Skip to content

[7 / 7] - Admin settings + Cross-site request forgery / Nonces #204

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TheSCREWEDSoftware wants to merge 7 commits into
base: master
Choose a base branch
from
Open

[7 / 7] - Admin settings + Cross-site request forgery / Nonces #204

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d56d53d
Profile theming: dark mode toggle, shared CSS, character colour helper
TheSCREWEDSoftware Jun 23, 2026
ba1c597
Characters menu: clickable rows, reset-order, CSRF nonce, escaping
TheSCREWEDSoftware Jun 23, 2026
167a8cf
Mail Return: redesigned layout, subject escaping, empty-state reset
TheSCREWEDSoftware Jun 23, 2026
6f4f17b
Item Restoration: redesigned page, ownership checks (IDOR), input val…
TheSCREWEDSoftware Jun 23, 2026
3fb9994
Misc menus: Unstuck nonce/data, Resurrection Scroll, RAF nonce + icon…
TheSCREWEDSoftware Jun 23, 2026
c4263c7
Security tab: password change, 2FA (website/in-game/admin/email), con…
TheSCREWEDSoftware Jun 23, 2026
80e07dc
Admin: Realm Settings revamp (modules panel) + CSRF nonces on all set…
TheSCREWEDSoftware Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/acore-wp-plugin/src/Components/AdminPanel/Pages/ElunaSettings.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
<h2> <?= __('AzerothCore Settings', Opts::I()->page_alias) ?></h2>
<p>Configure database connection for Eluna script that need use of the CMS.</p>
<form name="form-acore-eluna-settings" method="post" action="">
<?php wp_nonce_field('acore_eluna_settings_save', 'acore_eluna_settings_nonce'); ?>
<div class="row">
<div class="col-sm-6">
<div class="card p-0">
Expand Down
1 change: 1 addition & 0 deletions src/acore-wp-plugin/src/Components/AdminPanel/Pages/PVPRewards.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
<h5>Give rewards</h5>
<hr>
<form name="pvp-rewards" method="post" id="pvp-rewards" class="initial-form hide-if-no-js">
<?php wp_nonce_field('acore_pvp_rewards_save', 'acore_pvp_rewards_nonce'); ?>
Comment thread
TheSCREWEDSoftware marked this conversation as resolved.
<input type="hidden" name="page" value="<?= ACORE_SLUG . '-pvp-rewards'; ?>" />
<table class="form-table table table-borderless" role="presentation">
<tbody>
Expand Down
614 changes: 376 additions & 238 deletions src/acore-wp-plugin/src/Components/AdminPanel/Pages/RealmSettings.php
View file
Open in desktop

Large diffs are not rendered by default.

583 changes: 515 additions & 68 deletions src/acore-wp-plugin/src/Components/AdminPanel/Pages/Tools.php
View file
Open in desktop

Large diffs are not rendered by default.

7 changes: 7 additions & 0 deletions src/acore-wp-plugin/src/Components/AdminPanel/SettingsController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,8 @@ public function loadSettings() {
// If they did, this hidden field will be set to 'Y'

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
check_admin_referer('acore_realm_settings_save', 'acore_realm_settings_nonce');

foreach (Opts::I()->getConfs() as $key => $value) {
if (isset($_POST[$key])) {
$this->storeConf($key, $_POST[$key]);
Expand Down Expand Up @@ -84,6 +86,8 @@ public function loadElunaSettings() {
// If they did, this hidden field will be set to 'Y'

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
check_admin_referer('acore_eluna_settings_save', 'acore_eluna_settings_nonce');

foreach (Opts::I()->getConfs() as $key => $value) {
if (isset($_POST[$key])) {
$this->storeConf($key, $_POST[$key]);
Expand Down Expand Up @@ -131,6 +135,7 @@ public function loadPvpRewards() {
//! DEV NOTE: Put the rest of stuff within try { ... } check to handle every exception properly
try {
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
check_admin_referer('acore_pvp_rewards_save', 'acore_pvp_rewards_nonce');
global $wpdb;
$tableResult = $wpdb->query("CREATE TEMPORARY TABLE temp_pvp_rewards (
`account` VARCHAR(255) COLLATE utf8_unicode_ci,
Expand Down Expand Up @@ -385,6 +390,8 @@ public function loadTools() {
//! DEV NOTE: Put the rest of stuff within try { ... } check to handle every exception properly
try {
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
check_admin_referer('acore_tools_save', 'acore_tools_nonce');

foreach (Opts::I()->getConfs() as $key => $value) {
if (isset($_POST[$key])) {
if ($key == 'acore_name_unlock_allowed_banned_names_table') {
Expand Down
26 changes: 22 additions & 4 deletions src/acore-wp-plugin/src/Components/CharactersMenu/CharactersController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,18 @@ public function __construct() {

public function loadHome() {
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$this->saveCharacterOrder();
?>
<div class="updated"><p><strong>Character settings succesfully saved.</strong></p></div>
<?php
check_admin_referer('acore_character_order', 'acore_character_order_nonce');
if (isset($_POST["acore_reset_order"])) {
$this->resetCharacterOrder();
?>
<div class="updated"><p><strong>Character order reset successfully.</strong></p></div>
<?php
} else {
$this->saveCharacterOrder();
?>
<div class="updated"><p><strong>Character settings succesfully saved.</strong></p></div>
<?php
}
}

