[WIP] Rewrite OTS_Player class

This reverts commit 7ca05e47ff.

.editorconfig

@@ -11,4 +11,9 @@ insert_final_newline = true
 
 [*.md]
 trim_trailing_whitespace = false
-indent_style = tab
+
+[{composer.json,package.json}]
+indent_style = space
+
+[{package.json, *.yml}]
+indent_size = 2

.gitattributes

@@ -3,9 +3,11 @@
 .gitignore export-ignore
 .github export-ignore
 .editorconfig export-ignore
-.travis.yml export-ignore
 _config.yml export-ignore
 release.sh export-ignore
 
+# cypress
+cypress export-ignore
+cypress.config.js export-ignore
+
 *.sh text eol=lf
-VERSION text eol=lf

.github/workflows/cypress.yml

@@ -0,0 +1,164 @@
+name: Cypress
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  cypress:
+    runs-on: ubuntu-latest
+    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: myaac
+          MYSQL_USER: myaac
+          MYSQL_PASSWORD: myaac
+        ports:
+          - 3306/tcp
+        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: [ '8.1', '8.2', '8.3', '8.4' ]
+        ots: ['tfs-1.4', 'canary-3.1.2'] # TODO: add 'tfs-master' (actually doesn't work cause AAC doesn't support reading .env configuration)
+    name: Cypress (PHP ${{ matrix.php-versions }}, ${{ matrix.ots }})
+    steps:
+        - name: 📌 MySQL Start & init & show db
+          run: |
+            sudo /etc/init.d/mysql start
+            mysql -e 'CREATE DATABASE myaac;' -uroot -proot
+            mysql -e "SHOW DATABASES" -uroot -proot
+
+        - name: Checkout MyAAC
+          uses: actions/checkout@v4
+          with:
+            ref: main
+
+        - uses: actions/setup-node@v4
+          with:
+            node-version: 18
+        - run: npm ci
+
+        - name: Checkout TFS
+          uses: actions/checkout@v4
+          if: matrix.ots == 'tfs-1.4'
+          with:
+            repository: otland/forgottenserver
+            ref: 1.4
+            path: ots
+
+        - name: Checkout TFS
+          uses: actions/checkout@v4
+          if: matrix.ots == 'tfs-master'
+          with:
+            repository: otland/forgottenserver
+            ref: master
+            path: ots
+
+        - name: Checkout Canary
+          uses: actions/checkout@v4
+          if: matrix.ots == 'canary-3.1.2'
+          with:
+            repository: opentibiabr/canary
+            ref: v3.1.2
+            path: ots
+
+        - name: Import OTS Schema
+          run: |
+              mysql -uroot -proot myaac < ots/schema.sql
+
+        - name: Rename config.lua
+          run: mv ots/config.lua.dist ots/config.lua
+
+        - name: Replace mysqlUser (TFS 1.4)
+          uses: jacobtomlinson/gha-find-replace@v3
+          if: matrix.ots == 'tfs-1.4'
+          with:
+            find: 'mysqlUser = "forgottenserver"'
+            replace: 'mysqlUser = "root"'
+            regex: false
+            include: 'ots/config.lua'
+
+        - name: Replace mysqlPass (TFS 1.4)
+          uses: jacobtomlinson/gha-find-replace@v3
+          if: matrix.ots == 'tfs-1.4'
+          with:
+              find: 'mysqlPass = ""'
+              replace: 'mysqlPass = "root"'
+              regex: false
+              include: 'ots/config.lua'
+
+        - name: Replace mysqlDatabase (TFS 1.4)
+          uses: jacobtomlinson/gha-find-replace@v3
+          if: matrix.ots == 'tfs-1.4'
+          with:
+              find: 'mysqlDatabase = "forgottenserver"'
+              replace: 'mysqlDatabase = "myaac"'
+              regex: false
+              include: 'ots/config.lua'
+
+        - name: Replace mysqlDatabase (Canary)
+          uses: jacobtomlinson/gha-find-replace@v3
+          if: matrix.ots == 'canary-3.1.2'
+          with:
+              find: 'mysqlDatabase = "otservbr-global"'
+              replace: 'mysqlDatabase = "myaac"'
+              regex: false
+              include: 'ots/config.lua'
+
+        - name: Setup PHP
+          uses: shivammathur/setup-php@v2
+          with:
+            php-version: ${{ matrix.php-versions }}
+            extensions: mbstring, dom, fileinfo, mysql, json, xml, pdo, pdo_mysql
+
+        - name: Get composer cache directory
+          id: composer-cache
+          run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+        - name: Cache composer dependencies
+          uses: actions/cache@v4
+          with:
+            path: ${{ steps.composer-cache.outputs.dir }}
+            # Use composer.json for key, if composer.lock is not committed.
+            key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+            #key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+            restore-keys: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+
+        - name: Install Composer dependencies
+          run: composer install --no-progress --prefer-dist --optimize-autoloader
+
+        - name: Run PHP server
+          run: nohup php -S localhost:8080 > php.log 2>&1 &
+
+        - name: Cypress Run
+          uses: cypress-io/github-action@v6
+          env:
+            CYPRESS_URL: http://localhost:8080
+            CYPRESS_SERVER_PATH: /home/runner/work/myaac/myaac/ots
+
+        - name: Save screenshots
+          uses: actions/upload-artifact@v4
+          if: always()
+          with:
+            name: cypress-screenshots-${{ matrix.php-versions }}-${{ matrix.ots }}
+            path: cypress/screenshots
+            if-no-files-found: ignore
+
+        - name: Upload Cypress Videos
+          uses: actions/upload-artifact@v4
+          if: always()
+          with:
+            name: cypress-videos-${{ matrix.php-versions }}-${{ matrix.ots }}
+            path: cypress/videos
+            if-no-files-found: ignore
+
+        - name: Upload PHP Logs
+          uses: actions/upload-artifact@v4
+          if: always()
+          with:
+            name: php-log-${{ matrix.php-versions }}-${{ matrix.ots }}
+            path: php.log

.github/workflows/phplint.yml

@@ -1,16 +1,16 @@
 name: PHP Linting
 on:
   pull_request:
-    branches: [master]
+    branches: [main]
   push:
-    branches: [master]
+    branches: [main]
 
 jobs:
   phplint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: overtrue/phplint@3.4.0
+      - uses: overtrue/phplint@8.2
         with:
           path: .
-          options: --exclude="system/libs/polyfill-mbstring/bootstrap80.php"
+          options: --exclude=*.log

.github/workflows/phpstan.yml

@@ -0,0 +1,46 @@
+name: "PHPStan"
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  tests:
+    name: PhpStan on PHP ${{ matrix.php-versions }}
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: [ '8.1', '8.2', '8.3', '8.4' ]
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@v4"
+
+      - name: "Install PHP"
+        uses: "shivammathur/setup-php@v2"
+        with:
+          coverage: "none"
+          extensions: "intl, zip"
+          ini-values: "memory_limit=-1"
+          php-version: "${{ matrix.php-version }}"
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+
+      - name: "Install composer dependencies"
+        run: "composer install"
+
+      - name: "Run PHPStan"
+        run: "/usr/bin/php vendor/bin/phpstan analyse"

.gitignore

@@ -4,10 +4,10 @@ Thumbs.db
 
 #
 /.htaccess
-lua
+/lua
 
 # composer
-composer.lock
+composer.phar
 vendor
 
 # npm
@@ -24,6 +24,7 @@ releases
 tmp
 
 config.local.php
+config2.local.php
 
 # all custom templates
 templates/*
@@ -50,10 +51,7 @@ system/cache/*
 !system/cache/twig/index.html
 !system/cache/signatures/index.html
 !system/cache/plugins/index.html
-
-# php sessions
-system/php_sessions/*
-!system/php_sessions/index.html
+!system/cache/persistent/index.html
 
 # logs
 system/logs/*
@@ -63,6 +61,10 @@ system/logs/*
 system/data/*
 !system/data/index.html
 
+# php sessions
+system/php_sessions/*
+!system/php_sessions/index.html
+
 # plugins
 plugins/*
 !plugins/.htaccess
@@ -73,5 +75,5 @@ plugins/*
 !plugins/email-confirmed-reward
 landing
 
-# others/rest
-system/pages/downloads.php
+# system
+system/functions_custom.php

.htaccess.dist

@@ -6,12 +6,14 @@
 	Options -MultiViews
 </IfModule>
 
+<FilesMatch "^(.*\.md|.*\.json|.*\.dist|.*\.sql|CHANGELOG|README|composer\.lock)$">
+	Require all denied
+</FilesMatch>
+
 <IfModule mod_rewrite.c>
 	RewriteEngine On
 
-	# you can put here your myaac root folder
-	# path relative to web root
-    #RewriteBase /myaac/
+	#RewriteBase /myaac/
 
 	RewriteCond %{REQUEST_FILENAME} !-f
 	RewriteCond %{REQUEST_FILENAME} !-d

.travis.yml

@@ -1,20 +0,0 @@
-
-language: php
-php:
-  - 5.6
-  - 7.0
-  - 7.1
-  - 7.2
-  - 7.3
-  - 7.4
-  - 8.0
-
-cache:
-  directories:
-    - $HOME/.composer/cache
-
-before_script:
-  - composer require php-parallel-lint/php-parallel-lint --no-suggest --no-progress --no-interaction --no-ansi --quiet --optimize-autoloader
-
-script:
-  - php vendor/bin/parallel-lint --no-progress --no-colors --exclude vendor --exclude "system/libs/pot/OTS_DB_PDOQuery_PHP71.php" .

