Afs-cms

[Avarian]

BETA version of 1.6 is released, I sort of know what i'm doing with the fixes and have resolved a few but there are still more. So if you know SQL-Injection/XSS then hack away and send me a report with a fix.

http://www.megaupload.com/?d=NUH4KVMW

I couldn't remember who sent me the ban fix + the guild fix so I didn't give credits but I will in the official release now that I know

 

[MrV]

Thanks! <to short>

 

[sircurse]

Was I Avarians =)
And I never see my credits in some open project, I'll appreciate it xD

And thx for release.

 

[Dragondoom]

This page rox

 

[sircurse]

@Avarians, I have one more fix, when u delete a player, it just delete the players in table "players", but dont delete his attributes "player_deaths", "player_skills", "player_items", "player_depotitems", "player_viplist", "player_storage" and "player_spells", it a long of time can take many space on database, and the Last Deaths page will show the ID of the player deletes as the player name doesnt exist anymore.

To fix that, on manager.php change:

if ( isset($_POST['delete']) ) {
    mysql_query('DELETE FROM `players` WHERE `name` = "'.$_POST['char'].'" LIMIT 1');
    mysql_query('DELETE FROM `player_skills` WHERE `player_id` = "'.$_POST['charid'].'" LIMIT 1');
    mysql_query('DELETE FROM `player_playerstorage` WHERE `player_id` = "'.$_POST['charid'].'" LIMIT 1');
    mysql_query('DELETE FROM `player_deaths` WHERE `player_id` = "'.$_POST['charid'].'" LIMIT 1');
    echo $header;
    echo 'Character <b>'.$_POST['char'].'</b> has been deleted!';

}

To:

if ( isset($_POST['delete']) ) {
    mysql_query('DELETE FROM `players` WHERE `name` = "'.$_POST['char'].'" LIMIT 1');
    mysql_query('DELETE FROM `player_deaths` WHERE `player_id` = "'.$player['id'].'"');
    mysql_query('DELETE FROM `player_depotitems` WHERE `player_id` = "'.$player['id'].'"');
    mysql_query('DELETE FROM `player_items` WHERE `player_id` = "'.$player['id'].'"');
    mysql_query('DELETE FROM `player_skills` WHERE `player_id` = "'.$player['id'].'"');
    mysql_query('DELETE FROM `playplayer_spells` WHERE `player_id` = "'.$player['id'].'"');
    mysql_query('DELETE FROM `player_storage` WHERE `player_id` = "'.$player['id'].'"');
    mysql_query('DELETE FROM `player_viplist` WHERE `player_id` = "'.$player['id'].'"');
    echo $header;
    echo 'Character <b>'.$_POST['char'].'</b> has been deleted!';

}

And I can suggest u, to make a system that delete old players that the last login is > than a specific time configured in config. Will be good to make connections to the db more fast. Many players create the account to check the server then nevermore login again. Need to clean it all time =\

 

[Avarian]

Thanks for the fix, had never noticed that before..dont know why lol Anyway I can try and work on a system that will delete old players.

Also that beta I released was apparently bugged so you can't make accounts, maybe in a few days i'll have another beta release with more security fixes.

 

[kofel]

Avarian, please, Use POT! This AAC is dangerous.

 

[Avarian]

Thanks for the info already known massively I wont be using POT and a secure release will be out sometime, but for now real life comes first

 

[JayBeee]

How far have you come on the security fixes?

 

[Avarian]

How far have you come on the security fixes?

A couple of them have been fixed already.

 

[KaczooH]

And when are you going to release bug-free and secure version? It will be a key date for they who were using your ACC. Even though, You're great! Keep doing

 

[Khaos]

@Avarians, I have one more fix, when u delete a player, it just delete the players in table "players", but dont delete his attributes "player_deaths", "player_skills", "player_items", "player_depotitems", "player_viplist", "player_storage" and "player_spells",

That's why official SVN makes use of triggers
As far as I know, TFS does not make use of them for some reason.

Thanks for the fix, had never noticed that before..dont know why lol Anyway I can try and work on a system that will delete old players.

If you used Swelia's code as a base, it's a possible reason why. Official SVN uses triggers, and that.

Avarian, please, Use POT! This AAC is dangerous.

POT is designed for SVN release, and SVN's database uses triggers for many things. So it's not a good base either.

 

[Avarian]

That's why official SVN makes use of triggers
As far as I know, TFS does not make use of them for some reason.


If you used Swelia's code as a base, it's a possible reason why. Official SVN uses triggers, and that.



POT is designed for SVN release, and SVN's database uses triggers for many things. So it's not a good base either.

TFS has used triggers since 0.2.2 I believe (virtually no one used that release because no one could get triggers to import correctly.)

@Kaczooh - Release date unknown, i'm 80% sure I will release a secure release and probably a few updates after it, but right now i'm mainly focusing on a project that i've been putting off for ages that i'm not really going to get into talking about here

 

[Khaos]

TFS has used triggers since 0.2.2 I believe (virtually no one used that release because no one could get triggers to import correctly.)

If TFS has used and is still using triggers (as your sentence suggests) like official SVN does then you do not need to delete other data since that's already managed by triggers.

But by the report given by sircuse, I conclude that is not the case. TFS does not use triggers. (As I'm not a user of TFS I cannot say completely certainly, but evidence points in that direction.)

Nobody could import it? Why, it's easy! I use SQLite and it took a single command line to import the database. I'm pretty sure that similar feat can be achieved with command line version of MySQL client. I heard there are problems with PhpMyAdmin, but that's your problem, people -- you're scared of the command line

The correct solution would be not to remove triggers, but to import the database using TFS.

 

[Kumandaro]

Hello !

I was just wondering, I saw on the first post this :

Added "Send to Temple" to manager. [Avarian]

Is it possible to disable it in the configs because this feature could kill my server in a way

 

[Ronaldino]

I got a problem with this aac....





Someone know how can I fix that? -.-

 

[Sean Larson]

you have to be more specific, are you using windows xp or windows vista or what?

 

[Ronaldino]

windows xp, engine: tfs (0.2.9 version)

 

[Sean Larson]

there is a 0.2.9 in tfs??

 

[Ronaldino]

OMG 0.2.8 then... dont be a child