xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-11 13:51:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed a lot of bugs/security issues in the market

Browse Source 
+Fixed a bug that permitted to send resourcers to himself
+Fixed a bug that permitted to send resources to invalid villages
+Fixed a bug that permitted to create offerings with 0 resources or
invalid resources type
+Fixed a bug that permitted to accept offerings of other allies
+Fixed a bug that permitted to accept offerings with a too high maxtime
+Fixed a bug that permitted to accept offering from the same village
+Fixed a bug that permitted to accept offering with too few merchants
+Fixed a bug that permitted to accept offerings without the requested
resources
+Fixed a bug that hid offerings with a valid maxtime
+Fixed some bugs relative to errors diplaying
+Added some error
+Some clean-up
This commit is contained in:
iopietro
2018-04-16 23:45:21 +02:00
parent de8859da03
commit e116511c73
7 changed files with 114 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Templates/Build/17.tpl
+19 -16
View File
@@ -35,7 +35,7 @@ $userID = $database->getUserField($villageOwner,'id',0);
}
$maxcarry = $market->maxcarry;
$maxcarry *= $market->merchantAvail();
if(isset($_POST['ft'])=='check' && $allres!=0 && $allres <= $maxcarry && ($_POST['x']!="" && $_POST['y']!="" or $_POST['dname']!="") && $checkexist && ($userAccess == 2 || $userAccess == MULTIHUNTER || (ADMIN_ALLOW_INCOMING_RAIDS && $userAccess == ADMIN))){
if(isset($_POST['ft'])=='check' && (($_POST['send3'] > 1 && $_POST['send3'] < 3 && $session->goldclub) || $_POST['send3'] == 1) && $getwref != $village->wid && $allres!=0 && $allres <= $maxcarry && ($_POST['x']!="" && $_POST['y']!="" or $_POST['dname']!="") && $checkexist && ($userAccess == 2 || $userAccess == MULTIHUNTER || (ADMIN_ALLOW_INCOMING_RAIDS && $userAccess == ADMIN))){
?>
<form method="POST" name="snd" action="build.php">
<input type="hidden" name="ft" value="mk1">
@@ -72,20 +72,20 @@ if(isset($_POST['ft'])=='check' && $allres!=0 && $allres <= $maxcarry && ($_POST
<tbody><tr>
<th><?php echo COORDINATES;?>:</th>
<?php
if($_POST['x']!="" && $_POST['y']!="" && is_numeric($_POST['x']) && is_numeric($_POST['y'])){
$getwref = $database->getVilWref($_POST['x'],$_POST['y']);
$getvilname = $database->getVillageField($getwref, "name");
$getvilowner = $database->getVillageField($getwref, "owner");
$getvilcoor['y'] = $_POST['y'];
$getvilcoor['x'] = $_POST['x'];
$time = $generator->procDistanceTime($getvilcoor,$village->coor,$session->tribe,0);
if(!empty($_POST['x']) && !empty($_POST['y']) && is_numeric($_POST['x']) && is_numeric($_POST['y'])){
$getwref = $database->getVilWref($_POST['x'],$_POST['y']);
$getvilname = $database->getVillageField($getwref, "name");
$getvilowner = $database->getVillageField($getwref, "owner");
$getvilcoor['y'] = $_POST['y'];
$getvilcoor['x'] = $_POST['x'];
$time = $generator->procDistanceTime($getvilcoor,$village->coor,$session->tribe,0);
}
else if($_POST['dname']!=""){
$getwref = $database->getVillageByName($_POST['dname']);
$getvilcoor = $database->getCoor($getwref);
$getvilname = $database->getVillageField($getwref, "name");
$getvilowner = $database->getVillageField($getwref, "owner");
$time = $generator->procDistanceTime($getvilcoor,$village->coor,$session->tribe,0);
else if(!empty($_POST['dname'])){
$getwref = $database->getVillageByName($_POST['dname']);
$getvilcoor = $database->getCoor($getwref);
$getvilname = $database->getVillageField($getwref, "name");
$getvilowner = $database->getVillageField($getwref, "owner");
$time = $generator->procDistanceTime($getvilcoor,$village->coor,$session->tribe,0);
}
?>
<td><a href="karte.php?d=<?php echo $getwref; ?>&c=<?php echo $generator->getMapCheck($getwref); ?>"><?php echo $getvilname; ?>(<?php echo $getvilcoor['x']; ?>|<?php echo $getvilcoor['y']; ?>)<span class="clear"></span></a></td>
@@ -202,7 +202,7 @@ $coor['y'] = "";
</table>