CHANGELOG-1.x.md

@@ -0,0 +1,456 @@
+# Changelog
+
+## [1.8.4 - 27.10.2025]
+
+### Changed
+* Reimport myaac_ tables on every install, this fixes errors when one table is missing or is duplicated (https://github.com/slawkens/myaac/commit/2580edadf84779f09fd395c21f92019b2c762f83)
+* Use custom env init on migrate, migrate:run and migrate:to (https://github.com/slawkens/myaac/commit/13ea68cc0c9349380c8e4051d702a6c2c8256f44, https://github.com/slawkens/myaac/commit/07fd034fe4cb0ffdb88667b1e400f414d0c6d06f)
+
+### Fixed
+* Show if there is mysql error on import schema (https://github.com/slawkens/myaac/commit/44110a9496b4385e42c31b75de301037e711b6c3)
+* Fix the premium checks, introduced in v1.8.3 (https://github.com/slawkens/myaac/commit/9d92a11fb7cb6d7a1619d79c12faaa0b1c01f980)
+
+## [1.8.3 - 21.10.2025]
+
+### Added
+* Feature: resend email verify (https://github.com/slawkens/myaac/commit/fe821c58085483e70491dcf76376ad5b96de3fdd)
+* New config: hooks_debug (To view where hooks are located in .twig files) (https://github.com/slawkens/myaac/commit/8c3cb0e06f9709c1de3398b48221241e7cbdd310)
+* Functions: Add db->getColumnInfo(table, column) (https://github.com/slawkens/myaac/commit/c898fe25efff6793a01d11c26fc153cb23fcb858)
+* Plugins: Add option to use ?subtopic=x for plugins pages (https://github.com/slawkens/myaac/commit/97f9d3d6f6c28aef6d824973058d7133f56e09c4)
+* getTopPlayers() Function - Add lookmount & promotion (https://github.com/slawkens/myaac/commit/2da0024c68f1cedc38a16ebbc6f52ffa55e65f7a, https://github.com/slawkens/myaac/commit/901df48d134079d648a18f9d82b60182e818ac02)
+* New hooks for account/change-password (https://github.com/slawkens/myaac/commit/470555f2687809a0c12491bbb27597e64b8929c1)
+
+### Changed
+* Feature: show vip days in account management (https://github.com/slawkens/myaac/commit/c88b08eb1ec1f560cbfdaaa16b24e3a0f26da7b3, by @andreoam)
+* Allow links in error_box.html.twig (https://github.com/slawkens/myaac/commit/9acad15451071639acf7a7d4e81619b0a9742b12)
+* Canary - Comment code to update lastday in login.php (https://github.com/slawkens/myaac/commit/38902c30d114fdbce259467f5820f97037b393e9)
+* Cache::remember $ttl = -1 = infinite (https://github.com/slawkens/myaac/commit/64acf70d3854182d88aaf0b67f77cea2a254f179)
+
+### Fixed
+* Online - Allow for html code (example - img) in online_datacenter (https://github.com/slawkens/myaac/commit/3bb272ebbbd2eb7769d174b7082061d14a17bd44)
+* Guilds - Fix guild create with freePremium enabled (https://github.com/slawkens/myaac/commit/c91bb5d4097647dca2196d3dea87bc90c89181d2)
+* Canary - Fix premDays count (https://github.com/slawkens/myaac/commit/3e61692780d4add93b7b0e9f12f7a283bd8f4b7a)
+* Template Change: Ignore set last visit for AJAX pages - Fixes template change redirect (https://github.com/slawkens/myaac/commit/89fae38caa7e4f645957fcf1a9330a36358ac04f)
+* Admin Panel - Accounts: Fix lastip v6 (TFS master) (https://github.com/slawkens/myaac/commit/f54b1bdd2af4c16c64ddff0e87a6c96bc4cf9eeb)
+* Functions - Prevent injection in $db->hasColumn (https://github.com/slawkens/myaac/commit/56bd7ec5ed904666074492f2e4f13e4fce226bee)
+* Compat Config: Add missing config: email_lai_sec_interval (https://github.com/slawkens/myaac/commit/2eae44e0755e624a91be68b4d1ec26d01eb4d9a1)
+
+## [1.8.2 - 26.09.2025]
+
+### Added
+* Routes: Possibility to override routes with plugins pages, like characters.php - No need to define routes in plugin.json anymore (https://github.com/slawkens/myaac/commit/3f24f961b1cdeff5c60387e837ae454448bc5e1b)
+
+### Changed
+* Style: Better look for myaac-table (https://github.com/slawkens/myaac/commit/a6032093b21e5bb3f0e75d2704da87d6dea6469d, https://github.com/slawkens/myaac/commit/5aa9bbf1c8e580d973ec82ac012489f8e7bc437e)
+
+### Fixed
+* Install: Fix when config.local.php cannot be saved (https://github.com/slawkens/myaac/commit/4eab805d26d8c5562b29ed699769919d77dabced)
+* Create Account: Fix an exception when email cannot be sent (https://github.com/slawkens/myaac/commit/d0112d1a67e8b854b65ad131f0375b79305df8d3)
+* Login Page: Add missing csrf() - fix create account button (https://github.com/slawkens/myaac/commit/3c0cb53e17dd0b85394cfa0fdc9cf9ad8d4551df)
+* tibiacom template: Fix account lost menu (https://github.com/slawkens/myaac/commit/ed9beaf2b6ca069e304e569c52e5b9188b58f05c)
+* tibiacom template: Fix Menu div wrong tag/closing (#329) (https://github.com/slawkens/myaac/commit/85e7005fd3f0be51466151a3c122b96085fdfe68)
+* tibiacom template: Replace firstChild with firstElementChild (Thanks to @un000000) (https://github.com/slawkens/myaac/commit/df7b6e29fb8875da97f431468c81ee99116271d9)
+
+## [1.8.1 - 05.09.2025]
+
+### Added
+* New Commands: plugin:enable/disable/uninstall {plugin-name} (https://github.com/slawkens/myaac/commit/7a08f91d3fc0897c1ff76089ef3c649a2c6d2003, https://github.com/slawkens/myaac/commit/fec773ba4b740f35c0a3ef92ca8444a4c7d02082)
+* Gifts: Added Transferable Coins to the store dropdown menu in the admin area (by @andreoam, #321) (https://github.com/slawkens/myaac/commit/42671c5c199dd9e91c774d8c9d30da9e12f1b695)
+
+### Changed
+* Commands: Allow settings to be changed/reset by plugin name (https://github.com/slawkens/myaac/commit/f8c4332e03e838d285ea0afb4b72b7c23e324d45, https://github.com/slawkens/myaac/commit/4b948e9510f7ba69d00f84d7fdaea8b3bf05b630)
+* Templates: Menus should be saved for each template separately (https://github.com/slawkens/myaac/commit/482f4067b2a2e7513d9ba214274a361ffaf123d8)
+
+### Fixed
+* Online: Fix skulls display (#320) (https://github.com/slawkens/myaac/commit/98073a110ae13f9592ec9d2c4d1d1aace87587a9)
+* Online: Fix if there is no world_id in the server_record table (https://github.com/slawkens/myaac/commit/b6e1620f14c20eecfc9001a7d86dfb67942985c6) (Reported by @gesior in #318)
+* tibiacom: some fixes to menus (https://github.com/slawkens/myaac/commit/20f99903ae80c74ad66c1cf5a5ea8d0b0fc2fd70, https://github.com/slawkens/myaac/commit/11dae90fa94fbbf47447017db5e5847c33d6aadf)
+* Guilds: Fix for some servers that don't have guild_invites table (https://github.com/slawkens/myaac/commit/9725a3c2bdb7003f5cb48febb77604c31a9b805b)
+
+## [1.8 - 02.08.2025]
+
+### Added
+* Templates - Kathrine: Possibility to add custom menu categories (https://github.com/slawkens/myaac/commit/ec11c1402417c25980582467546d1c1e9bb8267f)
+* Admin Panel - Accounts Editor: Add Coins Transferable (https://github.com/slawkens/myaac/commit/45d6047031c9c3a0e7e512dc5d15c75629aec5a2, https://github.com/slawkens/myaac/commit/bb097b69ce106500a49686d6f4fe604348eaa310)
+* Highscores:
+  * Revamped: (https://github.com/slawkens/myaac/commit/d8132d4d76e03d5aa0c042be426320655a601392)
+    * Show real rank, if 2 or more players have the same skill, show them with same rank
+    * New setting: highscores_online_status
+    * Additional fields passed to twig: updatedAt, totalResults, page, baseLink
+  * Add new Setting: Display Skills Box (https://github.com/slawkens/myaac/commit/36ca755243ef1c83f6ac87465b426d4d8d3b0bb9)
+* Functions: Add getExperienceForLevel (level) (https://github.com/slawkens/myaac/commit/1566deb84a082176b8c683fda205d828bc38fbcc)
+* Commands - cache:clear : Add warning about APCu clear in CLI (https://github.com/slawkens/myaac/commit/83f84172e02e8ea2ccb6dca29bc033e44c35aebc)
+* Models - PlayerOnline: Add missing $fillable into model (https://github.com/slawkens/myaac/commit/43415cf35db1c1307f2684c1728693d65065ffff)
+* Twig: add cache variable (https://github.com/slawkens/myaac/commit/0efe47ce71c4b364a9e96bc5a55b1655326ae6da)
+
+### Changed
+* pages/online: add cache, resulting in 20x performance boost
+  * (for an example server with 2k players) (https://github.com/slawkens/myaac/commit/c8363086015cbb6e8786c398c7b9ac3959a26ec4)
+* Admin Bar: Move admin bar code into body_start place_holder (https://github.com/slawkens/myaac/commit/f17269e44ce9dd38447bd2e2a8e1bdb065d4161f)
+* Cache::remember: $ttl = 0 means no cache (https://github.com/slawkens/myaac/commit/3b47e9df2f4051807c5ff87892f7fa3d348f9c55)
+* Templates: Load config.ini with $process_sections set to true (https://github.com/slawkens/myaac/commit/a89f9a84847630eb75b4890fdcc8b7a7bfa6b8ac)
+* Twig: Allow for timestamp as integer in the timeago twig function
+  (https://github.com/slawkens/myaac/commit/34fead906ea13b9f09d7a3c41ed88109d34d386c)
+
+### Fixed
+* Settings: Fixed two exceptions (https://github.com/slawkens/myaac/commit/6e5a4ff8c78ff5373aba091baa66cae029557643, https://github.com/slawkens/myaac/commit/20d69a641c0a933d14889a89da6d32f6a4bc6c7d)
+* Models\Account + OTS_Account -> isPremium -> ignore config.freePremium (https://github.com/slawkens/myaac/commit/5271633bdbfbbfed0b1d59c403093ce6fc2b7d20)
+* Admin Panel - Mailer:
+  * Fix send to email link redirecting from accounts page (https://github.com/slawkens/myaac/commit/080cc2781f034c844af658229e495e9a47fd2298)
+  * Option to send only to verified accounts - only if setting('core.account_mail_verify') enabled (https://github.com/slawkens/myaac/commit/cf7fd20452e863980045bb5d6012ec86c6e8e01f)
+
+### Internal
+* Rewrite to use constants (account transferable coins) (https://github.com/slawkens/myaac/commit/bccf8e056df985bbe1bab5f7ab5492f714d6b62b)
+* Refactor to use HAS_ACCOUNT_COINS (https://github.com/slawkens/myaac/commit/caf326a6584a234775ebc6c8000ea02b3fecd160)
+
+## [1.7.1 - 27.06.2025]
+
+### Changed
+* Rename plugin:install:install to plugin:setup, also add alias to previous command (https://github.com/slawkens/myaac/commit/13d33822b59df349199e885a78a3d6beb0863d0b)
+
+### Fixed
+* Fix commands: setup + cache:clear (https://github.com/slawkens/myaac/commit/0da524fefe93b3028392e9014550eea3324d3a22, https://github.com/slawkens/myaac/commit/fe8281594e989f00280ba1adc734a9198c6b5cc1)
+* Fix polls link in tibiacom template (https://github.com/slawkens/myaac/commit/d90fa323d7c77d81768df60feeb1c374b1650a0c)
+
+## [1.7 - 22.06.2025]
+
+### Added
+* Feature: plugins versions check (#310)
+* New hooks: HOOK_ACCOUNT_MANAGE_AFTER_CHARACTERS, HOOK_GUILDS_AFTER_MANAGE_BUTTON (https://github.com/slawkens/myaac/commit/c074a48f245df55646b6705737f667b6a84149b2, https://github.com/slawkens/myaac/commit/e6100a1b72de8695bba1dae9ba4e28bfdce47b10)
+* Add OTS_Toolbox::getVocationName(id, promotion) + OTS_Player->isNameLocked() (https://github.com/slawkens/myaac/commit/e222957893c4a1de0dc8dbba55bce1a43418d275, https://github.com/slawkens/myaac/commit/522f6c11d835afd36fd07a07074d96d7e219b488)
+* Add missing csrf in more places, causing white page with error about Request (https://github.com/slawkens/myaac/commit/dca904e61d21d856bf809070e7652803a2df0f58, https://github.com/slawkens/myaac/commit/c720ccc451ff90ef40b2a1595468d061ffd7e1e4)
+
+### Changed
+* Revamped online page (https://github.com/slawkens/myaac/commit/9a90e4aae280e607430511c6727d9a714b11f4c5, https://github.com/slawkens/myaac/commit/4767120043b09141870383e249f3729638d53dc2)
+* Better $title inventing (https://github.com/slawkens/myaac/commit/0c95bcfd06b68b21512e477646ef7bd3a0d4912b)
+
+### Fixed
+* Use apcu cache clear (https://github.com/slawkens/myaac/commit/b329da52aae9d0e21120a6444d3caf442420ce50, https://github.com/slawkens/myaac/commit/566c2a9151ab6392286f74e26853faa19a1b4f24)
+* fix: boostedcreatures for 13.40 (by @GooseWithAKnife) (#307)
+
+## [1.6.1 - 11.06.2025]
+
+### Fixed
+* Fixed "Request has been cancelled due to security reasons", cause of missing csrf() in twig files (https://github.com/slawkens/myaac/commit/10cd71a6630ffec91b43a26a6d685b66c5836a6a)
+* Fix: Ignore duplicated route exception (https://github.com/slawkens/myaac/commit/9d8e9d27bd87167d8d4005942a6af62bfe4c0892)
+
+### Changed
+* Move counter & visitors code before router (In case someone wants to include that info on page) (https://github.com/slawkens/myaac/commit/f78285030708ad3c74ab048711f73bbf3ee5281e)
+* Set TinyMCE license key to gpl (Avoid warning message in browser console) (https://github.com/slawkens/myaac/commit/8d29fdb98b92dbc3d2853ef88a185c67036b4a77)
+
+### Removed
+* Remove deprecated TinyMCE plugin - template (https://github.com/slawkens/myaac/commit/309c1fb715b882e67cb673b1544a03befbf64a22)
+
+## [1.6 - 03.06.2025]
+
+### Added
+* Add new setting/configurable: site_url, prevents domain spoofing (https://github.com/slawkens/myaac/commit/d8a6090be382c35c19117cfef964b594ed02b8d4)
+* Add new account coins setting (https://github.com/slawkens/myaac/commit/28886551e86fe562172c4c7f2afb89a2e7672c2e)
+* autoload: settings/install/init.php (https://github.com/slawkens/myaac/commit/e5749437074c3b3556628a2aeb5bad2edf97bde0, https://github.com/slawkens/myaac/commit/7d213f479a7e40c6254069b5fc4e578dc32bf8d9, https://github.com/slawkens/myaac/commit/207d6bc69120aba1af2b51808f17e0059b571fed)
+* Protect against csrf in more places (accounts & guilds & forums pages) (https://github.com/slawkens/myaac/commit/6eda38603c8ed7e99b92a78a4600b1245377f74d, https://github.com/slawkens/myaac/commit/e776bd52beb3064a9e694efd1b9021ec972ee2f6, https://github.com/slawkens/myaac/commit/84d502bf105f2a789481fba1acc820d236b4de66)
+* Added two new hooks for pages loaded from database (custom pages): HOOK_BEFORE_PAGE_CUSTOM, HOOK_AFTER_PAGE_CUSTOM (https://github.com/slawkens/myaac/commit/c961a1ebf837f2ab1734a825ff2c57b4937610c9)
+* Add global variables into $hooks->executeFilter (https://github.com/slawkens/myaac/commit/8fdea943768b20193eede99d60313ee84511a0be)
+* Add getNPCsCount() to OTS_InfoRespond (https://github.com/slawkens/myaac/commit/7d435ff6433ef1fb2295ee79ed043ee10dc725e9)
+
+### Fixed
+* Allow [] in character name (https://github.com/slawkens/myaac/commit/de6603a51347b9e656c58637ed9971fffdd7cedd)
+* Do not allow access to tools/ folder after install (https://github.com/slawkens/myaac/commit/6e0f5913831f8dba69fd2d1505be3e2a303c6324)
+* Fix CHANGELOG-1.x.md loading in admin panel (https://github.com/slawkens/myaac/commit/4a30fb495dbfbe1d434e8d52419eaf44fe517aee)
+* Fix links not working in admin dashboard modules (https://github.com/slawkens/myaac/commit/be7b27c31aa3bbd6c0289c34d1e61139a3fe015c)
+* Fix twig variables: logged + account_logged being not set directly after login (https://github.com/slawkens/myaac/commit/1e9b10d6489c488cadf7f6ed17b42f1ea6c767a8)
+
+### Changed
+* OTS_ServerInfo -> move setTimeout out of class - Possibility to use the class without MyAAC (https://github.com/slawkens/myaac/commit/40d65a6613149fda51bdceb82c807e5301a3388b)
+
+## [1.5 - 14.05.2025]
+
+### Added
+* Feature/twig hooks filters (#258)
+* Add latest client versions (14.00 - 15.01) (https://github.com/slawkens/myaac/commit/5367df23812c6182863353c9a39fd7fb0b743f4b)
+* db variable to twig (https://github.com/slawkens/myaac/commit/5ed1aec28e146b871a75597411d12e42a067f4e6)
+* New filter: HOOK_FILTER_ROUTES (https://github.com/slawkens/myaac/commit/9b75011224f385db8b27e109bfeb28e75b9d779c)
+* Allow optionally separate folder for views (thanks @Scrollog for idea) (https://github.com/slawkens/myaac/commit/03e275213901a89edb0ebb8974b776a992ab391f)
+* Add float & double types to the Settings (https://github.com/slawkens/myaac/commit/67ab425bb9796d9d123296e3fda542fa8f7f05ee)
+* Add optional param _page_only for single-page apps etc. (https://github.com/slawkens/myaac/commit/113473f2560aab6d364c301cc14a8b5ba8f309f4)
+
+### Changed
+* Change OTS_Account->getPremDays to not return -1 in case of freePremium (https://github.com/slawkens/myaac/commit/3befde2a1e4d24a011311e785f15185db57e19b8)
+* Add note about highscores being updated x minutes + allow ttl 0 to disable cache (https://github.com/slawkens/myaac/commit/a161cff00329da6f970f3a70967fe8346fe92bbc)
+* Better monster images (no image not found anymore) + use cache (https://github.com/slawkens/myaac/commit/73a5829974ceca3f02d7925d5cfbd5fa50b1bbd2)
+* Rename server-info -> ots-info, changelog -> change-log (Due to conflict with apache2 server-info mod) (https://github.com/slawkens/myaac/commit/3949d84e5d7631f332111b6d00278bddbd0ad10a)
+* Move rules page to admin panel (https://github.com/slawkens/myaac/commit/3949d84e5d7631f332111b6d00278bddbd0ad10a)
+
+### Fixed
+* php 8.4 warnings
+* Visitors counter not working properly on dev mode (https://github.com/slawkens/myaac/commit/da151051186c913dd0dd091aabe893649c2b9ee7)
+* Fix login.php boosted creature & boss (not sure exact version, but should be 14.12 or around) (https://github.com/slawkens/myaac/commit/c48b8006319f6c3b5f082befd16785420bb98110)
+* Fix installMenus when theme/template was removed from disc (https://github.com/slawkens/myaac/commit/c24c580796bccd54bf9e95b864763f4642684d55)
+* Fix if user removes the menu category (https://github.com/slawkens/myaac/commit/dbea69f31478391dacfbbc02c8353c39b4245daf)
+
+### Updated:
+* Update cypress from version ^13.17.0 to ^14.3.3 (https://github.com/slawkens/myaac/commit/629fd18ea166860d5898a822f44f9277da6ce43d)
+
+## [1.4 - 22.04.2025]
+
+### Added
+* feat: admin-pages (can add admin pages through plugins) (https://github.com/slawkens/myaac/commit/ceaa0639e66d31e8177ff90791463470367aa45d)
+	* just place the page in admin-pages folder in the plugin
+	* Also, possibility to overwrite default myaac admin pages
+* Add db->hasTableAndColumns(table, columns), credits to @opentibiabr Team (https://github.com/slawkens/myaac/commit/82a533d88c8a342076891d132b4b409ed9a1fe72)
+* Add noSubmit option to buttons.base (https://github.com/slawkens/myaac/commit/64f6d3abcada3bf9fd7599f50d2fac0a1367f383)
+
+### Fixed
+* Fix: display 404 error instead of 500 when page has been removed from filesystem (https://github.com/slawkens/myaac/commit/c2bf94fb2370d2009a2eb907f818955132cf8611)
+* Fix headline.php: change image format to .png cause of black background (https://github.com/slawkens/myaac/commit/b618084d50918539d9a70abd97e764137b966067)
+* Clear cache on plugin enable/disable, fixes some issues with plugin pages being cached (https://github.com/slawkens/myaac/commit/1d0c173e7d000aecbd432800941fc3e38a0e50f2)
+* Do not autoload sub-folders if autoload pages is disabled (https://github.com/slawkens/myaac/commit/d47195a7878095336f9c9edc6f96244257f67eec)
+
+### Changed
+* SQL Syntax Standardization (by @JoaozinhoBrasil, #298)
+* Pages in theme/template folder will now have precedence over normal pages (https://github.com/slawkens/myaac/commit/6d8f4718a1d349fba8f0ebc39cfd3a1a84d104b0)
+* Small changes in account.login.html.twig (https://github.com/slawkens/myaac/commit/f40b986b59d4c8fa89ab4745731bf366f8619976)
+* Plugin name is required, version is optional (https://github.com/slawkens/myaac/commit/e6f05a2731c61d931be49e121c068e49c0ad5e01)
+
+## [1.3.3 - 04.04.2025]
+
+### Fixed
+* Fix uninstall plugin when plugin is disabled (https://github.com/slawkens/myaac/commit/6c568fd36a271270684fc412ccd556b230273a6d)
+
+### Changed
+* Display more useful info when error parsing config.lua (https://github.com/slawkens/myaac/commit/fa6b6aa153ffc131e0d1631a4dcd9012a5850c2e)
+
+### Other
+* Small adjustments (https://github.com/slawkens/myaac/commit/35e2483de86e295bdf089cceffa25842eeb2e34c, https://github.com/slawkens/myaac/commit/ae639d65b0bfa491e747e907e2ebc77f83f47981)
+
+## [1.3.2 - 01.04.2025]
+
+### Fixed
+* Fix debugBar/admin panel menu when using custom base_dir (https://github.com/slawkens/myaac/commit/65696f63e3aac02ff952ea81279e7cb2fa7570fb)
+
+### Changed
+* Settings: Show/hide IP Ban Protection options depending on the value (enabled/disabled) (https://github.com/slawkens/myaac/commit/dbf73d0b61b45601ae95e51b23c051c2704169c5)
+* Do not require init.php in cache:clear command (https://github.com/slawkens/myaac/commit/d25c71857f767834239bbffacd00fdc671adb157)
+
+## [1.3.1 - 19.03.2025]
+
+### Fixed
+* Fixed migrate:run command (https://github.com/slawkens/myaac/commit/1a5771ad51e595fe13368a0721b059c4ecefb17d)
+
+### Changed
+* Small adjustments (https://github.com/slawkens/myaac/commit/6fac883659f581baac1361826d046410156f1e58, https://github.com/slawkens/myaac/commit/4a6896b4469968b9904292734cf6c14ba5eeef14)
+
+## [1.3 - 10.03.2025]
+
+### Changed
+* Use latest outfit-images host from @gesior (https://github.com/slawkens/myaac/commit/529bdcf016dd0f9dffbc34d81f99a046a9ddb70d)
+* Change monster link to $_GET ?name= (https://github.com/slawkens/myaac/commit/4c5cc8b573b2b3e7ec00a22b7ede30a68083a924)
+
+### Fixed
+* Fixed house links (https://github.com/slawkens/myaac/commit/887b5068ad11c4cdab614afd34525caba785ce13)
+* Fixed long title on headline.php (https://github.com/slawkens/myaac/commit/3e3f4bb5a514158ec8777684ca6c7f1c2a37bed5)
+* Fixed menu colors once again, plus add !important tag (https://github.com/slawkens/myaac/commit/aa52df6e2ec92cafc25b655ae907bf2e1746d9cc)
+* Fix: add possibility to remove all menu items in admin panel (https://github.com/slawkens/myaac/commit/00fe1adc15ea7646596d755f6e6e1f7854ffc1d5, https://github.com/slawkens/myaac/commit/9239a4f4198c3ad260802ac3b47e9c41b80b754e)
+
+## [1.2 - 09.02.2025]
+
+### Added
+* Twig session(key) function + reworked session functions to accept multi-array like in Laravel (https://github.com/slawkens/myaac/commit/b46ddb43d03ef7e5fc34e555e92e856bdc905691)
+* add template_name to twig variables (https://github.com/slawkens/myaac/commit/ae1161d77050bda181802b4496c9de920a7bb1bc)
+* add HOOK_INIT, executed just after $hooks are loaded (https://github.com/slawkens/myaac/commit/19686725dc810f63a07f049f82c66cf336d90ca6)
+
+### Changed
+* settings: password input hide/show, enable Save button only if changes has been made, save settings in transaction (https://github.com/slawkens/myaac/commit/4fda4f643b60a151179e5dd4f04912fb2618d98f, https://github.com/slawkens/myaac/commit/28fef952f857b79d64bc7495ffa5e1999e68e192, https://github.com/slawkens/myaac/commit/4b6024dc451accadb6c469fa282a9a764c1c0a81)
+* rework menus: Different categories can have different colors + Option to reset menus (https://github.com/slawkens/myaac/commit/73de93a561f6b13111e019075724357d8a617249, https://github.com/slawkens/myaac/commit/3da3e62c5b12390d75de9b3320729bcca6e0b458)
+
+### Fixed
+* highscores: Fix online status + vocation for TFS 0.x (https://github.com/slawkens/myaac/commit/ea51ad27c38be88d86514cb979bb394fcfbef1f0)
+* clear cache button in admin bar needed to be clicked twice until it worked (https://github.com/slawkens/myaac/commit/ea51ad27c38be88d86514cb979bb394fcfbef1f0)
+* HOOK_STARTUP location (https://github.com/slawkens/myaac/commit/a73fb1003ee3f812cf182d1834d65f08e6f60d1f)
+* if vocation name has more words (https://github.com/slawkens/myaac/commit/9d7fc98e1e0a96b59ecc1a7c39800a64445db364)
+
+### Updated
+* Bump twig/twig from 3.18.0 to 3.19.0 (#284)
+
+## [1.1 - 27.01.2025]
+
+### Changed
+* adjust mailer settings descriptions to latest gmail (https://github.com/slawkens/myaac/commit/c5d5bb80671db135e6b503f53684771c7272e05d)
+* optimize $player->isOnline() function, thanks @gesior (https://github.com/slawkens/myaac/commit/10dd818b139d5e1bb1ca9ec81edfb083ba9316b4)
+* make players.comment and guilds.description VARCHAR (https://github.com/slawkens/myaac/commit/a45ceab83a74bee2b89cdb72baceda75e577e3cf)
+* add lua/ folder to .gitignore (https://github.com/slawkens/myaac/commit/07012f786b1114cb6ab2f064f82c645b136a375a)
+
+### Fixed
+* general fixes in the tibiacom template menus, better support for custom menus
+* make functions_custom.php optional (https://github.com/slawkens/myaac/commit/dc2b5afd9980984e2b259c9fc99f2ade46f70a5a)
+* error in CLI, where BASE_URL is not defined (https://github.com/slawkens/myaac/commit/4d749b881582f64b5a46196dbbb5ee8097127f03)
+* hook ACCOUNT_LOGIN_BEFORE_ACCOUNT location (https://github.com/slawkens/myaac/commit/669c447fca8643ce56d9ef8c1374ec647c780998)
+
+## [1.0.1 - 14.01.2025]
+
+### Fixed
+* tibiacom account & news menu links not auto expanding
+
+### Updated (Thanks dependabot)
+* twig from ^2.0 to ^3.11
+* tinymce from ^6.8.3 to ^7.2.0
+* cypress from ^12.12.0 to ^13.17.0
+* nesbot/carbon from 2.72.5 to 2.72.6
+
+## [1.0 - 12.01.2025]
+
+First stable release in the v1.0 series.
+
+Minimum PHP 8.1 is required.
+
+Changes since RC.2:
+
+### Added
+* feature: migrations up/down. Allows to downgrade/upgrade database to specified version (https://github.com/slawkens/myaac/commit/3f6ff3a3326b0475d28d11ffd7fff51f362d799f)
+* new hooks for news management (https://github.com/slawkens/myaac/commit/011a85d8ae34283ded6999882833f9d4797028ec, https://github.com/slawkens/myaac/commit/36bd3eb846e829b45313e10f7568dc4e95841143)
+* None Vocation to highscores (can be changed to RookStayer in Admin Panel) (https://github.com/slawkens/myaac/commit/a4a248099521bb5b8b2aa5bd592138debd2f19d5)
+* support for button_color (green, red, blue) (https://github.com/slawkens/myaac/commit/d8b6b749ee62e88b6af4a05d3d7557f90b94d94e)
+* add $whoopsHandler as variable, can be used by plugins (https://github.com/slawkens/myaac/commit/b0c8cf2ecda23045d725aaf43cfb3852ed766a4b)
+* PlayerModel->outfit_url attribute (https://github.com/slawkens/myaac/commit/3b5be1a8db5dceecaa388e2925a5536d13b38881)
+* support for selecting plugin themes in Admin menus.php (https://github.com/slawkens/myaac/commit/77a2c1cec343ffe4be5c2c2503ee81bc32a14ca1)
+
+### Changed
+* schema: Change character set to utf8mb4 (support for Emojis in Menus/Pages/News/Forum etc.) (https://github.com/slawkens/myaac/commit/27c44f1bdfb6234cf0c9d5b4b491123bb205b08f)
+* prefer get_browser_real_ip() over REMOTE_ADDR (https://github.com/slawkens/myaac/commit/941846605c00cee83168d2f916410b8ba8d4b7b9)
+* automatically set selected current one on highscores filters (https://github.com/slawkens/myaac/commit/e96227fbe41ae281783b2d49edb169a603601813)
+* rewrite towns loading code, removed OTBM loader (was too slow) (https://github.com/slawkens/myaac/commit/c980a0914632e7b27f718464f669a200707d217e)
+* allow OTS_Player to be passed as object to getPlayerLink (https://github.com/slawkens/myaac/commit/84d37c5a8f2c4535a41c8aa8264752969d3f3a3d)
+* do not clear menus by default on install (https://github.com/slawkens/myaac/commit/12d8faa3eda5e798f97b71e941c035187daad96e)
+* display warning in admin panel - plugins - if zip extension is not installed (https://github.com/slawkens/myaac/commit/e3ffe5d9e11d78ab064a370d8541bac351c9bcd9)
+* set default_socket_timeout for ipinfo.io checkup to 5 seconds (https://github.com/slawkens/myaac/commit/783d96fc6568a607d3198b832fed3a0dd06c4ebb)
+* refactor getTopPlayers function (support for balance) (https://github.com/slawkens/myaac/commit/c769962e39fe8dfb72ecd5be1864e145696be794)
+
+### Fixed
+* XSS in forum (https://github.com/slawkens/myaac/commit/c2b7286d20d4b579171540f7a774e8a0995d5e8f, https://github.com/slawkens/myaac/commit/8fb643596f9586005976e7bdb484a541a9d8715e)
+* price deducted when changing sex (https://github.com/slawkens/myaac/commit/16671ea40b72dcf74037c359ad572f9eb825edf9)
+* move_thread by unauthorized user (https://github.com/slawkens/myaac/commit/d6c40c836a53cb1710f911f77f45f28b54ea1b54, thanks @anyeor)
+* TFS 1.4.2 where conditions is NULL (https://github.com/slawkens/myaac/commit/b8396d4c8482e951da538b13f2296123732c4545)
+* do not show forum new thread show button if not logged in (https://github.com/slawkens/myaac/commit/507402171ba3b6e7ee184bd7fa73e0d55e0cad7a, @anyeor)
+* login if limiter is disabled (https://github.com/slawkens/myaac/commit/a0f1971583f0f790013e2145fb5ac573c59fbdef)
+* fixes to installMenus function (https://github.com/slawkens/myaac/commit/a2fadc5945fe0a5e39f740827f6ffbda1bb501e2)
+* many PHP exceptions in different places
+* fixes to tibiacom menus ActiveSubmenuItem
+
+### Removed
+* bugtracker SQL table code as the page has been removed/moved to plugins (https://github.com/slawkens/myaac/commit/5782772b901b05fb814bc718d062f6e2cd71df8c)
+
+## [1.0-RC.2 - 25.10.2024]
+
+Still waiting for your reports about bugs found in this release. We are very close to stable release.
+
+### Added
+* feat: rate limit settings for blocking accounts login attempts (@gpedro, #266)
+* search by email in accounts editor (https://github.com/slawkens/myaac/commit/c2ec46824621468f2a1cb4046805c485ed13fea5)
+* New hooks in account manage + create (https://github.com/slawkens/myaac/commit/93641fc68ac9a5f1479329e2bd41380c19534d5d)
+
+### Changed
+* chore: drop raw queries + accounts - search by email + accounts - required min size for search by account number (@gpedro, #266)
+* Use https for outfit & item images (https://github.com/slawkens/myaac/commit/71c00aa5e01fbdfd88802912e200dd1025976231)
+* Do not require players & guilds tables on install (https://github.com/slawkens/myaac/commit/779aa152fa940261c9b161533946f44e288597a2)
+* Do not create player if there is no players table in db (https://github.com/slawkens/myaac/commit/201f95caa8b70e88fa651eac8c3c3aa7cd765bd0)
+
+### Fixed
+* Highscore frags fixed for TFS 0.3 (@Scrollog, #263)
+* Missing groups variable #262. thanks, @Scrollog for reporting (https://github.com/slawkens/myaac/commit/8d8bdb6dac6df21672ac77288fff2f2f8d6eb665)
+* Verified email for login.php (@gpedro, #265)
+* Warning if core.account_country is disabled (https://github.com/slawkens/myaac/commit/ab73d60c61e14a1cacdb6cfbf7f89f4bf3be0833)
+
+
+## [1.0-RC.1 - 23.07.2024]
+
+Changes since 1.0-beta:
+
+### Added
+* Feat: Hooks priority (https://github.com/slawkens/myaac/commit/dc17b701da053e04bfa64e21be9247a4f07505e1)
+* Make autoload of pages, commands and themes configurable (https://github.com/slawkens/myaac/commit/c1d4b4f80cd6bb85507ee9471e47013955a26a91)
+* Fraggers in characters page for TFS 1.x and canary (https://github.com/slawkens/myaac/commit/42f99c3edc8de39cccc5632cb42e88b24579c5a6)
+* New hooks: HOOK_INSTALL_FINISH, HOOK_ACCOUNT_CREATE_CHARACTER_* (https://github.com/slawkens/myaac/commit/08ac8ebade106521a5c7396faa5ce7006e629f7c, https://github.com/slawkens/myaac/commit/45dda5e834ff2059faea6ef9be2efa76f1723cbd)
+
+### Changed
+* Allow account_create_character_create even if account_mail_verify is activated (https://github.com/slawkens/myaac/commit/203e411b626fe62401a4b74a48420769e512aa39)
+* Create guild_rank entries, in case MySQL trigger not loaded (https://github.com/slawkens/myaac/commit/d9c1b2507c81f306970642b35e4bf5f7cc04a6f2, https://github.com/slawkens/myaac/commit/47a19e85dd84e9f3b39a1b29cfc2c04b004832b9)
+* Set Admin Account verified by default (https://github.com/slawkens/myaac/commit/cd49dfc79942f3301ce9c0b8d899b9f39bda9a41)
+* Refactor account routes into sub folders (https://github.com/slawkens/myaac/commit/bdc0c43d3fd3a51030c3e916bdb9f008468f5ecd)
+* Order towns by id (https://github.com/slawkens/myaac/commit/9ea2a5067fc4b75de395f381577b18914132ad84)
+* Do not create news about myaac, if any news already exist (on installation (https://github.com/slawkens/myaac/commit/504242fb846b73b56b87bc1e39d070687ad7f5b4)
+
+### Fixed
+* Not working google recaptcha plugin (https://github.com/slawkens/myaac/commit/a1bcb217ecf4e21fd58da4ba491da1852029898a)
+* Not working account create if account_country is disabled (https://github.com/slawkens/myaac/commit/933b681a9fcdbb6283e0469b3806d2ded492d232)
+* Account verify - do not allow login without verified email (Thanks @anyeor, https://github.com/slawkens/myaac/commit/fcb13f3c0fb8ceafda0bd614a229a26a269432bd)
+* Detect tools/ext exists on install to prevent broken installs (https://github.com/slawkens/myaac/commit/10a739773c4f2911876bc802a0ee0537c3e00a92)
+* Cache reloading each time page refreshes (https://github.com/slawkens/myaac/commit/ec96985872057340112f65073efc0c4bf86dddb0)
+* Highscores frags for TFS 1.x and canary (https://github.com/slawkens/myaac/commit/a04d186c22912915f0a7873dfe677ef3b5a23c79)
+* Monsters page: monster not found exception (https://github.com/slawkens/myaac/commit/ef79b99b8acc179f14b8475547347d9daca27512)
+* Fixed bug if \<flags\> are not present in monster.xml (https://github.com/slawkens/myaac/commit/57b47ab7983f625c7c0ef4f5303a4d07ef172786)
+* fastRoute duplicate errors (https://github.com/slawkens/myaac/commit/4c0739d3e93812dff0c33849ea3f38e4e49113ac)
+* useGuildNick displaying (https://github.com/slawkens/myaac/commit/0db0ec1aa47e044c26bc403ff5078a2115d086f8)
+
+## [1.0-beta - 18.05.2024]
+
+Minimum PHP version for this release is 8.1.
+
+### Added
+* reworked Admin Panel (@Leesneaks, @gpedro, @slawkens)
+  * updated to Bootstrap v4
+  * new Menu
+  * new Dashboard: statistics, server status
+  * new Admin Bar showed on top when admin logged in
+  * new page: Server Data, to reload server data
+    * Towns, NPCs & Items are stored in permanent cache
+  * new pages: mass account & teleport tools
+  * changelogs editor
+  * revised Accounts & Players editors
+  * option to add/modify admin menus with plugins
+  * option to enable/disable plugins
+  * better, updated TinyMCE editor (v6.x)
+    * with option to upload images
+  * list of open source libraries used in project page
+* auto-loading of themes, commands & pages from plugins/ folder. You need just to place them in correct folder and they will be loaded automatically - this allows better customization, without interfering with core AAC folders. This will allow in the future automatic updates for plugins as well the AAC as whole.
+* config.php moved to Admin Panel -> Settings page
+* new console script: aac - using symfony/console
+  * usage: `php aac` (will list all commands by default)
+  * example: `php aac cache:clear`
+  * example: `php aac plugin:install theme-example.zip`
+* replace POT Query Builder to Eloquent ORM. Not 100% yet - in some places there is still old $db approach used (@gpedro) (https://github.com/slawkens/myaac/pull/230)
+* brand new charming installation page (by @fernandomatos)
+  * using Bootstrap
+* new pages router: nikic/fast-route, allowing for better customisation
+* Plugin cronjobs: central control of the cronjobs
+* Guild Wars support (available as plugin)
+* support for login and create account only by email (configurable)
+  * with no need for account name
+* Google ReCAPTCHA v3 support (available as plugin)
+* support for Account Number
+  * suggest account number option
+* many new functions, hooks and configurables
+* better Exception Handler (Whoops - https://github.com/filp/whoops)
+* automated website tests (using Cypress)
+* csrf protection (https://github.com/slawkens/myaac/pull/235)
+* option to restrict Page view to specified group of users (Not-Logged in, logged-in players, tutors, gamemasters etc.)
+* phpdebug bar (http://phpdebugbar.com/). Activated if env == 'dev', can be also activated in production by enabling "enable_debugbar" in local config
+
+### Changed
+* Composer and NPM is now used for external libraries like: Twig, PHPMailer, fast-route, jQuery, Bootstrap etc.
+* mail support is disabled on fresh install, can be manually enabled by user
+* disable add php pages in admin panel for security. Option to disable plugins upload
+* visitors counter shows now user browser, and also if its bot
+* changes in required and optional PHP extensions
+* reworked Pages:
+	* Bans
+		* works now for TFS 1.x
+	* Highscores
+		* frags works for TFS 1.x
+		* cached
+	* Monsters
+* moved pages to Twig:
+  * experience stages
+* update player_deaths entries on name change
+* change_password email to be more informal
+
+### Fixed
+* hundreds of bug fixes, mostly patched from 0.8, so it makes no sense writing them again here

CHANGELOG-2.x.md

@@ -0,0 +1,4 @@
+## [2.0-dev - x.x.2025]
+
+### Changed
+* Reworked account action logs to use single IP column as varchar(45) for both ipv4 and ipv6 (https://github.com/slawkens/myaac/pull/289)

CONTRIBUTORS.txt

@@ -8,7 +8,11 @@ Fernando Matos <fernando@pixele.com.br>
 Lee <42119604+Leesneaks@users.noreply.github.com>
 caio <caio.zucoli@gmail.com>
 slawkens <slawkens@gmail.com>
-tobi132 <52947952+tobi132@users.noreply.github.com>
+tobi132 <tobi132@gmx.net>
 vankk <nwtr.otland@hotmail.com>
 whiteblXK <krzys16001@gmail.com>
 xitobuh <jonas.hockert92@gmail.com>
+Danilo Pucci <dnlps@hotmail.com>
+gpedro <gpedro831@gmail.com>
+Matheus Collier <matheuscollier@gmail.com>
+SRNT-GG <95472530+SRNT-GG@users.noreply.github.com>

CREDITS

@@ -1,3 +1,3 @@
 * Gesior.pl (2007 - 2008)
-* Slawkens (2009 - 2023)
+* Slawkens (2009 - 2025)
 * Contributors listed in CONTRIBUTORS.txt

README.md

@@ -1,6 +1,6 @@
 # [MyAAC](https://my-aac.org)
 
-MyAAC is a free and open-source Automatic Account Creator (AAC) written in PHP. It is a fork of the [Gesior](https://github.com/gesior/Gesior2012) project. It supports only MySQL databases.
+MyAAC is a free and open-source Automatic Account Creator (AAC) for Open Tibia Servers written in PHP. It is a fork of the [Gesior](https://github.com/gesior/Gesior2012) project. It supports only MySQL databases.
 
 Official website: https://my-aac.org
 
@@ -80,7 +80,7 @@ Pull requests should be made to the *develop* branch as that is the working bran
 
 Bug fixes to current release should be done to master branch.
 
-Look: [Contributing](https://github.com/otsoft/myaac/wiki/Contributing) in our wiki.
+Look: [Contributing](https://docs.my-aac.org/misc/contributing) in our wiki.
 
 ### Other Notes
 
@@ -95,4 +95,4 @@ Many thanks to Jetbrains for kindly providing a license for me to work on this a
 ### License
 
 This program and all associated files are released under the GNU Public License.  
-See [LICENSE](https://github.com/slawkens/myaac/blob/master/LICENSE) for details.
+See [LICENSE](https://github.com/slawkens/myaac/blob/main/LICENSE) for details.

