Skip to content

[6 / 7] - Security tab #203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TheSCREWEDSoftware wants to merge 6 commits into
base: master
Choose a base branch
from
Open

[6 / 7] - Security tab #203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d56d53d
Profile theming: dark mode toggle, shared CSS, character colour helper
TheSCREWEDSoftware Jun 23, 2026
ba1c597
Characters menu: clickable rows, reset-order, CSRF nonce, escaping
TheSCREWEDSoftware Jun 23, 2026
167a8cf
Mail Return: redesigned layout, subject escaping, empty-state reset
TheSCREWEDSoftware Jun 23, 2026
6f4f17b
Item Restoration: redesigned page, ownership checks (IDOR), input val…
TheSCREWEDSoftware Jun 23, 2026
3fb9994
Misc menus: Unstuck nonce/data, Resurrection Scroll, RAF nonce + icon…
TheSCREWEDSoftware Jun 23, 2026
c4263c7
Security tab: password change, 2FA (website/in-game/admin/email), con…
TheSCREWEDSoftware Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
583 changes: 515 additions & 68 deletions src/acore-wp-plugin/src/Components/AdminPanel/Pages/Tools.php
View file
Open in desktop

Large diffs are not rendered by default.

26 changes: 22 additions & 4 deletions src/acore-wp-plugin/src/Components/CharactersMenu/CharactersController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,18 @@ public function __construct() {

public function loadHome() {
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$this->saveCharacterOrder();
?>
<div class="updated"><p><strong>Character settings succesfully saved.</strong></p></div>
<?php
check_admin_referer('acore_character_order', 'acore_character_order_nonce');
if (isset($_POST["acore_reset_order"])) {
$this->resetCharacterOrder();
?>
<div class="updated"><p><strong>Character order reset successfully.</strong></p></div>
<?php
} else {
$this->saveCharacterOrder();
?>
<div class="updated"><p><strong>Character settings succesfully saved.</strong></p></div>
<?php
}
}

$accId = ACoreServices::I()->getAcoreAccountId();
Expand All @@ -38,6 +46,16 @@ public function getView() {
return $this->view;
}

private function resetCharacterOrder() {
$accId = ACoreServices::I()->getAcoreAccountId();
$conn = ACoreServices::I()->getCharacterEm()->getConnection();
$stmt = $conn->prepare(
"UPDATE `characters` SET `order` = NULL WHERE `account` = ? AND `deleteDate` IS NULL"
);
$stmt->bindValue(1, $accId);
$stmt->executeQuery();
Comment thread
TheSCREWEDSoftware marked this conversation as resolved.
}

private function saveCharacterOrder() {
if (!isset($_POST) || !isset($_POST["characterorder"])) {
return;
Expand Down
64 changes: 40 additions & 24 deletions src/acore-wp-plugin/src/Components/CharactersMenu/CharactersView.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

namespace ACore\Components\CharactersMenu;

use ACore\Utils\AcoreCharColors;

class CharactersView {
private $controller;

Expand All @@ -16,44 +18,47 @@ public function __construct($controller) {
public function getHomeRender($characters) {
ob_start();
wp_enqueue_style('bootstrap-css', '//cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css', array(), '5.1.3');
wp_enqueue_style('acore-css', ACORE_URL_PLG . 'web/assets/css/main.css', array(), '0.1');
wp_enqueue_style('acore-css', ACORE_URL_PLG . 'web/assets/css/main.css', array(), '0.5');
wp_enqueue_script('bootstrap-js', '//cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js', array(), '5.1.3');
wp_enqueue_script('jquery-ui-sortable');
?>
<div class="wrap">
<h2>Characters Settings</h2>
<p>Check some details and configure of your characters.</p>

<div class="row">
<div class="col-sm-4">
<div class="card">
<div class="card-body">
<h3>Order</h3>
<p>Change the order in which the characters appear in your in-game character selection screen.</p>
<h3>Order Character Screen</h3>
<p>Change the order in which the characters appear in your in-game character selection screen, by dragging them, matches in-game position.</p>
<hr>
<form action="" method="POST" novalidate="novalidate">
<?php wp_nonce_field('acore_character_order', 'acore_character_order_nonce'); ?>

