Release v1.8.3

Add "The old password is same as the new password!"
Better post variables names

CHANGELOG-1.x.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## [1.8.3 - 21.10.2025]
+
+### Added
+* Feature: resend email verify (https://github.com/slawkens/myaac/commit/fe821c58085483e70491dcf76376ad5b96de3fdd)
+* New config: hooks_debug (To view where hooks are located in .twig files) (https://github.com/slawkens/myaac/commit/8c3cb0e06f9709c1de3398b48221241e7cbdd310)
+* Functions: Add db->getColumnInfo(table, column) (https://github.com/slawkens/myaac/commit/c898fe25efff6793a01d11c26fc153cb23fcb858)
+* Plugins: Add option to use ?subtopic=x for plugins pages (https://github.com/slawkens/myaac/commit/97f9d3d6f6c28aef6d824973058d7133f56e09c4)
+* getTopPlayers() Function - Add lookmount & promotion (https://github.com/slawkens/myaac/commit/2da0024c68f1cedc38a16ebbc6f52ffa55e65f7a, https://github.com/slawkens/myaac/commit/901df48d134079d648a18f9d82b60182e818ac02)
+* New hooks for account/change-password (https://github.com/slawkens/myaac/commit/470555f2687809a0c12491bbb27597e64b8929c1)
+
+### Changed
+* Feature: show vip days in account management (https://github.com/slawkens/myaac/commit/c88b08eb1ec1f560cbfdaaa16b24e3a0f26da7b3, by @andreoam)
+* Allow links in error_box.html.twig (https://github.com/slawkens/myaac/commit/9acad15451071639acf7a7d4e81619b0a9742b12)
+* Canary - Comment code to update lastday in login.php (https://github.com/slawkens/myaac/commit/38902c30d114fdbce259467f5820f97037b393e9)
+* Cache::remember $ttl = -1 = infinite (https://github.com/slawkens/myaac/commit/64acf70d3854182d88aaf0b67f77cea2a254f179)
+
+### Fixed
+* Online - Allow for html code (example - img) in online_datacenter (https://github.com/slawkens/myaac/commit/3bb272ebbbd2eb7769d174b7082061d14a17bd44)
+* Guilds - Fix guild create with freePremium enabled (https://github.com/slawkens/myaac/commit/c91bb5d4097647dca2196d3dea87bc90c89181d2)
+* Canary - Fix premDays count (https://github.com/slawkens/myaac/commit/3e61692780d4add93b7b0e9f12f7a283bd8f4b7a)
+* Template Change: Ignore set last visit for AJAX pages - Fixes template change redirect (https://github.com/slawkens/myaac/commit/89fae38caa7e4f645957fcf1a9330a36358ac04f)
+* Admin Panel - Accounts: Fix lastip v6 (TFS master) (https://github.com/slawkens/myaac/commit/f54b1bdd2af4c16c64ddff0e87a6c96bc4cf9eeb)
+* Functions - Prevent injection in $db->hasColumn (https://github.com/slawkens/myaac/commit/56bd7ec5ed904666074492f2e4f13e4fce226bee)
+* Compat Config: Add missing config: email_lai_sec_interval (https://github.com/slawkens/myaac/commit/2eae44e0755e624a91be68b4d1ec26d01eb4d9a1)
+
 ## [1.8.2 - 26.09.2025]
 
 ### Added

admin/tools/phpinfo.php

@@ -1,5 +1,6 @@
 <?php
-define('MYAAC_ADMIN', true);
+const MYAAC_ADMIN = true;
+const IGNORE_SET_LAST_VISIT = true;
 
 require '../../common.php';
 require SYSTEM . 'functions.php';

admin/tools/reload_data.php

@@ -26,6 +26,7 @@
 use MyAAC\DataLoader;
 
 const MYAAC_ADMIN = true;
+const IGNORE_SET_LAST_VISIT = true;
 
 require '../../common.php';
 require SYSTEM . 'functions.php';

admin/tools/settings_save.php

@@ -3,6 +3,7 @@
 use MyAAC\Settings;
 
 const MYAAC_ADMIN = true;
+const IGNORE_SET_LAST_VISIT = true;
 
 require '../../common.php';
 require SYSTEM . 'functions.php';

admin/tools/status.php

@@ -1,5 +1,6 @@
 <?php
-define('MYAAC_ADMIN', true);
+const MYAAC_ADMIN = true;
+const IGNORE_SET_LAST_VISIT = true;
 
 require '../../common.php';
 require SYSTEM . 'init.php';

admin/tools/upload_image.php

@@ -1,5 +1,6 @@
 <?php
-define('MYAAC_ADMIN', true);
+const MYAAC_ADMIN = true;
+const IGNORE_SET_LAST_VISIT = true;
 
 require '../../common.php';
 require SYSTEM . 'functions.php';

common.php

@@ -26,8 +26,8 @@
 if (version_compare(phpversion(), '8.1', '<')) die('PHP version 8.1 or higher is required.');
 
 const MYAAC = true;
-const MYAAC_VERSION = '1.8.3-dev';
-const DATABASE_VERSION = 45;
+const MYAAC_VERSION = '1.8.3';
+const DATABASE_VERSION = 46;
 const TABLE_PREFIX = 'myaac_';
 define('START_TIME', microtime(true));
 define('MYAAC_OS', stripos(PHP_OS, 'WIN') === 0 ? 'WINDOWS' : (strtoupper(PHP_OS) === 'DARWIN' ? 'MAC' : 'LINUX'));

install/includes/schema.sql

@@ -1,4 +1,4 @@
-SET @myaac_database_version = 45;
+SET @myaac_database_version = 46;
 
 CREATE TABLE `myaac_account_actions`
 (
@@ -10,6 +10,15 @@ CREATE TABLE `myaac_account_actions`
 	KEY (`account_id`)
 ) ENGINE=InnoDB DEFAULT CHARACTER SET=utf8mb4;
 
+CREATE TABLE `myaac_account_emails_verify`
+(
+	`id` int NOT NULL AUTO_INCREMENT,
+	`account_id` int NOT NULL,
+	`hash` varchar(32) NOT NULL,
+	`sent_at` int NOT NULL DEFAULT 0,
+	PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARACTER SET=utf8mb4;
+
 CREATE TABLE `myaac_admin_menu`
 (
 	`id` int NOT NULL AUTO_INCREMENT,

install/tools/5-database.php

@@ -102,18 +102,13 @@ if(!$db->hasColumn('accounts', 'web_flags')) {
 		success($locale['step_database_adding_field'] . ' accounts.web_flags...');
 }
 
-if(!$db->hasColumn('accounts', 'email_hash')) {
-	if(query("ALTER TABLE `accounts` ADD `email_hash` VARCHAR(32) NOT NULL DEFAULT '' AFTER `web_flags`;"))
-		success($locale['step_database_adding_field'] . ' accounts.email_hash...');
-}
-
 if(!$db->hasColumn('accounts', 'email_verified')) {
-	if(query("ALTER TABLE `accounts` ADD `email_verified` TINYINT(1) NOT NULL DEFAULT 0 AFTER `email_hash`;"))
+	if(query("ALTER TABLE `accounts` ADD `email_verified` TINYINT(1) NOT NULL DEFAULT 0 AFTER `web_flags`;"))
 		success($locale['step_database_adding_field'] . ' accounts.email_verified...');
 }
 
 if(!$db->hasColumn('accounts', 'email_new')) {
-	if(query("ALTER TABLE `accounts` ADD `email_new` VARCHAR(255) NOT NULL DEFAULT '' AFTER `email_hash`;"))
+	if(query("ALTER TABLE `accounts` ADD `email_new` VARCHAR(255) NOT NULL DEFAULT '' AFTER `email_verified`;"))
 		success($locale['step_database_adding_field'] . ' accounts.email_new...');
 }
 

login.php

@@ -220,6 +220,8 @@ switch ($action) {
 			}
 		}
 
+		/*
+		 * not needed anymore?
 		if (fieldExist('premdays', 'accounts') && fieldExist('lastday', 'accounts')) {
 			$save = false;
 			$timeNow = time();
@@ -256,6 +258,7 @@ switch ($action) {
 				$account->save();
 			}
 		}
+		*/
 
 		$worlds = [$world];
 		$playdata = compact('worlds', 'characters');

system/compat/config.php

@@ -81,6 +81,7 @@ $deprecatedConfig = [
 	'account_change_character_name_points' => 'account_change_character_name_price',
 	'account_change_character_sex',
 	'account_change_character_sex_points' => 'account_change_character_name_price',
+	'email_lai_sec_interval' => 'mail_lost_account_interval',
 ];
 
 foreach ($deprecatedConfig as $key => $value) {

system/functions.php

@@ -1142,10 +1142,18 @@ function getTopPlayers($limit = 5, $skill = 'level') {
 			'looktype', 'lookhead', 'lookbody', 'looklegs', 'lookfeet'
 		];
 
+		if ($db->hasColumn('players', 'promotion')) {
+			$columns[] = 'promotion';
+		}
+
 		if ($db->hasColumn('players', 'lookaddons')) {
 			$columns[] = 'lookaddons';
 		}
 
+		if ($db->hasColumn('players', 'lookmount')) {
+			$columns[] = 'lookmount';
+		}
+
 		return Player::query()
 			->select($columns)
 			->withOnlineStatus()
@@ -1632,13 +1640,14 @@ function camelCaseToUnderscore($input)
 	return ltrim(strtolower(preg_replace('/[A-Z]([A-Z](?![a-z]))*/', '_$0', $input)), '_');
 }
 
-function removeIfFirstSlash(&$text) {
+function removeIfFirstSlash(&$text): void
+{
 	if(strpos($text, '/') === 0) {
 		$text = str_replace_first('/', '', $text);
 	}
 };
 
-function escapeHtml($html) {
+function escapeHtml($html): string {
 	return htmlspecialchars($html);
 }
 
@@ -1652,7 +1661,7 @@ function getGuildNameById($id)
 	return false;
 }
 
-function getGuildLogoById($id)
+function getGuildLogoById($id): string
 {
 	$logo = 'default.gif';
 
@@ -1668,7 +1677,8 @@ function getGuildLogoById($id)
 	return BASE_URL . GUILD_IMAGES_DIR . $logo;
 }
 
-function displayErrorBoxWithBackButton($errors, $action = null) {
+function displayErrorBoxWithBackButton($errors, $action = null): void
+{
 	global $twig;
 	$twig->display('error_box.html.twig', ['errors' => $errors]);
 	$twig->display('account.back_button.html.twig', [
@@ -1696,6 +1706,12 @@ function getAccountIdentityColumn(): string
 	return 'id';
 }
 
+function isCanary(): bool
+{
+	$vipSystemEnabled = configLua('vipSystemEnabled');
+	return isset($vipSystemEnabled);
+}
+
 // validator functions
 require_once SYSTEM . 'compat/base.php';
 

system/libs/pot/OTS_DB_MySQL.php

@@ -120,6 +120,11 @@ class OTS_DB_MySQL extends OTS_Base_DB
 				if($cache->fetch('database_columns', $tmp) && $tmp) {
 					$this->has_column_cache = unserialize($tmp);
 				}
+
+				$tmp = null;
+				if($cache->fetch('database_columns_info', $tmp) && $tmp) {
+					$this->get_column_info_cache = unserialize($tmp);
+				}
 			}
 		}
 
@@ -156,11 +161,13 @@ class OTS_DB_MySQL extends OTS_Base_DB
 			if ($this->clearCacheAfter) {
 				$cache->delete('database_tables');
 				$cache->delete('database_columns');
+				$cache->delete('database_columns_info');
 				$cache->delete('database_checksum');
 			}
 			else {
 				$cache->set('database_tables', serialize($this->has_table_cache), 3600);
 				$cache->set('database_columns', serialize($this->has_column_cache), 3600);
+				$cache->set('database_columns_info', serialize($this->get_column_info_cache), 3600);
 				$cache->set('database_checksum', serialize(sha1($config['database_host'] . '.' . $config['database_name'])), 3600);
 			}
 		}
@@ -295,7 +302,8 @@ class OTS_DB_MySQL extends OTS_Base_DB
 		return [];
 	}
 