SECURITY.md

@@ -1,16 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 1.x.y   | :white_check_mark: |
-| 0.9.x   | :x:                |
-| 0.8.x   | :white_check_mark: |
-| < 0.7   | :x:                |
-
-## Reporting a Vulnerability
-
-If you found a security vulnerability, please write an email to security@my-aac.org
-
-All reports will be taken very seriously, and a fix will be posted as soon as possible.

aac

@@ -0,0 +1,38 @@
+#!/usr/bin/env php
+<?php
+
+require_once __DIR__ . '/common.php';
+
+if(!IS_CLI) {
+	echo 'This script can be run only in command line mode.';
+	exit(1);
+}
+
+require_once SYSTEM . 'functions.php';
+
+define('SELF_NAME', basename(__FILE__));
+
+use MyAAC\Plugins;
+use Symfony\Component\Console\Application;
+
+$application = new Application('MyAAC', MYAAC_VERSION);
+
+$commandsGlob = glob(SYSTEM . 'src/Commands/*.php');
+foreach ($commandsGlob as $item) {
+	$name = pathinfo($item, PATHINFO_FILENAME);
+	if ($name == 'Command') { // ignore base Command class
+		continue;
+	}
+
+	$commandPre = '\\MyAAC\Commands\\';
+	if (!trait_exists($class = $commandPre . $name)) {
+		$application->add(new $class);
+	}
+}
+
+$pluginCommands = Plugins::getCommands();
+foreach ($pluginCommands as $item) {
+	$application->add(require $item);
+}
+
+$application->run();

admin/includes/debugbar.php

@@ -0,0 +1,22 @@
+<?php
+
+$hooks->register('debugbar_admin_head_end', HOOK_ADMIN_HEAD_END, function ($params) {
+	global $debugBar;
+
+	if (!isset($debugBar)) {
+		return;
+	}
+
+	$debugBarRenderer = $debugBar->getJavascriptRenderer(BASE_URL . 'vendor/maximebf/debugbar/src/DebugBar/Resources/');
+	echo $debugBarRenderer->renderHead();
+});
+$hooks->register('debugbar_admin_body_end', HOOK_ADMIN_BODY_END, function ($params) {
+	global $debugBar;
+
+	if (!isset($debugBar)) {
+		return;
+	}
+
+	$debugBarRenderer = $debugBar->getJavascriptRenderer(BASE_URL . 'vendor/maximebf/debugbar/src/DebugBar/Resources/');
+	echo $debugBarRenderer->render();
+});

admin/includes/settings_menus.php

@@ -0,0 +1,37 @@
+<?php
+
+use MyAAC\Plugins;
+
+$order = 10;
+
+$settingsMenu = [];
+
+$settingsMenu[] = [
+	'name' => 'MyAAC',
+	'link' => 'settings&plugin=core',
+	'icon' => 'list',
+	'order' => $order,
+];
+
+foreach (Plugins::getAllPluginsSettings() as $setting) {
+	$file = BASE . $setting['settingsFilename'];
+	if (!file_exists($file)) {
+		warning('Plugin setting: ' . $file . ' - cannot be loaded.');
+		continue;
+	}
+
+	$order += 10;
+
+	$settings = require $file;
+
+	$settingsMenu[] = [
+		'name' => $settings['name'],
+		'link' => 'settings&plugin=' . $setting['pluginFilename'],
+		'icon' => 'list',
+		'order' => $order,
+	];
+}
+
+unset($settings, $file, $order);
+
+return $settingsMenu;

admin/index.php

@@ -1,13 +1,12 @@
 <?php
+
 // few things we'll need
+use MyAAC\Plugins;
+
 require '../common.php';
 
-define('ADMIN_PANEL', true);
-define('MYAAC_ADMIN', true);
-
-if(file_exists(BASE . 'config.local.php')) {
-	require_once BASE . 'config.local.php';
-}
+const ADMIN_PANEL = true;
+const MYAAC_ADMIN = true;
 
 if(file_exists(BASE . 'install') && (!isset($config['installed']) || !$config['installed']))
 {
@@ -18,8 +17,8 @@ if(file_exists(BASE . 'install') && (!isset($config['installed']) || !$config['i
 $content = '';
 
 // validate page
-$page = isset($_GET['p']) ? $_GET['p'] : '';
-if(empty($page) || preg_match("/[^a-zA-Z0-9_\-]/", $page))
+$page = $_GET['p'] ?? '';
+if(empty($page) || preg_match("/[^a-zA-Z0-9_\-\/.]/", $page))
 	$page = 'dashboard';
 
 $page = strtolower($page);
@@ -28,39 +27,49 @@ define('PAGE', $page);
 require SYSTEM . 'functions.php';
 require SYSTEM . 'init.php';
 
-if(config('env') === 'dev') {
-	ini_set('display_errors', 1);
-	ini_set('display_startup_errors', 1);
-	error_reporting(E_ALL);
-}
-
+require __DIR__ . '/includes/debugbar.php';
 require SYSTEM . 'status.php';
 require SYSTEM . 'login.php';
-require SYSTEM . 'migrate.php';
-require ADMIN . 'includes/functions.php';
+require __DIR__ . '/includes/functions.php';
 
 $twig->addGlobal('config', $config);
 $twig->addGlobal('status', $status);
 
+if (ACTION == 'logout') {
+	require SYSTEM . 'logout.php';
+}
+
 // if we're not logged in - show login box
 if(!$logged || !admin()) {
 	$page = 'login';
 }
 
-// include our page
-$file = ADMIN . 'pages/' . $page . '.php';
-if(!@file_exists($file)) {
-	$page = '404';
-	$file = SYSTEM . 'pages/404.php';
+$pluginsAdminPages = Plugins::getAdminPages();
+if(isset($pluginsAdminPages[$page]) && file_exists(BASE . $pluginsAdminPages[$page])) {
+	$file = BASE . $pluginsAdminPages[$page];
+}
+else {
+	// include our page
+	$file = __DIR__ . '/pages/' . $page . '.php';
+	if(!@file_exists($file)) {
+		if (str_contains($page, 'plugins/')) {
+			$file = BASE . $page;
+		}
+		else {
+			$page = '404';
+			$file = SYSTEM . 'pages/404.php';
+		}
+	}
 }
 
 ob_start();
-include($file);
+if($hooks->trigger(HOOK_ADMIN_BEFORE_PAGE)) {
+	require $file;
+}
 
 $content .= ob_get_contents();
 ob_end_clean();
 
 // template
 $template_path = 'template/';
-require ADMIN . $template_path . 'template.php';
-
+require __DIR__ . '/' . $template_path . 'template.php';

admin/pages/changelog.php

@@ -1,26 +1,131 @@
 <?php
 /**
- * CHANGELOG viewer
+ * CHANGELOG modifier
  *
  * @package   MyAAC
  * @author    Slawkens <slawkens@gmail.com>
- * @copyright 2019 MyAAC
+ * @author    Lee
+ * @copyright 2020 MyAAC
  * @link      https://my-aac.org
  */
-defined('MYAAC') or die('Direct access not allowed!');
-$title = 'MyAAC Changelog';
 
-if (!file_exists(BASE . 'CHANGELOG.md')) {
-	echo 'File CHANGELOG.md doesn\'t exist.';
+use MyAAC\Changelog;
+use MyAAC\Models\Changelog as ModelsChangelog;
+
+defined('MYAAC') or die('Direct access not allowed!');
+
+$title = 'Changelog';
+
+csrfProtect();
+
+if (!hasFlag(FLAG_CONTENT_PAGES) && !superAdmin()) {
+	echo 'Access denied.';
 	return;
 }
 
-require LIBS . 'Parsedown.php';
+$use_datatable = true;
+const CL_LIMIT = 600; // maximum changelog body length
 
-$changelog = file_get_contents(BASE . 'CHANGELOG.md');
+$id = $_GET['id'] ?? 0;
 
-$Parsedown = new Parsedown();
+if(!empty($action) && isRequestMethod('post'))
+{
+	$id = $_POST['id'] ?? null;
+	$body = isset($_POST['body']) ? stripslashes($_POST['body']) : null;
+	$create_date = isset($_POST['createdate']) ? (int)strtotime($_POST['createdate'] ): null;
+	$player_id = isset($_POST['player_id']) ? (int)$_POST['player_id'] : null;
+	$type = isset($_POST['type']) ? (int)$_POST['type'] : null;
+	$where = isset($_POST['where']) ? (int)$_POST['where'] : null;
 
-$changelog = $Parsedown->text($changelog); # prints: <p>Hello <em>Parsedown</em>!</p>
+	$errors = array();
 
-echo '<div>' . $changelog . '</div>';
+	if($action == 'new') {
+
+		if(isset($body) && Changelog::add($body, $type, $where, $player_id, $create_date, $errors)) {
+			$body = '';
+			$type = $where = $player_id = $create_date = 0;
+
+			success('Added successful.');
+		}
+	}
+	else if($action == 'delete') {
+		if (Changelog::delete($id, $errors)) {
+			success('Deleted successful.');
+		}
+	}
+	else if($action == 'edit')
+	{
+		if(isset($id) && !isset($body)) {
+			$cl = Changelog::get($id);
+			$body = $cl['body'];
+			$type = $cl['type'];
+			$where = $cl['where'];
+			$create_date = $cl['date'];
+			$player_id = $cl['player_id'];
+		}
+		else {
+			if(Changelog::update($id, $body, $type, $where, $player_id, $create_date,$errors)) {
+				$action = $body = '';
+				$type = $where = $player_id = $create_date = 0;
+
+				success('Updated successful.');
+			}
+		}
+	}
+	else if($action == 'hide') {
+		if (Changelog::toggleHide($id, $errors, $status)) {
+			success(($status == 1 ? 'Hide' : 'Show') . ' successful.');
+		}
+	}
+
+	if(!empty($errors))
+		error(implode(", ", $errors));
+}
+
+$changelogs = ModelsChangelog::orderBy('id')->get()->toArray();
+
+$i = 0;
+
+$log_type = [
+	['id' => 1, 'icon' => 'added'],
+	['id' => 2, 'icon' => 'removed'],
+	['id' => 3, 'icon' => 'changed'],
+	['id' => 4, 'icon' => 'fixed'],
+];
+
+$log_where = [
+	['id' => 1, 'icon' => 'server'],
+	['id' => 2, 'icon' => 'website'],
+];
+
+foreach($changelogs as $key => &$log)
+{
+	$log['type'] = getChangelogType($log['type']);
+	$log['where'] = getChangelogWhere($log['where']);
+}
+
+if($action == 'edit' || $action == 'new') {
+	if($action == 'edit') {
+		$player = new OTS_Player();
+		$player->load($player_id);
+	}
+
+	$account_players = $account_logged->getPlayersList();
+	$account_players->orderBy('group_id', POT::ORDER_DESC);
+	$twig->display('admin.changelog.form.html.twig', array(
+		'action' => $action,
+		'cl_link_form' => constant('ADMIN_URL').'?p=changelog',
+		'cl_id' => $id ?? null,
+		'body' => isset($body) ? escapeHtml($body) : '',
+		'create_date' => $create_date ?? '',
+		'player_id' => $player_id ?? null,
+		'account_players' => $account_players,
+		'type' => $type ?? 0,
+		'where' => $where ?? 0,
+		'log_type' => $log_type,
+		'log_where' => $log_where,
+	));
+}
+$twig->display('admin.changelog.html.twig', array(
+	'changelogs' => $changelogs,
+));

admin/pages/clmd.php

@@ -0,0 +1,25 @@
+<?php
+/**
+ * CHANGELOG viewer
+ *
+ * @package   MyAAC
+ * @author    Slawkens <slawkens@gmail.com>
+ * @author    Lee
+ * @copyright 2020 MyAAC
+ * @link      https://my-aac.org
+ */
+defined('MYAAC') or die('Direct access not allowed!');
+$title = 'MyAAC Changelog';
+
+if (!file_exists(BASE . 'CHANGELOG-1.x.md')) {
+	echo 'File CHANGELOG.md doesn\'t exist.';
+	return;
+}
+
+$changelog = file_get_contents(BASE . 'CHANGELOG-1.x.md');
+
+$Parsedown = new Parsedown();
+
+$changelog = $Parsedown->text($changelog); # prints: <p>Hello <em>Parsedown</em>!</p>
+
+echo '<div>' . $changelog . '</div>';

admin/pages/dashboard.php

@@ -10,7 +10,9 @@
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Dashboard';
 
-if (isset($_GET['clear_cache'])) {
+csrfProtect();
+
+if (isset($_POST['clear_cache'])) {
 	if (clearCache()) {
 		success('Cache cleared.');
 	} else {
@@ -18,9 +20,11 @@ if (isset($_GET['clear_cache'])) {
 	}
 }
 
-if (isset($_GET['maintenance'])) {
-	$_status = (int)$_POST['status'];
-	$message = $_POST['message'];
+if (isset($_POST['maintenance'])) {
+	$message = (!empty($_POST['message']) ? $_POST['message'] : null);
+	$_status = (isset($_POST['status']) && $_POST['status'] == 'true');
+	$_status = ($_status ? '0' : '1');
+
 	if (empty($message)) {
 		error('Message cannot be empty.');
 	} else if (strlen($message) > 255) {
@@ -45,47 +49,15 @@ $tmp = '';
 if (fetchDatabaseConfig('site_closed_message', $tmp))
 	$closed_message = $tmp;
 
-$query = $db->query('SELECT count(*) as `how_much` FROM `accounts`;');
-$query = $query->fetch();
-$total_accounts = $query['how_much'];
-
-$query = $db->query('SELECT count(*) as `how_much` FROM `players`;');
-$query = $query->fetch();
-$total_players = $query['how_much'];
-
-$query = $db->query('SELECT count(*) as `how_much` FROM `guilds`;');
-$query = $query->fetch();
-$total_guilds = $query['how_much'];
-
-$query = $db->query('SELECT count(*) as `how_much` FROM `houses`;');
-$query = $query->fetch();
-$total_houses = $query['how_much'];
-
-$twig->display('admin.statistics.html.twig', array(
-	'total_accounts' => $total_accounts,
-	'total_players' => $total_players,
-	'total_guilds' => $total_guilds,
-	'total_houses' => $total_houses
-));
-
-$twig->display('admin.dashboard.html.twig', array(
-	'is_closed' => $is_closed,
-	'closed_message' => $closed_message,
-	'status' => $status,
-	'account_type' => USE_ACCOUNT_NAME ? 'name' : 'number'
-));
-
-echo '<div class="row">';
-
-$configAdminPanelModules = config('admin_panel_modules');
-if(isset($configAdminPanelModules))
-	$configAdminPanelModules = explode(',', $configAdminPanelModules);
-
-$twig_loader->prependPath(__DIR__ . '/modules/templates');
-foreach($configAdminPanelModules as $box) {
-	$file = __DIR__ . '/modules/' . $box . '.php';
-	if(file_exists($file)) {
-		include($file);
+$settingAdminPanelModules = setting('core.admin_panel_modules');
+if (count($settingAdminPanelModules) > 0) {
+	echo '<div class="row">';
+	$twig_loader->prependPath(__DIR__ . '/modules/templates');
+	foreach ($settingAdminPanelModules as $box) {
+		$file = __DIR__ . '/modules/' . $box . '.php';
+		if (file_exists($file)) {
+			include($file);
+		}
 	}
-}
 echo '</div>';
+}

admin/pages/data.php

@@ -1,14 +1,13 @@
 <?php
 /**
- * Rules
+ * Load items.xml
  *
  * @package   MyAAC
- * @author    Gesior <jerzyskalski@wp.pl>
  * @author    Slawkens <slawkens@gmail.com>
  * @copyright 2019 MyAAC
  * @link      https://my-aac.org
  */
 defined('MYAAC') or die('Direct access not allowed!');
-$title = 'Server Rules';
+$title = 'Server Data';
 
-$twig->display('rules.html.twig');
+$twig->display('admin.data.html.twig');

admin/pages/items.php

@@ -1,35 +0,0 @@
-<?php
-/**
- * Load items.xml
- *
- * @package   MyAAC
- * @author    Slawkens <slawkens@gmail.com>
- * @copyright 2019 MyAAC
- * @link      https://my-aac.org
- */
-defined('MYAAC') or die('Direct access not allowed!');
-$title = 'Load items.xml';
-
-require_once LIBS . 'items.php';
-require_once LIBS . 'weapons.php';
-
-$twig->display('admin.items.html.twig');
-
-$reload = isset($_REQUEST['reload']) && (int)$_REQUEST['reload'] === 1;
-if ($reload) {
-	$items_start_time = microtime(true);
-	if (Items::loadFromXML(true)) {
-		success('Successfully loaded items (in ' . round(microtime(true) - $items_start_time, 4) . ' seconds).');
-	}
-	else {
-		error(Items::getError());
-	}
-
-	$weapons_start_time = microtime(true);
-	if (Weapons::loadFromXML(true)) {
-		success('Successfully loaded weapons (in ' . round(microtime(true) - $weapons_start_time, 4) . ' seconds).');
-	}
-	else {
-		error(Weapons::getError());
-	}
-}

admin/pages/login.php

@@ -9,18 +9,18 @@
  */
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Login';
-$logout = '';
-if ($action == 'logout') {
-	$logout = "You have  been logged out!";
+
+csrfProtect();
+
+require PAGES . 'account/login.php';
+if ($logged) {
+	header('Location: ' . (admin() ? ADMIN_URL : BASE_URL));
+	return;
 }
 
-if (isset($errors)) {
-	foreach ($errors as $error) {
-		error($error);
-	}
-}
-
-$twig->display('admin.login.html.twig', array(
-	'logout' => $logout,
+$twig->display('admin.login.html.twig', [
+	'logout' => (ACTION == 'logout' ? 'You have  been logged out!'  : ''),
 	'account' => USE_ACCOUNT_NAME ? 'Name' : 'Number',
-));
+	'account_login_by' => getAccountLoginByLabel(),
+	'errors' => $errors ?? ''
+]);

admin/pages/logs.php

@@ -4,56 +4,56 @@
  *
  * @package   MyAAC
  * @author    Slawkens <slawkens@gmail.com>
- * @copyright 2019 MyAAC
+ * @copyright 2020 MyAAC
  * @link      https://my-aac.org
  */
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Logs Viewer';
+$use_datatable = true;
 
 $files = array();
 $aac_path_logs = BASE . 'system/logs/';
 foreach (scandir($aac_path_logs, SCANDIR_SORT_ASCENDING) as $f) {
-    if ($f[0] === '.' || is_dir($aac_path_logs . $f)) {
-	    continue;
-    }
+	if ($f[0] === '.' || is_dir($aac_path_logs . $f) || $f === 'index.html') {
+		continue;
+	}
 
-    $files[] = array($f, $aac_path_logs);
+	$files[] = array($f, $aac_path_logs);
 }
 
 $server_path_logs = $config['server_path'] . 'logs/';
 if (!file_exists($server_path_logs)) {
-    $server_path_logs = $config['data_path'] . 'logs/';
+	$server_path_logs = $config['data_path'] . 'logs/';
 }
 
 if (file_exists($server_path_logs)) {
-    foreach (scandir($server_path_logs, SCANDIR_SORT_ASCENDING) as $f) {
-        if ($f[0] === '.') {
-	        continue;
-        }
+	foreach (scandir($server_path_logs, SCANDIR_SORT_ASCENDING) as $f) {
+		if ($f[0] === '.') {
+			continue;
+		}
 
-        if (is_dir($server_path_logs . $f)) {
-            foreach (scandir($server_path_logs . $f, SCANDIR_SORT_ASCENDING) as $f2) {
-                if ($f2[0] === '.') {
-	                continue;
-                }
+		if (is_dir($server_path_logs . $f)) {
+			foreach (scandir($server_path_logs . $f, SCANDIR_SORT_ASCENDING) as $f2) {
+				if ($f2[0] === '.') {
+					continue;
+				}
 
-                $files[] = array($f . '/' . $f2, $server_path_logs);
-            }
+				$files[] = array($f . '/' . $f2, $server_path_logs);
+			}
 
-            continue;
-        }
+			continue;
+		}
 
-        $files[] = array($f, $server_path_logs);
-    }
+		$files[] = array($f, $server_path_logs);
+	}
 }
 
 foreach ($files as &$f) {
-    $f['mtime'] = filemtime($f[1] . $f[0]);
-    $f['name'] = $f[0];
+	$f['mtime'] = filemtime($f[1] . $f[0]);
+	$f['name'] = $f[0];
 }
 unset($f);
 
-$twig->display('admin.logs.html.twig', array('files' => $files));
 
 define('EXIST_NONE', 0);
 define('EXIST_SERVER_LOG', 1);
@@ -72,10 +72,12 @@ if (!empty($file)) {
 		}
 
 		if ($exist !== EXIST_NONE) {
-			$content = nl2br(file_get_contents(($exist === EXIST_SERVER_LOG ? $server_path_logs : $aac_path_logs) . $file));
-			$twig->display('admin.logs.view.html.twig', array('file' => $file, 'content' => $content));
+			$file_content = nl2br(file_get_contents(($exist === EXIST_SERVER_LOG ? $server_path_logs : $aac_path_logs) . $file));
+			$twig->display('admin.logs.view.html.twig', array('file' => $file, 'content' => $file_content));
 		}
 	} else {
 		echo 'Invalid file name specified.';
 	}
 }
+
+$twig->display('admin.logs.html.twig', array('files' => $files));

admin/pages/mailer.php

@@ -7,63 +7,84 @@
  * @copyright 2019 MyAAC
  * @link      https://my-aac.org
  */
+
+use MyAAC\Models\Account;
+
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Mailer';
 
+csrfProtect();
+
 if (!hasFlag(FLAG_CONTENT_MAILER) && !superAdmin()) {
 	echo 'Access denied.';
 	return;
 }
 
-if (!$config['mail_enabled']) {
-	echo 'Mail support disabled.';
+if (!setting('core.mail_enabled')) {
+	echo 'Mail support disabled in config.';
 	return;
 }
 
-$mail_content = isset($_POST['mail_content']) ? stripslashes($_POST['mail_content']) : NULL;
-$mail_subject = isset($_POST['mail_subject']) ? stripslashes($_POST['mail_subject']) : NULL;
-$preview = isset($_REQUEST['preview']);
+$mail_to = isset($_REQUEST['mail_to']) ? stripslashes(trim($_REQUEST['mail_to'])) : null;
+$mail_subject = isset($_POST['mail_subject']) ? stripslashes($_POST['mail_subject']) : null;
+$mail_content = isset($_POST['mail_content']) ? stripslashes($_POST['mail_content']) : null;
+$mail_verified_only = $_POST['mail_verified_only'] ?? false;
 
-$preview_done = false;
-if ($preview) {
-	if (!empty($mail_content) && !empty($mail_subject)) {
-		$preview_done = _mail($account_logged->getCustomField('email'), $mail_subject, $mail_content);
+if (isset($_POST['submit'])) {
+	if (empty($mail_subject)) {
+		warning('Please enter subject of the message.');
+	}
 
-		if (!$preview_done)
-			error('Error while sending preview mail. More info can be found in system/logs/mailer-error.log');
+	if (empty($mail_content)) {
+		warning('Please enter content of the message.');
+	}
+}
+if (!empty($mail_to)) {
+	if(!Validator::email($mail_to)) {
+		warning('E-Mail is invalid.');
+	}
+	else {
+		if (!empty($mail_content) && !empty($mail_subject)) {
+			if (_mail($mail_to, $mail_subject, $mail_content)) {
+				success("Successfully mailed <strong>$mail_to</strong>");
+			}
+			else {
+				error("Error while sending mail to <strong>$mail_to</strong>. More info can be found in system/logs/mailer-error.log");
+			}
+		}
 	}
 }
 
+if (!empty($mail_content) && !empty($mail_subject) && empty($mail_to)) {
+	$success = 0;
+	$failed = 0;
 
-$twig->display('admin.mailer.html.twig', array(
+	$query = Account::where('email', '!=', '');
+
+	if ($mail_verified_only) {
+		info('Note: Sending only to users with verified E-Mail.');
+		$query->where('email_verified', 1);
+	}
+
+	foreach ($query->get(['email']) as $email) {
+		if (_mail($email->email, $mail_subject, $mail_content)) {
+			$success++;
+		}
+		else {
+			$failed++;
+			echo '<br />';
+			error('An error occorred while sending email to <b>' . $email->email . '</b>. For Admin: More info can be found in system/logs/mailer-error.log');
+		}
+	}
+
+	success('Mailing finished.');
+	success("$success emails delivered.");
+	warning("$failed emails failed.");
+}
+
+$twig->display('admin.mailer.html.twig', [
+	'mail_to' => $mail_to,
 	'mail_subject' => $mail_subject,
 	'mail_content' => $mail_content,
-	'preview_done' => $preview_done
-));
-
-if (empty($mail_content) || empty($mail_subject) || $preview)
-	return;
-
-$success = 0;
-$failed = 0;
-
-$add = '';
-if ($config['account_mail_verify']) {
-	note('Note: Sending only to users with verified E-Mail.');
-	$add = ' AND ' . $db->fieldName('email_verified') . ' = 1';
-}
-
-$query = $db->query('SELECT ' . $db->fieldName('email') . ' FROM ' . $db->tableName('accounts') . ' WHERE ' . $db->fieldName('email') . ' != ""' . $add);
-foreach ($query as $email) {
-	if (_mail($email['email'], $mail_subject, $mail_content))
-		$success++;
-	else {
-		$failed++;
-		echo '<br />';
-		error('An error occorred while sending email to <b>' . $email['email'] . '</b>. For Admin: More info can be found in system/logs/mailer-error.log');
-	}
-}
-
-success('Mailing finished.');
-success("$success emails delivered.");
-warning("$failed emails failed.");
+	'mail_verified_only' => $mail_verified_only,
+]);

admin/pages/mass_account.php

@@ -0,0 +1,174 @@
+<?php
+
+/**
+ * Account Admin Tool
+ *
+ * @package   MyAAC
+ * @author    Slawkens <slawkens@gmail.com>
+ * @author    Lee
+ * @author    gpedro
+ * @copyright 2020 MyAAC
+ * @link      https://my-aac.org
+ */
+
+use MyAAC\Models\Account;
+
+defined('MYAAC') or die('Direct access not allowed!');
+
+$title = 'Mass Account Actions';
+
+csrfProtect();
+
+$hasPointsColumn = $db->hasColumn('accounts', 'premium_points');
+$freePremium = getBoolean(configLua('freePremium'));
+
+function admin_give_points($points): void
+{
+	global $hasPointsColumn;
+
+	if (!$hasPointsColumn) {
+		displayMessage('Points not supported.');
+		return;
+	}
+
+	if (!Account::query()->increment('premium_points', $points)) {
+		displayMessage('Failed to add points.');
+		return;
+	}
+	displayMessage($points . ' points added to all accounts.', true);
+}
+
+function admin_give_coins($coins): void
+{
+	if (!HAS_ACCOUNT_COINS) {
+		displayMessage('Coins not supported.');
+		return;
+	}
+
+	if (!Account::query()->increment('coins', $coins)) {
+		displayMessage('Failed to add coins.');
+		return;
+	}
+
+	displayMessage($coins . ' coins added to all accounts.', true);
+}
+
+function admin_give_premdays($days): void
+{
+	global $db, $freePremium;
+
+	if ($freePremium) {
+		displayMessage('Premium days not supported. Free Premium enabled.');
+		return;
+	}
+
+	$value = $days * 86400;
+	$now = time();
+
+	// othire
+	if ($db->hasColumn('accounts', 'premend')) {
+		// append premend
+		if (Account::where('premend', '>', $now)->increment('premend', $value)) {
+			// set premend
+			if (Account::where('premend', '<=', $now)->update(['premend' => $now + $value])) {
+				displayMessage($days . ' premium days added to all accounts.', true);
+			} else {
+				displayMessage('Failed to execute set query.');
+			}
+		} else {
+			displayMessage('Failed to execute append query.');
+		}
+
+		return;
+	}
+
+	// tfs 0.x
+	if ($db->hasColumn('accounts', 'premdays')) {
+		// append premdays
+		if (Account::query()->update(['premdays' => $days])) {
+			// append lastday
+			if (Account::where('lastday', '>', $now)->increment('lastday', $value)) {
+				// set lastday
+				if (Account::where('lastday', '<=', $now)->update(['lastday' => $now + $value])) {
+					displayMessage($days . ' premium days added to all accounts.', true);
+				} else {
+					displayMessage('Failed to execute set query.');
+				}
+			} else {
+				displayMessage('Failed to execute append query.');
+			}
+		} else {
+			displayMessage('Failed to execute set days query.');
+		}
+
+		return;
+	}
+
+	// tfs 1.x
+	if ($db->hasColumn('accounts', 'premium_ends_at')) {
+		// append premium_ends_at
+		if (Account::where('premium_ends_at', '>', $now)->increment('premium_ends_at', $value)) {
+			// set premium_ends_at
+			if (Account::where('premium_ends_at', '<=', $now)->update(['premium_ends_at' => $now + $value])) {
+				displayMessage($days . ' premium days added to all accounts.', true);
+			} else {
+				displayMessage('Failed to execute set query.');
+			}
+		} else {
+			displayMessage('Failed to execute append query.');
+		}
+
+		return;
+	}
+
+	displayMessage('Premium Days not supported.');
+}
+
+if (!empty(ACTION) && isRequestMethod('post')) {
+
+	$action = ACTION;
+
+	if (preg_match("/[^A-z0-9_\-]/", $action)) {
+		displayMessage('Invalid action.');
+	} else {
+		$value = isset($_POST['value']) ? intval($_POST['value']) : 0;
+
+		if (!$value) {
+			displayMessage('Please fill all inputs');
+		} else {
+			switch ($action) {
+				case 'give-points':
+					admin_give_points($value);
+					break;
+				case 'give-coins':
+					admin_give_coins($value);
+					break;
+				case 'give-premdays':
+					admin_give_premdays($value);
+					break;
+				default:
+					displayMessage('Action ' . $action . 'not found.');
+			}
+		}
+	}
+}
+else {
+	$twig->display('admin.tools.account.html.twig', array(
+		'hasCoinsColumn' => HAS_ACCOUNT_COINS,
+		'hasPointsColumn' => $hasPointsColumn,
+		'freePremium' => $freePremium,
+	));
+}
+
+function displayMessage($message, $success = false): void
+{
+	global $twig, $hasPointsColumn, $freePremium;
+
+	$success ? success($message): error($message);
+
+	$twig->display('admin.tools.account.html.twig', array(
+		'hasCoinsColumn' => HAS_ACCOUNT_COINS,
+		'hasPointsColumn' => $hasPointsColumn,
+		'freePremium' => $freePremium,
+	));
+}

