Fix branch

Release v0.8.22
Update CHANGELOG.md
2025-09-14 04:23:34 +02:00 · 2025-01-27 22:04:54 +01:00 · 2025-01-27 22:04:17 +01:00 · 2025-01-27 22:03:55 +01:00 · 2025-01-27 21:45:59 +01:00 · 2025-01-27 21:30:39 +01:00
181 changed files with 1298 additions and 721 deletions
--- a/.github/workflows/phplint.yml
+++ b/.github/workflows/phplint.yml
@@ -0,0 +1,16 @@
+name: PHP Linting
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+
+jobs:
+  phplint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: overtrue/phplint@3.4.0
+        with:
+          path: .
+          options: --exclude="system/libs/polyfill-mbstring/bootstrap80.php"
--- a/.gitignore
+++ b/.gitignore
@@ -2,12 +2,21 @@ Thumbs.db
 .DS_Store
 .idea

+#
+/.htaccess
+
 # composer
 composer.lock
 vendor

 # npm
 node_modules
+tools/ext
+
+# cypress
+cypress.env.json
+cypress/e2e/2-advanced-examples
+cypress/screenshots

 # created by release.sh
 releases
@@ -28,6 +37,12 @@ images/guilds/*
 images/editor/*
 !images/editor/index.html

+# gallery images
+images/gallery/*
+!images/gallery/index.html
+!images/gallery/demon.jpg
+!images/gallery/demon_thumb.gif
+
 # cache
 system/cache/*
 !system/cache/index.html
@@ -37,7 +52,7 @@ system/cache/*

 # php sessions
 system/php_sessions/*
-!system/php_sessions//index.html
+!system/php_sessions/index.html

 # logs
 system/logs/*
--- a/.htaccess.dist
+++ b/.htaccess.dist
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,181 @@
 # Changelog

+## [0.8.22 - 27.01.2025]
+
+### Changed
+* Better exception handler, which clears the whole html output, so the message is better visible + better style (https://github.com/slawkens/myaac/commit/c304a9ab43bf0bda41907db3e6f65293350640a2 + https://github.com/slawkens/myaac/commit/7abc3c78334d44fb64684b26d8a305d0fe676caa)
+* Optimize $player->isOnline() function, thanks @gesior (https://github.com/slawkens/myaac/commit/7c3ebf70fa4751af986be7b46ee3530d4875271e)
+* All $cache->set calls should have $ttl (https://github.com/slawkens/myaac/commit/37ba9c7366139778d09d1316d7cb49a255165778)
+
+### Fixed
+* exception in lostaccount.php - $account->getName() (https://github.com/slawkens/myaac/commit/d390ea325e2dbfd87a830cfe40991f58e07a87a1)
+
+## [0.8.21 - 09.01.2025]
+
+### Added
+* support for button_color (red, green, blue) (https://github.com/slawkens/myaac/commit/b2c9eb474513650a014352d820602b8007eb3bf3)
+
+### Changed
+* Set default_socket_timeout for ipinfo.io checkup (https://github.com/slawkens/myaac/commit/e09fe517747e4f462c72395ede39759bf308d171)
+
+### Fixed
+* XSS in forum (https://github.com/slawkens/myaac/commit/580b888b1dd1317d7ccf5f888536159c3bfe4324)
+* move_thread by unauthorized user (https://github.com/slawkens/myaac/commit/19d3e15c114de65ef6c379e4da66d32138a0e7c4)
+* change sex wrong price deducted (https://github.com/slawkens/myaac/commit/39b19ed4c8724385ee80f7d02219e84f6b3f5d95)
+* fix for TFS 1.4.2 exception on creating character, where conditions column is NULL (https://github.com/slawkens/myaac/commit/5a68d204bb24392d424efde4133b0a3222e788bb)
+
+## [0.8.20 - 26.11.2024]
+
+Small fix regarding the latest release and the linux system.
+
+Download this one, instead of the 0.8.19 if you are using linux.
+
+If you are using 0.8.19, make this update:
+
+The fix is to make this change in the system/libs/hooks.php
+
+Change
+```
+require_once LIBS . 'src/plugins.php';
+```
+
+Into:
+```
+require_once LIBS . 'src/Plugins.php';
+```
+
+Yeah, we just changed 'p' to 'P' - that's just case-sensitive nature of linux.
+
+## [0.8.19 - 19.11.2024]
+
+### Added
+* syntactic sugar for db structure changes (https://github.com/slawkens/myaac/commit/e0036a3e32e8c37c28665dd7ae18ac9b8fc167d9)
+* add "None" vocation to highscores (https://github.com/slawkens/myaac/commit/7f4737631dfcb6ec255c6d9301304d3bf222a033)
+* new hooks in account manage + create (https://github.com/slawkens/myaac/commit/d40178104b0f411b9672102c49a4b87ac16e1779)
+* new functions: getGuildNameById($id) + getGuildLogoById($id) + Plugins::installMenus($templateName, $menus, $clearOld = false) (https://github.com/slawkens/myaac/commit/de1bb37bcb6d111fbdf185ef9c2fec7e7f05053e + https://github.com/slawkens/myaac/commit/d1c5a189c3b182a36933ed507c6ae36b61fe1d45 + https://github.com/slawkens/myaac/commit/5a953ce901522d080aa16fcfcd268e9544bf6e1a)
+
+### Changed
+* set default encryption to sha1 (https://github.com/slawkens/myaac/commit/55b8645d3f38c47f4aafc1906625b676c429cdd5)
+* prefer get_browser_real_ip() over REMOTE_ADDR (cause of Cloudflare and similar services) (https://github.com/slawkens/myaac/commit/b5bbae62b09db50a73bfa3e288245ea718005aa9)
+* allow account_create_character_create even if account_mail_verify is activated (https://github.com/slawkens/myaac/commit/1edf8833c844b25372017e4affaf12aa02cdce7a)
+* better https detection (patched from develop) (https://github.com/slawkens/myaac/commit/d73aceb272d0615244fcfd0998d75e6c6c15d3fe)
+* require login before create new thread (#261, @anyeor)
+* better tables.headline.html.twig (patched from 1.0) (https://github.com/slawkens/myaac/commit/71ef30d35ecb2f876e9b861f211f737302bf408e)
+
+### Fixed
+* bans page fixed functions getPlayerNameByAccount + getPlayerNameById (https://github.com/slawkens/myaac/commit/d39386cfabfa13e5c916ead69e2f8f90fdc47f4f)
+* account verify - do not allow login without verified email (https://github.com/slawkens/myaac/commit/1edf8833c844b25372017e4affaf12aa02cdce7a, Thanks @anyeor)
+* if <flags> is not present in monster.xml (https://github.com/slawkens/myaac/commit/81b6652738a7b04be3980cbf55443a6fbe437b34)
+* $db->update when there is null value (https://github.com/slawkens/myaac/commit/1458b7a412ff6875cebba1b88d380f7f959ee6be)
+* error on $db __destruct saving current script name in CLI (https://github.com/slawkens/myaac/commit/01660bd2b4967315c0e16d2f83c6c39f0b78683d)
+
+## [0.8.18 - 29.05.2024]
+
+### Added
+* hook in guilds page to support guild wars (https://github.com/slawkens/myaac/commit/f875f3cd2059fac5c23a08ce73dd8621a66613e0)
+
+## [0.8.17 - 18.05.2024]
+
+### Added
+* TwigTypeCastingExtension (https://github.com/slawkens/myaac/commit/7181b988e9518320d57486670ca4e2d3b2fe1cfa)
+
+### Fixed
+* fix XSS in creatures.php (https://github.com/slawkens/myaac/commit/02eea950e4fd756e8d5c32e56181986d51f5ac70, @gesior)
+* don't allow redirect to external website (https://github.com/slawkens/myaac/commit/ef62b53cec5a479cc85aa15940ad9ebbcefde876)
+* change_info if account_country is disabled (https://github.com/slawkens/myaac/commit/62d3c198d567541a90900fe2d7ede070e7b1ff68)
+
+### Changed
+* use word-break: break-all in guilds description + character comment (https://github.com/slawkens/myaac/commit/191ad25eb2d4c1cec6f6668da7a345fec0ad2a7f)
+* set default status_ip to 127.0.0.1, most server are hosted locally anyway (https://github.com/slawkens/myaac/commit/2793c41655b47f7db295143a298ccda70f11462b)
+
+## [0.8.16 - 12.02.2024]
+
+### Fixed
+* broken installation
+* database and finish step warnings/errors (https://github.com/slawkens/myaac/pull/245, @danilopucci)
+* silently ignore if the hook does not exist
+
+## [0.8.15 - 09.12.2023]
+
+More security fixes, especially in bugtracker.
+
+## [0-8.14 - 27.11.2023]
+Security fixes.
+
+### Fixed
+* XSS vulnerability in bugtracker (https://github.com/slawkens/myaac/commit/83a91ec540072d319dd338abff45f8d5ebf48190)
+* XSS vulnerability in forum (https://github.com/slawkens/myaac/commit/d1bc63d07ad88a143358cacd2c417891eea74dcc + https://github.com/slawkens/myaac/commit/55dbade8d5280c5baed45e5f7ebc3613b8e9b9e8)
+* Session Fixation (https://github.com/slawkens/myaac/commit/483155cf4c1e3068aaee0d44541dfa61f6223379)
+* displaying ban info on account page (https://github.com/slawkens/myaac/commit/764db0c203d1826ffce3a5a78f83a97e56bd0685)
+
+### Changed
+* Clear some additional cache keys - like database cache (https://github.com/slawkens/myaac/commit/4327b66f915d06dce504211692173606b9ef3b4e)
+
+## [0.8.13 - 16.09.2023]
+
+### Added
+* latest client versions to config (https://github.com/slawkens/myaac/commit/765886f0c782807400c429577cde5e45bd7c308f)
+* patching from develop - twig context for hooks (https://github.com/slawkens/myaac/commit/f1670f4012cc7595433fe0b1937c1f9b15a60b07)
+
+### Fixed
+* fixed XSS vulnerability in some pages (https://github.com/slawkens/myaac/commit/5c3b01aca4f3cfe8abc86b8ce48194b2da87b808)
+
+Nothing more or less!
+
+## [0.8.12 - 07.08.2023]
+I've moved the repository back to my personal account. (Just so you know!)
+
+I will also try to add git commits pointed to each change, lets see if you like it or not - you can comment in discussion, that will be created just after releasing this version :)
+
+### Added
+* forum: better error messages (Suggested by @anyeor) (https://github.com/slawkens/myaac/commit/34725e0257684fe5fa43875cc3a8f587ba04642e)
+* more support for GesiorAAC classes, so some of them will work with MyAAC (https://github.com/slawkens/myaac/commit/a8172a518ff8939c4402349b16c064fcaf855d31)
+* word-break on forum thread & reply (Suggested by @anyeor) (https://github.com/slawkens/myaac/commit/ce4aed0f1719d2aadc749e5238e883e3c10e2686)
+
+### Fixed
+* not working pages/links from database, introduced in 0.8.10 (Thanks to OtLand user - https://otland.net/members/0lo.99657/ for report) (https://github.com/slawkens/myaac/commit/1e874c7027769bd09e772a1cdac75d7e37991256)
+* it was possible to create topic in board that was closed, ommiting the error check (Thanks to @anyeor for report) (https://github.com/slawkens/myaac/commit/0d52978d9fb99869500d35e7676f454ca5eaba14)
+* PHP 8.2 compatibility - removed deprecated functions utf8_encode & utf8_decode (https://github.com/slawkens/myaac/commit/a338fd967cdbcc89e86be4e6b66b2cad2ff23251)
+* guild description not being correctly shown (Reported by @anyeor)  (https://github.com/slawkens/myaac/commit/f2a3ec1185df64ad9084d4ff55790ae4a5b3e5fd, https://github.com/slawkens/myaac/commit/df321154f63d458a4bc7d83bac5e3447b67317a4)
+
+### Removed
+* Some old code for verifying messages length (Reported by @anyeor) (https://github.com/slawkens/myaac/commit/df48363ea4ced4350fd90ffddf57d464ba5afa8b)
+* some info about config failed to load, was never working (https://github.com/slawkens/myaac/commit/7a546e5a41036b0e9e926d337c6f2e3c41c591d2)
+
+## [0.8.11 - 30.06.2023]
+
+### Added
+* new function from 0.9 - Cache::remember($key, $ttl, $callback)
+* new characters page hooks
+* line number & file to exception handler, to easier localize exceptions
+
+### Changed
+* rename to .htaccess.dist, causes some problems on default setup
+* removing unneccessary PHP closing tags to prevent potential issues (by @SRNT-GG)
+* display warning if hook file does not exist
+
+### Fixed
+* important: Not allow create char if limit is exceeded (by @anyeor) could have been used to spam database
+* deleted chars: cannot change comment, name, gender, cannot create guild, cannot be invited, cannot accept invite, cannot be passed leadership to
+* forum: quote and edit post buttons not being shown
+* twig exception thrown when player does not exist, on character change comment (thanks @anyeor)
+* BASE_DIR when accessing /tools
+* do not display warning if HTTP_ACCEPT_LANGUAGE is not set
+
+## [0.8.10 - 18.05.2023]
+
+### Changed
+* PHP 7.2.5 is now required, cause of Twig 2.x
+* allow pages to be placed in templates folder, under pages/ subfolder
+
+### Fixed
+* Twig error with global variable on create account
+* links/redirects from facebook, etc. like ?fbclid=x
+* do not allow to continue install when there is no server database imported
+* cannot go forward when config.local.php cannot be saved
+* when server uses another items serializer
+* small bug on install - please fill all input
+
 ## [0.8.9 - 16.03.2023]

 ### Added
--- a/README.md
+++ b/README.md
@@ -1,24 +1,29 @@
 # [MyAAC](https://my-aac.org)

-[![Build Status Master](https://img.shields.io/travis/slawkens/myaac/master)](https://travis-ci.org/github/slawkens/myaac)
-[![License: GPL-3.0](https://img.shields.io/github/license/slawkens/myaac)](https://opensource.org/licenses/gpl-license)
-[![Downloads Count](https://img.shields.io/github/downloads/slawkens/myaac/total)](https://github.com/slawkens/myaac/releases)
-[![PHP Versions](https://img.shields.io/travis/php-v/slawkens/myaac/master)](https://github.com/slawkens/myaac/blob/d8b3b4135827ee17e3c6d41f08a925e718c587ed/.travis.yml#L3)
-[![OpenTibia Discord](https://img.shields.io/discord/288399552581468162)](https://discord.gg/2J39Wus)
-[![Closed Issues](https://img.shields.io/github/issues-closed-raw/slawkens/myaac)](https://github.com/slawkens/myaac/issues?q=is%3Aissue+is%3Aclosed)
-
 MyAAC is a free and open-source Automatic Account Creator (AAC) written in PHP. It is a fork of the [Gesior](https://github.com/gesior/Gesior2012) project. It supports only MySQL databases.