-	public function revalidateCache() {
+	public function revalidateCache(): void
+	{
 		foreach($this->has_table_cache as $key => $value) {
 			$this->hasTableInternal($key);
 		}
@@ -310,6 +318,21 @@ class OTS_DB_MySQL extends OTS_Base_DB
 				$this->hasColumnInternal($explode[0], $explode[1]);
 			}
 		}
+
+		foreach($this->get_column_info_cache as $key => $value) {
+			$explode = explode('.', $key);
+			if(!isset($this->has_table_cache[$explode[0]])) { // first check if table exist
+				$this->hasTableInternal($explode[0]);
+			}
+
+			if($this->has_table_cache[$explode[0]]) {
+				$this->hasColumnInternal($explode[0], $explode[1]);
+			}
+
+			if($this->has_table_cache[$explode[0]]) {
+				$this->getColumnInfoInternal($explode[0], $explode[1]);
+			}
+		}
 	}
 
 	public function setClearCacheAfter($clearCache)

system/login.php

@@ -34,8 +34,10 @@ if($logged) {
 	$twig->addGlobal('account_logged', $account_logged);
 }
 
-setSession('last_visit', time());
-if(defined('PAGE')) {
-	setSession('last_page', PAGE);
+if (!defined('IGNORE_SET_LAST_VISIT') || !IGNORE_SET_LAST_VISIT) {
+	setSession('last_visit', time());
+	if(defined('PAGE')) {
+		setSession('last_page', PAGE);
+	}
+	setSession('last_uri', $_SERVER['REQUEST_URI']);
 }
-setSession('last_uri', $_SERVER['REQUEST_URI']);

system/migrations/46-account_emails_verify.sql

@@ -0,0 +1,8 @@
+CREATE TABLE `myaac_account_emails_verify`
+(
+	`id` int NOT NULL AUTO_INCREMENT,
+	`account_id` int NOT NULL,
+	`hash` varchar(32) NOT NULL,
+	`sent_at` int NOT NULL DEFAULT 0,
+	PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARACTER SET=utf8mb4;

system/migrations/46.php

@@ -0,0 +1,24 @@
+<?php
+/**
+ * @var OTS_DB_MySQL $db
+ */
+
+$up = function () use ($db) {
+	if ($db->hasColumn('accounts', 'email_hash')) {
+		$db->dropColumn('accounts', 'email_hash');
+	}
+
+	if (!$db->hasTable(TABLE_PREFIX . 'account_emails_verify')) {
+		$db->query(file_get_contents(__DIR__ . '/46-account_emails_verify.sql'));
+	}
+};
+
+$down = function () use ($db) {
+	if (!$db->hasColumn('accounts', 'email_hash')) {
+		$db->addColumn('accounts', 'email_hash', "varchar(32) NOT NULL DEFAULT ''");
+	}
+
+	if ($db->hasTable(TABLE_PREFIX . 'account_emails_verify')) {
+		$db->dropTable(TABLE_PREFIX . 'account_emails_verify');
+	}
+};

system/pages/account/change-password.php

@@ -19,18 +19,17 @@ if(!$logged) {
 
 csrfProtect();
 
-$new_password = $_POST['newpassword'] ?? NULL;
-$new_password_confirm = $_POST['newpassword_confirm'] ?? NULL;
-$old_password = $_POST['oldpassword'] ?? NULL;
+$new_password = $_POST['new_password'] ?? null;
+$new_password_confirm = $_POST['new_password_confirm'] ?? null;
+$old_password = $_POST['old_password'] ?? null;
 if(empty($new_password) && empty($new_password_confirm) && empty($old_password)) {
 	$twig->display('account.change-password.html.twig');
 }
-else
-{
+else {
 	if(empty($new_password) || empty($new_password_confirm) || empty($old_password)){
 		$errors[] = 'Please fill in form.';
 	}
-	$password_strlen = strlen($new_password);
+
 	if($new_password != $new_password_confirm) {
 		$errors[] = 'The new passwords do not match!';
 	}
@@ -41,10 +40,13 @@ else
 		}
 
 		/** @var OTS_Account $account_logged */
-		$old_password = encrypt((USE_ACCOUNT_SALT ? $account_logged->getCustomField('salt') : '') . $old_password);
-		if($old_password != $account_logged->getPassword()) {
+		$old_password_hashed = encrypt((USE_ACCOUNT_SALT ? $account_logged->getCustomField('salt') : '') . $old_password);
+		if($old_password_hashed != $account_logged->getPassword()) {
 			$errors[] = 'Current password is incorrect!';
 		}
+		else if ($old_password == $new_password) {
+			$errors[] = 'The old password is same as the new password!';
+		}
 
 		$hooks->trigger(HOOK_ACCOUNT_CHANGE_PASSWORD_POST);
 	}

system/pages/account/confirm-email.php

@@ -9,6 +9,7 @@
  */
 
 use MyAAC\Models\Account;
+use MyAAC\Models\AccountEmailVerify;
 
 defined('MYAAC') or die('Direct access not allowed!');
 
@@ -20,16 +21,20 @@ if(empty($hash)) {
 	return;
 }
 
-if(!Account::where('email_hash', $hash)->exists()) {
-	note("Your email couldn't be verified. Please contact staff to do it manually.");
+// by default link is valid for 30 days
+$accountEmailVerify = AccountEmailVerify::where('hash', $hash)->where('sent_at', '>', time() - 30 * 24 * 60 * 60)->first();
+if(!$accountEmailVerify) {
+	note("Wrong link or link has expired.");
 }
 else
 {
-	$accountModel = Account::where('email_hash', $hash)->where('email_verified', 0)->first();
+	$accountModel = Account::where('id', $accountEmailVerify->account_id)->where('email_verified', 0)->first();
 	if ($accountModel) {
 		$accountModel->email_verified = 1;
 		$accountModel->save();
 
+		AccountEmailVerify::where('account_id', $accountModel->id)->delete();
+
 		success('You have now verified your e-mail, this will increase the security of your account. Thank you for doing this. You can now <a href=' . getLink('account/manage') . '>log in</a>.');
 
 		$account = new OTS_Account();
@@ -39,6 +44,6 @@ else
 		}
 	}
 	else {
-		error('Link has expired.');
+		error('Your account is already verified.');
 	}
 }

system/pages/account/create.php

@@ -10,6 +10,7 @@
  */
 
 use MyAAC\CreateCharacter;
+use MyAAC\Models\AccountEmailVerify;
 
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Create Account';
@@ -244,7 +245,12 @@ if($save)
 		if(setting('core.mail_enabled') && setting('core.account_mail_verify'))
 		{
 			$hash = md5(generateRandomString(16, true, true) . $email);
-			$new_account->setCustomField('email_hash', $hash);
+
+			AccountEmailVerify::create([
+				'account_id' => $new_account->getId(),
+				'hash' => $hash,
+				'sent_at' => time(),
+			]);
 
 			$verify_url = getLink('account/confirm-email/' . $hash);
 			$body_html = $twig->render('mail.account.verify.html.twig', array(

system/pages/account/login.php

@@ -48,7 +48,9 @@ if(!empty($login_account) && !empty($login_password))
 	)
 	{
 		if (setting('core.account_mail_verify') && (int)$account_logged->getCustomField('email_verified') !== 1) {
-			$errors[] = 'Your account is not verified. Please verify your email address. If the message is not coming check the SPAM folder in your E-Mail client.';
+			$link = getLink('account/resend-email-verify');
+			$errors[] = 'Your account is not verified. Please verify your email address. If the message is not coming check the SPAM folder in your E-Mail client.<br/>' .
+				'You can resend the Email here: <a href="' . $link . '">' . $link . '</a>';
 		} else {
 			session_regenerate_id();
 			setSession('account', $account_logged->getId());

system/pages/account/lost.php

@@ -9,11 +9,540 @@
  * @link      https://my-aac.org
  */
 defined('MYAAC') or die('Direct access not allowed!');
-$title = 'Lost Account';
+$title = 'Lost Account Interface';
 
-if(!setting('core.mail_enabled')) {
-	echo "<b>Account maker is not configured to send e-mails, you can't use Lost Account Interface. Contact with admin to get help.</b>";
+if(!setting('core.mail_enabled'))
+{
+	echo '<b>Account maker is not configured to send e-mails, you can\'t use Lost Account Interface. Contact with admin to get help.</b>';
 	return;
 }
 
