From fc5635bad34dc87737cafc634e67f020f4827f6d Mon Sep 17 00:00:00 2001 From: slawkens Date: Fri, 22 Sep 2023 16:19:56 +0200 Subject: [PATCH 001/174] spaceless twig tag is deprecated as well --- templates/tibiacom/account.login.html.twig | 4 ++-- templates/tibiacom/buttons.base.html.twig | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/templates/tibiacom/account.login.html.twig b/templates/tibiacom/account.login.html.twig index d71ac78e..3e459a8b 100644 --- a/templates/tibiacom/account.login.html.twig +++ b/templates/tibiacom/account.login.html.twig @@ -115,14 +115,14 @@
- {% spaceless %} + {% apply spaceless %}
- {% endspaceless %} + {% endapply %}

{{ config.lua.serverName }}...

diff --git a/templates/tibiacom/buttons.base.html.twig b/templates/tibiacom/buttons.base.html.twig index 6833a61d..fe8447dc 100644 --- a/templates/tibiacom/buttons.base.html.twig +++ b/templates/tibiacom/buttons.base.html.twig @@ -1,8 +1,8 @@ -{% spaceless %} +{% apply spaceless %}
-{% endspaceless %} +{% endapply %} From a2a273cde219001d4cefd10612a1a55ff2114af6 Mon Sep 17 00:00:00 2001 From: slawkens Date: Fri, 22 Sep 2023 16:18:05 +0200 Subject: [PATCH 002/174] Twig_SimpleFilter is deprecated --- system/twig.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/system/twig.php b/system/twig.php index f82717a5..49c0cce6 100644 --- a/system/twig.php +++ b/system/twig.php @@ -30,7 +30,7 @@ if($dev_mode) { } unset($dev_mode); -$filter = new Twig_SimpleFilter('timeago', function ($datetime) { +$filter = new TwigFilter('timeago', function ($datetime) { $time = time() - strtotime($datetime); From 21bff971370e70697157e38f8e386efdaa276326 Mon Sep 17 00:00:00 2001 From: slawkens Date: Tue, 26 Sep 2023 21:52:05 +0200 Subject: [PATCH 003/174] Add additional cache keys to clear function --- system/functions.php | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/system/functions.php b/system/functions.php index 37f241bc..287d0f42 100644 --- a/system/functions.php +++ b/system/functions.php @@ -1201,11 +1201,37 @@ function clearCache() if ($cache->fetch('template_ini' . $template_name, $tmp)) $cache->delete('template_ini' . $template_name); - if ($cache->fetch('plugins_hooks', $tmp)) - $cache->delete('plugins_hooks'); + foreach (get_templates() as $template) { + if ($cache->fetch('template_ini' . $template, $tmp)) { + $cache->delete('template_ini' . $template); + } + } - if ($cache->fetch('plugins_routes', $tmp)) + if ($cache->fetch('template_menus', $tmp)) { + $cache->delete('template_menus'); + } + if ($cache->fetch('database_tables', $tmp)) { + $cache->delete('database_tables'); + } + if ($cache->fetch('database_columns', $tmp)) { + $cache->delete('database_columns'); + } + if ($cache->fetch('database_checksum', $tmp)) { + $cache->delete('database_checksum'); + } + if ($cache->fetch('last_kills', $tmp)) { + $cache->delete('last_kills'); + } + + if ($cache->fetch('hooks', $tmp)) { + $cache->delete('hooks'); + } + if ($cache->fetch('plugins_hooks', $tmp)) { + $cache->delete('plugins_hooks'); + } + if ($cache->fetch('plugins_routes', $tmp)) { $cache->delete('plugins_routes'); + } } deleteDirectory(CACHE . 