Fix sitter

Fix sitter
This commit is contained in:
novgorodschi catalin
2026-08-12 08:11:04 +03:00
parent e7c9c61ef8
commit 7c6425578e
10 changed files with 296 additions and 34 deletions
+15 -2
View File
@@ -385,10 +385,23 @@ class Account {
}
setcookie("COOKUSR", $username, time() + COOKIE_EXPIRE, COOKIE_PATH);
$session->login($username);
// dupa Login(), ca sa nu fie suprascris de initializarea sesiunii
/**
* BUG CRITIC REPARAT: aceasta linie era DUPA $session->login().
*
* Session::Login() se termina cu header("Location: dorf1.php"); exit;
* deci tot ce urma dupa apel era cod mort. $_SESSION['sitter_uid'] nu se
* scria NICIODATA, sesiunea sitterului arata identic cu a proprietarului
* si toate verificarile de permisiuni treceau - indiferent ce bifai in
* interfata.
*
* Setarea INAINTE de Login() are si un avantaj: Login() apeleaza intern
* PopulateVar(), care citeste chiar aceasta cheie, deci permisiunile sunt
* corecte inca din prima cerere, nu de la a doua.
*/
$_SESSION['sitter_uid'] = $sitterUid;
$session->login($username);
}
private function Logout() {
+9 -1
View File
@@ -246,10 +246,18 @@ trait DatabaseUserQueries {
}
// no need to cache this method
/**
* Conturile pe care utilizatorul $uid e sitter.
*
* Intoarce si sloturile si mastile de permisiuni, ca pagina de cont sa
* poata afisa CE drepturi i-a dat fiecare proprietar. Inainte se selecta
* doar "id", deci sitterul nu avea de unde sa stie ce are voie sa faca.
* Cheia 'id' ramane neschimbata, deci codul existent nu e afectat.
*/
function getSitee($uid) {
list($uid) = $this->escape_input((int) $uid);
$q = "SELECT id from " . TB_PREFIX . "users where sit1 = $uid or sit2 = $uid";
$q = "SELECT id, sit1, sit2, sit1_perm, sit2_perm from " . TB_PREFIX . "users where sit1 = $uid or sit2 = $uid";
$result = mysqli_query($this->dblink,$q);
return $this->mysqli_fetch_all($result);
}
+2 -1
View File
@@ -4392,4 +4392,5 @@ tz_def('SITTER_P_REINF', 'send reinforcements');
tz_def('SITTER_P_RES', 'send resources to other players');
tz_def('SITTER_P_GOLD', 'spend Gold');
tz_def('SITTER_P_DENIED', 'Your sitter permissions do not allow this action.');
tz_def('SITTER_P_HINT', 'Permissions for the new sitter:');
tz_def('SITTER_P_NOT_SITTING', 'You are not a sitter on any account.');
+3 -1
View File
@@ -4334,4 +4334,6 @@ tz_def('SITTER_P_RAID', 'envoyer des raids');
tz_def('SITTER_P_REINF', 'envoyer des renforts');
tz_def('SITTER_P_RES', 'envoyer des ressources à dautres joueurs');
tz_def('SITTER_P_GOLD', 'dépenser de lor');
tz_def('SITTER_P_DENIED', 'Vos permissions de sitter ne vous permettent pas deffectuer cette action.');
tz_def('SITTER_P_DENIED', 'Vos permissions de sitter ne vous permettent pas deffectuer cette action.');
tz_def('SITTER_P_HINT', 'Permissions du nouveau sitter :');
tz_def('SITTER_P_NOT_SITTING', 'Vous n\'etes sitter sur aucun compte.');
+3 -1
View File
@@ -4129,4 +4129,6 @@ tz_def('SITTER_P_RAID', 'trimite raiduri');
tz_def('SITTER_P_REINF', 'trimite intariri');
tz_def('SITTER_P_RES', 'trimite resurse altor jucatori');
tz_def('SITTER_P_GOLD', 'cheltuie aur');
tz_def('SITTER_P_DENIED', 'Permisiunile tale de sitter nu iti permit aceasta actiune.');
tz_def('SITTER_P_DENIED', 'Permisiunile tale de sitter nu iti permit aceasta actiune.');
tz_def('SITTER_P_HINT', 'Permisiuni pentru noul sitter:');
tz_def('SITTER_P_NOT_SITTING', 'Nu esti sitter pe niciun cont.');
+43
View File
@@ -30,9 +30,37 @@ class Profile {
'villages' => []
];
/**
* Sesiunea curenta e a unui sitter?
