Start 1.7.2-dev

Better space management

CHANGELOG-1.x.md

@@ -1,5 +1,64 @@
 # Changelog
 
+## [1.7.1 - 27.06.2025]
+
+### Changed
+* Rename plugin:install:install to plugin:setup, also add alias to previous command (https://github.com/slawkens/myaac/commit/13d33822b59df349199e885a78a3d6beb0863d0b)
+
+### Fixed
+* Fix commands: setup + cache:clear (https://github.com/slawkens/myaac/commit/0da524fefe93b3028392e9014550eea3324d3a22, https://github.com/slawkens/myaac/commit/fe8281594e989f00280ba1adc734a9198c6b5cc1)
+* Fix polls link in tibiacom template (https://github.com/slawkens/myaac/commit/d90fa323d7c77d81768df60feeb1c374b1650a0c)
+
+## [1.7 - 22.06.2025]
+
+### Added
+* Feature: plugins versions check (#310)
+* New hooks: HOOK_ACCOUNT_MANAGE_AFTER_CHARACTERS, HOOK_GUILDS_AFTER_MANAGE_BUTTON (https://github.com/slawkens/myaac/commit/c074a48f245df55646b6705737f667b6a84149b2, https://github.com/slawkens/myaac/commit/e6100a1b72de8695bba1dae9ba4e28bfdce47b10)
+* Add OTS_Toolbox::getVocationName(id, promotion) + OTS_Player->isNameLocked() (https://github.com/slawkens/myaac/commit/e222957893c4a1de0dc8dbba55bce1a43418d275, https://github.com/slawkens/myaac/commit/522f6c11d835afd36fd07a07074d96d7e219b488)
+* Add missing csrf in more places, causing white page with error about Request (https://github.com/slawkens/myaac/commit/dca904e61d21d856bf809070e7652803a2df0f58, https://github.com/slawkens/myaac/commit/c720ccc451ff90ef40b2a1595468d061ffd7e1e4)
+
+### Changed
+* Revamped online page (https://github.com/slawkens/myaac/commit/9a90e4aae280e607430511c6727d9a714b11f4c5, https://github.com/slawkens/myaac/commit/4767120043b09141870383e249f3729638d53dc2)
+* Better $title inventing (https://github.com/slawkens/myaac/commit/0c95bcfd06b68b21512e477646ef7bd3a0d4912b)
+
+### Fixed
+* Use apcu cache clear (https://github.com/slawkens/myaac/commit/b329da52aae9d0e21120a6444d3caf442420ce50, https://github.com/slawkens/myaac/commit/566c2a9151ab6392286f74e26853faa19a1b4f24)
+* fix: boostedcreatures for 13.40 (by @GooseWithAKnife) (#307)
+
+## [1.6.1 - 11.06.2025]
+
+### Fixed
+* Fixed "Request has been cancelled due to security reasons", cause of missing csrf() in twig files (https://github.com/slawkens/myaac/commit/10cd71a6630ffec91b43a26a6d685b66c5836a6a)
+* Fix: Ignore duplicated route exception (https://github.com/slawkens/myaac/commit/9d8e9d27bd87167d8d4005942a6af62bfe4c0892)
+
+### Changed
+* Move counter & visitors code before router (In case someone wants to include that info on page) (https://github.com/slawkens/myaac/commit/f78285030708ad3c74ab048711f73bbf3ee5281e)
+* Set TinyMCE license key to gpl (Avoid warning message in browser console) (https://github.com/slawkens/myaac/commit/8d29fdb98b92dbc3d2853ef88a185c67036b4a77)
+
+### Removed
+* Remove deprecated TinyMCE plugin - template (https://github.com/slawkens/myaac/commit/309c1fb715b882e67cb673b1544a03befbf64a22)
+
+## [1.6 - 03.06.2025]
+
+### Added
+* Add new setting/configurable: site_url, prevents domain spoofing (https://github.com/slawkens/myaac/commit/d8a6090be382c35c19117cfef964b594ed02b8d4)
+* Add new account coins setting (https://github.com/slawkens/myaac/commit/28886551e86fe562172c4c7f2afb89a2e7672c2e)
+* autoload: settings/install/init.php (https://github.com/slawkens/myaac/commit/e5749437074c3b3556628a2aeb5bad2edf97bde0, https://github.com/slawkens/myaac/commit/7d213f479a7e40c6254069b5fc4e578dc32bf8d9, https://github.com/slawkens/myaac/commit/207d6bc69120aba1af2b51808f17e0059b571fed)
+* Protect against csrf in more places (accounts & guilds & forums pages) (https://github.com/slawkens/myaac/commit/6eda38603c8ed7e99b92a78a4600b1245377f74d, https://github.com/slawkens/myaac/commit/e776bd52beb3064a9e694efd1b9021ec972ee2f6, https://github.com/slawkens/myaac/commit/84d502bf105f2a789481fba1acc820d236b4de66)
+* Added two new hooks for pages loaded from database (custom pages): HOOK_BEFORE_PAGE_CUSTOM, HOOK_AFTER_PAGE_CUSTOM (https://github.com/slawkens/myaac/commit/c961a1ebf837f2ab1734a825ff2c57b4937610c9)
+* Add global variables into $hooks->executeFilter (https://github.com/slawkens/myaac/commit/8fdea943768b20193eede99d60313ee84511a0be)
+* Add getNPCsCount() to OTS_InfoRespond (https://github.com/slawkens/myaac/commit/7d435ff6433ef1fb2295ee79ed043ee10dc725e9)
+
+### Fixed
+* Allow [] in character name (https://github.com/slawkens/myaac/commit/de6603a51347b9e656c58637ed9971fffdd7cedd)
+* Do not allow access to tools/ folder after install (https://github.com/slawkens/myaac/commit/6e0f5913831f8dba69fd2d1505be3e2a303c6324)
+* Fix CHANGELOG-1.x.md loading in admin panel (https://github.com/slawkens/myaac/commit/4a30fb495dbfbe1d434e8d52419eaf44fe517aee)
+* Fix links not working in admin dashboard modules (https://github.com/slawkens/myaac/commit/be7b27c31aa3bbd6c0289c34d1e61139a3fe015c)
+* Fix twig variables: logged + account_logged being not set directly after login (https://github.com/slawkens/myaac/commit/1e9b10d6489c488cadf7f6ed17b42f1ea6c767a8)
+
+### Changed
+* OTS_ServerInfo -> move setTimeout out of class - Possibility to use the class without MyAAC (https://github.com/slawkens/myaac/commit/40d65a6613149fda51bdceb82c807e5301a3388b)
+
 ## [1.5 - 14.05.2025]
 
 ### Added

README.md

@@ -80,7 +80,7 @@ Pull requests should be made to the *develop* branch as that is the working bran
 
 Bug fixes to current release should be done to master branch.
 
-Look: [Contributing](https://github.com/otsoft/myaac/wiki/Contributing) in our wiki.
+Look: [Contributing](https://docs.my-aac.org/misc/contributing) in our wiki.
 
 ### Other Notes
 
@@ -95,4 +95,4 @@ Many thanks to Jetbrains for kindly providing a license for me to work on this a
 ### License
 
 This program and all associated files are released under the GNU Public License.  
-See [LICENSE](https://github.com/slawkens/myaac/blob/master/LICENSE) for details.
+See [LICENSE](https://github.com/slawkens/myaac/blob/main/LICENSE) for details.

admin/pages/accounts.php

@@ -27,6 +27,13 @@ $nameOrNumberColumn = getAccountIdentityColumn();
 
 $hasSecretColumn = $db->hasColumn('accounts', 'secret');
 $hasCoinsColumn = $db->hasColumn('accounts', 'coins');
+
+$hasCoinsTransferableColumn = $db->hasColumn('accounts', 'coins_transferable');
+$hasTransferableCoinsColumn = $db->hasColumn('accounts', 'transferable_coins');
+$coinsTransferableColumn =
+	$hasTransferableCoinsColumn ?
+		'transferable_coins' : 'coins_transferable';
+
 $hasPointsColumn = $db->hasColumn('accounts', 'premium_points');
 $hasTypeColumn = $db->hasColumn('accounts', 'type');
 $hasGroupColumn = $db->hasColumn('accounts', 'group_id');
@@ -136,11 +143,18 @@ else if (isset($_REQUEST['search'])) {
 			if (!Validator::email($email))
 				$errors['email'] = Validator::getLastError();
 
-			//tibia coins
+			// tibia coins
 			if ($hasCoinsColumn) {
 				$t_coins = $_POST['t_coins'];
 				verify_number($t_coins, 'Tibia coins', 12);
 			}
+
+			// transferable tibia coins
+			if ($hasCoinsTransferableColumn || $hasTransferableCoinsColumn) {
+				$t_coins_transferable = $_POST['t_coins_transferable'];
+				verify_number($t_coins_transferable, 'Transferable Tibia coins', 12);
+			}
+
 			// prem days
 			$p_days = (int)$_POST['p_days'];
 			verify_number($p_days, 'Prem days', 11);
@@ -185,12 +199,18 @@ else if (isset($_REQUEST['search'])) {
 				if ($hasSecretColumn) {
 					$account->setCustomField('secret', $secret);
 				}
+
 				$account->setCustomField('key', $key);
 				$account->setEMail($email);
+
 				if ($hasCoinsColumn) {
 					$account->setCustomField('coins', $t_coins);
 				}
 
+				if ($hasCoinsTransferableColumn || $hasTransferableCoinsColumn) {
+					$account->setCustomField($coinsTransferableColumn, $t_coins_transferable);
+				}
+
 				$lastDay = 0;
 				if($p_days != 0 && $p_days != OTS_Account::GRATIS_PREMIUM_DAYS) {
 					$lastDay = time();
@@ -401,6 +421,12 @@ else if (isset($_REQUEST['search'])) {
 											<input type="text" class="form-control" id="t_coins" name="t_coins" autocomplete="off" maxlength="11" value="<?php echo $account->getCustomField('coins') ?>"/>
 										</div>
 									<?php endif; ?>
+									<?php if ($hasCoinsTransferableColumn || $hasTransferableCoinsColumn): ?>
+										<div class="col-12 col-sm-12 col-lg-6">
+											<label for="t_coins_transferable">Transferable Tibia Coins:</label>
+											<input type="text" class="form-control" id="t_coins_transferable" name="t_coins_transferable" autocomplete="off" maxlength="11" value="<?php echo $account->getCustomField($coinsTransferableColumn) ?>"/>
+										</div>
+									<?php endif; ?>
 									<div class="col-12 col-sm-12 col-lg-6">
 										<label for="p_days">Premium Days:</label>
 										<input type="text" class="form-control" id="p_days" name="p_days" autocomplete="off" maxlength="11" value="<?php echo $account->getPremDays(); ?>"/>

admin/pages/clmd.php

@@ -11,12 +11,12 @@
 defined('MYAAC') or die('Direct access not allowed!');
 $title = 'MyAAC Changelog';
 
-if (!file_exists(BASE . 'CHANGELOG.md')) {
+if (!file_exists(BASE . 'CHANGELOG-1.x.md')) {
 	echo 'File CHANGELOG.md doesn\'t exist.';
 	return;
 }
 
-$changelog = file_get_contents(BASE . 'CHANGELOG.md');
+$changelog = file_get_contents(BASE . 'CHANGELOG-1.x.md');
 
 $Parsedown = new Parsedown();
 

admin/pages/modules/balance.php

@@ -7,7 +7,7 @@ defined('MYAAC') or die('Direct access not allowed!');
 $balance = 0;
 
 if ($db->hasColumn('players', 'balance')) {
-	$balance = Player::orderByDesc('balance')->limit(10)->get(['balance', 'id','name', 'level'])->toArray();
+	$balance = Player::orderByDesc('balance')->limit(10)->get(['id', 'name', 'balance'])->toArray();
 }
 
 $twig->display('balance.html.twig', array(

admin/pages/modules/coins.php

@@ -7,7 +7,12 @@ defined('MYAAC') or die('Direct access not allowed!');
 $coins = 0;
 
 if ($db->hasColumn('accounts', 'coins')) {
-	$coins = Account::orderByDesc('coins')->limit(10)->get(['coins', (USE_ACCOUNT_NAME ? 'name' : 'id')])->toArray();
+	$whatToGet = ['id', 'coins'];
+	if (USE_ACCOUNT_NAME) {
+		$whatToGet[] = 'name';
+	}
+
+	$coins = Account::orderByDesc('coins')->limit(10)->get($whatToGet)->toArray();
 }
 
 $twig->display('coins.html.twig', array(

admin/pages/modules/lastlogin.php

@@ -7,7 +7,7 @@ defined('MYAAC') or die('Direct access not allowed!');
 $players = 0;
 
 if ($db->hasColumn('players', 'lastlogin')) {
-	$players = Player::orderByDesc('lastlogin')->limit(10)->get(['name', 'level', 'lastlogin'])->toArray();
+	$players = Player::orderByDesc('lastlogin')->limit(10)->get(['id', 'name', 'level', 'lastlogin'])->toArray();
 }
 
 $twig->display('lastlogin.html.twig', array(

admin/pages/modules/templates/balance.html.twig

@@ -19,7 +19,7 @@
 						{% set i = i + 1 %}
 						<tr>
 							<th>{{ i }}</th>
-							<td><a href="?p=players&search_name={{ result.name }}">{{ result.name }}</a></td>
+							<td><a href="?p=players&id={{ result.id }}">{{ result.name }}</a></td>
 							<td>{{ result.balance }}</td>
 						</tr>
 					{% endfor %}

admin/pages/modules/templates/coins.html.twig

@@ -19,7 +19,7 @@
 						{% set i = i + 1 %}
 						<tr>
 							<th>{{ i }}</th>
-							<td><a href="?p=accounts&search_name={{ result.name }}">{{ result.name }}</a></td>
+							<td><a href="?p=accounts&id={{ result.id }}">{{ result.name ?? result.id }}</a></td>
 							<td>{{ result.coins }}</td>
 						</tr>
 					{% endfor %}

admin/pages/modules/templates/lastlogin.html.twig

@@ -19,7 +19,7 @@
 						{% set i = i + 1 %}
 						<tr>
 							<th>{{ i }}</th>
-							<td><a href="?p=players&search_name={{ result.name }}">{{ result.name }}</a></td>
+							<td><a href="?p=players&id={{ result.id }}">{{ result.name }}</a></td>
 							<td>{{ result.lastlogin|date("M d Y, H:i:s") }}</td>
 						</tr>
 					{% endfor %}

admin/pages/modules/templates/points.html.twig

@@ -19,7 +19,7 @@
 						{% set i = i + 1 %}
 						<tr>
 							<th>{{ i }}</th>
-							<td><a href="?p=accounts&search_name={{ result.name }}">{{ result.name }}</a></td>
+							<td><a href="?p=accounts&id={{ result.id }}">{{ result.name }}</a></td>
 							<td>{{ result.premium_points }}</td>
 						</tr>
 					{% endfor %}

admin/pages/plugins.php

@@ -51,6 +51,56 @@ else {
 		} else {
 			error('Error while disabling plugin ' . $disable . ': ' . Plugins::getError());
 		}
+	}
+	else if (isset($_GET['check-updates'])) {
+		$repoUri = $config['admin_plugins_api_uri'] ?? 'https://plugins.my-aac.org/api/';
+		success("Fetching latest info from $repoUri..");
+
+		$adminPlugins = new \MyAAC\Admin\Plugins();
+
+		$adminPlugins->setApiBaseUri($repoUri);
+
+		try {
+			$plugins = $adminPlugins->getLatestVersions();
+		}
+		catch (Exception $e) {
+			error($e->getMessage());
+		}
+
+		if (isset($plugins) && count($plugins) > 0) {
+			$outdated = [];
+
+			foreach (get_plugins(true) as $plugin) {
+				$string = file_get_contents(BASE . 'plugins/' . $plugin . '.json');
+				$plugin_info = json_decode($string, true);
+
+				if (!$plugin_info) {
+					continue;
+				}
+
+				$disabled = (str_contains($plugin, 'disabled.'));
+				$pluginOriginal = ($disabled ? str_replace('disabled.', '', $plugin) : $plugin);
+
+				$info = $plugins[$pluginOriginal] ?? false;
+				if ($info && version_compare($info['version'], $plugin_info['version'], '>')) {
+					$outdated[] = [
+						'name' => $pluginOriginal,
+						'yourVersion' => $plugin_info['version'],
+						'latestVersion' => $info['version'],
+						'link' => $info['link'] ?? 'Unknown',
+						'download_link' => $info['download_link'] ?? 'Unknown',
+					];
+				}
+			}
+
+			if (count($outdated) > 0) {
+				info('Following updates have been found for your plugins:');
+				$twig->display('admin.plugins.outdated.html.twig', ['plugins' => $outdated]);
+			}
+			else {
+				success('All plugins up to date!');
+			}
+		}
 	} else if (isset($_FILES['plugin']['name'])) {
 		$file = $_FILES['plugin'];
 		$filename = $file['name'];

admin/pages/visitors.php

@@ -19,8 +19,7 @@ $use_datatable = true;
 
 if (!setting('core.visitors_counter')): ?>
 	Visitors counter is disabled.<br/>
-	You can enable it by editing this configurable in <b>config.local.php</b> file:<br/>
-	<p style="margin-left: 3em;"><b>$config['visitors_counter'] = true;</b></p>
+	You can enable it in Settings -> General -> Visitors Counter.<br/>
 	<?php
 	return;
 endif;
@@ -46,7 +45,7 @@ foreach ($tmp as &$visitor) {
 		if ($dd->isBot()) {
 			$bot = $dd->getBot();
 			$message = '(Bot) %s, <a href="%s" target="_blank">%s</a>';
-			$browser = sprintf($message, $bot['category'], $bot['url'], $bot['name']);
+			$browser = sprintf($message, $bot['category'] ?? 'Unknown', $bot['url'] ?? '', $bot['name'] ?? 'Unknown name');
 		}
 		else {
 			$osFamily = OperatingSystem::getOsFamily($dd->getOs('name'));

admin/tools/settings_save.php

@@ -1,6 +1,5 @@
 <?php
 
-use MyAAC\Hooks;
 use MyAAC\Settings;
 
 const MYAAC_ADMIN = true;

common.php

@@ -26,7 +26,7 @@
 if (version_compare(phpversion(), '8.1', '<')) die('PHP version 8.1 or higher is required.');
 
 const MYAAC = true;
-const MYAAC_VERSION = '1.5';
+const MYAAC_VERSION = '1.7.2-dev';
 const DATABASE_VERSION = 45;
 const TABLE_PREFIX = 'myaac_';
 define('START_TIME', microtime(true));
@@ -122,38 +122,30 @@ if (!IS_CLI) {
 	session_start();
 }
 
-// basedir
-$basedir = '';
-$tmp = explode('/', $_SERVER['SCRIPT_NAME']);
-$size = count($tmp) - 1;
-for($i = 1; $i < $size; $i++)
-	$basedir .= '/' . $tmp[$i];
-
-$basedir = str_replace(['/' . ADMIN_PANEL_FOLDER, '/install', '/tools'], '', $basedir);
-define('BASE_DIR', $basedir);
-
-if(!IS_CLI) {
-	if (isset($_SERVER['HTTP_HOST'][0])) {
-		$baseHost = $_SERVER['HTTP_HOST'];
-	} else {
-		if (isset($_SERVER['SERVER_NAME'][0])) {
-			$baseHost = $_SERVER['SERVER_NAME'];
-		} else {
-			$baseHost = $_SERVER['SERVER_ADDR'];
-		}
-	}
-
-	define('SERVER_URL', 'http' . (isHttps() ? 's' : '') . '://' . $baseHost);
-	define('BASE_URL', SERVER_URL . BASE_DIR . '/');
-	define('ADMIN_URL', SERVER_URL . BASE_DIR . '/' . ADMIN_PANEL_FOLDER . '/');
-
-	//define('CURRENT_URL', BASE_URL . $_SERVER['REQUEST_URI']);
-}
-
 if (file_exists(BASE . 'config.local.php')) {
 	require BASE . 'config.local.php';
 }
 
+require SYSTEM . 'base.php';
+define('BASE_DIR', $baseDir);
+
+if(!IS_CLI) {
+	if (isset($config['site_url'])) {
+		$hasSlashAtEnd = ($config['site_url'][strlen($config['site_url']) - 1] == '/');
+
+		define('SERVER_URL', $config['site_url']);
+		define('BASE_URL', SERVER_URL . ($hasSlashAtEnd ? '' : '/'));
+		define('ADMIN_URL', SERVER_URL . ($hasSlashAtEnd ? '' : '/') . ADMIN_PANEL_FOLDER . '/');
+	}
+	else {
+		define('SERVER_URL', 'http' . (isHttps() ? 's' : '') . '://' . $baseHost);
+		define('BASE_URL', SERVER_URL . BASE_DIR . '/');
+		define('ADMIN_URL', SERVER_URL . BASE_DIR . '/' . ADMIN_PANEL_FOLDER . '/');
+
+		//define('CURRENT_URL', BASE_URL . $_SERVER['REQUEST_URI']);
+	}
+}
+
 /** @var array $config */
 ini_set('log_errors', 1);
 if(@$config['env'] === 'dev' || defined('MYAAC_INSTALL')) {

composer.json

@@ -18,7 +18,8 @@
         "symfony/string": "^6.4",
         "symfony/var-dumper": "^6.4",
         "filp/whoops": "^2.15",
-        "maximebf/debugbar": "1.*"
+        "maximebf/debugbar": "1.*",
+        "guzzlehttp/guzzle": "7.9.3"
     },
     "require-dev": {
         "phpstan/phpstan": "^1.10"

