xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-11 05:41:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Some fixes & improovements

Browse Source 
1. Fix ban access, 2. Fix profile ('"") , 3. Add on vacation Admin/MH and exclude rat from reinforcement.
This commit is contained in:
Catalin Novgorodschi
2026-05-15 12:13:01 +03:00
parent cd4a5cd957
commit 850a46ae2d
8 changed files with 253 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Admin/Templates/ban.tpl
+31 -9
View File
@@ -12,7 +12,7 @@ $success = '';
if(isset($_POST['action']) && $_POST['action'] == 'addBan') if(isset($_POST['action']) && $_POST['action'] == 'addBan')
{ {
$uid = isset($_POST['uid']) ? (int)$_POST['uid'] : 0; $uid = isset($_POST['uid']) ? (int)$_POST['uid'] : 0;
$reason = $_POST['reason'] ?? ''; $reason = trim($_POST['reason'] ?? '');
$time = isset($_POST['time']) ? (int)$_POST['time'] : 0; $time = isset($_POST['time']) ? (int)$_POST['time'] : 0;
// ========================= // =========================
@@ -74,24 +74,46 @@ if(isset($_POST['action']) && $_POST['action'] == 'addBan')
// ========================= // =========================
// INSERT BAN (ACTIVE) // INSERT BAN (ACTIVE)
// ========================= // =========================
mysqli_query($database->dblink, " $currentTime = time();
INSERT INTO ".TB_PREFIX."banlist
(uid,name,reason,time,end,admin,active) $stmt = $database->dblink->prepare("
INSERT INTO `".TB_PREFIX."banlist`
(uid, name, reason, time, end, admin, active)
VALUES VALUES
($uid,'$name','$reason',".time().",$end,0,1) (?, ?, ?, ?, ?, 0, 1)
"); ");
if ($stmt) {
// i = integer, s = string
$stmt->bind_param("issii", $uid, $name, $reason, $currentTime, $end);
$stmt->execute();
$stmt->close();
} else {
$error = "Database error (ban insert): " . $database->dblink->error;
}
// ========================= // =========================
// BLOCK USER ACCESS // BLOCK USER ACCESS
// ========================= // =========================
mysqli_query($database->dblink, " if (empty($error)) {
UPDATE ".TB_PREFIX."users $stmt2 = $database->dblink->prepare("
UPDATE `".TB_PREFIX."users`
SET access = 0 SET access = 0
WHERE id = $uid WHERE id = ?
LIMIT 1 LIMIT 1
"); ");
if ($stmt2) {
$stmt2->bind_param("i", $uid);
$stmt2->execute();
$stmt2->close();
} else {
$error = "Database error (access update): " . $database->dblink->error;
}
}
if (empty($error)) {
$success = "User has been banned successfully!"; $success = "User has been banned successfully!";
}
} }
} }
} }
GameEngine/Account.php
+28 -17
View File
@@ -35,6 +35,7 @@ class Account {
function __construct() { function __construct() {
global $session; global $session;
if(isset($_POST['ft'])) { if(isset($_POST['ft'])) {
$_POST['ft'] = preg_replace('/[^a-z0-9]/i', '', $_POST['ft']);
switch($_POST['ft']) { switch($_POST['ft']) {
case "a1": case "a1":
$this->Signup(); $this->Signup();
@@ -121,7 +122,9 @@ class Account {
if ($form->returnErrors() > 0) { if ($form->returnErrors() > 0) {
$form->addError("invt", $_POST['invited'] ?? ''); $form->addError("invt", $_POST['invited'] ?? '');
$_SESSION['errorarray'] = $form->getErrors(); $_SESSION['errorarray'] = $form->getErrors();
$_SESSION['valuearray'] = $_POST; $tmp = $_POST;
unset($tmp['pw']); // nu salva parola
$_SESSION['valuearray'] = $tmp;
header("Location: anmelden.php"); header("Location: anmelden.php");