admin/pages/mass_teleport.php

@@ -0,0 +1,107 @@
+<?php
+/**
+ * Teleport Admin Tool
+ *
+ * @package   MyAAC
+ * @author    Slawkens <slawkens@gmail.com>
+ * @author    Lee
+ * @copyright 2020 MyAAC
+ * @link      https://my-aac.org
+ */
+
+use MyAAC\Models\Player;
+use MyAAC\Models\PlayerOnline;
+
+defined('MYAAC') or die('Direct access not allowed!');
+
+$title = 'Mass Teleport Actions';
+
+csrfProtect();
+
+function admin_teleport_position($x, $y, $z) {
+	if (!Player::query()->update([
+		'posx' => $x, 'posy' => $y, 'posz' => $z
+	])) {
+		displayMessage('Failed to execute query. Probably already updated.');
+		return;
+	}
+
+	displayMessage('Player\'s position updated.', true);
+}
+
+function admin_teleport_town($town_id) {
+	if (!Player::query()->update([
+		'town_id' => $town_id,
+	])) {
+		displayMessage('Failed to execute query. Probably already updated.');
+		return;
+	}
+
+	displayMessage('Player\'s town updated.', true);
+}
+
+if (!empty(ACTION) && isRequestMethod('post'))    {
+
+	$action = ACTION;
+
+	if (preg_match("/[^A-z0-9_\-]/", $action)) {
+		displayMessage('Invalid action.');
+	} else {
+
+		$playersOnline = 0;
+		if($db->hasTable('players_online')) {// tfs 1.0
+			$playersOnline = PlayerOnline::count();
+		} else {
+			$playersOnline = Player::online()->count();
+		}
+
+		if ($playersOnline > 0) {
+			displayMessage('Please, close the server before execute this action otherwise players will not be affected.');
+			return;
+		}
+
+		$town_id = isset($_POST['town_id']) ? intval($_POST['town_id']) : null;
+		$posx = isset($_POST['posx']) ? intval($_POST['posx']) : null;
+		$posy = isset($_POST['posy']) ? intval($_POST['posy']) : null;
+		$posz = isset($_POST['posz']) ? intval($_POST['posz']) : null;
+		$to_temple = $_POST['to_temple'] ?? null;
+
+		switch ($action) {
+			case 'set-town':
+				if (!$town_id) {
+					displayMessage('Please fill all inputs');
+					return;
+				}
+
+				if (!isset($config['towns'][$town_id])) {
+					displayMessage('Specified town does not exist');
+					return;
+				}
+
+				admin_teleport_town($town_id);
+				break;
+			case 'set-position':
+				if (!$to_temple &&  ($posx < 0 || $posx > 65535 || $posy < 0 || $posy > 65535|| $posz < 0 || $posz > 16)) {
+					displayMessage('Invalid Position');
+					return;
+				}
+
+				admin_teleport_position($posx, $posy, $posz);
+				break;
+			default:
+				displayMessage('Action ' . $action . 'not found.');
+		}
+	}
+
+}
+else {
+	$twig->display('admin.tools.teleport.html.twig', array());
+}
+
+
+function displayMessage($message, $success = false) {
+	global $twig;
+
+	$success ? success($message): error($message);
+	$twig->display('admin.tools.teleport.html.twig', array());
+}

admin/pages/menus.php

@@ -7,52 +7,72 @@
  * @copyright 2019 MyAAC
  * @link      https://my-aac.org
  */
+
+use MyAAC\Cache\Cache;
+use MyAAC\Models\Menu;
+use MyAAC\Plugins;
+
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Menus';
 
+csrfProtect();
+
 if (!hasFlag(FLAG_CONTENT_MENUS) && !superAdmin()) {
 	echo 'Access denied.';
 	return;
 }
 
-if (isset($_REQUEST['template'])) {
-	$template = $_REQUEST['template'];
+$pluginThemes = Plugins::getThemes();
 
-	if (isset($_REQUEST['menu'])) {
-		$post_menu = $_REQUEST['menu'];
-		$post_menu_link = $_REQUEST['menu_link'];
-		$post_menu_blank = $_REQUEST['menu_blank'];
-		$post_menu_color = $_REQUEST['menu_color'];
+if (isset($_POST['template'])) {
+	$template = $_POST['template'];
+
+	if (isset($_POST['save'])) {
+		$post_menu = $_POST['menu'] ?? [];
+		$post_menu_link = $_POST['menu_link'] ?? [];
+		$post_menu_blank = $_POST['menu_blank'] ?? [];
+		$post_menu_color = $_POST['menu_color'] ?? [];
 		if (count($post_menu) != count($post_menu_link)) {
 			echo 'Menu count is not equal menu links. Something went wrong when sending form.';
 			return;
 		}
 
-		$db->query('DELETE FROM `' . TABLE_PREFIX . 'menu` WHERE `template` = ' . $db->quote($template));
+		Menu::where('template', $template)->delete();
 		foreach ($post_menu as $category => $menus) {
 			foreach ($menus as $i => $menu) {
 				if (empty($menu)) // don't save empty menu item
 					continue;
 
 				try {
-					$db->insert(TABLE_PREFIX . 'menu', array('template' => $template, 'name' => $menu, 'link' => $post_menu_link[$category][$i], 'blank' => $post_menu_blank[$category][$i] == 'on' ? 1 : 0, 'color' => str_replace('#', '', $post_menu_color[$category][$i]), 'category' => $category, 'ordering' => $i));
+					Menu::create([
+						'template' => $template,
+						'name' => $menu,
+						'link' => $post_menu_link[$category][$i],
+						'blank' => $post_menu_blank[$category][$i] == 'on' ? 1 : 0,
+						'color' => str_replace('#', '', $post_menu_color[$category][$i]),
+						'category' => $category,
+						'ordering' => $i
+					]);
 				} catch (PDOException $error) {
 					warning('Error while adding menu item (' . $menu . '): ' . $error->getMessage());
 				}
 			}
 		}
 
-		$cache = Cache::getInstance();
-		if ($cache->enabled()) {
-			$cache->delete('template_menus');
-		}
-
+		onTemplateMenusChange();
 		success('Saved at ' . date('H:i'));
 	}
 
-	$file = TEMPLATES . $template . '/config.php';
-	if (file_exists($file)) {
-		require_once $file;
+	$path = TEMPLATES . $template;
+
+	if (isset($pluginThemes[$template])) {
+		$path = BASE . $pluginThemes[$template];
+	}
+
+	$path .= '/config.php';
+
+	if (file_exists($path)) {
+		require_once $path;
 	} else {
 		echo 'Cannot find template config.php file.';
 		return;
@@ -63,70 +83,115 @@ if (isset($_REQUEST['template'])) {
 		return;
 	}
 
-	echo 'Hint: You can drag menu items.<br/>
-	Hint: Add links to external sites using: <b>http://</b> or <b>https://</b> prefix.<br/>
-	Not all templates support blank and colorful links.<br/><br/>
-    <div class="row">';
-	$menus = array();
-	$menus_db = $db->query('SELECT `name`, `link`, `blank`, `color`, `category`, `ordering` FROM `' . TABLE_PREFIX . 'menu` WHERE `enabled` = 1 AND `template` = ' . $db->quote($template) . ' ORDER BY `ordering` ASC;')->fetchAll();
-	foreach ($menus_db as $menu) {
-		$menus[$menu['category']][] = array('name' => $menu['name'], 'link' => $menu['link'], 'blank' => $menu['blank'], 'color' => $menu['color'], 'ordering' => $menu['ordering']);
-	}
-
-	$last_id = array();
-	echo '<form method="post" id="menus-form" action="?p=menus">';
-	echo '<input type="hidden" name="template" value="' . $template . '"/>';
-	foreach ($config['menu_categories'] as $id => $cat) {
-		echo '        <div class="col-md-12 col-lg-6">
-            <div class="box box-danger">
-                <div class="box-header with-border">
-                    <h3 class="box-title">' . $cat['name'] . ' <img class="add-button" id="add-button-' . $id . '" src="' . BASE_URL . 'images/plus.png" width="16" height="16"/></h3>
-                </div>
-                <div class="box-body">';
-
-
-		echo '<ul class="sortable" id="sortable-' . $id . '">';
-		if (isset($menus[$id])) {
-			$i = 0;
-			foreach ($menus[$id] as $menu) {
-				echo '<li class="ui-state-default" id="list-' . $id . '-' . $i . '"><label>Name:</label><input type="text" name="menu[' . $id . '][]" value="' . escapeHtml($menu['name']) . '"/>
-				<label>Link:</label><input type="text" name="menu_link[' . $id . '][]" value="' . $menu['link'] . '"/>
-				<input type="hidden" name="menu_blank[' . $id . '][]" value="0" />
-				<label><input class="blank-checkbox" type="checkbox" ' . ($menu['blank'] == 1 ? 'checked' : '') . '/><span title="Open in New Window">Open in New Window</span></label>
-				
-				<input class="color-picker" type="text" name="menu_color[' . $id . '][]" value="#' . $menu['color'] . '" />
-				
-				<a class="remove-button" id="remove-button-' . $id . '-' . $i . '"><img src="' . BASE_URL . 'images/del.png"/></a></li>';
-
-				$i++;
-				$last_id[$id] = $i;
-			}
+	if (isset($_GET['reset_colors'])) {
+		foreach ($config['menu_categories'] as $id => $options) {
+			$color = $options['default_links_color'] ?? ($config['menu_default_links_color'] ?? ($config['menu_default_color'] ?? '#ffffff'));
+			Menu::where('template', $template)->where('category', $id)->update(['color' => str_replace('#', '', $color)]);
 		}
 
-		echo '</ul>';
-		echo '                </div>
-            </div>
-        </div>
-';
+		onTemplateMenusChange();
+		success('Colors has been reset at ' . date('H:i'));
 	}
-	echo ' </div><div class="row"><div class="col-md-6">';
-	echo '<input type="submit" class="btn btn-info" value="Save">';
-	echo '<input type="button" class="btn btn-default pull-right" value="Cancel" onclick="window.location = \'' . ADMIN_URL . '?p=menus&template=' . $template . '\';">';
-	echo '</div></div>';
-	echo '</form>';
 
+	if (isset($_GET['reset_menus'])) {
+		$configMenus = config('menus');
+		if (isset($configMenus)) {
+			Plugins::installMenus($template, config('menus'), true);
+
+			onTemplateMenusChange();
+			success('Menus has been reset at ' . date('H:i'));
+		}
+		else {
+			error("This template don't support reinstalling menus.");
+		}
+	}
+
+	$title = 'Menus - ' . $template;
+
+	$canResetColors = isset($config['menu_default_color']) || isset($config['menu_default_links_color']);
+	foreach ($config['menu_categories'] as $id => $options) {
+		if (isset($options['default_links_color'])) {
+			$canResetColors = true;
+		}
+	}
+
+	$twig->display('admin.menus.header.html.twig', [
+		'template' => $template,
+		'canResetColors' => $canResetColors
+	]);
+	?>
+	<?php
+	$menus = Menu::query()
+		->select('name', 'link', 'blank', 'color', 'category', 'ordering')
+		->where('enabled', 1)
+		->where('template', $template)
+		->orderBy('ordering')
+		->get()
+		->groupBy('category')
+		->toArray();
+
+	$last_id = array();
+	?>
+	<form method="post" id="menus-form" action="?p=menus">
+		<?php csrf(); ?>
+		<input type="hidden" name="template" value="<?php echo $template ?>"/>
+		<button type="submit" name="save" class="btn btn-info">Save</button><br/><br/>
+		<div class="row">
+			<?php foreach ($config['menu_categories'] as $id => $cat): ?>
+				<div class="col-md-12 col-lg-6">
+					<div class="card card-info card-outline">
+						<div class="card-header">
+							<h5 class="m-0"><?php echo $cat['name'] ?> <i class="far fa-plus-square add-button" id="add-button-<?php echo $id ?>"></i></h5>
+						</div>
+						<div class="card-body">
+							<ul class="sortable" id="sortable-<?php echo $id ?>">
+								<?php
+								if (isset($menus[$id])) {
+									$i = 0;
+									foreach ($menus[$id] as $menu):
+										$color = (empty($menu['color']) ? ($cat['default_links_color'] ?? ($config['menu_default_links_color'] ?? ($config['menu_default_color'] ?? '#ffffff'))) : '#' . $menu['color']);
+										?>
+										<li class="ui-state-default" id="list-<?php echo $id ?>-<?php echo $i ?>"><label>Name:</label> <input type="text" name="menu[<?php echo $id ?>][]" value="<?php echo escapeHtml($menu['name']); ?>"/>
+											<label>Link:</label> <input type="text" name="menu_link[<?php echo $id ?>][]" value="<?php echo $menu['link'] ?>"/>
+											<input type="hidden" name="menu_blank[<?php echo $id ?>][]" value="0"/>
+											<label><input class="blank-checkbox" type="checkbox" <?php echo($menu['blank'] == 1 ? 'checked' : '') ?>/><span title="Open in New Window">New Window</span></label>
+											<input class="color-picker" type="text" name="menu_color[<?php echo $id ?>][]" value="<?php echo $color; ?>"/>
+											<a class="remove-button" id="remove-button-<?php echo $id ?>-<?php echo $i ?>"><i class="fas fa-trash"></a></i></li>
+										<?php $i++; $last_id[$id] = $i;
+									endforeach;
+								} ?>
+							</ul>
+						</div>
+					</div>
+				</div>
+			<?php endforeach ?>
+		</div>
+		<div class="row pb-2">
+			<div class="col-md-12">
+				<button type="submit" name="save" class="btn btn-info">Save</button>
+				<?php
+				echo '<button type="button" class="btn btn-danger float-right" value="Cancel" onclick="window.location = \'' . ADMIN_URL . '?p=menus\';"><i class="fas fa-cancel"></i> Cancel</button>';
+				?>
+			</div>
+		</div>
+	</form>
+	<?php
 	$twig->display('admin.menus.js.html.twig', array(
 		'menus' => $menus,
-		'last_id' => $last_id
+		'last_id' => $last_id,
 	));
 	?>
-
 	<?php
 } else {
-	$templates = $db->query('SELECT `template` FROM `' . TABLE_PREFIX . 'menu` GROUP BY `template`;')->fetchAll();
+	$templates = Menu::select('template')->distinct()->get()->toArray();
 	foreach ($templates as $key => $value) {
-		$file = TEMPLATES . $value['template'] . '/config.php';
-		if (!file_exists($file)) {
+		$path = TEMPLATES . $value['template'];
+
+		if (isset($pluginThemes[$value['template']])) {
+			$path = BASE . $pluginThemes[$value['template']];
+		}
+
+		if (!file_exists($path . '/config.php')) {
 			unset($templates[$key]);
 		}
 	}
@@ -135,3 +200,11 @@ if (isset($_REQUEST['template'])) {
 		'templates' => $templates
 	));
 }
+
+function onTemplateMenusChange(): void
+{
+	$cache = Cache::getInstance();
+	if ($cache->enabled()) {
+		$cache->delete('template_menus');
+	}
+}

admin/pages/modules/balance.php

@@ -0,0 +1,15 @@
+<?php
+
+use MyAAC\Models\Player;
+
+defined('MYAAC') or die('Direct access not allowed!');
+
+$balance = 0;
+
+if ($db->hasColumn('players', 'balance')) {
+	$balance = Player::orderByDesc('balance')->limit(10)->get(['id', 'name', 'balance'])->toArray();
+}
+
+$twig->display('balance.html.twig', array(
+	'balance' => $balance
+));

admin/pages/modules/coins.php

@@ -1,9 +1,18 @@
 <?php
 
-if ($db->hasColumn('accounts', 'coins')) {
-	$coins = $db->query('SELECT `coins`, `' . (USE_ACCOUNT_NAME ? 'name' : 'id') . '` as `name` FROM `accounts` ORDER BY `coins` DESC LIMIT 10;');
-} else {
-	$coins = 0;
+use MyAAC\Models\Account;
+
+defined('MYAAC') or die('Direct access not allowed!');
+
+$coins = 0;
+
+if (HAS_ACCOUNT_COINS) {
+	$whatToGet = ['id', 'coins'];
+	if (USE_ACCOUNT_NAME) {
+		$whatToGet[] = 'name';
+	}
+
+	$coins = Account::orderByDesc('coins')->limit(10)->get($whatToGet)->toArray();
 }
 
 $twig->display('coins.html.twig', array(

admin/pages/modules/created.php

@@ -0,0 +1,15 @@
+<?php
+
+use MyAAC\Models\Account;
+
+defined('MYAAC') or die('Direct access not allowed!');
+
+$accounts = 0;
+
+if ($db->hasColumn('accounts', 'created')) {
+	$accounts = Account::orderByDesc('created')->limit(10)->get(['id', 'created'])->toArray();
+}
+
+$twig->display('created.html.twig', array(
+	'accounts' => $accounts,
+));

admin/pages/modules/lastlogin.php

@@ -1,9 +1,13 @@
 <?php
 
+use MyAAC\Models\Player;
+
+defined('MYAAC') or die('Direct access not allowed!');
+
+$players = 0;
+
 if ($db->hasColumn('players', 'lastlogin')) {
-	$players = $db->query('SELECT name, level, lastlogin FROM players ORDER BY lastlogin DESC LIMIT 10;');
-} else {
-	$players = 0;
+	$players = Player::orderByDesc('lastlogin')->limit(10)->get(['id', 'name', 'level', 'lastlogin'])->toArray();
 }
 
 $twig->display('lastlogin.html.twig', array(

admin/pages/modules/points.php

@@ -1,8 +1,13 @@
 <?php
+
+use MyAAC\Models\Account;
+
+defined('MYAAC') or die('Direct access not allowed!');
+
+$points = 0;
+
 if ($db->hasColumn('accounts', 'premium_points')) {
-	$points = $db->query('SELECT `premium_points`, `' . (USE_ACCOUNT_NAME ? 'name' : 'id') . '` as `name` FROM `accounts` ORDER BY `premium_points` DESC LIMIT 10;');
-} else {
-	$points = 0;
+	$coins = Account::orderByDesc('premium_points')->limit(10)->get(['premium_points', (USE_ACCOUNT_NAME ? 'name' : 'id')])->toArray();
 }
 
 $twig->display('points.html.twig', array(

admin/pages/modules/server_status.php

@@ -0,0 +1,46 @@
+<?php
+defined('MYAAC') or die('Direct access not allowed!');
+if (isset($status)) {
+
+	$error_icon = '<i class="fas fa-exclamation-circle text-danger"></i>'; ?>
+	<div class=" col-md-6 col-lg-6">
+		<div class="card card-info card-outline">
+			<div class="card-header border-bottom-0">
+				<span class="font-weight-bold m-0">Server Status</span> <span class="float-right small"><b>Last checked</b>: <?php echo(isset($status['lastCheck']) ? date("l, d.m.Y H:i:s", $status['lastCheck']) : $error_icon); ?></span>
+			</div>
+			<div class="card-body p-0 ">
+				<table class="table">
+					<tbody>
+					<tr>
+						<th width="30%">Server</th>
+						<td><?php echo(isset($status['server']) & isset($status['serverVersion']) ? $status['server'] . ' x ' . $status['serverVersion'] : $error_icon) ?></td>
+
+					</tr>
+					<tr>
+						<th>Client</th>
+						<td><?php echo(isset($status['clientVersion']) ? $status['clientVersion'] : $error_icon) ?></td>
+					</tr>
+					<tr>
+						<th>Map</th>
+						<td>
+							<?php if (isset($status['mapName']) & isset($status['mapAuthor']) & isset($status['mapWidth']) & isset($status['mapHeight'])) {
+								echo $status['mapName'] . ' by <b>' . $status['mapAuthor'] . '</b><br/>' . $status['mapWidth'] . ' x ' . $status['mapHeight'];
+							} else {
+								echo $error_icon;
+							} ?>
+						</td>
+					</tr>
+					<tr>
+						<th>Monsters</th>
+						<td><?php echo (isset($status['monsters']) ? $status['monsters'] : $error_icon); ?></td>
+					</tr>
+					<tr>
+						<th>MOTD:</th>
+						<td><?php echo(isset($status['motd']) ? $status['motd'] : $error_icon); ?></td>
+					</tr>
+					</tbody>
+				</table>
+			</div>
+		</div>
+	</div>
+<?php } ?>

admin/pages/modules/statistics.php

@@ -0,0 +1,21 @@
+<?php
+
+use MyAAC\Models\Account;
+use MyAAC\Models\Guild;
+use MyAAC\Models\House;
+use MyAAC\Models\Monster;
+use MyAAC\Models\Player;
+
+defined('MYAAC') or die('Direct access not allowed!');
+$count = $eloquentConnection->query()
+	->select([
+		'total_accounts' => Account::selectRaw('COUNT(id)'),
+		'total_players' => Player::selectRaw('COUNT(id)'),
+		'total_guilds' => Guild::selectRaw('COUNT(id)'),
+		'total_monsters' => Monster::selectRaw('COUNT(id)'),
+		'total_houses' => House::selectRaw('COUNT(id)'),
+	])->first();
+
+$twig->display('statistics.html.twig', array(
+	'count' => $count,
+));

admin/pages/modules/templates/balance.html.twig

@@ -0,0 +1,31 @@
+{% if balance is iterable %}
+	<div class=" col-md-6 col-lg-3">
+		<div class="card card-info card-outline">
+			<div class="card-header">
+				<h5 class="m-0">Top 10 - Balance</h5>
+			</div>
+			<div class="card-body p-0">
+				<table class="table table-striped table-condensed">
+					<thead>
+					<tr>
+						<th>#</th>
+						<th>Player</th>
+						<th>Balance</th>
+					</tr>
+					</thead>
+					<tbody>
+					{% set i = 0 %}
+					{% for result in balance %}
+						{% set i = i + 1 %}
+						<tr>
+							<th>{{ i }}</th>
+							<td><a href="?p=players&id={{ result.id }}">{{ result.name }}</a></td>
+							<td>{{ result.balance }}</td>
+						</tr>
+					{% endfor %}
+					</tbody>
+				</table>
+			</div>
+		</div>
+	</div>
+{% endif %}

admin/pages/modules/templates/coins.html.twig

@@ -1,23 +1,25 @@
 {% if coins is iterable %}
-	<div class="col-md-3">
-		<div class="box">
-			<div class="box-header">
-				<h3 class="box-title">Top 10 - Most coins</h3>
+	<div class=" col-md-6 col-lg-3">
+		<div class="card card-info card-outline">
+			<div class="card-header">
+				<h5 class="m-0">Top 10 - Most coins</h5>
 			</div>
-			<div class="box-body no-padding">
-				<table class="table table-condensed">
-					<tbody>
+			<div class="card-body p-0">
+				<table class="table table-striped table-condensed">
+					<thead>
 					<tr>
 						<th>#</th>
-						<th>Account {{ account_type }}</th>
+						<th>Account</th>
 						<th>Tibia coins</th>
 					</tr>
+					</thead>
+					<tbody>
 					{% set i = 0 %}
 					{% for result in coins %}
 						{% set i = i + 1 %}
 						<tr>
-							<td>{{ i }}</td>
-							<td>{{ result.name }}</td>
+							<th>{{ i }}</th>
+							<td><a href="?p=accounts&id={{ result.id }}">{{ result.name ?? result.id }}</a></td>
 							<td>{{ result.coins }}</td>
 						</tr>
 					{% endfor %}

admin/pages/modules/templates/created.html.twig

@@ -0,0 +1,31 @@
+{% if accounts is iterable %}
+	<div class=" col-md-6 col-lg-3">
+		<div class="card card-info card-outline">
+			<div class="card-header">
+				<h5 class="m-0">Last 10 created</h5>
+			</div>
+			<div class="card-body p-0">
+				<table class="table table-striped table-condensed">
+					<thead>
+					<tr>
+						<th>#</th>
+						<th>Account</th>
+						<th>Creation Date</th>
+					</tr>
+					</thead>
+					<tbody>
+					{% set i = 0 %}
+					{% for result in accounts %}
+						{% set i = i + 1 %}
+						<tr>
+							<th>{{ i }}</th>
+							<td><a href="?p=accounts&id={{ result.id }}">{{ result.id }}</a></td>
+							<td>{{ result.created|date("M d Y, H:i:s") }}</td>
+						</tr>
+					{% endfor %}
+					</tbody>
+				</table>
+			</div>
+		</div>
+	</div>
+{% endif %}

admin/pages/modules/templates/lastlogin.html.twig

@@ -1,23 +1,25 @@
 {% if players is iterable %}
-	<div class="col-md-3">
-		<div class="box">
-			<div class="box-header">
-				<h3 class="box-title">Last 10 Logins</h3>
+	<div class=" col-md-6 col-lg-3">
+		<div class="card card-info card-outline">
+			<div class="card-header">
+				<h5 class="m-0">Last 10 logins</h5>
 			</div>
-			<div class="box-body no-padding">
-				<table class="table table-condensed">
-					<tbody>
+			<div class="card-body p-0">
+				<table class="table table-striped table-condensed">
+					<thead>
 					<tr>
 						<th>#</th>
 						<th>Player</th>
 						<th>Login Date</th>
 					</tr>
+					</thead>
+					<tbody>
 					{% set i = 0 %}
 					{% for result in players %}
 						{% set i = i + 1 %}
 						<tr>
-							<td>{{ i }}</td>
-							<td>{{ result.name }}</td>
+							<th>{{ i }}</th>
+							<td><a href="?p=players&id={{ result.id }}">{{ result.name }}</a></td>
 							<td>{{ result.lastlogin|date("M d Y, H:i:s") }}</td>
 						</tr>
 					{% endfor %}

admin/pages/modules/templates/points.html.twig

@@ -1,23 +1,25 @@
 {% if points is iterable %}
-	<div class="col-md-3">
-		<div class="box">
-			<div class="box-header">
-				<h3 class="box-title">Top 10 - Most premium points</h3>
+	<div class=" col-md-6 col-lg-3">
+		<div class="card card-info card-outline">
+			<div class="card-header">
+				<h5 class="m-0">Top 10 - Most premium points</h5>
 			</div>
-			<div class="box-body no-padding">
-				<table class="table table-condensed">
-					<tbody>
+			<div class="card-body p-0">
+				<table class="table table-striped table-condensed">
+					<thead>
 					<tr>
 						<th>#</th>
-						<th>Account {{ account_type }}</th>
+						<th>Account</th>
 						<th>Premium points</th>
 					</tr>
+					</thead>
+					<tbody>
 					{% set i = 0 %}
 					{% for result in points %}
 						{% set i = i + 1 %}
 						<tr>
-							<td>{{ i }}</td>
-							<td>{{ result.name }}</td>
+							<th>{{ i }}</th>
+							<td><a href="?p=accounts&id={{ result.id }}">{{ result.name }}</a></td>
 							<td>{{ result.premium_points }}</td>
 						</tr>
 					{% endfor %}

