Some important fixes

Some important fixes

Admin/Templates/addABTroops.tpl

@@ -17,7 +17,7 @@
 ##  Copyright      : TravianZ (c) 2010-2025. All rights reserved.              ##
 ## --------------------------------------------------------------------------- ##
 #################################################################################
-$unarray = array(1=>U1,U2,U3,U4,U5,U6,U7,U8,U9,U10,U11,U12,U13,U14,U15,U16,U17,U18,U19,U20,U21,U22,U23,U24,U25,U26,U27,U28,U29,U30,U31,U32,U33,U34,U35,U36,U37,U38,U39,U40,U41,U42,U43,U44,U45,U46,U47,U48,U49,U50,U99,U0);
+$unarray = [1=>U1,U2,U3,U4,U5,U6,U7,U8,U9,U10,U11,U12,U13,U14,U15,U16,U17,U18,U19,U20,U21,U22,U23,U24,U25,U26,U27,U28,U29,U30,U31,U32,U33,U34,U35,U36,U37,U38,U39,U40,U41,U42,U43,U44,U45,U46,U47,U48,U49,U50,U51,U52,U53,U54,U55,U56,U57,U58,U59,U60,U61,U62,U63,U64,U65,U66,U67,U68,U69,U70,U71,U72,U73,U74,U75,U76,U77,U78,U79,U80,U81,U82,U83,U84,U85,U86,U87,U88,U89,U90,U99,U0];
 if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die(defined('ACCESS_DENIED_ADMIN') ? ACCESS_DENIED_ADMIN : 'Access Denied: You are not Admin!');
 }

GameEngine/Admin/Mods/goldPromo.php

@@ -11,7 +11,7 @@
 
 require_once(__DIR__ . '/../csrf.php');
 if (!isset($_SESSION)) session_start();
-if ($_SESSION['access'] < ADMIN) {
+if ($_SESSION['access'] < 9) {
     admin_deny('You must be signed in as an administrator to do this. '
         . 'Your session may have expired — please return to the admin panel and sign in again.');
 }
@@ -33,7 +33,7 @@ $admid = (int)($_SESSION['id'] ?? 0);
 $check = mysqli_query($GLOBALS['link'],
     "SELECT access FROM " . TB_PREFIX . "users WHERE id = " . $admid);
 $acc = $check ? mysqli_fetch_assoc($check) : null;
-if (!$acc || (int)$acc['access'] < ADMIN) {
+if (!$acc || (int)$acc['access'] < 9) {
     admin_deny('Your session may have expired — please sign in again.');
 }
 

GameEngine/Database/DatabaseMovementQueries.php

@@ -340,7 +340,11 @@ trait DatabaseMovementQueries {
         list($id) = $this->escape_input($id);
 
 		$vinfo = $this->getVillage($id);
-		$vtribe = $this->getUserField($vinfo['owner'], "tribe", 0);
+
+		// Satul poate lipsi (sters intre timp). Fara proprietar nu avem ce trib
+		// sa citim, deci nu are rost sa continuam cu null.
+		$vOwner = is_array($vinfo) && isset($vinfo['owner']) ? (int) $vinfo['owner'] : 0;
+		$vtribe = $vOwner > 0 ? $this->getUserField($vOwner, "tribe", 0) : 0;
         $movingunits = [];
         
 		$outgoingarray = $this->getMovement(3, $id, 0);

GameEngine/Database/DatabaseUserQueries.php

@@ -316,7 +316,11 @@ trait DatabaseUserQueries {
 		}
 		$result = mysqli_query($this->dblink,$q);
 		$dbarray = mysqli_fetch_array($result);
-		return $dbarray[$field];
+
+		// Cont inexistent: intoarcem null in loc sa citim dintr-un rand gol.
+		return (is_array($dbarray) && array_key_exists($field, $dbarray))
+			? $dbarray[$field]
+			: null;
 	}
 
 	function login($username, $password) {
@@ -341,6 +345,18 @@ trait DatabaseUserQueries {
 
