diff --git a/GameEngine/Account.php b/GameEngine/Account.php
index 61221e6a..9c1fbe90 100755
--- a/GameEngine/Account.php
+++ b/GameEngine/Account.php
@@ -385,10 +385,23 @@ class Account {
     }
 
     setcookie("COOKUSR", $username, time() + COOKIE_EXPIRE, COOKIE_PATH);
-    $session->login($username);
 
-    // dupa Login(), ca sa nu fie suprascris de initializarea sesiunii
+    /**
+     * BUG CRITIC REPARAT: aceasta linie era DUPA $session->login().
+     *
+     * Session::Login() se termina cu header("Location: dorf1.php"); exit;
+     * deci tot ce urma dupa apel era cod mort. $_SESSION['sitter_uid'] nu se
+     * scria NICIODATA, sesiunea sitterului arata identic cu a proprietarului
+     * si toate verificarile de permisiuni treceau - indiferent ce bifai in
+     * interfata.
+     *
+     * Setarea INAINTE de Login() are si un avantaj: Login() apeleaza intern
+     * PopulateVar(), care citeste chiar aceasta cheie, deci permisiunile sunt
+     * corecte inca din prima cerere, nu de la a doua.
+     */
     $_SESSION['sitter_uid'] = $sitterUid;
+
+    $session->login($username);
 }
 
 	private function Logout() {
diff --git a/GameEngine/Database/DatabaseUserQueries.php b/GameEngine/Database/DatabaseUserQueries.php
index 459b64d4..682ec037 100644
--- a/GameEngine/Database/DatabaseUserQueries.php
+++ b/GameEngine/Database/DatabaseUserQueries.php
@@ -246,10 +246,18 @@ trait DatabaseUserQueries {
 }
 
 	// no need to cache this method
+	/**
+	 * Conturile pe care utilizatorul $uid e sitter.
+	 *
+	 * Intoarce si sloturile si mastile de permisiuni, ca pagina de cont sa
+	 * poata afisa CE drepturi i-a dat fiecare proprietar. Inainte se selecta
+	 * doar "id", deci sitterul nu avea de unde sa stie ce are voie sa faca.
+	 * Cheia 'id' ramane neschimbata, deci codul existent nu e afectat.
+	 */
 	function getSitee($uid) {
 	    list($uid) = $this->escape_input((int) $uid);
 
