mirror of
https://github.com/Shadowss/TravianZ.git
synced 2026-08-09 04:40:59 +00:00
Fix and Notice
Fix and Notice
This commit is contained in:
novgorodschi catalin
@@ -262,6 +262,28 @@ class Profile {
|
||||
if (!isset($post['dname' . $i])) continue;
|
||||
$newName = trim($post['dname' . $i]);
|
||||
if ($newName === '') continue;
|
||||
|
||||
/**
|
||||
* FIX SECURITATE (XSS stocat): numele satului nu era validat deloc.
|
||||
* Un jucator putea sa-si numeasca satul "<script>...</script>", iar
|
||||
* numele se afiseaza in rapoarte de lupta, pe harta si in listele de
|
||||
* sate - deci codul se executa in browserul altor jucatori.
|
||||
*
|
||||
* Aceleasi reguli ca la numele de cont: litere, cifre, punct, liniuta,
|
||||
* underscore si spatii simple. Fara caractere cu inteles in HTML.
|
||||
*/
|
||||
if (function_exists('mb_strlen')) {
|
||||
if (mb_strlen($newName, 'UTF-8') > 25) {
|
||||
$newName = mb_substr($newName, 0, 25, 'UTF-8');
|
||||
}
|
||||
} elseif (strlen($newName) > 25) {
|
||||
$newName = substr($newName, 0, 25);
|
||||
}
|
||||
|
||||
if (!preg_match('/^[\p{L}\p{N}._-]+(?: [\p{L}\p{N}._-]+)*$/u', $newName)) {
|
||||
continue; // nume respins, satul isi pastreaza numele vechi
|
||||
}
|
||||
|
||||
$database->setVillageName($varray[$i]['wref'], $newName);
|
||||
}
|
||||
|
||||
|
||||
+16
-5
@@ -1,10 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
# Refactor incremental SAFE - Report View (1.tpl)
|
||||
# - Optimized caching DB calls
|
||||
# - PHP 5.6+ / 7+ compatible
|
||||
# - Logic preserved 100%
|
||||
# - No structural changes affecting gameplay
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : 1.tpl ##
|
||||
## Type : Battle Report - Attack / Raid ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
#################################################################################
|
||||
|
||||
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
|
||||
|
||||
+16
-5
@@ -1,10 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
# Refactor incremental SAFE - Report View (10.tpl)
|
||||
# - Eliminates redundant DB calls (cached)
|
||||
# - PHP 5.6+ / 7+ compatible
|
||||
# - Logic unchanged (100% safe)
|
||||
# - Improved readability + minor performance gain
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : 10.tpl ##
|
||||
## Type : Trade Report - Merchant Delivery ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
#################################################################################
|
||||
|
||||
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
|
||||
|
||||
+16
-5
@@ -1,10 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
# Refactor incremental SAFE - Report View (15.tpl)
|
||||
# - Cached DB calls (performance improvement)
|
||||
# - PHP 5.6+ / 7+ compatible
|
||||
# - Logic preserved 100%
|
||||
# - Minor safety fixes (undefined vars / repeated calls)
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : 15.tpl ##
|
||||
## Type : Battle Report - Reinforcements Attacked ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
#################################################################################
|
||||
|
||||
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
|
||||
|
||||
+28
-8
@@ -1,10 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
# Refactor incremental SAFE - Report View (22.tpl)
|
||||
# - Cached DB calls (performance improvement)
|
||||
# - PHP 5.6+ / 7+ compatible
|
||||
# - Logic preserved 100%
|
||||
# - Safer handling for event type + arrays
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : 22.tpl ##
|
||||
## Type : Festive Report - Holiday / Visit Greeting ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
#################################################################################
|
||||
|
||||
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
|
||||
@@ -19,10 +30,12 @@ $targetId = $dataarray[2];
|
||||
$type = isset($dataarray[15]) ? (int)$dataarray[15] : 0;
|
||||
|
||||
// CACHE DB CALLS (reduce repeated queries)
|
||||
$attackerName = $database->getUserField($attackerId, "username", 0);
|
||||
$attackerName = htmlspecialchars(
|
||||
(string) $database->getUserField($attackerId, "username", 0), ENT_QUOTES, 'UTF-8');
|
||||
$attackerUid = $database->getUserField($attackerId, "id", 0);
|
||||
|
||||
$targetName = $database->getUserField($targetId, "username", 0);
|
||||
$targetName = htmlspecialchars(
|
||||
(string) $database->getUserField($targetId, "username", 0), ENT_QUOTES, 'UTF-8');
|
||||
|
||||
// ======================== MESSAGE BUILD ========================
|
||||
if ($type == 1) {
|
||||
@@ -72,7 +85,14 @@ if ($type == 1) {
|
||||
<?php echo FROM_THE_VILL; ?>
|
||||
|
||||
<a href="karte.php?d=<?php echo $dataarray[1]."&c=".$generator->getMapCheck($dataarray[1]); ?>">
|
||||
<?php echo $database->getVillageField($dataarray[1], "name"); ?>
|
||||
<?php
|
||||
// Escapam si aici, nu doar la intrare: numele salvate INAINTE de
|
||||
// validare pot contine deja HTML.