exit; exit;
} }
@@ -170,8 +173,8 @@ class Account {
$database->updateUserField($uid, 'access', ADMIN, 1); $database->updateUserField($uid, 'access', ADMIN, 1);
} }
setcookie("COOKUSR", $_POST['name'], time() + COOKIE_EXPIRE, COOKIE_PATH); setcookie("COOKUSR", rawurlencode($_POST['name']), time()+COOKIE_EXPIRE, COOKIE_PATH, '', false, true);
setcookie("COOKEMAIL", $_POST['email'], time() + COOKIE_EXPIRE, COOKIE_PATH); setcookie("COOKEMAIL", rawurlencode($_POST['email']), time()+COOKIE_EXPIRE, COOKIE_PATH, '', false, true);
$database->updateUserField( $database->updateUserField(
$uid, $uid,
@@ -195,13 +198,16 @@ class Account {
if (START_DATE < date('d.m.Y') || (START_DATE === date('d.m.Y') && START_TIME <= date('H:i'))) { if (START_DATE < date('d.m.Y') || (START_DATE === date('d.m.Y') && START_TIME <= date('H:i'))) {
// Caută codul de activare în tabela activate // Caută codul de activare în tabela activate
$id = $database->escape($_POST['id'] ?? ''); $code = trim($_POST['id'] ?? '');
$q = "SELECT act, username, password, email, tribe, location $stmt = $database->dblink->prepare(
FROM " . TB_PREFIX . "activate "SELECT act, username, password, email, tribe, location
WHERE act = '" . $id . "'"; FROM `".TB_PREFIX."activate` WHERE act = ? LIMIT 1"
);
$result = $database->query($q); $stmt->bind_param("s", $code);
$dbarray = mysqli_fetch_array($result); $stmt->execute();
$result = $stmt->get_result();
$dbarray = $result->fetch_assoc();
$stmt->close();
// Verificăm dacă am găsit exact codul trimis // Verificăm dacă am găsit exact codul trimis
if ($dbarray && $dbarray['act'] === $_POST['id']) { if ($dbarray && $dbarray['act'] === $_POST['id']) {
@@ -240,14 +246,19 @@ class Account {
global $database; global $database;
// ==================== VERIFICARE ID & PAROLĂ ==================== // ==================== VERIFICARE ID & PAROLĂ ====================
$id = (int)($_POST['id'] ?? 0); $id = (int)($_POST['id'] ?? 0);
$q = "SELECT password, username $stmt = $database->dblink->prepare(
FROM " . TB_PREFIX . "activate "SELECT password, username
WHERE id = " . $id; FROM `".TB_PREFIX."activate`
WHERE id = ?
$result = $database->query($q); LIMIT 1"
$dbarray = mysqli_fetch_array($result); );
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
$dbarray = $result->fetch_assoc();
$stmt->close();
// Verificăm dacă înregistrarea există și parola este corectă // Verificăm dacă înregistrarea există și parola este corectă
// (protejează împotriva notice-urilor PHP dacă nu există rândul) // (protejează împotriva notice-urilor PHP dacă nu există rândul)
GameEngine/Alliance.php
+8 -6
View File
@@ -45,7 +45,12 @@ class Alliance {
public $userPermArray = []; public $userPermArray = [];
public function procAlliance($get) { public function procAlliance($get) {
global $session, $database; global $session, $database;
// ==================== SANITIZARE GET ====================
$get['a'] = isset($get['a']) ? (int)$get['a'] : 0;
$get['o'] = isset($get['o']) ? (int)$get['o'] : 0;
$get['d'] = isset($get['d']) ? (int)$get['d'] : 0; // dacă folosești și 'd'
// ==================== ÎNCĂRCARE DATE ALIANȚĂ SAU INVITAȚII ==================== // ==================== ÎNCĂRCARE DATE ALIANȚĂ SAU INVITAȚII ====================
if ($session->alliance > 0) { if ($session->alliance > 0) {
@@ -53,9 +58,6 @@ class Alliance {