-		$q = "SELECT id from " . TB_PREFIX . "users where sit1 = $uid or sit2 = $uid";
+		$q = "SELECT id, sit1, sit2, sit1_perm, sit2_perm from " . TB_PREFIX . "users where sit1 = $uid or sit2 = $uid";
 		$result = mysqli_query($this->dblink,$q);
 		return $this->mysqli_fetch_all($result);
 	}
diff --git a/GameEngine/Lang/en.php b/GameEngine/Lang/en.php
index d7146f0a..27283f74 100755
--- a/GameEngine/Lang/en.php
+++ b/GameEngine/Lang/en.php
@@ -4392,4 +4392,5 @@ tz_def('SITTER_P_REINF',  'send reinforcements');
 tz_def('SITTER_P_RES',    'send resources to other players');
 tz_def('SITTER_P_GOLD',   'spend Gold');
 tz_def('SITTER_P_DENIED', 'Your sitter permissions do not allow this action.');
-
+tz_def('SITTER_P_HINT',        'Permissions for the new sitter:');
+tz_def('SITTER_P_NOT_SITTING', 'You are not a sitter on any account.');
diff --git a/GameEngine/Lang/fr.php b/GameEngine/Lang/fr.php
index 6354207f..f6446376 100644
--- a/GameEngine/Lang/fr.php
+++ b/GameEngine/Lang/fr.php
@@ -4334,4 +4334,6 @@ tz_def('SITTER_P_RAID',   'envoyer des raids');
 tz_def('SITTER_P_REINF',  'envoyer des renforts');
 tz_def('SITTER_P_RES',    'envoyer des ressources à d’autres joueurs');
 tz_def('SITTER_P_GOLD',   'dépenser de l’or');
-tz_def('SITTER_P_DENIED', 'Vos permissions de sitter ne vous permettent pas d’effectuer cette action.');
\ No newline at end of file
+tz_def('SITTER_P_DENIED', 'Vos permissions de sitter ne vous permettent pas d’effectuer cette action.');
+tz_def('SITTER_P_HINT',        'Permissions du nouveau sitter :');
+tz_def('SITTER_P_NOT_SITTING', 'Vous n\'etes sitter sur aucun compte.');
\ No newline at end of file
diff --git a/GameEngine/Lang/ro.php b/GameEngine/Lang/ro.php
index fc4443ce..dbe259fa 100644
--- a/GameEngine/Lang/ro.php
+++ b/GameEngine/Lang/ro.php
@@ -4129,4 +4129,6 @@ tz_def('SITTER_P_RAID',   'trimite raiduri');
 tz_def('SITTER_P_REINF',  'trimite intariri');
 tz_def('SITTER_P_RES',    'trimite resurse altor jucatori');
 tz_def('SITTER_P_GOLD',   'cheltuie aur');
-tz_def('SITTER_P_DENIED', 'Permisiunile tale de sitter nu iti permit aceasta actiune.');
\ No newline at end of file
+tz_def('SITTER_P_DENIED', 'Permisiunile tale de sitter nu iti permit aceasta actiune.');
+tz_def('SITTER_P_HINT',        'Permisiuni pentru noul sitter:');
+tz_def('SITTER_P_NOT_SITTING', 'Nu esti sitter pe niciun cont.');
\ No newline at end of file
diff --git a/GameEngine/Profile.php b/GameEngine/Profile.php
index 355ecc6b..4f61125f 100755
--- a/GameEngine/Profile.php
+++ b/GameEngine/Profile.php
@@ -30,9 +30,37 @@ class Profile {
 		'villages'  => []
 	];
 
+	/**
+	 * Sesiunea curenta e a unui sitter?
+	 * Verificat defensiv, ca Profile.php sa mearga si daca ajunge intr-un
+	 * context unde $session inca nu e initializat.
+	 */
+	private function isSitter() {
+		global $session;
+
+		return isset($session) && is_object($session)
+			&& method_exists($session, 'isSitterSession')
+			&& $session->isSitterSession();
+	}
+
 	public function procProfile($post) {
 		global $session;
 
+		/**
+		 * RESTRICTIE SITTER - al doilea nivel, cel care conteaza.
+		 *
+		 * spieler.php blocheaza deja accesul la taburi, dar aceasta metoda e
+		 * punctul unic prin care trec TOATE formularele de profil (p1..p5:
+		 * descriere, preferinte, cont, parola, vacanta). Un sitter putea
+		 * trimite POST-ul direct catre spieler.php, fara sa deschida tabul.
+		 *
+		 * Aici se opreste definitiv: un sitter nu modifica setarile
+		 * proprietarului, indiferent pe unde intra.
+		 */
+		if ($this->isSitter()) {
+			return;
+		}
+
 		if (isset($post['ft'])) {
 			switch ($post['ft']) {
 				case "p1":
@@ -214,6 +242,21 @@ class Profile {
 	}
 
 	public function procSpecial($get) {
+
+		/**
+		 * Aceleasi motive ca la procProfile(). Actiunile de aici sunt chiar mai
+		 * sensibile, fiindca se declanseaza prin simplu GET:
+		 *   e=2 removeMeSit    - se scoate ca sitter de pe un cont
+		 *   e=3 removeSitter   - sterge un sitter al proprietarului (deci un
+		 *                        sitter l-ar fi putut elimina pe celalalt, sau
+		 *                        pe sine, ca sa scape de urme)
+		 *   e=4 cancelDeleting - anuleaza stergerea contului proprietarului
+		 * Niciuna nu are ce cauta intr-o sesiune de sitter.
+		 */
+		if ($this->isSitter()) {
+			return;
+		}
+
 		if (isset($get['e'])) {
 			switch ($get['e']) {
 				case 2:
diff --git a/Templates/Profile/account.tpl b/Templates/Profile/account.tpl
index 36d6d206..c8513401 100644
--- a/Templates/Profile/account.tpl
+++ b/Templates/Profile/account.tpl
@@ -49,8 +49,8 @@ $sitterPermList = array(
 );
 