<div class="clear"></div>
<?php if($session->goldclub == 1){?>
<p><select name="send3"><option value="1" selected="selected">1x</option><option value="2">2x</option><option value="3">3x</option></select><?php echo GO;?></p>
<p><select name="send3"><option value="1" selected="selected">1x</option><option value="2">2x</option><option value="3">3x</option></select> <?php echo GO;?></p>
<?php
}else{
?>
@@ -215,10 +215,13 @@ $coor['y'] = "";
$error = '';
if(isset($_POST['ft'])=='check'){
if(!$checkexist){
if($form->returnErrors() > 0) $error = '<span class="error"><b>'.$form->getError("error").'</b></span>';
elseif(!$checkexist){
$error = '<span class="error"><b>'.NO_COORDINATES_SELECTED.'</b></span>';
}elseif($getwref == $village->wid){
$error = '<span class="error"><b>'.CANNOT_SEND_RESOURCES.'</b></span>';
}elseif($_POST['send3'] < 1 || $_POST['send3'] > 3 || ($_POST['send3'] > 1 && !$session->goldclub)){
$error = '<span class="error"><b>'.INVALID_MERCHANTS_REPETITION.'</b></span>';
}elseif($userAccess == '0' or ($userAccess == MULTIHUNTER && $userID == 5) or (!ADMIN_ALLOW_INCOMING_RAIDS && $userAccess == ADMIN)){
$error = '<span class="error"><b>'.BANNED_CANNOT_SEND_RESOURCES.'.</b></span>';
}elseif($_POST['r1']==0 && $_POST['r2']==0 && $_POST['r3']==0 && $_POST['r4']==0){
Templates/Build/17_1.tpl
+15 -1
View File
@@ -47,6 +47,20 @@ if($session->plus) {
}
?>
<div class="clear"></div><table id="range" cellpadding="1" cellspacing="1">
<?php
if(isset($_GET['e1']))
{
echo "<p class=\"error2\">".NOT_ENOUGH_RESOURCES."</p>";
}
elseif(isset($_GET['e2']))
{
echo "<p class=\"error2\">".INVALID_OFFER."</p>";
}
elseif(isset($_GET['e3']))
{
echo "<p class=\"error2\">".NOT_ENOUGH_MERCHANTS."</p>";
}
?>
<thead><tr>
<th colspan="5"><a name="h2"></a><?php echo OFFERS_MARKETPLACE;?></th>
</tr>
@@ -95,7 +109,7 @@ switch($market->onsale[$i]['gtype']) {
echo "<td class=\"act none\">".NOT_ENOUGH_MERCHANTS."</td></tr>";
}
else if($session->access != BANNED){
echo "<td class=\"act\"><a href=\"build.php?id=$id&t=1&a=".$session->mchecker."&g=".$market->onsale[$i]['id']."\">".LUMBER."Accept offer</a></td>";
echo "<td class=\"act\"><a href=\"build.php?id=$id&t=1&a=".$session->mchecker."&g=".$market->onsale[$i]['id']."\">Accept offer</a></td>";
}else{
echo "<td class=\"act\"><a href=\"banned.php\">".ACCEP_OFFER."</a></td>";
}
Templates/Build/17_2.tpl
+2 -4
View File
@@ -58,10 +58,8 @@
{
echo "<p class=\"error2\">".NOT_ENOUGH_MERCHANTS."</p>";
}
else
{
echo "<p>Merchants: ".$market->merchantAvail()."/".$market->merchant."</p>";
}
echo "<br /><p>Merchants: ".$market->merchantAvail()."/".$market->merchant."</p>";
?>
<input type="image" tabindex="8" value="ok" name="s1" id="btn_ok" class="dynamic_img" src="img/x.gif" alt="OK" <?php //if(!$market->merchantAvail()) { echo "DISABLED"; }?>/></p>
</form>
Templates/Build/17_4.tpl
+2 -2
View File
@@ -22,7 +22,7 @@ include("17_edit.tpl");
}else{
?>
<p><?php echo TRADE_ROUTES_DESC;?> <img src="../../<?php echo GP_LOCATE; ?>img/a/gold.gif" alt="Gold" title="<?php echo GOLD;?>">2.</p>
<p><?php echo TRADE_ROUTES_DESC;?> <img src="../../<?php echo GP_LOCATE; ?>img/a/gold.gif" alt="Gold" title="<?php echo GOLD;?>"><b>2</b>.</p>
<table id="npc" cellpadding="1" cellspacing="1">
<thead>
@@ -61,7 +61,7 @@ echo "".TRADE_ROUTE_TO." <a href=karte.php?d=".$route['wid']."&c=".$generator->g
| <a href="build.php?id=<?php echo $id; ?>&t=4&action=editRoute&routeid=<?php echo $routeid; ?>"><?php echo EDIT;?></a>
| <a href="build.php?action=delRoute&routeid=<?php echo $routeid; ?>"><?php echo DELETE;?></a>
</th></tr></tfoot></table>
* <?php echo EXTEND_TRADE_ROUTES;?> <img src="../../<?php echo GP_LOCATE; ?>img/a/gold.gif" alt="Gold" title="<?php echo GOLD;?>">2
* <?php echo EXTEND_TRADE_ROUTES;?> <img src="../../<?php echo GP_LOCATE; ?>img/a/gold.gif" alt="Gold" title="<?php echo GOLD;?>"><b>2</b>
<br>
<div class="options">
<a class="arrow" href="build.php?gid=17&t=4&create">» <?php echo CREATE_TRADE_ROUTES;?></a>