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "be4d1489a53a9cd8eec6bcaa7a096f30",
+    "content-hash": "5317e97a5025ebc2a977214bd3fa964c",
     "packages": [
         {
             "name": "brick/math",
@@ -493,6 +493,331 @@
             ],
             "time": "2024-09-25T12:00:00+00:00"
         },
+        {
+            "name": "guzzlehttp/guzzle",
+            "version": "7.9.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/guzzle/guzzle.git",
+                "reference": "7b2f29fe81dc4da0ca0ea7d42107a0845946ea77"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/7b2f29fe81dc4da0ca0ea7d42107a0845946ea77",
+                "reference": "7b2f29fe81dc4da0ca0ea7d42107a0845946ea77",
+                "shasum": ""
+            },
+            "require": {
+                "ext-json": "*",
+                "guzzlehttp/promises": "^1.5.3 || ^2.0.3",
+                "guzzlehttp/psr7": "^2.7.0",
+                "php": "^7.2.5 || ^8.0",
+                "psr/http-client": "^1.0",
+                "symfony/deprecation-contracts": "^2.2 || ^3.0"
+            },
+            "provide": {
+                "psr/http-client-implementation": "1.0"
+            },
+            "require-dev": {
+                "bamarni/composer-bin-plugin": "^1.8.2",
+                "ext-curl": "*",
+                "guzzle/client-integration-tests": "3.0.2",
+                "php-http/message-factory": "^1.1",
+                "phpunit/phpunit": "^8.5.39 || ^9.6.20",
+                "psr/log": "^1.1 || ^2.0 || ^3.0"
+            },
+            "suggest": {
+                "ext-curl": "Required for CURL handler support",
+                "ext-intl": "Required for Internationalized Domain Name (IDN) support",
+                "psr/log": "Required for using the Log middleware"
+            },
+            "type": "library",
+            "extra": {
+                "bamarni-bin": {
+                    "bin-links": true,
+                    "forward-command": false
+                }
+            },
+            "autoload": {
+                "files": [
+                    "src/functions_include.php"
+                ],
+                "psr-4": {
+                    "GuzzleHttp\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Graham Campbell",
+                    "email": "hello@gjcampbell.co.uk",
+                    "homepage": "https://github.com/GrahamCampbell"
+                },
+                {
+                    "name": "Michael Dowling",
+                    "email": "mtdowling@gmail.com",
+                    "homepage": "https://github.com/mtdowling"
+                },
+                {
+                    "name": "Jeremy Lindblom",
+                    "email": "jeremeamia@gmail.com",
+                    "homepage": "https://github.com/jeremeamia"
+                },
+                {
+                    "name": "George Mponos",
+                    "email": "gmponos@gmail.com",
+                    "homepage": "https://github.com/gmponos"
+                },
+                {
+                    "name": "Tobias Nyholm",
+                    "email": "tobias.nyholm@gmail.com",
+                    "homepage": "https://github.com/Nyholm"
+                },
+                {
+                    "name": "Márk Sági-Kazár",
+                    "email": "mark.sagikazar@gmail.com",
+                    "homepage": "https://github.com/sagikazarmark"
+                },
+                {
+                    "name": "Tobias Schultze",
+                    "email": "webmaster@tubo-world.de",
+                    "homepage": "https://github.com/Tobion"
+                }
+            ],
+            "description": "Guzzle is a PHP HTTP client library",
+            "keywords": [
+                "client",
+                "curl",
+                "framework",
+                "http",
+                "http client",
+                "psr-18",
+                "psr-7",
+                "rest",
+                "web service"
+            ],
+            "support": {
+                "issues": "https://github.com/guzzle/guzzle/issues",
+                "source": "https://github.com/guzzle/guzzle/tree/7.9.3"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/GrahamCampbell",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/Nyholm",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/guzzlehttp/guzzle",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-03-27T13:37:11+00:00"
+        },
+        {
+            "name": "guzzlehttp/promises",
+            "version": "2.2.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/guzzle/promises.git",
+                "reference": "7c69f28996b0a6920945dd20b3857e499d9ca96c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/guzzle/promises/zipball/7c69f28996b0a6920945dd20b3857e499d9ca96c",
+                "reference": "7c69f28996b0a6920945dd20b3857e499d9ca96c",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.2.5 || ^8.0"
+            },
+            "require-dev": {
+                "bamarni/composer-bin-plugin": "^1.8.2",
+                "phpunit/phpunit": "^8.5.39 || ^9.6.20"
+            },
+            "type": "library",
+            "extra": {
+                "bamarni-bin": {
+                    "bin-links": true,
+                    "forward-command": false
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "GuzzleHttp\\Promise\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Graham Campbell",
+                    "email": "hello@gjcampbell.co.uk",
+                    "homepage": "https://github.com/GrahamCampbell"
+                },
+                {
+                    "name": "Michael Dowling",
+                    "email": "mtdowling@gmail.com",
+                    "homepage": "https://github.com/mtdowling"
+                },
+                {
+                    "name": "Tobias Nyholm",
+                    "email": "tobias.nyholm@gmail.com",
+                    "homepage": "https://github.com/Nyholm"
+                },
+                {
+                    "name": "Tobias Schultze",
+                    "email": "webmaster@tubo-world.de",
+                    "homepage": "https://github.com/Tobion"
+                }
+            ],
+            "description": "Guzzle promises library",
+            "keywords": [
+                "promise"
+            ],
+            "support": {
+                "issues": "https://github.com/guzzle/promises/issues",
+                "source": "https://github.com/guzzle/promises/tree/2.2.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/GrahamCampbell",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/Nyholm",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/guzzlehttp/promises",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-03-27T13:27:01+00:00"
+        },
+        {
+            "name": "guzzlehttp/psr7",
+            "version": "2.7.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/guzzle/psr7.git",
+                "reference": "c2270caaabe631b3b44c85f99e5a04bbb8060d16"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/guzzle/psr7/zipball/c2270caaabe631b3b44c85f99e5a04bbb8060d16",
+                "reference": "c2270caaabe631b3b44c85f99e5a04bbb8060d16",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.2.5 || ^8.0",
+                "psr/http-factory": "^1.0",
+                "psr/http-message": "^1.1 || ^2.0",
+                "ralouphie/getallheaders": "^3.0"
+            },
+            "provide": {
+                "psr/http-factory-implementation": "1.0",
+                "psr/http-message-implementation": "1.0"
+            },
+            "require-dev": {
+                "bamarni/composer-bin-plugin": "^1.8.2",
+                "http-interop/http-factory-tests": "0.9.0",
+                "phpunit/phpunit": "^8.5.39 || ^9.6.20"
+            },
+            "suggest": {
+                "laminas/laminas-httphandlerrunner": "Emit PSR-7 responses"
+            },
+            "type": "library",
+            "extra": {
+                "bamarni-bin": {
+                    "bin-links": true,
+                    "forward-command": false
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "GuzzleHttp\\Psr7\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Graham Campbell",
+                    "email": "hello@gjcampbell.co.uk",
+                    "homepage": "https://github.com/GrahamCampbell"
+                },
+                {
+                    "name": "Michael Dowling",
+                    "email": "mtdowling@gmail.com",
+                    "homepage": "https://github.com/mtdowling"
+                },
+                {
+                    "name": "George Mponos",
+                    "email": "gmponos@gmail.com",
+                    "homepage": "https://github.com/gmponos"
+                },
+                {
+                    "name": "Tobias Nyholm",
+                    "email": "tobias.nyholm@gmail.com",
+                    "homepage": "https://github.com/Nyholm"
+                },
+                {
+                    "name": "Márk Sági-Kazár",
+                    "email": "mark.sagikazar@gmail.com",
+                    "homepage": "https://github.com/sagikazarmark"
+                },
+                {
+                    "name": "Tobias Schultze",
+                    "email": "webmaster@tubo-world.de",
+                    "homepage": "https://github.com/Tobion"
+                },
+                {
+                    "name": "Márk Sági-Kazár",
+                    "email": "mark.sagikazar@gmail.com",
+                    "homepage": "https://sagikazarmark.hu"
+                }
+            ],
+            "description": "PSR-7 message implementation that also provides common utility methods",
+            "keywords": [
+                "http",
+                "message",
+                "psr-7",
+                "request",
+                "response",
+                "stream",
+                "uri",
+                "url"
+            ],
+            "support": {
+                "issues": "https://github.com/guzzle/psr7/issues",
+                "source": "https://github.com/guzzle/psr7/tree/2.7.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/GrahamCampbell",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/Nyholm",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/guzzlehttp/psr7",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-03-27T12:30:47+00:00"
+        },
         {
             "name": "illuminate/collections",
             "version": "v10.48.25",
@@ -1472,6 +1797,166 @@
             },
             "time": "2021-11-05T16:47:00+00:00"
         },
+        {
+            "name": "psr/http-client",
+            "version": "1.0.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/http-client.git",
+                "reference": "bb5906edc1c324c9a05aa0873d40117941e5fa90"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/http-client/zipball/bb5906edc1c324c9a05aa0873d40117941e5fa90",
+                "reference": "bb5906edc1c324c9a05aa0873d40117941e5fa90",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.0 || ^8.0",
+                "psr/http-message": "^1.0 || ^2.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.0.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Psr\\Http\\Client\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "PHP-FIG",
+                    "homepage": "https://www.php-fig.org/"
+                }
+            ],
+            "description": "Common interface for HTTP clients",
+            "homepage": "https://github.com/php-fig/http-client",
+            "keywords": [
+                "http",
+                "http-client",
+                "psr",
+                "psr-18"
+            ],
+            "support": {
+                "source": "https://github.com/php-fig/http-client"
+            },
+            "time": "2023-09-23T14:17:50+00:00"
+        },
+        {
+            "name": "psr/http-factory",
+            "version": "1.1.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/http-factory.git",
+                "reference": "2b4765fddfe3b508ac62f829e852b1501d3f6e8a"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/http-factory/zipball/2b4765fddfe3b508ac62f829e852b1501d3f6e8a",
+                "reference": "2b4765fddfe3b508ac62f829e852b1501d3f6e8a",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.1",
+                "psr/http-message": "^1.0 || ^2.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.0.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Psr\\Http\\Message\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "PHP-FIG",
+                    "homepage": "https://www.php-fig.org/"
+                }
+            ],
+            "description": "PSR-17: Common interfaces for PSR-7 HTTP message factories",
+            "keywords": [
+                "factory",
+                "http",
+                "message",
+                "psr",
+                "psr-17",
+                "psr-7",
+                "request",
+                "response"
+            ],
+            "support": {
+                "source": "https://github.com/php-fig/http-factory"
+            },
+            "time": "2024-04-15T12:06:14+00:00"
+        },
+        {
+            "name": "psr/http-message",
+            "version": "2.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/http-message.git",
+                "reference": "402d35bcb92c70c026d1a6a9883f06b2ead23d71"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/http-message/zipball/402d35bcb92c70c026d1a6a9883f06b2ead23d71",
+                "reference": "402d35bcb92c70c026d1a6a9883f06b2ead23d71",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.2 || ^8.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "2.0.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Psr\\Http\\Message\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "PHP-FIG",
+                    "homepage": "https://www.php-fig.org/"
+                }
+            ],
+            "description": "Common interface for HTTP messages",
+            "homepage": "https://github.com/php-fig/http-message",
+            "keywords": [
+                "http",
+                "http-message",
+                "psr",
+                "psr-7",
+                "request",
+                "response"
+            ],
+            "support": {
+                "source": "https://github.com/php-fig/http-message/tree/2.0"
+            },
+            "time": "2023-04-04T09:54:51+00:00"
+        },
         {
             "name": "psr/log",
             "version": "3.0.2",
@@ -1573,6 +2058,50 @@
             },
             "time": "2021-10-29T13:26:27+00:00"
         },
+        {
+            "name": "ralouphie/getallheaders",
+            "version": "3.0.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/ralouphie/getallheaders.git",
+                "reference": "120b605dfeb996808c31b6477290a714d356e822"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/ralouphie/getallheaders/zipball/120b605dfeb996808c31b6477290a714d356e822",
+                "reference": "120b605dfeb996808c31b6477290a714d356e822",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=5.6"
+            },
+            "require-dev": {
+                "php-coveralls/php-coveralls": "^2.1",
+                "phpunit/phpunit": "^5 || ^6.5"
+            },
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "src/getallheaders.php"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Ralph Khattar",
+                    "email": "ralph.khattar@gmail.com"
+                }
+            ],
+            "description": "A polyfill for getallheaders.",
+            "support": {
+                "issues": "https://github.com/ralouphie/getallheaders/issues",
+                "source": "https://github.com/ralouphie/getallheaders/tree/develop"
+            },
+            "time": "2019-03-08T08:55:37+00:00"
+        },
         {
             "name": "symfony/console",
             "version": "v6.4.17",
@@ -2910,7 +3439,7 @@
     ],
     "aliases": [],
     "minimum-stability": "stable",
-    "stability-flags": [],
+    "stability-flags": {},
     "prefer-stable": false,
     "prefer-lowest": false,
     "platform": {
@@ -2921,6 +3450,6 @@
         "ext-xml": "*",
         "ext-dom": "*"
     },
-    "platform-dev": [],
-    "plugin-api-version": "2.3.0"
+    "platform-dev": {},
+    "plugin-api-version": "2.6.0"
 }

index.php

@@ -93,6 +93,7 @@ if(setting('core.backward_support')) {
 	if($logged && $account_logged)
 		$group_id_of_acc_logged = $account_logged->getGroupId();
 
+	$config['serverPath'] = $config['server_path'];
 	$config['site'] = &$config;
 	$config['server'] = &$config['lua'];
 	$config['site']['shop_system'] = setting('core.gifts_system');
@@ -117,6 +118,14 @@ if(setting('core.backward_support')) {
 		$config['status']['serverStatus_' . $key] = $value;
 }
 
+if(setting('core.views_counter')) {
+	require_once SYSTEM . 'counter.php';
+}
+
+if(setting('core.visitors_counter')) {
+	$visitors = new Visitors(setting('core.visitors_counter_ttl'));
+}
+
 require_once SYSTEM . 'router.php';
 
 // anonymous usage statistics
@@ -153,22 +162,6 @@ if(setting('core.anonymous_usage_statistics')) {
 	}
 }
 
-if(setting('core.views_counter'))
-	require_once SYSTEM . 'counter.php';
-
-if(setting('core.visitors_counter')) {
-	$visitors = new Visitors(setting('core.visitors_counter_ttl'));
-}
-
-/**
- * @var OTS_Account $account_logged
- */
-if ($logged && admin()) {
-	$content .= $twig->render('admin-bar.html.twig', [
-		'username' => USE_ACCOUNT_NAME ? $account_logged->getName() : $account_logged->getId()
-	]);
-}
-
 $title_full =  (isset($title) ? $title . ' - ' : '') . $config['lua']['serverName'];
 require $template_path . '/' . $template_index;
 

install/steps/4-config.php

@@ -10,6 +10,14 @@ foreach($config['clients'] as $client) {
 	$clients[$client] = $client_version;
 }
 
+if (empty($_SESSION['var_site_url'])) {
+	//require SYSTEM . 'base.php';
+	$serverUrl = 'http' . (isHttps() ? 's' : '') . '://' . $baseHost;
+	$siteURL = $serverUrl . $baseDir;
+
+	$_SESSION['var_site_url'] = $siteURL;
+}
+
 $twig->display('install.config.html.twig', array(
 	'clients' => $clients,
 	'timezones' => DateTimeZone::listIdentifiers(),

install/steps/7-finish.php

@@ -195,13 +195,4 @@ if(!isset($_SESSION['installed'])) {
 	$_SESSION['installed'] = true;
 }
 
-foreach($_SESSION as $key => $value) {
-	if(strpos($key, 'var_') !== false)
-		unset($_SESSION[$key]);
-}
-unset($_SESSION['saved']);
-if(file_exists(CACHE . 'install.txt')) {
-	unlink(CACHE . 'install.txt');
-}
-
 $hooks->trigger(HOOK_INSTALL_FINISH_END);

install/tools/5-database.php

@@ -7,6 +7,11 @@ require SYSTEM . 'functions.php';
 require BASE . 'install/includes/functions.php';
 require BASE . 'install/includes/locale.php';
 
+if(isset($config['installed']) && $config['installed'] && !isset($_SESSION['saved'])) {
+	warning($locale['already_installed']);
+	return;
+}
+
 $error = false;
 require BASE . 'install/includes/config.php';
 

install/tools/7-finish.php

@@ -17,11 +17,11 @@ ini_set('max_execution_time', 300);
 ob_implicit_flush();
 
 header('X-Accel-Buffering: no');
-/*
+
 if(isset($config['installed']) && $config['installed'] && !isset($_SESSION['saved'])) {
 	warning($locale['already_installed']);
 	return;
-}*/
+}
 
 require SYSTEM . 'init.php';
 
@@ -94,6 +94,17 @@ $hooks->trigger(HOOK_INSTALL_FINISH);
 
 $db->setClearCacheAfter(true);
 
+// cleanup
+foreach($_SESSION as $key => $value) {
+	if(str_contains($key, 'var_')) {
+		unset($_SESSION[$key]);
+	}
+}
+unset($_SESSION['saved']);
+if(file_exists(CACHE . 'install.txt')) {
+	unlink(CACHE . 'install.txt');
+}
+
 $locale['step_finish_desc'] = str_replace('$ADMIN_PANEL$', generateLink(str_replace('tools/', '',ADMIN_URL), $locale['step_finish_admin_panel'], true), $locale['step_finish_desc']);
 $locale['step_finish_desc'] = str_replace('$HOMEPAGE$', generateLink(str_replace('tools/', '', BASE_URL), $locale['step_finish_homepage'], true), $locale['step_finish_desc']);
 $locale['step_finish_desc'] = str_replace('$LINK$', generateLink('https://my-aac.org', 'https://my-aac.org', true), $locale['step_finish_desc']);

login.php

@@ -88,8 +88,8 @@ switch ($action) {
 	case 'boostedcreature':
 		$clientVersion = (int)setting('core.client');
 
-		// 14.00 and up
-		if ($clientVersion >= 1400) {
+		// 13.40 and up
+		if ($clientVersion >= 1340) {
 			$creatureBoost = $db->query("SELECT * FROM " . $db->tableName('boosted_creature'))->fetchAll();
 			$bossBoost     = $db->query("SELECT * FROM " . $db->tableName('boosted_boss'))->fetchAll();
 			die(json_encode([

plugins/example.json

@@ -51,5 +51,8 @@
 		"themes": true,
 		"admin-pages": true,
 		"admin-pages-sub-folders": true,
+		"settings": true,
+		"install": true,
+		"init": false
 	}
  }

system/base.php

@@ -0,0 +1,21 @@
+<?php
+
+$baseDir = '';
+$tmp = explode('/', $_SERVER['SCRIPT_NAME']);
+$size = count($tmp) - 1;
+for($i = 1; $i < $size; $i++)
+	$baseDir .= '/' . $tmp[$i];
+
+$baseDir = str_replace(['/' . ADMIN_PANEL_FOLDER, '/install', '/tools'], '', $baseDir);
+
+if(!IS_CLI) {
+	if (isset($_SERVER['HTTP_HOST'][0])) {
+		$baseHost = $_SERVER['HTTP_HOST'];
+	} else {
+		if (isset($_SERVER['SERVER_NAME'][0])) {
+			$baseHost = $_SERVER['SERVER_NAME'];
+		} else {
+			$baseHost = $_SERVER['SERVER_ADDR'];
+		}
+	}
+}

system/functions.php

@@ -512,6 +512,13 @@ function template_place_holder($type): string
 	}
 	elseif ($type === 'body_start') {
 		$ret .= $twig->render('browsehappy.html.twig');
+
+		if (admin()) {
+			global $account_logged;
+			$ret .= $twig->render('admin-bar.html.twig', [
+				'username' => USE_ACCOUNT_NAME ? $account_logged->getName() : $account_logged->getId()
+			]);
+		}
 	}
 	elseif($type === 'body_end') {
 		$ret .= template_ga_code();
@@ -982,11 +989,12 @@ function load_config_lua($filename)
 		foreach($lines as $ln => $line)
 		{
 			$line = trim($line);
-			if(@$line[0] === '{' || @$line[0] === '}') {
+			if(isset($line[0]) && ($line[0] === '{' || $line[0] === '}')) {
 				// arrays are not supported yet
 				// just ignore the error
 				continue;
 			}
+
 			$tmp_exp = explode('=', $line, 2);
 			if(str_contains($line, 'dofile')) {
 				$delimiter = '"';
@@ -1265,14 +1273,15 @@ function clearCache()
 		$db->setClearCacheAfter(true);
 	}
 
+	if (function_exists('apcu_clear_cache')) {
+		apcu_clear_cache();
+	}
+
 	deleteDirectory(CACHE . 'signatures', ['index.html'], true);
 	deleteDirectory(CACHE . 'twig', ['index.html'], true);
 	deleteDirectory(CACHE . 'plugins', ['index.html'], true);
 	deleteDirectory(CACHE, ['signatures', 'twig', 'plugins', 'index.html', 'persistent'], true);
 
-	// routes cache
-	clearRouteCache();
-
 	global $hooks;
 	$hooks->trigger(HOOK_CACHE_CLEAR, ['cache' => Cache::getInstance()]);
 

system/init.php

@@ -12,6 +12,7 @@ use DebugBar\StandardDebugBar;
 use MyAAC\Cache\Cache;
 use MyAAC\CsrfToken;
 use MyAAC\Hooks;
+use MyAAC\Plugins;
 use MyAAC\Models\Town;
 use MyAAC\Settings;
 
@@ -46,6 +47,11 @@ if(isset($config['gzip_output']) && $config['gzip_output'] && isset($_SERVER['HT
 global $cache;
 $cache = Cache::getInstance();
 
+// load plugins init.php
+foreach (Plugins::getInits() as $init) {
+	require $init;
+}
+
 // event system
 global $hooks;
 $hooks = new Hooks();
@@ -138,6 +144,9 @@ $ots = POT::getInstance();
 $eloquentConnection = null;
 require_once SYSTEM . 'database.php';
 
+$twig->addGlobal('logged', false);
+$twig->addGlobal('account_logged', new \OTS_Account());
+
 // verify myaac tables exists in database
 if(!defined('MYAAC_INSTALL') && !$db->hasTable('myaac_account_actions')) {
 	throw new RuntimeException('Seems that the table myaac_account_actions of MyAAC doesn\'t exist in the database. This is a fatal error. You can try to reinstall MyAAC by visiting ' . (IS_CLI ? 'http://your-ip.com/' : BASE_URL) . 'install');

system/libs/pot/OTS_InfoRespond.php

@@ -15,11 +15,11 @@
 
 /**
  * Wrapper for 'info' respond's DOMDocument.
- * 
+ *
  * <p>
  * Note: as this class extends DOMDocument class and contains exacly respond XML tree you can work on it as on normal DOM tree.
  * </p>
- * 
+ *
  * @package POT
  * @version 0.1.0
  * @property-read string $tspqVersion Root element version.
@@ -48,252 +48,257 @@ class OTS_InfoRespond extends DOMDocument
 {
 /**
  * Returns version of root element.
- * 
+ *
  * @return string TSPQ version.
  * @throws DOMException On DOM operation error.
  */
-    public function getTSPQVersion()
-    {
-        return $this->documentElement->getAttribute('version');
-    }
+	public function getTSPQVersion()
+	{
+		return $this->documentElement->getAttribute('version');
+	}
 
 /**
  * Returns server uptime.
- * 
+ *
  * @return int Uptime.
  * @throws DOMException On DOM operation error.
  */
-    public function getUptime()
-    {
-        return (int) $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('uptime');
-    }
+	public function getUptime()
+	{
+		return (int) $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('uptime');
+	}
 
 /**
  * Returns server IP.
- * 
+ *
  * @return string IP.
  * @throws DOMException On DOM operation error.
  */
-    public function getIP()
-    {
-        return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('ip');
-    }
+	public function getIP()
+	{
+		return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('ip');
+	}
 
 /**
  * Returns server name.
- * 
+ *
  * @return string Name.
  * @throws DOMException On DOM operation error.
  */
-    public function getName()
-    {
-        return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('servername');
-    }
+	public function getName()
+	{
+		return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('servername');
+	}
 
 /**
  * Returns server port.
- * 
+ *
  * @return int Port.
  * @throws DOMException On DOM operation error.
  */
-    public function getPort()
-    {
-        return (int) $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('port');
-    }
+	public function getPort()
+	{
+		return (int) $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('port');
+	}
 
 /**
  * Returns server location.
- * 
+ *
  * @return string Location.
  * @throws DOMException On DOM operation error.
  */
-    public function getLocation()
-    {
-        return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('location');
-    }
+	public function getLocation()
+	{
+		return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('location');
+	}
 
 /**
  * Returns server website.
- * 
+ *
  * @return string Website URL.
  * @throws DOMException On DOM operation error.
  */
-    public function getURL()
-    {
-        return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('url');
-    }
+	public function getURL()
+	{
+		return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('url');
+	}
 
 /**
  * Returns server attribute.
- * 
+ *
  * I have no idea what the hell is it representing :P.
- * 
+ *
  * @return string Attribute value.
  * @throws DOMException On DOM operation error.
  */
-    public function getServer()
-    {
-        return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('server');
-    }
+	public function getServer()
+	{
+		return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('server');
+	}
 
 /**
  * Returns server version.
- * 
+ *
  * @return string Version.
  * @throws DOMException On DOM operation error.
  */
-    public function getServerVersion()
-    {
-        return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('version');
-    }
+	public function getServerVersion()
+	{
+		return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('version');
+	}
 
 /**
  * Returns dedicated version of client.
- * 
+ *
  * @return string Version.
  * @throws DOMException On DOM operation error.
  */
-    public function getClientVersion()
-    {
-        return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('client');
-    }
+	public function getClientVersion()
+	{
+		return $this->documentElement->getElementsByTagName('serverinfo')->item(0)->getAttribute('client');
+	}
 
 /**
  * Returns owner name.
- * 
+ *
  * @return string Owner name.
  * @throws DOMException On DOM operation error.
  */
-    public function getOwner()
-    {
-        return $this->documentElement->getElementsByTagName('owner')->item(0)->getAttribute('name');
-    }
+	public function getOwner()
+	{
+		return $this->documentElement->getElementsByTagName('owner')->item(0)->getAttribute('name');
+	}
 
 /**
  * Returns owner e-mail.
- * 
+ *
  * @return string Owner e-mail.
  * @throws DOMException On DOM operation error.
  */
-    public function getEMail()
-    {
-        return $this->documentElement->getElementsByTagName('owner')->item(0)->getAttribute('email');
-    }
+	public function getEMail()
+	{
+		return $this->documentElement->getElementsByTagName('owner')->item(0)->getAttribute('email');
+	}
 
 /**
  * Returns current amount of players online.
- * 
+ *
  * @return int Count of players.
  * @throws DOMException On DOM operation error.
  */
-    public function getOnlinePlayers()
-    {
-        return (int) $this->documentElement->getElementsByTagName('players')->item(0)->getAttribute('online');
-    }
+	public function getOnlinePlayers()
+	{
+		return (int) $this->documentElement->getElementsByTagName('players')->item(0)->getAttribute('online');
+	}
 