'signatures', ['index.html'], true); From 3b9feaf3bd463470082935d99a73188fd3e5b2e0 Mon Sep 17 00:00:00 2001 From: slawkens Date: Tue, 26 Sep 2023 22:03:30 +0200 Subject: [PATCH 004/174] My fault --- system/functions.php | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/system/functions.php b/system/functions.php index 287d0f42..b4e21bb6 100644 --- a/system/functions.php +++ b/system/functions.php @@ -1197,13 +1197,9 @@ function clearCache() if ($cache->fetch('failed_logins', $tmp)) $cache->delete('failed_logins'); - global $template_name; - if ($cache->fetch('template_ini' . $template_name, $tmp)) - $cache->delete('template_ini' . $template_name); - foreach (get_templates() as $template) { - if ($cache->fetch('template_ini' . $template, $tmp)) { - $cache->delete('template_ini' . $template); + if ($cache->fetch('template_ini_' . $template, $tmp)) { + $cache->delete('template_ini_' . $template); } } From 26a80e074188ce23ecffcb36433ee6777f8db188 Mon Sep 17 00:00:00 2001 From: Kamil Grzechulski Date: Fri, 6 Oct 2023 07:52:21 +0200 Subject: [PATCH 005/174] fix: password2 variable refactor to correct name (#237) --- cypress/e2e/2-create-account.cy.js | 2 +- system/pages/account/change_password.php | 8 +++---- system/pages/account/create.php | 8 +++---- .../account.change_password.html.twig | 4 ++-- system/templates/account.create.html.twig | 6 ++--- system/templates/account.create.js.html.twig | 24 +++++++++---------- tools/validate.php | 6 ++--- 7 files changed, 29 insertions(+), 29 deletions(-) diff --git a/cypress/e2e/2-create-account.cy.js b/cypress/e2e/2-create-account.cy.js index 9fc95cb0..2ee53d5d 100644 --- a/cypress/e2e/2-create-account.cy.js +++ b/cypress/e2e/2-create-account.cy.js @@ -14,7 +14,7 @@ describe('Create Account Page', () => { cy.get('#email').type('tester@example.com') cy.get('#password').type('test1234') - cy.get('#password2').type('test1234') + cy.get('#password_confirm').type('test1234') cy.get('#character_name').type('Slaw') diff --git a/system/pages/account/change_password.php b/system/pages/account/change_password.php index 95e15159..309c8dee 100644 --- a/system/pages/account/change_password.php +++ b/system/pages/account/change_password.php @@ -18,18 +18,18 @@ if(!$logged) { } $new_password = $_POST['newpassword'] ?? NULL; -$new_password2 = $_POST['newpassword2'] ?? NULL; +$new_password_confirm = $_POST['newpassword_confirm'] ?? NULL; $old_password = $_POST['oldpassword'] ?? NULL; -if(empty($new_password) && empty($new_password2) && empty($old_password)) { +if(empty($new_password) && empty($new_password_confirm) && empty($old_password)) { $twig->display('account.change_password.html.twig'); } else { - if(empty($new_password) || empty($new_password2) || empty($old_password)){ + if(empty($new_password) || empty($new_password_confirm) || empty($old_password)){ $errors[] = 'Please fill in form.'; } $password_strlen = strlen($new_password); - if($new_password != $new_password2) { + if($new_password != $new_password_confirm) { $errors[] = 'The new passwords do not match!'; } diff --git a/system/pages/account/create.php b/system/pages/account/create.php index 5775855f..0f190bb6 100644 --- a/system/pages/account/create.php +++ b/system/pages/account/create.php @@ -50,7 +50,7 @@ if($save) $email = $_POST['email']; $password = $_POST['password']; - $password2 = $_POST['password2']; + $password_confirm = $_POST['password_confirm']; // account if(!config('account_login_by_email')) { @@ -81,7 +81,7 @@ if($save) if(empty($password)) { $errors['password'] = 'Please enter the password for your new account.'; } - elseif($password != $password2) { + elseif($password != $password_confirm) { $errors['password'] = 'Passwords are not the same.'; } else if(!Validator::password($password)) { @@ -134,7 +134,7 @@ if($save) 'email' => $email, 'country' => $country, 'password' => $password, - 'password2' => $password2, + 'password_confirm' => $password_confirm, 'accept_rules' => isset($_POST['accept_rules']) ? $_POST['accept_rules'] === 'true' : false, ); @@ -267,7 +267,7 @@ if($save) $_POST['account_login'] = USE_ACCOUNT_NAME ? $account_name : $account_id; } - $_POST['password_login'] = $password2; + $_POST['password_login'] = $password_confirm; require PAGES . 