-$twig->display('account/lost/form.html.twig');
+$action_type = isset($_REQUEST['action_type']) ? $_REQUEST['action_type'] : '';
+if($action == '')
+{
+	$twig->display('account.lost.form.html.twig');
+}
+else if($action == 'step1' && $action_type == '') {
+	$twig->display('account.lost.noaction.html.twig');
+}
+elseif($action == 'step1' && $action_type == 'email')
+{
+	$nick = stripslashes($_REQUEST['nick']);
+	if(Validator::characterName($nick))
+	{
+		$player = new OTS_Player();
+		$account = new OTS_Account();
+		$player->find($nick);
+		if($player->isLoaded())
+			$account = $player->getAccount();
+
+		if($account->isLoaded())
+		{
+			if($account->getCustomField('email_next') < time())
+				echo 'Please enter e-mail to account with this character.<BR>
+				<form action="' . getLink('account/lost') . '?action=sendcode" method=post>
+				<input type=hidden name="character">
+				<table cellspacing=1 cellpadding=4 border=0 width=100%>
+				<TR><TD BGCOLOR="'.$config['vdarkborder'].'" class="white"><B>Please enter e-mail to account</B></TD></TR>
+				<TR><TD BGCOLOR="'.$config['darkborder'].'">
+				Character: <INPUT TYPE=text NAME="nick" VALUE="'.$nick.'" SIZE="40" readonly="readonly"><BR>
+				E-mail to account:<INPUT TYPE=text NAME="email" VALUE="" SIZE="40"><BR>
+				</TD></TR>
+				</TABLE>
+				<BR>
+				<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				' . $twig->render('buttons.submit.html.twig') . '</div>
+				</TD></TR></FORM></TABLE></TABLE>';
+			else
+			{
+				$insec = (int)$account->getCustomField('email_next') - time();
+				$minutesleft = floor($insec / 60);
+				$secondsleft = $insec - ($minutesleft * 60);
+				$timeleft = $minutesleft.' minutes '.$secondsleft.' seconds';
+				echo 'Account of selected character (<b>'.$nick.'</b>) received e-mail in last '.ceil(setting('core.mail_lost_account_interval') / 60).' minutes. You must wait '.$timeleft.' before you can use Lost Account Interface again.';
+			}
+		}
+		else
+			echo 'Player or account of player <b>' . $nick . '</b> doesn\'t exist.';
+	}
+	else
+		echo 'Invalid player name format. If you have other characters on account try with other name.';
+	echo '<BR /><TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				<a href="' . getLink('account/lost') . '" border="0"><IMG SRC="'.$template_path.'/images/global/buttons/sbutton_back.gif" NAME="Back" ALT="Back" BORDER=0 WIDTH=120 HEIGHT=18></a></div>
+				</TD></TR></FORM></TABLE></TABLE>';
+}
+elseif($action == 'sendcode')
+{
+	$email = $_REQUEST['email'];
+	$nick = stripslashes($_REQUEST['nick']);
+	if(Validator::characterName($nick))
+	{
+		$player = new OTS_Player();
+		$account = new OTS_Account();
+		$player->find($nick);
+		if($player->isLoaded())
+			$account = $player->getAccount();
+
+		if($account->isLoaded())
+		{
+			if($account->getCustomField('email_next') < time())
+			{
+				if($account->getEMail() == $email)
+				{
+					$newcode = generateRandomString(30, true, false, true);
+					$mailBody = '
+					You asked to reset your ' . $config['lua']['serverName'] . ' password.<br/>
+					<p>Account name: '.$account->getName().'</p>
+					<br />
+					To do so, please click this link:
+					<p><a href="' . getLink('account/lost') . '?action=checkcode&code='.$newcode.'&character='.urlencode($nick).'">' . getLink('account/lost') . '?action=checkcode&code='.$newcode.'&character='.urlencode($nick).'</a></p>
+					<p>or open page: <i>' . getLink('account/lost') . '?action=checkcode</i> and in field "code" write <b>'.$newcode.'</b></p>
+					<br/>
+						<p>If you did not request a password change, you may ignore this message and your password will remain unchanged.';
+
+					$account_mail = $account->getCustomField('email');
+					if(_mail($account_mail, $config['lua']['serverName'].' - Recover your account', $mailBody))
+					{
+						$account->setCustomField('email_code', $newcode);
+						$account->setCustomField('email_next', (time() + setting('core.mail_lost_account_interval')));
+						echo '<br />Details about steps required to recover your account has been sent to <b>' . $account_mail . '</b>. You should receive this email within 15 minutes. Please check your inbox/spam directory.';
+					}
+					else
+					{
+						$account->setCustomField('email_next', (time() + 60));
+						echo '<br /><p class="error">An error occurred while sending email! Try again later or contact with admin. For Admin: More info can be found in system/logs/mailer-error.log</p>';
+					}
+				}
+				else
+					echo 'Invalid e-mail to account of character <b>'.$nick.'</b>. Try again.';
+			}
+			else
+			{
+				$insec = (int)$account->getCustomField('email_next') - time();
+				$minutesleft = floor($insec / 60);
+				$secondsleft = $insec - ($minutesleft * 60);
+				$timeleft = $minutesleft.' minutes '.$secondsleft.' seconds';
+				echo 'Account of selected character (<b>'.$nick.'</b>) received e-mail in last '.ceil(setting('core.mail_lost_account_interval') / 60).' minutes. You must wait '.$timeleft.' before you can use Lost Account Interface again.';
+			}
+		}
+		else
+			echo 'Player or account of player <b>'.$nick.'</b> doesn\'t exist.';
+	}
+	else
+		echo 'Invalid player name format. If you have other characters on account try with other name.';
+	echo '<BR /><TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				<a href="' . getLink('account/lost') . '?action=step1&action_type=email&nick='.urlencode($nick).'" border="0"><IMG SRC="'.$template_path.'/images/global/buttons/sbutton_back.gif" NAME="Back" ALT="Back" BORDER=0 WIDTH=120 HEIGHT=18></a></div>
+				</TD></TR></FORM></TABLE></TABLE>';
+}
+elseif($action == 'step1' && $action_type == 'reckey')
+{
+	$nick = stripslashes($_REQUEST['nick']);
+	if(Validator::characterName($nick))
+	{
+		$player = new OTS_Player();
+		$account = new OTS_Account();
+		$player->find($nick);
+		if($player->isLoaded())
+			$account = $player->getAccount();
+		if($account->isLoaded())
+		{
+			$account_key = $account->getCustomField('key');
+			if(!empty($account_key))
+			{
+						echo 'If you enter right recovery key you will see form to set new e-mail and password to account. To this e-mail will be send your new password and account name.<BR>
+						<FORM ACTION="' . getLink('account/lost') . '?action=step2" METHOD=post>
+						<TABLE CELLSPACING=1 CELLPADDING=4 BORDER=0 WIDTH=100%>
+						<TR><TD BGCOLOR="'.$config['vdarkborder'].'" class="white"><B>Please enter your recovery key</B></TD></TR>
+						<TR><TD BGCOLOR="'.$config['darkborder'].'">
+						Character name:&nbsp;<INPUT TYPE=text NAME="nick" VALUE="'.$nick.'" SIZE="40" readonly="readonly"><BR />
+						Recovery key:&nbsp;&nbsp;&nbsp;&nbsp;<INPUT TYPE=text NAME="key" VALUE="" SIZE="40"><BR>
+						</TD></TR>
+						</TABLE>
+						<BR>
+						<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+						' . $twig->render('buttons.submit.html.twig') . '</div>
+						</TD></TR></FORM></TABLE></TABLE>';
+			}
+			else
+				echo 'Account of this character has no recovery key!';
+		}
+		else
+			echo 'Player or account of player <b>'.$nick.'</b> doesn\'t exist.';
+	}
+	else
+		echo 'Invalid player name format. If you have other characters on account try with other name.';
+	echo '<BR /><TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				<a href="' . getLink('account/lost') . '" border="0"><IMG SRC="'.$template_path.'/images/global/buttons/sbutton_back.gif" NAME="Back" ALT="Back" BORDER=0 WIDTH=120 HEIGHT=18></a></div>
+				</TD></TR></FORM></TABLE></TABLE>';
+}
+elseif($action == 'step2')
+{
+	$rec_key = trim($_REQUEST['key']);
+	$nick = stripslashes($_REQUEST['nick']);
+	if(Validator::characterName($nick))
+	{
+		$player = new OTS_Player();
+		$account = new OTS_Account();
+		$player->find($nick);
+		if($player->isLoaded())
+			$account = $player->getAccount();
+		if($account->isLoaded())
+		{
+			$account_key = $account->getCustomField('key');
+			if(!empty($account_key))
+			{
+				if($account_key == $rec_key)
+				{
+					echo '<script type="text/javascript">
+					function validate_required(field,alerttxt)
+					{
+					with (field)
+					{
+					if (value==null||value==""||value==" ")
+					  {alert(alerttxt);return false;}
+					else {return true}
+					}
+					}
+					function validate_email(field,alerttxt)
+					{
+					with (field)
+					{
+					apos=value.indexOf("@");
+					dotpos=value.lastIndexOf(".");
+					if (apos<1||dotpos-apos<2)
+					  {alert(alerttxt);return false;}
+					else {return true;}
+					}
+					}
+					function validate_form(thisform)
+					{
+					with (thisform)
+					{
+					if (validate_required(email,"Please enter your e-mail!")==false)
+					  {email.focus();return false;}
+					if (validate_email(email,"Invalid e-mail format!")==false)
+					  {email.focus();return false;}
+					if (validate_required(passor,"Please enter password!")==false)
+					  {passor.focus();return false;}
+					if (validate_required(passor2,"Please repeat password!")==false)
+					  {passor2.focus();return false;}
+					if (passor2.value!=passor.value)
+					  {alert(\'Repeated password is not equal to password!\');return false;}
+					}
+					}
+					</script>';
+					echo 'Set new password and e-mail to your account.<BR>
+					<FORM ACTION="' . getLink('account/lost') . '?action=step3" onsubmit="return validate_form(this)" METHOD=post>
+					<INPUT TYPE=hidden NAME="character" VALUE="">
+					<TABLE CELLSPACING=1 CELLPADDING=4 BORDER=0 WIDTH=100%>
+					<TR><TD BGCOLOR="'.$config['vdarkborder'].'" class="white"><B>Please enter new password and e-mail</B></TD></TR>
+					<TR><TD BGCOLOR="'.$config['darkborder'].'">
+					Account of character:&nbsp;&nbsp;<INPUT TYPE=text NAME="nick" VALUE="'.$nick.'" SIZE="40" readonly="readonly"><BR />
+					New password:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<INPUT id="passor" TYPE=password NAME="passor" VALUE="" SIZE="40"><BR>
+					Repeat new password:&nbsp;&nbsp;<INPUT id="passor2" TYPE=password NAME="passor" VALUE="" SIZE="40"><BR>
+					New e-mail address:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<INPUT id="email" TYPE=text NAME="email" VALUE="" SIZE="40"><BR>
+					<INPUT TYPE=hidden NAME="key" VALUE="'.$rec_key.'">
+					</TD></TR>
+					</TABLE>
+					<BR>
+					<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+					' . $twig->render('buttons.submit.html.twig') . '</div>
+					</TD></TR></FORM></TABLE></TABLE>';
+				}
+				else
+					echo 'Wrong recovery key!';
+			}
+			else
+				echo 'Account of this character has no recovery key!';
+		}
+		else
+			echo 'Player or account of player <b>'.$nick.'</b> doesn\'t exist.';
+	}
+	else
+		echo 'Invalid player name format. If you have other characters on account try with other name.';
+	echo '<BR /><TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				<a href="' . getLink('account/lost') . '?action=step1&action_type=reckey&nick='.urlencode($nick).'" border="0"><IMG SRC="'.$template_path.'/images/global/buttons/sbutton_back.gif" NAME="Back" ALT="Back" BORDER=0 WIDTH=120 HEIGHT=18></a></div>
+				</TD></TR></FORM></TABLE></TABLE>';
+}
+elseif($action == 'step3')
+{
+	$rec_key = trim($_REQUEST['key']);
+	$nick = stripslashes($_REQUEST['nick']);
+	$new_pass = trim($_REQUEST['passor']);
+	$new_email = trim($_REQUEST['email']);
+	if(Validator::characterName($nick))
+	{
+		$player = new OTS_Player();
+		$account = new OTS_Account();
+		$player->find($nick);
+		if($player->isLoaded())
+			$account = $player->getAccount();
+		if($account->isLoaded())
+		{
+			$account_key = $account->getCustomField('key');
+			if(!empty($account_key))
+			{
+				if($account_key == $rec_key)
+				{
+					if(Validator::password($new_pass))
+					{
+						if(Validator::email($new_email))
+						{
+							$account->setEMail($new_email);
+
+							$tmp_new_pass = $new_pass;
+							if(USE_ACCOUNT_SALT)
+							{
+								$salt = generateRandomString(10, false, true, true);
+								$tmp_new_pass = $salt . $new_pass;
+							}
+
+							$account->setPassword(encrypt($tmp_new_pass));
+							$account->save();
+
+							if(USE_ACCOUNT_SALT)
+								$account->setCustomField('salt', $salt);
+
+							echo 'Your account name, new password and new e-mail.<BR>
+							<FORM ACTION="' . getLink('account/manage') . '" onsubmit="return validate_form(this)" METHOD=post>
+							<INPUT TYPE=hidden NAME="character" VALUE="">
+							<TABLE CELLSPACING=1 CELLPADDING=4 BORDER=0 WIDTH=100%>
+							<TR><TD BGCOLOR="'.$config['vdarkborder'].'" class="white"><B>Your account name, new password and new e-mail</B></TD></TR>
+							<TR><TD BGCOLOR="'.$config['darkborder'].'">
+							Account name:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<b>'.$account->getName().'</b><BR>
+							New password:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<b>'.$new_pass.'</b><BR>
+							New e-mail address:&nbsp;<b>'.$new_email.'</b><BR>';
+							if($account->getCustomField('email_next') < time())
+							{
+								$mailBody = '
+								<h3>Your account name and new password!</h3>
+								<p>Changed password and e-mail to your account in Lost Account Interface on server <a href="'.BASE_URL.'"><b>'.$config['lua']['serverName'].'</b></a></p>
+								<p>Account name: <b>'.$account->getName().'</b></p>
+								<p>New password: <b>'.$new_pass.'</b></p>
+								<p>E-mail: <b>'.$new_email.'</b> (this e-mail)</p>
+								<br />
+								<p><u>It\'s automatic e-mail from OTS Lost Account System. Do not reply!</u></p>';
+
+								if(_mail($account->getCustomField('email'), $config['lua']['serverName']." - New password to your account", $mailBody))
+								{
+									echo '<br /><small>Sent e-mail with your account name and password to new e-mail. You should receive this e-mail in 15 minutes. You can login now with new password!</small>';
+								}
+								else
+								{
+									echo '<br /><p class="error">An error occurred while sending email! You will not receive e-mail with this informations. For Admin: More info can be found in system/logs/mailer-error.log</p>';
+								}
+							}
+							else
+							{
+								echo '<br /><small>You will not receive e-mail with this informations.</small>';
+							}
+							echo '<INPUT TYPE=hidden NAME="account_login" VALUE="'.$account->getId().'">
+							<INPUT TYPE=hidden NAME="password_login" VALUE="'.$new_pass.'">
+							</TD></TR></TABLE><BR>
+							<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+							<INPUT TYPE=image NAME="Login" ALT="Login" SRC="'.$template_path.'/images/global/buttons/sbutton_login.gif" BORDER=0 WIDTH=120 HEIGHT=18></div>
+							</TD></TR></FORM></TABLE></TABLE>';
+						}
+						else
+							echo Validator::getLastError();
+					}
+					else
+						echo Validator::getLastError();
+				}
+				else
+					echo 'Wrong recovery key!';
+			}
+			else
+				echo 'Account of this character has no recovery key!';
+		}
+		else
+			echo 'Player or account of player <b>'.$nick.'</b> doesn\'t exist.';
+	}
+	else
+		echo 'Invalid player name format. If you have other characters on account try with other name.';
+	echo '<BR /><TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				<a href="' . getLink('account/lost') . '?action=step1&action_type=reckey&nick='.urlencode($nick).'" border="0"><IMG SRC="'.$template_path.'/images/global/buttons/sbutton_back.gif" NAME="Back" ALT="Back" BORDER=0 WIDTH=120 HEIGHT=18></a></div>
+				</TD></TR></FORM></TABLE></TABLE>';
+}
+elseif($action == 'checkcode')
+{
+	$code = trim($_REQUEST['code']);
+	$character = stripslashes(trim($_REQUEST['character']));
+	if(empty($code) || empty($character))
+		echo 'Please enter code from e-mail and name of one character from account. Then press Submit.<BR>
+				<FORM ACTION="' . getLink('account/lost') . '?action=checkcode" METHOD=post>
+				<TABLE CELLSPACING=1 CELLPADDING=4 BORDER=0 WIDTH=100%>
+				<TR><TD BGCOLOR="'.$config['vdarkborder'].'" class="white"><B>Code & character name</B></TD></TR>
+				<TR><TD BGCOLOR="'.$config['darkborder'].'">
+				Your code:&nbsp;<INPUT TYPE=text NAME="code" VALUE="" SIZE="40")><BR />
+				Character:&nbsp;<INPUT TYPE=text NAME="character" VALUE="" SIZE="40")><BR />
+				</TD></TR>
+				</TABLE>
+				<BR>
+				<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				' . $twig->render('buttons.submit.html.twig') . '</div>
+				</TD></TR></FORM></TABLE></TABLE>';
+	else
+	{
+		$player = new OTS_Player();
+		$account = new OTS_Account();
+		$player->find($character);
+		if($player->isLoaded())
+			$account = $player->getAccount();
+		if($account->isLoaded())
+		{
+			if($account->getCustomField('email_code') == $code)
+			{
+				echo '<script type="text/javascript">
+				function validate_required(field,alerttxt)
+				{
+				with (field)
+				{
+				if (value==null||value==""||value==" ")
+				  {alert(alerttxt);return false;}
+				else {return true}
+				}
+				}
+
+				function validate_form(thisform)
+				{
+				with (thisform)
+				{
+				if (validate_required(passor,"Please enter password!")==false)
+				  {passor.focus();return false;}
+				if (validate_required(passor2,"Please repeat password!")==false)
+				  {passor2.focus();return false;}
+				if (passor2.value!=passor.value)
+				  {alert(\'Repeated password is not equal to password!\');return false;}
+				}
+				}
+				</script>
+				Please enter new password to your account and repeat to make sure you remember password.<BR>
+				<FORM ACTION="' . getLink('account/lost') . '?action=setnewpassword" onsubmit="return validate_form(this)" METHOD=post>
+				<INPUT TYPE=hidden NAME="character" VALUE="'.$character.'">
+				<INPUT TYPE=hidden NAME="code" VALUE="'.$code.'">
+				<TABLE CELLSPACING=1 CELLPADDING=4 BORDER=0 WIDTH=100%>
+				<TR><TD BGCOLOR="'.$config['vdarkborder'].'" class="white"><B>Code & account name</B></TD></TR>
+				<TR><TD BGCOLOR="'.$config['darkborder'].'">
+				New password:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<INPUT TYPE=password ID="passor" NAME="passor" VALUE="" SIZE="40")><BR />
+				Repeat new password:&nbsp;<INPUT TYPE=password ID="passor2" NAME="passor2" VALUE="" SIZE="40")><BR />
+				</TD></TR>
+				</TABLE>
+				<BR>
+				<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				' . $twig->render('buttons.submit.html.twig') . '</div>
+				</TD></TR></FORM></TABLE></TABLE>';
+			}
+			else
+				$error= 'Wrong code to change password.';
+		}
+		else
+			$error = 'Account of this character or this character doesn\'t exist.';
+	}
+	if(!empty($error))
+				echo '<span style="color: red"><b>'.$error.'</b></span><br />Please enter code from e-mail and name of one character from account. Then press Submit.<BR>
+				<FORM ACTION="' . getLink('account/lost') . '?action=checkcode" METHOD=post>
+				<TABLE CELLSPACING=1 CELLPADDING=4 BORDER=0 WIDTH=100%>
+				<TR><TD BGCOLOR="'.$config['vdarkborder'].'" class="white"><B>Code & character name</B></TD></TR>
+				<TR><TD BGCOLOR="'.$config['darkborder'].'">
+				Your code:&nbsp;<INPUT TYPE=text NAME="code" VALUE="" SIZE="40")><BR />
+				Character:&nbsp;<INPUT TYPE=text NAME="character" VALUE="" SIZE="40")><BR />
+				</TD></TR>
+				</TABLE>
+				<BR>
+				<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				' . $twig->render('buttons.submit.html.twig') . '</div>
+				</TD></TR></FORM></TABLE></TABLE>';
+}
+elseif($action == 'setnewpassword')
+{
+	$newpassword = $_REQUEST['passor'];
+	$code = $_REQUEST['code'];
+	$character = stripslashes($_REQUEST['character']);
+	echo '';
+	if(empty($code) || empty($character) || empty($newpassword))
+		echo '<span style="color: red"><b>Error. Try again.</b></span><br />Please enter code from e-mail and name of one character from account. Then press Submit.<BR>
+				<BR><FORM ACTION="' . getLink('account/lost') . '?action=checkcode" METHOD=post>
+				<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				<INPUT TYPE=image NAME="Back" ALT="Back" SRC="'.$template_path.'/images/global/buttons/sbutton_back.gif" BORDER=0 WIDTH=120 HEIGHT=18></div>
+				</TD></TR></FORM></TABLE></TABLE>';
+	else
+	{
+		$player = new OTS_Player();
+		$account = new OTS_Account();
+		$player->find($character);
+		if($player->isLoaded())
+			$account = $player->getAccount();
+		if($account->isLoaded())
+		{
+			if($account->getCustomField('email_code') == $code)
+			{
+				if(Validator::password($newpassword))
+				{
+					$tmp_new_pass = $newpassword;
+					if(USE_ACCOUNT_SALT)
+					{
+						$salt = generateRandomString(10, false, true, true);
+						$tmp_new_pass  = $salt . $newpassword;
+						$account->setCustomField('salt', $salt);
+					}
+
+					$account->setPassword(encrypt($tmp_new_pass ));
+					$account->save();
+					$account->setCustomField('email_code', '');
+					echo 'New password to your account is below. Now you can login.<BR>
+					<INPUT TYPE=hidden NAME="character" VALUE="'.$character.'">
+					<TABLE CELLSPACING=1 CELLPADDING=4 BORDER=0 WIDTH=100%>
+					<TR><TD BGCOLOR="'.$config['vdarkborder'].'" class="white"><B>Changed password</B></TD></TR>
+					<TR><TD BGCOLOR="'.$config['darkborder'].'">
+					New password:&nbsp;<b>'.$newpassword.'</b><BR />
+					Account name:&nbsp;&nbsp;&nbsp;<i>(Already on your e-mail)</i><BR />';
+
+					$mailBody = '
+					<h3>Your account name and password!</h3>
+					<p>Changed password to your account in Lost Account Interface on server <a href="'.BASE_URL.'"><b>'.$config['lua']['serverName'].'</b></a></p>
+					<p>Account name: <b>'.$account->getName().'</b></p>
+					<p>New password: <b>'.$newpassword.'</b></p>
+					<br />
+					<p><u>It\'s automatic e-mail from OTS Lost Account System. Do not reply!</u></p>';
+
+					if(_mail($account->getCustomField('email'), $config['lua']['serverName']." - Your new password", $mailBody))
+					{
+						echo '<br /><small>New password work! Sent e-mail with your password and account name. You should receive this e-mail in 15 minutes. You can login now with new password!';
+					}
+					else
+					{
+						echo '<br /><p class="error">New password work! An error occurred while sending email! You will not receive e-mail with new password. For Admin: More info can be found in system/logs/mailer-error.log';
+					}
+				echo '</TD></TR>
+				</TABLE>
+				<BR>
+				<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				<FORM ACTION="' . getLink('account/manage') . '" METHOD=post>
+				<INPUT TYPE=image NAME="Login" ALT="Login" SRC="'.$template_path.'/images/global/buttons/sbutton_login.gif" BORDER=0 WIDTH=120 HEIGHT=18></div>
+				</TD></TR></FORM></TABLE></TABLE>';
+				}
+				else
+					$error= Validator::getLastError();
+			}
+			else
+				$error= 'Wrong code to change password.';
+		}
+		else
+			$error = 'Account of this character or this character doesn\'t exist.';
+	}
+	if(!empty($error))
+				echo '<span style="color: red"><b>'.$error.'</b></span><br />Please enter code from e-mail and name of one character from account. Then press Submit.<BR>
+				<FORM ACTION="' . getLink('account/lost') . '?action=checkcode" METHOD=post>
+				<TABLE CELLSPACING=1 CELLPADDING=4 BORDER=0 WIDTH=100%>
+				<TR><TD BGCOLOR="'.$config['vdarkborder'].'" class="white"><B>Code & character name</B></TD></TR>
+				<TR><TD BGCOLOR="'.$config['darkborder'].'">
+				Your code:&nbsp;<INPUT TYPE=text NAME="code" VALUE="" SIZE="40")><BR />
+				Character:&nbsp;<INPUT TYPE=text NAME="character" VALUE="" SIZE="40")><BR />
+				</TD></TR>
+				</TABLE>
+				<BR>
+				<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD><div style="text-align:center">
+				' . $twig->render('buttons.submit.html.twig') . '</div>
+				</TD></TR></FORM></TABLE></TABLE>';
+}