 /**
- * Casutele pentru un slot. $mask = permisiunile curente, $field = numele
- * campului din formular.
+ * Casutele editabile pentru un slot de sitter.
+ * $mask = permisiunile curente, $field = numele campului din formular.
  */
 function sitterPermBoxes($mask, $field, $list) {
 
@@ -60,19 +60,44 @@ function sitterPermBoxes($mask, $field, $list) {
      * Campul asta e mereu trimis, asa ca Profile.php poate deosebi cele doua
      * situatii si nu reseteaza permisiunile din greseala.
      */
-    $out = '<input type="hidden" name="' . $field . '_sent" value="1" />';
-    $out .= '<div class="sitterPerm">';
+    $out  = '<input type="hidden" name="' . $field . '_sent" value="1" />';
+    $out .= '<ul class="permGrid">';
 
     foreach ($list as $bit => $label) {
 
-        $checked = (((int) $mask & $bit) === $bit) ? ' checked' : '';
+        $on = (((int) $mask & $bit) === $bit);
 
-        $out .= '<label><input type="checkbox" class="checkbox" name="' . $field . '[]"'
-              . ' value="' . (int) $bit . '"' . $checked . ' /> '
-              . htmlspecialchars($label, ENT_QUOTES, 'UTF-8') . '</label>';
+        $out .= '<li class="permItem' . ($on ? ' isOn' : '') . '">'
+              . '<label>'
+              . '<input type="checkbox" name="' . $field . '[]" value="' . (int) $bit . '"'
+              . ($on ? ' checked' : '') . ' />'
+              . '<span>' . htmlspecialchars($label, ENT_QUOTES, 'UTF-8') . '</span>'
+              . '</label></li>';
     }
 
-    return $out . '</div>';
+    return $out . '</ul>';
+}
+
+/**
+ * Aceleasi drepturi, dar DOAR pentru citire: se foloseste in lista conturilor
+ * pe care esti tu sitter, ca sa vezi ce ti-a permis fiecare proprietar.
+ * Bifa verde = ai voie, X gri = nu ai voie.
+ */
+function sitterPermView($mask, $list) {
+
+    $out = '<ul class="permGrid permView">';
+
+    foreach ($list as $bit => $label) {
+
+        $on = (((int) $mask & $bit) === $bit);
+
+        $out .= '<li class="permItem ' . ($on ? 'isOn' : 'isOff') . '">'
+              . '<i class="permMark">' . ($on ? '&#10003;' : '&#10007;') . '</i>'
+              . '<span>' . htmlspecialchars($label, ENT_QUOTES, 'UTF-8') . '</span>'
+              . '</li>';
+    }
+
+    return $out . '</ul>';
 }
 ?>
 