 /**
  * Returns maximum amount of players online.
- * 
+ *
  * @return int Maximum allowed count of players.
  * @throws DOMException On DOM operation error.
  */
-    public function getMaxPlayers()
-    {
-        return (int) $this->documentElement->getElementsByTagName('players')->item(0)->getAttribute('max');
-    }
+	public function getMaxPlayers()
+	{
+		return (int) $this->documentElement->getElementsByTagName('players')->item(0)->getAttribute('max');
+	}
 
 /**
  * Returns record of online players.
- * 
+ *
  * @return int Players online record.
  * @throws DOMException On DOM operation error.
  */
-    public function getPlayersPeak()
-    {
-        return (int) $this->documentElement->getElementsByTagName('players')->item(0)->getAttribute('peak');
-    }
+	public function getPlayersPeak()
+	{
+		return (int) $this->documentElement->getElementsByTagName('players')->item(0)->getAttribute('peak');
+	}
 
 /**
  * Returns number of all monsters on map.
- * 
+ *
  * @return int Count of monsters.
  * @throws DOMException On DOM operation error.
  */
-    public function getMonstersCount()
-    {
-        return (int) $this->documentElement->getElementsByTagName('monsters')->item(0)->getAttribute('total');
-    }
+	public function getMonstersCount(): int
+	{
+		return (int) $this->documentElement->getElementsByTagName('monsters')->item(0)->getAttribute('total');
+	}
+
+	public function getNPCsCount(): int
+	{
+		return (int) $this->documentElement->getElementsByTagName('npcs')->item(0)->getAttribute('total');
+	}
 
 /**
  * Returns map name.
- * 
+ *
  * @return string Map name.
  * @throws DOMException On DOM operation error.
  */
-    public function getMapName()
-    {
-        return $this->documentElement->getElementsByTagName('map')->item(0)->getAttribute('name');
-    }
+	public function getMapName()
+	{
+		return $this->documentElement->getElementsByTagName('map')->item(0)->getAttribute('name');
+	}
 
 /**
  * Returns map author.
- * 
+ *
  * @return string Mapper name.
  * @throws DOMException On DOM operation error.
  */
-    public function getMapAuthor()
-    {
-        return $this->documentElement->getElementsByTagName('map')->item(0)->getAttribute('author');
-    }
+	public function getMapAuthor()
+	{
+		return $this->documentElement->getElementsByTagName('map')->item(0)->getAttribute('author');
+	}
 
 /**
  * Returns map width.
- * 
+ *
  * @return int Map width.
  * @throws DOMException On DOM operation error.
  */
-    public function getMapWidth()
-    {
-        return (int) $this->documentElement->getElementsByTagName('map')->item(0)->getAttribute('width');
-    }
+	public function getMapWidth()
+	{
+		return (int) $this->documentElement->getElementsByTagName('map')->item(0)->getAttribute('width');
+	}
 
 /**
  * Returns map height.
- * 
+ *
  * @return int Map height.
  * @throws DOMException On DOM operation error.
  */
-    public function getMapHeight()
-    {
-        return (int) $this->documentElement->getElementsByTagName('map')->item(0)->getAttribute('height');
-    }
+	public function getMapHeight()
+	{
+		return (int) $this->documentElement->getElementsByTagName('map')->item(0)->getAttribute('height');
+	}
 
 /**
  * Returns server's Message Of The Day
- * 
+ *
  * @version 0.1.0
  * @return string Server MOTD.
  * @throws DOMException On DOM operation error.
  */
-    public function getMOTD()
-    {
-        // look for text node child
-        foreach( $this->documentElement->getElementsByTagName('motd')->item(0)->childNodes as $child)
-        {
-            if($child->nodeType == XML_TEXT_NODE)
-            {
-                // found
-                return $child->nodeValue;
-            }
-        }
+	public function getMOTD()
+	{
+		// look for text node child
+		foreach( $this->documentElement->getElementsByTagName('motd')->item(0)->childNodes as $child)
+		{
+			if($child->nodeType == XML_TEXT_NODE)
+			{
+				// found
+				return $child->nodeValue;
+			}
+		}
 
-        // strange...
-        return '';
-    }
+		// strange...
+		return '';
+	}
 
 /**
  * Magic PHP5 method.
- * 
+ *
  * @version 0.1.0
  * @since 0.1.0
  * @param string $name Property name.
@@ -301,89 +306,89 @@ class OTS_InfoRespond extends DOMDocument
  * @throws OutOfBoundsException For non-supported properties.
  * @throws DOMException On DOM operation error.
  */
-    public function __get($name)
-    {
-        switch($name)
-        {
-            case 'tspqVersion':
-                return $this->getTSPQVersion();
+	public function __get($name)
+	{
+		switch($name)
+		{
+			case 'tspqVersion':
+				return $this->getTSPQVersion();
 
-            case 'uptime':
-                return $this->getUptime();
+			case 'uptime':
+				return $this->getUptime();
 
-            case 'ip':
-                return $this->getIP();
+			case 'ip':
+				return $this->getIP();
 
-            case 'name':
-                return $this->getName();
+			case 'name':
+				return $this->getName();
 
-            case 'port':
-                return $this->getPort();
+			case 'port':
+				return $this->getPort();
 
-            case 'location':
-                return $this->getLocation();
+			case 'location':
+				return $this->getLocation();
 
-            case 'url':
-                return $this->getURL();
+			case 'url':
+				return $this->getURL();
 
-            case 'server':
-                return $this->getServer();
+			case 'server':
+				return $this->getServer();
 
-            case 'serverVersion':
-                return $this->getServerVersion();
+			case 'serverVersion':
+				return $this->getServerVersion();
 
-            case 'clientVersion':
-                return $this->getClientVersion();
+			case 'clientVersion':
+				return $this->getClientVersion();
 
-            case 'owner':
-                return $this->getOwner();
+			case 'owner':
+				return $this->getOwner();
 
-            case 'eMail':
-                return $this->getEMail();
+			case 'eMail':
+				return $this->getEMail();
 
-            case 'onlinePlayers':
-                return $this->getOnlinePlayers();
+			case 'onlinePlayers':
+				return $this->getOnlinePlayers();
 
-            case 'maxPlayers':
-                return $this->getMaxPlayers();
+			case 'maxPlayers':
+				return $this->getMaxPlayers();
 
-            case 'playersPeak':
-                return $this->getPlayersPeak();
+			case 'playersPeak':
+				return $this->getPlayersPeak();
 
-            case 'monstersCount':
-                return $this->getMonstersCount();
+			case 'monstersCount':
+				return $this->getMonstersCount();
 
-            case 'mapName':
-                return $this->getMapName();
+			case 'mapName':
+				return $this->getMapName();
 
-            case 'mapAuthor':
-                return $this->getMapAuthor();
+			case 'mapAuthor':
+				return $this->getMapAuthor();
 
-            case 'mapWidth':
-                return $this->getMapWidth();
+			case 'mapWidth':
+				return $this->getMapWidth();
 
-            case 'mapHeight':
-                return $this->getMapHeight();
+			case 'mapHeight':
+				return $this->getMapHeight();
 
-            case 'motd':
-                return $this->getMOTD();
+			case 'motd':
+				return $this->getMOTD();
 
-            default:
-                throw new OutOfBoundsException();
-        }
-    }
+			default:
+				throw new OutOfBoundsException();
+		}
+	}
 
 /**
  * Returns string representation of XML.
- * 
+ *
  * @version 0.1.0
  * @since 0.1.0
  * @return string String representation of object.
  */
-    public function __toString()
-    {
-        return $this->saveXML();
-    }
+	public function __toString()
+	{
+		return $this->saveXML();
+	}
 }
 
 /**#@-*/

system/libs/pot/OTS_Player.php

@@ -2919,6 +2919,32 @@ class OTS_Player extends OTS_Row_DAO
 		$this->data['banned'] = $ban['active'];
 		$this->data['banned_time'] = $ban['expires'];
 	}
+
+	public function isNameLocked(): bool
+	{
+		// nothing can't be banned
+		if( !$this->isLoaded() ) {
+			throw new E_OTS_NotLoaded();
+		}
+
+		if($this->db->hasTable('player_namelocks')) {
+			$ban = $this->db->query('SELECT 1 FROM `player_namelocks` WHERE `player_id` = ' . $this->data['id'])->fetch(PDO::FETCH_ASSOC);
+			return (isset($ban['1']));
+		}
+		else if($this->db->hasTable('bans')) {
+			if($this->db->hasColumn('bans', 'active')) {
+				$ban = $this->db->query('SELECT `active`, `expires` FROM `bans` WHERE `type` = 2 AND `active` = 1 AND `value` = ' . $this->data['id'] . ' AND (`expires` > ' . time() .' OR `expires` = -1) ORDER BY `expires` DESC')->fetch();
+				return isset($ban['active']);
+			}
+			else { // tfs 0.2
+				$ban = $this->db->query('SELECT `time` FROM `bans` WHERE `type` = 2 AND `account` = ' . $this->data['account_id'] . ' AND (`time` > ' . time() .' OR `time` = -1) ORDER BY `time` DESC')->fetch();
+
+				return isset($ban['time']) && ($ban['time'] == -1 || $ban['time'] > 0);
+			}
+		}
+
+		return false;
+	}
 /**
  * Deletes player.
  *
@@ -2953,21 +2979,14 @@ class OTS_Player extends OTS_Row_DAO
  * @return string Player proffesion name.
  * @throws E_OTS_NotLoaded If player is not loaded or global vocations list is not loaded.
  */
-	public function getVocationName()
+	public function getVocationName(): string
 	{
 		if( !isset($this->data['vocation']) )
 		{
 			throw new E_OTS_NotLoaded();
 		}
 
-		global $config;
-		$voc = $this->getVocation();
-		if(!isset($config['vocations'][$voc])) {
-			return 'Unknown';
-		}
-
-		return $config['vocations'][$voc];
-		//return POT::getInstance()->getVocationsList()->getVocationName($this->data['vocation']);
+		return OTS_Toolbox::getVocationName($this->data['vocation'], $this->data['promotion'] ?? 0);
 	}
 
 /**

system/libs/pot/OTS_ServerInfo.php

@@ -26,14 +26,19 @@ class OTS_ServerInfo
  *
  * @var string
  */
-    private $server;
+	private string $server;
 
 /**
  * Connection port.
  *
  * @var int
  */
-    private $port;
+	private int $port;
+
+	/**
+	 * Status timeout
+	 */
+	private float $timeout = 2.0;
 
 /**
  * Creates handler for new server.
@@ -41,11 +46,11 @@ class OTS_ServerInfo
  * @param string $server Server IP/domain.
  * @param int $port OTServ port.
  */
-    public function __construct($server, $port)
-    {
-        $this->server = $server;
-        $this->port = $port;
-    }
+	public function __construct($server, $port)
+	{
+		$this->server = $server;
+		$this->port = $port;
+	}
 
 /**
  * Sends packet to server.
@@ -54,46 +59,46 @@ class OTS_ServerInfo
  * @return OTS_Buffer|null Respond buffer (null if server is offline).
  * @throws E_OTS_OutOfBuffer When there is read attemp after end of packet stream.
  */
-    private function send(OTS_Buffer $packet)
-    {
-        // connects to server
-        $socket = @fsockopen($this->server, $this->port, $error, $message, setting('core.status_timeout'));
+	private function send(OTS_Buffer $packet)
+	{
+		// connects to server
+		$socket = @fsockopen($this->server, $this->port, $error, $message, $this->timeout);
 
-        // if connected then checking statistics
-        if($socket)
-        {
-            // sets 5 second timeout for reading and writing
-            stream_set_timeout($socket, 5);
+		// if connected then checking statistics
+		if($socket)
+		{
+			// sets 5 second timeout for reading and writing
+			stream_set_timeout($socket, 5);
 
-            // creates real packet
-            $packet = $packet->getBuffer();
-            $packet = pack('v', strlen($packet) ) . $packet;
+			// creates real packet
+			$packet = $packet->getBuffer();
+			$packet = pack('v', strlen($packet) ) . $packet;
 
-            // sends packet with request
-            // 06 - length of packet, 255, 255 is the comamnd identifier, 'info' is a request
-            fwrite($socket, $packet);
+			// sends packet with request
+			// 06 - length of packet, 255, 255 is the comamnd identifier, 'info' is a request
+			fwrite($socket, $packet);
 
-            // reads respond
-            //$data = stream_get_contents($socket);
+			// reads respond
+			//$data = stream_get_contents($socket);
 			$data = '';
 			while (!feof($socket))
 				$data .= fgets($socket, 1024);
 
-            // closing connection to current server
-            fclose($socket);
+			// closing connection to current server
+			fclose($socket);
 
-            // sometimes server returns empty info
-            if( empty($data) )
-            {
-                // returns offline state
-                return false;
-            }
+			// sometimes server returns empty info
+			if( empty($data) )
+			{
+				// returns offline state
+				return false;
+			}
 
-            return new OTS_Buffer($data);
-        }
+			return new OTS_Buffer($data);
+		}
 
-        return false;
-    }
+		return false;
+	}
 
 /**
  * Queries server status.
@@ -108,30 +113,30 @@ class OTS_ServerInfo
  * @example examples/info.php info.php
  * @tutorial POT/Server_status.pkg
  */
-    public function status()
-    {
-        // request packet
-        $request = new OTS_Buffer();
-        $request->putChar(255);
-        $request->putChar(255);
-        $request->putString('info', false);
+	public function status()
+	{
+		// request packet
+		$request = new OTS_Buffer();
+		$request->putChar(255);
+		$request->putChar(255);
+		$request->putString('info', false);
 
-        $status = $this->send($request);
+		$status = $this->send($request);
 
-        // checks if server is online
-        if($status)
-        {
-            // loads respond XML
-            $info = new OTS_InfoRespond();
-            if(!$info->loadXML( $status->getBuffer()))
+		// checks if server is online
+		if($status)
+		{
+			// loads respond XML
+			$info = new OTS_InfoRespond();
+			if(!$info->loadXML( $status->getBuffer()))
 				return false;
 
-            return $info;
-        }
+			return $info;
+		}
 
-        // offline
-        return false;
-    }
+		// offline
+		return false;
+	}
 
 /**
  * Queries server information.
@@ -146,26 +151,26 @@ class OTS_ServerInfo
  * @example examples/server.php info.php
  * @tutorial POT/Server_status.pkg
  */
-    public function info($flags)
-    {
-        // request packet
-        $request = new OTS_Buffer();
-        $request->putChar(255);
-        $request->putChar(1);
-        $request->putShort($flags);
+	public function info($flags)
+	{
+		// request packet
+		$request = new OTS_Buffer();
+		$request->putChar(255);
+		$request->putChar(1);
+		$request->putShort($flags);
 
-        $status = $this->send($request);
+		$status = $this->send($request);
 
-        // checks if server is online
-        if($status)
-        {
-            // loads respond
-            return new OTS_ServerStatus($status);
-        }
+		// checks if server is online
+		if($status)
+		{
+			// loads respond
+			return new OTS_ServerStatus($status);
+		}
 
-        // offline
-        return false;
-    }
+		// offline
+		return false;
+	}
 
 /**
  * Checks player online status.
@@ -180,27 +185,27 @@ class OTS_ServerInfo
  * @example examples/server.php info.php
  * @tutorial POT/Server_status.pkg
  */
-    public function playerStatus($name)
-    {
-        // request packet
-        $request = new OTS_Buffer();
-        $request->putChar(255);
-        $request->putChar(1);
-        $request->putShort(OTS_ServerStatus::REQUEST_PLAYER_STATUS_INFO);
-        $request->putString($name);
+	public function playerStatus($name)
+	{
+		// request packet
+		$request = new OTS_Buffer();
+		$request->putChar(255);
+		$request->putChar(1);
+		$request->putShort(OTS_ServerStatus::REQUEST_PLAYER_STATUS_INFO);
+		$request->putString($name);
 
-        $status = $this->send($request);
+		$status = $this->send($request);
 
-        // checks if server is online
-        if($status)
-        {
-            $status->getChar();
-            return (bool) $status->getChar();
-        }
+		// checks if server is online
+		if($status)
+		{
+			$status->getChar();
+			return (bool) $status->getChar();
+		}
 
-        // offline
-        return false;
-    }
+		// offline
+		return false;
+	}
 
 /**
  * Magic PHP5 method.
@@ -210,20 +215,24 @@ class OTS_ServerInfo
  * @throws OutOfBoundsException For non-supported properties.
  * @throws E_OTS_OutOfBuffer When there is read attemp after end of packet stream.
  */
-    public function __get($name)
-    {
-        switch($name)
-        {
-            case 'status':
-                return $this->status();
+	public function __get($name)
+	{
+		switch($name)
+		{
+			case 'status':
+				return $this->status();
 
-            case 'info':
-                return $this->info(OTS_ServerStatus::REQUEST_BASIC_SERVER_INFO | OTS_ServerStatus::REQUEST_OWNER_SERVER_INFO | OTS_ServerStatus::REQUEST_MISC_SERVER_INFO | OTS_ServerStatus::REQUEST_PLAYERS_INFO | OTS_ServerStatus::REQUEST_MAP_INFO | OTS_ServerStatus::REQUEST_PLAYER_STATUS_INFO);
+			case 'info':
+				return $this->info(OTS_ServerStatus::REQUEST_BASIC_SERVER_INFO | OTS_ServerStatus::REQUEST_OWNER_SERVER_INFO | OTS_ServerStatus::REQUEST_MISC_SERVER_INFO | OTS_ServerStatus::REQUEST_PLAYERS_INFO | OTS_ServerStatus::REQUEST_MAP_INFO | OTS_ServerStatus::REQUEST_PLAYER_STATUS_INFO);
 
-            default:
-                throw new OutOfBoundsException();
-        }
-    }
+			default:
+				throw new OutOfBoundsException();
+		}
+	}
+
+	public function setTimeout($timeout) {
+		$this->timeout = $timeout;
+	}
 }
 
 /**#@-*/

system/libs/pot/OTS_ServerStatus.php

@@ -40,175 +40,175 @@ class OTS_ServerStatus
 /**
  * Basic server info.
  */
-    const REQUEST_BASIC_SERVER_INFO = 1;
+	const REQUEST_BASIC_SERVER_INFO = 1;
 /**
  * Server owner info.
  */
-    const REQUEST_OWNER_SERVER_INFO = 2;
+	const REQUEST_OWNER_SERVER_INFO = 2;
 /**
  * Server extra info.
  */
-    const REQUEST_MISC_SERVER_INFO = 4;
+	const REQUEST_MISC_SERVER_INFO = 4;
 /**
  * Players stats info.
  */
-    const REQUEST_PLAYERS_INFO = 8;
+	const REQUEST_PLAYERS_INFO = 8;
 /**
  * Map info.
  */
-    const REQUEST_MAP_INFO = 16;
+	const REQUEST_MAP_INFO = 16;
 /**
  * Extended players info.
  */
-    const REQUEST_EXT_PLAYERS_INFO = 32;
+	const REQUEST_EXT_PLAYERS_INFO = 32;
 /**
  * Player status info.
  */
-    const REQUEST_PLAYER_STATUS_INFO = 64;
+	const REQUEST_PLAYER_STATUS_INFO = 64;
 /**
  * Server software info.
  */
-    const REQUEST_SERVER_SOFTWARE_INFO = 128;
+	const REQUEST_SERVER_SOFTWARE_INFO = 128;
 /**
  * Basic server respond.
  */
-    const RESPOND_BASIC_SERVER_INFO = 0x10;
+	const RESPOND_BASIC_SERVER_INFO = 0x10;
 /**
  * Server owner respond.
  */
-    const RESPOND_OWNER_SERVER_INFO = 0x11;
+	const RESPOND_OWNER_SERVER_INFO = 0x11;
 /**
  * Server extra respond.
  */
-    const RESPOND_MISC_SERVER_INFO = 0x12;
+	const RESPOND_MISC_SERVER_INFO = 0x12;
 /**
  * Players stats respond.
  */
-    const RESPOND_PLAYERS_INFO = 0x20;
+	const RESPOND_PLAYERS_INFO = 0x20;
 /**
  * Map respond.
  */
-    const RESPOND_MAP_INFO = 0x30;
+	const RESPOND_MAP_INFO = 0x30;
 /**
  * Extended players info.
  */
-    const RESPOND_EXT_PLAYERS_INFO = 0x21;
+	const RESPOND_EXT_PLAYERS_INFO = 0x21;
 /**
  * Player status info.
  */
-    const RESPOND_PLAYER_STATUS_INFO = 0x22;
+	const RESPOND_PLAYER_STATUS_INFO = 0x22;
 /**
  * Server software info.
  */
-    const RESPOND_SERVER_SOFTWARE_INFO = 0x23;
+	const RESPOND_SERVER_SOFTWARE_INFO = 0x23;
 /**
  * Server name.
  *
  * @var string
  */
-    private $name;
+	private $name;
 /**
  * Server IP.
  *
  * @var string
  */
-    private $ip;
+	private $ip;
 /**
  * Server port.
  *
  * @var string
  */
-    private $port;
+	private $port;
 /**
  * Owner name.
  *
  * @var string
  */
-    private $owner;
+	private $owner;
 /**
  * Owner's e-mail.
  *
  * @var string
  */
-    private $eMail;
+	private $eMail;
 /**
  * Message of the day.
  *
  * @var string
  */
-    private $motd;
+	private $motd;
 /**
  * Server location.
  *
  * @var string
  */
-    private $location;
+	private $location;
 /**
  * Website URL.
  *
  * @var string
  */
-    private $url;
+	private $url;
 /**
  * Uptime.
  *
  * @var int
  */
-    private $uptime;
+	private $uptime;
 /**
  * Status version.
  *
  * @var string
  */
-    private $version;
+	private $version;
 /**
  * Players online.
  *
  * @var int
  */
-    private $online;
+	private $online;
 /**
  * Maximum players.
  *
  * @var int
  */
-    private $max;
+	private $max;
 /**
  * Players peak.
  *
  * @var int
  */
-    private $peak;
+	private $peak;
 /**
  * Map name.
  *
  * @var string
  */
-    private $map;
+	private $map;
 /**
  * Map author.
  *
  * @var string
  */
-    private $author;
+	private $author;
 /**
  * Map width.
  *
  * @var int
  */
-    private $width;
+	private $width;
 /**
  * Map height.
  *
  * @var int
  */
-    private $height;
+	private $height;
 /**
  * Players online list.
  *
  * @var array
  */
-    private $players = array();
+	private $players = array();
 
 /**
  * Server software.
@@ -224,277 +224,277 @@ class OTS_ServerStatus
  *
  * @param OTS_Buffer $info Information packet.
  */
-    public function __construct(OTS_Buffer $info)
-    {
-        // skips packet length
-        $info->getShort();
+	public function __construct(OTS_Buffer $info)
+	{
+		// skips packet length
+		$info->getShort();
 
-        while( $info->isValid() )
-        {
-            switch( $info->getChar() )
-            {
-                case self::RESPOND_BASIC_SERVER_INFO:
-                    $this->name = $info->getString();
-                    $this->ip = $info->getString();
-                    $this->port = (int) $info->getString();
-                    break;
+		while( $info->isValid() )
+		{
+			switch( $info->getChar() )
+			{
+				case self::RESPOND_BASIC_SERVER_INFO:
+					$this->name = $info->getString();
+					$this->ip = $info->getString();
+					$this->port = (int) $info->getString();
+					break;
 
-                case self::RESPOND_OWNER_SERVER_INFO:
-                    $this->owner = $info->getString();
-                    $this->eMail = $info->getString();
-                    break;
+				case self::RESPOND_OWNER_SERVER_INFO:
+					$this->owner = $info->getString();
+					$this->eMail = $info->getString();
+					break;
 
-                case self::RESPOND_MISC_SERVER_INFO:
-                    $this->motd = $info->getString();
-                    $this->location = $info->getString();
-                    $this->url = $info->getString();
+				case self::RESPOND_MISC_SERVER_INFO:
+					$this->motd = $info->getString();
+					$this->location = $info->getString();
+					$this->url = $info->getString();
 
-                    $uptime = $info->getLong() << 32;
+					$uptime = $info->getLong() << 32;
 
-                    $this->uptime += $info->getLong() + $uptime;
-                    $this->version = $info->getString();
-                    break;
+					$this->uptime += $info->getLong() + $uptime;
+					$this->version = $info->getString();
+					break;
 