$this->allianceArray = $database->getAlliance($session->alliance); $this->allianceArray = $database->getAlliance($session->alliance);
// Permissions Array // Permissions Array
// [id] => id [uid] => uid [alliance] => alliance
// [opt1] => X [opt2] => X [opt3] => X [opt4] => X
// [opt5] => X [opt6] => X [opt7] => X [opt8] => X
$this->userPermArray = $database->getAlliPermissions($session->uid, $session->alliance); $this->userPermArray = $database->getAlliPermissions($session->uid, $session->alliance);
} else { } else {
// Utilizatorul NU este într-o alianță → încarcă invitațiile primite // Utilizatorul NU este într-o alianță → încarcă invitațiile primite
@@ -64,7 +66,7 @@ class Alliance {
} }
// ==================== PROCESARE ACȚIUNI DIN URL (GET) ==================== // ==================== PROCESARE ACȚIUNI DIN URL (GET) ====================
if (isset($get['a'])) { if ($get['a'] > 0) {
switch ($get['a']) { switch ($get['a']) {
case 2: case 2:
$this->rejectInvite($get); $this->rejectInvite($get);
@@ -74,7 +76,7 @@ class Alliance {
break; break;
} }
} }
if (isset($get['o'])) { if ($get['o'] > 0) {
switch ($get['o']) { switch ($get['o']) {
case 4: case 4:
$this->delInvite($get); $this->delInvite($get);
GameEngine/Database.php
+147 -52
View File
@@ -802,34 +802,73 @@ class MYSQLi_DB implements IDbConnection {
} }
function register($username, $password, $email, $tribe, $act, $uid = 0, $desc = null) { function register($username, $password, $email, $tribe, $act, $uid = 0, $desc = null) {
list($username, $password, $email, $tribe, $act, $uid, $desc) = $this->escape_input($username, $password, $email, (int) $tribe, $act, (int) $uid, $desc); $username = trim($username);
$email = filter_var($email, FILTER_VALIDATE_EMAIL) ?: '';
$tribe = (int)$tribe;
$uid = (int)$uid;
$desc = $desc ?? '';
$time = time();
$access = USER;
$startTime = strtotime(START_DATE) - strtotime(date('d.m.Y')) + strtotime(START_TIME);
$protectionTime = $uid != 3 ? (($startTime > $time) ? $startTime : $time) + PROTECTION : 0;
$time = time(); // încercăm varianta cu is_bcrypt (PHP 8.3)
$startTime = strtotime(START_DATE) - strtotime(date('d.m.Y')) + strtotime(START_TIME); $stmt = $this->dblink->prepare(
"INSERT INTO `".TB_PREFIX."users`
(id, username, password, access, email, timestamp, tribe, act, protect, lastupdate, regtime, desc2, is_bcrypt)
VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)"
);
$is_bcrypt = 1;
$stmt->bind_param("issisiiiiiisi", $uid, $username, $password, $access, $email, $time, $tribe, $act, $protectionTime, $time, $time, $desc, $is_bcrypt);
if($stmt->execute()){
$id = $stmt->insert_id ?: $uid;
$stmt->close();
return $id;
}
$stmt->close();
//If we're registering the Natars tribe, the protection must be 0 // fallback pentru DB vechi fără coloana is_bcrypt
$protectionTime = $uid != 3 ? (($startTime > $time) ? $stime : $time) + PROTECTION : 0; $stmt2 = $this->dblink->prepare(
"INSERT INTO `".TB_PREFIX."users`
$q = "INSERT INTO " . TB_PREFIX . "users (id, username, password, access, email, timestamp, tribe, act, protect, lastupdate, regtime, desc2, is_bcrypt) VALUES ($uid, '$username', '$password', " . USER . ", '$email', $time, $tribe, '$act', $protectionTime, $time, $time, '$desc', 1)"; (id, username, password, access, email, timestamp, tribe, act, protect, lastupdate, regtime, desc2)
VALUES (?,?,?,?,?,?,?,?,?,?,?,?)"