@@ -153,16 +178,96 @@ if (!empty($emailError)) {
 ?>
 
 <style type="text/css">
-/* casutele de permisiuni pentru sitteri */
-#sitter .sitterPerm { margin: 4px 0 8px 18px; }
-#sitter .sitterPerm label {
+/* =======================================================================
+   Sitteri: permisiuni
+   Totul e limitat la #sitter, deci nu atinge restul paginii de cont.
+
+   Fara CSS grid si fara "gap": jocul e deschis si din browsere vechi, iar
+   acolo grid-ul cade pe o singura coloana, iar gap-ul e ignorat (bifele
+   raman lipite de text). inline-block + margini merg peste tot.
+   ======================================================================= */
+
+/* --- cardul unui sitter: nume sus, drepturi dedesubt --- */
+#sitter .sitterCard {
+    margin: 0 0 8px 0;
+    padding: 7px 9px;
+    background: #fbfaf8;
+    border: 1px solid #dedbd4;
+    border-radius: 4px;
+}
+
+#sitter .sitterCard:last-child { margin-bottom: 0; }
+
+#sitter .sitterCard { text-align: left; }
+
+#sitter .sitterHead {
+    padding-bottom: 6px;
+    margin-bottom: 7px;
+    border-bottom: 1px solid #e8e5df;
+}
+
+#sitter .sitterHead .del  { margin-right: 6px; vertical-align: -1px; cursor: pointer; }
+#sitter .sitterHead .name { font-weight: bold; }
+
+/* --- grila de drepturi: doua coloane --- */
+#sitter .permGrid {
+    margin: 0;
+    padding: 0;
+    list-style: none;
+    font-size: 0;          /* elimina spatiul dintre elementele inline-block */
+    text-align: left;      /* celulele tabelului sunt centrate; grila nu trebuie */
+}
+
+#sitter .permGrid .permItem {
+    display: inline-block;
+    width: 50%;
+    box-sizing: border-box;
+    margin: 0;
+    padding: 2px 10px 2px 0;
+    font-size: 11px;
+    line-height: 15px;
+    color: #6f6b64;
+    vertical-align: top;
+}
+
+#sitter .permGrid .permItem label {
     display: block;
-    padding: 1px 0;
     font-weight: normal;
-    white-space: nowrap;
     cursor: pointer;
 }
-#sitter .sitterPerm input { margin-right: 5px; vertical-align: -1px; }
+
+#sitter .permGrid .permItem input {
+    margin: 0 5px 0 0;
+    padding: 0;
+    vertical-align: -1px;
+}
+
+#sitter .permGrid .permItem.isOn { color: #2f2d29; }
+
+/* --- varianta doar-citire (conturile pe care esti TU sitter) --- */
+#sitter .permMark {
+    display: inline-block;
+    width: 13px;
+    height: 13px;
+    margin-right: 5px;
+    line-height: 13px;
+    text-align: center;
+    font-style: normal;
+    font-size: 10px;
+    border-radius: 2px;
+    vertical-align: -2px;
+}
+
+#sitter .permView .isOn  .permMark { color: #ffffff; background: #5aa02c; }
+#sitter .permView .isOff .permMark { color: #ffffff; background: #c2bfb8; }
+#sitter .permView .isOff { color: #a5a19a; }
+
+/* --- casuta de adaugare a unui sitter nou --- */
+/* titlul cardului de adaugare: acelasi loc ca numele unui sitter existent,
+   dar fara accentul de nume propriu */
+#sitter .addSitter .name { font-weight: normal; color: #8a877f; }
+
+#sitter span.none { color: #a5a19a; }
 </style>
 
 <!-- =========================
@@ -188,10 +293,32 @@ if (!empty($emailError)) {
     <td>
         <input class="text" type="text" name="v1" maxlength="15">
         <span class="count">(<?php echo $count; ?>/2)</span>
+    </td>
+</tr>
+<tr>
+    <td colspan="2" class="sitter">
         <?php
-        // permisiunile cu care intra noul sitter; implicit toate bifate
-        echo sitterPermBoxes(SITTER_PERM_ALL, 'perm_new', $sitterPermList);
+        /**
+         * Permisiunile noului sitter stau pe UN RAND PROPRIU, pe toata latimea.
+         *
+         * Inainte erau inghesuite in celula de langa "Name of the sitter", care
+         * are ~300px: cele doua coloane ieseau la ~150px fiecare, iar etichetele
+         * lungi ("send resources to other players") se taiau. Acum folosesc
+         * acelasi card ca sitterii existenti de mai jos, deci si latimea, si
+         * aspectul sunt identice.
+         */
         ?>
+        <div class="sitterCard addSitter">
+            <div class="sitterHead">
+                <span class="name"><?php
+                    echo defined('SITTER_P_HINT') ? SITTER_P_HINT : 'Permissions for the new sitter:';
+                ?></span>
+            </div>
+            <?php
+            // permisiunile cu care intra noul sitter; implicit toate bifate
+            echo sitterPermBoxes(SITTER_PERM_ALL, 'perm_new', $sitterPermList);
+            ?>
+        </div>
     </td>
 </tr>
 <?php } ?>
@@ -214,18 +341,20 @@ foreach ($sitSlots as $type => $key) {
         $uid = $session->userinfo[$key];
         $uname = $database->getUserField($uid, "username", 0);
 