admin/pages/modules/templates/statistics.html.twig

@@ -0,0 +1,45 @@
+<div class="col">
+	<div class="info-box">
+		<span class="info-box-icon bg-info elevation-1"><i class="fas fa-user-plus"></i></span>
+		<div class="info-box-content">
+			<span class="info-box-text">Accounts:</span>
+			<span class="info-box-number">{{ count.total_accounts }}</span>
+		</div>
+	</div>
+</div>
+<div class="col">
+	<div class="info-box">
+		<span class="info-box-icon bg-red elevation-1"><i class="fas fa-user-plus"></i></span>
+		<div class="info-box-content">
+			<span class="info-box-text">Players:</span>
+			<span class="info-box-number">{{ count.total_players }}</span>
+		</div>
+	</div>
+</div>
+<div class="col">
+	<div class="info-box">
+		<span class="info-box-icon bg-teal elevation-1"><i class="fas fa-pastafarianism"></i></span>
+		<div class="info-box-content">
+			<span class="info-box-text">Monsters:</span>
+			<span class="info-box-number">{{ count.total_monsters }}</span>
+		</div>
+	</div>
+</div>
+<div class="col">
+	<div class="info-box">
+		<span class="info-box-icon bg-green elevation-1"><i class="fas fa-chart-pie"></i></span>
+		<div class="info-box-content">
+			<span class="info-box-text">Guilds:</span>
+			<span class="info-box-number">{{ count.total_guilds }}</span>
+		</div>
+	</div>
+</div>
+<div class="col">
+	<div class="info-box">
+		<span class="info-box-icon bg-yellow elevation-1"><i class="fas fa-home"></i></span>
+		<div class="info-box-content">
+			<span class="info-box-text">Houses:</span>
+			<span class="info-box-number">{{ count.total_houses }}</span>
+		</div>
+	</div>
+</div>

admin/pages/modules/templates/web_status.twig

@@ -0,0 +1,43 @@
+<div class="col-12 col-md-6">
+	<div class="card card-warning card-outline">
+		<div class="card-header">
+			<span class="m-0">Website Status<span class="float-right">
+			<div class="custom-control custom-switch custom-switch-off-danger custom-switch-on-success">
+				<input form="maintenance-form" type="checkbox" class="custom-control-input" name="status" id="status" value="true" {% if not is_closed %} checked{% endif %}>
+				<label id="status-label" class="custom-control-label" for="status"> {% if is_closed %}Closed{% else %}Open{% endif %}</label>
+			</div></span>
+			</span>
+		</div>
+		<div class="card-body p-2">
+			<div class="col-sm-12">
+				<label for="message" class="col-form-label">Maintenance Message</label>
+				<textarea form="maintenance-form" name="message" class="form-control" cols="40" rows="3" maxlength="255" placeholder="Enter ...">{{ closed_message }}</textarea>
+				<small>(only visible if closed)</small>
+			</div>
+		</div>
+		<div class="card-footer">
+			<form id="maintenance-form" method="post" action="?p=dashboard" class="float-left">
+				{{ csrf() }}
+				<input type="hidden" name="maintenance" value="1" />
+				<button type="submit" class="btn btn-info"><i class="far fa-update"></i> Update</button>
+			</form>
+			<form method="post" action="?p=dashboard" class="float-right">
+				{{ csrf() }}
+				<input type="hidden" name="clear_cache" value="1" />
+				<button type="submit" onclick="return confirm('Are you sure that you want to clear cache?');" class="btn btn-danger" title="Clear Cache"><i class="fas fa-clear"></i>Clear cache</button>
+			</form>
+		</div>
+	</div>
+</div>
+
+<script>
+	$(function() {
+		$("#status").change(function() {
+			$statusLabel = $("#status-label");
+			$statusLabel.html("Closed");
+			if ($(this).is(':checked')) {
+				$statusLabel.html("Open");
+			}
+		});
+	});
+</script>

admin/pages/modules/web_status.php

@@ -0,0 +1,10 @@
+<?php
+defined('MYAAC') or die('Direct access not allowed!');
+
+$twig->display('web_status.twig', array(
+	'is_closed' => $is_closed,
+	'closed_message' => $closed_message,
+	'status' => $status,
+	'account_type' => USE_ACCOUNT_NAME ? 'name' : 'number'
+));
+?>

admin/pages/news.php

@@ -7,13 +7,18 @@
  * @copyright 2019 MyAAC
  * @link      https://my-aac.org
  */
+
+use MyAAC\Forum;
+use MyAAC\News;
+
 defined('MYAAC') or die('Direct access not allowed!');
 
-require_once LIBS . 'forum.php';
-require_once LIBS . 'news.php';
-
 $title = 'News Panel';
 
+csrfProtect();
+
+$use_datatable = true;
+
 if (!hasFlag(FLAG_CONTENT_PAGES) && !superAdmin()) {
 	echo 'Access denied.';
 	return;
@@ -21,81 +26,80 @@ if (!hasFlag(FLAG_CONTENT_PAGES) && !superAdmin()) {
 
 header('X-XSS-Protection:0');
 
-// some constants, used mainly by database (cannot by modified without schema changes)
-define('TITLE_LIMIT', 100);
-define('BODY_LIMIT', 65535); // maximum news body length
-define('ARTICLE_TEXT_LIMIT', 300);
-define('ARTICLE_IMAGE_LIMIT', 100);
+// some constants, used mainly by database (cannot be modified without schema changes)
+const NEWS_TITLE_LIMIT = 100;
+const NEWS_BODY_LIMIT = 65535; // maximum news body length
+const ARTICLE_TEXT_LIMIT = 300;
+const ARTICLE_IMAGE_LIMIT = 100;
 
 $name = $p_title = '';
 if(!empty($action))
 {
-	$id = isset($_REQUEST['id']) ? $_REQUEST['id'] : null;
-	$p_title = isset($_REQUEST['title']) ? $_REQUEST['title'] : null;
-	$body = isset($_REQUEST['body']) ? stripslashes($_REQUEST['body']) : null;
-	$comments = isset($_REQUEST['comments']) ? $_REQUEST['comments'] : null;
-	$type = isset($_REQUEST['type']) ? (int)$_REQUEST['type'] : null;
-	$category = isset($_REQUEST['category']) ? (int)$_REQUEST['category'] : null;
-	$player_id = isset($_REQUEST['player_id']) ? (int)$_REQUEST['player_id'] : null;
-	$article_text = isset($_REQUEST['article_text']) ? $_REQUEST['article_text'] : null;
-	$article_image = isset($_REQUEST['article_image']) ? $_REQUEST['article_image'] : null;
-	$forum_section = isset($_REQUEST['forum_section']) ? $_REQUEST['forum_section'] : null;
-	$errors = array();
+	$id = $_POST['id'] ?? null;
+	$p_title = $_POST['title'] ?? null;
+	$body = isset($_POST['body']) ? stripslashes($_POST['body']) : null;
+	$comments = $_POST['comments'] ?? null;
+	$type = isset($_REQUEST['type']) ? (int)$_REQUEST['type'] : 1;
+	$category = isset($_POST['category']) ? (int)$_POST['category'] : null;
+	$player_id = isset($_POST['player_id']) ? (int)$_POST['player_id'] : null;
+	$article_text = $_POST['article_text'] ?? null;
+	$article_image = $_POST['article_image'] ?? null;
+	$forum_section = $_POST['forum_section'] ?? null;
+	$errors = [];
 
-	if($action == 'add') {
-		if(isset($forum_section) && $forum_section != '-1') {
-			$forum_add = Forum::add_thread($p_title, $body, $forum_section, $player_id, $account_logged->getId(), $errors);
-		}
+	if (isRequestMethod('post')) {
+		if ($action == 'new') {
+			if (isset($forum_section) && $forum_section != '-1') {
+				$forum_add = Forum::add_thread($p_title, $body, $forum_section, $player_id, $account_logged->getId(), $errors);
+			}
 
-		if(News::add($p_title, $body, $type, $category, $player_id, isset($forum_add) && $forum_add != 0 ? $forum_add : 0, $article_text, $article_image, $errors)) {
-			$p_title = $body = $comments = $article_text = $article_image = '';
-			$type = $category = $player_id = 0;
-
-			success("Added successful.");
-		}
-	}
-	else if($action == 'delete') {
-		News::delete($id, $errors);
-		success("Deleted successful.");
-	}
-	else if($action == 'edit')
-	{
-		if(isset($id) && !isset($p_title)) {
-			$news = News::get($id);
-			$p_title = $news['title'];
-			$body = $news['body'];
-			$comments = $news['comments'];
-			$type = $news['type'];
-			$category = $news['category'];
-			$player_id = $news['player_id'];
-			$article_text = $news['article_text'];
-			$article_image = $news['article_image'];
-		}
-		else {
-			if(News::update($id, $p_title, $body, $type, $category, $player_id, $forum_section, $article_text, $article_image, $errors)) {
-				// update forum thread if exists
-				if(isset($forum_section) && Validator::number($forum_section)) {
-					$db->query("UPDATE `" . TABLE_PREFIX . "forum` SET `author_guid` = ".(int) $player_id.", `post_text` = ".$db->quote($body).", `post_topic` = ".$db->quote($p_title).", `edit_date` = " . time() . " WHERE `id` = " . $db->quote($forum_section));
-				}
-
-				$action = $p_title = $body = $comments = $article_text = $article_image = '';
+			if (isset($p_title) && News::add($p_title, $body, $type, $category, $player_id, isset($forum_add) && $forum_add != 0 ? $forum_add : 0, $article_text, $article_image, $errors)) {
+				$p_title = $body = $comments = $article_text = $article_image = '';
 				$type = $category = $player_id = 0;
 
-				success("Updated successful.");
+				success('Added successful.');
+			}
+		} else if ($action == 'delete') {
+			if (News::delete($id, $errors)) {
+				success('Deleted successful.');
+			}
+		} else if ($action == 'edit') {
+			if (isset($id) && !isset($p_title)) {
+				$news = News::get($id);
+				$p_title = $news['title'];
+				$body = $news['body'];
+				$comments = $news['comments'];
+				$type = $news['type'];
+				$category = $news['category'];
+				$player_id = $news['player_id'];
+				$article_text = $news['article_text'];
+				$article_image = $news['article_image'];
+			} else {
+				if (News::update($id, $p_title, $body, $type, $category, $player_id, $forum_section, $article_text, $article_image, $errors)) {
+					// update forum thread if exists
+					if (isset($forum_section) && Validator::number($forum_section)) {
+						$db->query("UPDATE `" . TABLE_PREFIX . "forum` SET `author_guid` = " . (int)$player_id . ", `post_text` = " . $db->quote($body) . ", `post_topic` = " . $db->quote($p_title) . ", `edit_date` = " . time() . " WHERE `id` = " . $db->quote($forum_section));
+					}
+
+					$action = $p_title = $body = $comments = $article_text = $article_image = '';
+					$type = $category = $player_id = 0;
+
+					success('Updated successful.');
+				}
+			}
+		} else if ($action == 'hide') {
+			if (News::toggleHide($id, $errors, $status)) {
+				success(($status == 1 ? 'Hide' : 'Show') . ' successful.');
 			}
 		}
 	}
-	else if($action == 'hide') {
-		News::toggleHidden($id, $errors, $status);
-		success(($status == 1 ? 'Show' : 'Hide') . " successful.");
-	}
 
 	if(!empty($errors))
 		error(implode(", ", $errors));
 }
 
 $categories = array();
-foreach($db->query('SELECT `id`, `name`, `icon_id` FROM `' . TABLE_PREFIX . 'news_categories` WHERE `hidden` != 1') as $cat)
+foreach($db->query('SELECT `id`, `name`, `icon_id` FROM `' . TABLE_PREFIX . 'news_categories` WHERE `hide` != 1') as $cat)
 {
 	$categories[$cat['id']] = array(
 		'name' => $cat['name'],
@@ -113,39 +117,46 @@ if($action == 'edit' || $action == 'new') {
 	$account_players->orderBy('group_id', POT::ORDER_DESC);
 	$twig->display('admin.news.form.html.twig', array(
 		'action' => $action,
-		'news_link' => getLink(PAGE),
-		'news_link_form' => '?p=news&action=' . ($action == 'edit' ? 'edit' : 'add'),
-		'news_id' => isset($id) ? $id : null,
-		'title' => isset($p_title) ? $p_title : '',
+		'news_id' => $id ?? null,
+		'title' => $p_title ?? '',
 		'body' => isset($body) ? escapeHtml($body) : '',
-		'type' => isset($type) ? $type : null,
+		'type' => $type,
 		'player' => isset($player) && $player->isLoaded() ? $player : null,
-		'player_id' => isset($player_id) ? $player_id : null,
+		'player_id' => $player_id ?? null,
 		'account_players' => $account_players,
-		'category' => isset($category) ? $category : 0,
+		'category' => $category ?? 0,
 		'categories' => $categories,
 		'forum_boards' => getForumBoards(),
-		'forum_section' => isset($forum_section) ? $forum_section : null,
-		'comments' => isset($comments) ? $comments : null,
-		'article_text' => isset($article_text) ? $article_text : null,
-		'article_image' => isset($article_image) ? $article_image : null
+		'forum_section' => $forum_section ?? null,
+		'comments' => $comments ?? null,
+		'article_text' => $article_text ?? null,
+		'article_image' => $article_image ?? null
 	));
 }
 
 $query = $db->query('SELECT * FROM ' . $db->tableName(TABLE_PREFIX . 'news'));
 $newses = array();
+
+$cachePlayers = [];
 foreach ($query as $_news) {
-	$_player = new OTS_Player();
-	$_player->load($_news['player_id']);
+	$playerId = $_news['player_id'];
+	if (isset($cachePlayers[$playerId])) {
+		$_player = $cachePlayers[$playerId];
+	}
+	else {
+		$_player = new OTS_Player();
+		$_player->load($playerId);
+		$cachePlayers[$playerId] = $_player;
+	}
 
 	$newses[$_news['type']][] = array(
 		'id' => $_news['id'],
-		'hidden' => $_news['hidden'],
+		'hide' => $_news['hide'],
 		'archive_link' => getLink('news') . '/archive/' . $_news['id'],
 		'title' => $_news['title'],
 		'date' => $_news['date'],
-		'player_name' => isset($_player) && $_player->isLoaded() ? $_player->getName() : '',
-		'player_link' => isset($_player) && $_player->isLoaded() ? getPlayerLink($_player->getName(), false) : '',
+		'player_name' => $_player->isLoaded() ? $_player->getName() : '',
+		'player_link' => $_player->isLoaded() ? getPlayerLink($_player, false) : '',
 	);
 }
 

admin/pages/notepad.php

@@ -7,46 +7,35 @@
  * @copyright 2019 MyAAC
  * @link      https://my-aac.org
  */
+
+use MyAAC\Models\Notepad as ModelsNotepad;
+
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Notepad';
 
-$notepad_content = Notepad::get($account_logged->getId());
+csrfProtect();
+
+/**
+ * @var OTS_Account $account_logged
+ */
+$_content = '';
+$notepad = ModelsNotepad::where('account_id', $account_logged->getId())->first();
 if (isset($_POST['content'])) {
 	$_content = html_entity_decode(stripslashes($_POST['content']));
-	if (!$notepad_content)
-		Notepad::create($account_logged->getId(), $_content);
-	else
-		Notepad::update($account_logged->getId(), $_content);
+	if (!$notepad) {
+		ModelsNotepad::create([
+			'account_id' => $account_logged->getId(),
+			'content' => $_content
+		]);
+	}
+	else {
+		ModelsNotepad::where('account_id', $account_logged->getId())->update(['content' => $_content]);
+	}
 
-	echo '<div class="success" style="text-align: center;">Saved at ' . date('H:i') . '</div>';
+	success('Saved at ' . date('H:i'));
 } else {
-	if ($notepad_content !== false)
-		$_content = $notepad_content;
+	if ($notepad)
+		$_content = $notepad->content;
 }
 
-$twig->display('admin.notepad.html.twig', array('content' => isset($_content) ? $_content : null));
-
-class Notepad
-{
-	static public function get($account_id)
-	{
-		global $db;
-		$query = $db->select(TABLE_PREFIX . 'notepad', array('account_id' => $account_id));
-		if ($query !== false)
-			return $query['content'];
-
-		return false;
-	}
-
-	static public function create($account_id, $content = '')
-	{
-		global $db;
-		$db->insert(TABLE_PREFIX . 'notepad', array('account_id' => $account_id, 'content' => $content));
-	}
-
-	static public function update($account_id, $content = '')
-	{
-		global $db;
-		$db->update(TABLE_PREFIX . 'notepad', array('content' => $content), array('account_id' => $account_id));
-	}
-}
+$twig->display('admin.notepad.html.twig', ['content' => $_content]);

admin/pages/open_source.php

@@ -1,15 +1,14 @@
 <?php
 /**
- * Account confirm mail
- * Keept for compatibility
+ * Open Source libraries
  *
  * @package   MyAAC
  * @author    Slawkens <slawkens@gmail.com>
- * @copyright 2019 MyAAC
+ * @copyright 2023 MyAAC
  * @link      https://my-aac.org
  */
 defined('MYAAC') or die('Direct access not allowed!');
 
-if($action == 'confirm_email') {
-	require_once PAGES . 'account/confirm_email.php';
-}
+$title = 'Open Source';
+
+$twig->display('admin.open_source.html.twig');

admin/pages/pages.php

@@ -7,8 +7,15 @@
  * @copyright 2019 MyAAC
  * @link      https://my-aac.org
  */
+
+use MyAAC\Models\Pages as ModelsPages;
+use MyAAC\Admin\Pages;
+
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Pages';
+$use_datatable = true;
+
+csrfProtect();
 
 if (!hasFlag(FLAG_CONTENT_PAGES) && !superAdmin()) {
 	echo 'Access denied.';
@@ -17,50 +24,61 @@ if (!hasFlag(FLAG_CONTENT_PAGES) && !superAdmin()) {
 
 header('X-XSS-Protection:0');
 
-$name = $p_title = '';
+$name = $p_title = null;
 $groups = new OTS_Groups_List();
 
 $php = false;
 $enable_tinymce = true;
 $access = 0;
 
-if (!empty($action)) {
-	if ($action == 'delete' || $action == 'edit' || $action == 'hide')
-		$id = $_REQUEST['id'];
+// some constants, used mainly by database (cannot by modified without schema changes)
+const PAGE_TITLE_LIMIT = 30;
+const PAGE_NAME_LIMIT = 30;
+const PAGE_BODY_LIMIT = 65535; // maximum page body length
 
-	if (isset($_REQUEST['name']))
-		$name = $_REQUEST['name'];
-
-	if (isset($_REQUEST['title']))
-		$p_title = $_REQUEST['title'];
-
-	$php = isset($_REQUEST['php']) && $_REQUEST['php'] == 1;
-	$enable_tinymce = isset($_REQUEST['enable_tinymce']) && $_REQUEST['enable_tinymce'] == 1;
-	if ($php)
-		$body = $_REQUEST['body'];
-	else if (isset($_REQUEST['body'])) {
-		//$body = $_REQUEST['body'];
-		$body = html_entity_decode(stripslashes($_REQUEST['body']));
+if (!empty($action) && isRequestMethod('post')) {
+	if ($action == 'delete' || $action == 'edit' || $action == 'hide') {
+		$id = $_POST['id'];
 	}
 
-	if (isset($_REQUEST['access']))
-		$access = $_REQUEST['access'];
+	if (isset($_POST['name'])) {
+		$name = $_POST['name'];
+	}
+
+	if (isset($_POST['title'])) {
+		$p_title = $_POST['title'];
+	}
+
+	$php = isset($_POST['php']) && $_POST['php'] == 1;
+	$enable_tinymce = (isset($_POST['enable_tinymce']) && $_POST['enable_tinymce'] == 1) ?: $enable_tinymce;
+	if ($php) {
+		$body = $_POST['body'];
+	}
+	else if (isset($_POST['body'])) {
+		//$body = $_POST['body'];
+		$body = html_entity_decode(stripslashes($_POST['body']));
+	}
+
+	if (isset($_POST['access'])) {
+		$access = $_POST['access'];
+	}
 
 	$errors = array();
 	$player_id = 1;
 
-	if ($action == 'add') {
-		if (Pages::add($name, $p_title, $body, $player_id, $php, $enable_tinymce, $access, $errors)) {
+	if ($action == 'new') {
+		if (isset($p_title) && Pages::add($name, $p_title, $body, $player_id, $php, $enable_tinymce, $access, $errors)) {
 			$name = $p_title = $body = '';
 			$player_id = $access = 0;
 			$php = false;
 			$enable_tinymce = true;
+			success('Added successful.');
 		}
 	} else if ($action == 'delete') {
 		if (Pages::delete($id, $errors))
 			success('Page with id ' . $id . ' has been deleted');
 	} else if ($action == 'edit') {
-		if (isset($id) && !isset($_REQUEST['name'])) {
+		if (isset($id) && !isset($_POST['name'])) {
 			$_page = Pages::get($id);
 			$name = $_page['name'];
 			$p_title = $_page['title'];
@@ -69,36 +87,36 @@ if (!empty($action)) {
 			$enable_tinymce = $_page['enable_tinymce'] == '1';
 			$access = $_page['access'];
 		} else {
-			Pages::update($id, $name, $p_title, $body, $player_id, $php, $enable_tinymce, $access);
-			$action = $name = $p_title = $body = '';
-			$player_id = 1;
-			$access = 0;
-			$php = false;
-			$enable_tinymce = true;
+			if(Pages::update($id, $name, $p_title, $body, $player_id, $php, $enable_tinymce, $access, $errors)) {
+				$action = $name = $p_title = $body = '';
+				$player_id = 1;
+				$access = 0;
+				$php = false;
+				$enable_tinymce = true;
+				success('Updated successful.');
+			}
 		}
 	} else if ($action == 'hide') {
-		Pages::toggleHidden($id, $errors);
+		if (Pages::toggleHide($id, $errors, $status)) {
+			success(($status == 0 ? 'Show' : 'Hide') . ' successful.');
+		}
 	}
 
 	if (!empty($errors))
 		error(implode(", ", $errors));
 }
 
-$query =
-	$db->query('SELECT * FROM ' . $db->tableName(TABLE_PREFIX . 'pages'));
+$pages = ModelsPages::all()->map(function ($e) {
+	return [
+		'link' => getFullLink($e->name, $e->name, true),
+		'title' => substr($e->title, 0, 20),
+		'php' => $e->php == '1',
+		'id' => $e->id,
+		'hide' => $e->hide
+	];
+})->toArray();
 
-$pages = array();
-foreach ($query as $_page) {
-	$pages[] = array(
-		'link' => getFullLink($_page['name'], $_page['name'], true),
-		'title' => substr($_page['title'], 0, 20),
-		'php' => $_page['php'] == '1',
-		'id' => $_page['id'],
-		'hidden' => $_page['hidden']
-	);
-}
-
-$twig->display('admin.pages.form.html.twig', array(
+$twig->display('admin.pages.form.html.twig', [
 	'action' => $action,
 	'id' => $action == 'edit' ? $id : null,
 	'name' => $name,
@@ -108,91 +126,8 @@ $twig->display('admin.pages.form.html.twig', array(
 	'body' => isset($body) ? escapeHtml($body) : '',
 	'groups' => $groups->getGroups(),
 	'access' => $access
-));
+]);
 
-$twig->display('admin.pages.html.twig', array(
+$twig->display('admin.pages.html.twig', [
 	'pages' => $pages
-));
-
-class Pages
-{
-	static public function get($id)
-	{
-		global $db;
-		$query = $db->select(TABLE_PREFIX . 'pages', array('id' => $id));
-		if ($query !== false)
-			return $query;
-
-		return false;
-	}
-
-	static public function add($name, $title, $body, $player_id, $php, $enable_tinymce, $access, &$errors)
-	{
-		global $db;
-		if (isset($name[0]) && isset($title[0]) && isset($body[0]) && $player_id != 0) {
-			$query = $db->select(TABLE_PREFIX . 'pages', array('name' => $name));
-			if ($query === false)
-				$db->insert(TABLE_PREFIX . 'pages',
-					array(
-						'name' => $name,
-						'title' => $title,
-						'body' => $body,
-						'player_id' => $player_id,
-						'php' => $php ? '1' : '0',
-						'enable_tinymce' => $enable_tinymce ? '1' : '0',
-						'access' => $access
-					)
-				);
-			else
-				$errors[] = 'Page with this link already exists.';
-		} else
-			$errors[] = 'Please fill all inputs.';
-
-		return !count($errors);
-	}
-
-	static public function update($id, $name, $title, $body, $player_id, $php, $enable_tinymce, $access)
-	{
-		global $db;
-		$db->update(TABLE_PREFIX . 'pages',
-			array(
-				'name' => $name,
-				'title' => $title,
-				'body' => $body,
-				'player_id' => $player_id,
-				'php' => $php ? '1' : '0',
-				'enable_tinymce' => $enable_tinymce ? '1' : '0',
-				'access' => $access
-			),
-			array('id' => $id));
-	}
-
-	static public function delete($id, &$errors)
-	{
-		global $db;
-		if (isset($id)) {
-			if ($db->select(TABLE_PREFIX . 'pages', array('id' => $id)) !== false)
-				$db->delete(TABLE_PREFIX . 'pages', array('id' => $id));
-			else
-				$errors[] = 'Page with id ' . $id . ' does not exists.';
-		} else
-			$errors[] = 'id not set';
-
-		return !count($errors);
-	}
-
-	static public function toggleHidden($id, &$errors)
-	{
-		global $db;
-		if (isset($id)) {
-			$query = $db->select(TABLE_PREFIX . 'pages', array('id' => $id));
-			if ($query !== false)
-				$db->update(TABLE_PREFIX . 'pages', array('hidden' => ($query['hidden'] == 1 ? 0 : 1)), array('id' => $id));
-			else
-				$errors[] = 'Page with id ' . $id . ' does not exists.';
-		} else
-			$errors[] = 'id not set';
-
-		return !count($errors);
-	}
-}
+]);

admin/pages/phpinfo.php

@@ -16,4 +16,4 @@ if (!function_exists('phpinfo')) { ?>
 	<?php return;
 }
 ?>
-<iframe src="<?php echo BASE_URL; ?>admin/tools/phpinfo.php" width="1024" height="550"/>
+<iframe src="<?php echo ADMIN_URL; ?>tools/phpinfo.php" width="1024" height="550"></iframe>

admin/pages/plugins.php

@@ -7,101 +7,185 @@
  * @copyright 2019 MyAAC
  * @link      https://my-aac.org
  */
+
+use MyAAC\Plugins;
+
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Plugin manager';
 
-$twig->display('admin.plugins.form.html.twig');
+csrfProtect();
 
-if (isset($_REQUEST['uninstall'])) {
-	$uninstall = $_REQUEST['uninstall'];
+$use_datatable = true;
 
-	if (Plugins::uninstall($uninstall)) {
-		success('Successfully uninstalled plugin ' . $uninstall);
-	} else {
-		error('Error while uninstalling plugin ' . $uninstall . ': ' . Plugins::getError());
+if (!setting('core.admin_plugins_manage_enable')) {
+	warning('Plugin installation and management is disabled in Settings.<br/>If you wish to enable, go to Settings and enable <strong>Enable Plugins Manage</strong>.');
+}
+else {
+	$pluginUploadEnabled = true;
+	if(!\class_exists('\ZipArchive')) {
+		error('Please install PHP zip extension. Plugins upload disabled until then.');
+		$pluginUploadEnabled = false;
 	}
-} else if (isset($_FILES["plugin"]["name"])) {
-	$file = $_FILES["plugin"];
-	$filename = $file["name"];
-	$tmp_name = $file["tmp_name"];
-	$type = $file["type"];
 
-	$name = explode(".", $filename);
-	$accepted_types = array('application/zip', 'application/x-zip-compressed', 'multipart/x-zip', 'application/x-compressed', 'application/octet-stream', 'application/zip-compressed');
+	$twig->display('admin.plugins.form.html.twig', ['pluginUploadEnabled' => $pluginUploadEnabled]);
 
