xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-09-02 16:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix and Notice

Browse Source 
Fix and Notice
This commit is contained in:
novgorodschi catalin
2026-08-05 12:03:09 +03:00
parent ae2d835a84
commit 9084350e01
13 changed files with 225 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GameEngine/Profile.php
+22
View File
@@ -262,6 +262,28 @@ class Profile {
if (!isset($post['dname' . $i])) continue; if (!isset($post['dname' . $i])) continue;
$newName = trim($post['dname' . $i]); $newName = trim($post['dname' . $i]);
if ($newName === '') continue; if ($newName === '') continue;
/**
* FIX SECURITATE (XSS stocat): numele satului nu era validat deloc.
* Un jucator putea sa-si numeasca satul "<script>...</script>", iar
* numele se afiseaza in rapoarte de lupta, pe harta si in listele de
* sate - deci codul se executa in browserul altor jucatori.
*
* Aceleasi reguli ca la numele de cont: litere, cifre, punct, liniuta,
* underscore si spatii simple. Fara caractere cu inteles in HTML.
*/
if (function_exists('mb_strlen')) {
if (mb_strlen($newName, 'UTF-8') > 25) {
$newName = mb_substr($newName, 0, 25, 'UTF-8');
}
} elseif (strlen($newName) > 25) {
$newName = substr($newName, 0, 25);
}
if (!preg_match('/^[\p{L}\p{N}._-]+(?: [\p{L}\p{N}._-]+)*$/u', $newName)) {
continue; // nume respins, satul isi pastreaza numele vechi
}
$database->setVillageName($varray[$i]['wref'], $newName); $database->setVillageName($varray[$i]['wref'], $newName);
} }
Templates/Notice/1.tpl
+16 -5
View File
@@ -1,10 +1,21 @@
<?php <?php
################################################################################# #################################################################################
# Refactor incremental SAFE - Report View (1.tpl) ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
# - Optimized caching DB calls ## --------------------------------------------------------------------------- ##
# - PHP 5.6+ / 7+ compatible ## Filename : 1.tpl ##
# - Logic preserved 100% ## Type : Battle Report - Attack / Raid ##
# - No structural changes affecting gameplay ## --------------------------------------------------------------------------- ##
## Developed by : Shadow ##
## --------------------------------------------------------------------------- ##
## Contact : cata7007@gmail.com ##
## Project : TravianZ ##
## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ##
################################################################################# #################################################################################
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data'])); $dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
Templates/Notice/10.tpl
+16 -5
View File
@@ -1,10 +1,21 @@
<?php <?php
################################################################################# #################################################################################
# Refactor incremental SAFE - Report View (10.tpl) ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
# - Eliminates redundant DB calls (cached) ## --------------------------------------------------------------------------- ##
# - PHP 5.6+ / 7+ compatible ## Filename : 10.tpl ##
# - Logic unchanged (100% safe) ## Type : Trade Report - Merchant Delivery ##
# - Improved readability + minor performance gain ## --------------------------------------------------------------------------- ##
## Developed by : Shadow ##
## --------------------------------------------------------------------------- ##
## Contact : cata7007@gmail.com ##
## Project : TravianZ ##
## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ##
################################################################################# #################################################################################
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data'])); $dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
Templates/Notice/15.tpl
+16 -5
View File
@@ -1,10 +1,21 @@
<?php <?php
################################################################################# #################################################################################
# Refactor incremental SAFE - Report View (15.tpl) ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
# - Cached DB calls (performance improvement) ## --------------------------------------------------------------------------- ##
# - PHP 5.6+ / 7+ compatible ## Filename : 15.tpl ##
# - Logic preserved 100% ## Type : Battle Report - Reinforcements Attacked ##
# - Minor safety fixes (undefined vars / repeated calls) ## --------------------------------------------------------------------------- ##
## Developed by : Shadow ##
## --------------------------------------------------------------------------- ##
## Contact : cata7007@gmail.com ##
## Project : TravianZ ##
## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ##
################################################################################# #################################################################################
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data'])); $dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
Templates/Notice/22.tpl
+28 -8
View File
@@ -1,10 +1,21 @@
<?php <?php
################################################################################# #################################################################################