 		$dbarray = mysqli_fetch_array($result);
 
+		/**
+		 * Utilizator inexistent: iesim imediat, cu acelasi rezultat ca o parola
+		 * gresita (functia intoarce false si mai jos).
+		 *
+		 * Inainte se continua si se citeau $dbarray['password'], ['is_bcrypt'],
+		 * ['id'] si ['sessid'] dintr-un rand gol - de aici sirul de avertismente
+		 * la fiecare incercare de autentificare cu un nume care nu exista.
+		 */
+		if (!is_array($dbarray)) {
+			return false;
+		}
+
 		// even if we didn't do a DB conversion for bcrypt passwords,
 		// we still need to check if this password wasn't encrypted via password_hash,
 		// since all methods were updated to use that instead of md5 and therefore
@@ -539,7 +555,9 @@ trait DatabaseUserQueries {
 		$q = "SELECT sit FROM " . TB_PREFIX . "online WHERE uid = $uid LIMIT 1";
 		$result = mysqli_query($this->dblink,$q);
 		$dbarray = mysqli_fetch_array($result);
-		return $dbarray['sit'];
+
+		// Utilizatorul poate lipsi (cont sters). Fara sitter, intoarcem 0.
+		return (is_array($dbarray) && isset($dbarray['sit'])) ? $dbarray['sit'] : 0;
 	}
 
 	function UpdateOnline($mode, $name = "", $time = "", $uid = 0) {

GameEngine/Database/DatabaseVillageQueries.php

@@ -104,7 +104,13 @@ trait DatabaseVillageQueries {
 	}
 
 	function getVrefField($ref, $field, $use_cache = true) {
-        return $this->getVillage($ref, 0, $use_cache)[$field];
+        // getVillage() intoarce null pentru un sat inexistent (sters, cucerit
+        // sau id gresit). Fara verificare, apelantul primea un avertisment.
+        $village = $this->getVillage($ref, 0, $use_cache);
+
+        return (is_array($village) && array_key_exists($field, $village))
+            ? $village[$field]
+            : null;
 	}
 
     // no need to cache this method
@@ -254,7 +260,18 @@ trait DatabaseVillageQueries {
 	    
 	    //Count each kid in its own array, to check how many villages must be created
 	    foreach($villageArrays as $village){
-	        if($village['wid'] == 0) $countedWids[$village['mode']][$village['kid']]++;
+	        if($village['wid'] == 0) {
+	            // prima aparitie a perechii mode/kid: pornim de la zero, altfel
+	            // incrementam o cheie inexistenta
+	            $vMode = $village['mode'];
+	            $vKid  = $village['kid'];
+
+	            if (!isset($countedWids[$vMode][$vKid])) {
+	                $countedWids[$vMode][$vKid] = 0;
+	            }
+
+	            $countedWids[$vMode][$vKid]++;
+	        }
 	    }
 	    
 	    //Generate the number of desired village for each kid
@@ -2347,7 +2364,13 @@ trait DatabaseVillageQueries {
 		}
 		
         for($i = 0; $i <= count($cropholder) - 1; $i++){
-			$basecrop += $bid4[$buildarray[$cropholder[$i]]]['prod'];
+			// Un slot fara cladire nu are nivel in $buildarray, iar bid4 nu are
+			// intrare pentru el. Sarim peste, in loc sa adunam null.
+			$cropLevel = isset($buildarray[$cropholder[$i]]) ? $buildarray[$cropholder[$i]] : null;
+
+			if ($cropLevel !== null && isset($bid4[$cropLevel]['prod'])) {
+				$basecrop += $bid4[$cropLevel]['prod'];
+			}
 		}
 		
 		$crop = $basecrop + $basecrop * 0.25 * $cropo;

GameEngine/Technology.php

@@ -306,8 +306,14 @@ class Technology {
         global $database;
 		