-                case self::RESPOND_PLAYERS_INFO:
-                    $this->online = $info->getLong();
-                    $this->max = $info->getLong();
-                    $this->peak = $info->getLong();
-                    break;
+				case self::RESPOND_PLAYERS_INFO:
+					$this->online = $info->getLong();
+					$this->max = $info->getLong();
+					$this->peak = $info->getLong();
+					break;
 
-                case self::RESPOND_MAP_INFO:
-                    $this->map = $info->getString();
-                    $this->author = $info->getString();
-                    $this->width = $info->getShort();
-                    $this->height = $info->getShort();
-                    break;
+				case self::RESPOND_MAP_INFO:
+					$this->map = $info->getString();
+					$this->author = $info->getString();
+					$this->width = $info->getShort();
+					$this->height = $info->getShort();
+					break;
 
-                case self::RESPOND_EXT_PLAYERS_INFO:
-                    $count = $info->getLong();
+				case self::RESPOND_EXT_PLAYERS_INFO:
+					$count = $info->getLong();
 
-                    for($i = 0; $i < $count; $i++)
-                    {
-                        $name = $info->getString();
-                        $this->players[$name] = $info->getLong();
-                    }
-                    break;
+					for($i = 0; $i < $count; $i++)
+					{
+						$name = $info->getString();
+						$this->players[$name] = $info->getLong();
+					}
+					break;
 
 				case self::RESPOND_SERVER_SOFTWARE_INFO:
 					$this->softwareName = $info->getString();
 					$this->softwareVersion = $info->getString();
 					$this->softwareProtocol = $info->getString();
 					break;
-            }
-        }
-    }
+			}
+		}
+	}
 
 /**
  * Returns server uptime.
  *
  * @return int Uptime.
  */
-    public function getUptime()
-    {
-        return $this->uptime;
-    }
+	public function getUptime()
+	{
+		return $this->uptime;
+	}
 
 /**
  * Returns server IP.
  *
  * @return string IP.
  */
-    public function getIP()
-    {
-        return $this->ip;
-    }
+	public function getIP()
+	{
+		return $this->ip;
+	}
 
 /**
  * Returns server name.
  *
  * @return string Name.
  */
-    public function getName()
-    {
-        return $this->name;
-    }
+	public function getName()
+	{
+		return $this->name;
+	}
 
 /**
  * Returns server port.
  *
  * @return int Port.
  */
-    public function getPort()
-    {
-        return $this->port;
-    }
+	public function getPort()
+	{
+		return $this->port;
+	}
 
 /**
  * Returns server location.
  *
  * @return string Location.
  */
-    public function getLocation()
-    {
-        return $this->location;
-    }
+	public function getLocation()
+	{
+		return $this->location;
+	}
 
 /**
  * Returns server website.
  *
  * @return string Website URL.
  */
-    public function getURL()
-    {
-        return $this->url;
-    }
+	public function getURL()
+	{
+		return $this->url;
+	}
 
 /**
  * Returns server version.
  *
  * @return string Version.
  */
-    public function getServerVersion()
-    {
-        return $this->version;
-    }
+	public function getServerVersion()
+	{
+		return $this->version;
+	}
 
 /**
  * Returns owner name.
  *
  * @return string Owner name.
  */
-    public function getOwner()
-    {
-        return $this->owner;
-    }
+	public function getOwner()
+	{
+		return $this->owner;
+	}
 
 /**
  * Returns owner e-mail.
  *
  * @return string Owner e-mail.
  */
-    public function getEMail()
-    {
-        return $this->eMail;
-    }
+	public function getEMail()
+	{
+		return $this->eMail;
+	}
 
 /**
  * Returns current amount of players online.
  *
  * @return int Count of players.
  */
-    public function getOnlinePlayers()
-    {
-        return $this->online;
-    }
+	public function getOnlinePlayers()
+	{
+		return $this->online;
+	}
 
 /**
  * Returns maximum amount of players online.
  *
  * @return int Maximum allowed count of players.
  */
-    public function getMaxPlayers()
-    {
-        return $this->max;
-    }
+	public function getMaxPlayers()
+	{
+		return $this->max;
+	}
 
 /**
  * Returns record of online players.
  *
  * @return int Players online record.
  */
-    public function getPlayersPeak()
-    {
-        return $this->peak;
-    }
+	public function getPlayersPeak()
+	{
+		return $this->peak;
+	}
 
 /**
  * Returns map name.
  *
  * @return string Map name.
  */
-    public function getMapName()
-    {
-        return $this->map;
-    }
+	public function getMapName()
+	{
+		return $this->map;
+	}
 
 /**
  * Returns map author.
  *
  * @return string Mapper name.
  */
-    public function getMapAuthor()
-    {
-        return $this->author;
-    }
+	public function getMapAuthor()
+	{
+		return $this->author;
+	}
 
 /**
  * Returns map width.
  *
  * @return int Map width.
  */
-    public function getMapWidth()
-    {
-        return $this->width;
-    }
+	public function getMapWidth()
+	{
+		return $this->width;
+	}
 
 /**
  * Returns map height.
  *
  * @return int Map height.
  */
-    public function getMapHeight()
-    {
-        return $this->height;
-    }
+	public function getMapHeight()
+	{
+		return $this->height;
+	}
 
 /**
  * Returns server's Message Of The Day
  *
  * @return string Server MOTD.
  */
-    public function getMOTD()
-    {
-        return $this->motd;
-    }
+	public function getMOTD()
+	{
+		return $this->motd;
+	}
 
 /**
  * Returns list of players currently online.
  *
  * @return array List of players in format 'name' => level.
  */
-    public function getPlayers()
-    {
-    }
+	public function getPlayers()
+	{
+	}
 
 /**
  * Returns software name.
  *
  * @return string Software name.
  */
-    public function getSoftwareName()
-    {
-        return $this->softwareName;
-    }
+	public function getSoftwareName()
+	{
+		return $this->softwareName;
+	}
 
 /**
  * Returns software version.
  *
  * @return string Software version.
  */
-    public function getSoftwareVersion()
-    {
-        return $this->softwareVersion;
-    }
+	public function getSoftwareVersion()
+	{
+		return $this->softwareVersion;
+	}
 
 /**
  * Returns software protocol.
  *
  * @return string Software protocol.
  */
-    public function getSoftwareProtocol()
-    {
-        return $this->softwareProtocol;
-    }
+	public function getSoftwareProtocol()
+	{
+		return $this->softwareProtocol;
+	}
 
 /**
  * Magic PHP5 method.
@@ -503,68 +503,68 @@ class OTS_ServerStatus
  * @return mixed Property value.
  * @throws OutOfBoundsException For non-supported properties.
  */
-    public function __get($name)
-    {
-        switch($name)
-        {
-            case 'uptime':
-                return $this->getUptime();
+	public function __get($name)
+	{
+		switch($name)
+		{
+			case 'uptime':
+				return $this->getUptime();
 
-            case 'ip':
-                return $this->getIP();
+			case 'ip':
+				return $this->getIP();
 
-            case 'name':
-                return $this->getName();
+			case 'name':
+				return $this->getName();
 
-            case 'port':
-                return $this->getPort();
+			case 'port':
+				return $this->getPort();
 
-            case 'location':
-                return $this->getLocation();
+			case 'location':
+				return $this->getLocation();
 
-            case 'url':
-                return $this->getURL();
+			case 'url':
+				return $this->getURL();
 
-            case 'serverVersion':
-                return $this->getServerVersion();
+			case 'serverVersion':
+				return $this->getServerVersion();
 
-            case 'owner':
-                return $this->getOwner();
+			case 'owner':
+				return $this->getOwner();
 
-            case 'eMail':
-                return $this->getEMail();
+			case 'eMail':
+				return $this->getEMail();
 
-            case 'onlinePlayers':
-                return $this->getOnlinePlayers();
+			case 'onlinePlayers':
+				return $this->getOnlinePlayers();
 
-            case 'maxPlayers':
-                return $this->getMaxPlayers();
+			case 'maxPlayers':
+				return $this->getMaxPlayers();
 
-            case 'playersPeak':
-                return $this->getPlayersPeak();
+			case 'playersPeak':
+				return $this->getPlayersPeak();
 
-            case 'mapName':
-                return $this->getMapName();
+			case 'mapName':
+				return $this->getMapName();
 
-            case 'mapAuthor':
-                return $this->getMapAuthor();
+			case 'mapAuthor':
+				return $this->getMapAuthor();
 
-            case 'mapWidth':
-                return $this->getMapWidth();
+			case 'mapWidth':
+				return $this->getMapWidth();
 
-            case 'mapHeight':
-                return $this->getMapHeight();
+			case 'mapHeight':
+				return $this->getMapHeight();
 
-            case 'motd':
-                return $this->getMOTD();
+			case 'motd':
+				return $this->getMOTD();
 
-            case 'players':
-                return $this->getPlayers();
+			case 'players':
+				return $this->getPlayers();
 
-            default:
-                throw new OutOfBoundsException();
-        }
-    }
+			default:
+				throw new OutOfBoundsException();
+		}
+	}
 }
 
 /**#@-*/

system/libs/pot/OTS_Toolbox.php

@@ -15,7 +15,7 @@
 
 /**
  * Toolbox for common operations.
- * 
+ *
  * @package POT
  * @version 0.1.5
  */
@@ -23,41 +23,41 @@ class OTS_Toolbox
 {
 /**
  * Calculates experience points needed for given level.
- * 
+ *
  * @param int $level Level for which experience should be calculated.
  * @param int $experience Current experience points.
  * @return int Experience points for level.
  */
 	public static function experienceForLevel($level, $experience = 0)
-    {
-        //return 50 * ($level - 1) * ($level * $level - 5 * $level + 12) / 3 - $experience;
+	{
+		//return 50 * ($level - 1) * ($level * $level - 5 * $level + 12) / 3 - $experience;
 		$level = $level - 1;
 		return ((50 * $level * $level * $level) - (150 * $level * $level) + (400 * $level)) / 3;
-    }
+	}
 
 /**
  * Finds out which level user have basing on his/her experience.
- * 
+ *
  * <p>
  * PHP doesn't support complex numbers natively so solving third-level polynomials would be quite hard. Rather then doing this, this method iterates calculating experience for next levels until it finds one which requires enought experience we have. Because of that, for high experience values this function can take relatively long time to be executed.
  * </p>
- * 
+ *
  * @param int $experience Current experience points.
  * @return int Experience level.
  */
-    public static function levelForExperience($experience)
-    {
-        // default level
-        $level = 1;
+	public static function levelForExperience($experience)
+	{
+		// default level
+		$level = 1;
 
-        // until we will find level which requires more experience then we have we will step to next
-        while( self::experienceForLevel($level + 1) <= $experience)
-        {
-            $level++;
-        }
+		// until we will find level which requires more experience then we have we will step to next
+		while( self::experienceForLevel($level + 1) <= $experience)
+		{
+			$level++;
+		}
 
-        return $level;
-    }
+		return $level;
+	}
 
 /**
  * @version 0.1.5
@@ -65,25 +65,25 @@ class OTS_Toolbox
  * @return OTS_Players_List Filtered list.
  * @deprecated 0.1.5 Use OTS_PlayerBans_List.
  */
-    public static function bannedPlayers()
-    {
-        // creates filter
-        $filter = new OTS_SQLFilter();
-        $filter->addFilter( new OTS_SQLField('type', 'bans'), POT::BAN_PLAYER);
-        $filter->addFilter( new OTS_SQLField('active', 'bans'), 1);
-        $filter->addFilter( new OTS_SQLField('value', 'bans'), new OTS_SQLField('id', 'players') );
+	public static function bannedPlayers()
+	{
+		// creates filter
+		$filter = new OTS_SQLFilter();
+		$filter->addFilter( new OTS_SQLField('type', 'bans'), POT::BAN_PLAYER);
+		$filter->addFilter( new OTS_SQLField('active', 'bans'), 1);
+		$filter->addFilter( new OTS_SQLField('value', 'bans'), new OTS_SQLField('id', 'players') );
 
-        // selects only active bans
-        $actives = new OTS_SQLFilter();
-        $actives->addFilter( new OTS_SQLField('expires', 'bans'), 0);
-        $actives->addFilter( new OTS_SQLField('time', 'bans'), time(), OTS_SQLFilter::OPERATOR_GREATER, OTS_SQLFilter::CRITERIUM_OR);
-        $filter->addFilter($actives);
+		// selects only active bans
+		$actives = new OTS_SQLFilter();
+		$actives->addFilter( new OTS_SQLField('expires', 'bans'), 0);
+		$actives->addFilter( new OTS_SQLField('time', 'bans'), time(), OTS_SQLFilter::OPERATOR_GREATER, OTS_SQLFilter::CRITERIUM_OR);
+		$filter->addFilter($actives);
 
-        // creates list and aplies filter
-        $list = new OTS_Players_List();
-        $list->setFilter($filter);
-        return $list;
-    }
+		// creates list and aplies filter
+		$list = new OTS_Players_List();
+		$list->setFilter($filter);
+		return $list;
+	}
 
 /**
  * @version 0.1.5
@@ -91,25 +91,34 @@ class OTS_Toolbox
  * @return OTS_Accounts_List Filtered list.
  * @deprecated 0.1.5 Use OTS_AccountBans_List.
  */
-    public static function bannedAccounts()
-    {
-        // creates filter
-        $filter = new OTS_SQLFilter();
-        $filter->addFilter( new OTS_SQLField('type', 'bans'), POT::BAN_ACCOUNT);
-        $filter->addFilter( new OTS_SQLField('active', 'bans'), 1);
-        $filter->addFilter( new OTS_SQLField('value', 'bans'), new OTS_SQLField('id', 'accounts') );
+	public static function bannedAccounts()
+	{
+		// creates filter
+		$filter = new OTS_SQLFilter();
+		$filter->addFilter( new OTS_SQLField('type', 'bans'), POT::BAN_ACCOUNT);
+		$filter->addFilter( new OTS_SQLField('active', 'bans'), 1);
+		$filter->addFilter( new OTS_SQLField('value', 'bans'), new OTS_SQLField('id', 'accounts') );
 
-        // selects only active bans
-        $actives = new OTS_SQLFilter();
-        $actives->addFilter( new OTS_SQLField('expires', 'bans'), 0);
-        $actives->addFilter( new OTS_SQLField('time', 'bans'), time(), OTS_SQLFilter::OPERATOR_GREATER, OTS_SQLFilter::CRITERIUM_OR);
-        $filter->addFilter($actives);
+		// selects only active bans
+		$actives = new OTS_SQLFilter();
+		$actives->addFilter( new OTS_SQLField('expires', 'bans'), 0);
+		$actives->addFilter( new OTS_SQLField('time', 'bans'), time(), OTS_SQLFilter::OPERATOR_GREATER, OTS_SQLFilter::CRITERIUM_OR);
+		$filter->addFilter($actives);
 
-        // creates list and aplies filter
-        $list = new OTS_Accounts_List();
-        $list->setFilter($filter);
-        return $list;
-    }
+		// creates list and aplies filter
+		$list = new OTS_Accounts_List();
+		$list->setFilter($filter);
+		return $list;
+	}
+
+	public static function getVocationName($id, $promotion = 0): string
+	{
+		if($promotion > 0) {
+			$id = ($id + ($promotion * config('vocations_amount')));
+		}
+
+		return config('vocations')[$id] ?? 'Unknown';
+	}
 }
 
 /**#@-*/

system/locale/de/install.php

@@ -48,6 +48,8 @@ $locale['step_config'] = 'Konfiguration';
 $locale['step_config_title'] = 'Grundkonfiguration';
 $locale['step_config_server_path'] = 'Serverpfad';
 $locale['step_config_server_path_desc'] = 'Pfad zu Ihrem TFS-Hauptverzeichnis, in dem sich die config.lua befinden.';
+$locale['step_config_site_url'] = 'Website URL';
+$locale['step_config_site_url_desc'] = 'Ihre Website-Adresse.';
 $locale['step_config_mail_admin'] = 'Admin E-Mail';
 $locale['step_config_mail_admin_desc'] = 'Adresse, an die E-Mails aus dem Kontaktformular gesendet werden, z. B. admin@gmail.com';
 $locale['step_config_mail_admin_error'] = 'Admin E-Mail ist nicht korrekt.';

system/locale/en/install.php

@@ -52,6 +52,8 @@ $locale['step_config'] = 'Configuration';
 $locale['step_config_title'] = 'Basic configuration';
 $locale['step_config_server_path'] = 'Server path';
 $locale['step_config_server_path_desc'] = 'Path to your TFS main directory, where you have config.lua located.';
+$locale['step_config_site_url'] = 'Website URL';
+$locale['step_config_site_url_desc'] = 'Your website address.';
 $locale['step_config_mail_admin'] = 'Admin Email';
 $locale['step_config_mail_admin_desc'] = 'Address where emails from contact form will be delivered, for example admin@gmail.com';
 $locale['step_config_mail_admin_error'] = 'Admin Email is not correct.';

system/locale/pl/install.php

@@ -52,6 +52,8 @@ $locale['step_config'] = 'Konfiguracja';
 $locale['step_config_title'] = 'Podstawowa konfiguracja';
 $locale['step_config_server_path'] = 'Ścieżka do serwera';
 $locale['step_config_server_path_desc'] = 'Ścieżka do Twojego folderu z TFS, gdzie znajduje się plik config.lua.';
+$locale['step_config_server_url'] = 'Adres strony';
+$locale['step_config_server_url_desc'] = 'Adres tej strony www.';
 $locale['step_config_mail_admin'] = 'E-Mail admina';
 $locale['step_config_mail_admin_desc'] = 'Na ten adres będą dostarczane E-Maile z formularza kontaktowego, przykładowo admin@gmail.com';
 $locale['step_config_mail_admin_error'] = 'E-Mail admina jest niepoprawny.';

system/pages/404.php

@@ -8,7 +8,7 @@
  * @link      https://my-aac.org
  */
 defined('MYAAC') or die('Direct access not allowed!');
-$title = '404 Not Found';
+$title = 'Not Found';
 
 header('HTTP/1.0 404 Not Found');
 ?>

system/pages/405.php

@@ -8,7 +8,7 @@
  * @link      https://my-aac.org
  */
 defined('MYAAC') or die('Direct access not allowed!');
-$title = '405 Method Not Allowed';
+$title = 'Method Not Allowed';
 
 header('HTTP/1.0 405 Method Not Allowed');
 ?>

system/pages/account/change-email.php

@@ -17,6 +17,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 $email_new_time = $account_logged->getCustomField("email_new_time");
 
 if($email_new_time > 10) {
@@ -164,7 +166,7 @@ if(isset($_POST['emailchangecancel']) && $_POST['emailchangecancel'] == 1) {
 	$account_logged->setCustomField("email_new", "");
 	$account_logged->setCustomField("email_new_time", 0);
 
-	$custom_buttons = '<div style="text-align:center"><table border="0" cellspacing="0" cellpadding="0" ><form action="' . getLink('account/manage') . '" method="post" ><tr><td style="border:0px;" >' . $twig->render('buttons.back.html.twig') . '</td></tr></form></table></div>';
+	$custom_buttons = '<div style="text-align:center"><table border="0" cellspacing="0" cellpadding="0" ><form action="' . getLink('account/manage') . '" method="post" >' . csrf(true) . '<tr><td style="border:0px;" >' . $twig->render('buttons.back.html.twig') . '</td></tr></form></table></div>';
 
 	$twig->display('success.html.twig', array(
 		'title' => 'Email Address Change Cancelled',

system/pages/account/change-info.php

@@ -20,6 +20,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 if(setting('core.account_country'))
 	require SYSTEM . 'countries.conf.php';
 

system/pages/account/change-password.php

@@ -17,6 +17,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 $new_password = $_POST['newpassword'] ?? NULL;
 $new_password_confirm = $_POST['newpassword_confirm'] ?? NULL;
 $old_password = $_POST['oldpassword'] ?? NULL;

system/pages/account/characters/change-comment.php

@@ -20,6 +20,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 $player = null;
 $player_name = isset($_REQUEST['name']) ? stripslashes(urldecode($_REQUEST['name'])) : null;
 $new_comment = isset($_POST['comment']) ? htmlspecialchars(stripslashes(substr($_POST['comment'],0,2000))) : NULL;

system/pages/account/characters/change-name.php

@@ -17,6 +17,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 $player_id = isset($_POST['player_id']) ? (int)$_POST['player_id'] : NULL;
 $name = isset($_POST['name']) ? stripslashes(ucwords(strtolower($_POST['name']))) : NULL;
 if((!setting('core.account_change_character_name')))

system/pages/account/characters/change-sex.php

@@ -17,6 +17,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 $sex_changed = false;
 $player_id = isset($_POST['player_id']) ? (int)$_POST['player_id'] : NULL;
 $new_sex = isset($_POST['new_sex']) ? (int)$_POST['new_sex'] : NULL;

system/pages/account/characters/create.php

@@ -20,6 +20,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 $character_name = isset($_POST['name']) ? stripslashes($_POST['name']) : null;
 $character_sex = isset($_POST['sex']) ? (int)$_POST['sex'] : null;
 $character_vocation = isset($_POST['vocation']) ? (int)$_POST['vocation'] : null;

system/pages/account/characters/delete.php

@@ -17,6 +17,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 $player_name = isset($_POST['delete_name']) ? stripslashes($_POST['delete_name']) : null;
 $password_verify = isset($_POST['delete_password']) ? $_POST['delete_password'] : null;
 $password_verify = encrypt((USE_ACCOUNT_SALT ? $account_logged->getCustomField('salt') : '') . $password_verify);

system/pages/account/create.php

@@ -23,6 +23,8 @@ if($logged)
 	return;
 }
 
+csrfProtect();
+
 if(setting('core.account_create_character_create')) {
 	$createCharacter = new CreateCharacter();
 }
@@ -219,8 +221,14 @@ if($save)
 			}
 		}
 
-		if(setting('core.account_premium_points') && setting('core.account_premium_points') > 0) {
-			$new_account->setCustomField('premium_points', setting('core.account_premium_points'));
+		$accountDefaultPremiumPoints = setting('core.account_premium_points');
+		if($accountDefaultPremiumPoints > 0) {
+			$new_account->setCustomField('premium_points', $accountDefaultPremiumPoints);
+		}
+
+		$accountDefaultCoins = setting('core.account_coins');
+		if($db->hasColumn('accounts', 'coins') && $accountDefaultCoins > 0) {
+			$new_account->setCustomField('coins', $accountDefaultCoins);
 		}
 
 		$tmp_account = $email;

system/pages/account/login.php

@@ -18,6 +18,8 @@ if($logged || !isset($_POST['account_login']) || !isset($_POST['password_login']
 	return;
 }
 
+csrfProtect();
+
 $login_account = $_POST['account_login'];
 $login_password = $_POST['password_login'];
 $remember_me = isset($_POST['remember_me']);
@@ -95,3 +97,8 @@ else {
 }
 
 $hooks->trigger(HOOK_ACCOUNT_LOGIN_POST);
+
+if($logged) {
+	$twig->addGlobal('logged', true);
+	$twig->addGlobal('account_logged', $account_logged);
+}

system/pages/account/manage.php

@@ -34,6 +34,8 @@ if(isset($_REQUEST['redirect']))
 	return;
 }
 
+csrfProtect();
+
 $groups = new OTS_Groups_List();
 
 $freePremium = isset($config['lua']['freePremium']) && getBoolean($config['lua']['freePremium']) || $account_logged->getPremDays() == OTS_Account::GRATIS_PREMIUM_DAYS;

system/pages/account/redirect.php

@@ -1,23 +0,0 @@
-<?php
-/**
- * Change comment
- *
- * @package   MyAAC
- * @author    Gesior <jerzyskalski@wp.pl>
- * @author    Slawkens <slawkens@gmail.com>
- * @copyright 2019 MyAAC
- * @link      https://my-aac.org
- */
-defined('MYAAC') or die('Direct access not allowed!');
-
-$redirect = urldecode($_REQUEST['redirect']);
-
-// should never happen, unless hacker modify the URL
-if (!str_contains($redirect, BASE_URL)) {
-	error('Fatal error: Cannot redirect outside the website.');
-	return;
-}
-
-$twig->display('account.redirect.html.twig', array(
-	'redirect' => $redirect
-));

system/pages/account/register-new.php

@@ -17,6 +17,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 if(isset($_POST['reg_password']))
 	$reg_password = encrypt((USE_ACCOUNT_SALT ? $account_logged->getCustomField('salt') : '') . $_POST['reg_password']);
 

system/pages/account/register.php

@@ -17,6 +17,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 $_POST['reg_password'] = $_POST['reg_password'] ?? '';
 $reg_password = encrypt((USE_ACCOUNT_SALT ? $account_logged->getCustomField('salt') : '') . $_POST['reg_password']);
 $old_key = $account_logged->getCustomField("key");

system/pages/forum/admin.php

@@ -17,6 +17,8 @@ if(!$canEdit) {
 	return;
 }
 
+csrfProtect();
+
 $groupsList = new OTS_Groups_List();
 $groups = [
 	['id' => 0, 'name' => 'Guest'],
@@ -30,23 +32,24 @@ foreach ($groupsList as $group) {
 }
 
 if(!empty($action)) {
-	if($action == 'delete_board' || $action == 'edit_board' || $action == 'hide_board' || $action == 'moveup_board' || $action == 'movedown_board')
+	if($action == 'delete_board' || $action == 'edit_board' || $action == 'hide_board' || $action == 'moveup_board' || $action == 'movedown_board') {
 		$id = $_REQUEST['id'];
-
-	if(isset($_REQUEST['access'])) {
-		$access = $_REQUEST['access'];
 	}
 
