xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-16 16:21:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed a lot bugs/security exploits

Browse Source 
Profiles can't be hacked anymore, added some security control and
removed those malicious "hidden uid"
Errors now are now shown correctly while editing the profile
The level of the research you're doing in the Blacksmith/Armoury is now
displayed in the research queue
Hugely fixed the battle system, a big thanks to kirilloid for helping me
by providing his formulas :)!
Some general clean-up and bug fixing of little errors
Added some string constants to the language file (en.php)
This commit is contained in:
iopietro
2018-04-07 22:16:28 +02:00
parent f341c209b8
commit 0132af4611
12 changed files with 126 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Templates/Profile/account.tpl
+9 -10
View File
@@ -3,7 +3,6 @@
<?php include("menu.tpl"); ?>
<form action="spieler.php" method="POST">
<input type="hidden" name="ft" value="p3">
<input type="hidden" name="uid" value="<?php echo $session->uid; ?>" />
<table cellpadding="1" cellspacing="1" id="change_pass" class="account">
<thead><tr>
<th colspan="2">Change password</th>
@@ -22,8 +21,8 @@
<td><input class="text" type="password" name="pw3" maxlength="30" /></td>
</tr></tbody></table>
<?php
if($form->getError("pw") != "") {
echo "<span class=\"error\">".$form->getError('pw')."</span>";
if(!empty($passError = $form->getError("pw"))) {
echo "<span class=\"error\">".$passError."</span>";
}
?>
<table cellpadding="1" cellspacing="1" id="change_mail" class="account"><thead><tr>
@@ -42,8 +41,8 @@ echo "<span class=\"error\">".$form->getError('pw')."</span>";
<td><input class="text" type="text" name="email_neu" /></td>
</tr></tbody></table>
<?php
if($form->getError("email") != "") {
echo "<span class=\"error\">".$form->getError('email')."</span>";
if(!empty($emailError = $form->getError("email"))) {
echo "<span class=\"error\">".$emailError."</span>";
}
?>
<table cellpadding="1" cellspacing="1" id="sitter" class="account"><thead>
@@ -96,8 +95,8 @@ echo "<a href=\"spieler.php?uid=".$sit['id']."\">".$database->getUserField($sit[
?>
</td></tr></table>
<?php
if($form->getError("email") != "") {
echo "<span class=\"error\">".$form->getError('email')."</span>";
if(!empty($sitterError = $form->getError("sit"))) {
echo "<span class=\"error\">".$sitterError."</span>";
}
?>
<table cellpadding="1" cellspacing="1" id="del_acc" class="account"><thead>
@@ -117,7 +116,7 @@ echo "<a href=\"spieler.php?s=3&id=".$session->uid."&a=1&e=4\"><img
title=\"Cancel process\" /> </a>";
$time=$generator->getTimeFormat(($timestamp-time()));
echo "The account will be deleted in <span
id=\"timer1\">".$time."</span> .</td>";
id=\"timer2\">".$time."</span> .</td>";
}
else {
?>
@@ -136,8 +135,8 @@ else {
?>
</tr></tbody></table>
<?php
if($form->getError("del") != "") {
echo "<span class=\"error\">".$form->getError("del")."</span>";
if(!empty($deleteError = $form->getError("del"))) {
echo "<span class=\"error\">".$deleteError."</span>";
}
?>
<p class="btn"><input type="image" value="" name="s1" id="btn_save" class="dynamic_img" src="img/x.gif" alt="save" /></p>
Templates/Profile/notfound.tpl
+2 -1
View File
@@ -1,3 +1,4 @@
<?php
header("Location: dorf1.php");
exit;
exit;
?>
Templates/Profile/preference.tpl
-1
View File
@@ -96,7 +96,6 @@ while($data = mysqli_fetch_assoc($query)) {
<?php include("menu.tpl"); ?>
<form action="spieler.php?s=2" method="POST">
<input type="hidden" name="ft" value="p2">
<input type="hidden" name="uid" value="<?php echo $session->uid; ?>" />
<table cellpadding="1" cellspacing="1" id="links">
<thead>
<tr>
Templates/Profile/profile.tpl
-1
View File
@@ -23,7 +23,6 @@ $varmedal = $database->getProfileMedal($session->uid);
include("menu.tpl"); ?>
<form action="spieler.php" method="POST">
<input type="hidden" name="ft" value="p1" />
<input type="hidden" name="uid" value="<?php echo $session->uid; ?>" />
<input type="hidden" name="id" value="<?php echo (isset($id) ? $id : ''); ?>" />
<table cellpadding="1" cellspacing="1" id="edit" ><thead>
Templates/Profile/vacation.tpl
-1
View File
@@ -20,7 +20,6 @@
include("menu.tpl"); ?>
<form action="spieler.php" method="POST">
<input type="hidden" name="ft" value="p4">
<input type="hidden" name="uid" value="<?php echo $session->uid; ?>" />
<table cellpadding="1" cellspacing="1" id="del_acc" class="account"><thead>
<tr>