 Official website: https://my-aac.org

+[![GitHub Workflow Status (with event)](https://img.shields.io/github/actions/workflow/status/slawkens/myaac/cypress.yml)](https://github.com/slawkens/myaac/actions)
+[![License: GPL-3.0](https://img.shields.io/github/license/slawkens/myaac)](https://opensource.org/licenses/gpl-license)
+[![Downloads Count](https://img.shields.io/github/downloads/slawkens/myaac/total)](https://github.com/slawkens/myaac/releases)
+[![OpenTibia Discord](https://img.shields.io/discord/288399552581468162)](https://discord.gg/2J39Wus)
+[![Closed Issues](https://img.shields.io/github/issues-closed-raw/slawkens/myaac)](https://github.com/slawkens/myaac/issues?q=is%3Aissue+is%3Aclosed)
+
+| Version | Status                 | Branch  | Requirements   |
+|:--------|:-----------------------|:--------|:---------------|
+| **1.x** | **Active development** | develop | **PHP >= 8.1** |
+| 0.9.x   | Not developed anymore  | 0.9     | PHP >= 7.2.5   |
+| 0.8.x   | Active support         | master  | PHP >= 7.2.5   |
+| 0.7.x   | End Of Life            | 0.7     | PHP >= 5.3.3   |
+
 ### Requirements

-	- PHP 5.6 or later
 	- MySQL database
-	- PDO PHP Extension
-	- XML PHP Extension
-	- ZIP PHP Extension
-	- (optional) mod_rewrite to use friendly_urls
+	- PHP Extensions: pdo, xml, json
+	- (optional) apache2 mod_rewrite (to use friendly_urls)
+	- (optional) zip PHP Extension (to install plugins)
+	- (optional) gd PHP Extension (for generating signature images)

 ### Installation

@@ -42,7 +47,8 @@ Official website: https://my-aac.org

 ### Configuration

-Check *config.php* to get more informations.
+Check *config.php* to get more informations. (Notice: MyAAC 1.0+ doesn't use config.php anymore, it has been moved to Admin Panel - Settings page).
+
 Use *config.local.php* for your local configuration changes.

 ### Branches
@@ -73,6 +79,12 @@ Look: [Contributing](https://github.com/otsoft/myaac/wiki/Contributing) in our w

 If you have a great idea or want contribute to the project - visit our website at https://www.my-aac.org

+## Project supported by JetBrains
+
+Many thanks to Jetbrains for kindly providing a license for me to work on this and other open-source projects.
+
+[![JetBrains](https://resources.jetbrains.com/storage/products/company/brand/logos/jb_beam.svg)](https://www.jetbrains.com/?from=https://github.com/slawkens)
+
 ### License

 This program and all associated files are released under the GNU Public License.  
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -0,0 +1,16 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.x.y   | :white_check_mark: |
+| 0.9.x   | :x:                |
+| 0.8.x   | :white_check_mark: |
+| < 0.7   | :x:                |
+
+## Reporting a Vulnerability
+
+If you found a security vulnerability, please write an email to security@my-aac.org
+
+All reports will be taken very seriously, and a fix will be posted as soon as possible.
--- a/admin/includes/functions.php
+++ b/admin/includes/functions.php
@@ -1 +1,2 @@
-<?php
+<?php
+// nothing yet here
--- a/admin/index.php
+++ b/admin/index.php
@@ -68,4 +68,4 @@ ob_end_clean();
 // template
 $template_path = 'template/';
 require ADMIN . $template_path . 'template.php';
-?>
+
--- a/admin/pages/accounts.php
+++ b/admin/pages/accounts.php
@@ -426,7 +426,7 @@ else if ($id > 0 && isset($account) && $account->isLoaded()) {
 		<div class="box-body">
 			<form action="<?php echo $base; ?>" method="post">
 				<div class="input-group input-group-sm">
-					<input type="text" class="form-control" name="search_name" value="<?php echo $search_account; ?>"
+					<input type="text" class="form-control" name="search_name" value="<?php echo escapeHtml($search_account); ?>"
 						   maxlength="32" size="32">
 					<span class="input-group-btn">
                          <button type="submit" type="button" class="btn btn-info btn-flat">Search</button>
--- a/admin/pages/items.php
+++ b/admin/pages/items.php
@@ -10,8 +10,8 @@
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Load items.xml';

-require LIBS . 'items.php';
-require LIBS . 'weapons.php';
+require_once LIBS . 'items.php';
+require_once LIBS . 'weapons.php';

 $twig->display('admin.items.html.twig');

--- a/admin/pages/pages.php
+++ b/admin/pages/pages.php
@@ -196,5 +196,3 @@ class Pages
 		return !count($errors);
 	}
 }
-
-?>
--- a/admin/pages/players.php
+++ b/admin/pages/players.php
@@ -210,7 +210,7 @@ if ($id > 0) {

 		if ($hasBlessingsColumn) {
 			$blessings = $_POST['blessings'];
-			verify_number($blessings, 'Blessings', 2);
+			verify_number($blessings, 'Blessings', 3);
 		}

 		$balance = $_POST['balance'];
@@ -784,7 +784,7 @@ else if ($id > 0 && isset($player) && $player->isLoaded())
 			<div class="box-body">
 				<form action="<?php echo $base; ?>" method="post">
 					<div class="input-group input-group-sm">
-						<input type="text" class="form-control" name="search_name" value="<?php echo $search_name; ?>"
+						<input type="text" class="form-control" name="search_name" value="<?php echo escapeHtml($search_name); ?>"
 							   maxlength="32" size="32">
 						<span class="input-group-btn">
                          <button type="submit" type="button" class="btn btn-info btn-flat">Search</button>
--- a/admin/pages/plugins.php
+++ b/admin/pages/plugins.php
@@ -10,8 +10,6 @@
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'Plugin manager';

-require_once LIBS . 'plugins.php';
-
 $twig->display('admin.plugins.form.html.twig');

 if (isset($_REQUEST['uninstall'])) {
--- a/admin/pages/statistics.php
+++ b/admin/pages/statistics.php
@@ -36,4 +36,3 @@ $twig->display('admin.statistics.html.twig', array(
 	'account_type' => (USE_ACCOUNT_NAME ? 'name' : 'number'),
 	'points' => $points
 ));
-?>
--- a/admin/pages/version.php
+++ b/admin/pages/version.php
@@ -47,4 +47,3 @@ function version_revert($version)
 	$release = $version;
 	return $major . '.' . $minor . '.' . $release;
 }*/
-?>
--- a/admin/tools/phpinfo.php
+++ b/admin/tools/phpinfo.php
@@ -13,4 +13,3 @@ if(!function_exists('phpinfo'))
 	die('phpinfo() disabled on this web server.');

 phpinfo();
-?>
--- a/common.php
+++ b/common.php
@@ -23,10 +23,10 @@
 * @copyright 2019 MyAAC
 * @link      https://my-aac.org
 */
-if (version_compare(phpversion(), '5.6', '<')) die('PHP version 5.6 or higher is required.');
+if (version_compare(phpversion(), '7.2.5', '<')) die('PHP version 7.2.5 or higher is required.');

 define('MYAAC', true);
-define('MYAAC_VERSION', '0.8.9');
+define('MYAAC_VERSION', '0.8.22');
 define('DATABASE_VERSION', 33);
 define('TABLE_PREFIX', 'myaac_');
 define('START_TIME', microtime(true));
@@ -97,9 +97,13 @@ $size = count($tmp) - 1;
 for($i = 1; $i < $size; $i++)
 	$basedir .= '/' . $tmp[$i];

-$basedir = str_replace(array('/admin', '/install'), '', $basedir);
+$basedir = str_replace(array('/admin', '/install', '/tools'), '', $basedir);
 define('BASE_DIR', $basedir);

+if (file_exists(BASE . 'config.local.php') && !defined('MYAAC_INSTALL')) {
+	require BASE . 'config.local.php';
+}
+
 if(!IS_CLI) {
 	if (isset($_SERVER['HTTP_HOST'][0])) {
 		$baseHost = $_SERVER['HTTP_HOST'];
@@ -111,12 +115,21 @@ if(!IS_CLI) {
 		}
 	}

-	define('SERVER_URL', 'http' . (isset($_SERVER['HTTPS'][0]) && strtolower($_SERVER['HTTPS']) === 'on' ? 's' : '') . '://' . $baseHost);
+	define('SERVER_URL', 'http' . (isHttps() ? 's' : '') . '://' . $baseHost);
 	define('BASE_URL', SERVER_URL . BASE_DIR . '/');
 	define('ADMIN_URL', SERVER_URL . BASE_DIR . '/admin/');

 	//define('CURRENT_URL', BASE_URL . $_SERVER['REQUEST_URI']);
-
-	require SYSTEM . 'exception.php';
+	if(@$config['env'] === 'dev') {
+		require SYSTEM . 'exception.php';
+	}
 }
 require SYSTEM . 'autoload.php';
+
+function isHttps(): bool
+{
+	return
+		(!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) === 'https')
+		|| (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
+		|| (isset($_SERVER['SERVER_PORT']) && (int) $_SERVER['SERVER_PORT'] === 443);
+}
--- a/config.php
+++ b/config.php
@@ -77,6 +77,7 @@ $config = array(
 	'database_log' => false, // should database queries be logged and and saved into system/logs/database.log?
 	'database_socket' => '', // set if you want to connect to database through socket (example: /var/run/mysqld/mysqld.sock)
 	'database_persistent' => false, // use database permanent connection (like server), may speed up your site
+	'database_encryption' => 'sha1',

 	// multiworld system (only TFS 0.3)
 	'multiworld' => false, // use multiworld system?
@@ -268,9 +269,9 @@ $config = array(

 	// status, took automatically from config file if empty
 	'status_enabled' => true, // you can disable status checking by settings this to "false"
-	'status_ip' => '',
+	'status_ip' => '127.0.0.1',
 	'status_port' => '',
-	'status_timeout' => 2, // how long to wait for the initial response from the server (default: 2 seconds)
+	'status_timeout' => 1.0, // how long to wait for the initial response from the server (default: 1 second)

 	// how often to connect to server and update status (default: every minute)
 	// if your status timeout in config.lua is bigger, that it will be used instead
@@ -290,12 +291,12 @@ $config = array(
 	'footer_show_load_time' => true, // display load time of the page in the footer

 	'npc' => array(),
-	
+
 	// character name blocked
 	'character_name_blocked' => array(
 		'prefix' => array(),
 		'names' => array(),
 		'words' => array(),
 	),
-	
+
 );
--- a/images/gallery/index.html
+++ b/images/gallery/index.html
--- a/index.php
+++ b/index.php
@@ -24,6 +24,7 @@
 * @link      https://my-aac.org
 */

+ob_start();
 require_once 'common.php';
 require_once SYSTEM . 'functions.php';

@@ -74,6 +75,14 @@ if((!isset($config['installed']) || !$config['installed']) && file_exists(BASE .
 	throw new RuntimeException('Setup detected that <b>install/</b> directory exists. Please visit <a href="' . BASE_URL . 'install">this</a> url to start MyAAC Installation.<br/>Delete <b>install/</b> directory if you already installed MyAAC.<br/>Remember to REFRESH this page when you\'re done!');
 }

+require_once SYSTEM . 'init.php';
+require_once SYSTEM . 'template.php';
+
+// verify myaac tables exists in database
+if(!$db->hasTable('myaac_account_actions')) {
+	throw new RuntimeException('Seems that the table <strong>myaac_account_actions</strong> of MyAAC doesn\'t exist in the database. This is a fatal error. You can try to reinstall MyAAC by visiting <a href="' . BASE_URL . 'install">this</a> url.');
+}
+
 $found = false;
 if(empty($uri) || isset($_REQUEST['template'])) {
 	$_REQUEST['p'] = 'news';
@@ -81,7 +90,11 @@ if(empty($uri) || isset($_REQUEST['template'])) {
 }
 else {
 	$tmp = strtolower($uri);
-	if(!preg_match('/[^A-z0-9_\-]/', $uri) && file_exists(SYSTEM . 'pages/' . $tmp . '.php')) {
+	if (!preg_match('/[^A-z0-9_\-]/', $uri) && file_exists(TEMPLATES . $template_name . '/pages/' . $tmp . '.php')) {
+		$_REQUEST['p'] = $uri;
+		$found = true;
+	}
+	else if (!preg_match('/[^A-z0-9_\-]/', $uri) && file_exists(SYSTEM . 'pages/' . $tmp . '.php')) {
 		$_REQUEST['p'] = $uri;
 		$found = true;
 	}
@@ -133,13 +146,13 @@ else {
 			'/^houses\/view\/?$/' => array('subtopic' => 'houses', 'page' => 'view')
 		);

-		foreach($rules as $rule => $redirect) {
+		foreach ($rules as $rule => $redirect) {
 			if (preg_match($rule, $uri)) {
 				$tmp = explode('/', $uri);
 				/* @var $redirect array */
-				foreach($redirect as $key => $value) {
+				foreach ($redirect as $key => $value) {

-					if(strpos($value, '$') !== false) {
+					if (strpos($value, '$') !== false) {
 						$value = str_replace('$' . $value[1], $tmp[$value[1]], $value);
 					}

@@ -154,6 +167,12 @@ else {
 	}
 }

+// handle ?fbclid=x, etc. (show news page)
+if (!$found && count($_GET) > 0 && !isset($_REQUEST['subtopic']) && !isset($_REQUEST['p']) && !in_array($_SERVER['QUERY_STRING'], getDatabasePages())) {
+	$_REQUEST['p'] = $_REQUEST['subtopic'] = 'news';
+	$found = true;
+}
+
 // define page visited, so it can be used within events system
 $page = isset($_REQUEST['subtopic']) ? $_REQUEST['subtopic'] : (isset($_REQUEST['p']) ? $_REQUEST['p'] : '');
 if(empty($page) || !preg_match('/^[A-z0-9\_\-]+$/', $page)) {
@@ -174,18 +193,10 @@ define('PAGE', $page);

 $template_place_holders = array();

-require_once SYSTEM . 'init.php';
-
-// verify myaac tables exists in database
-if(!$db->hasTable('myaac_account_actions')) {
-	throw new RuntimeException('Seems that the table <strong>myaac_account_actions</strong> of MyAAC doesn\'t exist in the database. This is a fatal error. You can try to reinstall MyAAC by visiting <a href="' . BASE_URL . 'install">this</a> url.');
-}
-
 // event system
 require_once SYSTEM . 'hooks.php';
 $hooks = new Hooks();
 $hooks->load();
-require_once SYSTEM . 'template.php';
 require_once SYSTEM . 'login.php';
 require_once SYSTEM . 'status.php';