if(mysqli_query($this->dblink, $q)) return mysqli_insert_id($this->dblink); );
else $stmt2->bind_param("issisiiiiiis", $uid, $username, $password, $access, $email, $time, $tribe, $act, $protectionTime, $time, $time, $desc);
{
// if an error has occured, we probably don't have DB converted to handle bcrypt passwords yet if($stmt2->execute()){
$q = "INSERT INTO " . TB_PREFIX . "users (id, username, password, access, email, timestamp, tribe, act, protect, lastupdate, regtime, desc2) VALUES ($uid, '$username', '$password', " . USER . ", '$email', $time, $tribe, '$act', $protectionTime, $time, $time, '$desc')"; $id = $stmt2->insert_id ?: $uid;
if(mysqli_query($this->dblink, $q)) return mysqli_insert_id($this->dblink); $stmt2->close();
else return false; return $id;
} }
} $stmt2->close();
return false;
}
function activate($username, $password, $email, $tribe, $locate, $act, $act2) { function activate($username, $password, $email, $tribe, $locate, $act, $act2) {
list($username, $password, $email, $tribe, $locate, $act, $act2) = $this->escape_input($username, $password, $email, $tribe, $locate, $act, $act2); $username = trim($username);
$email = filter_var($email, FILTER_VALIDATE_EMAIL) ?: '';
$tribe = (int)$tribe;
$locate = (int)$locate;
$time = time();
$access = USER;
$time = time(); $stmt = $this->dblink->prepare(
$q = "INSERT INTO " . TB_PREFIX . "activate (username,password,access,email,tribe,timestamp,location,act,act2) VALUES ('$username', '$password', " . USER . ", '$email', " . (int) $tribe .", $time, $locate, '$act', '$act2')"; "INSERT INTO `".TB_PREFIX."activate`
if(mysqli_query($this->dblink,$q)) return mysqli_insert_id($this->dblink); (username,password,access,email,tribe,timestamp,location,act,act2)
else return false; VALUES (?,?,?,?,?,?,?,?,?)"
} );
$stmt->bind_param("ssisiiiss", $username, $password, $access, $email, $tribe, $time, $locate, $act, $act2);
if($stmt->execute()){
$id = $stmt->insert_id;
$stmt->close();
return $id;
}
$stmt->close();
return false;
}
function unreg($username) { function unreg($username) {
list($username) = $this->escape_input($username); list($username) = $this->escape_input($username);
@@ -1223,19 +1262,23 @@ class MYSQLi_DB implements IDbConnection {
} }
} }
function submitProfile($uid, $gender, $location, $birthday, $des1, $des2) { function submitProfile($uid, $gender, $location, $birthday, $desc1, $desc2) {
// temporarily replace newlines with placeholders, so they don't get escaped and backslashed stripped out of them $uid = (int)$uid;
$des1 = str_replace(['\\r', '\\n'], ['[!RETURN_CARRIAGE!]','[!NEW_LINE!]'], $des1); $gender = (int)$gender;
$des2 = str_replace(['\\r', '\\n'], ['[!RETURN_CARRIAGE!]','[!NEW_LINE!]'], $des2); $location = mb_substr(trim($location), 0, 30, 'UTF-8');
$birthday = trim($birthday);
$desc1 = trim($desc1);
$desc2 = trim($desc2);
list($uid, $gender, $location, $birthday, $des1, $des2) = $this->escape_input((int) $uid, (int) $gender, $location, $birthday, $des1, $des2); $stmt = $this->dblink->prepare(
"UPDATE `".TB_PREFIX."users`
// return new lines and return carriages to descriptions SET gender = ?, location = ?, birthday = ?, desc1 = ?, desc2 = ?