* Verificat defensiv, ca Profile.php sa mearga si daca ajunge intr-un
* context unde $session inca nu e initializat.
*/
private function isSitter() {
global $session;
return isset($session) && is_object($session)
&& method_exists($session, 'isSitterSession')
&& $session->isSitterSession();
}
public function procProfile($post) {
global $session;
/**
* RESTRICTIE SITTER - al doilea nivel, cel care conteaza.
*
* spieler.php blocheaza deja accesul la taburi, dar aceasta metoda e
* punctul unic prin care trec TOATE formularele de profil (p1..p5:
* descriere, preferinte, cont, parola, vacanta). Un sitter putea
* trimite POST-ul direct catre spieler.php, fara sa deschida tabul.
*
* Aici se opreste definitiv: un sitter nu modifica setarile
* proprietarului, indiferent pe unde intra.
*/
if ($this->isSitter()) {
return;
}
if (isset($post['ft'])) {
switch ($post['ft']) {
case "p1":
@@ -214,6 +242,21 @@ class Profile {
}
public function procSpecial($get) {
/**
* Aceleasi motive ca la procProfile(). Actiunile de aici sunt chiar mai
* sensibile, fiindca se declanseaza prin simplu GET:
* e=2 removeMeSit - se scoate ca sitter de pe un cont
* e=3 removeSitter - sterge un sitter al proprietarului (deci un
* sitter l-ar fi putut elimina pe celalalt, sau
* pe sine, ca sa scape de urme)
* e=4 cancelDeleting - anuleaza stergerea contului proprietarului
* Niciuna nu are ce cauta intr-o sesiune de sitter.
*/
if ($this->isSitter()) {
return;
}
if (isset($get['e'])) {
switch ($get['e']) {
case 2:
+182 -26
View File
@@ -49,8 +49,8 @@ $sitterPermList = array(
);
/**
* Casutele pentru un slot. $mask = permisiunile curente, $field = numele
* campului din formular.
* Casutele editabile pentru un slot de sitter.
* $mask = permisiunile curente, $field = numele campului din formular.
*/
function sitterPermBoxes($mask, $field, $list) {
@@ -60,19 +60,44 @@ function sitterPermBoxes($mask, $field, $list) {
* Campul asta e mereu trimis, asa ca Profile.php poate deosebi cele doua
* situatii si nu reseteaza permisiunile din greseala.
*/
$out = '<input type="hidden" name="' . $field . '_sent" value="1" />';
$out .= '<div class="sitterPerm">';
$out = '<input type="hidden" name="' . $field . '_sent" value="1" />';
$out .= '<ul class="permGrid">';
foreach ($list as $bit => $label) {
$checked = (((int) $mask & $bit) === $bit) ? ' checked' : '';
$on = (((int) $mask & $bit) === $bit);
$out .= '<label><input type="checkbox" class="checkbox" name="' . $field . '[]"'
. ' value="' . (int) $bit . '"' . $checked . ' /> '
. htmlspecialchars($label, ENT_QUOTES, 'UTF-8') . '</label>';
$out .= '<li class="permItem' . ($on ? ' isOn' : '') . '">'
. '<label>'
. '<input type="checkbox" name="' . $field . '[]" value="' . (int) $bit . '"'
. ($on ? ' checked' : '') . ' />'
. '<span>' . htmlspecialchars($label, ENT_QUOTES, 'UTF-8') . '</span>'
. '</label></li>';
}
return $out . '</div>';
return $out . '</ul>';
}
/**
* Aceleasi drepturi, dar DOAR pentru citire: se foloseste in lista conturilor
* pe care esti tu sitter, ca sa vezi ce ti-a permis fiecare proprietar.
