xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-24 12:07:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix some atomic exploit

Browse Source 
Fix some atomic exploit
This commit is contained in:
novgorodschi catalin
2026-08-13 11:51:54 +03:00
parent 7bad451a83
commit 35f4075734
8 changed files with 708 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GameEngine/Automation/AutomationBattleResolution.php
+124
View File
@@ -347,6 +347,130 @@ trait AutomationBattleResolution {
return (mysqli_affected_rows($database->dblink) === 1);
}
/**
* Claim atomic pentru un retur de trupe.
*
* Un attack ref poate avea legitim un singur movement de retur
* (sort_type = 4).
*
* Daca exista deja un alt return pentru acelasi ref care a fost
* procesat, acest movement este considerat duplicat si este marcat
* processed fara a mai credita trupele.
*/
private function claimReturnMovementRecord($moveid, $ref) {
global $database;
$moveid = (int)$moveid;
$ref = (int)$ref;
if ($moveid <= 0 || $ref <= 0) {
return false;
}
/*
* Lock pe ATTACK REF, nu pe moveid.
*
* Astfel doua movement-uri duplicate cu moveid diferit
* nu pot trece simultan de verificarea de unicitate.
*/
$lockResult = mysqli_query(
$database->dblink,
"SELECT GET_LOCK('return_attack_ref_$ref', 10) AS locked"
);
if (!$lockResult) {
return false;
}
$lockRow = mysqli_fetch_assoc($lockResult);
if (
!isset($lockRow['locked']) ||
(int)$lockRow['locked'] !== 1
) {
return false;
}
try {
/*
* Verificam daca acest movement mai este pending.
*/
$q = "
SELECT moveid
FROM " . TB_PREFIX . "movement
WHERE moveid = $moveid
AND sort_type = 4
AND proc = 0
LIMIT 1
";
$result = mysqli_query(
$database->dblink,
$q
);
if (!$result || mysqli_num_rows($result) === 0) {
return false;
}
/*
* Verificam daca un alt return pentru acelasi attack
* a fost deja procesat.
*/
$q = "
SELECT moveid
FROM " . TB_PREFIX . "movement
WHERE ref = $ref
AND sort_type = 4
AND proc = 1
AND moveid <> $moveid
LIMIT 1
";
$result = mysqli_query(
$database->dblink,
$q
);
if ($result && mysqli_num_rows($result) > 0) {
/*
* Este un duplicate.
*
* Il consumam fara sa adaugam trupele.
*/
mysqli_query(
$database->dblink,
"UPDATE " . TB_PREFIX . "movement
SET proc = 1
WHERE moveid = $moveid
AND proc = 0"
);
return false;
}
/*
* Claim atomic pentru movement-ul legitim.
*/
$result = mysqli_query(
$database->dblink,
"UPDATE " . TB_PREFIX . "movement
SET proc = 1
WHERE moveid = $moveid
AND proc = 0"
);
return $result && mysqli_affected_rows($database->dblink) === 1;
} finally {
mysqli_query(
$database->dblink,
"SELECT RELEASE_LOCK('return_attack_ref_$ref')"
);
}
}
/**
* Handle hero evasion: if the defender has evasion active and can afford it,
GameEngine/Automation/AutomationTroopMovements.php
+6 -4
View File
@@ -211,7 +211,7 @@ trait AutomationTroopMovements {
$time = time();
$q = "
SELECT
`to`, `from`, moveid, starttime, endtime, wood, clay, iron, crop,
`to`, `from`, moveid, ref, starttime, endtime, wood, clay, iron, crop,
t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11
FROM
".TB_PREFIX."movement,
@@ -238,9 +238,11 @@ trait AutomationTroopMovements {
$database->getOasisEnforce($vilIDs, 1);
foreach($dataarray as $data) {
if (!$this->claimMovementRecord($data['moveid'])) {
continue;
}
if (!$this->claimReturnMovementRecord(
$data['moveid'],
$data['ref'])) {
continue;
}
$tribe = $database->getUserField($database->getVillageField($data['to'], "owner"), "tribe", 0);
$u = $tribe == 1 ? "" : $tribe - 1;