@@ -211,7 +222,7 @@ if(isset($config['anonymous_usage_statistics']) && $config['anonymous_usage_stat
 		if(fetchDatabaseConfig('last_usage_report', $value)) {
 			$should_report = time() > (int)$value + $report_time;
 			if($cache->enabled()) {
-				$cache->set('last_usage_report', $value);
+				$cache->set('last_usage_report', $value, 60 * 60);
 			}
 		}
 		else {
@@ -226,7 +237,7 @@ if(isset($config['anonymous_usage_statistics']) && $config['anonymous_usage_stat

 		updateDatabaseConfig('last_usage_report', time());
 		if($cache->enabled()) {
-			$cache->set('last_usage_report', time());
+			$cache->set('last_usage_report', time(), 60 * 60);
 		}
 	}
 }
@@ -288,6 +299,7 @@ if($config['backward_support']) {
 	$config['site'] = &$config;
 	$config['server'] = &$config['lua'];
 	$config['site']['shop_system'] = $config['gifts_system'];
+	$config['site']['gallery_page'] = true;

 	if(!isset($config['vdarkborder']))
 		$config['vdarkborder'] = '#505050';
@@ -335,12 +347,10 @@ if($load_it)
 				)) . $content;
 		}
 	} else {
-		$file = TEMPLATES . $template_name . '/pages/' . $page . '.php';
-		if(!@file_exists($file) || preg_match('/[^A-z0-9_\-]/', $page))
-		{
-			$file = SYSTEM . 'pages/' . $page . '.php';
-			if(!@file_exists($file) || preg_match('/[^A-z0-9_\-]/', $page))
-			{
+		$file = TEMPLATES . "$template_name/pages/$page.php";
+		if(!@file_exists($file) || preg_match('/[^A-z0-9_\-]/', $page)) {
+			$file = SYSTEM . "pages/$page.php";
+			if(!@file_exists($file) || preg_match('/[^A-z0-9_\-]/', $page)) {
 				$page = '404';
 				$file = SYSTEM . 'pages/404.php';
 			}
--- a/install/includes/config.php
+++ b/install/includes/config.php
@@ -38,4 +38,3 @@ if(!isset($error) || !$error) {
 		$error = true;
 	}
 }
-?>
--- a/install/index.php
+++ b/install/index.php
@@ -70,7 +70,7 @@ if($step == 'database') {

 		$key = str_replace('var_', '', $key);

-		if(in_array($key, array('account', 'password', 'email', 'player_name'))) {
+		if(in_array($key, array('account', 'account_id', 'password', 'email', 'player_name'))) {
 			continue;
 		}

@@ -114,14 +114,12 @@ if($step == 'database') {
 	}
 }
 else if($step == 'admin') {
-	$config_failed = true;
-	if(file_exists(BASE . 'config.local.php') && isset($config['installed']) && $config['installed'] && isset($_SESSION['saved'])) {
-		$config_failed = false;
-	}
-
-	if($config_failed) {
+	if(!file_exists(BASE . 'config.local.php') || !isset($config['installed']) || !$config['installed']) {
 		$step = 'database';
 	}
+	else {
+		$_SESSION['saved'] = true;
+	}
 }
 else if($step == 'finish') {
 	$email = $_SESSION['var_email'];
@@ -191,14 +189,14 @@ clearstatcache();
 if(is_writable(CACHE) && (MYAAC_OS != 'WINDOWS' || win_is_writable(CACHE))) {
 	if(!file_exists(BASE . 'install/ip.txt')) {
 		$content = warning('AAC installation is disabled. To enable it make file <b>ip.txt</b> in install/ directory and put there your IP.<br/>
-		Your IP is:<br /><b>' . $_SERVER['REMOTE_ADDR'] . '</b>', true);
+		Your IP is:<br /><b>' . get_browser_real_ip() . '</b>', true);
 	}
 	else {
 		$file_content = trim(file_get_contents(BASE . 'install/ip.txt'));
 		$allow = false;
 		$listIP = preg_split('/\s+/', $file_content);
 		foreach($listIP as $ip) {
-			if($_SERVER['REMOTE_ADDR'] == $ip) {
+			if(get_browser_real_ip() == $ip) {
 				$allow = true;
 			}
 		}
--- a/install/steps/2-license.php
+++ b/install/steps/2-license.php
@@ -5,4 +5,3 @@ $twig->display('install.license.html.twig', array(
 	'license' => file_get_contents(BASE . 'LICENSE'),
 	'buttons' => next_buttons()
 ));
-?>
--- a/install/steps/4-config.php
+++ b/install/steps/4-config.php
@@ -18,4 +18,3 @@ $twig->display('install.config.html.twig', array(
 	'errors' => isset($errors) ? $errors : null,
 	'buttons' => next_buttons()
 ));
-?>
--- a/install/steps/5-database.php
+++ b/install/steps/5-database.php
@@ -57,16 +57,35 @@ if(!$error) {
 			error($database_error);
 		}
 		else {
-			$twig->display('install.installer.html.twig', array(
-				'url' => 'tools/5-database.php',
-				'message' => $locale['loading_spinner']
-			));
+			if(!$db->hasTable('accounts')) {
+				$tmp = str_replace('$TABLE$', 'accounts', $locale['step_database_error_table']);
+				error($tmp);
+				$error = true;
+			}
+
+			if(!$db->hasTable('players')) {
+				$tmp = str_replace('$TABLE$', 'players', $locale['step_database_error_table']);
+				error($tmp);
+				$error = true;
+			}
+
+			if(!$db->hasTable('guilds')) {
+				$tmp = str_replace('$TABLE$', 'guilds', $locale['step_database_error_table']);
+				error($tmp);
+				$error = true;
+			}

 			if(!$error) {
+				$twig->display('install.installer.html.twig', array(
+					'url' => 'tools/5-database.php',
+					'message' => $locale['loading_spinner']
+				));
+
 				if(!Validator::email($_SESSION['var_mail_admin'])) {
 					error($locale['step_config_mail_admin_error']);
 					$error = true;
 				}
+
 				if(!Validator::email($_SESSION['var_mail_address'])) {
 					error($locale['step_config_mail_address_error']);
 					$error = true;
@@ -92,7 +111,7 @@ if(!$error) {
 					unset($_SESSION['saved']);

 					$locale['step_database_error_file'] = str_replace('$FILE$', '<b>' . BASE . 'config.local.php</b>', $locale['step_database_error_file']);
-					warning($locale['step_database_error_file'] . '<br/>
+					error($locale['step_database_error_file'] . '<br/>
 						<textarea cols="70" rows="10">' . $content . '</textarea>');
 				}
 			}
@@ -103,6 +122,6 @@ if(!$error) {

 <form action="<?php echo BASE_URL; ?>install/" method="post">
 	<input type="hidden" name="step" id="step" value="admin" />
-	<?php echo next_buttons(true, $error ? false : true);
+	<?php echo next_buttons(true, !$error);
 	?>
-</form>
+</form>
--- a/install/steps/7-finish.php
+++ b/install/steps/7-finish.php
@@ -79,6 +79,8 @@ else {

 		$account_used->setCustomField('web_flags', FLAG_ADMIN + FLAG_SUPER_ADMIN);
 		$account_used->setCustomField('country', 'us');
+		$account_used->setCustomField('email_verified', 1);
+
 		if($db->hasColumn('accounts', 'group_id'))
 			$account_used->setCustomField('group_id', $groups->getHighestId());
 		if($db->hasColumn('accounts', 'type'))
--- a/install/template/template.php
+++ b/install/template/template.php
@@ -1,3 +1,4 @@
+<?php defined('MYAAC') or die('Direct access not allowed!'); ?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" dir="<?php echo $locale['direction']; ?>" lang="<?php echo $locale['lang']; ?>" xml:lang="<?php echo $locale['lang']; ?>">
 <head>
@@ -45,4 +46,4 @@
 		<p style="text-align: center;"><?php echo base64_decode('UG93ZXJlZCBieSA8YSBocmVmPSJodHRwOi8vbXktYWFjLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPk15QUFDLjwvYT4='); ?></p>
 	</div>
 </body>
-</html>
+</html>
--- a/install/tools/5-database.php
+++ b/install/tools/5-database.php
@@ -11,8 +11,10 @@ $error = false;
 require BASE . 'install/includes/config.php';

 ini_set('max_execution_time', 300);
+
+@ob_end_flush();
 ob_implicit_flush();
-ob_end_flush();
+
 header('X-Accel-Buffering: no');

 if(!$error) {
@@ -23,24 +25,6 @@ if(!$error) {
 	}
 }

-if(!$db->hasTable('accounts')) {
-	$locale['step_database_error_table'] = str_replace('$TABLE$', 'accounts', $locale['step_database_error_table']);
-	error($locale['step_database_error_table']);
-	return;
-}
-
-if(!$db->hasTable('players')) {
-	$locale['step_database_error_table'] = str_replace('$TABLE$', 'players', $locale['step_database_error_table']);
-	error($locale['step_database_error_table']);
-	return;
-}
-
-if(!$db->hasTable('guilds')) {
-	$locale['step_database_error_table'] = str_replace('$TABLE$', 'guilds', $locale['step_database_error_table']);
-	error($locale['step_database_error_table']);
-	return;
-}
-
 if($db->hasTable(TABLE_PREFIX . 'account_actions')) {
 	$locale['step_database_error_table_exist'] = str_replace('$TABLE$', TABLE_PREFIX . 'account_actions', $locale['step_database_error_table_exist']);
 	warning($locale['step_database_error_table_exist']);
--- a/install/tools/7-finish.php
+++ b/install/tools/7-finish.php
@@ -8,8 +8,10 @@ require BASE . 'install/includes/functions.php';
 require BASE . 'install/includes/locale.php';

 ini_set('max_execution_time', 300);
+
+@ob_end_flush();
 ob_implicit_flush();
-ob_end_flush();
+
 header('X-Accel-Buffering: no');

 if(isset($config['installed']) && $config['installed'] && !isset($_SESSION['saved'])) {
--- a/nginx-sample.conf
+++ b/nginx-sample.conf
@@ -10,28 +10,27 @@ server {
 	# this is very important, be sure its in your nginx conf - it prevents access to logs etc.
 	location ~ /system {
 		deny all;
-		return 404;
 	}

-	# block .htaccess
-	location ~ /\.ht {
+	# block .htaccess, CHANGELOG.md, composer.json etc.
+	# this is to prevent finding software versions
+	location ~\.(ht|md|json|dist)$ {
 		deny all;
 	}

 	# block git files and folders
 	location ~ /\.git {
-		return 404;
 		deny all;
 	}

 	location / {
-		try_files $uri $uri/ /index.php;
+		try_files $uri $uri/ /index.php?$query_string;;
 	}

 	location ~ \.php$ {
 		include snippets/fastcgi-php.conf;
 		fastcgi_read_timeout 240;
 		fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
-		# for ubuntu 22.04+ it will be php8.1-fpm.-sock
+		# for ubuntu 22.04+ it will be php8.1-fpm.sock
 	}
 }
--- a/plugins/email-confirmed-reward/reward.php
+++ b/plugins/email-confirmed-reward/reward.php
@@ -4,12 +4,12 @@ defined('MYAAC') or die('Direct access not allowed!');
 $reward = config('account_mail_confirmed_reward');

 $hasCoinsColumn = $db->hasColumn('accounts', 'coins');
-if ($reward['coins'] > 0 && $hasCoinsColumn) {
+if ($reward['coins'] > 0 && !$hasCoinsColumn) {
 	log_append('email_confirm_error.log', 'accounts.coins column does not exist.');
 }

 if (!isset($account) || !$account->isLoaded()) {
-	log_append('email_confirm_error.log', 'Account not loaded.');
+	//log_append('email_confirm_error.log', 'Account not loaded.');
 	return;
 }

--- a/release.sh
+++ b/release.sh
@@ -22,7 +22,7 @@ if [ $1 = "prepare" ]; then
 	mkdir -p tmp

 	# get myaac from git archive
-	git archive --format zip --output tmp/myaac.zip master
+	git archive --format zip --output tmp/myaac.zip 0.8

 	cd tmp/ || exit

--- a/system/bin/install_plugin.php
+++ b/system/bin/install_plugin.php
@@ -9,7 +9,6 @@ require_once __DIR__ . '/../../common.php';
 require_once SYSTEM . 'functions.php';
 require_once SYSTEM . 'init.php';
 require_once SYSTEM . 'hooks.php';
-require_once LIBS . 'plugins.php';

 if($argc !== 2) {
 	echo 'This command expects one parameter: zip file name (plugin)' . PHP_EOL;
--- a/system/clients.conf.php
+++ b/system/clients.conf.php
@@ -99,4 +99,14 @@ $config['clients'] = [
 	1291,

 	1300,
+	1310,
+	1311,
+	1312,
+	1316,
+	1320,
+	1321,
+	1322,
+	1330,
+	1332,
+	1340,
 ];
--- a/system/compat/classes.php
+++ b/system/compat/classes.php
@@ -9,7 +9,30 @@
 */
 defined('MYAAC') or die('Direct access not allowed!');

-class Player extends OTS_Player {}
-class Guild extends OTS_Guild {}
+class Account extends OTS_Account {
+	public function loadById($id) {
+		$this->load($id);
+	}
+	public function loadByName($name) {
+		$this->find($name);
+	}
+}
+
+class Player extends OTS_Player {
+	public function loadById($id) {
+		$this->load($id);
+	}
+	public function loadByName($name) {
+		$this->find($name);
+	}
+}
+class Guild extends OTS_Guild {
+	public function loadById($id) {
+		$this->load($id);
+	}
+	public function loadByName($name) {
+		$this->find($name);
+	}
+}
 class GuildRank extends OTS_GuildRank {}
 class House extends OTS_House {}
--- a/system/compat/pages.php
+++ b/system/compat/pages.php
@@ -10,6 +10,14 @@
 defined('MYAAC') or die('Direct access not allowed!');
 switch($page)
 {
+	case 'adminpanel':
+		header('Location: ' . ADMIN_URL);
+		die;
+
+	case 'archive':
+		$page = 'newsarchive';
+		break;
+
 	case 'whoisonline':
 		$page = 'online';
 		break;
@@ -37,4 +45,3 @@ switch($page)
 	default:
 		break;
 }
-?>
--- a/system/counter.php
+++ b/system/counter.php
@@ -51,4 +51,3 @@ else
 		updateDatabaseConfig('views_counter', $views_counter); // update counter
 	}
 }
-?>
--- a/system/database.php
+++ b/system/database.php
@@ -116,5 +116,4 @@ defined('MYAAC') or die('Direct access not allowed!');
 				'<li>MySQL is not configured propertly in <i>config.lua</i>.</li>' .
 				'<li>MySQL server is not running.</li>' .
 			'</ul>' . $error->getMessage());
-
 	}
--- a/system/exception.php
+++ b/system/exception.php
@@ -23,6 +23,8 @@ function exception_handler($exception) {