system/pages/account/lost/base.php

@@ -1,18 +0,0 @@
-<?php
-defined('MYAAC') or die('Direct access not allowed!');
-
-function lostAccountWriteCooldown(string $nick, int $time): void
-{
-	global $twig;
-
-	$inSec = $time - time();
-	$minutesLeft = floor($inSec / 60);
-	$secondsLeft = $inSec - ($minutesLeft * 60);
-	$timeLeft = $minutesLeft.' minutes '.$secondsLeft.' seconds';
-
-	$timeRounded = ceil(setting('core.mail_lost_account_interval') / 60);
-
-	$twig->display('error_box.html.twig', [
-		'errors' => ["Account of selected character (<b>" . escapeHtml($nick) . "</b>) received e-mail in last $timeRounded minutes. You must wait $timeLeft before you can use Lost Account Interface again."]
-	]);
-}

system/pages/account/lost/check-code.php

@@ -1,51 +0,0 @@
-<?php
-defined('MYAAC') or die('Direct access not allowed!');
-
-csrfProtect();
-
-$title = 'Lost Account';
-
-$code = isset($_REQUEST['code']) ? trim($_REQUEST['code']) : '';
-$character = isset($_REQUEST['character']) ? stripslashes(trim($_REQUEST['character'])) : '';
-
-if(empty($code) || empty($character))
-	$twig->display('account/lost/check-code.html.twig', [
-		'code' => $code,
-		'characters' => $character,
-	]);
-else
-{
-	$player = new OTS_Player();
-	$account = new OTS_Account();
-	$player->find($character);
-	if($player->isLoaded()) {
-		$account = $player->getAccount();
-	}
-
-	if($account->isLoaded()) {
-		if($account->getCustomField('email_code') == $code) {
-			$twig->display('account/lost/check-code.finish.html.twig', [
-				'character' => $character,
-				'code' => $code,
-			]);
-		}
-		else {
-			$error = 'Wrong code to change password.';
-		}
-	}
-	else {
-		$error = "Account of this character or this character doesn't exist.";
-	}
-}
-
-if(!empty($error)) {
-	$twig->display('error_box.html.twig', [
-		'errors' => [$error],
-	]);
-
-	echo '<br/>';
-
-	$twig->display('account/lost/check-code.html.twig', [
-
-	]);
-}