-	if(isset($_REQUEST['guild'])) {
-		$guild = $_REQUEST['guild'];
+	if(isset($_POST['access'])) {
+		$access = $_POST['access'];
 	}
 
-	if(isset($_REQUEST['name'])) {
-		$name = $_REQUEST['name'];
+	if(isset($_POST['guild'])) {
+		$guild = $_POST['guild'];
 	}
 
-	if(isset($_REQUEST['description'])) {
-		$description = stripslashes($_REQUEST['description']);
+	if(isset($_POST['name'])) {
+		$name = $_POST['name'];
+	}
+
+	if(isset($_POST['description'])) {
+		$description = stripslashes($_POST['description']);
 	}
 
 	$errors = [];
@@ -55,12 +58,13 @@ if(!empty($action)) {
 		if(Forum::add_board($name, $description, $access, $guild, $errors)) {
 			$action = $name = $description = '';
 			header('Location: ' . getLink('forum'));
+			exit;
 		}
 	}
 	else if($action == 'delete_board') {
 		Forum::delete_board($id, $errors);
 		header('Location: ' . getLink('forum'));
-		$action = '';
+		exit;
 	}
 	else if($action == 'edit_board')
 	{
@@ -74,28 +78,27 @@ if(!empty($action)) {
 		else {
 			Forum::update_board($id, $name, $access, $guild, $description);
 			header('Location: ' . getLink('forum'));
-			$action = $name = $description = '';
-			$access = $guild = 0;
+			exit;
 		}
 	}
 	else if($action == 'hide_board') {
 		Forum::toggleHide_board($id, $errors);
 		header('Location: ' . getLink('forum'));
-		$action = '';
+		exit;
 	}
 	else if($action == 'moveup_board') {
 		Forum::move_board($id, -1, $errors);
 		header('Location: ' . getLink('forum'));
-		$action = '';
+		exit;
 	}
 	else if($action == 'movedown_board') {
 		Forum::move_board($id, 1, $errors);
 		header('Location: ' . getLink('forum'));
-		$action = '';
+		exit;
 	}
 
 	if(!empty($errors)) {
-		$twig->display('error_box.html.twig', array('errors' => $errors));
+		$twig->display('error_box.html.twig', ['errors' => $errors]);
 		$action = '';
 	}
 }

system/pages/forum/edit_post.php

@@ -23,8 +23,9 @@ if(!$logged) {
 	return;
 }
 
-if(Forum::canPost($account_logged))
-{
+csrfProtect();
+
+if(Forum::canPost($account_logged)) {
 	$post_id = isset($_REQUEST['id']) ? (int) $_REQUEST['id'] : false;
 	if(!$post_id) {
 		$errors[] = 'Please enter post id.';
@@ -41,12 +42,12 @@ if(Forum::canPost($account_logged))
 			$char_id = $post_topic = $text = $smile = $html = null;
 			$players_from_account = $db->query("SELECT `players`.`name`, `players`.`id` FROM `players` WHERE `players`.`account_id` = ".(int) $account_logged->getId())->fetchAll();
 			$saved = false;
-			if(isset($_REQUEST['save'])) {
-				$text = stripslashes(trim($_REQUEST['text']));
-				$char_id = (int) $_REQUEST['char_id'];
-				$post_topic = stripslashes(trim($_REQUEST['topic']));
-				$smile = isset($_REQUEST['smile']) ? (int)$_REQUEST['smile'] : 0;
-				$html = isset($_REQUEST['html']) ? (int)$_REQUEST['html'] : 0;
+			if(isset($_POST['save'])) {
+				$text = stripslashes(trim($_POST['text']));
+				$char_id = (int) $_POST['char_id'];
+				$post_topic = stripslashes(trim($_POST['topic']));
+				$smile = isset($_POST['smile']) ? (int)$_POST['smile'] : 0;
+				$html = isset($_POST['html']) ? (int)$_POST['html'] : 0;
 
 				if (!superAdmin()) {
 					$html = 0;

system/pages/forum/move_thread.php

@@ -23,15 +23,17 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 if(!Forum::isModerator()) {
 	echo 'You are not logged in or you are not moderator.';
 	return;
 }
 
-$save = isset($_REQUEST['save']) && (int)$_REQUEST['save'] == 1;
+$save = isset($_POST['save']) && (int)$_POST['save'] == 1;
 if($save) {
-	$post_id = (int)$_REQUEST['id'];
-	$board = (int)$_REQUEST['section'];
+	$post_id = (int)$_POST['id'];
+	$board = (int)$_POST['section'];
 	if(!Forum::hasAccess($board)) {
 		$errors[] = "You don't have access to this board.";
 		displayErrorBoxWithBackButton($errors, getLink('forum'));

system/pages/forum/new_post.php

@@ -28,6 +28,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 if(Forum::canPost($account_logged)) {
 	$players_from_account = $db->query("SELECT `players`.`name`, `players`.`id` FROM `players` WHERE `players`.`account_id` = ".(int) $account_logged->getId())->fetchAll();
 	$thread_id = isset($_REQUEST['thread_id']) ? (int) $_REQUEST['thread_id'] : 0;
@@ -43,11 +45,11 @@ if(Forum::canPost($account_logged)) {
 		echo '<a href="' . getLink('forum') . '">Boards</a> >> <a href="' . getForumBoardLink($thread['section']) . '">'.$sections[$thread['section']]['name'].'</a> >> <a href="' . getForumThreadLink($thread_id) . '">'.htmlspecialchars($thread['post_topic']).'</a> >> <b>Post new reply</b><br /><h3>'.htmlspecialchars($thread['post_topic']).'</h3>';
 
 		$quote = isset($_REQUEST['quote']) ? (int) $_REQUEST['quote'] : NULL;
-		$text = isset($_REQUEST['text']) ? stripslashes(trim($_REQUEST['text'])) : NULL;
-		$char_id = (int) ($_REQUEST['char_id'] ?? 0);
-		$post_topic = isset($_REQUEST['topic']) ? stripslashes(trim($_REQUEST['topic'])) : '';
-		$smile = (int)($_REQUEST['smile'] ?? 0);
-		$html = (int)($_REQUEST['html'] ?? 0);
+		$text = isset($_POST['text']) ? stripslashes(trim($_POST['text'])) : NULL;
+		$char_id = (int) ($_POST['char_id'] ?? 0);
+		$post_topic = isset($_POST['topic']) ? stripslashes(trim($_POST['topic'])) : '';
+		$smile = (int)($_POST['smile'] ?? 0);
+		$html = (int)($_POST['html'] ?? 0);
 		$saved = false;
 
 		if (!superAdmin()) {
@@ -60,10 +62,10 @@ if(Forum::canPost($account_logged)) {
 				$text = '[i]Originally posted by ' . $quoted_post[0]['name'] . ' on ' . date('d.m.y H:i:s', $quoted_post[0]['post_date']) . ':[/i][quote]' . $quoted_post[0]['post_text'] . '[/quote]';
 			}
 		}
-		elseif(isset($_REQUEST['save'])) {
+		elseif(isset($_POST['save'])) {
 			$length = strlen($text);
 			if($length < 1 || strlen($text) > 15000) {
-				$errors[] = 'Too short or too long post (Length: $length letters). Minimum 1 letter, maximum 15000 letters.';
+				$errors[] = "Too short or too long post (Length: $length letters). Minimum 1 letter, maximum 15000 letters.";
 			}
 
 			if($char_id == 0) {
@@ -79,15 +81,14 @@ if(Forum::canPost($account_logged)) {
 				}
 
 				if(!$player_on_account) {
-					$errors[] = 'Player with selected ID ' . $char_id . ' doesn\'t exist or isn\'t on your account';
+					$errors[] = "Player with selected ID $char_id doesn't exist or isn't on your account";
 				}
 			}
 
 			if(count($errors) == 0) {
 				$last_post = 0;
 				$query = $db->query('SELECT post_date FROM ' . FORUM_TABLE_PREFIX . 'forum ORDER BY post_date DESC LIMIT 1');
-				if($query->rowCount() > 0)
-				{
+				if($query->rowCount() > 0) {
 					$query = $query->fetch();
 					$last_post = $query['post_date'];
 				}

system/pages/forum/new_thread.php

@@ -28,6 +28,8 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 if(Forum::canPost($account_logged)) {
 	$players_from_account = $db->query('SELECT `players`.`name`, `players`.`id` FROM `players` WHERE `players`.`account_id` = '.(int) $account_logged->getId())->fetchAll();
 	$section_id = $_REQUEST['section_id'] ?? null;
@@ -38,19 +40,18 @@ if(Forum::canPost($account_logged)) {
 			if ($sections[$section_id]['closed'] && !Forum::isModerator())
 				$errors[] = 'You cannot create topic on this board.';
 
-			$quote = (int)(isset($_REQUEST['quote']) ? $_REQUEST['quote'] : 0);
-			$text = isset($_REQUEST['text']) ? stripslashes($_REQUEST['text']) : '';
-			$char_id = (int)(isset($_REQUEST['char_id']) ? $_REQUEST['char_id'] : 0);
-			$post_topic = isset($_REQUEST['topic']) ? stripslashes($_REQUEST['topic']) : '';
-			$smile = (isset($_REQUEST['smile']) ? (int)$_REQUEST['smile'] : 0);
-			$html = (isset($_REQUEST['html']) ? (int)$_REQUEST['html'] : 0);
+			$text = isset($_POST['text']) ? stripslashes($_POST['text']) : '';
+			$char_id = (int)(isset($_POST['char_id']) ? $_POST['char_id'] : 0);
+			$post_topic = isset($_POST['topic']) ? stripslashes($_POST['topic']) : '';
+			$smile = (isset($_POST['smile']) ? (int)$_POST['smile'] : 0);
+			$html = (isset($_POST['html']) ? (int)$_POST['html'] : 0);
 
 			if (!superAdmin()) {
 				$html = 0;
 			}
 
 			$saved = false;
-			if (isset($_REQUEST['save'])) {
+			if (isset($_POST['save'])) {
 				$length = strlen($post_topic);
 				if ($length < 1 || $length > 60) {
 					$errors[] = "Too short or too long topic (Length: $length letters). Minimum 1 letter, maximum 60 letters.";

system/pages/forum/remove_post.php

@@ -23,11 +23,13 @@ if(!$logged) {
 	return;
 }
 
+csrfProtect();
+
 if(Forum::isModerator()) {
-	$id = (int) $_REQUEST['id'];
+	$id = (int) ($_POST['id'] ?? 0);
 	$post = $db->query("SELECT `id`, `first_post`, `section` FROM `" . FORUM_TABLE_PREFIX . "forum` WHERE `id` = ".$id." LIMIT 1")->fetch();
 
-	if($post['id'] == $id && Forum::hasAccess($post['section'])) {
+	if($post && $post['id'] == $id && Forum::hasAccess($post['section'])) {
 		if($post['id'] == $post['first_post']) {
 			$db->query("DELETE FROM `" . FORUM_TABLE_PREFIX . "forum` WHERE `first_post` = ".$post['id']);
 			header('Location: ' . getForumBoardLink($post['section']));
@@ -36,7 +38,7 @@ if(Forum::isModerator()) {
 			$post_page = $db->query("SELECT COUNT(`" . FORUM_TABLE_PREFIX . "forum`.`id`) AS posts_count FROM `players`, `" . FORUM_TABLE_PREFIX . "forum` WHERE `players`.`id` = `" . FORUM_TABLE_PREFIX . "forum`.`author_guid` AND `" . FORUM_TABLE_PREFIX . "forum`.`id` < ".$id." AND `" . FORUM_TABLE_PREFIX . "forum`.`first_post` = ".(int) $post['first_post'])->fetch();
 			$_page = (int) ceil($post_page['posts_count'] / setting('core.forum_threads_per_page')) - 1;
 			$db->query("DELETE FROM `" . FORUM_TABLE_PREFIX . "forum` WHERE `id` = ".$post['id']);
-			header('Location: ' . getForumThreadLink($post['first_post'], (int) $_page));
+			header('Location: ' . getForumThreadLink($post['first_post'], $_page));
 		}
 	}
 	else {

system/pages/forum/show_board.php

@@ -33,7 +33,7 @@ if(!Forum::hasAccess($section_id)) {
 	return;
 }
 
-$_page = (int) (isset($_REQUEST['page']) ? $_REQUEST['page'] : 0);
+$_page = (int) ($_REQUEST['page'] ?? 0);
 $threads_count = $db->query("SELECT COUNT(`" . FORUM_TABLE_PREFIX . "forum`.`id`) AS threads_count FROM `players`, `" . FORUM_TABLE_PREFIX . "forum` WHERE `players`.`id` = `" . FORUM_TABLE_PREFIX . "forum`.`author_guid` AND `" . FORUM_TABLE_PREFIX . "forum`.`section` = ".(int) $section_id." AND `" . FORUM_TABLE_PREFIX . "forum`.`first_post` = `" . FORUM_TABLE_PREFIX . "forum`.`id`")->fetch();
 for($i = 0; $i < $threads_count['threads_count'] / setting('core.forum_threads_per_page'); $i++) {
 	if($i != $_page)
@@ -50,7 +50,7 @@ if($logged && (!$sections[$section_id]['closed'] || Forum::isModerator())) {
 }
 
 echo '<br /><br />Page: '.$links_to_pages.'<br />';
-$last_threads = $db->query("SELECT `players`.`id` as `player_id`, `players`.`name`, `" . FORUM_TABLE_PREFIX . "forum`.`post_text`, `" . FORUM_TABLE_PREFIX . "forum`.`post_topic`, `" . FORUM_TABLE_PREFIX . "forum`.`id`, `" . FORUM_TABLE_PREFIX . "forum`.`last_post`, `" . FORUM_TABLE_PREFIX . "forum`.`replies`, `" . FORUM_TABLE_PREFIX . "forum`.`views`, `" . FORUM_TABLE_PREFIX . "forum`.`post_date` FROM `players`, `" . FORUM_TABLE_PREFIX . "forum` WHERE `players`.`id` = `" . FORUM_TABLE_PREFIX . "forum`.`author_guid` AND `" . FORUM_TABLE_PREFIX . "forum`.`section` = ".$section_id." AND `" . FORUM_TABLE_PREFIX . "forum`.`first_post` = `" . FORUM_TABLE_PREFIX . "forum`.`id` ORDER BY `" . FORUM_TABLE_PREFIX . "forum`.`last_post` DESC LIMIT ".setting('core.forum_threads_per_page')." OFFSET ".($_page * setting('core.forum_threads_per_page')))->fetchAll();
+$last_threads = $db->query("SELECT `players`.`id` as `player_id`, `players`.`name`, `" . FORUM_TABLE_PREFIX . "forum`.`first_post`, `" . FORUM_TABLE_PREFIX . "forum`.`post_text`, `" . FORUM_TABLE_PREFIX . "forum`.`post_topic`, `" . FORUM_TABLE_PREFIX . "forum`.`id`, `" . FORUM_TABLE_PREFIX . "forum`.`last_post`, `" . FORUM_TABLE_PREFIX . "forum`.`replies`, `" . FORUM_TABLE_PREFIX . "forum`.`views`, `" . FORUM_TABLE_PREFIX . "forum`.`post_date` FROM `players`, `" . FORUM_TABLE_PREFIX . "forum` WHERE `players`.`id` = `" . FORUM_TABLE_PREFIX . "forum`.`author_guid` AND `" . FORUM_TABLE_PREFIX . "forum`.`section` = ".$section_id." AND `" . FORUM_TABLE_PREFIX . "forum`.`first_post` = `" . FORUM_TABLE_PREFIX . "forum`.`id` ORDER BY `" . FORUM_TABLE_PREFIX . "forum`.`last_post` DESC LIMIT ".setting('core.forum_threads_per_page')." OFFSET ".($_page * setting('core.forum_threads_per_page')))->fetchAll(PDO::FETCH_ASSOC);
 
 if(isset($last_threads[0])) {
 	echo '<table width="100%">
@@ -67,8 +67,8 @@ if(isset($last_threads[0])) {
 	foreach($last_threads as $thread) {
 		echo '<tr bgcolor="' . getStyle($number_of_rows++) . '"><td>';
 		if(Forum::isModerator()) {
-			echo '<a href="' . getLink('forum') . '?action=move_thread&id='.$thread['id'].'"\')"><span style="color:darkgreen">[MOVE]</span></a>';
-			echo '<a href="' . getLink('forum') . '?action=remove_post&id='.$thread['id'].'" onclick="return confirm(\'Are you sure you want remove thread > '.htmlspecialchars($thread['post_topic']).' <?\')"><span style="color: red">[REMOVE]</span></a>  ';
+			echo '<a href="' . getLink('forum') . '?action=move_thread&id=' . $thread['id'] . '" title="Move Thread"><img src="images/icons/arrow_right.gif"/></a>';
+			$twig->display('forum.remove_post.html.twig', ['post' => $thread]);
 		}
 
 		$player->load($thread['player_id']);
@@ -82,10 +82,13 @@ if(isset($last_threads[0])) {
 		echo '<a href="' . getForumThreadLink($thread['id']) . '">'.htmlspecialchars($thread['post_topic']). '</a><br /><small>'.($canEditForum ? substr(strip_tags($thread['post_text']), 0, 50) : htmlspecialchars(substr($thread['post_text'], 0, 50))).'...</small></td><td>' . getPlayerLink($thread['name']) . '</td><td>'.(int) $thread['replies'].'</td><td>'.(int) $thread['views'].'</td><td>';
 		if($thread['last_post'] > 0) {
 			$last_post = $db->query("SELECT `players`.`name`, `" . FORUM_TABLE_PREFIX . "forum`.`post_date` FROM `players`, `" . FORUM_TABLE_PREFIX . "forum` WHERE `" . FORUM_TABLE_PREFIX . "forum`.`first_post` = ".(int) $thread['id']." AND `players`.`id` = `" . FORUM_TABLE_PREFIX . "forum`.`author_guid` ORDER BY `post_date` DESC LIMIT 1")->fetch();
-			if(isset($last_post['name']))
-				echo date('d.m.y H:i:s', $last_post['post_date']).'<br />by ' . getPlayerLink($last_post['name']);
-			else
+
+			if(isset($last_post['name'])) {
+				echo date('d.m.y H:i:s', $last_post['post_date']) . '<br />by ' . getPlayerLink($last_post['name']);
+			}
+			else {
 				echo 'No posts.';
+			}
 		}
 		else {
 			echo date('d.m.y H:i:s', $thread['post_date']) . '<br />by ' . getPlayerLink($thread['name']);

system/pages/forum/show_thread.php

@@ -35,7 +35,7 @@ if(!Forum::hasAccess($thread_starter['section'])) {
 	return;
 }
 
-$posts_count = $db->query("SELECT COUNT(`" . FORUM_TABLE_PREFIX . "forum`.`id`) AS posts_count FROM `players`, `" . FORUM_TABLE_PREFIX . "forum` WHERE `players`.`id` = `" . FORUM_TABLE_PREFIX . "forum`.`author_guid` AND `" . FORUM_TABLE_PREFIX . "forum`.`first_post` = ".(int) $thread_id)->fetch();
+$posts_count = $db->query("SELECT COUNT(`" . FORUM_TABLE_PREFIX . "forum`.`id`) AS posts_count FROM `players`, `" . FORUM_TABLE_PREFIX . "forum` WHERE `players`.`id` = `" . FORUM_TABLE_PREFIX . "forum`.`author_guid` AND `" . FORUM_TABLE_PREFIX . "forum`.`first_post` = ".$thread_id)->fetch();
 for($i = 0; $i < $posts_count['posts_count'] / setting('core.forum_threads_per_page'); $i++) {
 	if($i != $_page)
 		$links_to_pages .= '<a href="' . getForumThreadLink($thread_id, $i) . '">'.($i + 1).'</a> ';
@@ -46,7 +46,7 @@ for($i = 0; $i < $posts_count['posts_count'] / setting('core.forum_threads_per_p
 $posts = $db->query("SELECT `players`.`id` as `player_id`, `" . FORUM_TABLE_PREFIX . "forum`.`id`,`" . FORUM_TABLE_PREFIX . "forum`.`first_post`, `" . FORUM_TABLE_PREFIX . "forum`.`section`,`" . FORUM_TABLE_PREFIX . "forum`.`post_text`, `" . FORUM_TABLE_PREFIX . "forum`.`post_topic`, `" . FORUM_TABLE_PREFIX . "forum`.`post_date` AS `date`, `" . FORUM_TABLE_PREFIX . "forum`.`post_smile`, `" . FORUM_TABLE_PREFIX . "forum`.`post_html`, `" . FORUM_TABLE_PREFIX . "forum`.`author_aid`, `" . FORUM_TABLE_PREFIX . "forum`.`author_guid`, `" . FORUM_TABLE_PREFIX . "forum`.`last_edit_aid`, `" . FORUM_TABLE_PREFIX . "forum`.`edit_date` FROM `players`, `" . FORUM_TABLE_PREFIX . "forum` WHERE `players`.`id` = `" . FORUM_TABLE_PREFIX . "forum`.`author_guid` AND `" . FORUM_TABLE_PREFIX . "forum`.`first_post` = ".$thread_id." ORDER BY `" . FORUM_TABLE_PREFIX . "forum`.`post_date` LIMIT " . setting('core.forum_posts_per_page') . " OFFSET ".($_page * setting('core.forum_posts_per_page')))->fetchAll();
 
 if(isset($posts[0]['player_id'])) {
-	$db->query("UPDATE `" . FORUM_TABLE_PREFIX . "forum` SET `views`=`views`+1 WHERE `id` = ".(int) $thread_id);
+	$db->query("UPDATE `" . FORUM_TABLE_PREFIX . "forum` SET `views`=`views`+1 WHERE `id` = " . $thread_id);
 }
 
 $lookaddons = $db->hasColumn('players', 'lookaddons');

system/pages/guilds/accept_invite.php

@@ -12,11 +12,11 @@ defined('MYAAC') or die('Direct access not allowed!');
 
 require __DIR__ . '/base.php';
 
-//set rights in guild
+// set rights in guild
 $guild_name = isset($_REQUEST['guild']) ? urldecode($_REQUEST['guild']) : null;
 $name = isset($_REQUEST['name']) ? stripslashes($_REQUEST['name']) : null;
 if(!$logged) {
-	$errors[] = 'You are not logged in. You can\'t accept invitations.';
+	$errors[] = "You are not logged in. You can't accept invitations.";
 }
 
 if(!Validator::guildName($guild_name)) {
@@ -27,11 +27,11 @@ if(empty($errors)) {
 	$guild = new OTS_Guild();
 	$guild->find($guild_name);
 	if(!$guild->isLoaded()) {
-		$errors[] = 'Guild with name <b>'.$guild_name.'</b> doesn\'t exist.';
+		$errors[] = "Guild with name <b>$guild_name</b> doesn't exist.";
 	}
 }
 
-if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
+if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
 	if(!Validator::characterName($name)) {
 		$errors[] = 'Invalid name format.';
 	}
@@ -51,7 +51,7 @@ if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
 	}
 }
 
-if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
+if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
 	if(empty($errors)) {
 		$is_invited = false;
 		include(SYSTEM . 'libs/pot/InvitesDriver.php');
@@ -104,7 +104,7 @@ if(!empty($errors)) {
 	));
 }
 else {
-	if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
+	if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
 		$guild->acceptInvite($player);
 		$twig->display('success.html.twig', array(
 			'title' => 'Accept invitation',

system/pages/guilds/add_rank.php

@@ -13,7 +13,7 @@ defined('MYAAC') or die('Direct access not allowed!');
 require __DIR__ . '/base.php';
 