 	$backtrace_formatted = nl2br($exception->getTraceAsString());

+	$message = $message . "<br/><br/>File: {$exception->getFile()}<br/>Line: {$exception->getLine()}";
+
 	// display basic error message without template
 	// template is missing, why? probably someone deleted templates dir, or it wasn't downloaded right
 	$template_file = SYSTEM . 'templates/exception.html.twig';
@@ -35,12 +37,14 @@ function exception_handler($exception) {
 	}

 	// display beautiful error message
-	// the file is .twig.html, but its not really parsed by Twig
+	// the file is .twig.html, but it's not really parsed by Twig
 	// we just replace some values manually
 	// cause in case Twig throws exception, we can show it too
 	$content = file_get_contents($template_file);
 	$content = str_replace(array('{{ BASE_URL }}', '{{ exceptionClass }}', '{{ message }}', '{{ backtrace }}', '{{ powered_by }}'), array(BASE_URL, get_class($exception), $message, $backtrace_formatted, base64_decode('UG93ZXJlZCBieSA8YSBocmVmPSJodHRwOi8vbXktYWFjLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPk15QUFDLjwvYT4=')), $content);

+	@ob_clean();
+
 	echo $content;
 }

--- a/system/functions.php
+++ b/system/functions.php
@@ -7,11 +7,10 @@
 * @copyright 2019 MyAAC
 * @link      https://my-aac.org
 */
+defined('MYAAC') or die('Direct access not allowed!');

 use Twig\Loader\ArrayLoader as Twig_ArrayLoader;

-defined('MYAAC') or die('Direct access not allowed!');
-
 function message($message, $type, $return)
 {
 	if(IS_CLI) {
@@ -757,10 +756,10 @@ function get_browser_languages()
 {
 	$ret = array();

-	$acceptLang = $_SERVER['HTTP_ACCEPT_LANGUAGE'];
-	if(!isset($acceptLang[0]))
+	if(empty($_SERVER['HTTP_ACCEPT_LANGUAGE']))
 		return $ret;

+	$acceptLang = $_SERVER['HTTP_ACCEPT_LANGUAGE'];
 	$languages = strtolower($acceptLang);
 	// $languages = 'pl,en-us;q=0.7,en;q=0.3 ';
 	// need to remove spaces from strings to avoid error
@@ -798,7 +797,7 @@ function get_plugins()
 	$ret = array();

 	$path = PLUGINS;
-	foreach(scandir($path, 0) as $file) {
+	foreach(scandir($path, SCANDIR_SORT_ASCENDING) as $file) {
 		$file_ext = pathinfo($file, PATHINFO_EXTENSION);
 		$file_name = pathinfo($file, PATHINFO_FILENAME);
 		if ($file === '.' || $file === '..' || $file === 'disabled' || $file === 'example.json' || $file_ext !== 'json' || is_dir($path . $file))
@@ -924,8 +923,8 @@ function load_config_lua($filename)
 	$config_file = $filename;
 	if(!@file_exists($config_file))
 	{
-		log_append('error.log', '[load_config_file] Fatal error: Cannot load config.lua (' . $filename . '). Error: ' . print_r(error_get_last(), true));
-		throw new RuntimeException('ERROR: Cannot find ' . $filename . ' file. More info in system/logs/error.log');
+		log_append('error.log', '[load_config_file] Fatal error: Cannot load config.lua (' . $filename . ').');
+		throw new RuntimeException('ERROR: Cannot find ' . $filename . ' file.');
 	}

 	$result = array();
@@ -1147,9 +1146,30 @@ function clearCache()
 		if ($cache->fetch('failed_logins', $tmp))
 			$cache->delete('failed_logins');

-		global $template_name;
-		if ($cache->fetch('template_ini' . $template_name, $tmp))
-			$cache->delete('template_ini' . $template_name);
+		foreach (get_templates() as $template) {
+			if ($cache->fetch('template_ini_' . $template, $tmp)) {
+				$cache->delete('template_ini_' . $template);
+			}
+		}
+
+		if ($cache->fetch('template_menus', $tmp)) {
+			$cache->delete('template_menus');
+		}
+		if ($cache->fetch('database_tables', $tmp)) {
+			$cache->delete('database_tables');
+		}
+		if ($cache->fetch('database_columns', $tmp)) {
+			$cache->delete('database_columns');
+		}
+		if ($cache->fetch('database_checksum', $tmp)) {
+			$cache->delete('database_checksum');
+		}
+		if ($cache->fetch('hooks', $tmp)) {
+			$cache->delete('hooks');
+		}
+		if ($cache->fetch('last_kills', $tmp)) {
+			$cache->delete('last_kills');
+		}
 	}

 	deleteDirectory(CACHE . 'signatures', ['index.html'], true);
@@ -1245,7 +1265,70 @@ function getCustomPage($page, &$success)
 }

 function escapeHtml($html) {
-	return htmlentities($html, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+	return htmlspecialchars($html);
+}
+
+function getGuildNameById($id)
+{
+	global $db;
+
+	$guild = $db->query('SELECT `name` FROM `guilds` WHERE `id` = ' . (int)$id);
+
+	if ($guild->rowCount() > 0) {
+		return $guild->fetchColumn();
+	}
+
+	return false;
+}
+
+function getGuildLogoById($id)
+{
+	global $db;
+
+	$logo = 'default.gif';
+
+	$query = $db->query('SELECT `logo_name` FROM `guilds` WHERE `id` = ' . (int)$id);
+	if ($query->rowCount() == 1) {
+
+		$query = $query->fetch(PDO::FETCH_ASSOC);
+		$guildLogo = $query['logo_name'];
+
+		if (!empty($guildLogo) && file_exists('images/guilds/' . $guildLogo)) {
+			$logo = $guildLogo;
+		}
+	}
+
+	return BASE_URL . 'images/guilds/' . $logo;
+}
+
+function displayErrorBoxWithBackButton($errors, $action = null) {
+	global $twig;
+	$twig->display('error_box.html.twig', ['errors' => $errors]);
+	$twig->display('account.back_button.html.twig', [
+		'action' => $action ?: getLink('')
+	]);
+}
+
+function getDatabasePages($withHidden = false): array
+{
+	global $db, $logged_access;
+
+	if (!isset($logged_access)) {
+		$logged_access = 1;
+	}
+
+	$pages = $db->query('SELECT `name` FROM ' . TABLE_PREFIX . 'pages WHERE ' . ($withHidden ? '' : '`hidden` != 1 AND ') . '`access` <= ' . $db->quote($logged_access));
+	$ret = [];
+
+	if ($pages->rowCount() < 1) {
+		return $ret;
+	}
+
+	foreach($pages->fetchAll() as $page) {
+		$ret[] = $page['name'];
+	}
+
+	return $ret;
 }

 // validator functions
--- a/system/hooks.php
+++ b/system/hooks.php
@@ -9,45 +9,60 @@
 */
 defined('MYAAC') or die('Direct access not allowed!');

-define('HOOK_STARTUP', 1);
-define('HOOK_BEFORE_PAGE', 2);
-define('HOOK_AFTER_PAGE', 3);
-define('HOOK_FINISH', 4);
-define('HOOK_TIBIACOM_ARTICLE', 5);
-define('HOOK_TIBIACOM_BORDER_3', 6);
-define('HOOK_CHARACTERS_BEFORE_INFORMATIONS', 7);
-define('HOOK_CHARACTERS_AFTER_INFORMATIONS', 8);
-define('HOOK_CHARACTERS_BEFORE_SIGNATURE', 9);
-define('HOOK_CHARACTERS_AFTER_SIGNATURE', 10);
-define('HOOK_CHARACTERS_AFTER_ACCOUNT', 11);
-define('HOOK_CHARACTERS_AFTER_CHARACTERS', 12);
-define('HOOK_LOGIN', 13);
-define('HOOK_LOGIN_ATTEMPT', 14);
-define('HOOK_LOGOUT', 15);
-define('HOOK_ACCOUNT_CREATE_BEFORE_FORM', 16);
-define('HOOK_ACCOUNT_CREATE_BEFORE_BOXES', 17);
-define('HOOK_ACCOUNT_CREATE_BETWEEN_BOXES_1', 18);
-define('HOOK_ACCOUNT_CREATE_BETWEEN_BOXES_2', 19);
-define('HOOK_ACCOUNT_CREATE_AFTER_BOXES', 20);
-define('HOOK_ACCOUNT_CREATE_BEFORE_ACCOUNT', 21);
-define('HOOK_ACCOUNT_CREATE_AFTER_ACCOUNT', 22);
-define('HOOK_ACCOUNT_CREATE_AFTER_EMAIL', 23);
-define('HOOK_ACCOUNT_CREATE_AFTER_COUNTRY', 24);
-define('HOOK_ACCOUNT_CREATE_AFTER_PASSWORDS', 25);
-define('HOOK_ACCOUNT_CREATE_AFTER_RECAPTCHA', 26);
-define('HOOK_ACCOUNT_CREATE_BEFORE_CHARACTER_NAME', 27);
-define('HOOK_ACCOUNT_CREATE_AFTER_CHARACTER_NAME', 28);
-define('HOOK_ACCOUNT_CREATE_AFTER_SEX', 29);
-define('HOOK_ACCOUNT_CREATE_AFTER_VOCATION', 30);
-define('HOOK_ACCOUNT_CREATE_AFTER_TOWNS', 31);
-define('HOOK_ACCOUNT_CREATE_BEFORE_SUBMIT_BUTTON', 32);
-define('HOOK_ACCOUNT_CREATE_AFTER_FORM', 33);
-define('HOOK_ACCOUNT_CREATE_AFTER_SUBMIT', 34);
-define('HOOK_EMAIL_CONFIRMED', 35);
+$i = 0;
+define('HOOK_STARTUP', ++$i);
+define('HOOK_BEFORE_PAGE', ++$i);
+define('HOOK_AFTER_PAGE', ++$i);
+define('HOOK_FINISH', ++$i);
+define('HOOK_TIBIACOM_ARTICLE', ++$i);
+define('HOOK_TIBIACOM_BORDER_3', ++$i);
+define('HOOK_CHARACTERS_BEFORE_INFORMATIONS', ++$i);
+define('HOOK_CHARACTERS_AFTER_INFORMATIONS', ++$i);
+define('HOOK_CHARACTERS_BEFORE_SKILLS', ++$i);
+define('HOOK_CHARACTERS_AFTER_SKILLS', ++$i);
+define('HOOK_CHARACTERS_AFTER_QUESTS', ++$i);
+define('HOOK_CHARACTERS_AFTER_EQUIPMENT', ++$i);
+define('HOOK_CHARACTERS_BEFORE_DEATHS', ++$i);
+define('HOOK_CHARACTERS_BEFORE_SIGNATURE', ++$i);
+define('HOOK_CHARACTERS_AFTER_SIGNATURE', ++$i);
+define('HOOK_CHARACTERS_AFTER_ACCOUNT', ++$i);
+define('HOOK_CHARACTERS_AFTER_CHARACTERS', ++$i);
+define('HOOK_LOGIN', ++$i);
+define('HOOK_LOGIN_ATTEMPT', ++$i);
+define('HOOK_LOGOUT', ++$i);
+define('HOOK_ACCOUNT_CREATE_BEFORE_FORM', ++$i);
+define('HOOK_ACCOUNT_CREATE_BEFORE_BOXES', ++$i);
+define('HOOK_ACCOUNT_CREATE_BETWEEN_BOXES_1', ++$i);
+define('HOOK_ACCOUNT_CREATE_BETWEEN_BOXES_2', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_BOXES', ++$i);
+define('HOOK_ACCOUNT_CREATE_BEFORE_ACCOUNT', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_ACCOUNT', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_EMAIL', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_COUNTRY', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_PASSWORDS', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_RECAPTCHA', ++$i);
+define('HOOK_ACCOUNT_CREATE_BEFORE_CHARACTER_NAME', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_CHARACTER_NAME', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_SEX', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_VOCATION', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_TOWNS', ++$i);
+define('HOOK_ACCOUNT_CREATE_BEFORE_SUBMIT_BUTTON', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_FORM', ++$i);
+define('HOOK_ACCOUNT_CREATE_POST', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_SUBMIT', ++$i);
+define('HOOK_ACCOUNT_CREATE_AFTER_SAVED', ++$i);
+define('HOOK_ACCOUNT_MANAGE_BEFORE_GENERAL_INFORMATION', ++$i);
+define('HOOK_ACCOUNT_MANAGE_BEFORE_PUBLIC_INFORMATION', ++$i);
+define('HOOK_ACCOUNT_MANAGE_BEFORE_ACCOUNT_LOGS', ++$i);
+define('HOOK_ACCOUNT_MANAGE_BEFORE_CHARACTERS', ++$i);
+define('HOOK_EMAIL_CONFIRMED', ++$i);
+define('HOOK_GUILDS_AFTER_INVITED_CHARACTERS', ++$i);
 define('HOOK_FIRST', HOOK_STARTUP);
 define('HOOK_LAST', HOOK_EMAIL_CONFIRMED);

 require_once LIBS . 'plugins.php';
+require_once LIBS . 'src/Plugins.php';
+
 class Hook
 {
 	private $_name, $_type, $_file;
@@ -68,9 +83,7 @@ class Hook
 		}*/

 		global $db, $config, $template_path, $ots, $content, $twig;
-		if(file_exists(BASE . $this->_file)) {
-			$ret = require BASE . $this->_file;
-		}
+		$ret = include BASE . $this->_file;

 		return !isset($ret) || $ret == 1 || $ret;
 	}
--- a/system/init.php
+++ b/system/init.php
@@ -28,12 +28,10 @@ if($config['gzip_output'] && isset($_SERVER['HTTP_ACCEPT_ENCODING']) && strpos($
 	ob_start('ob_gzhandler');

 // cache
-require_once SYSTEM . 'libs/cache.php';
+require_once LIBS . 'cache.php';
+require_once LIBS . 'src/Cache.php';
 $cache = Cache::getInstance();

