Fix parallel research exploit (#143)

* Fix parallel building exploit via race condition

* Fix parallel research exploit via race condition

---------

Co-authored-by: hdmaniak <bombo15.forum@gmail.com>
Co-authored-by: Catalin Novgorodschi <1140613+Shadowss@users.noreply.github.com>

GameEngine/Database.php

@@ -4568,6 +4568,18 @@ References: User ID/Message ID, Mode
 		mysqli_query($this->dblink, "SELECT RELEASE_LOCK('build_village_$wid')");
 	}
 
+	function getResearchLock($wid) {
+		$wid = (int) $wid;
+		$result = mysqli_query($this->dblink, "SELECT GET_LOCK('research_village_$wid', 10) AS locked");
+		$row = mysqli_fetch_assoc($result);
+		return $row['locked'] == 1;
+	}
+
+	function releaseResearchLock($wid) {
+		$wid = (int) $wid;
+		mysqli_query($this->dblink, "SELECT RELEASE_LOCK('research_village_$wid')");
+	}
+
 	/**
 	 * Get the time required to build a specified building
 	 * 

GameEngine/Technology.php

@@ -593,6 +593,9 @@ class Technology {
 
 	private function researchTech($get) {
 		global $database,$session,${'r'.$get['a']},$bid22,$building,$village,$logging;
+		if (!$database->getResearchLock($village->wid)) return;
+		try {
+			$village->researching = $database->getResearching($village->wid, false);
 			if($this->meetRRequirement($get['a']) && $get['c'] == $session->mchecker) {
 				$data = ${'r'.$get['a']};
 				$time = time() + round(($data['time'] * ($bid22[$building->getTypeLevel(22)]['attri'] / 100))/SPEED);
@@ -600,6 +603,9 @@ class Technology {
 				$database->addResearch($village->wid,"t".$get['a'],$time);
 				$logging->addTechLog($village->wid,"t".$get['a'],1);
 			}
+		} finally {
+			$database->releaseResearchLock($village->wid);
+		}
 		$session->changeChecker();
 		header("Location: build.php?id=".$get['id']);
 		exit;
@@ -609,7 +615,10 @@ class Technology {
 	
 	private function upgradeSword($get) {
 		global $database,$session,$bid12,$building,$village,$logging;
-		$ABTech = $database->getABTech($village->wid);
+		if (!$database->getResearchLock($village->wid)) return;
+		try {
+			$ABTech = $database->getABTech($village->wid, false);
+			$village->researching = $database->getResearching($village->wid, false);
 			$ABUpgrades = $this->getABUpgrades('b');
 			$ABUpgradesCount = count($ABUpgrades);
 
@@ -631,6 +640,9 @@ class Technology {
 					$logging->addTechLog($village->wid,"b".$get['a'],$CurrentTech+1);
 				}
 			}
+		} finally {
+			$database->releaseResearchLock($village->wid);
+		}
 		$session->changeChecker();
 		header("Location: build.php?id=".$get['id']);
 		exit;
@@ -638,7 +650,10 @@ class Technology {
 
 	private function upgradeArmour($get) {
 		global $database,$session,$bid13,$building,$village,$logging;
-		$ABTech = $database->getABTech($village->wid);
+		if (!$database->getResearchLock($village->wid)) return;
+		try {
+			$ABTech = $database->getABTech($village->wid, false);
+			$village->researching = $database->getResearching($village->wid, false);
 			$ABUpgrades = $this->getABUpgrades('a');
 			$ABUpgradesCount = count($ABUpgrades);
 
@@ -660,6 +675,9 @@ class Technology {
 					$logging->addTechLog($village->wid,"a".$get['a'],$CurrentTech+1);
 				}
 			}
+		} finally {
+			$database->releaseResearchLock($village->wid);
+		}
 		$session->changeChecker();
 		header("Location: build.php?id=".$get['id']);
 		exit;