         $ownunit = $database->getUnit($base, $useCache);
-		$ownunit['u99'] -= $ownunit['u99'];
+		// getUnit() poate intoarce null (sat fara rand in units) sau un rand
-		$ownunit['u99o'] -= $ownunit['u99o'];
+		// fara coloanele de prizonieri. Le tratam ca zero.
+		if (!is_array($ownunit)) {
+			$ownunit = array();
+		}
+
+		$ownunit['u99']  = 0;
+		$ownunit['u99o'] = 0;
 		$enforcementarray = $database->getEnforceVillage($base, 0, $useCache);
 		$this->addUnits($ownunit, $enforcementarray);
 		if($mode == 0){
@@ -529,7 +535,12 @@ class Technology {
 
             // Horse Drinking Trough lets a number of cavalry units drink for free (1 crop less each).
             $freeDrinker = $horsedrinking > 0 && (($i == 4 && $horsedrinking >= 10) || ($i == 5 && $horsedrinking >= 15) || ($i == 6 && $horsedrinking == 20));
-            $upkeep += ($dataarray['pop'] - ($freeDrinker ? 1 : 0)) * $array[$index];
+            // Bucla trece prin toate cele 90 de unitati, dar tabloul primit are
+            // doar unitatile care exista efectiv. O cheie lipsa inseamna zero
+            // unitati din tipul acela.
+            $unitCount = isset($array[$index]) ? $array[$index] : 0;
+
+            $upkeep += ($dataarray['pop'] - ($freeDrinker ? 1 : 0)) * $unitCount;
         }
 
         $index = $prisoners > 0 ? 't11' : 'hero';

Templates/Plus/10.tpl

@@ -36,7 +36,11 @@ if($session->sit == 0) {
         // update sesiune
         $session->gold -= $cost;
         $_SESSION['gold'] = $session->gold;
-        $session->b2 = ($session->b2 > $now ? $session->b2 : $now) + PLUS_PRODUCTION;
+        // Session nu are proprietatea ->b2; valoarea sta in userarray, de unde
+        // o citeste si PopulateVar(). Scrierea directa crea o proprietate
+        // dinamica (depreciata in PHP 8.2) si nu se vedea nicaieri.
+        $currentB2 = isset($session->userarray['b2']) ? (int) $session->userarray['b2'] : 0;
+        $session->userarray['b2'] = ($currentB2 > $now ? $currentB2 : $now) + PLUS_PRODUCTION;
 
         // LOG pentru a2b2.php
         mysqli_query($database->dblink,

Templates/Plus/11.tpl

@@ -35,7 +35,11 @@ if($session->sit == 0) {
     if(mysqli_affected_rows($database->dblink) == 1) {
         $session->gold -= $cost;
         $_SESSION['gold'] = $session->gold;
-        $session->b3 = ($session->b3 > $now ? $session->b3 : $now) + PLUS_PRODUCTION;
+        // Session nu are proprietatea ->b3; valoarea sta in userarray, de unde
+        // o citeste si PopulateVar(). Scrierea directa crea o proprietate
+        // dinamica (depreciata in PHP 8.2) si nu se vedea nicaieri.
+        $currentB3 = isset($session->userarray['b3']) ? (int) $session->userarray['b3'] : 0;
+        $session->userarray['b3'] = ($currentB3 > $now ? $currentB3 : $now) + PLUS_PRODUCTION;
 
         // LOG pentru a2b2
         mysqli_query($database->dblink,

Templates/Plus/12.tpl

@@ -34,7 +34,11 @@ if($session->sit == 0) {
     if(mysqli_affected_rows($database->dblink) == 1) {
         $session->gold -= $cost;
         $_SESSION['gold'] = $session->gold;
-        $session->b4 = ($session->b4 > $now ? $session->b4 : $now) + PLUS_PRODUCTION;
+        // Session nu are proprietatea ->b4; valoarea sta in userarray, de unde
+        // o citeste si PopulateVar(). Scrierea directa crea o proprietate
+        // dinamica (depreciata in PHP 8.2) si nu se vedea nicaieri.
+        $currentB4 = isset($session->userarray['b4']) ? (int) $session->userarray['b4'] : 0;
+        $session->userarray['b4'] = ($currentB4 > $now ? $currentB4 : $now) + PLUS_PRODUCTION;
 