-// twig
-require_once SYSTEM . 'twig.php';
-
 // trim values we receive
 if(isset($_POST))
 {
@@ -76,8 +74,8 @@ if($config_lua_reload) {

 	// cache config
 	if($cache->enabled()) {
-		$cache->set('config_lua', serialize($config['lua']), 120);
-		$cache->set('server_path', $config['server_path']);
+		$cache->set('config_lua', serialize($config['lua']), 2 * 60);
+		$cache->set('server_path', $config['server_path'], 10 * 60);
 	}
 }
 unset($tmp);
@@ -114,18 +112,21 @@ if(!isset($foundValue)) {
 $config['data_path'] = $foundValue;
 unset($foundValue);

-// new config values for compability
+// new config values for compatibility
 if(!isset($config['highscores_ids_hidden']) || count($config['highscores_ids_hidden']) == 0) {
 	$config['highscores_ids_hidden'] = array(0);
 }

-$config['account_create_character_create'] = config('account_create_character_create') && (!config('mail_enabled') || !config('account_mail_verify'));
+$config['account_mail_verify'] = config('account_mail_verify') && config('mail_enabled');

 // POT
 require_once SYSTEM . 'libs/pot/OTS.php';
 $ots = POT::getInstance();
 require_once SYSTEM . 'database.php';

+// twig
+require_once SYSTEM . 'twig.php';
+
 define('USE_ACCOUNT_NAME', $db->hasColumn('accounts', 'name'));
 // load vocation names
 $tmp = '';
--- a/system/item.php
+++ b/system/item.php
@@ -58,4 +58,3 @@ function outputItem($id = 100, $count = 1)
 	$file_name = Items_Images::$outputDir . $file_name . '.gif';
 	readfile($file_name);
 }
-?>
--- a/system/libs/CreateCharacter.php
+++ b/system/libs/CreateCharacter.php
@@ -138,7 +138,7 @@ class CreateCharacter

 		if(empty($errors))
 		{
-			$number_of_players_on_account = $account->getPlayersList(false)->count();
+			$number_of_players_on_account = $account->getPlayersList(true)->count();
 			if($number_of_players_on_account >= config('characters_per_account'))
 				$errors[] = 'You have too many characters on your account <b>('.$number_of_players_on_account.'/'.config('characters_per_account').')</b>!';
 		}
@@ -252,10 +252,12 @@ class CreateCharacter
 			}
 		}

-		$loaded_items_to_copy = $db->query("SELECT * FROM player_items WHERE player_id = ".$char_to_copy->getId()."");
-		foreach($loaded_items_to_copy as $save_item) {
-			$blob = $db->quote($save_item['attributes']);
-			$db->query("INSERT INTO `player_items` (`player_id` ,`pid` ,`sid` ,`itemtype`, `count`, `attributes`) VALUES ('".$player->getId()."', '".$save_item['pid']."', '".$save_item['sid']."', '".$save_item['itemtype']."', '".$save_item['count']."', $blob);");
+		if ($db->hasTable('player_items') && $db->hasColumn('player_items', 'pid') && $db->hasColumn('player_items', 'sid') && $db->hasColumn('player_items', 'itemtype')) {
+			$loaded_items_to_copy = $db->query("SELECT * FROM player_items WHERE player_id = ".$char_to_copy->getId()."");
+			foreach($loaded_items_to_copy as $save_item) {
+				$blob = $db->quote($save_item['attributes']);
+				$db->query("INSERT INTO `player_items` (`player_id` ,`pid` ,`sid` ,`itemtype`, `count`, `attributes`) VALUES ('".$player->getId()."', '".$save_item['pid']."', '".$save_item['sid']."', '".$save_item['itemtype']."', '".$save_item['count']."', $blob);");
+			}
 		}

 		global $twig;
--- a/system/libs/TwigTypeCastingExtension.php
+++ b/system/libs/TwigTypeCastingExtension.php
@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace MyAAC\Twig\Extension;
+
+use Twig\Extension\AbstractExtension;
+use Twig\TwigFilter;
+
+final class TwigTypeCastingExtension extends AbstractExtension
+{
+	/** @return array<int, TwigFilter> */
+	public function getFilters(): array
+	{
+		return [
+			new TwigFilter('int', function ($value) {
+				return (int)$value;
+			}),
+			new TwigFilter('float', function ($value) {
+				return (float)$value;
+			}),
+			new TwigFilter('string', function ($value) {
+				return (string)$value;
+			}),
+			new TwigFilter('bool', function ($value) {
+				return (bool)$value;
+			}),
+			new TwigFilter('array', function (object $value) {
+				return (array)$value;
+			}),
+			new TwigFilter('object', function (array $value) {
+				return (object)$value;
+			}),
+		];
+	}
+}
--- a/system/libs/cache.php
+++ b/system/libs/cache.php
@@ -110,4 +110,21 @@ class Cache
 	 * @return bool
 	 */
 	public function enabled() {return false;}
+
+	public static function remember($key, $ttl, $callback)
+	{
+		$cache = self::getInstance();
+		if(!$cache->enabled()) {
+			return $callback();
+		}
+
+		$value = null;
+		if ($cache->fetch($key, $value)) {
+			return unserialize($value);
+		}
+
+		$value = $callback();
+		$cache->set($key, serialize($value),$ttl);
+		return $value;
+	}
 }
--- a/system/libs/data.php
+++ b/system/libs/data.php
@@ -41,4 +41,3 @@ class Data
 		return $db->update($this->table, $data, $where);
 	}
 }
-?>
--- a/system/libs/forum.php
+++ b/system/libs/forum.php
@@ -71,7 +71,7 @@ class Forum
 			'post_smile' => 0, 'post_html' => 1,
 			'post_date' => time(),
 			'last_edit_aid' => 0, 'edit_date' => 0,
-			'post_ip' => $_SERVER['REMOTE_ADDR']
+			'post_ip' => get_browser_real_ip()
 		))) {
 			$thread_id = $db->lastInsertId();
 			$db->query("UPDATE `" . FORUM_TABLE_PREFIX . "forum` SET `first_post`=".(int) $thread_id." WHERE `id` = ".(int) $thread_id);
@@ -93,7 +93,7 @@ class Forum
 			'post_smile' => $smile,
 			'post_html' => $html,
 			'post_date' => time(),
-			'post_ip' => $_SERVER['REMOTE_ADDR']
+			'post_ip' => get_browser_real_ip()
 		));
 	}
 	public static function add_board($name, $description, $access, $guild, &$errors)
--- a/system/libs/plugins.php
+++ b/system/libs/plugins.php
@@ -74,6 +74,10 @@ class Plugins {
 			if (isset($plugin['hooks'])) {
 				foreach ($plugin['hooks'] as $_name => $info) {
 					if (defined('HOOK_'. $info['type'])) {
+						if (strpos($info['type'], 'HOOK_') !== false) {
+							$info['type'] = str_replace('HOOK_', '', $info['type']);
+						}
+
 						$hook = constant('HOOK_'. $info['type']);
 						$hooks[] = ['name' => $_name, 'type' => $hook, 'file' => $info['file']];
 					} else {
@@ -401,4 +405,60 @@ class Plugins {

 		return $string;
 	}
+
+	/**
+	 * Install menus
+	 * Helper function for plugins
+	 *
+	 * @param string $templateName
+	 * @param array $menus
+	 */
+	public static function installMenus($templateName, $menus, $clearOld = false)
+	{
+		global $db;
+
+		if ($clearOld) {
+			$db->query('DELETE FROM `' . TABLE_PREFIX . 'menu` WHERE `template` = ' . $db->quote($templateName));
+		}
+
+		// check if menus already exist
+		$query = $db->query('SELECT `id` FROM `' . TABLE_PREFIX . 'menu` WHERE `template` = ' . $db->quote($templateName) . ' LIMIT 1;');
+		if ($query->rowCount() > 0) {
+			return;
+		}
+
+		foreach ($menus as $category => $_menus) {
+			$i = 0;
+			foreach ($_menus as $name => $link) {
+				$color = '';
+				$blank = 0;
+
+				if (is_array($link)) {
+					if (isset($link['name'])) {
+						$name = $link['name'];
+					}
+					if (isset($link['color'])) {
+						$color = $link['color'];
+					}
+					if (isset($link['blank'])) {
+						$blank = $link['blank'] ? 1 : 0;
+					}
+
+					$link = $link['link'];
+				}
+
+				$insert_array = [
+					'template' => $templateName,
+					'name' => $name,
+					'link' => $link,
+					'category' => $category,
+					'ordering' => $i++,
+					'blank' => $blank,
+					'color' => $color,
+				];
+
+				$db->insert(TABLE_PREFIX . 'menu', $insert_array);
+			}
+		}
+	}
 }
--- a/system/libs/pot/E_OTS_ErrorCode.php
+++ b/system/libs/pot/E_OTS_ErrorCode.php
@@ -32,5 +32,3 @@ class E_OTS_ErrorCode extends Exception
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/E_OTS_Generic.php
+++ b/system/libs/pot/E_OTS_Generic.php
@@ -36,5 +36,3 @@ class E_OTS_Generic extends E_OTS_ErrorCode
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/E_OTS_NotAContainer.php
+++ b/system/libs/pot/E_OTS_NotAContainer.php
@@ -22,5 +22,3 @@ class E_OTS_NotAContainer extends Exception
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/E_OTS_OTBMError.php
+++ b/system/libs/pot/E_OTS_OTBMError.php
@@ -32,5 +32,3 @@ class E_OTS_OTBMError extends E_OTS_ErrorCode
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/E_OTS_ReadOnly.php
+++ b/system/libs/pot/E_OTS_ReadOnly.php
@@ -22,5 +22,3 @@ class E_OTS_ReadOnly extends Exception
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/IOTS_Cipher.php
+++ b/system/libs/pot/IOTS_Cipher.php
@@ -37,5 +37,3 @@ interface IOTS_Cipher
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/IOTS_DataDisplay.php
+++ b/system/libs/pot/IOTS_DataDisplay.php
@@ -89,5 +89,3 @@ interface IOTS_DataDisplay
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/IOTS_Display.php
+++ b/system/libs/pot/IOTS_Display.php
@@ -96,5 +96,3 @@ interface IOTS_Display
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/IOTS_GuildAction.php
+++ b/system/libs/pot/IOTS_GuildAction.php
@@ -67,5 +67,3 @@ interface IOTS_GuildAction
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_Account.php
+++ b/system/libs/pot/OTS_Account.php
@@ -922,7 +922,7 @@ class OTS_Account extends OTS_Row_DAO implements IteratorAggregate, Countable
        $access = 0;

        // finds ranks of all characters
-        foreach($this->getPlayersList() as $player)
+        foreach($this->getPlayersList(false) as $player)
        {
            $rank = $player->getRank();

@@ -1126,5 +1126,3 @@ class OTS_Account extends OTS_Row_DAO implements IteratorAggregate, Countable
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_AccountBans_List.php
+++ b/system/libs/pot/OTS_AccountBans_List.php
@@ -34,5 +34,3 @@ class OTS_AccountBans_List extends OTS_Bans_List
        $this->setFilter($filter);
    }
 }
-
-?>
--- a/system/libs/pot/OTS_Admin.php
+++ b/system/libs/pot/OTS_Admin.php
@@ -735,5 +735,3 @@ class OTS_Admin
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_Bans_List.php
+++ b/system/libs/pot/OTS_Bans_List.php
@@ -100,5 +100,3 @@ class OTS_Bans_List extends OTS_Base_List
        }
    }
 }
-
-?>
--- a/system/libs/pot/OTS_Base_DB.php
+++ b/system/libs/pot/OTS_Base_DB.php
@@ -167,8 +167,14 @@ abstract class OTS_Base_DB extends PDO implements IOTS_DB
 		$query = 'UPDATE '.$this->tableName($table).' SET ';

 		$count = count($fields);
-		for ($i = 0; $i < $count; $i++)
-			$query.= $this->fieldName($fields[$i]).' = '.$this->quote($values[$i]).', ';
+		for ($i = 0; $i < $count; $i++) {
+			$value = 'NULL';
+			if ($values[$i] !== null) {
+				$value = $this->quote($values[$i]);
+			}
+
+			$query.= $this->fieldName($fields[$i]).' = '.$value.', ';
+		}

 		$query = substr($query, 0, -2);
 		$query.=' WHERE (';
@@ -212,6 +218,30 @@ abstract class OTS_Base_DB extends PDO implements IOTS_DB
 		$this->exec($query);
 		return true;
 	}
+
+	public function addColumn($table, $column, $definition): void {
+		$this->exec('ALTER TABLE ' . $this->tableName($table) . ' ADD ' . $this->fieldName($column) . ' ' . $definition . ';');
+	}
+
+	public function modifyColumn($table, $column, $definition): void {
+		$this->exec('ALTER TABLE ' . $this->tableName($table) . ' MODIFY ' . $this->fieldName($column) . ' ' . $definition . ';');
+	}
+
+	public function changeColumn($table, $from, $to, $definition): void {
+		$this->exec('ALTER TABLE ' . $this->tableName($table) . ' CHANGE ' . $this->fieldName($from) . ' ' . $this->fieldName($to) . ' ' . $definition . ';');
+	}
+
+	public function dropColumn($table, $column): void {
+		$this->exec('ALTER TABLE ' . $this->tableName($table) . ' DROP COLUMN ' . $this->fieldName($column) . ';');
+	}
+
+	public function renameTable($from, $to): void {
+		$this->exec('RENAME TABLE ' . $this->tableName($from) . ' TO ' . $this->tableName($to) . ';');
+	}
+
+	public function dropTable($table, $ifExists = true): void {
+		$this->exec('DROP TABLE ' . ($ifExists ? 'IF EXISTS' : '') . ' ' . $this->tableName($table) . ';');
+	}
 /**
 * LIMIT/OFFSET clause for queries.
 *
@@ -248,5 +278,3 @@ abstract class OTS_Base_DB extends PDO implements IOTS_DB
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_BinaryTools.php
+++ b/system/libs/pot/OTS_BinaryTools.php
@@ -146,5 +146,3 @@ class OTS_BinaryTools
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_Container.php
+++ b/system/libs/pot/OTS_Container.php
@@ -149,5 +149,3 @@ class OTS_Container extends OTS_Item implements IteratorAggregate
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_DB_MySQL.php
+++ b/system/libs/pot/OTS_DB_MySQL.php
@@ -151,7 +151,8 @@ class OTS_DB_MySQL extends OTS_Base_DB
 		}

 		if($this->logged) {
-			log_append('database.log', $_SERVER['REQUEST_URI'] . PHP_EOL . $this->getLog());
+			$currentScript = $_SERVER['REQUEST_URI'] ?? $_SERVER['SCRIPT_FILENAME'];
+			log_append('database.log', $currentScript . PHP_EOL . $this->getLog());
 		}
 	}