<ul id="acore-characters-order" class="list-unstyled">
<?php foreach ($characters as $char) { ?>
<ul id="acore-characters-order" class="acore-char-list list-unstyled">
<?php $charPos = 0; foreach ($characters as $char) {
$clsStyle = AcoreCharColors::rowStyle(intval($char["class"]), intval($char["race"]));
$charPos++;
$displayPos = $char['order'] !== null ? intval($char['order']) + 1 : $charPos;
?>
<li>
<div class="menu-item-bar">
<div class="menu-item-handle ui-sortable-handle">
<span class="item-title menu-item-title"><?= $char["name"] ?></span>
<span class="item-controls">
<span class="item-type">
level <?= $char["level"] ?>&ensp;
<img src="<?= ACORE_URL_PLG . "web/assets/race/" . $char["race"] . ($char["gender"] == 0 ? "m" : "f") . ".webp"; ?>">
<img src="<?= ACORE_URL_PLG . "web/assets/class/" . $char["class"] . ".webp"; ?>">
</span>
</div>
<div class="acore-char-row" style="<?= esc_attr($clsStyle) ?>">
<span class="acore-char-pos"><?= $displayPos ?></span>
<span class="acore-char-name"><?= esc_html($char["name"]) ?></span>
<span class="acore-char-meta">
<span class="acore-level" data-exp="<?= AcoreCharColors::expansionSlug(intval($char["level"])) ?>" title="<?= esc_attr(AcoreCharColors::expansionLabel(intval($char["level"]))) ?>">Level <?= intval($char["level"]) ?></span>
<img class="race-icon" height="32" width="32" title="<?= esc_attr(AcoreCharColors::getRaceName(intval($char["race"]))) ?>" src="<?= esc_url(ACORE_URL_PLG . "web/assets/race/" . intval($char["race"]) . (intval($char["gender"]) == 0 ? "m" : "f") . ".webp") ?>">
<img class="class-icon" height="32" width="32" title="<?= esc_attr(AcoreCharColors::getClassName(intval($char["class"]))) ?>" src="<?= esc_url(ACORE_URL_PLG . "web/assets/class/" . intval($char["class"]) . ".webp") ?>">
Comment thread
TheSCREWEDSoftware marked this conversation as resolved.
</span>
</div>
<input name="characterorder[]" value="<?= $char["guid"] ?>">
<input type="hidden" name="characterorder[]" value="<?= esc_attr($char["guid"]) ?>">
</li>
<?php } ?>
</ul>

<?php if (!empty($characters)) { ?>
<input type="submit" name="submit" class="button button-primary" value="Save Order">
<div style="display:flex; justify-content:space-between; align-items:center; margin-top:8px;">
<input type="submit" name="submit" class="button button-primary" value="Save Order">
<input type="submit" name="acore_reset_order" class="button acore-btn-danger" value="Reset Order">
</div>
<?php } ?>
</form>
</div>
Expand All @@ -62,12 +67,23 @@ public function getHomeRender($characters) {
</div>
</div>

<script type="text/javascript">
jQuery(document).ready(function($) {
$("#acore-characters-order").sortable();
<!-- .acore-btn-danger styling lives in theme.css (shared light/dark) -->

<script>
jQuery(document).ready(function($) {
$("#acore-characters-order").sortable({
update: function(event, ui) {
var order = [];
$("#acore-characters-order li").each(function(index) {
var input = $(this).find("input[name='characterorder[]']");
order.push(input.val());
$(this).find(".acore-char-pos").text(index + 1);
});
}
});
$("#acore-characters-order").disableSelection();
});
Comment thread
TheSCREWEDSoftware marked this conversation as resolved.
</script>

<?php
return ob_get_clean();
}
Expand Down
4 changes: 2 additions & 2 deletions src/acore-wp-plugin/src/Components/MailReturnMenu/MailReturnController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ public static function getSentUnreadMails($charGuid)