         // LOG pentru a2b2
         mysqli_query($database->dblink,

Templates/Plus/9.tpl

@@ -36,7 +36,11 @@ if($session->sit == 0) {
         // update sesiune instant
         $session->gold -= $cost;
         $_SESSION['gold'] = $session->gold;
-        $session->b1 = ($session->b1 > $now ? $session->b1 : $now) + PLUS_PRODUCTION;
+        // Session nu are proprietatea ->b1; valoarea sta in userarray, de unde
+        // o citeste si PopulateVar(). Scrierea directa crea o proprietate
+        // dinamica (depreciata in PHP 8.2) si nu se vedea nicaieri.
+        $currentB1 = isset($session->userarray['b1']) ? (int) $session->userarray['b1'] : 0;
+        $session->userarray['b1'] = ($currentB1 > $now ? $currentB1 : $now) + PLUS_PRODUCTION;
 
         // LOG pentru a2b2.php
 		mysqli_query($database->dblink,

Templates/menu.tpl

@@ -146,6 +146,13 @@ $idUser      = isset($_SESSION['id_user']) ? (int)$_SESSION['id_user'] : 0;
         </a>
     </p>
 	
+	<!-- Discord -->
+	<p>
+		<a href="https://discord.gg/HzU2HfqaG" target="_blank" rel="noopener noreferrer" style="color: #d32f2f; font-weight: bold;">
+			Discord
+		</a>
+	</p>
+
     <!-- Plus / Support / Custom links -->
     <p>
 

a2b.php

@@ -47,7 +47,7 @@ if(isset($_GET['newdid'])){
 	}else if(isset($_GET['z'])){
 		header("Location: ".$_SERVER['PHP_SELF']."?z=".$_GET['z']);
 		exit();
-	}else if($_GET['id'] > 0){
+	}else if(isset($_GET['id']) && $_GET['id'] > 0){
 		header("Location: ".$_SERVER['PHP_SELF']);
 		exit();
 	}

allianz.php

@@ -102,7 +102,14 @@ if(isset($_GET['aid']) || isset($_GET['fid']) || isset($_GET['fid2']) ||
 				break;
 		}
 	}
-	else echo $alliance->allianceArray['tag'].' - '.$alliance->allianceArray['name'];
+	else {
+		// Jucator fara alianta: allianceArray e gol, deci nu avem ce afisa.
+		echo isset($alliance->allianceArray['tag'], $alliance->allianceArray['name'])
+			? htmlspecialchars($alliance->allianceArray['tag'], ENT_QUOTES, 'UTF-8')
+			  . ' - '
+			  . htmlspecialchars($alliance->allianceArray['name'], ENT_QUOTES, 'UTF-8')
+			: '';
+	}
 
 ?></title>
 	<link rel="shortcut icon" href="favicon.ico"/>

berichte.php

@@ -37,7 +37,7 @@ if(isset($_GET['newdid'])) {
     } else if ( isset( $_GET['vill'] ) && isset( $_GET['id'] ) ) {
         header( "Location: " . $_SERVER['PHP_SELF'] . "?id=" . $_GET['id'] . "&vill=" . $_GET['vill'] . "" );
         exit;
-    } else if ( $_GET['id'] != 0 ) {
+    } else if ( isset($_GET['id']) && $_GET['id'] != 0 ) {
         header( "Location: " . $_SERVER['PHP_SELF'] . "?id=" . $_GET['id'] );
         exit;
     } else {