$des1 = str_replace(['[!RETURN_CARRIAGE!]','[!NEW_LINE!]'], ['\\r', '\\n'], $des1); WHERE id = ? LIMIT 1"
$des2 = str_replace(['[!RETURN_CARRIAGE!]','[!NEW_LINE!]'], ['\\r', '\\n'], $des2); );
$stmt->bind_param("issssi", $gender, $location, $birthday, $desc1, $desc2, $uid);
$q = "UPDATE " . TB_PREFIX . "users set gender = $gender, location = '$location', birthday = '$birthday', desc1 = '$des1', desc2 = '$des2' where id = $uid"; $stmt->execute();
return mysqli_query($this->dblink,$q); $stmt->close();
return true;
} }
function gpack($uid, $gpack) { function gpack($uid, $gpack) {
@@ -1383,8 +1426,9 @@ class MYSQLi_DB implements IDbConnection {
* @return array Returns the created villages ID * @return array Returns the created villages ID
*/ */
function generateVillages($villageArrays, $uid, $username, $troopsArray = null, $buildingsArray = null){ function generateVillages($villageArrays, $uid, $username, $troopsArray = null, $buildingsArray = null){
list($villageArrays, $uid, $username, $troopsArray, $buildingsArray) = $this->escape_input($villageArrays, (int) $uid, $username, $troopsArray, $buildingsArray); $uid = (int)$uid;
$username = trim($username);
$wids = $takenWids = $countedWids = $generatedWids = $i = []; $wids = $takenWids = $countedWids = $generatedWids = $i = [];
@@ -1441,15 +1485,36 @@ class MYSQLi_DB implements IDbConnection {
*/ */
function addVillage($wid, $uid, $username, $capital, $pop = 2, $villageName = null, $isNatar = 0) { function addVillage($wid, $uid, $username, $capital, $pop = 2, $villageName = null, $isNatar = 0) {
list($wid, $uid, $username, $capital, $pop, $villageName, $isNatar) = $this->escape_input((int) $wid, (int) $uid, $username, (int) $capital, (int) $pop, $villageName, (int) $isNatar); $wid = (int)$wid;
$uid = (int)$uid;
$capital = (int)$capital;
$pop = (int)$pop;
$isNatar = (int)$isNatar;
$username = trim($username);
$total = count($this->getVillagesID($uid)); $total = count($this->getVillagesID($uid));
if($villageName == null) $villageName = $username."\'s village ".($total >= 1 ? $total + 1 : ""); if (empty($villageName)) {
// fără backslash, fără htmlentities – doar text curat
$villageName = $username . "'s village" . ($total >= 1 ? " " . ($total + 1) : "");
}
$time = time(); $time = time();
$q = "INSERT into " . TB_PREFIX . "vdata (wref, owner, name, capital, pop, cp, celebration, wood, clay, iron, maxstore, crop, maxcrop, lastupdate, created, natar) values ($wid, $uid, '$villageName', $capital, $pop, 1, 0, 750, 750, 750, ".STORAGE_BASE.", 750, ".STORAGE_BASE.", $time, $time, $isNatar)"; $storage = STORAGE_BASE;
return mysqli_query($this->dblink,$q);
} $stmt = $this->dblink->prepare(
"INSERT INTO `".TB_PREFIX."vdata`
(wref, owner, name, capital, pop, cp, celebration, wood, clay, iron, maxstore, crop, maxcrop, lastupdate, created, natar)
VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)"
);
$cp = 1; $celebration = 0; $wood = 750; $clay = 750; $iron = 750; $crop = 750;
$stmt->bind_param("iisiiiiiiiiiiiii",
$wid, $uid, $villageName, $capital, $pop, $cp, $celebration,
$wood, $clay, $iron, $storage, $crop, $storage, $time, $time, $isNatar
);
$result = $stmt->execute();
$stmt->close();
return $result;
}
/** /**
* *
@@ -3928,14 +3993,20 @@ class MYSQLi_DB implements IDbConnection {
return mysqli_query($this->dblink,$q); return mysqli_query($this->dblink,$q);
} }
function setVillageName($vid, $name) { function setVillageName($vid, $name) {
list($vid, $name) = $this->escape_input((int) $vid, $name); $vid = (int)$vid;
$name = trim($name);
if ($name === '') return false;
$name = mb_substr($name, 0, 30, 'UTF-8');