'account/login.php'; header('Location: ' . getLink('account/manage')); diff --git a/system/templates/account.change_password.html.twig b/system/templates/account.change_password.html.twig index d801a733..bb0d7823 100644 --- a/system/templates/account.change_password.html.twig +++ b/system/templates/account.change_password.html.twig @@ -33,7 +33,7 @@ Please enter your current password and a new password. For your security, please New Password Again: - + @@ -75,4 +75,4 @@ Please enter your current password and a new password. For your security, please - \ No newline at end of file + diff --git a/system/templates/account.create.html.twig b/system/templates/account.create.html.twig index 5f9ea910..4563154b 100644 --- a/system/templates/account.create.html.twig +++ b/system/templates/account.create.html.twig @@ -104,11 +104,11 @@ Repeat password: - - + + - {% if errors.password is defined %}{{ errors.password }}{% endif %} + {% if errors.password is defined %}{{ errors.password }}{% endif %} {{ hook('HOOK_ACCOUNT_CREATE_AFTER_PASSWORDS') }} diff --git a/system/templates/account.create.js.html.twig b/system/templates/account.create.js.html.twig index 74bfb8bf..61300039 100644 --- a/system/templates/account.create.js.html.twig +++ b/system/templates/account.create.js.html.twig @@ -17,7 +17,7 @@ $('#password').blur(function() { checkPassword(); }); - $('#password2').blur(function() { + $('#password_confirm').blur(function() { checkPassword(); }); $('#SuggestAccountNumber a').click(function (event) { @@ -150,11 +150,11 @@ return; } - if(document.getElementById("password2").value == "") + if(document.getElementById("password_confirm").value == "") { - $('#password2_error').html('Please enter the password again!'); - $('#password2_indicator').attr('src', 'images/global/general/nok.gif'); - $('#password2_indicator').show(); + $('#password_confirm_error').html('Please enter the password again!'); + $('#password_confirm_indicator').attr('src', 'images/global/general/nok.gif'); + $('#password_confirm_indicator').show(); return; } @@ -172,24 +172,24 @@ } var password = document.getElementById("password").value; - var password2 = document.getElementById("password2").value; - $.getJSON("tools/validate.php", { password: password, password2: password2, uid: Math.random() }, + var password_confirm = document.getElementById("password_confirm").value; + $.getJSON("tools/validate.php", { password: password, password_confirm: password_confirm, uid: Math.random() }, function(data){ if(data.hasOwnProperty('success')) { $('#password_error').html (''); - $('#password2_error').html (''); + $('#password_confirm_error').html (''); $('#password_indicator').attr('src', 'images/global/general/ok.gif'); - $('#password2_indicator').attr('src', 'images/global/general/ok.gif'); + $('#password_confirm_indicator').attr('src', 'images/global/general/ok.gif'); } else