mirror of
https://github.com/Shadowss/TravianZ.git
synced 2026-08-15 15:51:01 +00:00
Catalin Novgorodschi
89 lines
4.7 KiB
PHP
89 lines
4.7 KiB
PHP
<?php
|
|
#################################################################################
|
|
## ##
|
|
## -= YOU MUST NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
|
## ##
|
|
## --------------------------------------------------------------------------- ##
|
|
## ##
|
|
## Project: TravianZ ##
|
|
## Version: 05.03.2026 ##
|
|
## Filename: Admin/admin.php ##
|
|
## Developed by: Dzoki ##
|
|
## Refactored by: Shadow ##
|
|
## License: TravianZ Project ##
|
|
## Copyright: TravianZ (c) 2010-2026. All rights reserved. ##
|
|
## URLs: https://travianz.org ##
|
|
## https://github.com/Shadowss/TravianZ ##
|
|
## ##
|
|
#################################################################################
|
|
|
|
// Multi-instance bootstrap MUST run before session_start() so each world gets
|
|
// its own session name and its own configuration before Admin loads the DB.
|
|
require_once __DIR__ . "/../GameEngine/Instance/Bootstrap.php";
|
|
|
|
// ─── SESSION ─────────────────────────────────────────────────────────────────
|
|
// Harden session cookie before session_start() — has no effect after.
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
session_set_cookie_params([
|
|
'lifetime' => 0,
|
|
'path' => '/',
|
|
'secure' => isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
|
|
'httponly' => true,
|
|
'samesite' => 'Strict',
|
|
]);
|
|
session_start();
|
|
}
|
|
|
|
// ─── CSRF PROTECTION ──────────────────────────────────────────────────────────
|
|
// Token init + csrf_token()/csrf_field()/csrf_verify() helpers, shared with the
|
|
// admin Mods (which are POSTed to directly). See GameEngine/Admin/csrf.php.
|
|
include_once("../GameEngine/Admin/csrf.php");
|
|
|
|
// ─── CORE INCLUDES ───────────────────────────────────────────────────────────
|
|
// Bootstrap already selected the authoritative instance config. Keep this
|
|
// include for backwards compatibility with the existing Admin bootstrap.
|
|
include_once("../GameEngine/config.php");
|
|
include_once("../GameEngine/Database.php");
|
|
require_once __DIR__ . "/../GameEngine/Lang/loader.php";
|
|
tz_load_language(LANG);
|
|
include_once("../GameEngine/Admin/database.php");
|
|
|
|
// Helperul care descopera pachetele grafice din gpack/ (tz_available_gpacks).
|
|
// Sabloanele panoului il folosesc pentru selectorul de pachet; fara acest
|
|
// include, functia nu exista la randare si lista arata doar pachetul curent.
|
|
include_once("../GameEngine/Admin/Mods/config_template.php");
|
|
include_once("../GameEngine/Data/buidata.php");
|
|
include_once("../GameEngine/Artifacts.php");
|
|
include_once("../GameEngine/MultiAccount.php");
|
|
include_once("../GameEngine/PushProtection.php");
|
|
include_once("../GameEngine/RegBlock.php");
|
|
include_once("../GameEngine/Heatmap.php");
|
|
include_once("../GameEngine/GoldShop.php");
|
|
include_once("../GameEngine/QuestConfig.php");
|
|
|
|
// ─── SECURITY HELPERS ────────────────────────────────────────────────────────
|
|
|
|
/**
|
|
* Return a sanitised integer from a superglobal key, or null if missing/invalid.
|
|
* Replaces direct (int) casts on $_GET inside switch — ensures 0 is treated as
|
|
* absent (IDs are always >= 1 in TravianZ).
|
|
*/
|
|
function admin_input_id(array $source, string $key): ?int
|
|
{
|
|
if (!isset($source[$key]) || !ctype_digit((string)$source[$key])) {
|
|
return null;
|
|
}
|
|
$v = (int)$source[$key];
|
|
return $v > 0 ? $v : null;
|
|
}
|
|
|
|
/**
|
|
* HTML-escape a value for safe output inside HTML attributes or text nodes.
|
|
*/
|
|
function e(string $value): string
|
|
{
|
|
// decode first prevents &#39; / ' double encoding
|
|
return htmlspecialchars(html_entity_decode($value, ENT_QUOTES, 'UTF-8'),
|
|
ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
|
|
}
|