--- a/system/libs/pot/OTS_FileLoader.php
+++ b/system/libs/pot/OTS_FileLoader.php
@@ -357,5 +357,3 @@ class OTS_FileLoader
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_Group.php
+++ b/system/libs/pot/OTS_Group.php
@@ -671,5 +671,3 @@ class OTS_Group extends OTS_Row_DAO implements IteratorAggregate, Countable
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_Guild.php
+++ b/system/libs/pot/OTS_Guild.php
@@ -837,5 +837,3 @@ class OTS_Guild extends OTS_Row_DAO implements IteratorAggregate, Countable
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_GuildRanks_List.php
+++ b/system/libs/pot/OTS_GuildRanks_List.php
@@ -72,5 +72,3 @@ class OTS_GuildRanks_List extends OTS_Base_List
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_House.php
+++ b/system/libs/pot/OTS_House.php
@@ -60,12 +60,7 @@ class OTS_House extends OTS_Row_DAO
    private $tiles = array();

 	public function load($id) {
-		$this->data = $this->db->query('SELECT * FROM `houses` WHERE `id` = ' . $id )->fetch();
-		foreach($this->data as $key => $value) {
-			if(is_numeric($key)) {
-				unset($this->data[$key]);
-			}
-		}
+		$this->data = $this->db->query('SELECT * FROM `houses` WHERE `id` = ' . $id )->fetch(PDO::FETCH_ASSOC);
 	}

    public function find($name)
@@ -529,5 +524,3 @@ class OTS_House extends OTS_Row_DAO
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_IPBans_List.php
+++ b/system/libs/pot/OTS_IPBans_List.php
@@ -34,5 +34,3 @@ class OTS_IPBans_List extends OTS_Bans_List
        $this->setFilter($filter);
    }
 }
-
-?>
--- a/system/libs/pot/OTS_InfoRespond.php
+++ b/system/libs/pot/OTS_InfoRespond.php
@@ -387,5 +387,3 @@ class OTS_InfoRespond extends DOMDocument
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_ItemsList.php
+++ b/system/libs/pot/OTS_ItemsList.php
@@ -676,5 +676,3 @@ class OTS_ItemsList extends OTS_FileLoader implements IteratorAggregate, Countab
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_MapCoords.php
+++ b/system/libs/pot/OTS_MapCoords.php
@@ -130,5 +130,3 @@ class OTS_MapCoords
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_Monster.php
+++ b/system/libs/pot/OTS_Monster.php
@@ -15,11 +15,11 @@

 /**
 * Wrapper for monsters files DOMDocument.
- * 
+ *
 * <p>
 * Note: as this class extends {@link http://www.php.net/manual/en/ref.dom.php DOMDocument class} and contains exacly file XML tree you can work on it as on normal DOM tree.
 * </p>
- * 
+ *
 * @package POT
 * @version 0.1.3
 * @property-read string $name Monster name.
@@ -44,14 +44,14 @@ class OTS_Monster extends DOMDocument
 	{
 		$this->loaded = parent::loadXML($source, $options);
 	}
-	
+
 	public function loaded()
 	{
 		return $this->loaded;
 	}
 /**
 * Returns monster name.
- * 
+ *
 * @return string Name.
 * @throws DOMException On DOM operation error.
 */
@@ -62,7 +62,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns monster race.
- * 
+ *
 * @return string Race.
 * @throws DOMException On DOM operation error.
 */
@@ -73,7 +73,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns amount of experience for killing this monster.
- * 
+ *
 * @return int Experience points.
 * @throws DOMException On DOM operation error.
 */
@@ -84,7 +84,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns monster speed.
- * 
+ *
 * @return int Speed.
 * @throws DOMException On DOM operation error.
 */
@@ -95,7 +95,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns amount of mana required to summon this monster.
- * 
+ *
 * @return int|bool Mana required (false if not possible).
 * @throws DOMException On DOM operation error.
 */
@@ -114,7 +114,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns monster HP.
- * 
+ *
 * @return int Hit points.
 * @throws DOMException On DOM operation error.
 */
@@ -125,28 +125,29 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns all monster flags (in format flagname => value).
- * 
+ *
 * @return array Flags.
 * @throws DOMException On DOM operation error.
 */
-    public function getFlags()
-    {
-        $flags = array();
+	public function getFlags()
+	{
+		$flags = array();

-        // read all flags
-        foreach( $this->documentElement->getElementsByTagName('flags')->item(0)->getElementsByTagName('flag') as $flag)
-        {
-            $flag = $flag->attributes->item(0);
+		if ($this->documentElement->getElementsByTagName('flags')->item(0)) {
+			foreach( $this->documentElement->getElementsByTagName('flags')->item(0)->getElementsByTagName('flag') as $flag)
+			{
+				$flag = $flag->attributes->item(0);

-            $flags[$flag->nodeName] = (int) $flag->nodeValue;
-        }
+				$flags[$flag->nodeName] = (int) $flag->nodeValue;
+			}
+		}

-        return $flags;
-    }
+		return $flags;
+	}

 /**
 * Returns specified flag value.
- * 
+ *
 * @param string $flag Flag.
 * @return int|bool Flag value (false if not set).
 * @throws DOMException On DOM operation error.
@@ -169,7 +170,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns voices that monster can sound.
- * 
+ *
 * @return array List of voices.
 * @throws DOMException On DOM operation error.
 */
@@ -214,17 +215,17 @@ class OTS_Monster extends DOMDocument
 		                $chance = 100000;
                    }
                }
-                
+
                $count = $item->getAttribute('countmax');
 	            if(empty($count)) {
 	                $count = 1;
                }
-                
+
                $id = $item->getAttribute('id');
                if(empty($id)) {
                    $id = $item->getAttribute('name');
                }
-                
+
                $loot[] = array('id' => $id, 'count' => $count, 'chance' => $chance);
            }
        }
@@ -234,11 +235,11 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns all possible loot.
- * 
+ *
 * <p>
 * In order to use this method you have to have global items list loaded.
 * </p>
- * 
+ *
 * @version 0.1.0
 * @since 0.1.0
 * @return array List of item types.
@@ -275,7 +276,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns all monster immunities.
- * 
+ *
 * @return array Immunities.
 * @throws DOMException On DOM operation error.
 */
@@ -306,7 +307,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Checks if monster has given immunity.
- * 
+ *
 * @param string $name Immunity to check.
 * @return bool Immunity state.
 * @throws DOMException On DOM operation error.
@@ -334,7 +335,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns monster defense rate.
- * 
+ *
 * @return int Defense rate.
 * @throws DOMException On DOM operation error.
 */
@@ -353,7 +354,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns monster armor.
- * 
+ *
 * @return int Armor rate.
 * @throws DOMException On DOM operation error.
 */
@@ -372,7 +373,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns list of special defenses.
- * 
+ *
 * @return array List of defense effects.
 * @throws DOMException On DOM operation error.
 */
@@ -396,7 +397,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns list of monster attacks.
- * 
+ *
 * @return array List of attafck effects.
 * @throws DOMException On DOM operation error.
 */
@@ -420,7 +421,7 @@ class OTS_Monster extends DOMDocument

 /**
 * Magic PHP5 method.
- * 
+ *
 * @version 0.1.0
 * @since 0.1.0
 * @param string $name Property name.
@@ -481,11 +482,11 @@ class OTS_Monster extends DOMDocument

 /**
 * Returns string representation of XML.
- * 
+ *
 * <p>
 * If any display driver is currently loaded then it uses it's method. Otherwise just returns monster XML content.
 * </p>
- * 
+ *
 * @version 0.1.3
 * @since 0.1.0
 * @return string String representation of object.
--- a/system/libs/pot/OTS_MonstersList.php
+++ b/system/libs/pot/OTS_MonstersList.php
@@ -299,5 +299,3 @@ class OTS_MonstersList implements Iterator, Countable, ArrayAccess
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_Player.php
+++ b/system/libs/pot/OTS_Player.php
@@ -108,6 +108,8 @@ class OTS_Player extends OTS_Row_DAO
 		POT::SKILL_SHIELD => array('value' => 0, 'tries' => 0),
 		POT::SKILL_FISH => array('value' => 0, 'tries' => 0)
 	);
+
+	private static array $playersOnline;
 /**
 * Magic PHP5 method.
 *
@@ -763,21 +765,29 @@ class OTS_Player extends OTS_Row_DAO
        $this->data['deleted'] = (int) $deleted;
    }

-    public function isOnline()
-    {
-		if($this->db->hasTable('players_online')) // tfs 1.0
-		{
-			$query = $this->db->query('SELECT `player_id` FROM `players_online` WHERE `player_id` = ' . $this->data['id']);
-			return $query->rowCount() > 0;
+	public function isOnline()
+	{
+		if($this->db->hasTable('players_online')) {// tfs 1.0
+			if (!isset(self::$playersOnline)) {
+				self::$playersOnline = [];
+
+				$query = $this->db->query('SELECT `player_id` FROM `players_online`');
+
+				foreach ($query->fetchAll(PDO::FETCH_ASSOC) as $item) {
+					self::$playersOnline[$item['player_id']] = true;
+				}
+			}
+
+			return isset(self::$playersOnline[$this->data['id']]);
 		}

-        if( !isset($this->data['online']) )
-        {
-            throw new E_OTS_NotLoaded();
-        }
+		if( !isset($this->data['online']) )
+		{
+			throw new E_OTS_NotLoaded();
+		}

-        return $this->data['online'] == 1;
-    }
+		return $this->data['online'] == 1;
+	}

    public function getCreated()
    {
@@ -1745,11 +1755,6 @@ class OTS_Player extends OTS_Row_DAO
 */
    public function getConditions()
    {
-        if( !isset($this->data['conditions']) )
-        {
-            throw new E_OTS_NotLoaded();
-        }
-
        return $this->data['conditions'];
    }

@@ -3627,5 +3632,3 @@ class OTS_Player extends OTS_Row_DAO
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_PlayerBans_List.php
+++ b/system/libs/pot/OTS_PlayerBans_List.php
@@ -34,5 +34,3 @@ class OTS_PlayerBans_List extends OTS_Bans_List
        $this->setFilter($filter);
    }
 }
-
-?>
--- a/system/libs/pot/OTS_Row_DAO.php
+++ b/system/libs/pot/OTS_Row_DAO.php
@@ -75,5 +75,3 @@ abstract class OTS_Row_DAO extends OTS_Base_DAO
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_SQLField.php
+++ b/system/libs/pot/OTS_SQLField.php
@@ -121,5 +121,3 @@ class OTS_SQLField
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_ServerInfo.php
+++ b/system/libs/pot/OTS_ServerInfo.php
@@ -14,7 +14,7 @@

 /**
 * Various server status querying methods.
- * 
+ *
 * @package POT
 * @property-read OTS_InfoRespond|bool $status status() method wrapper.
 * @property-read OTS_ServerStatus|bool $info Full info() method wrapper.
@@ -23,21 +23,21 @@ class OTS_ServerInfo
 {
 /**
 * Server address.
- * 
+ *
 * @var string
 */
    private $server;

 /**
 * Connection port.
- * 
+ *
 * @var int
 */
    private $port;

 /**
 * Creates handler for new server.
- * 
+ *
 * @param string $server Server IP/domain.
 * @param int $port OTServ port.
 */
@@ -49,7 +49,7 @@ class OTS_ServerInfo

 /**
 * Sends packet to server.
- * 
+ *
 * @param OTS_Buffer|string $packet Buffer to send.
 * @return OTS_Buffer|null Respond buffer (null if server is offline).
 * @throws E_OTS_OutOfBuffer When there is read attemp after end of packet stream.
@@ -75,7 +75,7 @@ class OTS_ServerInfo

            // reads respond
            //$data = stream_get_contents($socket);
-			$data = ''; 
+			$data = '';
 			while (!feof($socket))
 				$data .= fgets($socket, 1024);

@@ -97,11 +97,11 @@ class OTS_ServerInfo

 /**
 * Queries server status.
- * 
+ *
 * <p>
 * Sends 'info' packet to OTS server and return output. Returns {@link OTS_InfoRespond OTS_InfoRespond} (wrapper for XML data) with results or <var>false</var> if server is online.
 * </p>
- * 
+ *
 * @return OTS_InfoRespond|bool Respond content document (false when server is offline).
 * @throws DOMException On DOM operation error.
 * @throws E_OTS_OutOfBuffer When there is read attemp after end of packet stream.
@@ -123,7 +123,7 @@ class OTS_ServerInfo
        {
            // loads respond XML
            $info = new OTS_InfoRespond();
-            if(!$info->loadXML( utf8_encode($status->getBuffer())))
+            if(!$info->loadXML( $status->getBuffer()))
 				return false;

            return $info;
@@ -135,11 +135,11 @@ class OTS_ServerInfo

 /**
 * Queries server information.
- * 
+ *
 * <p>
 * This method uses binary info protocol. It provides more infromation then {@link OTS_Toolbox::serverStatus() XML way}.
 * </p>
- * 
+ *
 * @param int $flags Requested info flags.
 * @return OTS_ServerStatus|bool Respond content document (false when server is offline).
 * @throws E_OTS_OutOfBuffer When there is read attemp after end of packet stream.
@@ -169,11 +169,11 @@ class OTS_ServerInfo

 /**
 * Checks player online status.
- * 
+ *
 * <p>
 * This method uses binary info protocol.
 * </p>
- * 
+ *
 * @param string $name Player name.
 * @return bool True if player is online, false if player or server is online.
 * @throws E_OTS_OutOfBuffer When there is read attemp after end of packet stream.
@@ -204,7 +204,7 @@ class OTS_ServerInfo

 /**
 * Magic PHP5 method.
- * 
+ *
 * @param string $name Property name.
 * @param mixed $value Property value.
 * @throws OutOfBoundsException For non-supported properties.
@@ -227,5 +227,3 @@ class OTS_ServerInfo
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_Spell.php
+++ b/system/libs/pot/OTS_Spell.php
@@ -482,5 +482,3 @@ class OTS_Spell
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_Toolbox.php
+++ b/system/libs/pot/OTS_Toolbox.php
@@ -113,5 +113,3 @@ class OTS_Toolbox
 }

 /**#@-*/
-
-?>
--- a/system/libs/pot/OTS_XTEA.php
+++ b/system/libs/pot/OTS_XTEA.php
@@ -151,5 +151,3 @@ class OTS_XTEA implements IOTS_Cipher
 }

