[8] - Show ban and mute info to users

src/acore-wp-plugin/src/Components/AdminPanel/Pages/ElunaSettings.php

@@ -6,6 +6,7 @@
     <h2> <?= __('AzerothCore Settings', Opts::I()->page_alias) ?></h2>
     <p>Configure database connection for Eluna script that need use of the CMS.</p>
     <form name="form-acore-eluna-settings" method="post" action="">
+        <?php wp_nonce_field('acore_eluna_settings_save', 'acore_eluna_settings_nonce'); ?>
         <div class="row">
             <div class="col-sm-6">
                 <div class="card p-0">

src/acore-wp-plugin/src/Components/AdminPanel/Pages/PVPRewards.php

@@ -14,6 +14,7 @@
                     <h5>Give rewards</h5>
                     <hr>
                     <form name="pvp-rewards" method="post" id="pvp-rewards" class="initial-form hide-if-no-js">
+                        <?php wp_nonce_field('acore_pvp_rewards_save', 'acore_pvp_rewards_nonce'); ?>
                         <input type="hidden" name="page" value="<?= ACORE_SLUG . '-pvp-rewards'; ?>" />
                         <table class="form-table table table-borderless" role="presentation">
                             <tbody>

src/acore-wp-plugin/src/Components/AdminPanel/SettingsController.php

@@ -44,6 +44,8 @@ public function loadSettings() {
             // If they did, this hidden field will be set to 'Y'
 
             if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+                check_admin_referer('acore_realm_settings_save', 'acore_realm_settings_nonce');
+
                 foreach (Opts::I()->getConfs() as $key => $value) {
                     if (isset($_POST[$key])) {
                         $this->storeConf($key, $_POST[$key]);
@@ -84,6 +86,8 @@ public function loadElunaSettings() {
             // If they did, this hidden field will be set to 'Y'
 
             if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+                check_admin_referer('acore_eluna_settings_save', 'acore_eluna_settings_nonce');
+
                 foreach (Opts::I()->getConfs() as $key => $value) {
                     if (isset($_POST[$key])) {
                         $this->storeConf($key, $_POST[$key]);
@@ -131,6 +135,7 @@ public function loadPvpRewards() {
         //! DEV NOTE: Put the rest of stuff within try { ... } check to handle every exception properly
         try {
             if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+                check_admin_referer('acore_pvp_rewards_save', 'acore_pvp_rewards_nonce');
                 global $wpdb;
                 $tableResult = $wpdb->query("CREATE TEMPORARY TABLE temp_pvp_rewards (
                 `account` VARCHAR(255) COLLATE utf8_unicode_ci,
@@ -385,6 +390,13 @@ public function loadTools() {
         //! DEV NOTE: Put the rest of stuff within try { ... } check to handle every exception properly
         try {
             if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+                check_admin_referer('acore_tools_save', 'acore_tools_nonce');
+
+                // If the thresholds sentinel is present but no rows were submitted, clear them
+                if (isset($_POST['acore_name_unlock_thresholds_present']) && !isset($_POST['acore_name_unlock_thresholds'])) {
+                    $this->storeConf('acore_name_unlock_thresholds', []);
+                }
+
                 foreach (Opts::I()->getConfs() as $key => $value) {
                     if (isset($_POST[$key])) {
                         if ($key == 'acore_name_unlock_allowed_banned_names_table') {

src/acore-wp-plugin/src/Components/CharactersMenu/CharactersController.php

@@ -14,30 +14,81 @@ public function __construct() {
 
     public function loadHome() {
         if ($_SERVER["REQUEST_METHOD"] == "POST") {
-            $this->saveCharacterOrder();
-            ?>
-            <div class="updated"><p><strong>Character settings succesfully saved.</strong></p></div>
-            <?php
+            check_admin_referer('acore_character_order', 'acore_character_order_nonce');
+            if (isset($_POST["acore_reset_order"])) {
+                $this->resetCharacterOrder();
+                ?>
+                <div class="updated"><p><strong>Character order reset successfully.</strong></p></div>
+                <?php
+            } else {
+                $this->saveCharacterOrder();
+                ?>
+                <div class="updated"><p><strong>Character settings successfully saved.</strong></p></div>
+                <?php
+            }
         }
 
         $accId = ACoreServices::I()->getAcoreAccountId();
+        if (!$accId) {
+            echo $this->getView()->getHomeRender([], 0, null);
+            return;
+        }
+
+        $conn  = ACoreServices::I()->getCharacterEm()->getConnection();
+
         $query = "SELECT
-            `guid`, `name`, `order`, `race`, `class`, `level`, `gender`
-            FROM `characters`
-            WHERE `characters`.`deleteDate` IS NULL AND `account` = $accId
-            ORDER BY COALESCE(`order`, `guid`)
+            c.`guid`, c.`name`, c.`order`, c.`race`, c.`class`, c.`level`, c.`gender`,
+            cb.`bandate`   AS `ban_bandate`,
+            cb.`unbandate` AS `ban_unbandate`
+            FROM `characters` c
+            LEFT JOIN `character_banned` cb
+                ON cb.`guid` = c.`guid`
+               AND cb.`active` = 1
+               AND (cb.`unbandate` = 0 OR cb.`unbandate` = cb.`bandate` OR cb.`unbandate` > UNIX_TIMESTAMP())
+            WHERE c.`deleteDate` IS NULL AND c.`account` = ?
+            ORDER BY (c.`order` IS NULL), c.`order`, c.`guid`
         ";
-        $conn = ACoreServices::I()->getCharacterEm()->getConnection();
-        $queryResult = $conn->executeQuery($query);
-        $chars = $queryResult->fetchAllAssociative();
+        $chars = $conn->executeQuery($query, [$accId])->fetchAllAssociative();
+
+        $authConn = ACoreServices::I()->getAccountEm()->getConnection();
+
+        $muteRow  = $authConn
+            ->executeQuery("SELECT `mutetime` FROM `account` WHERE `id` = ?", [$accId])
+            ->fetchAssociative();
+        $mutetime = $muteRow ? intval($muteRow['mutetime']) : 0;
+        // Negative = pending mute (seconds magnitude, applied on next login); positive = Unix timestamp expiry
 