if(data.hasOwnProperty('error')) { $('#password_error').html(data.error); - $('#password2_error').html(data.error); + $('#password_confirm_error').html(data.error); $('#password_indicator').attr('src', 'images/global/general/nok.gif'); - $('#password2_indicator').attr('src', 'images/global/general/nok.gif'); + $('#password_confirm_indicator').attr('src', 'images/global/general/nok.gif'); } $('#password_indicator').show(); - $('#password2_indicator').show(); + $('#password_confirm_indicator').show(); } ); diff --git a/tools/validate.php b/tools/validate.php index 43c965d0..78140085 100644 --- a/tools/validate.php +++ b/tools/validate.php @@ -75,9 +75,9 @@ else if(isset($_GET['name'])) success_('Good. Your name will be:
' . (admin() ? $name : ucwords($name)) . ''); } -else if(isset($_GET['password']) && isset($_GET['password2'])) { +else if(isset($_GET['password']) && isset($_GET['password_confirm'])) { $password = $_GET['password']; - $password2 = $_GET['password2']; + $password_confirm = $_GET['password_confirm']; if(!isset($password[0])) { error_('Please enter the password for your new account.'); @@ -86,7 +86,7 @@ else if(isset($_GET['password']) && isset($_GET['password2'])) { if(!Validator::password($password)) error_(Validator::getLastError()); - if($password != $password2) + if($password != $password_confirm) error_('Passwords are not the same.'); success_(1); From 4a430ae9dbcd6827e288096f5f09b36a7cbd9db0 Mon Sep 17 00:00:00 2001 From: slawkens Date: Thu, 2 Nov 2023 22:06:07 +0100 Subject: [PATCH 006/174] Fix display ban info on account page https://otland.net/threads/myacc-bans-display-problem.286825/ --- templates/tibiacom/account.management.html.twig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/tibiacom/account.management.html.twig b/templates/tibiacom/account.management.html.twig index e1106e8c..b5195ce9 100644 --- a/templates/tibiacom/account.management.html.twig +++ b/templates/tibiacom/account.management.html.twig @@ -35,7 +35,7 @@ - {{ welcome_message }}
+ {{ welcome_message|raw }}
From 3297a7c51aef81eee6cd6c33266c04f46cbd04a7 Mon Sep 17 00:00:00 2001 From: slawkens Date: Tue, 7 Nov 2023 22:01:43 +0100 Subject: [PATCH 007/174] Better https detection --- common.php | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/common.php b/common.php index 13cdabb7..c51381fe 100644 --- a/common.php +++ b/common.php @@ -136,7 +136,7 @@ if(!IS_CLI) { } } - define('SERVER_URL', 'http' . (isset($_SERVER['HTTPS'][0]) && strtolower($_SERVER['HTTPS']) === 'on' ? 's' : '') . '://' . $baseHost); + define('SERVER_URL', 'http' . (isHttps() ? 's' : '') . '://' . $baseHost); define('BASE_URL', SERVER_URL . BASE_DIR . '/'); define('ADMIN_URL', SERVER_URL . BASE_DIR . '/' . ADMIN_PANEL_FOLDER . '/'); @@ -165,3 +165,11 @@ if (!is_file($autoloadFile)) { } require $autoloadFile; + +function isHttps(): bool +{ + return + (!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) === 'https') + || (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') + || $_SERVER['SERVER_PORT'] == 443; +} From 7dd9b7764abee2d8d458088544d0046c3eee1b47 Mon Sep 17 00:00:00 2001 From: slawkens Date: Tue, 7 Nov 2023 22:01:47 +0100 Subject: [PATCH 008/174] Update common.php --- common.php | 1 + 1 file changed, 1 insertion(+) diff --git a/common.php b/common.php index c51381fe..61cb32ca 100644 --- a/common.php +++ b/common.php @@ -147,6 +147,7 @@ if (file_exists(BASE . 'config.local.php')) { require BASE . 