 /**#@-*/
-
-?>
--- a/system/libs/rfc6238.php
+++ b/system/libs/rfc6238.php
@@ -282,4 +282,3 @@ class TokenAuth6238 {
 		return $result;
 	}
 }
-?>
--- a/system/libs/src/Cache.php
+++ b/system/libs/src/Cache.php
@@ -0,0 +1,5 @@
+<?php
+
+namespace MyAAC;
+
+class Cache extends \Cache {}
--- a/system/libs/src/Plugins.php
+++ b/system/libs/src/Plugins.php
@@ -0,0 +1,5 @@
+<?php
+
+namespace MyAAC;
+
+class Plugins extends \Plugins {}
--- a/system/libs/validator.php
+++ b/system/libs/validator.php
@@ -432,4 +432,3 @@ class Validator
 		return self::$lastError;
 	}
 }
-?>
--- a/system/libs/visitors.php
+++ b/system/libs/visitors.php
@@ -33,7 +33,7 @@ class Visitors
 		$this->sessionTime = $sessionTime;
 		$this->cleanVisitors();

-		$ip = $_SERVER['REMOTE_ADDR'];
+		$ip = get_browser_real_ip();
 		if($this->visitorExists($ip))
 			$this->updateVisitor($ip, $_SERVER['REQUEST_URI']);
 		else
--- a/system/locale/de/admin.php
+++ b/system/locale/de/admin.php
@@ -6,4 +6,3 @@
 * @author Slawkens <slawkens@gmail.com>
 */
 $locale['title'] = 'MyAAC Admin';
-?>
--- a/system/locale/de/main.php
+++ b/system/locale/de/main.php
@@ -11,5 +11,4 @@ $locale['encoding'] = 'utf-8';
 $locale['direction']= 'ltr';

 $locale['error404'] = 'Diese Seite konnte nicht gefunden werden.';
-$locale['news'] = 'Neuesten Nachrichten';
-?>
+$locale['news'] = 'Neuesten Nachrichten';
--- a/system/locale/en/install.php
+++ b/system/locale/en/install.php
@@ -123,4 +123,3 @@ $locale['step_finish_title'] = 'Installation finished!';
 $locale['step_finish_desc'] = 'Congratulations! <b>MyAAC</b> is ready to use!<br/>You can now login to $ADMIN_PANEL$, or visit $HOMEPAGE$.<br/><br/>
 <span style="color: red">Please delete install/ directory.</span><br/><br/>
 Post bugs and suggestions at $LINK$, thanks!';
-?>
--- a/system/locale/pl/admin.php
+++ b/system/locale/pl/admin.php
@@ -6,4 +6,3 @@
 * @author Slawkens <slawkens@gmail.com>
 */
 $locale['title'] = 'MyAAC Admin';
-?>
--- a/system/locale/pl/main.php
+++ b/system/locale/pl/main.php
@@ -11,5 +11,4 @@ $locale['encoding'] = 'utf-8';
 $locale['direction']= 'ltr';

 $locale['error404'] = 'Strona nie została odnaleziona.';
-$locale['news'] = 'Ostatnie newsy';
-?>
+$locale['news'] = 'Ostatnie newsy';
--- a/system/locale/pt_br/install.php
+++ b/system/locale/pt_br/install.php
@@ -121,4 +121,3 @@ $locale['step_finish'] = 'Finalizar';
 $locale['step_finish_title'] = 'Instalação terminada!';
 $locale['step_finish_desc'] = 'Parabéns! <b>MyAAC</b> está pronto para uso!<br/>Agora você pode fazer login em $ADMIN_PANEL$ ou visitar $HOMEPAGE$.<br/><br/>
 <span style = "color: red">Por favor remova a pasta install/.</span><br/><br/>Postar bugs e sugestões em $LINK$, obrigado!';
-?>
--- a/system/locale/sv/admin.php
+++ b/system/locale/sv/admin.php
@@ -6,4 +6,3 @@
 * @author Sizaro <sizaro@live.se>
 */
 $locale['title'] = 'MyAAC Admin';
-?>
--- a/system/locale/sv/main.php
+++ b/system/locale/sv/main.php
@@ -12,4 +12,3 @@ $locale['direction']= 'ltr';

 $locale['error404'] = 'Sidan kunde inte hittas.';
 $locale['news'] = 'Senaste nyheterna';
-?>
--- a/system/login.php
+++ b/system/login.php
@@ -10,6 +10,7 @@
 defined('MYAAC') or die('Direct access not allowed!');
 $logged = false;
 $logged_flags = 0;
+$account_logged = new OTS_Account();

 $action = isset($_REQUEST['action']) ? strtolower($_REQUEST['action']) : '';
 if(!defined('ACTION')) {
@@ -20,7 +21,6 @@ if(!defined('ACTION')) {
 $current_session = getSession('account');
 if($current_session !== false)
 {
-	$account_logged = new OTS_Account();
 	$account_logged->load($current_session);
 	if($account_logged->isLoaded() && $account_logged->getPassword() == getSession('password')
 		//&& (!isset($_SESSION['admin']) || admin())
@@ -42,12 +42,6 @@ if(ACTION === 'logout' && !isset($_REQUEST['account_login'])) {

 			$logged = false;
 			unset($account_logged);
-
-			if(isset($_REQUEST['redirect']))
-			{
-				header('Location: ' . urldecode($_REQUEST['redirect']));
-				exit;
-			}
 		}
 	}
 }
@@ -80,11 +74,10 @@ else
 				else
 					$tmp = array();

-				$ip = $_SERVER['REMOTE_ADDR'];
+				$ip = get_browser_real_ip();
 				$t = isset($tmp[$ip]) ? $tmp[$ip] : NULL;
 			}

-			$account_logged = new OTS_Account();
 			if(USE_ACCOUNT_NAME)
 				$account_logged->find($login_account);
 			else
@@ -95,27 +88,32 @@ else
 				&& (!isset($t) || $t['attempts'] < 5)
 				)
 			{
-				setSession('account', $account_logged->getId());
-				setSession('password', encrypt(($config_salt_enabled ? $account_logged->getCustomField('salt') : '') . $login_password));
-				if($remember_me) {
-					setSession('remember_me', true);
-				}
-
-				$logged = true;
-				$logged_flags = $account_logged->getWebFlags();
-
-				if(isset($_POST['admin']) && !admin()) {
-					$errors[] = 'This account has no admin privileges.';
-					unsetSession('account');
-					unsetSession('password');
-					unsetSession('remember_me');
-					$logged = false;
+				if (config('mail_enabled') && config('account_mail_verify') && (int)$account_logged->getCustomField('email_verified') !== 1) {
+					$errors[] = 'Your account is not verified. Please verify your email address. If the message is not coming check the SPAM folder in your E-Mail client.';
 				}
 				else {
-					$account_logged->setCustomField('web_lastlogin', time());
-				}
+					session_regenerate_id();
+					setSession('account', $account_logged->getId());
+					setSession('password', encrypt(($config_salt_enabled ? $account_logged->getCustomField('salt') : '') . $login_password));
+					if ($remember_me) {
+						setSession('remember_me', true);
+					}