-        echo "<div>";
-        echo "<a href=\"spieler.php?s=3&e=3&id=".$uid."&a=".$session->checker."&type=".$type."\">";
-        echo "<img class=\"del\" src=\"img/x.gif\" title=\"Remove sitters\" alt=\"Remove sitters\" />";
-        echo "</a>";
-        echo "<a href=\"spieler.php?uid=".$uid."\">".$uname."</a>";
-
         // permisiunile curente ale acestui sitter
         $permField = 'perm' . $type;
         $permMask  = isset($session->userinfo[$key . '_perm'])
             ? (int) $session->userinfo[$key . '_perm']
             : SITTER_PERM_ALL;
 
+        echo "<div class=\"sitterCard\">";
+        echo "<div class=\"sitterHead\">";
+        echo "<a href=\"spieler.php?s=3&e=3&id=".$uid."&a=".$session->checker."&type=".$type."\">";
+        echo "<img class=\"del\" src=\"img/x.gif\" title=\"Remove sitters\" alt=\"Remove sitters\" />";
+        echo "</a>";
+        echo "<a class=\"name\" href=\"spieler.php?uid=".$uid."\">".$uname."</a>";
+        echo "</div>";
+
         echo sitterPermBoxes($permMask, $permField, $sitterPermList);
         echo "</div>";
     }
@@ -251,14 +380,41 @@ foreach ($sitSlots as $type => $key) {
 $sitee = $database->getSitee($session->uid);
 
 if (count($sitee) == 0) {
-    echo "<span class=\"none\">You have no sitters.</span>";
+    // textul de aici spunea tot "You have no sitters", desi lista arata
+    // conturile pe care esti TU sitter - doua lucruri diferite
+    echo "<span class=\"none\">"
+       . (defined('SITTER_P_NOT_SITTING') ? SITTER_P_NOT_SITTING
+          : 'You are not a sitter on any account.')
+       . "</span>";
 } else {
     foreach ($sitee as $sit) {
-        echo "<div>";
+
+        /**
+         * Ce drepturi mi-a dat ACEST proprietar.
+         *
+         * getSitee() intoarce randul lui, deci ne uitam pe care dintre cele
+         * doua sloturi stam si citim masca potrivita. Daca serverul inca nu are
+         * coloanele (migrarea nerulata), cadem pe SITTER_PERM_ALL - exact ce
+         * face si backendul, deci afisajul nu minte.
+         */
+        $myMask = SITTER_PERM_ALL;
+
+        if ((int) ($sit['sit1'] ?? 0) === (int) $session->uid) {
+            $myMask = isset($sit['sit1_perm']) ? (int) $sit['sit1_perm'] : SITTER_PERM_ALL;
+        } else if ((int) ($sit['sit2'] ?? 0) === (int) $session->uid) {
+            $myMask = isset($sit['sit2_perm']) ? (int) $sit['sit2_perm'] : SITTER_PERM_ALL;
+        }
+
+        echo "<div class=\"sitterCard\">";
+        echo "<div class=\"sitterHead\">";
         echo "<a href=\"spieler.php?s=3&e=2&id=".$sit['id']."&a=".$session->checker."\">";
         echo "<img class=\"del\" src=\"img/x.gif\" title=\"Remove sitters\" alt=\"Remove sitters\" />";
         echo "</a>";
-        echo "<a href=\"spieler.php?uid=".$sit['id']."\">".$database->getUserField($sit['id'], "username", 0)."</a>";
+        echo "<a class=\"name\" href=\"spieler.php?uid=".$sit['id']."\">"
+           . $database->getUserField($sit['id'], "username", 0)."</a>";
+        echo "</div>";
+
+        echo sitterPermView($myMask, $sitterPermList);
         echo "</div>";
     }
 }
diff --git a/Templates/Profile/menu.tpl b/Templates/Profile/menu.tpl
index 0b8594a9..ebcc9331 100644
--- a/Templates/Profile/menu.tpl
+++ b/Templates/Profile/menu.tpl
@@ -20,6 +20,17 @@ $menuUid = isset($_GET['uid']) ? (int)$_GET['uid'] : (int)$session->uid;
 // helper simplu pentru "selected"
 $selectedUid = isset($_GET['uid']);
 $sParam = isset($_GET['s']) ? (int)$_GET['s'] : null;
+
+/**
+ * Un sitter vede DOAR Overview. Restul taburilor nu se mai deseneaza.
+ *
+ * Ascunderea e doar cosmetica - blocarea reala e in spieler.php (redirect
+ * inainte de orice include) si in Profile::procProfile()/procSpecial()
+ * (refuza POST-urile trimise direct). Aici doar nu mai aratam linkuri care
+ * oricum ar redirectiona.
+ */
+$sitterView = isset($session) && is_object($session)
+    && method_exists($session, 'isSitterSession') && $session->isSitterSession();
 ?>
 