* Bifa verde = ai voie, X gri = nu ai voie.
*/
function sitterPermView($mask, $list) {
$out = '<ul class="permGrid permView">';
foreach ($list as $bit => $label) {
$on = (((int) $mask & $bit) === $bit);
$out .= '<li class="permItem ' . ($on ? 'isOn' : 'isOff') . '">'
. '<i class="permMark">' . ($on ? '&#10003;' : '&#10007;') . '</i>'
. '<span>' . htmlspecialchars($label, ENT_QUOTES, 'UTF-8') . '</span>'
. '</li>';
}
return $out . '</ul>';
}
?>
@@ -153,16 +178,96 @@ if (!empty($emailError)) {
?>
<style type="text/css">
/* casutele de permisiuni pentru sitteri */
#sitter .sitterPerm { margin: 4px 0 8px 18px; }
#sitter .sitterPerm label {
/* =======================================================================
Sitteri: permisiuni
Totul e limitat la #sitter, deci nu atinge restul paginii de cont.
Fara CSS grid si fara "gap": jocul e deschis si din browsere vechi, iar
acolo grid-ul cade pe o singura coloana, iar gap-ul e ignorat (bifele
raman lipite de text). inline-block + margini merg peste tot.
======================================================================= */
/* --- cardul unui sitter: nume sus, drepturi dedesubt --- */
#sitter .sitterCard {
margin: 0 0 8px 0;
padding: 7px 9px;
background: #fbfaf8;
border: 1px solid #dedbd4;
border-radius: 4px;
}
#sitter .sitterCard:last-child { margin-bottom: 0; }
#sitter .sitterCard { text-align: left; }
#sitter .sitterHead {
padding-bottom: 6px;
margin-bottom: 7px;
border-bottom: 1px solid #e8e5df;
}
#sitter .sitterHead .del { margin-right: 6px; vertical-align: -1px; cursor: pointer; }
#sitter .sitterHead .name { font-weight: bold; }
/* --- grila de drepturi: doua coloane --- */
#sitter .permGrid {
margin: 0;
padding: 0;
list-style: none;
font-size: 0; /* elimina spatiul dintre elementele inline-block */
text-align: left; /* celulele tabelului sunt centrate; grila nu trebuie */
}
#sitter .permGrid .permItem {
display: inline-block;
width: 50%;
box-sizing: border-box;
margin: 0;
padding: 2px 10px 2px 0;
font-size: 11px;
line-height: 15px;
color: #6f6b64;
vertical-align: top;
}
#sitter .permGrid .permItem label {
display: block;
padding: 1px 0;
font-weight: normal;
white-space: nowrap;
cursor: pointer;
}
#sitter .sitterPerm input { margin-right: 5px; vertical-align: -1px; }
#sitter .permGrid .permItem input {
margin: 0 5px 0 0;
padding: 0;
vertical-align: -1px;
}
#sitter .permGrid .permItem.isOn { color: #2f2d29; }
/* --- varianta doar-citire (conturile pe care esti TU sitter) --- */
#sitter .permMark {
display: inline-block;
width: 13px;
height: 13px;
margin-right: 5px;
line-height: 13px;
text-align: center;
font-style: normal;
font-size: 10px;
border-radius: 2px;
vertical-align: -2px;
}
#sitter .permView .isOn .permMark { color: #ffffff; background: #5aa02c; }
#sitter .permView .isOff .permMark { color: #ffffff; background: #c2bfb8; }
#sitter .permView .isOff { color: #a5a19a; }
/* --- casuta de adaugare a unui sitter nou --- */
/* titlul cardului de adaugare: acelasi loc ca numele unui sitter existent,
dar fara accentul de nume propriu */
#sitter .addSitter .name { font-weight: normal; color: #8a877f; }
#sitter span.none { color: #a5a19a; }
</style>
<!-- =========================
@@ -188,10 +293,32 @@ if (!empty($emailError)) {
<td>
<input class="text" type="text" name="v1" maxlength="15">
<span class="count">(<?php echo $count; ?>/2)</span>
</td>
</tr>
<tr>
<td colspan="2" class="sitter">
<?php
// permisiunile cu care intra noul sitter; implicit toate bifate
echo sitterPermBoxes(SITTER_PERM_ALL, 'perm_new', $sitterPermList);
/**
* Permisiunile noului sitter stau pe UN RAND PROPRIU, pe toata latimea.