|
||||
echo htmlspecialchars(
|
||||
(string) $database->getVillageField($dataarray[1], "name"),
|
||||
ENT_QUOTES, 'UTF-8'
|
||||
);
|
||||
?>
|
||||
</a>
|
||||
|
||||
</td>
|
||||
|
||||
+16
-4
@@ -1,9 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
# Settler reports (24.tpl) - issue #178
|
||||
# Handles ntype 24 (new village founded) and ntype 25 (valley occupied).
|
||||
# Title is stored in English and localized at display via tz_loc_topic().
|
||||
# Body is built from localized constants + coordinates stored in `data`.
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : 24.tpl ##
|
||||
## Type : Settler Report - New Village / Oasis ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
#################################################################################
|
||||
|
||||
$ntype = (int)($message->readingNotice['ntype'] ?? 24);
|
||||
|
||||
+16
-10
@@ -1,15 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
# Hero adventure report (26.tpl) - T4 hero port, Phase 1 #
|
||||
# Handles ntype 26. The reward payload is stored in ndata.data as a #
|
||||
# query-string, e.g.: #
|
||||
# difficulty=1&exp=22&silver=80&wood=300&clay=0&iron=450&crop=120&hp=18 #
|
||||
# &item=HERO_ITEM_OINTMENT&itemqty=2 #
|
||||
# Any missing key simply renders as 0 / hidden, so partial payloads are safe. #
|
||||
# #
|
||||
# Lang constants (HERO_ADV_*, HERO_ITEM_*) arrive in the Phase 6 lang pass; #
|
||||
# the tz() helper below falls back to a readable literal until then so this #
|
||||
# template never emits "Undefined constant" before the rest of the port lands. #
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : 26.tpl ##
|
||||
## Type : Hero Report - Adventure Result ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
#################################################################################
|
||||
|
||||
// Tiny local fallback so this file is self-contained in Phase 1.
|
||||
|
||||
+16
-6
@@ -1,11 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
# Hero auction report (27.tpl) - T4 hero port, Phase 4 #
|
||||
# Handles ntype 27. Payload (ndata.data, query-string): #
|
||||
# role=winner&itemid=71&qty=1&price=120&refund=30 #
|
||||
# role=seller&itemid=71&qty=1&price=120&fee=12 #
|
||||
# role=seller&expired=1&itemid=71&qty=1 #
|
||||
# Same defensive-lang conventions as 26.tpl. #
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : 27.tpl ##
|
||||
## Type : Hero Report - Auction Result ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
#################################################################################
|
||||
|
||||
if (!function_exists('tz_hero_auc')) {
|
||||
|
||||
+16
-5
@@ -1,10 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
# Refactor incremental SAFE - Report View (3.tpl)
|
||||
# - Performance optimization (DB call caching)
|
||||
# - PHP 5.6+ / 7+ compatible
|
||||
# - Logic unchanged (100% safe)
|
||||
# - Reduced redundant queries
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : 3.tpl ##
|
||||
## Type : Battle Report - No Troops Returned ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
#################################################################################
|
||||
|
||||
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
|
||||
|
||||
+16
-5
@@ -1,10 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
# Refactor incremental SAFE - Report View (8.tpl)
|
||||
# - Removes redundant DB calls (cache)
|
||||
# - PHP 5.6+ / 7+ compatible
|
||||
# - Logic unchanged (100% safe)
|
||||
# - Minor stability fixes
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : 8.tpl ##
|
||||
## Type : Battle Report - Scouting ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
#################################################################################
|
||||
|
||||
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
|
||||
|
||||
+16
-6
@@ -1,11 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
# Refactor incremental SAFE - Report Loader (9.tpl)
|
||||
# - Added basic input validation
|
||||
# - Prevents undefined index warnings
|
||||
# - PHP 5.6+ / 7+ compatible
|
||||
# - Logic preserved 100%
|
||||
# - Minimal safe hardening (no behavior change)
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : 9.tpl ##
|
||||
## Type : Report Loader - Archived Report Dispatcher ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
#################################################################################
|
||||
|
||||
// ======================== SAFE INPUT ========================
|
||||
|
||||
@@ -1,11 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
# Refactor incremental SAFE - Reports Overview (all.tpl)
|
||||
# - Reduced duplicate DB calls (caching user data)
|
||||
# - Safer pagination handling
|
||||
# - PHP 5.6+ / 7+ compatible
|
||||
# - Logic preserved 100%
|
||||
# - Minor SQL safety improvement (cast uid already present, kept safe)
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : all.tpl ##
|
||||
## Type : Reports Inbox - List and Filters ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
#################################################################################
|
||||
|
||||
// ======================== NOTICE TYPES ========================
|
||||
|
||||
@@ -1,11 +1,21 @@
|
||||
<?php
|
||||
|
||||
#################################################################################
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename : index.php ##
|
||||
## Type : Directory Access Guard ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Developed by : aggenkeech & Shadow ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Contact : cata7007@gmail.com ##
|
||||
## Project : TravianZ ##
|
||||
## URLs: : https://travianz.org ##
|
||||
## GitHub : https://github.com/Shadowss/TravianZ ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## License : TravianZ Project ##
|
||||
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
|
||||
## --------------------------------------------------------------------------- ##
|
||||
## Filename index.php ##
|
||||
## Developed by: aggenkeech ##
|
||||
## License: TravianZ Project ##
|
||||
## Copyright: TravianZ (c) 2010-2025. All rights reserved. ##
|
||||
#################################################################################
|
||||
|
||||
// prevent direct misuse in weird contexts (optional but safe)
|
||||
|
||||
Reference in New Issue
Block a user