 <div id="textmenu">
@@ -30,6 +41,7 @@ $sParam = isset($_GET['s']) ? (int)$_GET['s'] : null;
         <?php echo OVERVIEW; ?>
     </a>
 
+<?php if (!$sitterView) { ?>
     |
 
     <!-- ================= PROFILE ================= -->
@@ -77,5 +89,6 @@ $sParam = isset($_GET['s']) ? (int)$_GET['s'] : null;
     <?php
     }
     ?>
+<?php } // fara taburi de setari pentru sitteri ?>
 
 </div>
\ No newline at end of file
diff --git a/spieler.php b/spieler.php
index f0cfe1b6..c7e3477e 100644
--- a/spieler.php
+++ b/spieler.php
@@ -28,6 +28,30 @@ ob_start();
 include_once("GameEngine/Village.php");
 AccessLogger::logRequest();
 
+/**
+ * RESTRICTIE SITTER pe pagina de profil.
+ *
+ * Un sitter are voie DOAR la Overview (spieler.php?uid=...). Taburile
+ * Profile / Preferences / Account / Vacation / Graphic Pack (s=1..5) sunt
+ * interzise, inclusiv prin URL scris de mana sau POST trimis direct.
+ *
+ * De ce aici si nu la finalul fisierului, unde exista deja o verificare
+ * "$_GET['s'] > 5 or $session->sit == 1":
+ *   - procProfile($_POST) ruleaza la linia urmatoare si salveaza efectiv
+ *     setarile; verificarea de la final se executa mult dupa;
+ *   - graphic.tpl si preference.tpl scriu direct in baza de date la include,
+ *     tot inainte de acea verificare.
+ * Cu ob_start() activ, redirectul de la final ascundea doar PAGINA, nu si
+ * efectele - un sitter putea schimba setarile proprietarului fara sa vada
+ * vreun ecran.
+ */
+if (isset($session) && is_object($session) && method_exists($session, 'isSitterSession')
+    && $session->isSitterSession() && isset($_GET['s'])) {
+
+    header("Location: " . $_SERVER['PHP_SELF'] . "?uid=" . (int) $session->uid);
+    exit;
+}
+
 $profile->procProfile($_POST);
 $profile->procSpecial($_GET);
 if(isset($_GET['newdid'])){
diff --git a/var/db/struct.sql b/var/db/struct.sql
index 3d797dda..158e5535 100644
--- a/var/db/struct.sql
+++ b/var/db/struct.sql
@@ -1995,9 +1995,9 @@ CREATE TABLE IF NOT EXISTS `%PREFIX%users` (
   `b3` int(11) DEFAULT '0',
   `b4` int(11) DEFAULT '0',
   `sit1` int(11) DEFAULT '0',
- `sit1_perm` int(11) NOT NULL DEFAULT '31',
+  `sit1_perm` int(11) NOT NULL DEFAULT '31',
   `sit2` int(11) DEFAULT '0',
- `sit2_perm` int(11) NOT NULL DEFAULT '31',
+  `sit2_perm` int(11) NOT NULL DEFAULT '31',
   `alliance` int(11) DEFAULT '0',
   `alliance_joined` int(11) NOT NULL DEFAULT '0',
   `sessid` varchar(100) DEFAULT NULL,