*
* Inainte erau inghesuite in celula de langa "Name of the sitter", care
* are ~300px: cele doua coloane ieseau la ~150px fiecare, iar etichetele
* lungi ("send resources to other players") se taiau. Acum folosesc
* acelasi card ca sitterii existenti de mai jos, deci si latimea, si
* aspectul sunt identice.
*/
?>
<div class="sitterCard addSitter">
<div class="sitterHead">
<span class="name"><?php
echo defined('SITTER_P_HINT') ? SITTER_P_HINT : 'Permissions for the new sitter:';
?></span>
</div>
<?php
// permisiunile cu care intra noul sitter; implicit toate bifate
echo sitterPermBoxes(SITTER_PERM_ALL, 'perm_new', $sitterPermList);
?>
</div>
</td>
</tr>
<?php } ?>
@@ -214,18 +341,20 @@ foreach ($sitSlots as $type => $key) {
$uid = $session->userinfo[$key];
$uname = $database->getUserField($uid, "username", 0);
echo "<div>";
echo "<a href=\"spieler.php?s=3&e=3&id=".$uid."&a=".$session->checker."&type=".$type."\">";
echo "<img class=\"del\" src=\"img/x.gif\" title=\"Remove sitters\" alt=\"Remove sitters\" />";
echo "</a>";
echo "<a href=\"spieler.php?uid=".$uid."\">".$uname."</a>";
// permisiunile curente ale acestui sitter
$permField = 'perm' . $type;
$permMask = isset($session->userinfo[$key . '_perm'])
? (int) $session->userinfo[$key . '_perm']
: SITTER_PERM_ALL;
echo "<div class=\"sitterCard\">";
echo "<div class=\"sitterHead\">";
echo "<a href=\"spieler.php?s=3&e=3&id=".$uid."&a=".$session->checker."&type=".$type."\">";
echo "<img class=\"del\" src=\"img/x.gif\" title=\"Remove sitters\" alt=\"Remove sitters\" />";
echo "</a>";
echo "<a class=\"name\" href=\"spieler.php?uid=".$uid."\">".$uname."</a>";
echo "</div>";
echo sitterPermBoxes($permMask, $permField, $sitterPermList);
echo "</div>";
}
@@ -251,14 +380,41 @@ foreach ($sitSlots as $type => $key) {
$sitee = $database->getSitee($session->uid);
if (count($sitee) == 0) {
echo "<span class=\"none\">You have no sitters.</span>";
// textul de aici spunea tot "You have no sitters", desi lista arata
// conturile pe care esti TU sitter - doua lucruri diferite
echo "<span class=\"none\">"
. (defined('SITTER_P_NOT_SITTING') ? SITTER_P_NOT_SITTING
: 'You are not a sitter on any account.')
. "</span>";
} else {
foreach ($sitee as $sit) {
echo "<div>";
/**
* Ce drepturi mi-a dat ACEST proprietar.
*
* getSitee() intoarce randul lui, deci ne uitam pe care dintre cele
* doua sloturi stam si citim masca potrivita. Daca serverul inca nu are
* coloanele (migrarea nerulata), cadem pe SITTER_PERM_ALL - exact ce
* face si backendul, deci afisajul nu minte.