if(!empty($name)){ $stmt = $this->dblink->prepare(
$q = "UPDATE " . TB_PREFIX . "vdata set name = '$name' where wref = $vid"; "UPDATE `".TB_PREFIX."vdata` SET name = ? WHERE wref = ? LIMIT 1"
return mysqli_query($this->dblink, $q); );
} $stmt->bind_param("si", $name, $vid);
} $result = $stmt->execute();
$stmt->close();
return $result;
}
function modifyPop($vid, $pop, $mode) { function modifyPop($vid, $pop, $mode) {
list($vid, $pop, $mode) = $this->escape_input((int) $vid, (int) $pop, $mode); list($vid, $pop, $mode) = $this->escape_input((int) $vid, (int) $pop, $mode);
@@ -8389,7 +8460,18 @@ References: User ID/Message ID, Mode
FROM ".TB_PREFIX."enforcement e FROM ".TB_PREFIX."enforcement e
JOIN ".TB_PREFIX."vdata v ON v.wref = e.vref JOIN ".TB_PREFIX."vdata v ON v.wref = e.vref
WHERE v.owner = $uid WHERE v.owner = $uid
AND e.from != e.vref"; AND e.from != e.vref
AND (
(e.u1 + e.u2 + e.u3 + e.u4 + e.u5 +
e.u6 + e.u7 + e.u8 + e.u9 + e.u10 +
e.u11 + e.u12 + e.u13 + e.u14 + e.u15 +
e.u16 + e.u17 + e.u18 + e.u19 + e.u20 +
e.u21 + e.u22 + e.u23 + e.u24 + e.u25 +
e.u26 + e.u27 + e.u28 + e.u29 + e.u30 +
e.u41 + e.u42 + e.u43 + e.u44 + e.u45 +
e.u46 + e.u47 + e.u48 + e.u49 + e.u50
) > 0
)";
$res = mysqli_query($this->dblink,$q); $res = mysqli_query($this->dblink,$q);
if(!$res){ die("SQL ERROR (REINFORCEMENTS): ".mysqli_error($this->dblink)); } if(!$res){ die("SQL ERROR (REINFORCEMENTS): ".mysqli_error($this->dblink)); }
@@ -8511,6 +8593,19 @@ References: User ID/Message ID, Mode
if(!empty($row['timestamp']) && $row['timestamp'] > $time){ if(!empty($row['timestamp']) && $row['timestamp'] > $time){
$errors[] = "ACCOUNT_DELETION"; $errors[] = "ACCOUNT_DELETION";
} }
// 10. Admin / Multihunter restriction
$q = "SELECT access FROM ".TB_PREFIX."users WHERE id=$uid";
$res = mysqli_query($this->dblink,$q);
if(!$res){ die("SQL ERROR (ACCESS): ".mysqli_error($this->dblink)); }
$row = mysqli_fetch_assoc($res);
$access = (int)$row['access'];
// 0 = user, 1 = sitter, 2 = mh, 3 = admin (depinde de serverul tău)
if($access >= 2){
$errors[] = "NO_VACATION_ACCESS";
}
return empty($errors) ? true : $errors; return empty($errors) ? true : $errors;
} }
GameEngine/Generator.php
+8 -16
View File
@@ -192,27 +192,19 @@ class MyGenerator
/** /**
* Page load start time * Page load start time
*/ */
public function pageLoadTimeStart() public function pageLoadTimeStart() {
{
if (isset($_SERVER["REQUEST_TIME_FLOAT"])) { return $_SERVER["REQUEST_TIME_FLOAT"]?? microtime(true);
return $_SERVER["REQUEST_TIME_FLOAT"];
}
$starttime = microtime(true);
$startarray = explode(" ", $starttime);
return $startarray[0];
} }
/** /**
* Page load end time * Page load end time
*/ */
public function pageLoadTimeEnd() public function pageLoadTimeEnd() {
{
$endtime = microtime(true); return microtime(true);
$endarray = explode(" ", $endtime);
return $endarray[0];
} }
} }
GameEngine/Profile.php
+23 -28
View File
@@ -76,40 +76,35 @@ class Profile {
* Update player profile + village names * Update player profile + village names
*/ */
private function updateProfile($post) { private function updateProfile($post) {
global $database, $session; global $database, $session;
$birthday = $post['jahr'] . '-' . $post['monat'] . '-' . $post['tag']; $birthday = $post['jahr'] . '-' . $post['monat'] . '-' . $post['tag'];
$birthday = preg_match('/^\d{4}-\d{1,2}-\d{1,2}$/', $birthday) ? $birthday : '0';
$database->submitProfile( $mw = (int)($post['mw'] ?? 0);
$session->uid, $ort = trim($post['ort'] ?? '');
$database->RemoveXSS($post['mw']), $be2 = trim($post['be2'] ?? ''); // descrierea stânga