-	if (isset($file['error'])) {
-		$error = 'Error uploading file';
-		switch ($file['error']) {
-			case UPLOAD_ERR_OK:
-				$error = false;
-				break;
-			case UPLOAD_ERR_INI_SIZE:
-			case UPLOAD_ERR_FORM_SIZE:
-				$error .= ' - file too large (limit of ' . ini_get('upload_max_filesize') . ' bytes). You can enlarge the limits by changing "upload_max_filesize" in php.ini';
-				break;
-			case UPLOAD_ERR_PARTIAL:
-				$error .= ' - file upload was not completed.';
-				break;
-			case UPLOAD_ERR_NO_FILE:
-				$error .= ' - zero-length file uploaded.';
-				break;
-			default:
-				$error .= ' - internal error #' . $file['error'];
-				break;
+	if (isset($_POST['uninstall'])) {
+		$uninstall = $_POST['uninstall'];
+
+		if (Plugins::uninstall($uninstall)) {
+			success('Successfully uninstalled plugin ' . $uninstall);
+		} else {
+			error('Error while uninstalling plugin ' . $uninstall . ': ' . Plugins::getError());
+		}
+	} else if (isset($_POST['enable'])) {
+		$enable = $_POST['enable'];
+		if (Plugins::enable($enable)) {
+			success('Successfully enabled plugin ' . $enable);
+		} else {
+			error('Error while enabling plugin ' . $enable . ': ' . Plugins::getError());
+		}
+	} else if (isset($_POST['disable'])) {
+		$disable = $_POST['disable'];
+		if (Plugins::disable($disable)) {
+			success('Successfully disabled plugin ' . $disable);
+		} else {
+			error('Error while disabling plugin ' . $disable . ': ' . Plugins::getError());
 		}
 	}
+	else if (isset($_GET['check-updates'])) {
+		$repoUri = $config['admin_plugins_api_uri'] ?? 'https://plugins.my-aac.org/api/';
+		success("Fetching latest info from $repoUri..");
 
-	if (isset($error) && $error != false) {
-		error($error);
-	} else {
-		if (is_uploaded_file($file['tmp_name'])) {
-			$filetype = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
-			if ($filetype == 'zip') // check if it is zipped/compressed file
-			{
-				$tmp_filename = pathinfo($filename, PATHINFO_FILENAME);
-				$targetzip = BASE . 'plugins/' . $tmp_filename . '.zip';
+		$adminPlugins = new \MyAAC\Admin\Plugins();
 
-				if (move_uploaded_file($tmp_name, $targetzip)) { // move uploaded file
-					if (Plugins::install($targetzip)) {
-						foreach (Plugins::getWarnings() as $warning) {
-							warning($warning);
+		$adminPlugins->setApiBaseUri($repoUri);
+
+		try {
+			$plugins = $adminPlugins->getLatestVersions();
+		}
+		catch (Exception $e) {
+			error($e->getMessage());
+		}
+
+		if (isset($plugins) && count($plugins) > 0) {
+			$outdated = [];
+
+			foreach (get_plugins(true) as $plugin) {
+				$string = file_get_contents(BASE . 'plugins/' . $plugin . '.json');
+				$plugin_info = json_decode($string, true);
+
+				if (!$plugin_info) {
+					continue;
+				}
+
+				$disabled = (str_contains($plugin, 'disabled.'));
+				$pluginOriginal = ($disabled ? str_replace('disabled.', '', $plugin) : $plugin);
+
+				$info = $plugins[$pluginOriginal] ?? false;
+				if ($info && version_compare($info['version'], $plugin_info['version'], '>')) {
+					$outdated[] = [
+						'name' => $pluginOriginal,
+						'yourVersion' => $plugin_info['version'],
+						'latestVersion' => $info['version'],
+						'link' => $info['link'] ?? 'Unknown',
+						'download_link' => $info['download_link'] ?? 'Unknown',
+					];
+				}
+			}
+
+			if (count($outdated) > 0) {
+				info('Following updates have been found for your plugins:');
+				$twig->display('admin.plugins.outdated.html.twig', ['plugins' => $outdated]);
+			}
+			else {
+				success('All plugins up to date!');
+			}
+		}
+	} else if (isset($_FILES['plugin']['name'])) {
+		$file = $_FILES['plugin'];
+		$filename = $file['name'];
+		$tmp_name = $file['tmp_name'];
+		$type = $file['type'];
+
+		$name = explode('.', $filename);
+		$accepted_types = array('application/zip', 'application/x-zip-compressed', 'multipart/x-zip', 'application/x-compressed', 'application/octet-stream', 'application/zip-compressed');
+
+		if (isset($file['error'])) {
+			$error = 'Error uploading file';
+			switch ($file['error']) {
+				case UPLOAD_ERR_OK:
+					$error = false;
+					break;
+				case UPLOAD_ERR_INI_SIZE:
+				case UPLOAD_ERR_FORM_SIZE:
+					$error .= ' - file too large (limit of ' . ini_get('upload_max_filesize') . ' bytes). You can enlarge the limits by changing "upload_max_filesize" in php.ini';
+					break;
+				case UPLOAD_ERR_PARTIAL:
+					$error .= ' - file upload was not completed.';
+					break;
+				case UPLOAD_ERR_NO_FILE:
+					$error .= ' - zero-length file uploaded.';
+					break;
+				default:
+					$error .= ' - internal error #' . $file['error'];
+					break;
+			}
+		}
+
+		if (isset($error) && $error != false) {
+			error($error);
+		} else {
+			if (is_uploaded_file($file['tmp_name'])) {
+				$filetype = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
+				if ($filetype == 'zip') // check if it is zipped/compressed file
+				{
+					$tmp_filename = pathinfo($filename, PATHINFO_FILENAME);
+					$targetzip = BASE . 'plugins/' . $tmp_filename . '.zip';
+
+					if (move_uploaded_file($tmp_name, $targetzip)) { // move uploaded file
+						if (Plugins::install($targetzip)) {
+							foreach (Plugins::getWarnings() as $warning) {
+								warning($warning);
+							}
+
+							$info = Plugins::getPluginJson();
+							success((isset($info['name']) ? '<strong>' . $info['name'] . '</strong> p' : 'P') . 'lugin has been successfully installed.');
+						} else {
+							$error = Plugins::getError();
+							error(!empty($error) ? $error : 'Unexpected error happened while installing plugin. Please try again later.');
 						}
 
-						$info = Plugins::getPluginJson();
-						success((isset($info['name']) ? '<strong>' . $info['name'] . '</strong> p' : 'P') . 'lugin has been successfully installed.');
-					} else {
-						$error = Plugins::getError();
-						error(!empty($error) ? $error : 'Unexpected error happened while installing plugin. Please try again later.');
-					}
-
-					unlink($targetzip); // delete the Zipped file
-				} else
-					error('There was a problem with the upload. Please try again.');
+						unlink($targetzip); // delete the Zipped file
+					} else
+						error('There was a problem with the upload. Please try again.');
+				} else {
+					error('The file you are trying to upload is not a .zip file. Please try again.');
+				}
 			} else {
-				error('The file you are trying to upload is not a .zip file. Please try again.');
+				error('Error uploading file - unknown error.');
 			}
-		} else {
-			error('Error uploading file - unknown error.');
 		}
 	}
 }
 
 $plugins = array();
-foreach (get_plugins() as $plugin) {
+foreach (get_plugins(true) as $plugin) {
 	$string = file_get_contents(BASE . 'plugins/' . $plugin . '.json');
-	$string = Plugins::removeComments($string);
 	$plugin_info = json_decode($string, true);
 
-	if ($plugin_info == false) {
+	if (!$plugin_info) {
 		warning('Cannot load plugin info ' . $plugin . '.json');
 	} else {
+		$disabled = (str_contains($plugin, 'disabled.'));
+		$pluginOriginal = ($disabled ? str_replace('disabled.', '', $plugin) : $plugin);
 		$plugins[] = array(
-			'name' => isset($plugin_info['name']) ? $plugin_info['name'] : '',
-			'description' => isset($plugin_info['description']) ? $plugin_info['description'] : '',
-			'version' => isset($plugin_info['version']) ? $plugin_info['version'] : '',
-			'author' => isset($plugin_info['author']) ? $plugin_info['author'] : '',
-			'contact' => isset($plugin_info['contact']) ? $plugin_info['contact'] : '',
-			'file' => $plugin,
+			'name' => $plugin_info['name'] ?? '',
+			'description' => $plugin_info['description'] ?? '',
+			'version' => $plugin_info['version'] ?? '',
+			'author' => $plugin_info['author'] ?? '',
+			'contact' => $plugin_info['contact'] ?? '',
+			'file' => $pluginOriginal,
+			'enabled' => !$disabled,
 			'uninstall' => isset($plugin_info['uninstall'])
 		);
 	}

admin/pages/reports.php

@@ -4,35 +4,36 @@
  *
  * @package   MyAAC
  * @author    Lee
- * @copyright 2019 MyAAC
+ * @copyright 2020 MyAAC
  * @link      https://my-aac.org
  */
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Report Viewer';
+$use_datatable = true;
 
 $files = array();
 $server_path_reports = $config['data_path'] . 'reports/';
 
 if (file_exists($server_path_reports)) {
-    foreach (scandir($server_path_reports, SCANDIR_SORT_ASCENDING) as $f) {
-        if ($f[0] === '.') {
-	        continue;
-        }
+	foreach (scandir($server_path_reports, SCANDIR_SORT_ASCENDING) as $f) {
+		if ($f[0] === '.') {
+			continue;
+		}
 
-        if (is_dir($server_path_reports . $f)) {
-            foreach (scandir($server_path_reports . $f, SCANDIR_SORT_ASCENDING) as $f2) {
-                if ($f2[0] === '.') {
-	                continue;
-                }
+		if (is_dir($server_path_reports . $f)) {
+			foreach (scandir($server_path_reports . $f, SCANDIR_SORT_ASCENDING) as $f2) {
+				if ($f2[0] === '.') {
+					continue;
+				}
 
-                $files[] = array($f . '/' . $f2, $server_path_reports);
-            }
+				$files[] = array($f . '/' . $f2, $server_path_reports);
+			}
 
-            continue;
-        }
+			continue;
+		}
 
-        $files[] = array($f, $server_path_reports);
-    }
+		$files[] = array($f, $server_path_reports);
+	}
 }
 
 foreach ($files as &$f) {
@@ -42,16 +43,13 @@ foreach ($files as &$f) {
 
 unset($f);
 
-$twig->display('admin.reports.html.twig', array('files' => $files));
-
-
 $file = isset($_GET['file']) ? $_GET['file'] : NULL;
 if (!empty($file)) {
 	if (!preg_match('/[^A-z0-9\' _\/\-\.]/', $file)) {
 		if (file_exists($server_path_reports . $file)) {
-			$content = nl2br(file_get_contents($server_path_reports . $file));
+			$file_content = nl2br(file_get_contents($server_path_reports . $file));
 
-			$twig->display('admin.logs.view.html.twig', array('file' => $file, 'content' => $content));
+			$twig->display('admin.logs.view.html.twig', array('file' => $file, 'content' => $file_content));
 		} else {
 			echo 'Specified file does not exist.';
 		}
@@ -59,3 +57,5 @@ if (!empty($file)) {
 		echo 'Invalid file name specified.';
 	}
 }
+
+$twig->display('admin.reports.html.twig', array('files' => $files));

admin/pages/settings.php

@@ -0,0 +1,60 @@
+<?php
+/**
+ * Menus
+ *
+ * @package   MyAAC
+ * @author    Slawkens <slawkens@gmail.com>
+ * @copyright 2019 MyAAC
+ * @link      https://my-aac.org
+ */
+
+use MyAAC\Plugins;
+use MyAAC\Settings;
+
+defined('MYAAC') or die('Direct access not allowed!');
+$title = 'Settings';
+
+require_once SYSTEM . 'clients.conf.php';
+if (empty($_GET['plugin'])) {
+	error('Please select plugin from left Panel.');
+	return;
+}
+
+$plugin = $_GET['plugin'];
+
+if($plugin != 'core') {
+	$pluginSettings = Plugins::getPluginSettings($plugin);
+	if (!$pluginSettings) {
+		error('This plugin does not exist or does not have settings defined.');
+		return;
+	}
+
+	$settingsFilePath = BASE . $pluginSettings;
+}
+else {
+	$settingsFilePath = SYSTEM . 'settings.php';
+}
+
+if (!file_exists($settingsFilePath)) {
+	error("Plugin $plugin does not exist or does not have settings defined.");
+	return;
+}
+
+$settingsFile = require $settingsFilePath;
+if (!is_array($settingsFile)) {
+	error("Cannot load settings file for plugin $plugin");
+	return;
+}
+
+$settingsKeyName = ($plugin == 'core' ? $plugin : $settingsFile['key']);
+
+$title = ($plugin == 'core' ? 'Settings' : 'Plugin Settings - ' . $settingsFile['name']);
+
+$settingsParsed = Settings::display($settingsKeyName, $settingsFile['settings']);
+
+$twig->display('admin.settings.html.twig', [
+	'settingsParsed' => $settingsParsed['content'],
+	'settings' => $settingsFile['settings'],
+	'script' => $settingsParsed['script'],
+	'settingsKeyName' => $settingsKeyName,
+]);

admin/pages/statistics.php

@@ -7,26 +7,25 @@
  * @copyright 2019 MyAAC
  * @link      https://my-aac.org
  */
+
+use MyAAC\Models\Account;
+use MyAAC\Models\Guild;
+use MyAAC\Models\House;
+use MyAAC\Models\Player;
+
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Statistics';
 
-$query = $db->query('SELECT count(*) as `how_much` FROM `accounts`;');
-$query = $query->fetch();
-$total_accounts = $query['how_much'];
+$total_accounts = Account::count();
+$total_players = Player::count();
+$total_guilds = Guild::count();
+$total_houses = House::count();
 
-$query = $db->query('SELECT count(*) as `how_much` FROM `players`;');
-$query = $query->fetch();
-$total_players = $query['how_much'];
-
-$query = $db->query('SELECT count(*) as `how_much` FROM `guilds`;');
-$query = $query->fetch();
-$total_guilds = $query['how_much'];
-
-$query = $db->query('SELECT count(*) as `how_much` FROM `houses`;');
-$query = $query->fetch();
-$total_houses = $query['how_much'];
-
-$points = $db->query('SELECT `premium_points`, `' . (USE_ACCOUNT_NAME ? 'name' : 'id') . '` as `name` FROM `accounts` ORDER BY `premium_points` DESC LIMIT 10;');
+$points = Account::select(['premium_points', (USE_ACCOUNT_NAME ? 'name' : 'id')])
+	->orderByDesc('premium_points')
+	->limit(10)
+	->get()
+	->toArray();
 
 $twig->display('admin.statistics.html.twig', array(
 	'total_accounts' => $total_accounts,

admin/pages/tools.php

@@ -10,18 +10,24 @@
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Tools';
 
-$tool = $_GET['tool'];
-if (!isset($tool)) {
+if (!isset($_GET['tool'])) {
 	echo 'Tool not set.';
 	return;
 }
 
+$tool = $_GET['tool'];
 if (preg_match("/[^A-z0-9_\-]/", $tool)) {
 	echo 'Invalid tool.';
 	return;
 }
 
-$file = BASE . 'admin/pages/tools/' . $tool . '.php';
-if (!@file_exists($file))
+$file = ADMIN . 'tools/' . $tool . '.php';
+
+if (@file_exists($file)) {
 	require $file;
+	return;
+}
+
+echo 'Tool <strong>' . $tool . '</strong> not found.';
+
 ?>

admin/pages/version.php

@@ -24,10 +24,10 @@ if (!$myaac_version) {
 $version_compare = version_compare($myaac_version, MYAAC_VERSION);
 if ($version_compare == 0) {
 	success('MyAAC latest version is ' . $myaac_version . '. You\'re using the latest version.
-	<br/>View CHANGELOG ' . generateLink(ADMIN_URL . '?p=changelog', 'here'));
+	<br/>View CHANGELOG ' . generateLink(ADMIN_URL . '?p=clmd', 'here'));
 } else if ($version_compare < 0) {
 	success('Woah, seems you\'re using newer version as latest released one! MyAAC latest released version is ' . $myaac_version . ', and you\'re using version ' . MYAAC_VERSION . '.
-	<br/>View CHANGELOG ' . generateLink(ADMIN_URL . '?p=changelog', 'here'));
+	<br/>View CHANGELOG ' . generateLink(ADMIN_URL . '?p=clmd', 'here'));
 } else {
 	warning('You\'re using outdated version.<br/>
 		Your version: <b>' . MYAAC_VERSION . '</b><br/>

admin/pages/visitors.php

@@ -8,29 +8,58 @@
  * @link      https://my-aac.org
  */
 defined('MYAAC') or die('Direct access not allowed!');
-$title = 'Visitors';
 
-if (!$config['visitors_counter']): ?>
+use DeviceDetector\DeviceDetector;
+use DeviceDetector\Parser\Client\Browser;
+use DeviceDetector\Parser\OperatingSystem;
+use MyAAC\Visitors;
+
+$title = 'Visitors';
+$use_datatable = true;
+
+if (!setting('core.visitors_counter')): ?>
 	Visitors counter is disabled.<br/>
-	You can enable it by editing this configurable in <b>config.local.php</b> file:<br/>
-	<p style="margin-left: 3em;"><b>$config['visitors_counter'] = true;</b></p>
+	You can enable it in Settings -> General -> Visitors Counter.<br/>
 	<?php
 	return;
 endif;
 
-require SYSTEM . 'libs/visitors.php';
-$visitors = new Visitors($config['visitors_counter_ttl']);
+$visitors = new Visitors(setting('core.visitors_counter_ttl'));
 
-function compare($a, $b)
-{
+function compare($a, $b): int {
 	return $a['lastvisit'] > $b['lastvisit'] ? -1 : 1;
 }
 
 $tmp = $visitors->getVisitors();
 usort($tmp, 'compare');
 
+foreach ($tmp as &$visitor) {
+	$userAgent = $visitor['user_agent'] ?? '';
+	if (!strlen($userAgent) || $userAgent == 'unknown') {
+		$browser = 'Unknown';
+	}
+	else {
+		$dd = new DeviceDetector($userAgent);
+		$dd->parse();
+
+		if ($dd->isBot()) {
+			$bot = $dd->getBot();
+			$message = '(Bot) %s, <a href="%s" target="_blank">%s</a>';
+			$browser = sprintf($message, $bot['category'] ?? 'Unknown', $bot['url'] ?? '', $bot['name'] ?? 'Unknown name');
+		}
+		else {
+			$osFamily = OperatingSystem::getOsFamily($dd->getOs('name'));
+			$browserFamily = Browser::getBrowserFamily($dd->getClient('name'));
+
+			$browser = $osFamily . ', ' . $browserFamily;
+		}
+	}
+
+	$visitor['browser'] = $browser;
+}
+
 $twig->display('admin.visitors.html.twig', array(
-	'config_visitors_counter_ttl' => $config['visitors_counter_ttl'],
+	'config_visitors_counter_ttl' => setting('core.visitors_counter_ttl'),
 	'visitors' => $tmp
 ));
 ?>

admin/template/menus.php

@@ -0,0 +1,69 @@
+<?php
+
+$menus = [
+	['name' => 'Dashboard', 'icon' => 'tachometer-alt', 'order' => 10, 'link' => 'dashboard'],
+	['name' => 'Settings', 'icon' => 'edit', 'order' => 19, 'link' =>
+		require ADMIN . 'includes/settings_menus.php'
+	],
+	['name' => 'News', 'icon' => 'newspaper', 'order' => 20,  'link' =>
+		[
+			['name' => 'View', 'link' => 'news', 'icon' => 'list', 'order' => 10],
+			['name' => 'Add news', 'link' => 'news&action=new&type=1', 'icon' => 'plus', 'order' => 20],
+			['name' => 'Add ticker', 'link' => 'news&action=new&type=2', 'icon' => 'plus', 'order' => 30],
+			['name' => 'Add article', 'link' => 'news&action=new&type=3', 'icon' => 'plus', 'order' => 40],
+		],
+	],
+	['name' => 'Changelogs', 'icon' => 'newspaper', 'order' => 30, 'link' =>
+		[
+			['name' => 'View', 'link' => 'changelog', 'icon' => 'list', 'order' => 10],
+			['name' => 'Add', 'link' => 'changelog&action=new', 'icon' => 'plus', 'order' => 20],
+		],
+	],
+	['name' => 'Mailer', 'icon' => 'envelope', 'order' => 40, 'link' => 'mailer', 'disabled' => !setting('core.mail_enabled')],
+	['name' => 'Pages', 'icon' => 'book', 'order' => 50, 'link' =>
+		[
+			['name' => 'View', 'link' => 'pages', 'icon' => 'list', 'order' => 10],
+			['name' => 'Add', 'link' => 'pages&action=new', 'icon' => 'plus', 'order' => 20],
+		],
+	],
+	['name' => 'Menus', 'icon' => 'list', 'order' => 60, 'link' => 'menus'],
+	['name' => 'Plugins', 'icon' => 'plug', 'order' => 70, 'link' => 'plugins'],
+	['name' => 'Server Data', 'icon' => 'gavel', 'order' => 80, 'link' => 'data'],
+	['name' => 'Editor', 'icon' => 'edit', 'order' => 90, 'link' =>
+		[
+			['name' => 'Accounts', 'link' => 'accounts', 'icon' => 'users', 'order' => 10],
+			['name' => 'Players', 'link' => 'players', 'icon' => 'user-astronaut', 'order' => 20],
+		],
+	],
+	['name' => 'Tools', 'icon' => 'tools', 'order' => 100, 'link' =>
+		[
+			['name' => 'Mass Account Actions', 'link' => 'mass_account', 'icon' => 'globe', 'order' => 10],
+			['name' => 'Mass Teleport Actions', 'link' => 'mass_teleport', 'icon' => 'globe', 'order' => 20],
+			['name' => 'Notepad', 'link' => 'notepad', 'icon' => 'marker', 'order' => 30],
+			['name' => 'phpinfo', 'link' => 'phpinfo', 'icon' => 'server', 'order' => 40],
+		],
+	],
+	['name' => 'Logs', 'icon' => 'bug', 'order' => 110, 'link' =>
+		[
+			['name' => 'Logs', 'link' => 'logs', 'icon' => 'book', 'order' => 10],
+			['name' => 'Reports', 'link' => 'reports', 'icon' => 'book', 'order' => 20],
+			['name' => 'Visitors', 'link' => 'visitors', 'icon' => 'user', 'order' => 30],
+		],
+	],
+];
+
+$hooks->trigger(HOOK_ADMIN_MENU);
+
+usort($menus, function ($a, $b) {
+	return $a['order'] - $b['order'];
+});
+
+foreach ($menus as $i => $menu) {
+	if (isset($menu['link']) && is_array($menu['link'])) {
+		usort($menu['link'], function ($a, $b) {
+			return $a['order'] - $b['order'];
+		});
+	}
+}
+
+return $menus;

admin/template/style.css

@@ -1,44 +1,15 @@
-.slidecontainer {
-	width: 100%;
+.menu-text-li {color: #4b646f; background: #1a2226;}
+.menu-text {
+	display: block;
+	padding: .5rem 1rem;
+	white-space: nowrap;
 }
 
-.slider {
-	-webkit-appearance: none;
-	width: 100%;
-
-	outline: none;
-	opacity: 0.7;
-	-webkit-transition: .2s;
-	transition: opacity .2s;
+.sidebar-mini.sidebar-collapse .menu-text {
+	display: none;
 }
 
-.slider:hover {
-	opacity: 1;
-}
-
-.slider::-webkit-slider-thumb {
-	-webkit-appearance: none;
-	appearance: none;
-	width: 15px;
-	height: 25px;
-	background: #3c8dbc;
-	cursor: pointer;
-}
-
-.slider::-moz-range-thumb {
-	width: 25px;
-	height: 25px;
-	background: #3c8dbc;
-	cursor: pointer;
-}
-
-td.details-control {
-	text-align: center;
-	color: forestgreen;
-	cursor: pointer;
-}
-
-tr.shown td.details-control {
-	text-align: center;
-	color: red;
-}
+.myaac-table tbody tr:nth-child(even) {background: #FFF} /* light border */
+.myaac-table tbody tr:nth-child(odd) {background: #CCC} /* dark border */
+.myaac-table thead td {background: #000000; color: #ffffff !important;} /* vdark border */
+.myaac-table tfoot td {background: #000000; color: #ffffff !important;} /* vdark border */

admin/template/template.php

@@ -1,229 +1,203 @@
 <?php defined('MYAAC') or die('Direct access not allowed!'); ?>
-<!DOCTYPE html>
-<html>
+<!doctype html>
+<html lang="en">
 <head>
-	<?php echo template_header(true);
-	$title_full =  (isset($title) ? $title . $config['title_separator'] : '') . $config['lua']['serverName'];
-	?>
-
-	<title><?php echo $title_full ?></title>
-	<link rel="shortcut icon" href="<?php echo BASE_URL; ?>images/favicon.ico" type="image/x-icon" />
-	<link rel="icon" href="<?php echo BASE_URL; ?>images/favicon.ico" type="image/x-icon" />
-	<meta content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" name="viewport">
-
-	<link rel="stylesheet" href="<?php echo BASE_URL; ?>tools/css/bootstrap.min.css">
-	<link rel="stylesheet" href="<?php echo BASE_URL; ?>tools/css/AdminLTE.min.css">
-	<link rel="stylesheet" href="<?php echo BASE_URL; ?>tools/css/skins/skin-blue.min.css">
+	<?php $hooks->trigger(HOOK_ADMIN_HEAD_START); ?>
+	<?php echo template_header(true); ?>
+	<title><?php echo (isset($title) ? $title . ' - ' : '') . $config['lua']['serverName'];?></title>
+	<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+	<link rel="stylesheet" href="<?php echo BASE_URL; ?>tools/css/adminlte.min.css">
 	<link rel="stylesheet" href="<?php echo BASE_URL; ?>tools/css/font-awesome.min.css">
-	<link rel="stylesheet" href="<?php echo BASE_URL; ?>tools/css/ionicons.min.css">
-	<link rel="stylesheet" href="<?php echo BASE_URL; ?>tools/css/jquery.dataTables.min.css">
+	<?php if (isset($use_datatable)) { ?>
+	<link rel="stylesheet" href="<?php echo BASE_URL; ?>tools/css/datatables.bs.min.css">
+	<?php } ?>
 	<link rel="stylesheet" type="text/css" href="<?php echo $template_path; ?>style.css"/>
 	<!--[if lt IE 9]>
-	<script src="https://oss.maxcdn.com/html5shiv/3.7.3/html5shiv.min.js"></script>
-	<script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
+	<script src="<?php echo BASE_URL; ?>tools/js/html5shiv.min.js"></script>
+	<script src="<?php echo BASE_URL; ?>tools/js/respond.min.js"></script>
 	<![endif]-->
-	<link rel="stylesheet"
-		  href="https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,600,700,300italic,400italic,600italic">
+	<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,600,700,300italic,400italic,600italic">
+	<?php $hooks->trigger(HOOK_ADMIN_HEAD_END); ?>
 </head>
-<body class="hold-transition skin-blue sidebar-mini">
-<div class="wrapper">
-	<?php
-	if ($logged && admin()) {
-	?>
-	<header class="main-header">
-		<a href="." class="logo">
-			<span class="logo-mini"><b>M</b>A</span>
-			<span class="logo-lg"><b>My</b>AAC</span>
-		</a>
-
-		<nav class="navbar navbar-static-top" role="navigation">
-			<a href="#" class="sidebar-toggle" data-toggle="push-menu" role="button">
-				<span class="sr-only">Toggle navigation</span>
-			</a>
-			<div class="navbar-custom-menu">
-				<ul class="nav navbar-nav">
-					<li>
-						<a href="#" data-toggle="control-sidebar"><i class="fa fa-gears"></i></a>
-					</li>
-				</ul>
-			</div>
+<body class="sidebar-mini ">
+<?php $hooks->trigger(HOOK_ADMIN_BODY_START); ?>
+<?php if ($logged && admin()) { ?>
+	<div class="wrapper">
+		<nav class="main-header navbar navbar-expand navbar-white navbar-light">
+			<ul class="navbar-nav">
+				<li class="nav-item">
+					<a class="nav-link" data-widget="pushmenu" href="#"><i class="fas fa-bars"></i></a>
+				</li>
+				<li class="nav-item d-none d-sm-inline-block">
+					<a href="<?php echo ADMIN_URL; ?>" class="nav-link">Home</a>
+				</li>
+			</ul>
+			<ul class="navbar-nav ml-auto">
+				<li class="nav-item">
+					<a class="nav-link" data-widget="control-sidebar" data-slide="true" href="#"><i class="fas fa-th-large"></i></a>
+				</li>
+			</ul>
 		</nav>
-	</header>
-	<aside class="main-sidebar">
-		<section class="sidebar">
-			<ul class="sidebar-menu" data-widget="tree">
-				<li class="header">MyAAC</li>
+		<aside class="main-sidebar sidebar-dark-info elevation-4">
+			<a href="<?php echo ADMIN_URL; ?>" class="brand-link navbar-info">
+				<img src="<?php echo ADMIN_URL; ?>images/logo.png" class="brand-image img-circle elevation-3" style="opacity: .8">
+				<span class="brand-text"><b>My</b>AAC</span>
+			</a>
+			<div class="sidebar">
+				<nav class="mt-1">
+					<ul class="nav nav-pills nav-sidebar flex-column nav-legacy nav-child-indent" data-widget="treeview" data-accordion="false">
+						<li class="menu-text-li">
+							<span class="menu-text">
+								<a class="text-info" href="<?php echo BASE_URL; ?>" target="_blank">
+									<?php echo $config['lua']['serverName'] ?>
+								</a>
+							</span>
+						</li>
+						<?php
+						// name = Display name of link
+						// icon = fontawesome icon name without "fas fa-"
+						// link = Page link or use as array for sub items
+						$menus = require __DIR__ . '/menus.php';
 