system/pages/account/lost/email/send-code.php

@@ -1,68 +0,0 @@
-<?php
-defined('MYAAC') or die('Direct access not allowed!');
-
-csrfProtect();
-
-require __DIR__ . '/../base.php';
-
-$title = 'Lost Account';
-
-$email = $_REQUEST['email'];
-$nick = stripslashes($_REQUEST['nick']);
-
-$player = new OTS_Player();
-$account = new OTS_Account();
-$player->find($nick);
-if($player->isLoaded()) {
-	$account = $player->getAccount();
-}
-
-if($account->isLoaded()) {
-	if($account->getCustomField('email_next') < time()) {
-		if($account->getEMail() == $email) {
-			$newCode = generateRandomString(30, true, false, true);
-			$mailBody = $twig->render('mail.account.lost.code.html.twig', [
-				'newCode' => $newCode,
-				'account' => $account,
-				'nick' => $nick,
-			]);
-
-			$accountEMail = $account->getCustomField('email');
-			if(_mail($accountEMail, configLua('serverName') . ' - Recover your account', $mailBody)) {
-				$account->setCustomField('email_code', $newCode);
-				$account->setCustomField('email_next', (time() + setting('core.mail_lost_account_interval')));
-
-				$twig->display('success.html.twig', [
-					'title' => 'Email has been sent',
-					'description' => 'Details about steps required to recover your account has been sent to <b>' . $accountEMail . '</b>. You should receive this email within 15 minutes. Please check your inbox/spam directory.',
-					'custom_buttons' => '',
-				]);
-			}
-			else {
-				$account->setCustomField('email_next', (time() + 60));
-				error('An error occurred while sending email! Try again later or contact with admin. For Admin: More info can be found in system/logs/mailer-error.log</p>');
-			}
-		}
-		else {
-			$errors[] = 'Invalid e-mail to account of character <b>' . escapeHtml($nick) . '</b>. Try again.';
-		}
-	}
-	else {
-		lostAccountWriteCooldown($nick, (int)$account->getCustomField('email_next'));
-	}
-}
-else {
-	$errors[] =  "Player or account of player <b>" . escapeHtml($nick) . "</b> doesn't exist.";
-}
-
-if (!empty($errors)) {
-	$twig->display('error_box.html.twig', [
-		'errors' => $errors,
-	]);
-}
-
-$twig->display('account.back_button.html.twig', [
-	'new_line' => true,
-	'center' => true,
-	'action' => getLink('account/lost/step-1') . '?action=email&nick=' . urlencode($nick),
-]);

system/pages/account/lost/email/set-new-password.php

@@ -1,94 +0,0 @@
-<?php
-defined('MYAAC') or die('Direct access not allowed!');
-
-csrfProtect();
-
-$title = 'Lost Account';
-
-$newPassword = $_REQUEST['password'];
-$passwordRepeat = $_REQUEST['password_repeat'];
-$code = $_REQUEST['code'];
-$character = stripslashes($_REQUEST['character']);
-
-if(empty($code) || empty($character) || empty($newPassword) || empty($passwordRepeat)) {
-	$errors[] = 'Please enter code from e-mail and name of one character from account. Then press Submit.';
-
-	$twig->display('error_box.html.twig', [
-		'errors' => $errors,
-	]);
-
-	$twig->display('account.back_button.html.twig', [
-		'new_line' => true,
-		'center' => true,
-		'action' => getLink('account/lost/check-code')
-	]);
-
-	return;
-}
-
-$player = new OTS_Player();
-$account = new OTS_Account();
-$player->find($character);
-if($player->isLoaded()) {
-	$account = $player->getAccount();
-}
-
-if($account->isLoaded()) {
-	if($account->getCustomField('email_code') == $code) {
-		if ($newPassword == $passwordRepeat) {
-			if (Validator::password($newPassword)) {
-				$tmp_new_pass = $newPassword;
-				if (USE_ACCOUNT_SALT) {
-					$salt = generateRandomString(10, false, true, true);
-					$tmp_new_pass = $salt . $newPassword;
-					$account->setCustomField('salt', $salt);
-				}
-
-				$account->setPassword(encrypt($tmp_new_pass));
-				$account->save();
-				$account->setCustomField('email_code', '');
-
-				$mailBody = $twig->render('mail.account.lost.new-password.html.twig', [
-					'account' => $account,
-					'newPassword' => $newPassword,
-				]);
-
-				$statusMsg = '';
-				if (_mail($account->getCustomField('email'), configLua('serverName') . ' - Your new password', $mailBody)) {
-					$statusMsg = '<br /><small>New password work! Sent e-mail with your password and account name. You should receive this e-mail in 15 minutes. You can login now with new password!';
-				} else {
-					$statusMsg = '<br /><p class="error">New password work! An error occurred while sending email! You will not receive e-mail with new password. For Admin: More info can be found in system/logs/mailer-error.log';
-				}
-
-				$twig->display('account/lost/finish.new-password.html.twig', [
-					'statusMsg' => $statusMsg,
-					'newPassword' => $newPassword,
-				]);
-			} else {
-				$error = Validator::getLastError();
-			}
-		}
-		else {
-			$error = 'Passwords are not the same!';
-		}
-	}
-	else {
-		$error = 'Wrong code to change password.';
-	}
-}
-else {
-	$error = "Account of this character or this character doesn't exist.";
-}
-
-if(!empty($error)) {
-	$twig->display('error_box.html.twig', [
-		'errors' => [$error],
-	]);
-
-	echo '<br/>';
-
-	$twig->display('account/lost/check-code.html.twig', [
-		'code' => $code,
-		'character' => $character,
-	]);
-}

system/pages/account/lost/email/step-1.php

@@ -1,34 +0,0 @@
-<?php
-defined('MYAAC') or die('Direct access not allowed!');
-
-require __DIR__ . '/../base.php';
-
-csrfProtect();
-
-$title = 'Lost Account';
-
-if($account->isLoaded()) {
-	if($account->getCustomField('email_next') < time()) {
-		$twig->display('account/lost/email.html.twig', [
-			'nick' => $nick,
-		]);
-	}
-	else {
-		lostAccountWriteCooldown($nick, (int)$account->getCustomField('email_next'));
-	}
-}
-else {
-	$errors[] = "Player or account of player <b>" . escapeHtml($nick) . "</b> doesn't exist.";
-}
-
-if (!empty($errors)) {
-	$twig->display('error_box.html.twig', [
-		'errors' => $errors,
-	]);
-}
-
-$twig->display('account.back_button.html.twig', [
-	'new_line' => true,
-	'center' => true,
-	'action' => getLink('account/lost'),
-]);

system/pages/account/lost/recovery-key/step-1.php

@@ -1,34 +0,0 @@
-<?php
-defined('MYAAC') or die('Direct access not allowed!');
-
-csrfProtect();
-
-$title = 'Lost Account';
-
-if($account->isLoaded()) {
-	$account_key = $account->getCustomField('key');
-
-	if(!empty($account_key)) {
-		$twig->display('account/lost/recovery-key.step-1.html.twig', [
-			'nick' => $nick,
-		]);
-	}
-	else {
-		$errors[] = 'Account of this character has no recovery key!';
-	}
-}
-else {
-	$errors[] = "Player or account of player <b>" . escapeHtml($nick) . "</b> doesn't exist.";
-}
-
-if (!empty($errors)) {
-	$twig->display('error_box.html.twig', [
-		'errors' => $errors,
-	]);
-}
-
-$twig->display('account.back_button.html.twig', [
-	'new_line' => true,
-	'center' => true,
-	'action' => getLink('account/lost'),
-]);

system/pages/account/lost/recovery-key/step-2.php

@@ -1,48 +0,0 @@
-<?php
-defined('MYAAC') or die('Direct access not allowed!');
-
-csrfProtect();
-
-$title = 'Lost Account';
-
-$key = trim($_REQUEST['key']);
-$nick = stripslashes($_REQUEST['nick']);
-
-$player = new OTS_Player();
-$account = new OTS_Account();
-$player->find($nick);
-if($player->isLoaded()) {
-	$account = $player->getAccount();
-}
-
-if($account->isLoaded()) {
-	$accountKey = $account->getCustomField('key');
-	if(!empty($accountKey)) {
-		if($accountKey == $key) {
-			$twig->display('account/lost/recovery-key.step-2.html.twig', [
-				'nick' => $nick,
-				'key' => $key,
-			]);
-		}
-		else {
-			$errors[] = 'Wrong recovery key!';
-		}
-	}
-	else {
-		$errors[] = 'Account of this character has no recovery key!';
-	}
-}
-else
-	$errors[] =  "Player or account of player <b>" . escapeHtml($nick) . "</b> doesn't exist.";
-
-if (!empty($errors)) {
-	$twig->display('error_box.html.twig', [
-		'errors' => $errors,
-	]);
-}
-
-$twig->display('account.back_button.html.twig', [
-	'new_line' => true,
-	'center' => true,
-	'action' => getLink('account/lost/step-1') . '?action=recovery-key&nick=' . urlencode($nick),
-]);

system/pages/account/lost/recovery-key/step-3.php

@@ -1,101 +0,0 @@
-<?php
-defined('MYAAC') or die('Direct access not allowed!');
-
-csrfProtect();
-
-$title = 'Lost Account';
-
-$key = trim($_REQUEST['key']);
-$nick = stripslashes($_REQUEST['nick']);
-$newPassword = trim($_REQUEST['password']);
-$passwordRepeat = trim($_REQUEST['password_repeat']);
-$newEmail = trim($_REQUEST['email']);
-
-$player = new OTS_Player();
-$account = new OTS_Account();
-$player->find($nick);
-if($player->isLoaded()) {
-	$account = $player->getAccount();
-}
-
-if($account->isLoaded()) {
-	$accountKey = $account->getCustomField('key');
-
-	if(!empty($accountKey)) {
-		if($accountKey == $key) {
-			if(Validator::password($newPassword)) {
-				if ($newPassword == $passwordRepeat) {
-					if (Validator::email($newEmail)) {
-						$account->setEMail($newEmail);
-
-						$tmp_new_pass = $newPassword;
-						if (USE_ACCOUNT_SALT) {
-							$salt = generateRandomString(10, false, true, true);
-							$tmp_new_pass = $salt . $newPassword;
-						}
-
-						$account->setPassword(encrypt($tmp_new_pass));
-						$account->save();
-
-						if (USE_ACCOUNT_SALT) {
-							$account->setCustomField('salt', $salt);
-						}
-
-						$statusMsg = '';
-						if ($account->getCustomField('email_next') < time()) {
-							$mailBody = $twig->render('mail.account.lost.new-email.html.twig', [
-								'account' => $account,
-								'newPassword' => $newPassword,
-								'newEmail' => $newEmail,
-							]);
-
-							if (_mail($account->getCustomField('email'), configLua('serverName') . ' - New password to your account', $mailBody)) {
-								$statusMsg = '<br /><small>Sent e-mail with your account name and password to new e-mail. You should receive this e-mail in 15 minutes. You can login now with new password!</small>';
-							} else {
-								$statusMsg = '<br /><p class="error">An error occurred while sending email! You will not receive e-mail with this informations. For Admin: More info can be found in system/logs/mailer-error.log</p>';
-							}
-						} else {
-							$statusMsg = '<br /><small>You will not receive e-mail with this informations.</small>';
-						}
-
-						$twig->display('account/lost/finish.new-email.html.twig', [
-							'statusMsg' => $statusMsg,
-							'account' => $account,
-							'newPassword' => $newPassword,
-							'newEmail' => $newEmail,
-						]);
-					} else {
-						$errors[] = Validator::getLastError();
-					}
-				}
-				else {
-					$errors[] = 'Passwords are not the same!';
-				}
-			}
-			else {
-				$errors[] = Validator::getLastError();
-			}
-		}
-		else {
-			$errors[] = 'Wrong recovery key!';
-		}
-	}
-	else {
-		$errors[] = 'Account of this character has no recovery key!';
-	}
-}
-else {
-	$errors[] = "Player or account of player <b>" . escapeHtml($nick) . "</b> doesn't exist.";
-}
-
-if (!empty($errors)) {
-	$twig->display('error_box.html.twig', [
-		'errors' => $errors,
-	]);
-}
-
-$twig->display('account.back_button.html.twig', [
-	'new_line' => true,
-	'center' => true,
-	'action' => getLink('account/lost/step-1') . '?action=recovery-key&nick=' . urlencode($nick),
-]);

system/pages/account/lost/step-1.php

@@ -1,26 +0,0 @@
-<?php
-defined('MYAAC') or die('Direct access not allowed!');
-
-csrfProtect();
-
-$title = 'Lost Account';
-
-$nick = stripslashes($_REQUEST['nick']);
-
-$player = new OTS_Player();
-$account = new OTS_Account();
-$player->find($nick);
-if($player->isLoaded()) {
-	$account = $player->getAccount();
-}
-
-if (ACTION == 'email') {
-	require __DIR__ . '/email/step-1.php';
-}
-else if (ACTION == 'recovery-key') {
-	require __DIR__ . '/recovery-key/step-1.php';
-}
-else {
-	$twig->display('account/lost/no-action.html.twig');
-}
-

system/pages/account/manage.php

@@ -38,15 +38,24 @@ csrfProtect();
 
