xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-12 14:21:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "vulnerability fixed and cleanup and refactor"

Browse Source 
This reverts commit 2a44e76414.
This commit is contained in:
Catalin Novgorodschi
2026-02-11 15:22:16 +02:00
parent d3f51506e1
commit 260896570e
21 changed files with 5458 additions and 6106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GameEngine/Mailer.php
+28 -92
View File
@@ -1,9 +1,10 @@
<?php
#################################################################################
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
## --------------------------------------------------------------------------- ##
## Filename Mailer.php ##
## Developed by: Shadow ##
## Developed by: Dixie ##
## License: TravianZ Project ##
## Copyright: TravianZ (c) 2010-2025. All rights reserved. ##
## ##
@@ -11,46 +12,11 @@
class Mailer {
/* =====================================================
INTERNAL SANITIZERS (ANTI HEADER / CRLF INJECTION)
====================================================== */
function sendActivate($email,$username,$pass,$act) {
private function sanitizeEmail($email) {
$email = trim($email);
$email = str_replace(array("\r", "\n"), '', $email);
$subject = "Welcome to ".SERVER_NAME;
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
return false;
}
return $email;
}
private function sanitizeHeader($value) {
return str_replace(array("\r", "\n"), '', (string)$value);
}
private function sanitizeBody($value) {
return str_replace("\r", '', (string)$value);
}
/* =====================================================
SEND ACCOUNT ACTIVATION
====================================================== */
public function sendActivate($email, $username, $pass, $act) {
$email = $this->sanitizeEmail($email);
if (!$email) return false;
$username = $this->sanitizeBody($username);
$pass = $this->sanitizeBody($pass);
$act = $this->sanitizeBody($act);
$subject = "Welcome to " . SERVER_NAME;
$message =
"Hello ".$username."
$message = "Hello ".$username."
Thank you for your registration.
@@ -66,69 +32,38 @@ Click the following link in order to activate your account:
Greetings,
Travian adminision";
$headers = "From: " . $this->sanitizeHeader(ADMIN_EMAIL);
$headers = "From: ".ADMIN_EMAIL."\n";
return mail($email, $subject, $message, $headers);
}
mail($email, $subject, $message, $headers);
}
/* =====================================================
SEND INVITE (BACKWARD COMPATIBLE)
====================================================== */
function sendInvite($email,$uid,$text) {
public function sendInvite($email, $uid, $text, $username = null) {
$subject = "".SERVER_NAME." registeration";
$email = $this->sanitizeEmail($email);
if (!$email) return false;
$uid = (int)$uid;
$text = $this->sanitizeBody($text);
$username = $username !== null ? $this->sanitizeBody($username) : '';
$subject = SERVER_NAME . " registeration";
$greeting = $username !== ''
? "Hello " . $username
: "Hello";
$message =
$greeting."
$message = "Hello ".$username."
Try the new ".SERVER_NAME."!
Link: ".SERVER."anmelden.php?id=ref".$uid."
".$text."
Greetings,
Travian";
$headers = "From: " . $this->sanitizeHeader(ADMIN_EMAIL);
$headers = "From: ".ADMIN_EMAIL."\n";
return mail($email, $subject, $message, $headers);
}
mail($email, $subject, $message, $headers);
}
/* =====================================================
SEND PASSWORD RESET
====================================================== */
function sendPassword($email,$uid,$username,$npw,$cpw) {
public function sendPassword($email, $uid, $username, $npw, $cpw) {
$subject = "Password forgotten";
$email = $this->sanitizeEmail($email);
if (!$email) return false;
$uid = (int)$uid;
$username = $this->sanitizeBody($username);
$npw = $this->sanitizeBody($npw);
$cpw = $this->sanitizeBody($cpw);
$host = isset($_SERVER['HTTP_HOST'])
? $this->sanitizeHeader($_SERVER['HTTP_HOST'])
: 'localhost';
$subject = "Password forgotten";
$message =
"Hello ".$username."
$message = "Hello ".$username."
You have requested a new password for Travian.
@@ -140,20 +75,21 @@ Password: ".$npw."
Please click this link to activate your new password. The old password then
becomes invalid:
http://".$host."/password.php?cpw=".$cpw."&npw=".$uid."
http://${_SERVER['HTTP_HOST']}/password.php?cpw=$cpw&npw=$uid
If you want to change your new password, you can enter a new one in your profile
on tab \"account\".
In case you did not request a new password you may ignore this email.
Travian";
Travian
";
$headers = "From: " . $this->sanitizeHeader(ADMIN_EMAIL);
$headers = "From: ".ADMIN_EMAIL."\n";
return mail($email, $subject, $message, $headers);
}
}
mail($email, $subject, $message, $headers);
}
$mailer = new Mailer();
?>
};
$mailer = new Mailer;
?>