# Refactor incremental SAFE - Report View (22.tpl) ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
# - Cached DB calls (performance improvement) ## --------------------------------------------------------------------------- ##
# - PHP 5.6+ / 7+ compatible ## Filename : 22.tpl ##
# - Logic preserved 100% ## Type : Festive Report - Holiday / Visit Greeting ##
# - Safer handling for event type + arrays ## --------------------------------------------------------------------------- ##
## Developed by : Shadow ##
## --------------------------------------------------------------------------- ##
## Contact : cata7007@gmail.com ##
## Project : TravianZ ##
## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ##
################################################################################# #################################################################################
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data'])); $dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
@@ -19,10 +30,12 @@ $targetId = $dataarray[2];
$type = isset($dataarray[15]) ? (int)$dataarray[15] : 0; $type = isset($dataarray[15]) ? (int)$dataarray[15] : 0;
// CACHE DB CALLS (reduce repeated queries) // CACHE DB CALLS (reduce repeated queries)
$attackerName = $database->getUserField($attackerId, "username", 0); $attackerName = htmlspecialchars(
(string) $database->getUserField($attackerId, "username", 0), ENT_QUOTES, 'UTF-8');
$attackerUid = $database->getUserField($attackerId, "id", 0); $attackerUid = $database->getUserField($attackerId, "id", 0);
$targetName = $database->getUserField($targetId, "username", 0); $targetName = htmlspecialchars(
(string) $database->getUserField($targetId, "username", 0), ENT_QUOTES, 'UTF-8');
// ======================== MESSAGE BUILD ======================== // ======================== MESSAGE BUILD ========================
if ($type == 1) { if ($type == 1) {
@@ -72,7 +85,14 @@ if ($type == 1) {
<?php echo FROM_THE_VILL; ?> <?php echo FROM_THE_VILL; ?>
<a href="karte.php?d=<?php echo $dataarray[1]."&amp;c=".$generator->getMapCheck($dataarray[1]); ?>"> <a href="karte.php?d=<?php echo $dataarray[1]."&amp;c=".$generator->getMapCheck($dataarray[1]); ?>">
<?php echo $database->getVillageField($dataarray[1], "name"); ?> <?php
// Escapam si aici, nu doar la intrare: numele salvate INAINTE de
// validare pot contine deja HTML.
echo htmlspecialchars(
(string) $database->getVillageField($dataarray[1], "name"),
ENT_QUOTES, 'UTF-8'
);
?>
</a> </a>
</td> </td>
Templates/Notice/24.tpl
+16 -4
View File
@@ -1,9 +1,21 @@
<?php <?php
################################################################################# #################################################################################
# Settler reports (24.tpl) - issue #178 ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
# Handles ntype 24 (new village founded) and ntype 25 (valley occupied). ## --------------------------------------------------------------------------- ##
# Title is stored in English and localized at display via tz_loc_topic(). ## Filename : 24.tpl ##
# Body is built from localized constants + coordinates stored in `data`. ## Type : Settler Report - New Village / Oasis ##
## --------------------------------------------------------------------------- ##
## Developed by : Shadow ##
## --------------------------------------------------------------------------- ##
## Contact : cata7007@gmail.com ##
## Project : TravianZ ##
## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ##
################################################################################# #################################################################################
$ntype = (int)($message->readingNotice['ntype'] ?? 24); $ntype = (int)($message->readingNotice['ntype'] ?? 24);
Templates/Notice/26.tpl
+16 -10
View File
@@ -1,15 +1,21 @@
<?php <?php
################################################################################# #################################################################################
# Hero adventure report (26.tpl) - T4 hero port, Phase 1 # ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
# Handles ntype 26. The reward payload is stored in ndata.data as a # ## --------------------------------------------------------------------------- ##
# query-string, e.g.: # ## Filename : 26.tpl ##
# difficulty=1&exp=22&silver=80&wood=300&clay=0&iron=450&crop=120&hp=18 # ## Type : Hero Report - Adventure Result ##
# &item=HERO_ITEM_OINTMENT&itemqty=2 # ## --------------------------------------------------------------------------- ##
# Any missing key simply renders as 0 / hidden, so partial payloads are safe. # ## Developed by : Shadow ##
# # ## --------------------------------------------------------------------------- ##
# Lang constants (HERO_ADV_*, HERO_ITEM_*) arrive in the Phase 6 lang pass; # ## Contact : cata7007@gmail.com ##
# the tz() helper below falls back to a readable literal until then so this # ## Project : TravianZ ##
# template never emits "Undefined constant" before the rest of the port lands. # ## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ##
################################################################################# #################################################################################
// Tiny local fallback so this file is self-contained in Phase 1. // Tiny local fallback so this file is self-contained in Phase 1.