 $guild_name = isset($_REQUEST['guild']) ? urldecode($_REQUEST['guild']) : null;
-$rank_name = isset($_REQUEST['rank_name']) ? $_REQUEST['rank_name'] : null;
+$rank_name = $_POST['rank_name'] ?? null;
 if(!Validator::guildName($guild_name)) {
 	$errors[] = Validator::getLastError();
 }
@@ -35,7 +35,7 @@ if(empty($errors)) {
 		$rank_list = $guild->getGuildRanksList();
 		$rank_list->orderBy('level', POT::ORDER_DESC);
 		$guild_leader = false;
-		$account_players = $account_logged->getPlayers();
+		$account_players = $account_logged->getPlayersList();
 		foreach($account_players as $player) {
 			if($guild_leader_char->getId() == $player->getId()) {
 				$guild_vice = true;

system/pages/guilds/base.php

@@ -15,3 +15,5 @@ else
 	define('GUILD_MEMBERS_TABLE', 'guild_membership');
 
 define('MOTD_EXISTS', $db->hasColumn('guilds', 'motd'));
+
+csrfProtect();

system/pages/guilds/change_description.php

@@ -31,7 +31,7 @@ if(empty($errors)) {
 		$rank_list = $guild->getGuildRanksList();
 		$rank_list->orderBy('level', POT::ORDER_DESC);
 		$guild_leader = false;
-		$account_players = $account_logged->getPlayers();
+		$account_players = $account_logged->getPlayersList();
 		foreach($account_players as $player) {
 			if($guild->getOwner()->getId() == $player->getId()) {
 				$guild_vice = true;
@@ -42,8 +42,8 @@ if(empty($errors)) {
 
 		$saved = false;
 		if($guild_leader) {
-			if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
-				$description = htmlspecialchars(stripslashes(substr(trim($_REQUEST['description']),0, setting('core.guild_description_chars_limit'))));
+			if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
+				$description = htmlspecialchars(stripslashes(substr(trim($_POST['description']),0, setting('core.guild_description_chars_limit'))));
 				$guild->setCustomField('description', $description);
 				$saved = true;
 			}

system/pages/guilds/change_logo.php

@@ -30,7 +30,7 @@ if(empty($errors)) {
 	if($logged) {
 		$guild_leader_char = $guild->getOwner();
 		$guild_leader = false;
-		$account_players = $account_logged->getPlayers();
+		$account_players = $account_logged->getPlayersList();
 
 		foreach($account_players as $player) {
 			if($guild_leader_char->getId() == $player->getId()) {
@@ -40,14 +40,13 @@ if(empty($errors)) {
 			}
 		}
 
-		if($guild_leader)
-		{
+		if($guild_leader) {
 			$max_image_size_b = setting('core.guild_image_size_kb') * 1024;
 			$allowed_ext = array('image/gif', 'image/jpg', 'image/pjpeg', 'image/jpeg', 'image/bmp', 'image/png', 'image/x-png');
 			$ext_name = array('image/gif' => 'gif', 'image/jpg' => 'jpg', 'image/jpeg' => 'jpg', 'image/pjpeg' => 'jpg', 'image/bmp' => 'bmp', 'image/png' => 'png', 'image/x-png' => 'png');
 			$save_file_name = str_replace(' ', '_', strtolower($guild->getName()));
 			$save_path = GUILD_IMAGES_DIR . $save_file_name;
-			if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save')
+			if(isset($_POST['todo']) && $_POST['todo'] == 'save')
 			{
 				$file = $_FILES['newlogo'];
 				if(is_uploaded_file($file['tmp_name']))
@@ -97,13 +96,13 @@ if(empty($errors)) {
 
 			$guild_logo = $guild->getCustomField('logo_name');
 			if(empty($guild_logo) || !file_exists(GUILD_IMAGES_DIR . $guild_logo)) {
-				$guild_logo = "default.gif";
+				$guild_logo = 'default.gif';
 			}
 
 			$twig->display('guilds.change_logo.html.twig', array(
 				'guild_logo' => $guild_logo,
 				'guild' => $guild,
-				'max_image_size_b' => $max_image_size_b
+				//'max_image_size_b' => $max_image_size_b
 			));
 
 		}

system/pages/guilds/change_motd.php

@@ -34,7 +34,7 @@ if(empty($errors)) {
 		$rank_list = $guild->getGuildRanksList();
 		$rank_list->orderBy('level', POT::ORDER_DESC);
 		$guild_leader = false;
-		$account_players = $account_logged->getPlayers();
+		$account_players = $account_logged->getPlayersList();
 		foreach($account_players as $player) {
 			if($guild->getOwner()->getId() == $player->getId()) {
 				$guild_vice = true;
@@ -45,8 +45,8 @@ if(empty($errors)) {
 
 		$saved = false;
 		if($guild_leader) {
-			if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
-				$motd = htmlspecialchars(stripslashes(substr($_REQUEST['motd'],0, setting('core.guild_motd_chars_limit'))));
+			if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
+				$motd = htmlspecialchars(stripslashes(substr($_POST['motd'],0, setting('core.guild_motd_chars_limit'))));
 				$guild->setCustomField('motd', $motd);
 				$saved = true;
 			}

system/pages/guilds/change_nick.php

@@ -20,17 +20,15 @@ if(!$logged) {
 }
 
 $name = isset($_REQUEST['name']) ? stripslashes($_REQUEST['name']) : null;
-$new_nick = isset($_REQUEST['nick']) ? stripslashes($_REQUEST['nick']) : null;
+$new_nick = isset($_POST['nick']) ? stripslashes($_POST['nick']) : null;
 $guild_name = isset($_REQUEST['guild']) ? urldecode($_REQUEST['guild']) : null;
 
 if(!$name) {
 	$errors[] = 'Please enter new name.';
-	return;
 }
 
 if(!$new_nick) {
 	$errors[] = 'Please enter new nick.';
-	return;
 }
 
 if(empty($errors))

system/pages/guilds/change_rank.php

@@ -17,8 +17,9 @@ if(!$logged) {
 }
 else {
 	$guild_name = isset($_REQUEST['guild']) ? urldecode($_REQUEST['guild']) : null;
-	if(!Validator::guildName($guild_name))
+	if(!Validator::guildName($guild_name)) {
 		$errors[] = Validator::getLastError();
+	}
 }
 
 if(empty($errors))
@@ -42,7 +43,7 @@ $rank_list = $guild->getGuildRanksList();
 $rank_list->orderBy('level', POT::ORDER_DESC);
 $guild_leader = false;
 $guild_vice = false;
-$account_players = $account_logged->getPlayers();
+$account_players = $account_logged->getPlayersList();
 foreach($account_players as $player)
 {
 	$player_rank = $player->getRank();
@@ -65,22 +66,23 @@ foreach($account_players as $player)
 	}
 }
 
-if($guild_vice)
-{
-	if(isset($_REQUEST['todo']) && $_REQUEST['todo'] === 'save')
-	{
+if($guild_vice) {
+	if(isset($_POST['todo']) && $_POST['todo'] === 'save') {
 		$player_name = stripslashes($_REQUEST['name']);
-		$new_rank = (int) $_REQUEST['rankid'];
-		if(!Validator::characterName($player_name))
+		$new_rank = (int) $_POST['rankid'];
+
+		if(!Validator::characterName($player_name)) {
 			$errors[] = 'Invalid player name format.';
+		}
+
 		$rank = new OTS_GuildRank();
 		$rank->load($new_rank);
 		if(!$rank->isLoaded())
 			$errors[] = "Rank with this ID doesn't exist.";
 		if($level_in_guild <= $rank->getLevel() && !$guild_leader)
 			$errors[] = "You can't set ranks with equal or higher level than your.";
-		if(empty($errors))
-		{
+
+		if(empty($errors)) {
 			$player_to_change = new OTS_Player();
 			$player_to_change->find($player_name);
 			if(!$player_to_change->isLoaded())
@@ -108,8 +110,7 @@ if($guild_vice)
 				$errors[] = 'This player has higher rank in guild than you. You can\'t change his/her rank.';
 		}
 
-		if(empty($errors))
-		{
+		if(empty($errors)) {
 			$player_to_change->setRank($rank);
 			$twig->display('success.html.twig', array(
 				'title' => 'Rank Changed',
@@ -125,7 +126,7 @@ if($guild_vice)
 	$result = getPlayersWithLowerRank($rank_list, $guild_leader, $db, $level_in_guild, $guild);
 
 	$twig->display('guilds.change_rank.html.twig', array(
-		'players' => isset($result['players']) ? $result['players'] : array(),
+		'players' => $result['players'] ?? [],
 		'guild_name' => $guild->getName(),
 		'ranks' => $result['ranks']
 	));

system/pages/guilds/cleanup_players.php

@@ -12,33 +12,27 @@ defined('MYAAC') or die('Direct access not allowed!');
 
 require __DIR__ . '/base.php';
 
-if(!$logged)
-{
+if(!$logged) {
 	echo "You are not logged in.";
 	$twig->display('guilds.back_button.html.twig');
 	return;
 }
 
-if(admin())
-{
+if(admin()) {
 	$players_list = new OTS_Players_List();
 	$players_list->init();
 }
-else
+else {
 	$players_list = $account_logged->getPlayersList();
+}
 
-if(count($players_list) > 0)
-{
-	foreach($players_list as $player)
-	{
+if(count($players_list) > 0) {
+	foreach($players_list as $player) {
 		$player_rank = $player->getRank();
-		if($player_rank->isLoaded())
-		{
-			if($player_rank->isLoaded())
-			{
+		if($player_rank->isLoaded()) {
+			if($player_rank->isLoaded()) {
 				$rank_guild = $player_rank->getGuild();
-				if(!$rank_guild->isLoaded())
-				{
+				if(!$rank_guild->isLoaded()) {
 					$player->setRank();
 					$player->setGuildNick('');
 					$changed_ranks_of[] = $player->getName();
@@ -46,8 +40,7 @@ if(count($players_list) > 0)
 					$player_rank->delete();
 				}
 			}
-			else
-			{
+			else {
 				$player->setRank();
 				$player->setGuildNick('');
 				$changed_ranks_of[] = $player->getName();
@@ -55,14 +48,20 @@ if(count($players_list) > 0)
 
 		}
 	}
+
 	echo "<b>Deleted ranks (this ranks guilds doesn't exist [bug fix]):</b>";
-	if(!empty($deleted_ranks))
-		foreach($deleted_ranks as $rank)
-			echo "<li>".$rank;
+	if(!empty($deleted_ranks)) {
+		foreach ($deleted_ranks as $rank) {
+			echo "<li>" . $rank;
+		}
+	}
 	echo "<BR /><BR /><b>Changed ranks of players (rank or guild of rank doesn't exist [bug fix]):</b>";
-	if(!empty($changed_ranks_of))
-		foreach($changed_ranks_of as $name)
-			echo "<li>".$name;
+
+	if(!empty($changed_ranks_of)) {
+		foreach ($changed_ranks_of as $name) {
+			echo "<li>" . $name;
+		}
+	}
 }
 else
 	echo "0 players found.";

system/pages/guilds/create.php

@@ -14,15 +14,15 @@ use MyAAC\Models\GuildRank;
 
 require __DIR__ . '/base.php';
 
-$guild_name = isset($_REQUEST['guild']) ? urldecode($_REQUEST['guild']) : NULL;
-$name = isset($_REQUEST['name']) ? stripslashes($_REQUEST['name']) : NULL;
-$todo = isset($_REQUEST['todo']) ? $_REQUEST['todo'] : NULL;
+$guild_name = isset($_POST['guild']) ? urldecode($_POST['guild']) : NULL;
+$name = isset($_POST['name']) ? stripslashes($_POST['name']) : NULL;
+$todo = isset($_POST['todo']) ? $_POST['todo'] : NULL;
 if(!$logged) {
-	$guild_errors[] = 'You are not logged in. You can\'t create guild.';
+	$errors[] = 'You are not logged in. You can\'t create guild.';
 }
 
 $array_of_player_nig = array();
-if(empty($guild_errors))
+if(empty($errors))
 {
 	$account_players = $account_logged->getPlayersList(false);
 	foreach($account_players as $player)
@@ -41,45 +41,44 @@ if(empty($guild_errors))
 
 if(empty($todo)) {
 	if(count($array_of_player_nig) == 0) {
-		$guild_errors[] = 'On your account all characters are in guilds, have too low level to create new guild' . (setting('core.guild_need_premium') ? ' or you don\' have a premium account' : '') . '.';
+		$errors[] = 'On your account all characters are in guilds, have too low level to create new guild' . (setting('core.guild_need_premium') ? ' or you don\' have a premium account' : '') . '.';
 	}
 }
 
 if($todo == 'save')
 {
 	if(!Validator::guildName($guild_name)) {
-		$guild_errors[] = Validator::getLastError();
+		$errors[] = Validator::getLastError();
 		$guild_name = '';
 	}
 
 	if(!Validator::characterName($name)) {
-		$guild_errors[] = 'Invalid character name format.';
+		$errors[] = 'Invalid character name format.';
 		$name = '';
 	}
 
-	if(empty($guild_errors)) {
+	if(empty($errors)) {
 		$player = new OTS_Player();
 		$player->find($name);
 		if(!$player->isLoaded()) {
-			$guild_errors[] = 'Character <b>'.$name.'</b> doesn\'t exist.';
+			$errors[] = 'Character <b>'.$name.'</b> doesn\'t exist.';
 		}
 	}
 
-
-	if(empty($guild_errors))
+	if(empty($errors))
 	{
 		$guild = new OTS_Guild();
 		$guild->find($guild_name);
 		if($guild->isLoaded()) {
-			$guild_errors[] = 'Guild <b>'.$guild_name.'</b> already exist. Select other name.';
+			$errors[] = 'Guild <b>'.$guild_name.'</b> already exist. Select other name.';
 		}
 	}
 
-	if(empty($guild_errors) && $player->isDeleted()) {
-		$guild_errors[] = "Character <b>$name</b> has been deleted.";
+	if(empty($errors) && $player->isDeleted()) {
+		$errors[] = "Character <b>$name</b> has been deleted.";
 	}
 
-	if(empty($guild_errors))
+	if(empty($errors))
 	{
 		$bad_char = true;
 		foreach($array_of_player_nig as $nick_from_list) {
@@ -88,22 +87,22 @@ if($todo == 'save')
 			}
 		}
 		if($bad_char) {
-			$guild_errors[] = 'Character <b>'.$name.'</b> isn\'t on your account or is already in guild.';
+			$errors[] = 'Character <b>'.$name.'</b> isn\'t on your account or is already in guild.';
 		}
 	}
 
-	if(empty($guild_errors)) {
+	if(empty($errors)) {
 		if($player->getLevel() < setting('core.guild_need_level')) {
-			$guild_errors[] = 'Character <b>'.$name.'</b> has too low level. To create guild you need character with level <b>' . setting('core.guild_need_level') . '</b>.';
+			$errors[] = 'Character <b>'.$name.'</b> has too low level. To create guild you need character with level <b>' . setting('core.guild_need_level') . '</b>.';
 		}
 		if(setting('core.guild_need_premium') && !$account_logged->isPremium()) {
-			$guild_errors[] = 'Character <b>'.$name.'</b> is on FREE account. To create guild you need PREMIUM account.';
+			$errors[] = 'Character <b>'.$name.'</b> is on FREE account. To create guild you need PREMIUM account.';
 		}
 	}
 }
 
-if(!empty($guild_errors)) {
-	$twig->display('error_box.html.twig', array('errors' => $guild_errors));
+if(!empty($errors)) {
+	$twig->display('error_box.html.twig', array('errors' => $errors));
 	unset($todo);
 }
 

system/pages/guilds/delete_by_admin.php

@@ -45,7 +45,10 @@ if(empty($errors)) {
 				$twig->display('success.html.twig', array(
 					'title' => 'Delete Guild',
 					'description' => 'Are you sure you want delete guild <b>' . $guild_name . '</b>?<br/>
-				<form action="' . getLink('guilds') . '?guild=' . $guild->getName() . '&action=delete_by_admin" METHOD="post"><input type="hidden" name="todo" value="save"><input type="submit" value="Yes, delete"></form>',
+				<form action="' . getLink('guilds') . '?guild=' . $guild->getName() . '&action=delete_by_admin" METHOD="post">
+					' . csrf(true) . '
+					<input type="hidden" name="todo" value="save"><input type="submit" value="Yes, delete">
+				</form>',
 					'custom_buttons' => $twig->render('guilds.back_button.html.twig')
 				));
 			}

system/pages/guilds/delete_guild.php

@@ -21,7 +21,7 @@ if(empty($errors)) {
 	$guild = new OTS_Guild();
 	$guild->find($guild_name);
 	if(!$guild->isLoaded()) {
-		$errors[] = 'Guild with name <b>'.$guild_name.'</b> doesn\'t exist.';
+		$errors[] = "Guild with name <b>$guild_name</b> doesn't exist.";
 	}
 }
 
@@ -31,7 +31,7 @@ if(empty($errors)) {
 		$rank_list = $guild->getGuildRanksList();
 		$rank_list->orderBy('level', POT::ORDER_DESC);
 		$guild_leader = false;
-		$account_players = $account_logged->getPlayers();
+		$account_players = $account_logged->getPlayersList();
 
 		foreach($account_players as $player) {
 			if($guild->getOwner()->getId() == $player->getId()) {

system/pages/guilds/delete_invite.php

@@ -15,47 +15,43 @@ require __DIR__ . '/base.php';
 $guild_name = isset($_REQUEST['guild']) ? urldecode($_REQUEST['guild']) : null;
 $name = stripslashes($_REQUEST['name']);
 
-if(!$logged)
+if(!$logged) {
 	$errors[] = 'You are not logged in. You can\'t delete invitations.';
+}
 
-if(!Validator::guildName($guild_name))
+if(!Validator::guildName($guild_name)) {
 	$errors[] = Validator::getLastError();
+}
 
-if(!Validator::characterName($name))
+if(!Validator::characterName($name)) {
 	$errors[] = 'Invalid name format.';
+}
 
-if(empty($errors))
-{
+if(empty($errors)) {
 	$guild = new OTS_Guild();
 	$guild->find($guild_name);
 	if(!$guild->isLoaded())
 		$errors[] = "Guild with name <b>" . $guild_name . "</b> doesn't exist.";
 }
 
-if(empty($errors))
-{
+if(empty($errors)) {
 	$rank_list = $guild->getGuildRanksList();
 	$rank_list->orderBy('level', POT::ORDER_DESC);
 	$guild_leader = false;
 	$guild_vice = false;
-	$account_players = $account_logged->getPlayers();
-	foreach($account_players as $player)
-	{
+	$account_players = $account_logged->getPlayersList();
+	foreach($account_players as $player) {
 		$player_rank = $player->getRank();
-		if($player_rank->isLoaded())
-		{
-			foreach($rank_list as $rank_in_guild)
-			{
-				if($rank_in_guild->getId() == $player_rank->getId())
-				{
+		if($player_rank->isLoaded()) {
+			foreach($rank_list as $rank_in_guild) {
+				if($rank_in_guild->getId() == $player_rank->getId()) {
 					$players_from_account_in_guild[] = $player->getName();
-					if($player_rank->getLevel() > 1)
-					{
+					if($player_rank->getLevel() > 1) {
 						$guild_vice = true;
 						$level_in_guild = $player_rank->getLevel();
 					}
-					if($guild->getOwner()->getId() == $player->getId())
-					{
+
+					if($guild->getOwner()->getId() == $player->getId()) {
 						$guild_vice = true;
 						$guild_leader = true;
 					}
@@ -64,44 +60,46 @@ if(empty($errors))
 		}
 	}
 
-	if(!$guild_vice)
+	if(!$guild_vice) {
 		$errors[] = 'You are not a leader or vice leader of guild <b>' . $guild_name . '</b>.';
-}
-if(empty($errors))
-{
-	$player = new OTS_Player();
-	$player->find($name);
-	if(!$player->isLoaded())
-		$errors[] = 'Player with name <b>' . $name . '</b> doesn\'t exist.';
+	}
 }
 
-if(empty($errors))
-{
+if(empty($errors)) {
+	$player = new OTS_Player();
+	$player->find($name);
+	if(!$player->isLoaded()) {
+		$errors[] = "Player with name <b>$name</b> doesn't exist.";
+	}
+}
+
+if(empty($errors)) {
 	include(SYSTEM . 'libs/pot/InvitesDriver.php');
 	new InvitesDriver($guild);
 	$invited_list = $guild->listInvites();
-	if(count($invited_list) > 0)
-	{
+	if(count($invited_list) > 0) {
 		$is_invited = false;
-		foreach($invited_list as $invited)
-			if($invited->getName() == $player->getName())
+		foreach($invited_list as $invited) {
+			if ($invited->getName() == $player->getName()) {
 				$is_invited = true;
-		if(!$is_invited)
-			$errors[] = '<b>'.$player->getName().'</b> isn\'t invited to your guild.';
+			}
+		}
+		if(!$is_invited) {
+			$errors[] = '<b>' . $player->getName() . '</b> isn\'t invited to your guild.';
+		}
 	}
-	else
+	else {
 		$errors[] = 'No one is invited to your guild.';
+	}
 }
-if(!empty($errors))
-{
+
+if(!empty($errors)) {
 	$twig->display('error_box.html.twig', array('errors' => $errors));
 
 	$twig->display('guilds.back_button.html.twig', array('action' => getLink('guilds') . '?action=show&guild=' . $guild_name));
 }
-else
-{
-	if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save')
-	{
+else {
+	if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
 		$guild->deleteInvite($player);
 		$twig->display('success.html.twig', array(
 			'title' => 'Deleted player invitation',

system/pages/guilds/delete_rank.php

@@ -13,25 +13,27 @@ defined('MYAAC') or die('Direct access not allowed!');
 require __DIR__ . '/base.php';
 
 $guild_name = isset($_REQUEST['guild']) ? urldecode($_REQUEST['guild']) : null;
-$rank_to_delete = isset($_REQUEST['rankid']) ? (int) $_REQUEST['rankid'] : null;
+$rank_to_delete = isset($_POST['rankid']) ? (int) $_POST['rankid'] : null;
 
 if(!Validator::guildName($guild_name)) {
-	$guild_errors[] = Validator::getLastError();
+	$errors[] = Validator::getLastError();
 }
-if(empty($guild_errors)) {
+
+if(empty($errors)) {
 	$guild = new OTS_Guild();
 	$guild->find($guild_name);
 	if(!$guild->isLoaded()) {
-		$guild_errors[] = 'Guild with name <b>'.$guild_name.'</b> doesn\'t exist.';
+		$errors[] = 'Guild with name <b>'.$guild_name.'</b> doesn\'t exist.';
 	}
 }
-if(empty($guild_errors)) {
+
+if(empty($errors)) {
 	if($logged) {
 		$guild_leader_char = $guild->getOwner();
 		$rank_list = $guild->getGuildRanksList();
 		$rank_list->orderBy('level', POT::ORDER_DESC);
 		$guild_leader = false;
-		$account_players = $account_logged->getPlayers();
+		$account_players = $account_logged->getPlayersList();
 		foreach($account_players as $player) {
 			if($guild->getOwner()->getId() == $player->getId()) {
 				$guild_vice = true;
@@ -39,21 +41,21 @@ if(empty($guild_errors)) {
 				$level_in_guild = 3;
 			}
 		}
+
 		if($guild_leader) {
 			$rank = new OTS_GuildRank();
 			$rank->load($rank_to_delete);
 			if(!$rank->isLoaded()) {
-				$guild_errors2[] = 'Rank with ID '.$rank_to_delete.' doesn\'t exist.';
+				$errors2[] = 'Rank with ID '.$rank_to_delete.' doesn\'t exist.';
 			}
-			else
-			{
+			else {
 				if($rank->getGuild()->getId() != $guild->getId()) {
-					$guild_errors2[] = 'Rank with ID '.$rank_to_delete.' isn\'t from your guild.';
+					$errors2[] = 'Rank with ID '.$rank_to_delete.' isn\'t from your guild.';
 				}
 				else
 				{
 					if(count($rank_list) < 2) {
-						$guild_errors2[] = 'You have only 1 rank in your guild. You can\'t delete this rank.';
+						$errors2[] = 'You have only 1 rank in your guild. You can\'t delete this rank.';
 					}
 					else
 					{
@@ -87,19 +89,21 @@ if(empty($guild_errors)) {
 									$player->setRank($new_rank);
 							}
 						}
+
 						$rank->delete();
 						$saved = true;
 					}
 				}
 			}
-			if($saved) {
+
+			if(isset($saved) && $saved) {
 				$twig->display('success.html.twig', array(
 					'title' => 'Rank Deleted',
 					'description' => 'Rank <b>'.$rank->getName().'</b> has been deleted. Players with this rank has now other rank.',
 					'custom_buttons' => ''
 				));
 			} else {
-				$twig->display('error_box.html.twig', array('errors' => $guild_errors2));
+				$twig->display('error_box.html.twig', array('errors' => $errors2));
 			}
 