 $groups = new OTS_Groups_List();
 
-$freePremium = isset($config['lua']['freePremium']) && getBoolean($config['lua']['freePremium']) || $account_logged->getPremDays() == OTS_Account::GRATIS_PREMIUM_DAYS;
-$dayOrDays = $account_logged->getPremDays() == 1 ? 'day' : 'days';
 /**
  * @var OTS_Account $account_logged
  */
-if(!$account_logged->isPremium())
+$premDays = $account_logged->getPremDays();
+
+$freePremium = isset($config['lua']['freePremium']) && getBoolean($config['lua']['freePremium']) || $premDays == OTS_Account::GRATIS_PREMIUM_DAYS;
+$dayOrDays = ($premDays == 1 ? 'day' : 'days');
+
+$vipSystemEnabled = isset($config['lua']['vipSystemEnabled']) && getBoolean($config['lua']['vipSystemEnabled']);
+$premiumLabel = $vipSystemEnabled ? 'VIP' : 'Premium Account';
+
+if ($freePremium && !$vipSystemEnabled) {
+	$account_status = '<b><span style="color: green">Gratis Premium Account</span></b>';
+} else if(!$account_logged->isPremium()) {
 	$account_status = '<b><span style="color: red">Free Account</span></b>';
-else
-	$account_status = '<b><span style="color: green">' . ($freePremium ? 'Gratis Premium Account' : 'Premium Account, ' . $account_logged->getPremDays() . ' '.$dayOrDays.' left') . '</span></b>';
+} else {
+	$account_status = '<b><span style="color: green">' . $premiumLabel . ', ' . $premDays . ' '.$dayOrDays.' left</span></b>';
+}
 
 $recovery_key = $account_logged->getCustomField('key');
 if(empty($recovery_key))

system/pages/account/resend-email-verify.php

@@ -0,0 +1,94 @@
+<?php
+
+use MyAAC\Models\AccountEmailVerify;
+
+defined('MYAAC') or die('Direct access not allowed!');
+
+$title = 'Resend Email';
+
+$errorWithBackButton = function ($msg) use ($twig) {
+	$errors = [$msg];
+
+	$twig->display('error_box.html.twig', ['errors' => $errors]);
+	$twig->display('account.back_button.html.twig', [
+		'action' => getLink('account/resend-email-verify'),
+	]);
+};
+
+if (!setting('core.mail_enabled') || !setting('core.account_mail_verify')) {
+	$errorWithBackButton('Resending email is not possible on this server.');
+	return;
+}
+
+$showForm = true;
+
+if (isset($_POST['submit']) && $_POST['submit'] == '1') {
+	$email = $_REQUEST['email'];
+
+	if (empty($email) || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
+		$errorWithBackButton('Please enter valid Email.');
+		return;
+	}
+
+	$account = new OTS_Account();
+	$account->findByEMail($email);
+	if ($account->isLoaded()) {
+		if ($account->getCustomField('email_verified') == '1') {
+			$errorWithBackButton('This account is already verified! You can <a href=' . getLink('account/manage') . '>log in</a> on the website.');
+			return;
+		}
+
+		$accountEmailVerify = AccountEmailVerify::where('account_id', $account->getId())->orderBy('sent_at', 'DESC')->first();
+		if ($accountEmailVerify && time() - $accountEmailVerify->sent_at < 60) {
+			$errorWithBackButton('Only one Email per minute is allowed. Please try again later.');
+			return;
+		}
+
+		$tmp_account = $email;
+		if (!config('account_login_by_email')) {
+			$tmp_account = (USE_ACCOUNT_NAME ? $account->getName() : $account->getId());
+		}
+
+		$hash = md5(generateRandomString(16, true, true) . $email);
+
+		AccountEmailVerify::create([
+			'account_id' => $account->getId(),
+			'hash' => $hash,
+			'sent_at' => time(),
+		]);
+
+		$verify_url = getLink('account/confirm-email/' . $hash);
+		$body_html = $twig->render('mail.account.resend-email-verify.html.twig', array(
+			'account' => $tmp_account,
+			'verify_url' => generateLink($verify_url, $verify_url, true)
+		));
+
+		if (_mail($account->getEMail(), configLua('serverName') . ' - Verify Account', $body_html)) {
+			$message = "If account with this email exists - you will become an email with verification link.";
+			$showForm = false;
+		} else {
+			$message = "<p class='error'>An error occurred while sending email (<b>{$email}</b> )! Try again later. For Admin: More info can be found in system/logs/mailer-error.log</p>";
+		}
+	}
+	else {
+		$message = "<br />If account with this email exists - you will become an email with verification link.";
+		$showForm = false;
+	}
+
+	$twig->display('success.html.twig', array(
+		'title' => 'Verify Email Sent',
+		'description' => $message,
+	));
+}
+
+//show errors if not empty
+if (!empty($errors)) {
+	$twig->display('error_box.html.twig', ['errors' => $errors]);
+	$twig->display('account.back_button.html.twig', [
+		'action' => getLink('account/resend-email-verify'),
+	]);
+}
+
+if ($showForm) {
+	$twig->display('account.resend-email-verify.html.twig');
+}

system/pages/guilds/create.php

@@ -21,6 +21,9 @@ if(!$logged) {
 	$errors[] = 'You are not logged in. You can\'t create guild.';
 }
 
+$configLuaFreePremium = configLua('freePremium');
+$freePremium = (isset($configLuaFreePremium) && getBoolean($configLuaFreePremium)) || ($logged && $account_logged->getPremDays() == OTS_Account::GRATIS_PREMIUM_DAYS);
+
 $array_of_player_nig = array();
 if(empty($errors))
 {
@@ -31,7 +34,7 @@ if(empty($errors))
 		if(!$player_rank->isLoaded())
 		{
 			if($player->getLevel() >= setting('core.guild_need_level')) {
-				if(!setting('core.guild_need_premium') || $account_logged->isPremium()) {
+				if(!setting('core.guild_need_premium') || $account_logged->isPremium() || $freePremium) {
 					$array_of_player_nig[] = $player->getName();
 				}
 			}
@@ -95,7 +98,7 @@ if($todo == 'save')
 		if($player->getLevel() < setting('core.guild_need_level')) {
 			$errors[] = 'Character <b>'.$name.'</b> has too low level. To create guild you need character with level <b>' . setting('core.guild_need_level') . '</b>.';
 		}
-		if(setting('core.guild_need_premium') && !$account_logged->isPremium()) {
+		if(setting('core.guild_need_premium') && !$account_logged->isPremium() && !$freePremium) {
 			$errors[] = 'Character <b>'.$name.'</b> is on FREE account. To create guild you need PREMIUM account.';
 		}
 	}

system/router.php

@@ -88,8 +88,10 @@ if($logged && $account_logged && $account_logged->isLoaded()) {
 /**
  * Routes loading
  */
+$routesFinal = [];
 $dispatcher = FastRoute\cachedDispatcher(function (FastRoute\RouteCollector $r) {
-	$routesFinal = [];
+	global $cache, $routesFinal;
+
 	foreach(getDatabasePages() as $page) {
 		$routesFinal[] = ['*', $page, '__database__/' . $page, 100];
 	}
@@ -165,7 +167,7 @@ $dispatcher = FastRoute\cachedDispatcher(function (FastRoute\RouteCollector $r)
 	echo '</pre>';
 	die;
 */
-	foreach ($routesFinal as $route) {
+	foreach ($routesFinal as &$route) {
 		if ($route[0] === '*') {
 			$route[0] = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD'];
 		}
@@ -198,6 +200,10 @@ $dispatcher = FastRoute\cachedDispatcher(function (FastRoute\RouteCollector $r)
 			log_append('router.log', $warning);
 		}
 	}
+
+	if ($cache->enabled()) {
+		$cache->set('routes_final', serialize($routesFinal), 10 * 365 * 24 * 60 * 60); // 10 years / infinite
+	}
 },
 	[
 		'cacheFile' => CACHE . 'route.cache',
@@ -212,7 +218,7 @@ $found = true;
 
 // old support for pages like /?subtopic=accountmanagement
 $page = $_REQUEST['p'] ?? ($_REQUEST['subtopic'] ?? '');
-if(!empty($page) && preg_match('/^[A-z0-9\-]+$/', $page)) {
+if(!empty($page) && preg_match('/^[A-z0-9\/\-]+$/', $page)) {
 	if (isset($_REQUEST['p'])) { // some plugins may require this
 		$_REQUEST['subtopic'] = $_REQUEST['p'];
 	}
@@ -221,9 +227,26 @@ if(!empty($page) && preg_match('/^[A-z0-9\-]+$/', $page)) {
 		require SYSTEM . 'compat/pages.php';
 	}
 
-	$file = loadPageFromFileSystem($page, $found);
-	if(!$found) {
-		$file = false;
+	$foundRoute = false;
+
+	$tmp = null;
+	if ($cache->enabled() && $cache->fetch('routes_final', $tmp)) {
+		$routesFinal = unserialize($tmp);
+	}
+
+	foreach ($routesFinal as $route) {
+		if ($page === $route[1]) {
+			$file = $route[2];
+			$foundRoute = true;
+			break;
+		}
+	}
+
+	if (!$foundRoute) {
+		$file = loadPageFromFileSystem($page, $found);
+		if(!$found) {
+			$file = false;
+		}
 	}
 }
 else {

system/src/Cache/Cache.php

@@ -115,6 +115,11 @@ class Cache
 			return unserialize($value);
 		}
 
+		// -1 for infinite cache
+		if ($ttl == -1) {
+			$ttl = 10 * 365 * 24 * 60 * 60; // 10 years should be enough
+		}
+
 		$value = $callback();
 		$cache->set($key, serialize($value), $ttl);
 		return $value;

system/src/Models/Account.php

@@ -33,10 +33,11 @@ class Account extends Model {
 
 	public function getPremiumDaysAttribute()
 	{
-		if(isset($this->premium_ends_at) || isset($this->premend)) {
-			$col = isset($this->premium_ends_at) ? 'premium_ends_at' : 'premend';
-			$ret = ceil(($this->{$col}- time()) / (24 * 60 * 60));
-			return $ret > 0 ? $ret : 0;
+		if(isset($this->premium_ends_at) || isset($this->premend) ||
+			(isCanary() && isset($this->data['lastday']))) {
+				$col = (isset($this->premium_ends_at) ? 'premium_ends_at' : (isset($this->data['lastday']) ? 'lastday' : 'premend'));
+				$ret = ceil(($this->{$col}- time()) / (24 * 60 * 60));
+				return max($ret, 0);
 		}
 
 		if($this->premdays == 0) {

system/src/Models/AccountEmailVerify.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace MyAAC\Models;
+use Illuminate\Database\Eloquent\Model;
+
+class AccountEmailVerify extends Model
+{
+
+	protected $table = TABLE_PREFIX . 'account_emails_verify';
+
+	public $timestamps = false;
+
+	protected $fillable = ['account_id', 'hash', 'sent_at'];
+
+}

