From cfc64aacc829274829d81c19ad3d7d95770600ae Mon Sep 17 00:00:00 2001
From: Pietro <iopietro@hotmail.it>
Date: Sun, 1 Apr 2018 18:37:10 +0200
Subject: [PATCH] Fixed an exploit in the Hero's mansion

With this exploit you can release any conquered oasis
---
 Templates/Build/37_land.tpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Templates/Build/37_land.tpl b/Templates/Build/37_land.tpl
index 30a5ba13..c7bb8299 100644
--- a/Templates/Build/37_land.tpl
+++ b/Templates/Build/37_land.tpl
@@ -3,7 +3,7 @@
 	Copyright: Travianx Project */
 
 	$oasisarray = $database->getOasis($village->wid);
-if(isset($_GET['gid']) && $_GET['gid']==37 && isset($_GET['del'])){
+if(isset($_GET['gid']) && $_GET['gid']==37 && isset($_GET['del']) && $database->getOasisField($_GET['del'], 'owner') == $session->uid){
 if($session->access != BANNED){
 	$database->removeOases($_GET['del']);
 	header("Location: build.php?id=".$id."&land");