-				<?php
-				$icons_a = array(
-                    'dashboard','newspaper-o', 'envelope',
-                    'book', 'list',
-                    'plug', 'user',
-                    'edit', 'gavel',
-                    'wrench', 'edit', 'book', 'book',
-                );
-
-				$menus = array(
-					'Dashboard' => 'dashboard',
-					'News' => 'news',
-					'Mailer' => 'mailer',
-					'Pages' => 'pages',
-					'Menus' => 'menus',
-					'Plugins' => 'plugins',
-					'Visitors' => 'visitors',
-					'Editor' => array(
-						'Accounts' => 'accounts',
-						'Players' => 'players',
-					),
-					'Items' => 'items',
-					'Tools' => array(
-						'Notepad' => 'notepad',
-						'phpinfo' => 'phpinfo',
-					),
-					'Logs' => array(
-						'Logs' => 'logs',
-						'Reports' => 'reports',
-					),
-				);
-
-				$i = 0;
-				foreach ($menus as $_name => $_page) {
-					$has_child = is_array($_page);
-					if (!$has_child) {
-						echo '<li ';
-						if ($page == $_page) echo ' class="active"';
-						echo ">";
-						echo '<a href="?p=' . $_page . '"><i class="fa fa-' . (isset($icons_a[$i]) ? $icons_a[$i] : 'link') . '"></i> <span>' . $_name . '</span></a></li>';
-					}
-
-					if ($has_child) {
-						$used_menu = "";
-						$nav_construct = '';
-						foreach ($_page as $__name => $__page) {
-							$nav_construct = $nav_construct . '<li';
-
-							if ($page == $__page) {
-								$nav_construct = $nav_construct . ' class="active"';
-								$used_menu = true;
+						foreach ($menus as $category => $menu) {
+							if (isset($menu['disabled']) && $menu['disabled']) {
+								continue;
+							}
+
+							$has_child = is_array($menu['link']);
+							if (!$has_child) { ?>
+								<li class="nav-item">
+									<a class="nav-link<?php echo(strpos($menu['link'], $page) !== false ? ' active' : '') ?>" href="?p=<?php echo $menu['link'] ?>">
+										<i class="nav-icon fas fa-<?php echo($menu['icon'] ?? 'link') ?>"></i>
+										<p><?php echo $menu['name'] ?></p>
+									</a>
+								</li>
+								<?php
+							} else if ($has_child) {
+								$used_menu = null;
+								$nav_construct = '';
+								foreach ($menu['link'] as $sub_category => $sub_menu) {
+									$nav_construct .= '<li class="nav-item"><a href="?p=' . $sub_menu['link'] . '" class="nav-link';
+									if ($_SERVER['QUERY_STRING'] == 'p=' . $sub_menu['link']) {
+										$nav_construct .= ' active';
+										$used_menu = true;
+									}
+									$nav_construct .= '"><i class="fas fa-' . ($sub_menu['icon'] ?? 'circle') . ' nav-icon"></i><p>' . $sub_menu['name'] . '</p></a></li>';
+								}
+								?>
+								<li class="nav-item has-treeview<?php echo($used_menu ? ' menu-open' : '') ?>">
+									<a href="#" class="nav-link<?php echo($used_menu ? ' active' : '') ?>">
+										<i class="nav-icon fas fa-<?php echo($menu['icon'] ?? 'link') ?>"></i>
+										<p><?php echo $menu['name'] ?></p><i class="right fas fa-angle-left"></i>
+									</a>
+									<ul class="nav nav-treeview">
+										<?php echo $nav_construct; ?>
+									</ul>
+								</li>
+								<?php
 							}
-							$nav_construct = $nav_construct . '><a href="?p=' . $__page . '"><i class="fa fa-circle-o"></i> ' . $__name . '</a></li>';
 						}
 
-						echo '<li class="treeview' . (($used_menu) ? ' menu-open' : '') . '">
-                                      <a href="#"><i class="fa fa-' . (isset($icons_a[$i]) ? $icons_a[$i] : 'link') . '"></i> <span>' . $_name . '</span>
-						              <span class="pull-right-container"><i class="fa fa-angle-left pull-right"></i></span></a>
-						              <ul class="treeview-menu" style="' . (($used_menu) ? '  display: block' : ' display: none') . '">';
-						echo $nav_construct;
-						echo '</ul>
-                                </li>';
-					}
-					$i++;
-				}
+						$query = $db->query('SELECT `name`, `page`, `flags` FROM `' . TABLE_PREFIX . 'admin_menu` ORDER BY `ordering`');
+						$menu_db = $query->fetchAll();
+						foreach ($menu_db as $item) {
+							if ($item['flags'] == 0 || hasFlag($item['flags'])) { ?>
+								<li class="nav-item">
+									<a class="nav-link<?php echo($page == $item['page'] ? ' active' : '') ?>" href="?p=<?php echo $item['page'] ?>">
+										<i class="nav-icon fas fa-link"></i>
+										<p><?php echo $item['name'] ?></p>
+									</a>
+								</li>
+								<?php
+							}
+						}
+						?>
+					</ul>
+				</nav>
+			</div>
+		</aside>
 
-				$query = $db->query('SELECT `name`, `page`, `flags` FROM `' . TABLE_PREFIX . 'admin_menu` ORDER BY `ordering`');
-				$menu_db = $query->fetchAll();
-				foreach ($menu_db as $item) {
-					if ($item['flags'] == 0 || hasFlag($item['flags'])) {
-						echo '<li ';
-						if ($page == $item['page']) echo ' class="active"';
-						echo ">";
-						echo '<a href="?p=' . $item['page'] . '"><i class="fa fa-link"></i> <span>' . $item['name'] . '</span></a></li>';
-					}
-				}
-				?>
-			</ul>
-		</section>
-	</aside>
-
-	<div class="content-wrapper">
-		<section class="content-header">
-			<h1><?php echo(isset($title) ? $title : ''); ?>
-				<small> - Admin Panel</small>
-				<div class="pull-right">
-					<span class="label label-<?php echo(($status['online']) ? 'success' : 'danger'); ?>"><?php echo $config['lua']['serverName'] ?></span>
+		<div class="content-wrapper" style="min-height: 823px;">
+			<div class="content-header">
+				<div class="container-fluid">
+					<div class="row mb-2">
+						<div class="col-sm-6">
+							<h3 class="m-0 text-dark"><?php echo(isset($title) ? $title : ''); ?><small> - Admin Panel</small></h3>
+						</div>
+						<div class="col-sm-6">
+							<div class="float-sm-right d-none d-sm-inline">
+								<span class="p-2 right badge badge-<?php echo((isset($status['online']) and $status['online']) ? 'success' : 'danger'); ?>"><?php echo $config['lua']['serverName'] ?></span>
+							</div>
+						</div>
+					</div>
 				</div>
-			</h1>
-		</section>
-		<section class="content">
-			<?php echo $content; ?>
-		</section>
+			</div>
+			<div class="content">
+				<div class="container-fluid">
+					<?php echo $content; ?>
+				</div>
+			</div>
+		</div>
 
+		<aside class="control-sidebar control-sidebar-dark">
+			<div class="p-3">
+				<h4>Account:</h4>
+				<p><h5><a href="?action=logout"><i class="fas fa-sign-out-alt text-danger"></i> Log out</h5></a>
+				<small>This will log you out</small></p>
+			</div>
+			<div class="p-3">
+				<h4>Site:</h4>
+				<p><h5><a href="<?php echo BASE_URL; ?>" target="_blank"><i class="far fa-eye text-blue"></i> Preview</a></h5>
+				<small>This will open a new tab</small></p>
+			</div>
+			<div class="p-3">
+				<h4>Version:</h4>
+				<p><h5><a href="?p=version"><i class="fas fa-code-branch"></i> <?php echo MYAAC_VERSION; ?></a></h5>
+				<small>Check for updates</small></p>
+			</div>
+			<div class="p-3">
+				<h4>Site:</h4>
+				<p><h5><a href="https://github.com/slawkens/myaac" target="_blank"><i class="fab fa-github"></i> Github</a></h5>
+				<small>Goto GitHub Page</small></p>
+
+				<p><h5><a href="http://my-aac.org/" target="_blank"><i class="fas fa-shoe-prints"></i> MyAAC Official</a></h5>
+				<small>Goto MyAAC Official Website</small></p>
+
+				<p><h5><a href="?p=open_source"><i class="fas fa-wrench"></i> Open Source</a></h5>
+				<small>View Open Source Software MyAAC is using</small></p>
+			</div>
+		</aside>
+
+		<footer class="main-footer">
+			<div class="float-sm-right d-none d-sm-inline">
+				<span class="p-2 right badge badge-<?php echo((isset($status['online']) and $status['online']) ? 'success' : 'danger'); ?>"><?php echo $config['lua']['serverName'] ?></span>
+			</div>
+			<?php echo base64_decode('UG93ZXJlZCBieSA8YSBocmVmPSJodHRwOi8vbXktYWFjLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPk15QUFDLjwvYT4='); ?>
+		</footer>
+		<div id="sidebar-overlay"></div>
 	</div>
 
-	<footer class="main-footer">
-
-		<div class="pull-right hidden-xs">
-			<div id="status">
-				<?php if ($status['online']): ?>
-					<p class="success" style="width: 120px; text-align: center;">Server Online</p>
-				<?php else: ?>
-					<p class="error" style="width: 120px; text-align: center;">Server Offline</p>
-				<?php endif; ?>
-			</div>
-		</div>
-		<?php echo base64_decode('UG93ZXJlZCBieSA8YSBocmVmPSJodHRwOi8vbXktYWFjLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPk15QUFDLjwvYT4='); ?>
-	</footer>
-
-	<aside class="control-sidebar control-sidebar-dark">
-		<ul class="nav nav-tabs nav-justified control-sidebar-tabs">
-			<li class="active"><a href="#control-sidebar-home-tab" data-toggle="tab"><i class="fa fa-home"></i></a></li>
-			<li><a href="#control-sidebar-settings-tab" data-toggle="tab"><i class="fa fa-gears"></i></a></li>
-		</ul>
-		<div class="tab-content">
-			<div class="tab-pane active" id="control-sidebar-home-tab">
-				<h3 class="control-sidebar-heading">Account</h3>
-				<ul class="control-sidebar-menu">
-					<li>
-						<a href="?action=logout">
-							<i class="menu-icon fa  fa-sign-out bg-red"></i>
-							<div class="menu-info">
-								<h4 class="control-sidebar-subheading">Log out</h4>
-								<p>This will log you out
-									of <?php echo(USE_ACCOUNT_NAME ? $account_logged->getName() : $account_logged->getId()); ?></p>
-							</div>
-						</a>
-					</li>
-				</ul>
-				<h3 class="control-sidebar-heading">Site</h3>
-				<ul class="control-sidebar-menu">
-					<li>
-						<a href="<?php echo BASE_URL; ?>" target="_blank">
-							<i class="menu-icon fa  fa-eye bg-blue"></i>
-							<div class="menu-info">
-								<h4 class="control-sidebar-subheading">Preview</h4>
-								<p>This will open a new tab</p>
-							</div>
-						</a>
-					</li>
-				</ul>
-			</div>
-			<div class="tab-pane" id="control-sidebar-settings-tab">
-				<form method="post">
-					<h3 class="control-sidebar-heading">Version</h3>
-
-					<div class="form-group">
-						<label class="control-sidebar-subheading">
-							<?php echo MYAAC_VERSION; ?> (<a href="?p=version">Check for updates</a>)<br/>
-						</label>
-						<label class="control-sidebar-subheading">
-							<p><a href="https://github.com/slawkens/myaac" target="_blank">Github</a></p>
-					</div>
-				</form>
-			</div>
-		</div>
-	</aside>
-	<div class="control-sidebar-bg"></div>
-</div>
-
-<?php }
-if (!$logged && !admin()) {
+<?php } else if (!$logged && !admin()) {
 	echo $content;
 }
 ?>
-
-<script src="<?php echo BASE_URL; ?>tools/js/bootstrap.min.js"></script>
-<script src="<?php echo BASE_URL; ?>tools/js/jquery-ui.min.js"></script>
-<script src="<?php echo BASE_URL; ?>tools/js/jquery.dataTables.min.js"></script>
+<?php
+/**
+ * @var OTS_Account $account_logged
+ */
+if ($logged && admin()) {
+	$twig->display('admin-bar.html.twig', [
+		'username' => USE_ACCOUNT_NAME ? $account_logged->getName() : $account_logged->getId()
+	]);
+}
+?>
+<script src="<?php echo BASE_URL; ?>tools/ext/bootstrap/js/bootstrap.min.js"></script>
+<script src="<?php echo BASE_URL; ?>tools/ext/jquery-ui/jquery-ui.min.js"></script>
+<?php if (isset($use_datatable))  { ?>
+<script src="<?php echo BASE_URL; ?>tools/js/datatables.min.js"></script>
+<script src="<?php echo BASE_URL; ?>tools/js/datatables.bs.min.js"></script>
+<?php } ?>
 <script src="<?php echo BASE_URL; ?>tools/js/adminlte.min.js"></script>
+<?php $hooks->trigger(HOOK_ADMIN_BODY_END); ?>
 </body>
 </html>

admin/tools/phpinfo.php

@@ -1,5 +1,6 @@
 <?php
-define('MYAAC_ADMIN', true);
+const MYAAC_ADMIN = true;
+const IGNORE_SET_LAST_VISIT = true;
 
 require '../../common.php';
 require SYSTEM . 'functions.php';

admin/tools/reload_data.php

@@ -0,0 +1,48 @@
+<?php
+/**
+ * Project: MyAAC
+ *     Automatic Account Creator for Open Tibia Servers
+ *
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * @package   MyAAC
+ * @author    Slawkens <slawkens@gmail.com>
+ * @copyright 2020 MyAAC
+ * @link      https://my-aac.org
+ */
+
+use MyAAC\DataLoader;
+
+const MYAAC_ADMIN = true;
+const IGNORE_SET_LAST_VISIT = true;
+
+require '../../common.php';
+require SYSTEM . 'functions.php';
+require SYSTEM . 'init.php';
+require SYSTEM . 'login.php';
+
+if (!admin())
+	die('Access denied.');
+
+ini_set('max_execution_time', 300);
+ob_implicit_flush();
+@ob_end_flush();
+header('X-Accel-Buffering: no');
+
+require LOCALE . 'en/main.php';
+require LOCALE . 'en/install.php';
+
+DataLoader::setLocale($locale);
+DataLoader::load();

admin/tools/settings_save.php

@@ -0,0 +1,45 @@
+<?php
+
+use MyAAC\Settings;
+
+const MYAAC_ADMIN = true;
+const IGNORE_SET_LAST_VISIT = true;
+
+require '../../common.php';
+require SYSTEM . 'functions.php';
+require SYSTEM . 'init.php';
+require SYSTEM . 'login.php';
+
+if(!admin()) {
+	http_response_code(500);
+	die('You are not logged in. Probably session expired. Please login again.');
+}
+
+csrfProtect();
+
+if (!isset($_REQUEST['plugin'])) {
+	http_response_code(500);
+	die('Please enter plugin name.');
+}
+
+if (!isset($_POST['settings'])) {
+	http_response_code(500);
+	die('Please enter settings.');
+}
+
+$settings = Settings::getInstance();
+
+$success = $settings->save($_REQUEST['plugin'], $_POST['settings']);
+
+$errors = $settings->getErrors();
+if (count($errors) > 0) {
+	http_response_code(500);
+	die(implode('<br/>', $errors));
+}
+
+if ($success) {
+	echo 'Saved at ' . date('H:i');
+}
+else {
+	echo 'Something unexpected happened - it was impossible to save the settings, please try again later. If problem persists - contact MyAAC developers.';
+}

admin/tools/status.php

@@ -1,5 +1,6 @@
 <?php
-define('MYAAC_ADMIN', true);
+const MYAAC_ADMIN = true;
+const IGNORE_SET_LAST_VISIT = true;
 
 require '../../common.php';
 require SYSTEM . 'init.php';

admin/tools/upload_image.php

@@ -0,0 +1,54 @@
+<?php
+const MYAAC_ADMIN = true;
+const IGNORE_SET_LAST_VISIT = true;
+
+require '../../common.php';
+require SYSTEM . 'functions.php';
+require SYSTEM . 'init.php';
+require SYSTEM . 'login.php';
+
+if(!admin())
+	die('Access denied.');
+
+// Don't attempt to process the upload on an OPTIONS request
+if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
+	header('Access-Control-Allow-Methods: POST, OPTIONS');
+	return;
+}
+
+$imageFolder = BASE . EDITOR_IMAGES_DIR;
+
+reset ($_FILES);
+$temp = current($_FILES);
+if (is_uploaded_file($temp['tmp_name'])) {
+	header('Access-Control-Allow-Credentials: true');
+	header('P3P: CP="There is no P3P policy."');
+
+	// Sanitize input
+	if (preg_match("/([^\w\s\d\-_~,;:\[\]\(\).])|([\.]{2,})/", $temp['name'])) {
+		header('HTTP/1.1 400 Invalid file name.');
+		return;
+	}
+
+	// Verify extension
+	$ext = strtolower(pathinfo($temp['name'], PATHINFO_EXTENSION));
+	if (!in_array($ext, ['gif', 'jpg', 'png'])) {
+		header('HTTP/1.1 400 Invalid extension.');
+		return;
+	}
+
+	do {
+		$randomName = generateRandomString(8). ".$ext";
+		$fileToWrite = $imageFolder . $randomName;
+	} while (file_exists($fileToWrite));
+
+	move_uploaded_file($temp['tmp_name'], $fileToWrite);
+
+	$returnPathToImage = BASE_URL . EDITOR_IMAGES_DIR . $randomName;
+	echo json_encode(['location' => $returnPathToImage]);
+} else {
+	// Notify editor that the upload failed
+	header('HTTP/1.1 500 Server Error');
+}
+
+

common.php

@@ -20,111 +20,151 @@
  *
  * @package   MyAAC
  * @author    Slawkens <slawkens@gmail.com>
- * @copyright 2019 MyAAC
+ * @copyright 2024 MyAAC
  * @link      https://my-aac.org
  */
-if (version_compare(phpversion(), '7.2.5', '<')) die('PHP version 7.2.5 or higher is required.');
+if (version_compare(phpversion(), '8.1', '<')) die('PHP version 8.1 or higher is required.');
 
-define('MYAAC', true);
-define('MYAAC_VERSION', '0.8.24');
-define('DATABASE_VERSION', 33);
-define('TABLE_PREFIX', 'myaac_');
+const MYAAC = true;
+const MYAAC_VERSION = '2.0-dev';
+const DATABASE_VERSION = 47;
+const TABLE_PREFIX = 'myaac_';
 define('START_TIME', microtime(true));
 define('MYAAC_OS', stripos(PHP_OS, 'WIN') === 0 ? 'WINDOWS' : (strtoupper(PHP_OS) === 'DARWIN' ? 'MAC' : 'LINUX'));
 define('IS_CLI', in_array(php_sapi_name(), ['cli', 'phpdb']));
 
 // account flags
-define('FLAG_ADMIN', 1);
-define('FLAG_SUPER_ADMIN', 2);
-define('FLAG_CONTENT_PAGES', 4);
-define('FLAG_CONTENT_MAILER', 8);
-define('FLAG_CONTENT_NEWS', 16);
-define('FLAG_CONTENT_FORUM', 32);
-define('FLAG_CONTENT_COMMANDS', 64);
-define('FLAG_CONTENT_SPELLS', 128);
-define('FLAG_CONTENT_MONSTERS', 256);
-define('FLAG_CONTENT_GALLERY', 512);
-define('FLAG_CONTENT_VIDEOS', 1024);
-define('FLAG_CONTENT_FAQ', 2048);
-define('FLAG_CONTENT_MENUS', 4096);
-define('FLAG_CONTENT_PLAYERS', 8192);
+const FLAG_NONE = 0;
+const FLAG_ADMIN = 1;
+const FLAG_SUPER_ADMIN = 2;
+const FLAG_SUPER_BOTH = 3;
+const FLAG_CONTENT_PAGES = 4;
+const FLAG_CONTENT_MAILER = 8;
+const FLAG_CONTENT_NEWS = 16;
+const FLAG_CONTENT_FORUM = 32;
+const FLAG_CONTENT_COMMANDS = 64;
+const FLAG_CONTENT_SPELLS = 128;
+const FLAG_CONTENT_MONSTERS = 256;
+const FLAG_CONTENT_GALLERY = 512;
+const FLAG_CONTENT_VIDEOS = 1024;
+const FLAG_CONTENT_FAQ = 2048;
+const FLAG_CONTENT_MENUS = 4096;
+const FLAG_CONTENT_PLAYERS = 8192;
+
+// account access types
+const ACCOUNT_WEB_FLAGS = [
+	FLAG_NONE => 'None',
+	FLAG_ADMIN =>'Admin',
+	FLAG_SUPER_ADMIN => 'Super Admin',
+	FLAG_SUPER_BOTH =>'(Admin + Super Admin)',
+];
 
 // news
-define('NEWS', 1);
-define('TICKER', 2);
-define('ARTICLE', 3);
+const NEWS = 1;
+const TICKER = 2;
+const ARTICLE = 3;
+
+// here you can change location of admin panel
+// you need also to rename folder "admin"
+// this may improve security
+const ADMIN_PANEL_FOLDER = 'admin';
 
 // directories
-define('BASE', __DIR__ . '/');
-define('ADMIN', BASE . 'admin/');
-define('SYSTEM', BASE . 'system/');
-define('CACHE', SYSTEM . 'cache/');
-define('LOCALE', SYSTEM . 'locale/');
-define('LIBS', SYSTEM . 'libs/');
-define('LOGS', SYSTEM . 'logs/');
-define('PAGES', SYSTEM . 'pages/');
-define('PLUGINS', BASE . 'plugins/');
-define('TEMPLATES', BASE . 'templates/');
-define('TOOLS', BASE . 'tools/');
+const BASE = __DIR__ . '/';
+const ADMIN = BASE . ADMIN_PANEL_FOLDER . '/';
+const SYSTEM = BASE . 'system/';
+const CACHE = SYSTEM . 'cache/';
+const LOCALE = SYSTEM . 'locale/';
+const LIBS = SYSTEM . 'libs/';
+const LOGS = SYSTEM . 'logs/';
+const PAGES = SYSTEM . 'pages/';
+const PLUGINS = BASE . 'plugins/';
+const TEMPLATES = BASE . 'templates/';
+const TOOLS = BASE . 'tools/';
+const VENDOR = BASE . 'vendor/';
+
+// other dirs
+const SESSIONS_DIR = SYSTEM . 'php_sessions';
+const GUILD_IMAGES_DIR = 'images/guilds/';
+const EDITOR_IMAGES_DIR = 'images/editor/';
+const GALLERY_DIR = 'images/gallery/';
 
 // menu categories
-define('MENU_CATEGORY_NEWS', 1);
-define('MENU_CATEGORY_ACCOUNT', 2);
-define('MENU_CATEGORY_COMMUNITY', 3);
-define('MENU_CATEGORY_FORUM', 4);
-define('MENU_CATEGORY_LIBRARY', 5);
-define('MENU_CATEGORY_SHOP', 6);
+const MENU_CATEGORY_NEWS = 1;
+const MENU_CATEGORY_ACCOUNT = 2;
+const MENU_CATEGORY_COMMUNITY = 3;
+const MENU_CATEGORY_FORUM = 4;
+const MENU_CATEGORY_LIBRARY = 5;
+const MENU_CATEGORY_SHOP = 6;
 
 // otserv versions
-define('OTSERV', 1);
-define('OTSERV_06', 2);
-define('OTSERV_FIRST', OTSERV);
-define('OTSERV_LAST', OTSERV_06);
-define('TFS_02', 3);
-define('TFS_03', 4);
-define('TFS_FIRST', TFS_02);
-define('TFS_LAST', TFS_03);
+const OTSERV = 1;
+const OTSERV_06 = 2;
+const OTSERV_FIRST = OTSERV;
+const OTSERV_LAST = OTSERV_06;
+const TFS_02 = 3;
+const TFS_03 = 4;
+const TFS_FIRST = TFS_02;
+const TFS_LAST = TFS_03;
+
+// other definitions
+const MAIL_MAIL = 0;
+const MAIL_SMTP = 1;
+
+const SMTP_SECURITY_NONE = 0;
+const SMTP_SECURITY_SSL = 1;
+const SMTP_SECURITY_TLS = 2;
+
+const ACCOUNT_NUMBER_LENGTH = 8;
 
 if (!IS_CLI) {
-	session_save_path(SYSTEM . 'php_sessions');
+	session_save_path(SESSIONS_DIR);
 	session_start();
 }
 
-// basedir
-$basedir = '';
-$tmp = explode('/', $_SERVER['SCRIPT_NAME']);
-$size = count($tmp) - 1;
-for($i = 1; $i < $size; $i++)
-	$basedir .= '/' . $tmp[$i];
-
-$basedir = str_replace(array('/admin', '/install', '/tools'), '', $basedir);
-define('BASE_DIR', $basedir);
-
 if (file_exists(BASE . 'config.local.php')) {
 	require BASE . 'config.local.php';
 }
 
