mirror of
https://github.com/Znote/ZnoteAAC.git
synced 2025-04-30 03:09:22 +02:00
f5bbc78101
Security issue reported by @slawkens All wifi traffic is broadcasted - this means that any nearby sniffing devices can read your traffic. If you're connecting to a page through HTTP over public/unencrypted wifi you can assume that whatever information you are sending and receiving is public - all it takes is an attacker nearby with an antenna to read all that in plaintext. To perform a true MITM by having traffic flow through them, attackers can use technologies like WiFi pineapples or aircrack-ng to force users to connect to their wifi network. Connecting over cable internet is much harder to intercept/mitm because you're not broadcasting your traffic for the whole neighborhood. In order to compromise this network an attacker will have to gain access to it somehow - either through physical access to a network port, malware installed on a host machine or router, etc. When an attacker has access to a network they then have to exploit that access through attacks such as ARP poisoning or HSRP spoofing. These attacks just MITM traffic - anyone on the network can still sniff (read, but not change) traffic, but keep in mind HTTPS traffic is still encrypted and can't be read. https://security.stackexchange.com/questions/153148/how-easy-it-is-to-actually-perform-mitm-attack-these-days
ZnoteAAC
What is Znote AAC?
Znote AAC is a full-fledged website used together with an Open Tibia(OT) server. It aims to be super easy to install and compatible with all the popular OT distributions. It is created in PHP with a simple custom procedural framework.
Where do I download?
We use github to distribute our versions, stable are tagged as releases, while development is the latest commit.
NOTE: Developement version supports TFS 1.0, but you can expect bugs to occur.
Compatible OT distributions
Znote AAC primarily aims to be compatible with Forgotten Server Forgotten Server is commonly known as TFS (The Forgotten Server) and Znote AAC supports these versions:
- TFS 0.2.13+ (Since initial release)
- TFS 0.3.6+ (Since Znote AAC 1.2)
- TFS 1.2+ (Since Znote AAC 1.5)
Requirements
- PHP Version 5.3.3 or higher. Mostly tested on 5.6 and 7.0. Most web stacks ships with this as default these days.
Optionals
- For email registration verification and account recovery: PHPMailer Version 6.x, extracted and renamed to just "PHPMailer" in Znote AAC directory.
- PHP extention curl for PHPMailer, paypal and google reCaptcha services.
- PHP extention openssl for google reCaptcha services.
Installation instructions
1: Extract the .zip file to your web directory (Example: C:\UniServ\www\ ) Without modifying config.php, enter the website and wait for mysql connection error. This will show you the rest of the instructions as well as the mysql schema.
2: Edit config.php and:
- modify $config['ServerEngine'] with correct TFS version you are running. (TFS_02, TFS_03, TFS_10).
- modify $config['page_admin_access'] with your admin account username(s).
3: Before inserting correct SQL connection details, visit the website ( http://127.0.0.1/ ), it will generate a mysql schema you should import to your OT servers database.
4: Follow the steps on the website and import the SQL schema for Znote AAC, and edit config.php with correct mysql details.
5: IF you have existing database from active OT server, enter the folder called "special" and convert the database for Znote AAC support ( http://127.0.0.1/special/ )
6: Enjoy Znote AAC. You can look around HERE for plugins and resources to Znote AAC, for instance various free templates to use.
7: Please note that you need PHP cURL enabled to make Paypal payments work.
8: You may need to change directory access rights of /engine/cache to allow writing.
Features:
Znote AAC is very rich feature wise, here is an attempt at summarizing what we offer.
Server distribution compatibility:
- OTHire
- TFS 0.2
- TFS 0.3/4
- TFS 1.x
- Distributions based on these (such as OTX).
General
- Server wide latest death list
- Server wide latest kills list
- Server information with PvP settings, skill rates, experience stages (parses config.lua and stages.xml file)
- Spells page with vocation filters (parses spells.xml file)
- Item list showing equippable items (parses items.xml file)
Account & login:
- Basic account registration
- Change password and email
- reCaptcha antibot(spam) system
- Email verification & lost account interface
- Two-factor authentication support
- Hide characters from character list
- Support helpdesk (tickets)
Create character:
- Supports custom vocations, starting skills, available towns
- Character firstitems through provided Lua script
- Soft character deletion
House:
- Houses list with towns filter
- House bidding
Character profile
- General information such as name, vocation, level, guild membership etc...
- Obtained achievement list
- Player comments
- Death list
- Quest progression
- Character list
Guilds
- Configurable level and account type restrictions to create guild
- Create and disband guilds
- Invite and revoke players to guild
- Change name of guild positions
- Add nickname to guild members
- Guild forum board accessible only for guild members & admin.
- Upload guild image
- Guild description
- Invite, accept and cancel war declarations
- View ongoing guild wars
Item market
- Want to buy list
- Want to sell list
- Item search
- Compare item offer with other similar offers, as well as transaction history
Downloads
- Page with download links to client version and IP changer
- Tutorial on how to connect to server
Achievement system
- List of all achievements and character obtained achievements in their profile.
Highscores
- Vocation & skill type filters
Buy shop points / digital currency
- PayPal payment gateway
- PayGol (SMS) payment gateway
- PagseGuro payment gateway
Shop system
- Items
- Premium days
- Change character gender
- Change character name
- Outfits
- Mounts
- Custom offer types. (basic Lua knowledge required)
Forum
- Create custom discussion boards
- Level restriction to post
- Player outfit as avatars
- Player position
- Guildboards
- Feedback board where all threads are only visible for admins.
- Hide thread, close thread, stick thread
- Forum search
Cache system
- Offload SQL load and CPU usage by loading treated data from a flatfile instead of raw SQL queries.
Administration
- Delete character
- Ban character and/or account
- Change password of account
- Give character in-game position
- Give shop points to character
- Teleport a player or all players to home town, specific town or specific position.
- Edit level and skills of player
- View in-game bug reports and feedback on forum
- Overview of shop transactions and their status
- Moderate user submitted images to the gallery
- Create news with a feature rich text editor
- Add changelogs
- Load and update server and spells information
- Helpdesk
TODO List:
- Check Milestones