// Get mails sent by this character that are unread by the receiver
// messageType = 0 means player mail
$query = "SELECT m.`id`, m.`subject`, m.`has_items`, m.`money`,
$query = "SELECT m.`id`, m.`subject`, m.`has_items`, m.`money`, m.`cod`,
m.`expire_time`, m.`deliver_time`,
rc.`name` AS receiver_name, rc.`race` AS receiver_race,
rc.`class` AS receiver_class, rc.`gender` AS receiver_gender,
Expand Down Expand Up @@ -94,7 +94,7 @@ public static function getSentUnreadMails($charGuid)
$placeholders = implode(',', array_fill(0, count($mailIds), '?'));
$worldDb = Opts::I()->acore_db_world_name;
$itemQuery = "SELECT mi.`mail_id`, ii.`itemEntry`, ii.`count`,
it.`name` AS item_name
it.`name` AS item_name, it.`Quality` AS item_quality
FROM `mail_items` mi
JOIN `item_instance` ii ON mi.`item_guid` = ii.`guid`
JOIN `$worldDb`.`item_template` it ON ii.`itemEntry` = it.`entry`
Expand Down
108 changes: 66 additions & 42 deletions src/acore-wp-plugin/src/Components/MailReturnMenu/MailReturnView.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

namespace ACore\Components\MailReturnMenu;

use ACore\Utils\AcoreCharColors;


class MailReturnView
{
Expand All @@ -17,58 +19,80 @@ public function getMailReturnRender($chars)
ob_start();

wp_enqueue_style('bootstrap-css', '//cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css', array(), '5.1.3');
wp_enqueue_style('acore-css', ACORE_URL_PLG . 'web/assets/css/main.css', array(), '0.1');
wp_enqueue_style('acore-css', ACORE_URL_PLG . 'web/assets/css/main.css', array(), '0.5');
wp_enqueue_script('bootstrap-js', '//cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js', array(), '5.1.3');
wp_enqueue_script('jquery');
wp_enqueue_script('acore-mail-return-js', ACORE_URL_PLG . 'web/assets/mail-return/mail-return.js', array('jquery'), null, true);
wp_enqueue_script('power-js', 'https://wow.zamimg.com/widgets/power.js', array(), null, false);
wp_enqueue_script('acore-mail-return-js', ACORE_URL_PLG . 'web/assets/mail-return/mail-return.js', array('jquery'), '2.3', true);
wp_localize_script('acore-mail-return-js', 'mailReturnData', [
'mailsUrl' => rest_url(ACORE_SLUG . '/v1/mail-return/list'),
'returnUrl' => rest_url(ACORE_SLUG . '/v1/mail-return'),
'assetsUrl' => ACORE_URL_PLG . 'web/assets/',
'nonce' => wp_create_nonce('wp_rest'),
]);

?>

<div class="wrap">
<div class="col-sm-6">
<div class="card">
<div class="card-body">
<h3>Mail Return</h3>
<p>You can return sent mails that have not yet been read by the recipient in this page. Select the character, the sent mail and hit return.</p>
<hr>

<label for="mail-return-char-select"><strong>Select Character:</strong></label>
<select id="mail-return-char-select" class="form-select mb-3">
<option value="">-- Select a character --</option>
<?php foreach ($chars as $char) { ?>
<option value="<?= intval($char["guid"]) ?>" data-name="<?= esc_attr($char["name"]) ?>">
<?= esc_html($char["name"]) ?> (Level <?= intval($char["level"]) ?>)
</option>
<?php } ?>
</select>

<div id="mail-return-loading" style="display:none;" class="text-center my-3">
<div class="spinner-border text-primary" role="status">
<span class="visually-hidden">Loading...</span>
<script>const whTooltips = {colorLinks: true, iconizeLinks: true, renameLinks: true};</script>
<div class="wrap" id="acore-mail-return-page">
<div id="mail-return-layout">

<!-- Col 1: character selector - always visible, same width -->
<div id="mail-return-sidebar">
<div class="card">
<div class="card-body">
<h3>Mail Return</h3>
<p>You can return sent mails that have not yet been read by the recipient in this page. Select the character, the sent mail and hit return.</p>
<hr>

