From 54265f42e987522803288477952d6e5c4daeeb24 Mon Sep 17 00:00:00 2001
From: slawkens <slawkens@gmail.com>
Date: Fri, 6 Feb 2026 20:26:14 +0100
Subject: [PATCH] New Setting: block create account spam by ip

---
 system/pages/account/create.php | 11 +++++++++++
 system/settings.php             | 12 ++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/system/pages/account/create.php b/system/pages/account/create.php
index 49fdf1a2..5d9edf59 100644
--- a/system/pages/account/create.php
+++ b/system/pages/account/create.php
@@ -10,6 +10,7 @@
  */
 
 use MyAAC\CreateCharacter;
+use MyAAC\Models\AccountAction;
 use MyAAC\Models\AccountEmailVerify;
 
 defined('MYAAC') or die('Direct access not allowed!');
@@ -44,6 +45,16 @@ $errors = array();
 $save = isset($_POST['save']) && $_POST['save'] == 1;
 if($save)
 {
+	$cooldown = setting('core.account_create_ip_block_cooldown');;
+	if ($cooldown > 0) {
+		$accountAction = AccountAction::where('ip', get_browser_real_ip())->where('action', 'Account created.')->where('date', '>=', time() - ($cooldown * 60))->first();
+
+		if ($accountAction) {
+			$minute = ($cooldown > 1 ? 'minutes' : 'minute');
+			$errors['account'] = "You have to wait $cooldown $minute before creating another account.";
+		}
+	}
+
 	if(!config('account_login_by_email')) {
 		if(USE_ACCOUNT_NAME) {
 			$account_name = $_POST['account'];
diff --git a/system/settings.php b/system/settings.php
index e667474e..7ab35a44 100644
--- a/system/settings.php
+++ b/system/settings.php
@@ -1744,6 +1744,18 @@ Sent by MyAAC,<br/>
 				'account_login_ipban_protection', '=', 'true'
 			]
 		],
+
+		[
+			'type' => 'section',
+			'title' => 'Cooldowns',
+		],
+		'account_create_ip_block_cooldown' => [
+			'name' => 'Create Account IP Block Cooldown',
+			'type' => 'number',
+			'desc' => 'Block flooding create account per ip. If you still have a problem with account create spam - then its recommended to install the recaptcha plugin.' .
+				'<br/><strong>In minutes.</strong> 0 to disable.',
+			'default' => 10,
+		],
 	],
 	'callbacks' => [
 		'beforeSave' => function(&$settings, &$values) {