 			$twig->display('guilds.back_button.html.twig', array(
@@ -107,18 +111,16 @@ if(empty($guild_errors)) {
 				'action' => getLink('guilds') . '?guild='.$guild->getName().'&action=manager'
 			));
 		}
-		else
-		{
-			$guild_errors[] = 'You are not a leader of guild!';
+		else {
+			$errors[] = 'You are not a leader of guild!';
 		}
 	}
-	else
-	{
-		$guild_errors[] = 'You are not logged. You can\'t manage guild.';
+	else {
+		$errors[] = 'You are not logged. You can\'t manage guild.';
 	}
 }
-if(!empty($guild_errors)) {
-	$twig->display('error_box.html.twig', array('errors' => $guild_errors));
+if(!empty($errors)) {
+	$twig->display('error_box.html.twig', array('errors' => $errors));
 
 	$twig->display('guilds.back_button.html.twig', array(
 		'new_line' => true,

system/pages/guilds/invite.php

@@ -36,7 +36,7 @@ if(empty($errors)) {
 	$rank_list->orderBy('level', POT::ORDER_DESC);
 	$guild_leader = false;
 	$guild_vice = false;
-	$account_players = $account_logged->getPlayers();
+	$account_players = $account_logged->getPlayersList();
 	foreach($account_players as $player) {
 		$player_rank = $player->getRank();
 		if($player_rank->isLoaded()) {
@@ -62,7 +62,7 @@ if(!$guild_vice) {
 	$errors[] = 'You are not a leader or vice leader of guild <b>'.$guild_name.'</b>.'.$level_in_guild;
 }
 
-if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
+if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
 	if(!Validator::characterName($name)) {
 		$errors[] = 'Invalid name format.';
 	}
@@ -71,7 +71,7 @@ if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
 		$player = new OTS_Player();
 		$player->find($name);
 		if(!$player->isLoaded()) {
-			$errors[] = 'Player with name <b>' . $name . '</b> doesn\'t exist.';
+			$errors[] = "Player with name <b>$name</b> doesn't exist.";
 		} else if ($player->isDeleted()) {
 			$errors[] = "Character with name <b>$name</b> has been deleted.";
 		}
@@ -102,7 +102,7 @@ if(!empty($errors)) {
 	$twig->display('error_box.html.twig', array('errors' => $errors));
 }
 else {
-	if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
+	if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
 		$guild->invite($player);
 		$twig->display('success.html.twig', array(
 			'title' => 'Invite player',

system/pages/guilds/kick_player.php

@@ -41,7 +41,7 @@ if(empty($errors)) {
 	$rank_list->orderBy('level', POT::ORDER_DESC);
 	$guild_leader = false;
 	$guild_vice = false;
-	$account_players = $account_logged->getPlayers();
+	$account_players = $account_logged->getPlayersList();
 	foreach($account_players as $player) {
 		$player_rank = $player->getRank();
 		if($player_rank->isLoaded()) {
@@ -102,7 +102,7 @@ if(!empty($errors)) {
 }
 else
 {
-	if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
+	if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
 		$player->setRank();
 
 		$twig->display('success.html.twig', array(

system/pages/guilds/leave.php

@@ -34,7 +34,7 @@ if(empty($errors)) {
 $array_of_player_ig = array();
 if(empty($errors)) {
 	$guild_owner_name = $guild->getOwner()->getName();
-	if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
+	if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
 		if(!Validator::characterName($name)) {
 			$errors[] = 'Invalid name format.';
 		}
@@ -72,7 +72,7 @@ if(empty($errors)) {
 	}
 	else
 	{
-		$account_players = $account_logged->getPlayers();
+		$account_players = $account_logged->getPlayersList();
 		foreach($account_players as $player_fac) {
 			$player_rank = $player_fac->getRank();
 			if($player_rank->isLoaded()) {
@@ -94,7 +94,7 @@ if(!empty($errors)) {
 }
 else
 {
-	if(isset($_REQUEST['todo']) && $_REQUEST['todo'] == 'save') {
+	if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
 		$player->setRank();
 		$twig->display('success.html.twig', array(
 			'title' => 'Leave guild',

system/pages/guilds/list.php

@@ -14,31 +14,31 @@ defined('MYAAC') or die('Direct access not allowed!');
 require __DIR__ . '/base.php';
 
 $guilds_list = new OTS_Guilds_List();
-$guilds_list->orderBy("name");
+$guilds_list->orderBy('name');
 
 $guilds = array();
-if(count($guilds_list) > 0)
-{
+if(count($guilds_list) > 0) {
 	/**
 	 * @var OTS_Guild $guild
 	 */
 	foreach ($guilds_list as $guild) {
 		$guild_logo = $guild->getCustomField('logo_name');
-		if (empty($guild_logo) || !file_exists(GUILD_IMAGES_DIR . $guild_logo))
-			$guild_logo = "default.gif";
+		if (empty($guild_logo) || !file_exists(GUILD_IMAGES_DIR . $guild_logo)) {
+			$guild_logo = 'default.gif';
+		}
 
 		$description = $guild->getCustomField('description');
 		$description_with_lines = str_replace(array("\r\n", "\n", "\r"), '<br />', $description, $count);
-		if ($count < setting('core.guild_description_lines_limit'))
+		if ($count < setting('core.guild_description_lines_limit')) {
 			$description = nl2br($description);
+		}
 
 		$guildName = $guild->getName();
 		$guilds[] = array('name' => $guildName, 'logo' => $guild_logo, 'link' => getGuildLink($guildName, false), 'description' => $description);
 	}
-};
+}
 
 $twig->display('guilds.list.html.twig', array(
 	'guilds' => $guilds,
-	'logged' => isset($logged) ? $logged : false,
 	'isAdmin' => admin(),
 ));

system/pages/guilds/manager.php

@@ -21,7 +21,7 @@ if(empty($errors)) {
 	$guild = new OTS_Guild();
 	$guild->find($guild_name);
 	if(!$guild->isLoaded()) {
-		$errors[] = 'Guild with name <b>'.$guild_name.'</b> doesn\'t exist.';
+		$errors[] = "Guild with name <b>$guild_name</b> doesn't exist.";
 	}
 }
 
@@ -31,7 +31,7 @@ if(empty($errors)) {
 		$rank_list = $guild->getGuildRanksList();
 		$rank_list->orderBy('level', POT::ORDER_DESC);
 		$guild_leader = false;
-		$account_players = $account_logged->getPlayers();
+		$account_players = $account_logged->getPlayersList();
 		foreach($account_players as $player) {
 			if($guild_leader_char->getId() == $player->getId()) {
 				$guild_vice = true;
@@ -39,22 +39,22 @@ if(empty($errors)) {
 				$level_in_guild = 3;
 			}
 		}
+
 		if($guild_leader) {
 			$twig->display('guilds.manager.html.twig', array(
 				'guild' => $guild,
 				'rank_list' => $rank_list
 			));
 		}
-		else
-		{
+		else {
 			$errors[] = 'You are not a leader of guild!';
 		}
 	}
-	else
-	{
-		$errors[] = 'You are not logged. You can\'t manage guild.';
+	else {
+		$errors[] = "You are not logged. You can't manage guild.";
 	}
 }
+
 if(!empty($errors)) {
 	$twig->display('error_box.html.twig', array('errors' => $errors));
 }

system/pages/guilds/pass_leadership.php

@@ -15,51 +15,52 @@ require __DIR__ . '/base.php';
 $guild_name = isset($_REQUEST['guild']) ? urldecode($_REQUEST['guild']) : NULL;
 $pass_to = isset($_REQUEST['player']) ? stripslashes($_REQUEST['player']) : NULL;
 if(!Validator::guildName($guild_name)) {
-	$guild_errors[] = Validator::getLastError();
+	$errors[] = Validator::getLastError();
 }
 
-if(empty($guild_errors)) {
+if(empty($errors)) {
 	$guild = new OTS_Guild();
 	$guild->find($guild_name);
 	if(!$guild->isLoaded()) {
-		$guild_errors[] = "Guild with name <b>" . $guild_name . "</b> doesn't exist.";
+		$errors[] = "Guild with name <b>" . $guild_name . "</b> doesn't exist.";
 	}
 }
-if(empty($guild_errors)) {
+
+if(empty($errors)) {
 	if(isset($_POST['todo']) && $_POST['todo'] == 'save') {
 		if(!Validator::characterName($pass_to)) {
-			$guild_errors2[] = 'Invalid player name format.';
+			$errors2[] = 'Invalid player name format.';
 		}
 
-		if(empty($guild_errors2)) {
+		if(empty($errors2)) {
 			$to_player = new OTS_Player();
 			$to_player->find($pass_to);
 			if(!$to_player->isLoaded()) {
-				$guild_errors2[] = 'Player with name <b>'.$pass_to.'</b> doesn\'t exist.';
+				$errors2[] = 'Player with name <b>'.$pass_to.'</b> doesn\'t exist.';
 			} else if ($to_player->isDeleted()) {
-				$guild_errors2[] = "Character with name <b>$pass_to</b> has been deleted.";
+				$errors2[] = "Character with name <b>$pass_to</b> has been deleted.";
 			}
 
-			if(empty($guild_errors2)) {
+			if(empty($errors2)) {
 				$to_player_rank = $to_player->getRank();
 				if($to_player_rank->isLoaded()) {
 					$to_player_guild = $to_player_rank->getGuild();
 					if($to_player_guild->getId() != $guild->getId()) {
-						$guild_errors2[] = 'Player with name <b>'.$to_player->getName().'</b> isn\'t from your guild.';
+						$errors2[] = 'Player with name <b>'.$to_player->getName().'</b> isn\'t from your guild.';
 					}
 				}
 				else {
-					$guild_errors2[] = 'Player with name <b>'.$to_player->getName().'</b> isn\'t from your guild.';
+					$errors2[] = 'Player with name <b>'.$to_player->getName().'</b> isn\'t from your guild.';
 				}
 			}
 		}
 	}
 }
-if(empty($guild_errors) && empty($guild_errors2)) {
+if(empty($errors) && empty($errors2)) {
 	if($logged) {
 		$guild_leader_char = $guild->getOwner();
 		$guild_leader = false;
-		$account_players = $account_logged->getPlayers();
+		$account_players = $account_logged->getPlayersList();
 		foreach($account_players as $player) {
 			if($guild_leader_char->getId() == $player->getId()) {
 				$guild_vice = true;
@@ -99,23 +100,23 @@ if(empty($guild_errors) && empty($guild_errors2)) {
 			}
 		}
 		else {
-			$guild_errors[] = 'You are not a leader of guild!';
+			$errors[] = 'You are not a leader of guild!';
 		}
 	}
 	else {
-		$guild_errors[] = "You are not logged. You can't manage guild.";
+		$errors[] = "You are not logged. You can't manage guild.";
 	}
 }
-if(empty($guild_errors) && !empty($guild_errors2)) {
-	$twig->display('error_box.html.twig', array('errors' => $guild_errors2));
+if(empty($errors) && !empty($errors2)) {
+	$twig->display('error_box.html.twig', array('errors' => $errors2));
 
 	echo '<br/><div style="text-align:center"><form action="' . getLink('guilds') . '?guild='.$guild->getName().'&action=pass_leadership" method="post">' . $twig->render('buttons.back.html.twig') . '</form></div>';
 }
-if(!empty($guild_errors)) {
-	if(!empty($guild_errors2)) {
-		$guild_errors = array_merge($guild_errors, $guild_errors2);
+if(!empty($errors)) {
+	if(!empty($errors2)) {
+		$errors = array_merge($errors, $errors2);
 	}
-	$twig->display('error_box.html.twig', array('errors' => $guild_errors));
+	$twig->display('error_box.html.twig', array('errors' => $errors));
 
 	echo '<br/><div style="text-align:center"><form action="' . getLink('guilds') . '" method="post">' . $twig->render('buttons.back.html.twig') . '</form></div>';
 }

system/pages/guilds/save_ranks.php

@@ -31,7 +31,7 @@ if(empty($errors)) {
 		$rank_list = $guild->getGuildRanksList();
 		$rank_list->orderBy('level', POT::ORDER_DESC);
 		$guild_leader = false;
-		$account_players = $account_logged->getPlayers();
+		$account_players = $account_logged->getPlayersList();
 
 		foreach($account_players as $player) {
 			if($guild_leader_char->getId() == $player->getId()) {
@@ -61,6 +61,7 @@ if(empty($errors)) {
 
 				$rank->save();
 			}
+
 			//show errors or redirect
 			if(empty($errors)) {
 				header("Location: " . getLink('guilds') . "?action=manager&guild=".$guild->getName());
@@ -73,10 +74,10 @@ if(empty($errors)) {
 	}
 	else
 	{
-		$errors[] = 'You are not logged. You can\'t manage guild.';
+		$errors[] = "You are not logged. You can't manage guild.";
 	}
 }
 
 if(!empty($errors)) {
-	$twig->display('error_box.html.twig', array('errors' => $errors));
+	$twig->display('error_box.html.twig', ['errors' => $errors]);
 }

system/pages/guilds/show.php

@@ -16,19 +16,18 @@ $title = 'Guilds';
 require __DIR__ . '/base.php';
 
 $guild_name = isset($_REQUEST['guild']) ? urldecode($_REQUEST['guild']) : null;
-if(!Validator::guildName($guild_name))
+if(!Validator::guildName($guild_name)) {
 	$errors[] = Validator::getLastError();
+}
 
-if(empty($errors))
-{
+if(empty($errors)) {
 	$guild = new OTS_Guild();
 	$guild->find($guild_name);
 	if(!$guild->isLoaded())
 		$errors[] = 'Guild with name <b>'.$guild_name.'</b> doesn\'t exist.';
 }
 
-if(!empty($errors))
-{
+if(!empty($errors)) {
 	$twig->display('error_box.html.twig', array('errors' => $errors));
 	$twig->display('guilds.back_button.html.twig');
 	return;
@@ -47,9 +46,8 @@ $level_in_guild = 0;
 
 $players_from_account_in_guild = array();
 $players_from_account_ids = array();
-if($logged)
-{
-	$account_players = $account_logged->getPlayers();
+if($logged) {
+	$account_players = $account_logged->getPlayersList();
 	foreach($account_players as $player)
 	{
 		$players_from_account_ids[] = $player->getId();

system/pages/online.php

@@ -22,13 +22,16 @@ $promotion = '';
 if($db->hasColumn('players', 'promotion'))
 	$promotion = '`promotion`,';
 
-$order = $_GET['order'] ?? 'name';
-if(!in_array($order, array('country', 'name', 'level', 'vocation')))
-	$order = $db->fieldName('name');
-else if($order == 'country')
-	$order = $db->tableName('accounts') . '.' . $db->fieldName('country');
-else if($order == 'vocation')
-	$order = $promotion . 'vocation ASC';
+$order = $_GET['order'] ?? 'name_asc';
+if(!in_array($order, ['country_asc', 'country_desc', 'name_asc', 'name_desc', 'level_asc', 'level_desc', 'vocation_asc', 'vocation_desc'])) {
+	$order = 'name_asc';
+}
+else if($order == 'vocation_asc' || $order == 'vocation_desc') {
+	$order = $promotion . 'vocation_' . (str_contains($order, 'asc') ? 'asc' : 'desc');
+}
+
+$orderExplode = explode('_', $order);
+$orderSql = $orderExplode[0] . ' ' . $orderExplode[1];
 
 $skull_type = 'skull';
 if($db->hasColumn('players', 'skull_type')) {
@@ -58,11 +61,11 @@ if (setting('core.online_vocations')) {
 }
 
 if($db->hasTable('players_online')) // tfs 1.0
-	$playersOnline = $db->query('SELECT `accounts`.`country`, `players`.`name`, `players`.`level`, `players`.`vocation`' . $outfit . ', `' . $skull_time . '` as `skulltime`, `' . $skull_type . '` as `skull` FROM `accounts`, `players`, `players_online` WHERE `players`.`id` = `players_online`.`player_id` AND `accounts`.`id` = `players`.`account_id`  ORDER BY ' . $order);
+	$playersOnline = $db->query('SELECT `accounts`.`country`, `players`.`name`, `players`.`level`, `players`.`vocation`' . $outfit . ', `' . $skull_time . '` as `skulltime`, `' . $skull_type . '` as `skull` FROM `accounts`, `players`, `players_online` WHERE `players`.`id` = `players_online`.`player_id` AND `accounts`.`id` = `players`.`account_id`  ORDER BY ' . $orderSql);
 else
-	$playersOnline = $db->query('SELECT `accounts`.`country`, `players`.`name`, `players`.`level`, `players`.`vocation`' . $outfit . ', ' . $promotion . ' `' . $skull_time . '` as `skulltime`, `' . $skull_type . '` as `skull` FROM `accounts`, `players` WHERE `players`.`online` > 0 AND `accounts`.`id` = `players`.`account_id`  ORDER BY ' . $order);
+	$playersOnline = $db->query('SELECT `accounts`.`country`, `players`.`name`, `players`.`level`, `players`.`vocation`' . $outfit . ', ' . $promotion . ' `' . $skull_time . '` as `skulltime`, `' . $skull_type . '` as `skull` FROM `accounts`, `players` WHERE `players`.`online` > 0 AND `accounts`.`id` = `players`.`account_id`  ORDER BY ' . $orderSql);
 
-$players_data = array();
+$players_data = [];
 $players = 0;
 $data = '';
 foreach($playersOnline as $player) {
@@ -115,7 +118,7 @@ if(count($players_data) > 0) {
 		}
 
 		if($result) {
-			$record = 'The maximum on this game world was ' . $result['record'] . ' players' . ($timestamp ? ' on ' . date("M d Y, H:i:s", $result['timestamp']) . '.' : '.');
+			$record = $result['record'] . ' player' . ($result['record'] > 1 ? 's' : '') . ($timestamp ? ' (on ' . date("M d Y, H:i:s", $result['timestamp']) . ')' : '');
 		}
 	}
 }
@@ -124,8 +127,9 @@ $twig->display('online.html.twig', array(
 	'players' => $players_data,
 	'record' => $record,
 	'vocs' => $vocs,
+	'order' => $order,
 ));
 
 //search bar
-$twig->display('online.form.html.twig');
+$twig->display('characters.form.html.twig');
 ?>

system/router.php

@@ -129,14 +129,14 @@ $dispatcher = FastRoute\cachedDispatcher(function (FastRoute\RouteCollector $r)
 		return ($a[3] < $b[3]) ? -1 : 1;
 	});
 
+	$aliases = [
+		[':int', ':string', ':alphanum'],
+		[':\d+', ':[A-Za-z0-9-_%+\' ]+', ':[A-Za-z0-9]+'],
+	];
+
 	// remove duplicates
 	// if same route pattern, but different priority
-	$routesFinal = array_filter($routesFinal, function ($a) {
-		$aliases = [
-			[':int', ':string', ':alphanum'],
-			[':\d+', ':[A-Za-z0-9-_%+\' ]+', ':[A-Za-z0-9]+'],
-		];
-
+	$routesFinal = array_filter($routesFinal, function ($a) use ($aliases) {
 		// apply aliases
 		$a[1] = str_replace($aliases[0], $aliases[1], $a[1]);
 
@@ -171,15 +171,15 @@ $dispatcher = FastRoute\cachedDispatcher(function (FastRoute\RouteCollector $r)
 			$route[0] = array_map($toUpperCase, $route[0]);
 		}
 
-		$aliases = [
-			[':int', ':string', ':alphanum'],
-			[':\d+', ':[A-Za-z0-9-_%+\' ]+', ':[A-Za-z0-9]+'],
-		];
-
 		// apply aliases
 		$route[1] = str_replace($aliases[0], $aliases[1], $route[1]);
 
-		$r->addRoute($route[0], $route[1], $route[2]);
+		try {
+			$r->addRoute($route[0], $route[1], $route[2]);
+		}
+		catch (\Exception $e) {
+			// duplicated route, just ignore
+		}
 	}
 
 	if (config('env') === 'dev') {
@@ -252,7 +252,7 @@ else {
 
 				$success = false;
 				$tmp_content = getCustomPage($pageName, $success);
-				if ($success) {
+				if ($success && $hooks->trigger(HOOK_BEFORE_PAGE_CUSTOM)) {
 					$content .= $tmp_content;
 					if (hasFlag(FLAG_CONTENT_PAGES) || superAdmin()) {
 						$pageInfo = getCustomPageInfo($pageName);
@@ -260,6 +260,8 @@ else {
 							) . $content;
 					}
 
+					$hooks->trigger(HOOK_AFTER_PAGE_CUSTOM);
+
 					$page = $pageName;
 					$file = false;
 				}
@@ -324,7 +326,9 @@ if (isset($_REQUEST['_page_only'])) {
 
 if(!isset($title)) {
 	$title = str_replace('index.php/', '', $page);
-	$title = ucfirst($title);
+	$title = str_replace(['_', '-', '/'], ' ', $page);
+
+	$title = ucwords($title);
 }
 
 if(setting('core.backward_support')) {

system/routes.php

@@ -22,11 +22,11 @@ return [
 	['GET', 'account/confirm-email/{hash:alphanum}', 'account/confirm-email.php'],
 
 	['GET', 'bans/{page:int}', 'bans.php'],
-	[['GET', 'POST'], 'characters[/{name:string}]', 'characters.php'],
-	['GET', 'changelog[/{page:int}]', 'changelog.php'],
-	[['GET', 'POST'], 'monsters[/{name:string}]', 'monsters.php'],
+	[['GET', 'POST'], 'characters/{name:[A-Za-z0-9-_%+\' \[\]]+}', 'characters.php'],
+	['GET', 'changelog/{page:int}', 'changelog.php'],
+	[['GET', 'POST'], 'monsters/{name:string}', 'monsters.php'],
 
-	[['GET', 'POST'], 'faq[/{action:string}]', 'faq.php'],
+	[['GET', 'POST'], 'faq/{action:string}', 'faq.php'],
 
 	[['GET', 'POST'], 'forum/{action:string}', 'forum.php'],
 	['GET', 'forum/board/{id:int}', 'forum/show_board.php'],

system/settings.php

@@ -19,6 +19,15 @@ $templates = Cache::remember('templates', 5 * 60, function () {
 });
 $defaultTemplate = in_array('kathrine', $templates) ? 'kathrine' : $templates[0];
 