$database->RemoveXSS($post['ort']), $be1 = trim($post['be1'] ?? ''); // descrierea dreapta
$database->RemoveXSS($birthday),
$database->RemoveXSS($post['be2']),
$database->RemoveXSS($post['be1'])
);
// Cache villages per request $database->submitProfile($session->uid, $mw, $ort, $birthday, $be2, $be1);
if (!isset(self::$cache['villages'][$session->uid])) {
self::$cache['villages'][$session->uid] = $database->getProfileVillages($session->uid);
}
$varray = self::$cache['villages'][$session->uid]; // Cache villages
$cnt = count($varray); if (!isset(self::$cache['villages'][$session->uid])) {
self::$cache['villages'][$session->uid] = $database->getProfileVillages($session->uid);
}
$varray = self::$cache['villages'][$session->uid];
$cnt = count($varray);
for ($i = 0; $i < $cnt; $i++) { for ($i = 0; $i < $cnt; $i++) {
if (!isset($post['dname' . $i])) continue; if (!isset($post['dname' . $i])) continue;
$newName = trim($post['dname' . $i]);
$database->setVillageName( if ($newName === '') continue;
$varray[$i]['wref'], $database->setVillageName($varray[$i]['wref'], $newName);
$database->RemoveXSS(trim($post['dname' . $i])) }
);
}
header("Location: spieler.php?uid=" . $session->uid);
exit;
}
header("Location: spieler.php?uid=" . $session->uid);
exit;
}
/** /**
* Gpack settings * Gpack settings
*/ */
Templates/Profile/profile.tpl
+4 -8
View File
@@ -95,9 +95,7 @@ maxlength="4" class="text year">
<!-- DESCRIPTION RIGHT --> <!-- DESCRIPTION RIGHT -->
<td rowspan="<?php echo 7 + count($database->getProfileVillages($session->uid)); ?>" class="desc1"> <td rowspan="<?php echo 7 + count($database->getProfileVillages($session->uid)); ?>" class="desc1">
<textarea tabindex="7" name="be1"><?php <textarea tabindex="7" name="be1"><?= htmlspecialchars($session->userinfo['desc2'] ?? '', ENT_QUOTES, 'UTF-8') ?></textarea>
echo $session->userinfo['desc2'] ?? '';
?></textarea>
</td> </td>
</tr> </tr>
@@ -125,7 +123,7 @@ echo $session->userinfo['desc2'] ?? '';
<th>Location</th> <th>Location</th>
<td> <td>
<input tabindex="5" type="text" name="ort" <input tabindex="5" type="text" name="ort"
value="<?php echo $session->userinfo['location'] ?? ''; ?>" value="<?= htmlspecialchars($session->userinfo['location'] ?? '', ENT_QUOTES, 'UTF-8') ?>"
maxlength="30" class="text"> maxlength="30" class="text">
</td> </td>
</tr> </tr>
@@ -145,7 +143,7 @@ for ($i = 0; $i < count($varray); $i++):
<td> <td>
<input tabindex="6" type="text" <input tabindex="6" type="text"
name="dname<?php echo $i; ?>" name="dname<?php echo $i; ?>"
value="<?php echo str_replace(['<','>'], '', $varray[$i]['name']); ?>" value="<?= htmlspecialchars($varray[$i]['name'], ENT_QUOTES, 'UTF-8') ?>"
maxlength="30" class="text"> maxlength="30" class="text">
</td> </td>
</tr> </tr>
@@ -154,9 +152,7 @@ maxlength="30" class="text">
<!-- DESCRIPTION LEFT --> <!-- DESCRIPTION LEFT -->
<tr> <tr>
<td colspan="2" class="desc2"> <td colspan="2" class="desc2">
<textarea tabindex="8" name="be2"><?php <textarea tabindex="8" name="be2"><?= htmlspecialchars($session->userinfo['desc1'] ?? '', ENT_QUOTES, 'UTF-8') ?></textarea>
echo $session->userinfo['desc1'] ?? '';
?></textarea>
</td> </td>
</tr> </tr>
Templates/Profile/vacation.tpl
+4 -1
View File
@@ -132,7 +132,10 @@ function vac_ok($key, $errors)
<li style="color:<?= vac_ok('ACCOUNT_DELETION',$errors) ? 'green':'red' ?>"> <li style="color:<?= vac_ok('ACCOUNT_DELETION',$errors) ? 'green':'red' ?>">
Account is not scheduled for deletion Account is not scheduled for deletion
</li> </li>
<li style="color:<?= vac_ok('NO_VACATION_ACCESS',$errors) ? 'green':'red' ?>">
Account is Admin or MH
</li>
</ul> </ul>
</div> </div>