'config.local.php'; } +/** @var array $config */ ini_set('log_errors', 1); if(@$config['env'] === 'dev') { ini_set('display_errors', 1); From 9d119b627991f795704cbe41539cd0f980d5d72d Mon Sep 17 00:00:00 2001 From: slawkens Date: Tue, 7 Nov 2023 22:15:23 +0100 Subject: [PATCH 009/174] This is more error tolerant --- common.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/common.php b/common.php index 61cb32ca..8684cc4b 100644 --- a/common.php +++ b/common.php @@ -172,5 +172,5 @@ function isHttps(): bool return (!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) === 'https') || (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') - || $_SERVER['SERVER_PORT'] == 443; + || (isset($_SERVER['SERVER_PORT']) && (int) $_SERVER['SERVER_PORT'] === 443); } From a04fbde607cabcf18911e57a67a358fb53ff7843 Mon Sep 17 00:00:00 2001 From: slawkens Date: Thu, 9 Nov 2023 20:32:20 +0100 Subject: [PATCH 010/174] Fix highscores error --- system/pages/highscores.php | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/system/pages/highscores.php b/system/pages/highscores.php index e3b64e3c..e42e10dd 100644 --- a/system/pages/highscores.php +++ b/system/pages/highscores.php @@ -135,6 +135,7 @@ if($settingHighscoresOutfit) { $configHighscoresPerPage = setting('core.highscores_per_page'); $limit = $configHighscoresPerPage + 1; +$highscores = []; $needReCache = true; $cacheKey = 'highscores_' . $skill . '_' . $vocation . '_' . $page . '_' . $configHighscoresPerPage; @@ -158,7 +159,7 @@ $query->join('accounts', 'accounts.id', '=', 'players.account_id') ->selectRaw('accounts.country, players.id, players.name, players.account_id, players.level, players.vocation' . $outfit . $promotion) ->orderByDesc('value'); -if (!isset($highscores) || empty($highscores)) { +if (empty($highscores)) { if ($skill >= POT::SKILL_FIRST && $skill <= POT::SKILL_LAST) { // skills if ($db->hasColumn('players', 'skill_fist')) {// tfs 1.0 $skill_ids = array( @@ -201,17 +202,17 @@ if (!isset($highscores) || empty($highscores)) { $list = 'experience'; } } + + $highscores = $query->get()->map(function($row) { + $tmp = $row->toArray(); + $tmp['online'] = $row->online_status; + $tmp['vocation'] = $row->vocation_name; + unset($tmp['online_table']); + + return $tmp; + })->toArray(); } -$highscores = $query->get()->map(function($row) { - $tmp = $row->toArray(); - $tmp['online'] = $row->online_status; - $tmp['vocation'] = $row->vocation_name; - unset($tmp['online_table']); - - return $tmp; -})->toArray(); - if ($cache->enabled() && $needReCache) { $cache->set($cacheKey, serialize($highscores), setting('core.highscores_cache_ttl') * 60); } From 790d85a88a2b4094eba1c1d0c0554d0ef7bd4b96 Mon Sep 17 00:00:00 2001 From: Slawomir Boczek Date: Sat, 11 Nov 2023 10:57:57 +0100 Subject: [PATCH 011/174] CSRF Protection (#235) * Fix alert class name * feature: csrf protection * Cosmetics * Fix token generate * Admin Panel: changelogs csrf protection * news/id route * Refactor admin newses + add csrf * Use admin.links instead * Admin panel: Pages csrf * Menus: better csrf + add success message on reset colors * Plugins csrf * Move definitions * add info function, same as note($message) * Update mailer.php * Fix new page/news links * clear_cache & maintenance csrf * Formatting * Fix news type * Fix changelog link * Add new changelog link * More info to confirm dialog * This is always true --- admin/pages/accounts.php | 8 +- admin/pages/changelog.php | 49 ++--- admin/pages/dashboard.php | 6 +- admin/pages/login.php | 2 + admin/pages/mailer.php | 4 +- admin/pages/mass_account.php | 2 + admin/pages/mass_teleport.php | 2 + admin/pages/menus.php | 21 +- admin/pages/modules/templates/web_status.twig | 46 +++-- admin/pages/news.php | 40 ++-- admin/pages/notepad.php | 2 + admin/pages/pages.php | 193 ++++-------------- admin/pages/players.php | 8 +- admin/pages/plugins.php | 17 +- admin/tools/settings_save.php | 2 + common.php | 7 + system/functions.php | 35 +++- system/init.php | 9 + system/libs/changelog.php | 1 + system/logout.php | 5 + system/pages/account/change_email.php | 8 +- system/pages/faq.php | 4 +- system/pages/news.php | 25 +-- system/router.php | 5 +- system/routes.php | 1 + system/settings.php | 6 + system/src/Admin/Pages.php | 134 ++++++++++++ system/src/CsrfToken.php | 95 +++++++++ .../templates/account.back_button.html.twig | 1 + .../account.change_comment.html.twig | 2 + .../templates/account.change_info.html.twig | 4 +- .../templates/account.change_mail.html.twig | 2 + .../templates/account.change_name.html.twig | 2 + .../account.change_password.html.twig | 2 + system/templates/account.change_sex.html.twig | 2 + system/templates/account.create.html.twig | 1 + .../account.create_character.html.twig | 2 + .../account.delete_character.html.twig | 4 +- ...ccount.generate_new_recovery_key.html.twig | 2 + .../account.generate_recovery_key.html.twig | 4 +- system/templates/account.login.html.twig | 4 +- system/templates/account.lost.form.html.twig | 5 +- system/templates/account.management.html.twig | 8 + system/templates/admin-bar.html.twig | 9 +- .../templates/admin.changelog.form.html.twig | 2 + system/templates/admin.changelog.html.twig | 48 ++++- system/templates/admin.links.html.twig | 22 ++ system/templates/admin.login.html.twig | 1 + system/templates/admin.mailer.html.twig | 1 + system/templates/admin.menus.form.html.twig | 1 + system/templates/admin.news.form.html.twig | 14 +- system/templates/admin.news.html.twig | 136 +----------- system/templates/admin.news.table.html.twig | 64 ++++++ system/templates/admin.notepad.html.twig | 1 + system/templates/admin.pages.form.html.twig | 4 +- system/templates/admin.pages.html.twig | 36 +++- system/templates/admin.pages.links.html.twig | 14 -- system/templates/admin.plugins.form.html.twig | 1 + system/templates/admin.plugins.html.twig | 24 ++- system/templates/admin.settings.html.twig | 6 + .../templates/admin.tools.account.html.twig | 3 + system/templates/characters.html.twig | 4 +- system/templates/faq.form.html.twig | 9 +- system/templates/forum.add_board.html.twig | 3 +- system/templates/forum.edit_post.html.twig | 3 +- system/templates/forum.move_thread.html.twig | 3 +- system/templates/forum.new_post.html.twig | 1 + system/templates/forum.new_thread.html.twig | 3 +- system/templates/gallery.form.html.twig | 3 +- .../templates/guilds.accept_invite.html.twig | 4 +- system/templates/guilds.back_button.html.twig | 3 +- .../guilds.change_description.html.twig | 2 + system/templates/guilds.change_logo.html.twig | 2 + system/templates/guilds.change_motd.html.twig | 2 + system/templates/guilds.change_rank.html.twig | 4 +- system/templates/guilds.create.html.twig | 4 +- .../templates/guilds.create.success.html.twig | 3 +- .../templates/guilds.delete_guild.html.twig | 4 +- .../templates/guilds.delete_invite.html.twig | 4 +- system/templates/guilds.invite.html.twig | 3 +- system/templates/guilds.kick_player.html.twig | 4 +- system/templates/guilds.leave_guild.html.twig | 4 +- system/templates/guilds.list.html.twig | 12 +- system/templates/guilds.manager.html.twig | 5 +- .../guilds.pass_leadership.html.twig | 4 +- system/templates/guilds.view.html.twig | 7 + system/templates/templates.header.html.twig | 2 + system/twig.php | 11 + .../tibiacom/news.featured_article.html.twig | 11 +- 89 files changed, 789 insertions(+), 504 deletions(-) create mode 100644 system/src/Admin/Pages.php create mode 100644 system/src/CsrfToken.php create mode 100644 system/templates/admin.links.html.twig create mode 100644 system/templates/admin.news.table.html.twig delete mode 100644 system/templates/admin.pages.links.html.twig diff --git a/admin/pages/accounts.php b/admin/pages/accounts.php index 214b82f0..4d410f11 100644 --- a/admin/pages/accounts.php +++ b/admin/pages/accounts.php @@ -13,6 +13,9 @@ use MyAAC\Models\Player; defined('MYAAC') or die('Direct access not allowed!'); $title = 'Account editor'; + +csrfProtect(); + $admin_base = ADMIN_URL . '?p=accounts'; $use_datatable = true; @@ -82,7 +85,7 @@ else if (isset($_REQUEST['search'])) { $account = new OTS_Account(); $account->load($id); - if (isset($account, $_POST['save']) && $account->isLoaded()) { + if (isset($_POST['save']) && $account->isLoaded()) { $error = false; $_error = ''; @@ -289,6 +292,7 @@ else if (isset($_REQUEST['search'])) {
+
@@ -581,6 +585,7 @@ else if (isset($_REQUEST['search'])) {
+
@@ -590,6 +595,7 @@ else if (isset($_REQUEST['search'])) {
+
diff --git a/admin/pages/changelog.php b/admin/pages/changelog.php index 3d5cad64..ae2fd7b0 100644 --- a/admin/pages/changelog.php +++ b/admin/pages/changelog.php @@ -13,30 +13,29 @@ use MyAAC\Models\Changelog as ModelsChangelog; defined('MYAAC') or die('Direct access not allowed!'); +$title = 'Changelog'; + +csrfProtect(); + if (!hasFlag(FLAG_CONTENT_PAGES) && !superAdmin()) { echo 'Access denied.'; return; } -$title = 'Changelog'; $use_datatable = true; const CL_LIMIT = 600; // maximum changelog body length -?> - - -orderBy('group_id', POT::ORDER_DESC); $twig->display('admin.changelog.form.html.twig', array( 'action' => $action, - 'cl_link_form' => constant('ADMIN_URL').'?p=changelog&action=' . ($action == 'edit' ? 'edit' : 'new'), + 'cl_link_form' => constant('ADMIN_URL').'?p=changelog', 'cl_id' => $id ?? null, 'body' => isset($body) ? escapeHtml($body) : '', 'create_date' => $create_date ?? '', @@ -128,15 +129,3 @@ if($action == 'edit' || $action == 'new') { $twig->display('admin.changelog.html.twig', array( 'changelogs' => $changelogs, )); - -?> - diff --git a/admin/pages/dashboard.php b/admin/pages/dashboard.php index e24b98ad..73430456 100644 --- a/admin/pages/dashboard.php +++ b/admin/pages/dashboard.php @@ -10,7 +10,9 @@ defined('MYAAC') or die('Direct access not allowed!'); $title = 'Dashboard'; -if (isset($_GET['clear_cache'])) { +csrfProtect(); + +if (isset($_POST['clear_cache'])) { if (clearCache()) { success('Cache cleared.'); } else { @@ -18,7 +20,7 @@ if (isset($_GET['clear_cache'])) { } } -if (isset($_GET['maintenance'])) { +if (isset($_POST['maintenance'])) { $message = (!empty($_POST['message']) ? $_POST['message'] : null); $_status = (isset($_POST['status']) && $_POST['status'] == 'true'); $_status = ($_status ? '0' : '1'); diff --git a/admin/pages/login.php b/admin/pages/login.php index 8bb25f36..eb6466d3 100644 --- a/admin/pages/login.php +++ b/admin/pages/login.php @@ -10,6 +10,8 @@ defined('MYAAC') or die('Direct access not allowed!'); $title = 'Login'; +csrfProtect(); + require PAGES . 