Templates/Notice/27.tpl
+16 -6
View File
@@ -1,11 +1,21 @@
<?php <?php
################################################################################# #################################################################################
# Hero auction report (27.tpl) - T4 hero port, Phase 4 # ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
# Handles ntype 27. Payload (ndata.data, query-string): # ## --------------------------------------------------------------------------- ##
# role=winner&itemid=71&qty=1&price=120&refund=30 # ## Filename : 27.tpl ##
# role=seller&itemid=71&qty=1&price=120&fee=12 # ## Type : Hero Report - Auction Result ##
# role=seller&expired=1&itemid=71&qty=1 # ## --------------------------------------------------------------------------- ##
# Same defensive-lang conventions as 26.tpl. # ## Developed by : Shadow ##
## --------------------------------------------------------------------------- ##
## Contact : cata7007@gmail.com ##
## Project : TravianZ ##
## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ##
################################################################################# #################################################################################
if (!function_exists('tz_hero_auc')) { if (!function_exists('tz_hero_auc')) {
Templates/Notice/3.tpl
+16 -5
View File
@@ -1,10 +1,21 @@
<?php <?php
################################################################################# #################################################################################
# Refactor incremental SAFE - Report View (3.tpl) ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
# - Performance optimization (DB call caching) ## --------------------------------------------------------------------------- ##
# - PHP 5.6+ / 7+ compatible ## Filename : 3.tpl ##
# - Logic unchanged (100% safe) ## Type : Battle Report - No Troops Returned ##
# - Reduced redundant queries ## --------------------------------------------------------------------------- ##
## Developed by : Shadow ##
## --------------------------------------------------------------------------- ##
## Contact : cata7007@gmail.com ##
## Project : TravianZ ##
## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ##
################################################################################# #################################################################################
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data'])); $dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
Templates/Notice/8.tpl
+16 -5
View File
@@ -1,10 +1,21 @@
<?php <?php
################################################################################# #################################################################################
# Refactor incremental SAFE - Report View (8.tpl) ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
# - Removes redundant DB calls (cache) ## --------------------------------------------------------------------------- ##
# - PHP 5.6+ / 7+ compatible ## Filename : 8.tpl ##
# - Logic unchanged (100% safe) ## Type : Battle Report - Scouting ##
# - Minor stability fixes ## --------------------------------------------------------------------------- ##
## Developed by : Shadow ##
## --------------------------------------------------------------------------- ##
## Contact : cata7007@gmail.com ##
## Project : TravianZ ##
## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ##
################################################################################# #################################################################################
$dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data'])); $dataarray = array_map('tz_expand_report', explode(",", $message->readingNotice['data']));
Templates/Notice/9.tpl
+16 -6
View File
@@ -1,11 +1,21 @@
<?php <?php
################################################################################# #################################################################################
# Refactor incremental SAFE - Report Loader (9.tpl) ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
# - Added basic input validation ## --------------------------------------------------------------------------- ##
# - Prevents undefined index warnings ## Filename : 9.tpl ##
# - PHP 5.6+ / 7+ compatible ## Type : Report Loader - Archived Report Dispatcher ##
# - Logic preserved 100% ## --------------------------------------------------------------------------- ##
# - Minimal safe hardening (no behavior change) ## Developed by : Shadow ##
## --------------------------------------------------------------------------- ##
## Contact : cata7007@gmail.com ##
## Project : TravianZ ##
## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ##
################################################################################# #################################################################################
// ======================== SAFE INPUT ======================== // ======================== SAFE INPUT ========================
Templates/Notice/all.tpl
+16 -6
View File
@@ -1,11 +1,21 @@
<?php <?php
################################################################################# #################################################################################
# Refactor incremental SAFE - Reports Overview (all.tpl) ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
# - Reduced duplicate DB calls (caching user data) ## --------------------------------------------------------------------------- ##
# - Safer pagination handling ## Filename : all.tpl ##
# - PHP 5.6+ / 7+ compatible ## Type : Reports Inbox - List and Filters ##
# - Logic preserved 100% ## --------------------------------------------------------------------------- ##
# - Minor SQL safety improvement (cast uid already present, kept safe) ## Developed by : Shadow ##
## --------------------------------------------------------------------------- ##
## Contact : cata7007@gmail.com ##
## Project : TravianZ ##
## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ##
################################################################################# #################################################################################
// ======================== NOTICE TYPES ======================== // ======================== NOTICE TYPES ========================
Templates/Notice/index.php
+15 -5
View File
@@ -1,11 +1,21 @@
<?php <?php
################################################################################# #################################################################################
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ## ## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
## --------------------------------------------------------------------------- ##
## Filename : index.php ##
## Type : Directory Access Guard ##
## --------------------------------------------------------------------------- ##
## Developed by : aggenkeech & Shadow ##
## --------------------------------------------------------------------------- ##
## Contact : cata7007@gmail.com ##
## Project : TravianZ ##
## URLs: : https://travianz.org ##
## GitHub : https://github.com/Shadowss/TravianZ ##
## --------------------------------------------------------------------------- ##
## License : TravianZ Project ##
## Copyright : TravianZ (c) 2010-2026. All rights reserved. ##
## --------------------------------------------------------------------------- ## ## --------------------------------------------------------------------------- ##
## Filename index.php ##
## Developed by: aggenkeech ##
## License: TravianZ Project ##
## Copyright: TravianZ (c) 2010-2025. All rights reserved. ##
################################################################################# #################################################################################
// prevent direct misuse in weird contexts (optional but safe) // prevent direct misuse in weird contexts (optional but safe)