-        echo $this->getView()->getHomeRender($chars);
+        $accBanRow = $authConn
+            ->executeQuery(
+                "SELECT `bandate`, `unbandate` FROM `account_banned`
+                 WHERE `id` = ? AND `active` = 1
+                   AND (`unbandate` = 0 OR `unbandate` = `bandate` OR `unbandate` > UNIX_TIMESTAMP())
+                 ORDER BY `bandate` DESC LIMIT 1",
+                [$accId]
+            )
+            ->fetchAssociative();
+
+        echo $this->getView()->getHomeRender($chars, $mutetime, $accBanRow);
     }
 
     public function getView() {
         return $this->view;
     }
 
+    private function resetCharacterOrder() {
+        $accId = ACoreServices::I()->getAcoreAccountId();
+        $accId = is_numeric($accId) ? (int) $accId : 0;
+        if ($accId <= 0) {
+            return;
+        }
+        $conn = ACoreServices::I()->getCharacterEm()->getConnection();
+        $stmt = $conn->prepare(
+            "UPDATE `characters` SET `order` = NULL WHERE `account` = ? AND `deleteDate` IS NULL"
+        );
+        $stmt->bindValue(1, $accId);
+        $stmt->executeQuery();
+    }
+
     private function saveCharacterOrder() {
         if (!isset($_POST) || !isset($_POST["characterorder"])) {
             return;

src/acore-wp-plugin/src/Components/CharactersMenu/CharactersMenu.php

@@ -3,6 +3,7 @@
 namespace ACore\Components\CharactersMenu;
 
 use ACore\Components\CharactersMenu\CharactersController;
+use ACore\Manager\ACoreServices;
 
 add_action('init', __NAMESPACE__ . '\\characters_menu_init');
 
@@ -25,7 +26,35 @@ public static function I()
 
     function acore_characters_menu()
     {
-        add_submenu_page('profile.php', 'Characters', 'Characters', 'read', ACORE_SLUG . '-characters-menu', array($this, 'acore_characters_menu_page'));
+        $menuTitle = 'Characters';
+        try {
+            $accId    = ACoreServices::I()->getAcoreAccountId();
+            if (!$accId) throw new \Exception('no account');
+            $authConn = ACoreServices::I()->getAccountEm()->getConnection();
+            $now      = time();
+
+            $isBanned = (bool) $authConn->executeQuery(
+                "SELECT 1 FROM `account_banned`
+                 WHERE `id` = ? AND `active` = 1
+                   AND (`unbandate` = 0 OR `unbandate` = `bandate` OR `unbandate` > UNIX_TIMESTAMP())
+                 LIMIT 1", [$accId]
+            )->fetchOne();
+
+            if ($isBanned) {
+                $menuTitle .= ' <span style="background:#dc3545;color:#fff;font-size:9px;font-weight:700;padding:1px 5px;border-radius:3px;vertical-align:middle;text-transform:uppercase;">Banned</span>';
+            } else {
+                $muteRow  = $authConn->executeQuery("SELECT `mutetime` FROM `account` WHERE `id` = ?", [$accId])->fetchAssociative();
+                $mutetime = $muteRow ? intval($muteRow['mutetime']) : 0;
+                $isMuted  = $mutetime < 0 || $mutetime > $now;
+                if ($isMuted) {
+                    $menuTitle .= ' <span style="background:#ffc107;color:#000;font-size:9px;font-weight:700;padding:1px 5px;border-radius:3px;vertical-align:middle;text-transform:uppercase;">Muted</span>';
+                }
+            }
+        } catch (\Throwable $e) {
+            // silently skip badge on DB error
+        }
+
+        add_submenu_page('profile.php', 'Characters', $menuTitle, 'read', ACORE_SLUG . '-characters-menu', array($this, 'acore_characters_menu_page'));
     }
 
     function acore_characters_menu_page()
@@ -40,4 +69,7 @@ function characters_menu_init()
     $charactersMenu = CharactersMenu::I();
 
     add_action('admin_menu', array($charactersMenu, 'acore_characters_menu'));
+    add_action('admin_head', function () {
+        echo '<style>#adminmenu a[href*="acore-characters-menu"]{display:flex!important;align-items:center!important;justify-content:space-between!important;}</style>';
+    });
 }