xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-09-08 19:37:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix #384 #387

Browse Source 
Fix #384 #387
This commit is contained in:
novgorodschi catalin
2026-09-04 12:45:00 +03:00
parent 7e3ffc4c2e
commit 90c8d3dee6
1 changed files with 23 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GameEngine/Session.php
+23 -18
View File
@@ -390,19 +390,21 @@ function __construct() {
/** /**
* FIXED: winner condition bug (safe parentheses + logic) * FIXED: winner condition bug (safe parentheses + logic)
* *
* BUG FIXED (game-lock after server win): this only protected 3 pages * BUG FIXED (game-lock after server win): originally only protected 3 pages
* (build.php, plus1.php, plus.php?id>=7). Every other gameplay-changing * (build.php, plus1.php, plus.php?id>=7). Added a2b.php - the rally-point
* endpoint - most importantly a2b.php (attacks/reinforcements/troop * "send troops" endpoint (attacks/raids/reinforcements/resource sends) -
* movements), but also dorf1.php/dorf2.php/dorf3.php, karte.php, resource * which is the actual gameplay-changing action that needs to stop once the
* transfers, troop training, etc. - stayed fully playable after the server * server is won. Deliberately scoped to just these action endpoints, NOT a
* was won, including actually executing on the backend (INSERT/UPDATE * blanket lock: dorf1.php/dorf2.php/dorf3.php, statistiken.php, messages,
* attack/reinforce) before any page ever redirected. Widened to a blanket * reports, karte.php etc. must all stay fully browsable after the winner
* lock: everything except winner.php itself and logout.php now redirects, * announcement so players can keep looking around - only the actions that
* for every logged-in request. This method is called from checkLogin(), * change game state (build/train and send troops) are blocked.
* which runs at the very start of Session::__construct() - itself the very *
* first include in Village.php, which every gameplay page includes before * This is called from checkLogin(), which runs at the very start of
* any of its own logic - so the lock (and the exit; that comes with it) * Session::__construct() - itself the very first include in Village.php,
* fires before a single gameplay DB write can happen, not just as a * which every gameplay page includes before any of its own logic - so for
* a2b.php/build.php specifically, the block (and the exit; that comes with
* it) fires before a single gameplay DB write can happen, not just as a
* frontend redirect. checkLogin() only calls this while $user is set (see * frontend redirect. checkLogin() only calls this while $user is set (see
* call site above), so anonymous visitors can still reach login.php to * call site above), so anonymous visitors can still reach login.php to
* authenticate; $this->inAdmin mirrors the same admin exemption already * authenticate; $this->inAdmin mirrors the same admin exemption already
@@ -421,12 +423,15 @@ function __construct() {
$requiredPage = basename($_SERVER['PHP_SELF']); $requiredPage = basename($_SERVER['PHP_SELF']);
if (in_array($requiredPage, ['winner.php', 'logout.php'], true)) { $idParam = isset($_GET['id']) ? (int)$_GET['id'] : 0;
return;
}
header('Location: winner.php'); if (
exit; in_array($requiredPage, ['build.php', 'plus1.php', 'a2b.php'], true) ||
($requiredPage === 'plus.php' && $idParam >= 7)
) {
header('Location: winner.php');
exit;
}
} }
/** /**