytes are encoded as a SQL hex literal so they cannot alter query syntax, without assuming a fork-specific escape API. SQLMsg ownership is released with unique_ptr. The implementation is guarded by ENABLE_LOGIN_SECURITY. Setup uses CREATE TABLE IF NOT EXISTS and does not drop existing allowlist data; an index is included only for new tables.

Branch checks and safe deployment
This is an integration for administrators who control their auth/game source, not a ready-made server binary. Confirm SQLMsg::Get()->pSQLResult and DBManager::DirectQuery ownership against your branch and build with C++11. Back up account.login_security and the executable. Create/verify the table before enabling the feature, merge the complete input_auth.cpp login-check block, add the NMIP locale response and build the required target in staging.
Test no rows, one matching row, multiple rows with one match, multiple rows with no match, query failure and an account with a changed IP. Database failure now denies login, so retain an operator rollback procedure. Existing tables are left unchanged: inspect their types and indexes rather than dropping them.
Use informed account-owner opt-in and a legitimate recovery/change process. Dynamic addresses and shared networks make an IP allowlist unsuitable as the sole authentication control. This is not MFA, HWID protection or a general anti-cheat.

Validation and attribution
All eight nonempty supplied files were reviewed. The actual revised C++ function passed isolated clang++ C++11 fake-database tests for absent, matching and nonmatching rows, multiple rows, nulls, database failure, special-character login encoding and object cleanup. No live MySQL integration, full auth-server build or end-to-end login test was performed. The ZIP retains the original iBeast archive, corrected sources, review and test code. Research did not establish an authoritative exact-version public release for this copy.

Editorial resource — M2City
Version: Legacy C++11 auth/game source; ENABLE_LOGIN_SECURITY; exact fork unspecified; M2City r1 (2026-11-04)
Rights: Public redistribution confirmed by supplying owner; original creator notices retained. No blanket open-source licence granted.
Validation: Full supplied small-package source review and isolated native regression tests; no complete client/server build or in-game runtime validation.
Source: Owner-supplied iBeast Login-Security archive; original notices retained
SHA-256: 12a8d25e39f91f2d23904afbfe7d580105197a5d0e8541717bc3e00eddbbbbc6