<strong>Select Character:</strong>
<ul id="acore-characters-mail" class="acore-char-list list-unstyled mt-2">
<?php foreach ($chars as $char) {
$clsStyle = AcoreCharColors::rowStyle(intval($char['class']), intval($char['race']));
?>
<li>
<button type="button" class="acore-char-row acore-char-card" data-char-guid="<?= intval($char['guid']) ?>" style="<?= esc_attr($clsStyle) ?>">
<span class="acore-char-name"><?= esc_html($char['name']) ?></span>
<span class="acore-char-meta">
<span class="acore-level" data-exp="<?= AcoreCharColors::expansionSlug(intval($char['level'])) ?>" title="<?= esc_attr(AcoreCharColors::expansionLabel(intval($char['level']))) ?>">Level <?= intval($char['level']) ?></span>
<img class="race-icon" height="32" width="32" alt="<?= esc_attr(AcoreCharColors::getRaceName(intval($char['race']))) ?>" title="<?= esc_attr(AcoreCharColors::getRaceName(intval($char['race']))) ?>" src="<?= ACORE_URL_PLG . 'web/assets/race/' . intval($char['race']) . (intval($char['gender']) == 0 ? 'm' : 'f') . '.webp' ?>">
<img class="class-icon" height="32" width="32" alt="<?= esc_attr(AcoreCharColors::getClassName(intval($char['class']))) ?>" title="<?= esc_attr(AcoreCharColors::getClassName(intval($char['class']))) ?>" src="<?= ACORE_URL_PLG . 'web/assets/class/' . intval($char['class']) . '.webp' ?>">
</span>
</button>
</li>
<?php } ?>
</ul>

<div id="mail-return-loading" style="display:none;" class="text-center my-3">
<div class="spinner-border text-primary" role="status">
<span class="visually-hidden">Loading...</span>
</div>
</div>

<!-- Empty state lives inside the card -->
<div id="mail-return-empty-wrap" style="display:none;">
<hr>
<h5>Unread Sent Mails</h5>
<p id="mail-return-empty" class="text-muted">No unread sent mails found for this character.</p>
</div>
</div>
</div>
</div><!-- /mail-return-sidebar -->

<div id="mail-return-list" style="display:none;">
<h5>Unread Sent Mails</h5>
<ul id="mail-return-items" class="list-unstyled"></ul>
<p id="mail-return-empty" style="display:none;" class="text-muted">No unread sent mails found for this character.</p>
<!-- Cols 2-3: mail list - hidden until mails are loaded by JS -->
<div id="mail-return-content">
<div class="card">
<div class="card-body">
<h5 id="mail-return-heading">Unread Sent Mails</h5>
<ul id="mail-return-items" class="list-unstyled mb-0"></ul>
</div>
</div>
</div>
</div>
</div>

<script>
var mailReturnData = {
nonce: "<?php echo esc_js(wp_create_nonce('wp_rest')); ?>",
mailsUrl: "<?php echo esc_url(get_rest_url(null, ACORE_SLUG . '/v1/mail-return/list')); ?>",
returnUrl: "<?php echo esc_url(get_rest_url(null, ACORE_SLUG . '/v1/mail-return')); ?>",
assetsUrl: "<?php echo esc_url(ACORE_URL_PLG . 'web/assets/'); ?>"
};
</script>
<script>var whTooltips = {colorLinks: true, iconizeLinks: true, renameLinks: true};</script>
<script src="https://wow.zamimg.com/js/tooltips.js"></script>
<?php
</div><!-- /mail-return-content -->

</div><!-- /mail-return-layout -->
</div><!-- /wrap -->

<?php
return ob_get_clean();
}
}
13 changes: 11 additions & 2 deletions src/acore-wp-plugin/src/Components/ResurrectionScrollMenu/ResurrectionScrollMenu.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,19 @@ public static function I()
return self::$instance;
}

private function isAvailable(): bool
{
if (Opts::I()->acore_resurrection_scroll != '1') {
return false;
}
$csv = get_option('acore_modules_csv', '');
$modules = $csv ? array_map('trim', explode(',', $csv)) : [];
return in_array('mod-resurrection-scroll', $modules);
}

function acore_resurrection_scroll_menu()
{
if (Opts::I()->acore_resurrection_scroll == '1') {
if ($this->isAvailable()) {
add_submenu_page('profile.php', 'Scroll of Resurrection', 'Scroll of Resurrection', 'read', ACORE_SLUG . '-resurrection-scroll', array($this, 'acore_resurrection_scroll_menu_page'));
}
}
Expand All @@ -41,6 +51,5 @@ function acore_resurrection_scroll_menu_page()
function resurrection_scroll_menu_init()
{
$menu = ResurrectionScrollMenu::I();

add_action('admin_menu', array($menu, 'acore_resurrection_scroll_menu'));
}
Loading
Loading