system/src/global.php

@@ -28,6 +28,8 @@ define('HOOK_CHARACTERS_AFTER_CHARACTERS', ++$i);
 define('HOOK_LOGIN', ++$i);
 define('HOOK_LOGIN_ATTEMPT', ++$i);
 define('HOOK_LOGOUT', ++$i);
+define('HOOK_ACCOUNT_CHANGE_PASSWORD_AFTER_OLD_PASSWORD', ++$i);
+define('HOOK_ACCOUNT_CHANGE_PASSWORD_AFTER_NEW_PASSWORD', ++$i);
 define('HOOK_ACCOUNT_CHANGE_PASSWORD_POST', ++$i);
 define('HOOK_ACCOUNT_CREATE_BEFORE_FORM', ++$i);
 define('HOOK_ACCOUNT_CREATE_BEFORE_BOXES', ++$i);

system/templates/account.back_button.html.twig

@@ -1,26 +1,7 @@
 {% if new_line is defined and new_line %}
 	<br/>
 {% endif %}
-
-{% set _center = false %}
-
-{% if center is defined and center %}
-{% set _center = true %}
-{% endif %}
-
-{% if _center %}
-<table border="0" cellspacing="1" cellpadding="4" width="100%">
-	<tbody>
-	<tr>
-		<td align="center">
-{% endif %}
-			<form action="{% if action is not defined %}{{ getLink('account/manage') }}{% else %}{{ action }}{% endif %}" method="post">
-				{{ csrf() }}
-				{{ include('buttons.back.html.twig') }}
-			</form>
-{% if _center %}
-		</td>
-	</tr>
-	</tbody>
-</table>
-{% endif %}
+<form action="{% if action is not defined %}{{ getLink('account/manage') }}{% else %}{{ action }}{% endif %}" method="post">
+	{{ csrf() }}
+	{{ include('buttons.back.html.twig') }}
+</form>

system/templates/account.change-password.html.twig

@@ -9,23 +9,29 @@ Please enter your current password and a new password. For your security, please
 			<span>Current Password:</span>
 		</td>
 		<td>
-			<input form="form" type="password" name="oldpassword" size="30" maxlength="29">
+			<input form="form" type="password" id="old_password" name="old_password" size="30" maxlength="29">
 		</td>
 	</tr>
+
+	{{ hook('HOOK_ACCOUNT_CHANGE_PASSWORD_AFTER_OLD_PASSWORD') }}
+
 	<tr>
 		<td class="LabelV">
 			<span>New Password:</span>
 		</td>
 		<td style="width:90%;">
-			<input form="form" type="password" name="newpassword" size="30" maxlength="29">
+			<input form="form" type="password" id="new_password" name="new_password" size="30" maxlength="29">
 		</td>
 	</tr>
+
+	{{ hook('HOOK_ACCOUNT_CHANGE_PASSWORD_AFTER_NEW_PASSWORD') }}
+
 	<tr>
 		<td class="LabelV">
 			<span>New Password Again:</span>
 		</td>
 		<td>
-			<input form="form" type="password" name="newpassword_confirm" size="30" maxlength="29">
+			<input form="form" type="password" id="new_password_confirm" name="new_password_confirm" size="30" maxlength="29">
 		</td>
 	</tr>
 </table>

system/templates/account.lost.form.html.twig

@@ -0,0 +1,36 @@
+The Lost Account Interface can help you to get back your account name and password. Please enter your character name and select what you want to do.<br/>
+<form action="{{ getLink('account/lost') }}?action=step1" method="post">
+	{{ csrf() }}
+	<input type="hidden" name="character" value="">
+	<table cellspacing="1" cellpadding="4" border="0" width="100%">
+		<tr>
+			<td bgcolor="{{ config.vdarkborder }}" class="white"><b>Please enter your character name</b></td>
+		</tr>
+		<tr>
+			<td bgcolor="{{ config.darkborder }}">
+				<input type="text" name="nick" size="40" autofocus/><br>
+			</td>
+		</tr>
+	</table>
+	<table cellspacing="1" cellpadding="4" border="0" width="100%">
+		<tr>
+			<td bgcolor="{{ config.vdarkborder }}" class="white"><b>What do you want?</b></td>
+		</tr>
+		<tr>
+			<td bgcolor="{{ config.darkborder }}">
+				<input type="radio" name="action_type" id="action_type_email" value="email">
+				<label for="action_type_email"> Send me new password and my account name to account e-mail adress.</label><br/>
+				<input type=radio name="action_type" id="action_type_key" value="reckey">
+				<label for="action_type_key"> I got <b>recovery key</b> and want set new password and e-mail adress to my account.</label><br/>
+			</td>
+		</tr>
+	</table>
+	<br/>
+	<table cellspacing="0" cellpadding="0" border="0" width="100%">
+		<tr>
+			<td align="center">
+				{{ include('buttons.submit.html.twig') }}
+			</td>
+		</tr>
+	</table>
+</form>

system/templates/account.lost.noaction.html.twig

@@ -0,0 +1,10 @@
+Please select action.<br/>
+<table cellspacing="0" cellpadding="0" border="0" width="100%">
+	<tr>
+		<td align="center">
+			<a href="{{ getLink('account/lost') }}" border="0">
+				{{ include('buttons.back.html.twig') }}
+			</a>
+		</td>
+	</tr>
+</table>

system/templates/account.resend-email-verify.html.twig

@@ -0,0 +1,45 @@
+Please enter your account Email address.<br/><br/>
+{% set title = 'Resend Email' %}
+{% set background = config('darkborder') %}
+{% set content %}
+	<table style="width:100%;">
+		<tr>
+			<td class="LabelV" >
+				<span><label for="email">Email Address:</label></span>
+			</td>
+			<td style="width:90%;">
+				<input type="email" form="form" id="email" name="email" size="30" maxlength="50" autofocus/>
+			</td>
+		</tr>
+	</table>
+{% endset %}
+{% include 'tables.headline.html.twig' %}
+<br/>
+<table style="width:100%;">
+	<tr align="center">
+		<td>
+			<table border="0" cellspacing="0" cellpadding="0">
+				<tr>
+					<td style="border:0;">
+						<form id="form" action="{{ getLink('account/resend-email-verify') }}" method="post">
+							{{ csrf() }}
+							<input type="hidden" name="submit" value="1"/>
+							{{ include('buttons.submit.html.twig') }}
+						</form>
+					</td>
+				<tr>
+			</table>
+		</td>
+		<td>
+			<table border="0" cellspacing="0" cellpadding="0">
+				<tr>
+					<td style="border:0;">
+						<form action="{{ getLink('news') }}" method="post">
+							{{ include('buttons.back.html.twig') }}
+						</form>
+					</td>
+				</tr>
+			</table>
+		</td>
+	</tr>
+</table>

system/templates/account/lost/check-code.finish.html.twig

@@ -1,54 +0,0 @@
-Please enter new password to your account and repeat to make sure you remember password.<BR>
-<form action="{{ getLink('account/lost/email/set-new-password') }}" method="post">
-
-	{{ csrf() }}
-
-	<input type="hidden" name="character" value="{{ character }}">
-	<input type="hidden" name="code" value="{{ code }}">
-
-	<table class="myaac-table" style="width: 100%;">
-
-		<thead>
-		<tr>
-			<th class="white"><b>Passwords</b></th>
-		</tr>
-		</thead>
-
-		<tbody>
-		<tr>
-			<td>
-				<table>
-					<tr>
-						<td>
-							<label for="password">New password:</label>
-						</td>
-						<td>
-							<input type="password" id="password" name="password" value="" size="40">
-						</td>
-					</tr>
-					<tr>
-						<td>
-							<label for="password_repeat">Repeat new password:</label>
-						</td>
-						<td>
-							<input type="password" id="password_repeat" name="password_repeat" value="" size="40">
-						</td>
-					</tr>
-				</table>
-			</td>
-		</tr>
-		</tbody>
-
-	</table>
-	<br/>
-	<table style="width: 100%">
-		<tr>
-			<td>
-				<div style="text-align: center">
-					{% set button_name = 'Submit' %}
-					{% include('buttons.base.html.twig') %}
-				</div>
-			</td>
-		</tr>
-	</table>
-</form>

system/templates/account/lost/check-code.html.twig

@@ -1,33 +0,0 @@
-Please enter code from e-mail and name of one character from account. Then press Submit.<br/>
-<form action="{{ getLink('account/lost/check-code') }}" method="post">
-
-	{{ csrf() }}
-
-	<table class="myaac-table" style="width: 100%;">
-		<thead>
-		<tr>
-			<th class="white">
-				<b>Code & character name</b>
-			</th>
-		</tr>
-		</thead>
-
-		<tbody>
-		<tr>
-			<td>
-				Your code:&nbsp;<input type="text" name="code" value="{{ code }}" size="40"><br/>
-				Character:&nbsp;<input type="text" name="character" value="{{ character }}" size="40"><br/>
-			</td>
-		</tr>
-		</tbody>
-	</table>
-	<br>
-	<table style="width: 100%">
-		<tr>
-			<td align="center">
-				{% set button_name = 'Submit' %}
-				{% include('buttons.base.html.twig') %}
-			</td>
-		</tr>
-	</table>
-</form>

system/templates/account/lost/email.html.twig

@@ -1,54 +0,0 @@
-Please enter e-mail to account with this character.<br/>
-<form action="{{ getLink('account/lost/email/send-code') }}" method="post">
-
-	{{ csrf() }}
-
-	<input type=hidden name="character">
-	<table class="myaac-table" style="width: 100%;">
-
-		<thead>
-		<tr>
-			<th class="white"><b>Please enter e-mail to account</b></th>
-		</tr>
-		</thead>
-
-		<tbody>
-		<tr>
-			<td>
-
-				<table>
-					<tr>
-						<td>
-							<label for="nick">Character:</label>
-						</td>
-						<td>
-							<input type=text id="nick" name="nick" value="{{ nick }}" size="40" readonly="readonly">
-						</td>
-					</tr>
-					<tr>
-						<td>
-							<label for="name">E-mail to account:</label>
-						</td>
-						<td>
-							<input type=text id="name" name="email" value="" size="40">
-						</td>
-					</tr>
-				</table>
-
-			</td>
-		</tr>
-		</tbody>
-
-	</table>
-	<br>
-	<table style="width: 100%">
-		<tr>
-			<td>
-				<div style="text-align:center">
-					{% set button_name = 'Submit' %}
-					{% include('buttons.base.html.twig') %}
-				</div>
-			</td>
-		</tr>
-	</table>
-</form>

system/templates/account/lost/finish.new-email.html.twig

@@ -1,58 +0,0 @@
-Your account name, new password and new e-mail.<br/>
-<table class="myaac-table" style="width: 100%;">
-
-	<thead>
-	<tr>
-		<th class="white">
-			<b>Your account name, new password and new e-mail</b>
-		</th>
-	</tr>
-	</thead>
-
-	<tbody>
-	<tr>
-		<td>
-
-			<table>
-				<tr>
-					<td>
-						Account name:
-					</td>
-					<td>
-						<b>{{ account.getName() }}</b>
-					</td>
-				</tr>
-				<tr>
-					<td>
-						New password:
-					</td>
-					<td>
-						<b>{{ newPassword }}</b>
-					</td>
-				</tr>
-				<tr>
-					<td>
-						New e-mail address:
-					</td>
-					<td>
-						<b>{{ newEmail }}</b>
-					</td>
-				</tr>
-			</table>
-
-			{{ statusMsg|raw }}
-		</td>
-	</tr>
-	</tbody>
-
-</table>
-<br>
-<table style="width: 100%">
-	<tr>
-		<td align="center">
-			<form action="{{ getLink('account/manage') }}" method="post">
-				{{ include('buttons.login.html.twig') }}
-			</form>
-		</td>
-	</tr>
-</table>

system/templates/account/lost/finish.new-password.html.twig

@@ -1,30 +0,0 @@
-New password to your account is below. Now you can log in.<BR>
-<table class="myaac-table" style="width: 100%;">
-
-	<thead>
-	<tr>
-		<th class="white"><b>Changed password</b></th>
-	</tr>
-	</thead>
-
-	<tbody>
-	<tr>
-		<td>
-			New password:&nbsp;<b>{{ newPassword }}</b><br/>
-			Account name:&nbsp;&nbsp;&nbsp;<i>(Already on your e-mail)</i><br/>
-			{{ statusMsg|raw }}
-		</td>
-	</tr>
-	</tbody>
-</table>
-<br/>
-<table style="width: 100%">
-	<tr>
-		<td align="center">
-			<form action="{{ getLink('account/manage') }}">
-				{% set button_name = 'Login' %}
-				{% include('buttons.base.html.twig') %}
-			</form>
-		</td>
-	</tr>
-</table>