'account/login.php'; if ($logged) { header('Location: ' . (admin() ? ADMIN_URL : BASE_URL)); diff --git a/admin/pages/mailer.php b/admin/pages/mailer.php index 732b7461..d9cf8888 100644 --- a/admin/pages/mailer.php +++ b/admin/pages/mailer.php @@ -10,6 +10,8 @@ defined('MYAAC') or die('Direct access not allowed!'); $title = 'Mailer'; +csrfProtect(); + if (!hasFlag(FLAG_CONTENT_MAILER) && !superAdmin()) { echo 'Access denied.'; return; @@ -20,7 +22,7 @@ if (!setting('core.mail_enabled')) { return; } -$mail_to = isset($_REQUEST['mail_to']) ? stripslashes(trim($_REQUEST['mail_to'])) : null; +$mail_to = isset($_POST['mail_to']) ? stripslashes(trim($_POST['mail_to'])) : null; $mail_subject = isset($_POST['mail_subject']) ? stripslashes($_POST['mail_subject']) : null; $mail_content = isset($_POST['mail_content']) ? stripslashes($_POST['mail_content']) : null; diff --git a/admin/pages/mass_account.php b/admin/pages/mass_account.php index 63bec54c..549310a5 100644 --- a/admin/pages/mass_account.php +++ b/admin/pages/mass_account.php @@ -16,6 +16,8 @@ defined('MYAAC') or die('Direct access not allowed!'); $title = 'Mass Account Actions'; +csrfProtect(); + $hasCoinsColumn = $db->hasColumn('accounts', 'coins'); $hasPointsColumn = $db->hasColumn('accounts', 'premium_points'); $freePremium = $config['lua']['freePremium']; diff --git a/admin/pages/mass_teleport.php b/admin/pages/mass_teleport.php index 5027fa1c..f2a7ee27 100644 --- a/admin/pages/mass_teleport.php +++ b/admin/pages/mass_teleport.php @@ -16,6 +16,8 @@ defined('MYAAC') or die('Direct access not allowed!'); $title = 'Mass Teleport Actions'; +csrfProtect(); + function admin_teleport_position($x, $y, $z) { if (!Player::query()->update([ 'posx' => $x, 'posy' => $y, 'posz' => $z diff --git a/admin/pages/menus.php b/admin/pages/menus.php index a0b492df..4a908eb5 100644 --- a/admin/pages/menus.php +++ b/admin/pages/menus.php @@ -13,19 +13,21 @@ use MyAAC\Models\Menu; defined('MYAAC') or die('Direct access not allowed!'); $title = 'Menus'; +csrfProtect(); + if (!hasFlag(FLAG_CONTENT_MENUS) && !superAdmin()) { echo 'Access denied.'; return; } -if (isset($_REQUEST['template'])) { - $template = $_REQUEST['template']; +if (isset($_POST['template'])) { + $template = $_POST['template']; - if (isset($_REQUEST['menu'])) { - $post_menu = $_REQUEST['menu']; - $post_menu_link = $_REQUEST['menu_link']; - $post_menu_blank = $_REQUEST['menu_blank']; - $post_menu_color = $_REQUEST['menu_color']; + if (isset($_POST['menu'])) { + $post_menu = $_POST['menu']; + $post_menu_link = $_POST['menu_link']; + $post_menu_blank = $_POST['menu_blank']; + $post_menu_color = $_POST['menu_color']; if (count($post_menu) != count($post_menu_link)) { echo 'Menu count is not equal menu links. Something went wrong when sending form.'; return; @@ -69,9 +71,10 @@ if (isset($_REQUEST['template'])) { return; } - if (isset($_REQUEST['reset_colors'])) { + if (isset($_GET['reset_colors'])) { if (isset($config['menu_default_color'])) { Menu::where('template', $template)->update(['color' => str_replace('#', '', $config['menu_default_color'])]); + success('Colors has been reset.'); } else { warning('There is no default color defined, cannot reset colors.'); @@ -93,6 +96,7 @@ if (isset($_REQUEST['template'])) {

+ @@ -112,6 +116,7 @@ if (isset($_REQUEST['template'])) { $last_id = array(); ?>