mirror of
https://github.com/Shadowss/TravianZ.git
synced 2026-08-09 21:01:00 +00:00
novgorodschi catalin
137 lines
5.9 KiB
PHP
137 lines
5.9 KiB
PHP
<?php
|
|
|
|
#################################################################################
|
|
## -= YOU MAY NOT REMOVE OR CHANGE THIS NOTICE =- ##
|
|
## --------------------------------------------------------------------------- ##
|
|
## Filename sysmessage.php ##
|
|
## Type BACKEND ##
|
|
## Purpose Handler for the Admin Panel "Create System Message" form ##
|
|
## (Admin/Templates/sysmessage.tpl). Displays a global system ##
|
|
## message to all players (same mechanism as sysmsg.php): ##
|
|
## writes Templates/text.tpl from text_format.tpl and sets ##
|
|
## users.ok = 1 so every player sees it on their next page. ##
|
|
## License: TravianZ Project ##
|
|
## Copyright: TravianZ (c) 2010-2026. All rights reserved. ##
|
|
## ##
|
|
#################################################################################
|
|
|
|
// #299: load CSRF helpers + admin_deny() before the access check below.
|
|
require_once(__DIR__ . '/../csrf.php');
|
|
session_start();
|
|
|
|
include_once("../../config.php");
|
|
include_once("../../Database.php");
|
|
|
|
if (!isset($_SESSION['access']) || $_SESSION['access'] < ADMIN) {
|
|
admin_deny('You must be signed in as an administrator to view this page. Your session may have expired — please return to the admin panel and sign in again.');
|
|
}
|
|
|
|
// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
|
|
// itself (it does not go through admin.php's central csrf_verify()).
|
|
require_once(__DIR__ . '/../csrf.php');
|
|
csrf_verify();
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Resolve project root (so we can read/write Templates/*.tpl)
|
|
// ---------------------------------------------------------------------------
|
|
$autoprefix = '';
|
|
for ($i = 0; $i < 6; $i++) {
|
|
$autoprefix = str_repeat('../', $i);
|
|
if (file_exists($autoprefix . 'autoloader.php')) {
|
|
break;
|
|
}
|
|
}
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| STEP 1 - PREPARE (show confirmation)
|
|
|--------------------------------------------------------------------------
|
|
*/
|
|
if (isset($_POST['action']) && $_POST['action'] == 'prepare') {
|
|
|
|
if (empty($_POST['subject'])) die("Subject required");
|
|
if (empty($_POST['message'])) die("Message required");
|
|
|
|
$_SESSION['sys_subject'] = trim($_POST['subject']);
|
|
$_SESSION['sys_message'] = trim($_POST['message']);
|
|
$_SESSION['sys_color'] = trim($_POST['color'] ?? 'black');
|
|
|
|
header("Location: ../../../Admin/admin.php?p=sysmessage&confirm=1");
|
|
exit;
|
|
}
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| STEP 2 - EXECUTE (write the global system message)
|
|
|--------------------------------------------------------------------------
|
|
*/
|
|
if (isset($_POST['action']) && $_POST['action'] == 'execute') {
|
|
|
|
// Cancel button
|
|
if (isset($_POST['confirm']) && $_POST['confirm'] == 'No') {
|
|
unset($_SESSION['sys_subject'], $_SESSION['sys_message'], $_SESSION['sys_color']);
|
|
header("Location: ../../../Admin/admin.php?p=sysmessage");
|
|
exit;
|
|
}
|
|
|
|
if (empty($_SESSION['sys_subject']) || empty($_SESSION['sys_message'])) {
|
|
header("Location: ../../../Admin/admin.php?p=sysmessage");
|
|
exit;
|
|
}
|
|
|
|
$subject = trim($_SESSION['sys_subject']);
|
|
$message = trim($_SESSION['sys_message']);
|
|
$color = trim($_SESSION['sys_color'] ?: 'black');
|
|
|
|
// Compose the HTML body: coloured subject heading + message (line breaks kept).
|
|
$body = '<div style="color:' . $color . ';font-weight:bold;font-size:14px;margin-bottom:8px">' . $subject . '</div>';
|
|
$body .= $message;
|
|
|
|
// %TEKST% is injected into a PHP double-quoted string inside text_format.tpl,
|
|
// so escape backslash, double-quote and $ to avoid breaking the string or
|
|
// allowing code injection. str_replace (not preg_replace) so the replacement
|
|
// is treated literally.
|
|
$safe = str_replace(['\\', '"', '$'], ['\\\\', '\\"', '\\$'], $body);
|
|
|
|
$format = @file_get_contents($autoprefix . 'Templates/text_format.tpl');
|
|
if ($format === false) {
|
|
die("Cannot read Templates/text_format.tpl");
|
|
}
|
|
|
|
// Inlocuim DOAR atribuirea reala, nu orice aparitie a marcajului.
|
|
//
|
|
// BUG REPARAT: text_format.tpl continea marcajul si intr-un comentariu din
|
|
// antetul de credite ("Preserved original placeholder logic (%TEKST%)").
|
|
// str_replace le lovea pe amandoua, deci mesajul ajungea si in mijlocul
|
|
// comentariului. Textul avea ghilimele si linii noi, care inchideau blocul
|
|
// de comentariu si rupeau fisierul - de aici "imi rupe jocul".
|
|
//
|
|
// Tiparul de mai jos prinde exact linia de atribuire, deci un marcaj ramas
|
|
// intr-un comentariu nu mai poate face rau.
|
|
$pattern = '/\$txt\s*=\s*"%TEKST%"\s*;/';
|
|
$out = preg_replace($pattern, '$txt = "' . str_replace('$', '\\$', $safe) . '";', $format, 1, $count);
|
|
|
|
if ($out === null || $count !== 1) {
|
|
// Sablonul nu mai arata cum ne asteptam: mai bine oprim decat sa
|
|
// scriem un fisier stricat peste unul care functioneaza.
|
|
die("Cannot update Templates/text.tpl: the placeholder was not found exactly once in text_format.tpl");
|
|
}
|
|
|
|
if (@file_put_contents($autoprefix . 'Templates/text.tpl', $out) === false) {
|
|
die("Cannot write Templates/text.tpl (check permissions)");
|
|
}
|
|
|
|
// Make the message visible to every player (they will see it on next page).
|
|
$database->setUsersOk(1);
|
|
|
|
unset($_SESSION['sys_subject'], $_SESSION['sys_message'], $_SESSION['sys_color']);
|
|
|
|
header("Location: ../../../Admin/admin.php?p=sysmessage&done=1");
|
|
exit;
|
|
}
|
|
|
|
// Fallback
|
|
header("Location: ../../../Admin/admin.php?p=sysmessage");
|
|
exit;
|
|
?>
|