system/templates/account/lost/form.html.twig

@@ -1,43 +0,0 @@
-The Lost Account Interface can help you to get back your account name and password. Please enter your character name and select what you want to do.<br/>
-<form action="{{ getLink('account/lost/step-1') }}" method="post">
-
-	{{ csrf() }}
-
-	<input type="hidden" name="character" value="">
-	<table class="myaac-table" style="width: 100%">
-		<thead>
-		<tr>
-			<th class="white"><b>Please enter your character name</b></th>
-		</tr>
-		</thead>
-		<tbody>
-			<tr>
-				<td>
-					<input type="text" name="nick" size="40" autofocus/><br>
-				</td>
-			</tr>
-		</tbody>
-	</table>
-	<table style="width: 100%; border-spacing: 1px">
-		<tr>
-			<td style="padding: 4px; background: {{ config('vdarkborder') }}" class="white"><b>What do you want?</b></td>
-		</tr>
-		<tr>
-			<td style="padding: 4px; background: {{ config('darkborder') }}">
-				<input type="radio" name="action" id="action_type_email" value="email">
-				<label for="action_type_email"> Send me new password and my account name to account e-mail address.</label><br/>
-				<input type=radio name="action" id="action_type_key" value="recovery-key">
-				<label for="action_type_key"> I got <b>recovery key</b> and want set new password and e-mail address to my account.</label><br/>
-			</td>
-		</tr>
-	</table>
-	<br/>
-	<table style="width: 100%">
-		<tr>
-			<td align="center">
-				{% set button_name = 'Submit' %}
-				{% include('buttons.base.html.twig') %}
-			</td>
-		</tr>
-	</table>
-</form>

system/templates/account/lost/no-action.html.twig

@@ -1,10 +0,0 @@
-Please select action.<br/>
-<table style="width: 100%">
-	<tr>
-		<td align="center">
-			<a href="{{ getLink('account/lost') }}">
-				{{ include('buttons.back.html.twig') }}
-			</a>
-		</td>
-	</tr>
-</table>

system/templates/account/lost/recovery-key.step-1.html.twig

@@ -1,53 +0,0 @@
-If you enter right recovery key you will see form to set new e-mail and password to account. To this e-mail will be send your new password and account name.<BR>
-<form action="{{ getLink('account/lost/recovery-key/step-2') }}" method="post">
-
-	{{ csrf() }}
-
-	<table class="myaac-table" style="width: 100%;">
-
-		<thead>
-		<tr>
-			<th class="white">
-				<b>Please enter your recovery key</b>
-			</th>
-		</tr>
-		</thead>
-
-		<tbody>
-		<tr>
-			<td>
-				<table>
-					<tr>
-						<td>
-							<label for="nick">Character name:</label>
-						</td>
-						<td>
-							<input type=text id="nick" name="nick" value="{{ nick }}" size="40" readonly="readonly">
-						</td>
-					</tr>
-					<tr>
-						<td>
-							<label for="key">Recovery key:</label>
-						</td>
-						<td>
-							<input type="text" id="key" name="key" value="" size="40">
-						</td>
-					</tr>
-				</table>
-			</td>
-		</tr>
-		</tbody>
-
-	</table>
-	<br>
-	<table style="width: 100%">
-		<tr>
-			<td>
-				<div style="text-align:center">
-					{% set button_name = 'Submit' %}
-					{% include('buttons.base.html.twig') %}
-				</div>
-			</td>
-		</tr>
-	</table>
-</form>

system/templates/account/lost/recovery-key.step-2.html.twig

@@ -1,71 +0,0 @@
-Set new password and e-mail to your account.<br>
-<form action="{{ getLink('account/lost/recovery-key/step-3') }}" method="post">
-
-	{{ csrf() }}
-
-	<input type="hidden" name="key" VALUE="{{ key }}">
-
-	<input type="hidden" name="character" value="">
-	<table class="myaac-table" style="width: 100%">
-
-		<thead>
-		<tr>
-			<th class="white">
-				<b>Please enter new password and e-mail</b>
-			</th>
-		</tr>
-		</thead>
-
-		<tbody>
-		<tr>
-			<td>
-
-				<table>
-					<tr>
-						<td>
-							<label for="nick">Account of character:</label>
-						</td>
-						<td>
-							<input type="text" id="nick" name="nick" value="{{ nick }}" size="40" readonly="readonly">
-						</td>
-					</tr>
-					<tr>
-						<td>
-							<label for="password">New password:</label>
-						</td>
-						<td>
-							<input type="password" id="password" name="password" value="" size="40">
-						</td>
-					</tr>
-					<tr>
-						<td>
-							<label for="password_repeat">Repeat new password:</label>
-						</td>
-						<td>
-							<input type="password" id="password_repeat" name="password_repeat" value="" size="40">
-						</td>
-					</tr>
-					<tr>
-						<td>
-							<label for="email">New e-mail address:</label>
-						</td>
-						<td>
-							<input type="text" id="email" name="email" value="" size="40">
-						</td>
-					</tr>
-				</table>
-
-			</td>
-		</tr>
-		</tbody>
-	</table>
-	<br>
-	<table style="width: 100%">
-		<tr>
-			<td align="center">
-				{% set button_name = 'Submit' %}
-				{% include('buttons.base.html.twig') %}
-			</td>
-		</tr>
-</table>
-</form>

system/templates/error_box.html.twig

@@ -9,7 +9,7 @@
 			<div class="AttentionSign" style="background-image:url({{ template_path }}/images/content/attentionsign.gif);"></div>
 			<b>The Following Errors Have Occurred:</b><br/>
 			{% for error in errors %}
-			<li>{{ error|striptags('<b>')|raw }}</li>
+			<li>{{ error|striptags('<b><a>')|raw }}</li>
 			{% endfor %}
 		</div>
 		<div class="BoxFrameHorizontal" style="background-image:url({{ template_path }}/images/content/box-frame-horizontal.gif);"></div>
@@ -17,4 +17,4 @@
 		<div class="BoxFrameEdgeLeftBottom" style="background-image:url({{ template_path }}/images/content/box-frame-edge.gif);"></div>
 	</div>
 </div>
-<br/>
+<br/>

system/templates/mail.account.lost.code.html.twig

@@ -1,10 +0,0 @@
-You asked to reset your {{ config('lua')['serverName'] }} password.<br/>
-<p>Account name: {{ account.getName() }}</p>
-<br/>
-To do so, please click this link:
-<p>
-	<a href="{{ getLink('account/lost/check-code') }}?code={{ newCode }}&character={{ nick|urlencode }}">{{ getLink('account/lost/check-code') }}?code={{ newCode }}&character={{ nick|urlencode }}</a>
-</p>
-<p>or open page: <i>{{ getLink('account/lost/check-code') }}</i> and in field "code" write <b>{{ newCode }}</b></p>
-<br/>
-<p>If you did not request a password change, you may ignore this message and your password will remain unchanged.

system/templates/mail.account.lost.new-email.html.twig

@@ -1,7 +0,0 @@
-<h3>Your account name and new password!</h3>
-<p>Changed password and e-mail to your account in Lost Account Interface on server <a href="{{ constant('BASE_URL') }}"><b>{{ config('lua')['serverName'] }}</b></a></p>
-<p>Account name: <b>{{ account.getName() }}</b></p>
-<p>New password: <b>{{ newPassword }}</b></p>
-<p>E-mail: <b>{{ newEmail }}</b> (this e-mail)</p>
-<br/>
-<p><u>It's automatic e-mail from OTS Lost Account System. Do not reply!</u></p>

system/templates/mail.account.lost.new-password.html.twig

@@ -1,6 +0,0 @@
-<h3>Your account name and password!</h3>
-<p>Changed password to your account in Lost Account Interface on server <a href="{{ constant('BASE_URL') }}"><b>{{ config('lua')['serverName'] }}</b></a></p>
-<p>Account name: <b>{{ account.getName() }}</b></p>
-<p>New password: <b>{{ newPassword }}</b></p>
-<br/>
-<p><u>It's automatic e-mail from OTS Lost Account System. Do not reply!</u></p>

system/templates/mail.account.resend-email-verify.html.twig

@@ -0,0 +1,7 @@
+Hello {{ account }}!<br/>
+<br/>
+You requested to resend the verify Email on {{ config.lua.serverName }}!<br/>
+<br/>
+
+To verify your email address please click the link below:<br/>
+{{ verify_url|raw }}

system/templates/online.html.twig

@@ -101,7 +101,7 @@
 
 	<tr>
 		<td class="LabelV150"><b>Location Datacenter:</b></td>
-		<td>{{ setting('core.online_datacenter') }} <small>(Server date & time: - {{ "now"|date("d/m/Y H:i:s") }})</small></td>
+		<td>{{ setting('core.online_datacenter')|raw }} <small>(Server date & time: - {{ "now"|date("d/m/Y H:i:s") }})</small></td>
 	</tr>
 	<tr>
 		<td class="LabelV150"><b>PvP Type:</b></td>

system/twig.php

@@ -101,7 +101,9 @@ $twig->addFunction($function);
 $function = new TwigFunction('hook', function ($context, $hook, array $params = []) {
 	global $hooks;
 
-	//note($hook);
+	if (config('hooks_debug')) {
+		note($hook);
+	}
 
 	if(is_string($hook)) {
 		if (defined($hook)) {

templates/tibiacom/index.php

@@ -27,26 +27,18 @@ if(isset($config['boxes']))
 		var loginStatus="<?php echo ($logged ? 'true' : 'false'); ?>";
 		<?php
 			if(PAGE !== 'news') {
-				if(isset($_REQUEST['subtopic'])) {
-					$tmp = escapeHtml($_REQUEST['subtopic']);
-					if($tmp === 'accountmanagement') {
-						$tmp = 'accountmanage';
+				$tmp = str_replace('/', '_', isset($_REQUEST['subtopic']) ? escapeHtml($_REQUEST['subtopic']) :  PAGE);
+				$exp = explode('/', PAGE);
+				if(PAGE !== 'account/create' && PAGE !== 'account/lost' && isset($exp[1])) {
+					if ($exp[0] === 'account' && $exp[1] === 'lost') {
+						$tmp = 'account_lost';
+					} elseif ($exp[0] === 'account') {
+						$tmp = 'account_manage';
+					} else if ($exp[0] === 'news' && $exp[1] === 'archive') {
+						$tmp = 'news_archive';
 					}
-				}
-				else {
-					$tmp = str_replace('/', '_', PAGE);
-					$exp = explode('/', PAGE);
-					if(PAGE !== 'account/create' && PAGE !== 'account/lost' && isset($exp[1])) {
-						if ($exp[0] === 'account' && $exp[1] === 'lost') {
-							$tmp = 'account_lost';
-						} elseif ($exp[0] === 'account') {
-							$tmp = 'account_manage';
-						} else if ($exp[0] === 'news' && $exp[1] === 'archive') {
-							$tmp = 'news_archive';
-						}
-						else if (in_array($exp[0], ['characters', 'highscores', 'guilds', 'forum'])) {
-							$tmp = $exp[0];
-						}
+					else if (in_array($exp[0], ['characters', 'highscores', 'guilds', 'forum'])) {
+						$tmp = $exp[0];
 					}
 				}
 			}

tools/generate_account_number.php

@@ -9,6 +9,8 @@
  * @link      https://my-aac.org
  */
 
+const IGNORE_SET_LAST_VISIT = true;
+
 // we need some functions
 require '../common.php';
 require SYSTEM . 'functions.php';

tools/status.php

@@ -1,4 +1,7 @@
 <?php
+
+const IGNORE_SET_LAST_VISIT = true;
+
 require '../common.php';
 require SYSTEM . 'init.php';
 require SYSTEM . 'functions.php';

tools/validate.php

@@ -12,6 +12,8 @@
 use MyAAC\CreateCharacter;
 use MyAAC\Models\Account;
 
+const IGNORE_SET_LAST_VISIT = true;
+
 // we need some functions
 require '../common.php';
 require SYSTEM . 'functions.php';