-				$hooks->trigger(HOOK_LOGIN, array('account' => $account_logged, 'password' => $login_password, 'remember_me' => $remember_me));
+					$logged = true;
+					$logged_flags = $account_logged->getWebFlags();
+
+					if (isset($_POST['admin']) && !admin()) {
+						$errors[] = 'This account has no admin privileges.';
+						unsetSession('account');
+						unsetSession('password');
+						unsetSession('remember_me');
+						$logged = false;
+					} else {
+						$account_logged->setCustomField('web_lastlogin', time());
+					}
+
+					$hooks->trigger(HOOK_LOGIN, array('account' => $account_logged, 'password' => $login_password, 'remember_me' => $remember_me));
+				}
 			}
 			else
 			{
--- a/system/migrations/11.php
+++ b/system/migrations/11.php
@@ -16,5 +16,4 @@
 			'image' => str_replace('/screenshots/', '/gallery/', $item['image']),
 			'thumb' => str_replace('/screenshots/', '/gallery/', $item['thumb']),
 		), array('id' => $item['id']));
-	}
-?>
+	}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
slawkens	e13bd879db	Fix branch	2025-01-27 22:04:54 +01:00
slawkens	f696f74a06	Release v0.8.22	2025-01-27 22:04:17 +01:00
slawkens	3b18e400c0	Update CHANGELOG.md	2025-01-27 22:03:55 +01:00
slawkens	d1c72b3240	Update exception.php	2025-01-27 21:45:59 +01:00
slawkens	7abc3c7833	Exception: better style - better showing of longer exceptions	2025-01-27 21:30:39 +01:00
slawkens	c0c4fe33e9	Secure template.php of direct access	2025-01-27 21:30:16 +01:00
slawkens	05827b7861	Typo	2025-01-27 21:29:57 +01:00
slawkens	c304a9ab43	Better exception handler, which clears the whole html output, so the message is better visible	2025-01-27 21:29:43 +01:00
slawkens	d390ea325e	Fix exception $account->getName	2025-01-18 19:12:08 +01:00
slawkens	37ba9c7366	All $cache->set calls should have $ttl	2025-01-17 22:55:35 +01:00
slawkens	7c3ebf70fa	Optimize $player->isOnline() function, thanks @gesior	2025-01-17 22:52:00 +01:00
slawkens	eda773cb55	Start v0.8.22-dev	2025-01-09 20:26:17 +01:00
slawkens	c5c266b023	Update CHANGELOG.md	2025-01-09 19:26:27 +01:00
slawkens	9483cfaad8	vendor should be accessible, cause of debugbar	2025-01-09 13:39:58 +01:00
slawkens	b4ed68dfd7	Prepare v0.8.21 release	2025-01-09 10:46:51 +01:00
slawkens	39b19ed4c8	Fix change sex price deducted	2025-01-09 09:42:09 +01:00
slawkens	580b888b1d	Fix XSS in forum	2025-01-08 23:29:34 +01:00
slawkens	19d3e15c11	Fix move_thread by unauthorized user	2025-01-08 22:34:16 +01:00
slawkens	5a68d204bb	Fix for TFS 1.4.2 where conditions is NULL	2024-12-29 15:38:02 +01:00
slawkens	e09fe51774	Set default_socket_timeout for ipinfo.io checkup	2024-12-26 08:53:40 +01:00
slawkens	b2c9eb4745	Support for button_color (red, green, blue)	2024-12-05 21:49:24 +01:00
slawkens	d96787ec21	Update to v0.8.21-defv	2024-11-26 19:00:20 +01:00
slawkens	5df5c64e4f	Update to v0.8.20	2024-11-26 18:34:51 +01:00
slawkens	3c4b19743f	Linux is case-sensitive, made a mistake here, sorry!	2024-11-26 18:25:01 +01:00
slawkens	0e25ce553c	Set current version to 0.8.20-dev	2024-11-19 15:24:42 +01:00
slawkens	2e4bbeb7f7	Release v0.8.19	2024-11-19 14:10:25 +01:00
slawkens	cb6640343b	Prepare 0.8.19 changelog	2024-11-19 14:09:49 +01:00
slawkens	4658d1cb29	More obvious name for parameter in -> installMenus	2024-11-19 14:03:49 +01:00
slawkens	b25feaadf6	Fix includes	2024-11-19 14:03:02 +01:00
slawkens	2693db5f6f	images/news is in the main folder	2024-11-19 08:21:06 +01:00
slawkens	8195b44061	require src/plugins.php	2024-11-19 07:46:16 +01:00
slawkens	035d0c1012	Add forward-compatible MyAAC namespace	2024-11-19 07:15:26 +01:00
slawkens	5a953ce901	Do not clear menus by default	2024-11-19 07:05:40 +01:00
slawkens	01660bd2b4	Fix for console displaying REQUEST_URI	2024-11-18 23:47:31 +01:00
slawkens	5b858c521a	target_blank in template menus links	2024-11-18 23:47:11 +01:00
slawkens	d1c5a189c3	Add Plugins::installMenus function	2024-11-18 23:46:37 +01:00
slawkens	de1bb37bcb	getGuildNameById($id) + getGuildLogoById($id)	2024-11-18 23:46:04 +01:00
slawkens	e0036a3e32	Syntactic sugar for db structure changes	2024-11-08 14:38:00 +01:00
slawkens	7f4737631d	Add none vocation to highscores	2024-10-10 15:33:25 +02:00
slawkens	317505bf19	Add missing Validator::characterName check	2024-09-12 09:40:36 +02:00
slawkens	55b8645d3f	Set default encryption to sha1	2024-09-08 15:05:12 +02:00
slawkens	ffb8f0879b	two hooks for compatibility	2024-09-08 15:03:45 +02:00
slawkens	79f5614dce	Add more clients (13.22+)	2024-09-08 14:47:36 +02:00
slawkens	2c347d0eac	Interesting update from opentibiabr (Uptime readable)	2024-09-08 14:47:21 +02:00
slawkens	d40178104b	New hooks in account manage + create	2024-09-08 06:23:17 +02:00
slawkens	55543ee881	Fix title - should be account logs	2024-09-08 06:22:29 +02:00
slawkens	d39386cfab	Fix bans page getPlayerNameByAccount + getPlayerNameById	2024-09-08 06:21:40 +02:00
slawkens	b5bbae62b0	Prefer get_browser_real_ip() over REMOTE_ADDR	2024-09-08 05:36:33 +02:00
slawkens	71ef30d35e	Better tables.headline.html.twig (patched from 1.0)	2024-09-07 17:28:45 +02:00
anyeor	263c7bed07	fix: require login before create new thread (#261 ) We have to login first to see new thread button.	2024-07-26 18:19:29 +02:00
slawkens	1458b7a412	Fix $db->update when there is null value	2024-07-24 17:30:33 +02:00
slawkens	3e00c52128	Optimize OTS_House::load function with appropriate FETCH_ASSOC	2024-07-24 17:30:03 +02:00
slawkens	d73aceb272	Better https detection (patched from develop)	2024-07-23 16:39:24 +02:00
slawkens	1c55d4a220	Set Admin Account verified by default	2024-07-12 22:19:36 +02:00
slawkens	1edf8833c8	Patching from develop * Allow account_create_character_create even if account_mail_verify is activated * Fixes to account verify - do not allow login without verified email (Thanks @anyeor)	2024-07-09 23:51:12 +02:00
slawkens	0ffc5f68b4	deny all is enough	2024-06-23 09:56:12 +02:00
slawkens	81b6652738	Fix if <flags> is not present in monster.xml	2024-06-05 21:58:44 +02:00
slawkens	e5b4d2c6b3	Fix warnings in basic.js	2024-05-30 09:49:06 +02:00
slawkens	da1830371f	Fix blessings longer than 3 characters	2024-05-30 08:24:02 +02:00
slawkens	6ba04967ed	Update to 0.8.19-dev	2024-05-29 21:55:15 +02:00
slawkens	f503e140f3	Release v0.8.18	2024-05-29 21:29:31 +02:00
slawkens	f875f3cd20	New hook for guild-wars-old (0.8)	2024-05-24 22:44:34 +02:00
slawkens	72632c7b45	Fix typo	2024-05-24 17:02:14 +02:00
slawkens	1f2e7bd72d	Update to 0.8.18-dev	2024-05-23 23:45:01 +02:00
slawkens	016138ab55	Release v0.8.17	2024-05-18 21:39:50 +02:00
slawkens	77efb80a12	Update config.php	2024-05-15 22:20:31 +02:00
slawkens	02eea950e4	Fix XSS in creatures.php, thanks to @gesior Closes #254	2024-05-15 22:15:36 +02:00
slawkens	2793c41655	Set default status_ip, most server are hosted locally anyway	2024-05-15 22:07:46 +02:00
slawkens	62d3c198d5	Fix change_info if account_country is disabled	2024-04-15 21:55:02 +02:00
slawkens	ef62b53cec	Don't allow redirect to external website	2024-04-08 19:05:42 +02:00
slawkens	7181b988e9	Add TwigTypeCastingExtension Useful for casting variables in Twig	2024-04-08 07:35:48 +02:00
slawkens	8b0b123f42	deny vendor, composer.json, changelog.md etc. in nginx config sample	2024-04-06 19:51:57 +02:00
slawkens	f98332c698	Update .gitignore	2024-02-18 12:01:22 +01:00
slawkens	b1660bf27a	Update README.md [skip ci]	2024-02-17 09:06:54 +01:00
slawkens	191ad25eb2	Use word-break: break-all in guilds description + character comment	2024-02-16 20:39:40 +01:00
slawkens	7469be6efb	Fix date	2024-02-12 21:48:50 +01:00
slawkens	47a3bfd265	Release v0.8.16	2024-02-12 21:48:17 +01:00
slawkens	5ae0be2323	Revert "Fix installation" This reverts commit `9c318f9012`.	2024-02-12 21:43:55 +01:00
slawkens	42154d55a0	Fix broken installation I introduced in 0.8.15	2024-02-12 21:39:04 +01:00
slawkens	9dcc08ee6e	Seems that this is better solution to the #245 (output buffering) This works for both, when output_buffering is enabled, and disabled	2024-01-30 19:20:18 +01:00
slawkens	ba537b42bb	Remove 31.php migration -> was for develop branch	2024-01-30 18:23:20 +01:00
slawkens	9c318f9012	Fix installation	2024-01-28 11:11:51 +01:00
Danilo Pucci	a88103a956	- adding check before flush buffer (#245 )	2024-01-01 23:31:26 +01:00
slawkens	e26e6f3a1c	Silently ignore if the hook does not exist	2023-12-28 19:12:47 +01:00
Slawomir Boczek	08d67a07e0	Create SECURITY.md	2023-12-15 20:56:06 +01:00
slawkens	6e9a89cb2e	Update common.php	2023-12-14 16:34:44 +01:00
slawkens	e3aa3d4031	Release v 0.8.15	2023-12-09 00:14:16 +01:00
slawkens	156a68f8bd	Update phplint.yml	2023-12-09 00:11:01 +01:00
slawkens	6a28da5d33	Update phplint.yml	2023-12-09 00:04:20 +01:00
slawkens	ee32384dca	Seems there was more XSS in bugtracker	2023-12-08 23:45:13 +01:00
slawkens	19afd73e8a	This is better	2023-11-29 15:48:03 +01:00
slawkens	eead6a2975	Fix exception showing	2023-11-28 17:11:04 +01:00
slawkens	11b11dd3ee	Release v0.8.14	2023-11-27 23:31:45 +01:00
slawkens	483155cf4c	Prevent session fixation	2023-11-27 23:16:51 +01:00
slawkens	55dbade8d5	Fix XSS in forum	2023-11-27 22:58:24 +01:00
slawkens	d1bc63d07a	Fix forum XSS	2023-11-27 22:58:00 +01:00
slawkens	83a91ec540	Fix XSS in bugtracker.php	2023-11-27 20:28:43 +01:00
slawkens	7b43c972dd	Fix missing query_string in nginx sample config Causes missing parameters in $_GET query	2023-11-25 16:34:57 +01:00
slawkens	3fdf1d3f44	require_once is better	2023-11-05 20:13:31 +01:00
slawkens	764db0c203	Fix display ban info on account page https://otland.net/threads/myacc-bans-display-problem.286825/	2023-11-02 22:06:07 +01:00
slawkens	538076bc45	My fault	2023-09-26 22:00:45 +02:00
slawkens	4327b66f91	Clear some additional cache keys	2023-09-26 20:45:50 +02:00
slawkens	3f27724569	Update common.php	2023-09-16 10:46:17 +02:00
slawkens	9c0c2bbece	Update CHANGELOG.md	2023-09-16 10:45:54 +02:00
slawkens	946144016b	Release v0.8.13	2023-09-16 10:35:10 +02:00
slawkens	5c3b01aca4	Fix XSS vulnerability	2023-09-16 10:31:33 +02:00
slawkens	50983a2b85	Fix error log when coins column does not exist	2023-09-14 16:29:31 +02:00
slawkens	765886f0c7	Add latest clients versions	2023-08-31 14:20:49 +02:00
slawkens	8ea78a5852	thanks @elsongabriel, seems str_contains is not available in php 7	2023-08-25 20:45:45 +02:00
slawkens	063cbab93e	Allow hooks to be prefixed with HOOK_	2023-08-23 12:00:03 +02:00
slawkens	f1670f4012	Patching from develop - twig context for hooks	2023-08-21 12:25:53 +02:00
slawkens	6fcf0f7117	Ignore gallery	2023-08-21 12:21:24 +02:00
slawkens	7a07763625	Update README.md	2023-08-11 22:21:54 +02:00
slawkens	8d2172a649	Added JetBrains logo + notice, thanks for support!	2023-08-11 22:17:17 +02:00
slawkens	b8f65207b6	Add version support table + fix badges	2023-08-11 22:11:29 +02:00
slawkens	ea675afe86	Start 0.8.13-dev	2023-08-07 22:53:02 +02:00
slawkens	cc1cebf359	Update CHANGELOG & release v0.8.12	2023-08-07 22:14:47 +02:00
slawkens	1e874c7027	Fixed not working links from database, introduced in 0.8.10	2023-08-07 21:45:56 +02:00
slawkens	a338fd967c	Removed deprecated functions: utf8_encode & decode	2023-08-05 19:58:52 +02:00
slawkens	8796ff7e72	Remove whitespaces	2023-08-05 19:58:20 +02:00
slawkens	a8172a518f	Add some functions to compatibility layer of gesioraac	2023-08-05 19:58:04 +02:00
slawkens	559c2c7bd2	Add .htaccess to .gitignore	2023-08-05 11:57:15 +02:00
slawkens	7a546e5a41	There is no more info. That never worked.	2023-07-29 07:26:03 +02:00
slawkens	5f7a9154b7	Thanks @anyeor for previous fix	2023-07-11 11:17:18 +02:00
slawkens	0d52978d9f	Fix: cannot create topic on this board (check wasn't working)	2023-07-11 11:15:58 +02:00
slawkens	df48363ea4	Shorten some forum code about length	2023-07-07 17:15:13 +02:00
slawkens	34725e0257	Forum: better error messages (Suggested by @anyeor)	2023-07-07 14:34:26 +02:00
slawkens	df321154f6	Fix guild description on guilds page	2023-07-02 13:47:32 +02:00
slawkens	f2a3ec1185	Fix guild description not shown	2023-06-30 19:53:16 +02:00
slawkens	ce4aed0f17	Add word-break on forum thread & reply When someone inserts long word, is will break into multiple lines	2023-06-30 19:32:47 +02:00
slawkens	d0c82f6fb0	Start 0.8.12-dev	2023-06-30 19:13:38 +02:00
slawkens	89b76e721d	Release 0.8.11	2023-06-30 17:12:38 +02:00
slawkens	6091290efe	Update CHANGELOG.md	2023-06-30 17:12:02 +02:00
slawkens	e4c4990e7f	Forum: Fix quote and edit post buttons not being shown	2023-06-30 15:46:25 +02:00
slawkens	4f1235bfe9	Fix twig exception thrown when player does not exist	2023-06-28 15:15:14 +02:00
slawkens	bf9d440a95	Fix BASE_DIR when accessing /tools	2023-06-27 18:17:37 +02:00
slawkens	59a149c253	Move <base href> above, so it works, thanks @Leesneaks	2023-06-27 18:15:54 +02:00
slawkens	563099f290	Revert "<base> is not working properly, use full URL instead" This reverts commit `fa015b8d39`.	2023-06-27 17:44:19 +02:00
slawkens	3732bf988d	More changes to deleted characters (Account, guilds) Account: Cannot change name, comment, gender + Cannot be deleted if owns a guild Guilds: Cannot create, cannot be invited, cannot accept invite, cannot be passed leadership to	2023-06-27 17:41:04 +02:00
slawkens	ab964fa1de	Important fix: Not allow create char if limit is exceeded (by @anyeor ) Could have been used to spam database, now it doesn't ignore deleted characters He is not my brother :P Just same last name	2023-06-27 15:02:28 +02:00
slawkens	b5c694224e	code formatting	2023-06-27 14:50:44 +02:00
slawkens	23810345f6	small adjustments	2023-06-25 08:38:45 +02:00
slawkens	b574a29331	Better Gesior support	2023-06-22 22:15:18 +02:00
slawkens	6593e32d83	Change title to "Support in game"	2023-06-19 08:04:46 +02:00
slawkens	b09adc836d	Nothing important, just some comments and small code style fixes	2023-06-19 08:03:47 +02:00
slawkens	dcf9a45974	Do not display warning if HTTP_ACCEPT_LANGUAGE is not set	2023-06-19 08:01:35 +02:00
slawkens	21258313ef	New function Cache::remember($key, $ttl, $callback)	2023-06-19 08:01:11 +02:00
slawkens	f851fa3845	New characters page hooks HOOK_CHARACTERS_BEFORE_SKILLS HOOK_CHARACTERS_AFTER_SKILLS HOOK_CHARACTERS_AFTER_QUESTS HOOK_CHARACTERS_AFTER_EQUIPMENT HOOK_CHARACTERS_BEFORE_DEATHS	2023-06-19 08:00:54 +02:00
slawkens	2fdd507902	Display warning if hook file does not exist	2023-06-19 08:00:11 +02:00
slawkens	b850e56ff1	Use $i for hooks, easier compare	2023-06-19 07:47:49 +02:00
SRNT-GG	8d10082179	WIP - Removing unneccessary closing tags to prevent potential issues. (#223 ) * Part 1 Removing closing tags when no HTML or other output comes after the last PHP codeblock. * Further removals * nothing --------- Co-authored-by: slawkens <slawkens@gmail.com>	2023-06-15 20:53:55 +02:00
SRNT-GG	996ae625c9	Update README.md (#224 ) updated required php version	2023-06-11 18:41:47 +02:00
slawkens	467f7ef927	Rename to .htaccess.dist Causes problems on default setup	2023-06-03 09:04:41 +02:00
slawkens	fa015b8d39	<base> is not working properly, use full URL instead	2023-06-02 15:26:09 +02:00
slawkens	4b4864561c	Better news back button	2023-06-01 11:23:28 +02:00
slawkens	475cea8549	Change button style (characters - view) was causing issues in other templates	2023-06-01 09:57:20 +02:00
slawkens	760214fdbd	Init $account_logged, if no logged	2023-06-01 08:52:22 +02:00
slawkens	9c5dcd7b19	Add cypress/e2e/2-advanced-examples to .gitignore	2023-05-29 08:20:56 +02:00
slawkens	720e400f7c	Add cypress.env.json to .gitignore	2023-05-29 08:20:33 +02:00
slawkens	c261c6ba48	Add line & file to exception handler	2023-05-29 08:19:58 +02:00
slawkens	933d4e1d6f	Release 0.8.10	2023-05-18 19:29:53 +02:00
slawkens	1d08833726	Update CHANGELOG.md	2023-05-18 19:25:50 +02:00
slawkens	7cfca55e3c	PHP 7.2.5 is now required, cause of Twig 2.x	2023-05-18 19:21:13 +02:00
slawkens	7e13b62b8f	Fix Twig error on create account	2023-05-18 19:06:50 +02:00
slawkens	5ccfcd541e	Allow pages to be placed in templates folder (second attempt)	2023-05-14 08:59:34 +02:00
slawkens	ba4d2a9c48	Dirty workaround for fb links	2023-05-14 08:38:20 +02:00
slawkens	7a61f613ec	Revert "Workaround for links from fb, like ?fbclid=x" This reverts commit `073d9da0bc`.	2023-05-14 08:15:44 +02:00
slawkens	073d9da0bc	Workaround for links from fb, like ?fbclid=x Now shows news page, instead of "not found". For 0.9 there is better solution	2023-05-13 10:20:58 +02:00
slawkens	e081a67589	Print more info if character cannot be created	2023-04-12 12:52:05 +02:00
slawkens	37a27b8065	Add check for player_deaths columns	2023-04-01 15:09:10 +02:00
slawkens	d34f7eb2fc	Exclude polyfill-mbstring/bootstrap80.php	2023-03-31 11:18:58 +02:00
slawkens	f6c080cb5c	Add overtrue/phplint@7.4	2023-03-31 10:26:16 +02:00
slawkens	a983fd03b1	Revert "test github actions" This reverts commit `5b651886a5`.	2023-03-31 09:34:21 +02:00
slawkens	5b651886a5	test github actions	2023-03-31 09:30:28 +02:00
slawkens	6484ab75d9	Do not allow to continue install when there is no server database imported	2023-03-26 00:17:55 +01:00
slawkens	becad18465	fix small bug on install - please fill all input	2023-03-26 00:02:25 +01:00
slawkens	ec7e5a8838	Fix when server uses another items serializer	2023-03-25 21:59:13 +01:00
slawkens	300c1b4ebc	Fix cannot go forward when config.local.php cannot be saved	2023-03-19 14:46:57 +01:00
slawkens	4f0dd89eb9	Change from warning to error (config.local.php save error)	2023-03-19 14:46:15 +01:00
slawkens	79f7c3dbd4	nothing important	2023-03-19 14:34:29 +01:00
slawkens	f24fc75b12	Bump version to 0.8.10-dev	2023-03-16 10:41:57 +01:00