*/
$myMask = SITTER_PERM_ALL;
if ((int) ($sit['sit1'] ?? 0) === (int) $session->uid) {
$myMask = isset($sit['sit1_perm']) ? (int) $sit['sit1_perm'] : SITTER_PERM_ALL;
} else if ((int) ($sit['sit2'] ?? 0) === (int) $session->uid) {
$myMask = isset($sit['sit2_perm']) ? (int) $sit['sit2_perm'] : SITTER_PERM_ALL;
}
echo "<div class=\"sitterCard\">";
echo "<div class=\"sitterHead\">";
echo "<a href=\"spieler.php?s=3&e=2&id=".$sit['id']."&a=".$session->checker."\">";
echo "<img class=\"del\" src=\"img/x.gif\" title=\"Remove sitters\" alt=\"Remove sitters\" />";
echo "</a>";
echo "<a href=\"spieler.php?uid=".$sit['id']."\">".$database->getUserField($sit['id'], "username", 0)."</a>";
echo "<a class=\"name\" href=\"spieler.php?uid=".$sit['id']."\">"
. $database->getUserField($sit['id'], "username", 0)."</a>";
echo "</div>";
echo sitterPermView($myMask, $sitterPermList);
echo "</div>";
}
}
+13
View File
@@ -20,6 +20,17 @@ $menuUid = isset($_GET['uid']) ? (int)$_GET['uid'] : (int)$session->uid;
// helper simplu pentru "selected"
$selectedUid = isset($_GET['uid']);
$sParam = isset($_GET['s']) ? (int)$_GET['s'] : null;
/**
* Un sitter vede DOAR Overview. Restul taburilor nu se mai deseneaza.
*
* Ascunderea e doar cosmetica - blocarea reala e in spieler.php (redirect
* inainte de orice include) si in Profile::procProfile()/procSpecial()
* (refuza POST-urile trimise direct). Aici doar nu mai aratam linkuri care
* oricum ar redirectiona.
*/
$sitterView = isset($session) && is_object($session)
&& method_exists($session, 'isSitterSession') && $session->isSitterSession();
?>
<div id="textmenu">
@@ -30,6 +41,7 @@ $sParam = isset($_GET['s']) ? (int)$_GET['s'] : null;
<?php echo OVERVIEW; ?>
</a>
<?php if (!$sitterView) { ?>
|
<!-- ================= PROFILE ================= -->
@@ -77,5 +89,6 @@ $sParam = isset($_GET['s']) ? (int)$_GET['s'] : null;
<?php
}
?>
<?php } // fara taburi de setari pentru sitteri ?>
</div>
+24
View File
@@ -28,6 +28,30 @@ ob_start();
include_once("GameEngine/Village.php");
AccessLogger::logRequest();
/**
* RESTRICTIE SITTER pe pagina de profil.
*
* Un sitter are voie DOAR la Overview (spieler.php?uid=...). Taburile
* Profile / Preferences / Account / Vacation / Graphic Pack (s=1..5) sunt
* interzise, inclusiv prin URL scris de mana sau POST trimis direct.
*
* De ce aici si nu la finalul fisierului, unde exista deja o verificare
* "$_GET['s'] > 5 or $session->sit == 1":
* - procProfile($_POST) ruleaza la linia urmatoare si salveaza efectiv
* setarile; verificarea de la final se executa mult dupa;
* - graphic.tpl si preference.tpl scriu direct in baza de date la include,
* tot inainte de acea verificare.
* Cu ob_start() activ, redirectul de la final ascundea doar PAGINA, nu si
* efectele - un sitter putea schimba setarile proprietarului fara sa vada
* vreun ecran.
*/
if (isset($session) && is_object($session) && method_exists($session, 'isSitterSession')
&& $session->isSitterSession() && isset($_GET['s'])) {
header("Location: " . $_SERVER['PHP_SELF'] . "?uid=" . (int) $session->uid);
exit;
}
$profile->procProfile($_POST);
$profile->procSpecial($_GET);
if(isset($_GET['newdid'])){
+2 -2
View File
@@ -1995,9 +1995,9 @@ CREATE TABLE IF NOT EXISTS `%PREFIX%users` (
`b3` int(11) DEFAULT '0',
`b4` int(11) DEFAULT '0',
`sit1` int(11) DEFAULT '0',
`sit1_perm` int(11) NOT NULL DEFAULT '31',
`sit1_perm` int(11) NOT NULL DEFAULT '31',
`sit2` int(11) DEFAULT '0',
`sit2_perm` int(11) NOT NULL DEFAULT '31',
`sit2_perm` int(11) NOT NULL DEFAULT '31',
`alliance` int(11) DEFAULT '0',
`alliance_joined` int(11) NOT NULL DEFAULT '0',
`sessid` varchar(100) DEFAULT NULL,