+global $db;
+
+if (!IS_CLI) {
+	require SYSTEM . 'base.php';
+
+	$serverUrl = 'http' . (isHttps() ? 's' : '') . '://' . $baseHost;
+	$siteURL = $serverUrl . $baseDir;
+}
+
 return [
 	'name' => 'MyAAC',
 	'settings' => [
@@ -30,6 +39,13 @@ return [
 			'type' => 'section',
 			'title' => 'General'
 		],
+		'site_url' => [
+			'name' => 'Website URL',
+			'type' => 'text',
+			'desc' => 'Website address of this MyAAC instance',
+			'default' => IS_CLI ? '' : $siteURL,
+			'is_config' => true,
+		],
 		'env' => [
 			'name' => 'App Environment',
 			'type' => 'options',
@@ -674,6 +690,13 @@ Sent by MyAAC,<br/>
 			'desc' => 'Default premium points on new account',
 			'default' => 0,
 		],
+		'account_coins' => [
+			'name' => 'Default Account Coins',
+			'type' => 'number',
+			'desc' => 'Default coins on new account',
+			'hidden' => ($db && !$db->hasColumn('accounts', 'coins')),
+			'default' => 0,
+		],
 		'account_mail_change' => [
 			'name' => 'Account Mail Change Days',
 			'type' => 'number',
@@ -1039,6 +1062,12 @@ Sent by MyAAC,<br/>
 			'desc' => 'How often to update highscores from database in minutes. Too low may slow down your website.<br/>0 to disable.',
 			'default' => 15,
 		],
+		'highscores_skills_box' => [
+			'name' => 'Display Skills Box',
+			'type' => 'boolean',
+			'desc' => 'show "Choose a skill" box on the highscores (allowing peoples to sort highscores by skill)?',
+			'default' => true,
+		],
 		'highscores_vocation_box' => [
 			'name' => 'Display Vocation Box',
 			'type' => 'boolean',
@@ -1241,6 +1270,12 @@ Sent by MyAAC,<br/>
 			'desc' => '',
 			'default' => false,
 		],
+		'online_datacenter' => [
+			'name' => 'Data Center',
+			'type' => 'text',
+			'desc' => 'Server Location, will be shown on online page',
+			'default' => 'Frankfurt - Germany',
+		],
 		[
 			'type' => 'section',
 			'title' => 'Team Page'

system/src/Admin/Plugins.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace MyAAC\Admin;
+
+use GuzzleHttp\Client;
+
+class Plugins
+{
+	private string $api_base_uri = 'https://plugins.my-aac.org/api/';
+
+	public function getLatestVersions(): array
+	{
+		$client = new Client([
+			// Base URI is used with relative requests
+			'base_uri' => $this->api_base_uri,
+			// You can set any number of default request options.
+			'timeout'  => 3.0,
+		]);
+
+		$plugins = get_plugins(true);
+		foreach ($plugins as &$plugin) {
+			if (str_contains($plugin, 'disabled.')) {
+				$plugin = str_replace('disabled.', '', $plugin);
+			}
+		}
+
+		try {
+			$response = $client->get('get-latest-versions', [
+				'json' => ['plugins' => $plugins],
+			]);
+		}
+		catch (\Exception $e) {
+			error('API Error. Please try again later.');
+			return [];
+		}
+
+		$statusCode = $response->getStatusCode();
+		if ($statusCode != 200) {
+			throw new \Exception('Error getting info from plugins repository. Please try again later.');
+		}
+
+		$data = $response->getBody();
+		return json_decode($data, true);
+	}
+
+	public function setApiBaseUri(string $uri): void {
+		$this->api_base_uri = $uri;
+	}
+}

system/src/Commands/CacheClearCommand.php

@@ -17,10 +17,7 @@ class CacheClearCommand extends Command
 
 	protected function execute(InputInterface $input, OutputInterface $output): int
 	{
-		global $hooks;
-		$hooks = new Hooks();
-		$hooks->load();
-		$hooks->trigger(HOOK_INIT);
+		require SYSTEM . 'init.php';
 
 		$io = new SymfonyStyle($input, $output);
 

system/src/Commands/MailSendCommand.php

@@ -12,9 +12,10 @@ class MailSendCommand extends Command
 {
 	protected function configure(): void
 	{
-		$this->setName('mail:send')
+		$this->setName('email:send')
+			->setAliases(['mail:send'])
 			->setDescription('This command sends E-Mail to single user. Message can be provided as follows: ' . PHP_EOL
-				. '  echo "Hello World" | php sa email:send --subject="This is the subject" test@test.com')
+				. '  echo "Hello World" | php aac email:send --subject="This is the subject" test@test.com')
 			->addArgument('recipient', InputArgument::REQUIRED, 'Email, Account Name, Account id or Player Name')
 			->addOption('subject', 's', InputOption::VALUE_REQUIRED, 'Subject');
 	}

system/src/Commands/PluginInstallInstallCommand.php

@@ -12,7 +12,8 @@ class PluginInstallInstallCommand extends Command
 {
 	protected function configure(): void
 	{
-		$this->setName('plugin:install:install')
+		$this->setName('plugin:setup')
+			->setAliases(['plugin:install:install'])
 			->setDescription('This command executes the "install" part of the plugin')
 			->addArgument('plugin', InputArgument::REQUIRED, 'Plugin name');
 	}

system/src/CsrfToken.php

@@ -25,8 +25,9 @@ class CsrfToken
 	 *
 	 * @access public
 	 * @static true
+	 * @param bool $return
 	 * @return string
-	 **/
+	 */
 	public static function create(bool $return = false): string {
 		$input = '<input type="hidden" name="csrf_token" value="' . self::get() . '" />';
 		if ($return) {
@@ -58,7 +59,7 @@ class CsrfToken
 	 * @static true
 	 * @return boolean
 	 **/
-	public static function isValid($post): bool
+	public static function isValid(string|null $post): bool
 	{
 		if (!setting('core.csrf_protection')) {
 			return true;

system/src/Hook.php

@@ -38,6 +38,8 @@ class Hook
 	}
 
 	public function executeFilter(&$args) {
+		global $db, $config, $template_path, $ots, $content, $twig;
+
 		return include BASE . $this->_file;
 	}
 

system/src/Plugins.php

@@ -11,6 +11,25 @@ class Plugins {
 	private static $error = null;
 	private static $plugin_json = [];
 
+	public static function getInits()
+	{
+		return Cache::remember('plugins_inits', 10 * 60, function () {
+			$inits = [];
+			foreach(self::getAllPluginsJson() as $plugin) {
+				if (!self::getAutoLoadOption($plugin, 'init', false)) {
+					continue;
+				}
+
+				$pluginInits = glob(PLUGINS . $plugin['filename'] . '/init.php');
+				foreach ($pluginInits as $path) {
+					$inits[] = $path;
+				}
+			}
+
+			return $inits;
+		});
+	}
+
 	public static function getAdminPages()
 	{
 		return Cache::remember('plugins_admin_pages', 10 * 60, function () {
@@ -346,6 +365,25 @@ class Plugins {
 		}
 
 		$settings = [];
+		foreach (self::getAllPluginsJson() as $plugin) {
+			if (!self::getAutoLoadOption($plugin, 'settings', true)) {
+				continue;
+			}
+
+			$settingsFileName = PLUGINS . $plugin['filename'] . '/settings.php';
+			if (!is_file($settingsFileName)) {
+				continue;
+			}
+
+			$settingsFile = require $settingsFileName;
+			if (!isset($settingsFile['key'])) {
+				warning("Settings file for plugin - {$plugin['name']} does not contain 'key' field");
+				continue;
+			}
+
+			$settings[$settingsFile['key']] = ['pluginFilename' => $plugin['filename'], 'settingsFilename' => 'plugins/' . $plugin['filename'] . '/settings.php'];
+		}
+
 		foreach (self::getAllPluginsJson() as $plugin) {
 			if (isset($plugin['settings'])) {
 				$settingsFile = require BASE . $plugin['settings'];
@@ -401,8 +439,14 @@ class Plugins {
 			return false;
 		}
 
-		if (!isset($plugin_json['settings']) || !file_exists(BASE . $plugin_json['settings'])) {
-			return false;
+		$settingsFileName = PLUGINS . $plugin_json['filename'] . '/settings.php';
+		if (!is_file($settingsFileName)) {
+			if (!isset($plugin_json['settings']) || !is_file(BASE . $plugin_json['settings'])) {
+				return false;
+			}
+		}
+		else {
+			return 'plugins/' . $plugin_json['filename'] . '/settings.php';
 		}
 
 		return $plugin_json['settings'];
@@ -432,6 +476,8 @@ class Plugins {
 			return false;
 		}
 
+		$plugin_json['filename'] = $filename;
+
 		return $plugin_json;
 	}
 
@@ -486,187 +532,192 @@ class Plugins {
 		self::$plugin_json = $plugin_json;
 		if ($plugin_json == null) {
 			self::$warnings[] = 'Cannot load ' . $file_name . '. File might be not a valid json code.';
+			return false;
 		}
-		else {
-			$continue = true;
 
-			if(!isset($plugin_json['name']) || empty(trim($plugin_json['name']))) {
-				self::$error = 'Plugin "name" tag is not set.';
+		$continue = true;
+
+		if(!isset($plugin_json['name']) || empty(trim($plugin_json['name']))) {
+			self::$error = 'Plugin "name" tag is not set.';
+			return false;
+		}
+
+		if(!isset($plugin_json['version']) || empty(trim($plugin_json['version']))) {
+			self::$warnings[] = 'Plugin "version" tag is not set.';
+		}
+
+		if(isset($plugin_json['require'])) {
+			$require = $plugin_json['require'];
+
+			$myaac_satified = true;
+			if(isset($require['myaac_'])) {
+				$require_myaac = $require['myaac_'];
+				if(!Semver::satisfies(MYAAC_VERSION, $require_myaac)) {
+					$myaac_satified = false;
+				}
+			}
+			else if(isset($require['myaac'])) {
+				$require_myaac = $require['myaac'];
+				if(version_compare(MYAAC_VERSION, $require_myaac, '<')) {
+					$myaac_satified = false;
+				}
+			}
+
+			if(!$myaac_satified) {
+				self::$error = "Your AAC version doesn't meet the requirement of this plugin. Required version is: " . $require_myaac . ", and you're using version " . MYAAC_VERSION . ".";
 				return false;
 			}
 
-			if(!isset($plugin_json['version']) || empty(trim($plugin_json['version']))) {
-				self::$warnings[] = 'Plugin "version" tag is not set.';
+			$php_satisfied = true;
+			if(isset($require['php_'])) {
+				$require_php = $require['php_'];
+				if(!Semver::satisfies(phpversion(), $require_php)) {
+					$php_satisfied = false;
+				}
+			}
+			else if(isset($require['php'])) {
+				$require_php = $require['php'];
+				if(version_compare(phpversion(), $require_php, '<')) {
+					$php_satisfied = false;
+				}
 			}
 
-			if(isset($plugin_json['require'])) {
-				$require = $plugin_json['require'];
+			if(!$php_satisfied) {
+				self::$error = "Your PHP version doesn't meet the requirement of this plugin. Required version is: " . $require_php . ", and you're using version " . phpversion() . ".";
+				$continue = false;
+			}
 
-				$myaac_satified = true;
-				if(isset($require['myaac_'])) {
-					$require_myaac = $require['myaac_'];
-					if(!Semver::satisfies(MYAAC_VERSION, $require_myaac)) {
-						$myaac_satified = false;
+			$database_satisfied = true;
+			if(isset($require['database_'])) {
+				$require_database = $require['database_'];
+				if(!Semver::satisfies(DATABASE_VERSION, $require_database)) {
+					$database_satisfied = false;
+				}
+			}
+			else if(isset($require['database'])) {
+				$require_database = $require['database'];
+				if(version_compare(DATABASE_VERSION, $require_database, '<')) {
+					$database_satisfied = false;
+				}
+			}
+
+			if(!$database_satisfied) {
+				self::$error = "Your database version doesn't meet the requirement of this plugin. Required version is: " . $require_database . ", and you're using version " . DATABASE_VERSION . ".";
+				$continue = false;
+			}
+
+			if($continue) {
+				foreach($require as $req => $version) {
+					$req = strtolower(trim($req));
+					$version = trim($version);
+
+					if(in_array($req, array('myaac', 'myaac_', 'php', 'php_', 'database', 'database_'))) {
+						continue;
 					}
-				}
-				else if(isset($require['myaac'])) {
-					$require_myaac = $require['myaac'];
-					if(version_compare(MYAAC_VERSION, $require_myaac, '<')) {
-						$myaac_satified = false;
-					}
-				}
 
-				if(!$myaac_satified) {
-					self::$error = "Your AAC version doesn't meet the requirement of this plugin. Required version is: " . $require_myaac . ", and you're using version " . MYAAC_VERSION . ".";
-					return false;
-				}
+					if(in_array($req, array('php-ext', 'php-extension'))) { // require php extension
+						$tmpDisplayError = false;
+						$explode = explode(',', $version);
 
-				$php_satisfied = true;
-				if(isset($require['php_'])) {
-					$require_php = $require['php_'];
-					if(!Semver::satisfies(phpversion(), $require_php)) {
-						$php_satisfied = false;
-					}
-				}
-				else if(isset($require['php'])) {
-					$require_php = $require['php'];
-					if(version_compare(phpversion(), $require_php, '<')) {
-						$php_satisfied = false;
-					}
-				}
-
-				if(!$php_satisfied) {
-					self::$error = "Your PHP version doesn't meet the requirement of this plugin. Required version is: " . $require_php . ", and you're using version " . phpversion() . ".";
-					$continue = false;
-				}
-
-				$database_satisfied = true;
-				if(isset($require['database_'])) {
-					$require_database = $require['database_'];
-					if(!Semver::satisfies(DATABASE_VERSION, $require_database)) {
-						$database_satisfied = false;
-					}
-				}
-				else if(isset($require['database'])) {
-					$require_database = $require['database'];
-					if(version_compare(DATABASE_VERSION, $require_database, '<')) {
-						$database_satisfied = false;
-					}
-				}
-
-				if(!$database_satisfied) {
-					self::$error = "Your database version doesn't meet the requirement of this plugin. Required version is: " . $require_database . ", and you're using version " . DATABASE_VERSION . ".";
-					$continue = false;
-				}
-
-				if($continue) {
-					foreach($require as $req => $version) {
-						$req = strtolower(trim($req));
-						$version = trim($version);
-
-						if(in_array($req, array('myaac', 'myaac_', 'php', 'php_', 'database', 'database_'))) {
-							continue;
+						foreach ($explode as $item) {
+							if(!extension_loaded($item)) {
+								$errors[] = "This plugin requires php extension: " . $item . " to be installed.";
+								$tmpDisplayError = true;
+							}
 						}
 
-						if(in_array($req, array('php-ext', 'php-extension'))) { // require php extension
-							$tmpDisplayError = false;
-							$explode = explode(',', $version);
-
-							foreach ($explode as $item) {
-								if(!extension_loaded($item)) {
-									$errors[] = "This plugin requires php extension: " . $item . " to be installed.";
-									$tmpDisplayError = true;
-								}
-							}
-
-							if ($tmpDisplayError) {
-								self::$error = implode('<br/>', $errors);
-								$continue = false;
-								break;
-							}
-						}
-						else if($req == 'table') {
-							$tmpDisplayError = false;
-							$explode = explode(',', $version);
-							foreach ($explode as $item) {
-								if(!$db->hasTable($item)) {
-									$errors[] = "This plugin requires table: " . $item . " to exist in the database.";
-									$tmpDisplayError = true;
-								}
-							}
-
-							if ($tmpDisplayError) {
-								self::$error = implode('<br/>', $errors);
-								$continue = false;
-								break;
-							}
-						}
-						else if($req == 'column') {
-							$tmpDisplayError = false;
-							$explode = explode(',', $version);
-							foreach ($explode as $item) {
-								$tmp = explode('.', $item);
-
-								if(count($tmp) == 2) {
-									if(!$db->hasColumn($tmp[0], $tmp[1])) {
-										$errors[] = "This plugin requires database column: " . $tmp[0] . "." . $tmp[1] . " to exist in database.";
-										$tmpDisplayError = true;
-									}
-								}
-								else {
-									self::$warnings[] = "Invalid plugin require column: " . $item;
-								}
-							}
-
-							if ($tmpDisplayError) {
-								self::$error = implode('<br/>', $errors);
-								$continue = false;
-								break;
-							}
-						}
-						else if(strpos($req, 'ext-') !== false) {
-							$tmp = explode('-', $req);
-							if(count($tmp) == 2) {
-								if(!extension_loaded($tmp[1]) || !Semver::satisfies(phpversion($tmp[1]), $version)) {
-									self::$error = "This plugin requires php extension: " . $tmp[1] . ", version " . $version . " to be installed.";
-									$continue = false;
-									break;
-								}
-							}
-						}
-						else if(!self::is_installed($req, $version)) {
-							self::$error = "This plugin requires another plugin to run correctly. The another plugin is: " . $req . ", with version " . $version . ".";
+						if ($tmpDisplayError) {
+							self::$error = implode('<br/>', $errors);
 							$continue = false;
 							break;
 						}
 					}
-				}
-			}
+					else if($req == 'table') {
+						$tmpDisplayError = false;
+						$explode = explode(',', $version);
+						foreach ($explode as $item) {
+							if(!$db->hasTable($item)) {
+								$errors[] = "This plugin requires table: " . $item . " to exist in the database.";
+								$tmpDisplayError = true;
+							}
+						}
 
-			if($continue) {
-				if(!$zip->extractTo(BASE)) { // "Real" Install
-					self::$error = 'There was a problem with extracting zip archive to base directory.';
-					$zip->close();
-					return false;
-				}
-
-				if (isset($plugin_json['install'])) {
-					if (file_exists(BASE . $plugin_json['install'])) {
-						$db->revalidateCache();
-						require BASE . $plugin_json['install'];
-						$db->revalidateCache();
+						if ($tmpDisplayError) {
+							self::$error = implode('<br/>', $errors);
+							$continue = false;
+							break;
+						}
+					}
+					else if($req == 'column') {
+						$tmpDisplayError = false;
+						$explode = explode(',', $version);
+						foreach ($explode as $item) {
+							$tmp = explode('.', $item);
+
+							if(count($tmp) == 2) {
+								if(!$db->hasColumn($tmp[0], $tmp[1])) {
+									$errors[] = "This plugin requires database column: " . $tmp[0] . "." . $tmp[1] . " to exist in database.";
+									$tmpDisplayError = true;
+								}
+							}
+							else {
+								self::$warnings[] = "Invalid plugin require column: " . $item;
+							}
+						}
+
+						if ($tmpDisplayError) {
+							self::$error = implode('<br/>', $errors);
+							$continue = false;
+							break;
+						}
+					}
+					else if(strpos($req, 'ext-') !== false) {
+						$tmp = explode('-', $req);
+						if(count($tmp) == 2) {
+							if(!extension_loaded($tmp[1]) || !Semver::satisfies(phpversion($tmp[1]), $version)) {
+								self::$error = "This plugin requires php extension: " . $tmp[1] . ", version " . $version . " to be installed.";
+								$continue = false;
+								break;
+							}
+						}
+					}
+					else if(!self::is_installed($req, $version)) {
+						self::$error = "This plugin requires another plugin to run correctly. The another plugin is: " . $req . ", with version " . $version . ".";
+						$continue = false;
+						break;
 					}
-					else
-						self::$warnings[] = 'Cannot load install script. Your plugin might be not working correctly.';
 				}
-
-				clearCache();
-
-				return true;
 			}
 		}
 
-		return false;
+		if(!$continue) {
+			return false;
+		}
+
+		if(!$zip->extractTo(BASE)) { // "Real" Install
+			self::$error = 'There was a problem with extracting zip archive to base directory.';
+			$zip->close();
+			return false;
+		}
+
+		$install = $plugin_json['install'] ?? '';
+		if (self::getAutoLoadOption($plugin_json, 'install', true) && is_file(PLUGINS . $pluginFilename . '/install.php')) {
+			$install = 'plugins/' . $pluginFilename . '/install.php';
+		}
+
+		if (!empty($install)) {
+			if (file_exists(BASE . $install)) {
+				$db->revalidateCache();
+				require BASE . $install;
+				$db->revalidateCache();
+			}
+			else {
+				self::$warnings[] = 'Cannot load install script. Your plugin might be not working correctly.';
+			}
+		}
+
+		clearCache();
+		return true;
 	}
 
 	public static function isEnabled($pluginFileName): bool
@@ -729,15 +780,20 @@ class Plugins {
 			return false;
 		}
 
-		if(!isset($plugin_json['install'])) {
-			self::$error = "Plugin doesn't have install options defined. Skipping...";
+		$install = $plugin_json['install'] ?? '';
+		if (self::getAutoLoadOption($plugin_json, 'install', true) && is_file(PLUGINS . $plugin_name . '/install.php')) {
+			$install = 'plugins/' . $plugin_name . '/install.php';
+		}
+
+		if (empty($install)) {
+			self::$error = "This plugin doesn't seem to have install script defined.";
 			return false;
 		}
 
 		global $db;
-		if (file_exists(BASE . $plugin_json['install'])) {
+		if (file_exists(BASE . $install)) {
 			$db->revalidateCache();
-			require BASE . $plugin_json['install'];
+			require BASE . $install;
 			$db->revalidateCache();
 		}
 		else {

system/src/Settings.php

@@ -560,8 +560,8 @@ class Settings implements \ArrayAccess
 				$settingsFilePath = BASE . $settings[$pluginKeyName]['settingsFilename'];
 			}
 
-			if (!file_exists($settingsFilePath)) {
-				throw new \RuntimeException('Failed to load settings file for plugin: ' . $pluginKeyName);
+			if (!is_file($settingsFilePath)) {
+				throw new \RuntimeException('Failed to load settings file for plugin: ' . $pluginKeyName . ' (Tried: ' . $settingsFilePath . ')');
 			}
 
 			$this->settingsFile[$pluginKeyName] = require $settingsFilePath;

system/src/global.php

@@ -8,7 +8,9 @@ $i = 0;
 define('HOOK_INIT', ++$i);
 define('HOOK_STARTUP', ++$i);
 define('HOOK_BEFORE_PAGE', ++$i);
+define('HOOK_BEFORE_PAGE_CUSTOM', ++$i);
 define('HOOK_AFTER_PAGE', ++$i);
+define('HOOK_AFTER_PAGE_CUSTOM', ++$i);
 define('HOOK_FINISH', ++$i);
 define('HOOK_TIBIACOM_ARTICLE', ++$i);
 define('HOOK_TIBIACOM_BORDER_3', ++$i);
@@ -52,6 +54,7 @@ define('HOOK_ACCOUNT_MANAGE_BEFORE_GENERAL_INFORMATION', ++$i);
 define('HOOK_ACCOUNT_MANAGE_BEFORE_PUBLIC_INFORMATION', ++$i);
 define('HOOK_ACCOUNT_MANAGE_BEFORE_ACCOUNT_LOGS', ++$i);
 define('HOOK_ACCOUNT_MANAGE_BEFORE_CHARACTERS', ++$i);
+define('HOOK_ACCOUNT_MANAGE_AFTER_CHARACTERS', ++$i);
 define('HOOK_ACCOUNT_LOGIN_BEFORE_PAGE', ++$i);
 define('HOOK_ACCOUNT_LOGIN_BEFORE_ACCOUNT', ++$i);
 define('HOOK_ACCOUNT_LOGIN_AFTER_ACCOUNT', ++$i);
@@ -90,6 +93,7 @@ define('HOOK_EMAIL_CONFIRMED', ++$i);
 define('HOOK_GUILDS_BEFORE_GUILD_HEADER', ++$i);
 define('HOOK_GUILDS_AFTER_GUILD_HEADER', ++$i);
 define('HOOK_GUILDS_AFTER_GUILD_INFORMATION', ++$i);
+define('HOOK_GUILDS_AFTER_MANAGE_BUTTON', ++$i);
 define('HOOK_GUILDS_AFTER_GUILD_MEMBERS', ++$i);
 define('HOOK_GUILDS_AFTER_INVITED_CHARACTERS', ++$i);
 define('HOOK_TWIG', ++$i);

system/status.php

@@ -114,6 +114,8 @@ function updateStatus() {
 
 	// get server status and save it to database
 	$serverInfo = new OTS_ServerInfo($status_ip, $status_port);
+	$serverInfo->setTimeout(setting('core.status_timeout'));
+
 	$serverStatus = $serverInfo->status();
 	if(!$serverStatus)
 	{

system/template.php

@@ -91,7 +91,7 @@ else {
 			$file = BASE . $template_path . '/layout_config.ini';
 		}
 
-		$template_ini = parse_ini_file($file);
+		$template_ini = parse_ini_file($file, true);
 		unset($file);
 
 		if ($cache->enabled()) {

system/templates/account.change-email.html.twig

@@ -28,7 +28,7 @@ Please enter your password and the new email address. Make sure that you enter a
 		<td>
 			<table border="0" cellspacing="0" cellpadding="0">
 				<tr>
-					<td style="border:0px;">
+					<td style="border:0;">
 						<form id="form" action="{{ getLink('account/change-email') }}" method="post">
 							{{ csrf() }}
 							<input type="hidden" name="changeemailsave" value="1"/>
@@ -40,14 +40,14 @@ Please enter your password and the new email address. Make sure that you enter a
 		</td>
 		<td>
 			<table border="0" cellspacing="0" cellpadding="0">
-				<form action="{{ getLink('account/manage') }}" method="post">
-					{{ csrf() }}
-					<tr>
-						<td style="border:0px;">
+				<tr>
+					<td style="border:0;">
+						<form action="{{ getLink('account/manage') }}" method="post">
+							{{ csrf() }}
 							{{ include('buttons.back.html.twig') }}
-						</td>
-					</tr>
-				</form>
+						</form>
+					</td>
+				</tr>
 			</table>
 		</td>
 	</tr>