+require SYSTEM . 'base.php';
+define('BASE_DIR', $baseDir);
+
 if(!IS_CLI) {
-	if (isset($_SERVER['HTTP_HOST'][0])) {
-		$baseHost = $_SERVER['HTTP_HOST'];
-	} else {
-		if (isset($_SERVER['SERVER_NAME'][0])) {
-			$baseHost = $_SERVER['SERVER_NAME'];
-		} else {
-			$baseHost = $_SERVER['SERVER_ADDR'];
-		}
+	if (isset($config['site_url'])) {
+		$hasSlashAtEnd = ($config['site_url'][strlen($config['site_url']) - 1] == '/');
+
+		define('SERVER_URL', $config['site_url']);
+		define('BASE_URL', SERVER_URL . ($hasSlashAtEnd ? '' : '/'));
+		define('ADMIN_URL', SERVER_URL . ($hasSlashAtEnd ? '' : '/') . ADMIN_PANEL_FOLDER . '/');
 	}
+	else {
+		define('SERVER_URL', 'http' . (isHttps() ? 's' : '') . '://' . $baseHost);
+		define('BASE_URL', SERVER_URL . BASE_DIR . '/');
+		define('ADMIN_URL', SERVER_URL . BASE_DIR . '/' . ADMIN_PANEL_FOLDER . '/');
 
-	define('SERVER_URL', 'http' . (isHttps() ? 's' : '') . '://' . $baseHost);
-	define('BASE_URL', SERVER_URL . BASE_DIR . '/');
-	define('ADMIN_URL', SERVER_URL . BASE_DIR . '/admin/');
-
-	//define('CURRENT_URL', BASE_URL . $_SERVER['REQUEST_URI']);
-	if(@$config['env'] === 'dev') {
-		require SYSTEM . 'exception.php';
+		//define('CURRENT_URL', BASE_URL . $_SERVER['REQUEST_URI']);
 	}
 }
-require SYSTEM . 'autoload.php';
+
+/** @var array $config */
+ini_set('log_errors', 1);
+if(@$config['env'] === 'dev' || defined('MYAAC_INSTALL')) {
+	ini_set('display_errors', 1);
+	ini_set('display_startup_errors', 1);
+	error_reporting(E_ALL);
+}
+else {
+	ini_set('display_errors', 0);
+	ini_set('display_startup_errors', 0);
+	error_reporting(E_ALL & ~E_DEPRECATED & ~E_STRICT);
+}
+
+$autoloadFile = VENDOR . 'autoload.php';
+if (!is_file($autoloadFile)) {
+	throw new RuntimeException('The vendor folder is missing. Please download Composer: <a href="https://getcomposer.org/download">https://getcomposer.org/download</a>, install it and execute in the main MyAAC directory this command: <b>composer install</b>. Or download MyAAC from <a href="https://github.com/slawkens/myaac/releases">GitHub releases</a>, which includes Vendor folder.');
+}
+
+require $autoloadFile;
 
 function isHttps(): bool
 {

composer.json

@@ -0,0 +1,33 @@
+{
+    "require": {
+        "php": "^8.1",
+        "ext-pdo": "*",
+        "ext-pdo_mysql": "*",
+        "ext-json": "*",
+        "ext-xml": "*",
+        "ext-dom": "*",
+        "phpmailer/phpmailer": "^6.1",
+        "composer/semver": "^3.2",
+        "twig/twig": "^3.11",
+        "erusev/parsedown": "^1.7",
+        "nikic/fast-route": "^1.3",
+        "matomo/device-detector": "^6.0",
+        "illuminate/database": "^10.18",
+        "peppeocchi/php-cron-scheduler": "4.*",
+        "symfony/console": "^6.4",
+        "symfony/string": "^6.4",
+        "symfony/var-dumper": "^6.4",
+        "filp/whoops": "^2.15",
+        "maximebf/debugbar": "1.*",
+        "guzzlehttp/guzzle": "7.9.3"
+    },
+    "require-dev": {
+        "phpstan/phpstan": "^1.10"
+    },
+    "autoload": {
+        "psr-4": {
+            "MyAAC\\": "system/src"
+        },
+        "files": ["system/src/global.php"]
+    }
+}

config.php

@@ -1,302 +0,0 @@
-<?php
-/**
- * This is MyAAC's Main Configuration file
- *
- * All the default values are kept here, you should not modify it but use
- * a config.local.php file instead to override the settings from here.
- *
- * This is a piece of PHP code so PHP syntax applies!
- * For boolean values please use true/false.
- *
- * Minimally 'server_path' directive have to be filled, other options are optional.
- *
- * @package   MyAAC
- * @author    Slawkens <slawkens@gmail.com>
- * @copyright 2019 MyAAC
- * @link      https://my-aac.org
- */
-
-$config = array(
-	// directories & files
-	'server_path' => '', // path to the server directory (same directory where config file is located)
-
-	/**
-	 * Environment Setting
-	 *
-	 * if you use this script on your live server - set to 'prod' (production)
-	 * if you want to test and debug the script locally, or develop plugins, set to 'dev' (development)
-	 * WARNING: on 'dev' cache is disabled, so site will be significantly slower !!!
-	 * WARNING2: on 'dev' all PHP errors/warnings are displayed
-	 * Recommended: 'prod' cause of speed (page load time is better)
-	 */
-	'env' => 'prod', // 'prod' for production and 'dev' for development
-
-	'template' => 'kathrine', // template used by website (kathrine, tibiacom)
-	'template_allow_change' => true, // allow users to choose their own template while browsing website?
-
-	'vocations_amount' => 4, // how much basic vocations your server got (without promotion)
-
-	// what client version are you using on this OT?
-	// used for the Downloads page and some templates aswell
-	'client' => 1098, // 954 = client 9.54
-
-	'session_prefix' => 'myaac_', // must be unique for every site on your server
-	'friendly_urls' => false, // mod_rewrite is required for this, it makes links looks more elegant to eye, and also are SEO friendly (example: https://my-aac.org/guilds/Testing instead of https://my-aac.org/?subtopic=guilds&name=Testing). Remember to rename .htaccess.dist to .htaccess
-	'gzip_output' => false, // gzip page content before sending it to the browser, uses less bandwidth but more cpu cycles
-
-	// gesior backward support (templates & pages)
-	// allows using gesior templates and pages with myaac
-	// might bring some performance when disabled
-	'backward_support' => true,
-
-	// head options (html)
-	'meta_description' => 'Tibia is a free massive multiplayer online role playing game (MMORPG).', // description of the site
-	'meta_keywords' => 'free online game, free multiplayer game, ots, open tibia server', // keywords list separated by commas
-	'title_separator' => ' - ',
-
-	// footer
-	'footer' => ''/*'<br/>Your Server &copy; 2016. All rights reserved.'*/,
-
-	'language' => 'en', // default language (currently only 'en' available)
-	'language_allow_change' => false,
-
-	'visitors_counter' => true,
-	'visitors_counter_ttl' => 10, // how long visitor will be marked as online (in minutes)
-	'views_counter' => true,
-
-	// cache system. by default file cache is used
-	'cache_engine' => 'auto', // apc, apcu, eaccelerator, xcache, file, auto, or blank to disable.
-	'cache_prefix' => 'myaac_', // have to be unique if running more MyAAC instances on the same server (except file system cache)
-
-	// database details (leave blank for auto detect from config.lua)
-	'database_host' => '',
-	'database_port' => '', // leave blank to default 3306
-	'database_user' => '',
-	'database_password' => '',
-	'database_name' => '',
-	'database_log' => false, // should database queries be logged and and saved into system/logs/database.log?
-	'database_socket' => '', // set if you want to connect to database through socket (example: /var/run/mysqld/mysqld.sock)
-	'database_persistent' => false, // use database permanent connection (like server), may speed up your site
-	'database_encryption' => 'sha1',
-
-	// multiworld system (only TFS 0.3)
-	'multiworld' => false, // use multiworld system?
-	'worlds' => array( // list of worlds
-		//'1' => 'Your World Name',
-		//'2' => 'Your Second World Name'
-	),
-
-	// images
-	'outfit_images_url' => 'https://outfit-images.ots.me/outfit.php', // set to animoutfit.php for animated outfit
-	'item_images_url' => 'https://item-images.ots.me/1092/', // set to images/items if you host your own items in images folder
-
-	// account
-	'account_management' => true, // disable if you're using other method to manage users (fe. tfs account manager)
-	'account_create_auto_login' => false, // auto login after creating account?
-	'account_create_character_create' => true, // allow directly to create character on create account page?
-	'account_mail_verify' => false, // force users to confirm their email addresses when registering
-	'account_mail_confirmed_reward' => [ // reward users for confirming their E-Mails
-		// account_mail_verify needs to be enabled too
-		'premium_days' => 0,
-		'premium_points' => 0,
-		'coins' => 0,
-		'message' => 'You received %d %s for confirming your E-Mail address.' // example: You received 20 premium points for confirming your E-Mail address.
-	],
-	'account_mail_unique' => true, // email addresses cannot be duplicated? (one account = one email)
-	'account_premium_days' => 0, // default premium days on new account
-	'account_premium_points' => 0, // default premium points on new account
-	'account_welcome_mail' => true, // send welcome email when user registers
-	'account_mail_change' => 2, // how many days user need to change email to account - block hackers
-	'account_country' => true, // user will be able to set country of origin when registering account, this information will be viewable in others places aswell
-	'account_country_recognize' => true, // should country of user be automatically recognized by his IP? This makes an external API call to http://ipinfo.io
-	'account_change_character_name' => false, // can user change their character name for premium points?
-	'account_change_character_name_points' => 30, // cost of name change
-	'account_change_character_sex' => false, // can user change their character sex for premium points?
-	'account_change_character_sex_points' => 30, // cost of sex change
-	'characters_per_account' => 10,	// max. number of characters per account
-
-	// mail
-	'mail_enabled' => false, // is aac maker configured to send e-mails?
-	'mail_address' => 'no-reply@your-server.org', // server e-mail address (from:)
-	'mail_admin' => 'your-address@your-server.org', // admin email address, where mails from contact form will be sent
-	'mail_signature' => array( // signature that will be included at the end of every message sent using _mail function
-		'plain' => ""/*"--\nMy Server,\nhttp://www.myserver.com"*/,
-		'html' => ''/*'<br/>My Server,\n<a href="http://www.myserver.com">myserver.com</a>'*/
-	),
-	'smtp_enabled' => false, // send by smtp or mail function (set false if use mail function, set to true if you use GMail or Microsoft Outlook)
-	'smtp_host' => '', // mail host. smtp.gmail.com for GMail / smtp-mail.outlook.com for Microsoft Outlook
-	'smtp_port' => 25, // 25 (default) / 465 (ssl, GMail) / 587 (tls, Microsoft Outlook)
-	'smtp_auth' => true, // need authorization?
-	'smtp_user' => 'admin@example.org', // here your email username
-	'smtp_pass' => '',
-	'smtp_secure' => '', // What kind of encryption to use on the SMTP connection. Options: '', 'ssl' (GMail) or 'tls' (Microsoft Outlook)
-	'smtp_debug' => false, // set true to debug (you will see more info in error.log)
-
-	// reCAPTCHA (prevent spam bots)
-	'recaptcha_enabled' => false, // enable recaptcha verification code
-	'recaptcha_site_key' => '', // get your own site and secret keys at https://www.google.com/recaptcha
-	'recaptcha_secret_key' => '',
-	'recaptcha_theme' => 'light', // light, dark
-
-	//
-	'generate_new_reckey' => true,				// let player generate new recovery key, he will receive e-mail with new rec key (not display on page, hacker can't generate rec key)
-	'generate_new_reckey_price' => 20,			// price for new recovery key
-	'send_mail_when_change_password' => true,	// send e-mail with new password when change password to account
-	'send_mail_when_generate_reckey' => true,	// send e-mail with rec key (key is displayed on page anyway when generate)
-
-	// genders (aka sex)
-	'genders' => array(
-		0 => 'Female',
-		1 => 'Male'
-	),
-
-	// new character config
-	'character_samples' => array( // vocations, format: ID_of_vocation => 'Name of Character to copy'
-		//0 => 'Rook Sample',
-		1 => 'Sorcerer Sample',
-		2 => 'Druid Sample',
-		3 => 'Paladin Sample',
-		4 => 'Knight Sample'
-	),
-
-	'use_character_sample_skills' => false,
-
-	// it must show limited number of players after using search in character page
-	'characters_search_limit' => 15,
-
-	// town list used when creating character
-	// won't be displayed if there is only one item (rookgaard for example)
-	'character_towns' => array(1),
-
-	// characters length
-	// This is the minimum and the maximum length that a player can create a character. It is highly recommend the maximum length to be 21.
-	'character_name_min_length' => 4,
-	'character_name_max_length' => 21,
-
-	// list of towns
-	// if you use TFS 1.3 with support for 'towns' table in database, then you can ignore this - it will be configured automatically (generated from your .OTBM map)
-	'towns' => array(
-		0 => 'No town',
-		1 => 'Sample town'
-	),
-
-	// guilds
-	'guild_management' => true, // enable guild management system on the site?
-	'guild_need_level' => 1, // min. level to form a guild
-	'guild_need_premium' => true, // require premium account to form a guild?
-	'guild_image_size_kb' => 80, // maximum size of the guild logo image in KB (kilobytes)
-	'guild_description_chars_limit' => 1000, // limit of guild description
-	'guild_description_lines_limit' => 6, // limit of lines, if description has more lines it will be showed as long text, without 'enters'
-	'guild_motd_chars_limit' => 150, // limit of MOTD (message of the day) that is shown later in the game on the guild channel
-
-	// online page
-	'online_record' => true, // display players record?
-	'online_vocations' => false, // display vocation statistics?
-	'online_vocations_images' => false, // display vocation images?
-	'online_skulls' => false, // display skull images
-	'online_outfit' => true,
-	'online_afk' => false,
-
-	// support list page
-	'team_style' => 2, // 1/2 (1 - normal table, 2 - in boxes, grouped by group id)
-	'team_display_status' => true,
-	'team_display_lastlogin' => true,
-	'team_display_world' => false,
-	'team_display_outfit' => true,
-
-	// bans page
-	'bans_limit' => 50,
-	'bans_display_all' => true, // should all bans be displayed? (sorted page by page)
-
-	// highscores page
-	'highscores_vocation_box' => true, // show 'Choose a vocation' box on the highscores (allowing peoples to sort highscores by vocation)?
-	'highscores_vocation' => true, // show player vocation under his nickname?
-	'highscores_frags' => false, // show 'Frags' tab (best fraggers on the server)? Only 0.3
-	'highscores_balance' => false, // show 'Balance' tab (richest players on the server)
-	'highscores_outfit' => true, // show player outfit?
-	'highscores_country_box' => false, // doesnt work yet! (not implemented)
-	'highscores_groups_hidden' => 3, // this group id and higher won't be shown on the highscores
-	'highscores_ids_hidden' => array(0), // this ids of players will be hidden on the highscores (should be ids of samples)
-	'highscores_length' => 100, // how many records per page on highscores
-
-	// characters page
-	'characters' => array( // what things to display on character view page (true/false in each option)
-		'level' => true,
-		'experience' => false,
-		'magic_level' => false,
-		'balance' => false,
-		'marriage_info' => true, // only 0.3
-		'outfit' => true,
-		'creation_date' => true,
-		'quests' => true,
-		'skills' => true,
-		'equipment' => true,
-		'frags' => false,
-		'deleted' => false, // should deleted characters from same account be still listed on the list of characters? When enabled it will show that character is "[DELETED]"
-	),
-	'quests' => array(
-		//'Some Quest' => 123,
-		//'Some Quest Two' => 456,
-	), // quests list (displayed in character view), name => storage
-	'signature_enabled' => true,
-	'signature_type' => 'tibian', // signature engine to use: tibian, mango, gesior
-	'signature_cache_time' => 5, // how long to store cached file (in minutes), default 5 minutes
-	'signature_browser_cache' => 60, // how long to cache by browser (in minutes), default 1 hour
-
-	// news page
-	'news_limit' => 5, // limit of news on the latest news page
-	'news_ticker_limit' => 5, // limit of news in tickers (mini news) (0 to disable)
-	'news_date_format' => 'j.n.Y', // check php manual date() function for more info about this
-	'news_author' => true, // show author of the news
-
-	// gifts/shop system
-	'gifts_system' => false,
-
-	// support/system
-	'bug_report' => true, // this configurable has no effect, its always enabled
-
-	// forum
-	'forum' => 'site', // link to the server forum, set to "site" if you want to use build in forum system, otherwise leave empty if you aren't going to use any forum
-	'forum_level_required' => 0, // level required to post, 0 to disable
-	'forum_post_interval' => 30, // in seconds
-	'forum_posts_per_page' => 20,
-	'forum_threads_per_page' => 20,
-	// uncomment to force use table for forum
-	//'forum_table_prefix' => 'z_', // what forum mysql table to use, z_ (for gesior old forum) or myaac_ (for myaac)
-
-	// last kills
-	'last_kills_limit' => 50, // max. number of deaths shown on the last kills page
-
-	// status, took automatically from config file if empty
-	'status_enabled' => true, // you can disable status checking by settings this to "false"
-	'status_ip' => '127.0.0.1',
-	'status_port' => '',
-	'status_timeout' => 1.0, // how long to wait for the initial response from the server (default: 1 second)
-
-	// how often to connect to server and update status (default: every minute)
-	// if your status timeout in config.lua is bigger, that it will be used instead
-	// when server is offline, it will be checked every time web refreshes, ignoring this variable
-	'status_interval' => 60,
-
-	// admin panel
-	'admin_panel_modules' => 'lastlogin,points,coins',
-
-	// other
-	'anonymous_usage_statistics' => true,
-	'email_lai_sec_interval' => 60, // time in seconds between e-mails to one account from lost account interface, block spam
-	'google_analytics_id' => '', // e.g.: UA-XXXXXXX-X
-	'experiencetable_columns' => 3, // how many columns to display in experience table page. * experiencetable_rows, 5 = 500 (will show up to 500 level)
-	'experiencetable_rows' => 200, // till how many levels in one column
-	'date_timezone' => 'Europe/Berlin', // more info at http://php.net/manual/en/timezones.php
-	'footer_show_load_time' => true, // display load time of the page in the footer
-
-	'npc' => array(),
-
-	// character name blocked
-	'character_name_blocked' => array(
-		'prefix' => array(),
-		'names' => array(),
-		'words' => array(),
-	),
-
-);

cypress.config.js

@@ -0,0 +1,9 @@
+const { defineConfig } = require("cypress");
+
+module.exports = defineConfig({
+  e2e: {
+    setupNodeEvents(on, config) {
+      // implement node event listeners here
+    },
+  },
+});

cypress/e2e/1-install.cy.js

@@ -0,0 +1,76 @@
+describe('Install MyAAC', () => {
+	beforeEach(() => {
+		// Cypress starts out with a blank slate for each test
+		// so we must tell it to visit our website with the `cy.visit()` command.
+		// Since we want to visit the same URL at the start of all our tests,
+		// we include it in our beforeEach function so that it runs before each test
+		cy.visit(Cypress.env('URL'))
+	})
+
+	it('Go through installer', () => {
+		cy.visit(Cypress.env('URL') + '/install/?step=welcome')
+		cy.wait(1000)
+
+		cy.screenshot('install-welcome')
+
+		// step 1 - Welcome
+		cy.get('select[name="lang"]').select('en')
+
+		//cy.get('input[type=button]').contains('Next »').click()
+
+		cy.get('form').submit()
+
+		// step 2 - License
+		// just skip
+		cy.contains('GNU/GPL License');
+		cy.get('form').submit()
+
+		// step 3 - Requirements
+		cy.contains('Requirements check');
+
+		cy.get('#step').then(elem => {
+			elem.val('config');
+		});
+
+		cy.get('form').submit()
+
+		// step 4 - Configuration
+		cy.contains('Basic configuration');
+
+		cy.get('#vars_server_path').click().clear().type(Cypress.env('SERVER_PATH'))
+
+		cy.get('[type="checkbox"]').uncheck() // usage statistics uncheck
+
+		cy.wait(1000)
+
+		cy.get('form').submit()
+
+		// check if there is any error
+
+
+		// step 5 - Import Schema
+		cy.contains('Import MySQL schema');
+
+		// AAC is not installed yet, this message should not come
+		cy.contains('Seems AAC is already installed. Skipping importing MySQL schema..').should('not.exist')
+
+		cy.contains('[class="alert alert-success"]', 'Local configuration has been saved into file: config.local.php').should('be.visible')
+
+		cy.get('form').submit()
+
+		// step 6 - Admin Account
+		cy.get('#vars_email').click().clear().type('admin@my-aac.org')
+		cy.get('#vars_account').click().clear().type('admin')
+		cy.get('#vars_password').click().clear().type('test1234')
+		cy.get('#vars_password_confirm').click().clear().type('test1234')
+		cy.get('#vars_player_name').click().clear().type('Admin')
+
+		cy.get('form').submit()
+
+		cy.contains('[class="alert alert-success"]', 'Congratulations', { timeout: 60000 }).should('be.visible')
+
+		cy.wait(2000);
+
+		cy.screenshot('install-finish')
+	})
+})

cypress/e2e/2-create-account.cy.js

@@ -0,0 +1,33 @@
+describe('Create Account Page', () => {
+	beforeEach(() => {
+		// Cypress starts out with a blank slate for each test
+		// so we must tell it to visit our website with the `cy.visit()` command.
+		// Since we want to visit the same URL at the start of all our tests,
+		// we include it in our beforeEach function so that it runs before each test
+		cy.visit(Cypress.env('URL') + '/index.php/account/create')
+	})
+
+	it('Create Test Account', () => {
+		cy.screenshot('create-account-page')
+
+		cy.get('#account_input').type('tester')
+		cy.get('#email').type('tester@example.com')
+
+		cy.get('#password').type('test1234')
+		cy.get('#password_confirm').type('test1234')
+
+		cy.get('#character_name').type('Slaw')
+
+		cy.get('#sex1').check()
+		cy.get('#vocation1').check()
+		cy.get('#accept_rules').check()
+
+		cy.get('#createaccount').submit()
+
+		// no errors please
+		cy.contains('The Following Errors Have Occurred:').should('not.exist')
+
+		// ss of post page
+		cy.screenshot('create-account-page-post')
+	})
+})

cypress/e2e/3-check-public-pages.cy.js

@@ -0,0 +1,174 @@
+describe('Check Public Pages', () => {
+
+	/// news
+	it('Go to news page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/news',
+			method: 'GET',
+		})
+	})
+
+	it('Go to news archive page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/news/archive',
+			method: 'GET',
+		})
+	})
+
+	it('Go to changelog page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/change-log',
+			method: 'GET',
+		})
+	})
+
+	/// account management
+	it('Go to account manage page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/account/manage',
+			method: 'GET',
+		})
+	})
+
+	it('Go to account create page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/account/create',
+			method: 'GET',
+		})
+	})
+
+	it('Go to account lost page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/account/lost',
+			method: 'GET',
+		})
+	})
+
+	it('Go to rules page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/rules',
+			method: 'GET',
+		})
+	})
+
+	// community
+	it('Go to online page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/online',
+			method: 'GET',
+		})
+	})
+
+	it('Go to characters list page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/characters',
+			method: 'GET',
+		})
+	})
+
+	it('Go to guilds page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/guilds',
+			method: 'GET',
+		})
+	})
+
+	it('Go to highscores page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/highscores',
+			method: 'GET',
+		})
+	})
+
+	it('Go to last kills page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/last-kills',
+			method: 'GET',
+		})
+	})
+
+	it('Go to houses page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/houses',
+			method: 'GET',
+		})
+	})
+
+	it('Go to bans page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/bans',
+			method: 'GET',
+		})
+	})
+
+	it('Go to forum page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/forum',
+			method: 'GET',
+		})
+	})
+
+	it('Go to team page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/team',
+			method: 'GET',
+		})
+	})
+
+	// library
+	it('Go to monsters page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/monsters',
+			method: 'GET',
+		})
+	})
+
+	it('Go to spells page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/spells',
+			method: 'GET',
+		})
+	})
+
+	it('Go to server info page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/ots-info',
+			method: 'GET',
+		})
+	})
+
+	it('Go to commands page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/commands',
+			method: 'GET',
+		})
+	})
+
+	it('Go to downloads page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/downloads',
+			method: 'GET',
+		})
+	})
+
+	it('Go to gallery page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/gallery',
+			method: 'GET',
+		})
+	})
+
+	it('Go to experience table page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/exp-table',
+			method: 'GET',
+		})
+	})
+
+	it('Go to faq page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/faq',
+			method: 'GET',
+		})
+	})
+})

cypress/e2e/4-check-protected-pages.cy.js

@@ -0,0 +1,81 @@
+const REQUIRED_LOGIN_MESSAGE = 'Please enter your account name and your password.';
+const YOU_ARE_NOT_LOGGEDIN = 'You are not logged in.';
+
+describe('Check Protected Pages', () => {
+
+	// character actions
+	it('Go to account character creation page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/account/character/create',
+			method: 'GET',
+		})
+		cy.contains(REQUIRED_LOGIN_MESSAGE)
+	})
+
+	it('Go to account character deletion page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/account/character/delete',
+			method: 'GET',
+		})
+		cy.contains(REQUIRED_LOGIN_MESSAGE)
+	})
+
+	// account actions
+	it('Go to account email change page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/account/email',
+			method: 'GET',
+		})
+		cy.contains(REQUIRED_LOGIN_MESSAGE)
+	})
+
+	it('Go to account password change page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/account/password',
+			method: 'GET',
+		})
+		cy.contains(REQUIRED_LOGIN_MESSAGE)
+	})
+
+	it('Go to account info change page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/account/info',
+			method: 'GET',
+		})
+		cy.contains(REQUIRED_LOGIN_MESSAGE)
+	})
+
+	it('Go to account logout change page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/account/logout',
+			method: 'GET',
+		})
+		cy.contains(REQUIRED_LOGIN_MESSAGE)
+	})
+
+	// guild actions
+	it('Go to guild creation page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/?subtopic=guilds&action=create',
+			method: 'GET',
+		})
+		cy.contains(YOU_ARE_NOT_LOGGEDIN)
+	})
+
+	it('Go to guilds cleanup players action page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/?subtopic=guilds&action=cleanup_players',
+			method: 'GET',
+		})
+		cy.contains(YOU_ARE_NOT_LOGGEDIN)
+	})
+
+	it('Go to guilds cleanup guilds action page', () => {
+		cy.visit({
+			url: Cypress.env('URL') + '/?subtopic=guilds&action=cleanup_guilds',
+			method: 'GET',
+		})
+		cy.contains(YOU_ARE_NOT_LOGGEDIN)
+	})
+
+})

cypress/fixtures/example.json

@@ -0,0 +1,5 @@
+{
+  "name": "Using fixtures to represent data",
+  "email": "hello@cypress.io",
+  "body": "Fixtures are a great way to mock data for responses to routes"
+}

cypress/support/commands.js

@@ -0,0 +1,25 @@
+// ***********************************************
+// This example commands.js shows you how to
+// create various custom commands and overwrite
+// existing commands.
+//
+// For more comprehensive examples of custom
+// commands please read more here:
+// https://on.cypress.io/custom-commands
+// ***********************************************
+//
+//
+// -- This is a parent command --
+// Cypress.Commands.add('login', (email, password) => { ... })
+//
+//
+// -- This is a child command --
+// Cypress.Commands.add('drag', { prevSubject: 'element'}, (subject, options) => { ... })
+//
+//
+// -- This is a dual command --
+// Cypress.Commands.add('dismiss', { prevSubject: 'optional'}, (subject, options) => { ... })
+//
+//
+// -- This will overwrite an existing command --
+// Cypress.Commands.overwrite('visit', (originalFn, url, options) => { ... })

cypress/support/e2e.js

@@ -0,0 +1,20 @@
+// ***********************************************************
+// This example support/e2e.js is processed and
+// loaded automatically before your test files.
+//
+// This is a great place to put global configuration and
+// behavior that modifies Cypress.
+//
+// You can change the location of this file or turn off
+// automatically serving support files with the
+// 'supportFile' configuration option.
+//
+// You can read more here:
+// https://on.cypress.io/configuration
+// ***********************************************************
+
+// Import commands.js using ES2015 syntax:
+import './commands'
+
+// Alternatively you can use CommonJS syntax:
+// require('./commands')