$accId = ACoreServices::I()->getAcoreAccountId();
Expand All @@ -38,6 +46,16 @@ public function getView() {
return $this->view;
}

private function resetCharacterOrder() {
$accId = ACoreServices::I()->getAcoreAccountId();
$conn = ACoreServices::I()->getCharacterEm()->getConnection();
$stmt = $conn->prepare(
"UPDATE `characters` SET `order` = NULL WHERE `account` = ? AND `deleteDate` IS NULL"
);
$stmt->bindValue(1, $accId);
$stmt->executeQuery();
}

private function saveCharacterOrder() {
if (!isset($_POST) || !isset($_POST["characterorder"])) {
return;
Expand Down
64 changes: 40 additions & 24 deletions src/acore-wp-plugin/src/Components/CharactersMenu/CharactersView.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

namespace ACore\Components\CharactersMenu;

use ACore\Utils\AcoreCharColors;

class CharactersView {
private $controller;

Expand All @@ -16,44 +18,47 @@ public function __construct($controller) {
public function getHomeRender($characters) {
ob_start();
wp_enqueue_style('bootstrap-css', '//cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css', array(), '5.1.3');
wp_enqueue_style('acore-css', ACORE_URL_PLG . 'web/assets/css/main.css', array(), '0.1');
wp_enqueue_style('acore-css', ACORE_URL_PLG . 'web/assets/css/main.css', array(), '0.5');
wp_enqueue_script('bootstrap-js', '//cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js', array(), '5.1.3');
wp_enqueue_script('jquery-ui-sortable');
?>
<div class="wrap">
<h2>Characters Settings</h2>
<p>Check some details and configure of your characters.</p>

<div class="row">
<div class="col-sm-4">
<div class="card">
<div class="card-body">
<h3>Order</h3>
<p>Change the order in which the characters appear in your in-game character selection screen.</p>
<h3>Order Character Screen</h3>
<p>Change the order in which the characters appear in your in-game character selection screen, by dragging them, matches in-game position.</p>
<hr>
<form action="" method="POST" novalidate="novalidate">
<?php wp_nonce_field('acore_character_order', 'acore_character_order_nonce'); ?>

<ul id="acore-characters-order" class="list-unstyled">
<?php foreach ($characters as $char) { ?>
<ul id="acore-characters-order" class="acore-char-list list-unstyled">
<?php $charPos = 0; foreach ($characters as $char) {
$clsStyle = AcoreCharColors::rowStyle(intval($char["class"]), intval($char["race"]));
$charPos++;
$displayPos = $char['order'] !== null ? intval($char['order']) + 1 : $charPos;
?>
<li>
<div class="menu-item-bar">
<div class="menu-item-handle ui-sortable-handle">
<span class="item-title menu-item-title"><?= $char["name"] ?></span>
<span class="item-controls">
<span class="item-type">
level <?= $char["level"] ?>&ensp;
<img src="<?= ACORE_URL_PLG . "web/assets/race/" . $char["race"] . ($char["gender"] == 0 ? "m" : "f") . ".webp"; ?>">
<img src="<?= ACORE_URL_PLG . "web/assets/class/" . $char["class"] . ".webp"; ?>">
</span>
</div>
<div class="acore-char-row" style="<?= esc_attr($clsStyle) ?>">
<span class="acore-char-pos"><?= $displayPos ?></span>
<span class="acore-char-name"><?= esc_html($char["name"]) ?></span>
<span class="acore-char-meta">
<span class="acore-level" data-exp="<?= AcoreCharColors::expansionSlug(intval($char["level"])) ?>" title="<?= esc_attr(AcoreCharColors::expansionLabel(intval($char["level"]))) ?>">Level <?= intval($char["level"]) ?></span>
<img class="race-icon" height="32" width="32" title="<?= esc_attr(AcoreCharColors::getRaceName(intval($char["race"]))) ?>" src="<?= esc_url(ACORE_URL_PLG . "web/assets/race/" . intval($char["race"]) . (intval($char["gender"]) == 0 ? "m" : "f") . ".webp") ?>">
<img class="class-icon" height="32" width="32" title="<?= esc_attr(AcoreCharColors::getClassName(intval($char["class"]))) ?>" src="<?= esc_url(ACORE_URL_PLG . "web/assets/class/" . intval($char["class"]) . ".webp") ?>">
</span>
</div>
<input name="characterorder[]" value="<?= $char["guid"] ?>">
<input type="hidden" name="characterorder[]" value="<?= esc_attr($char["guid"]) ?>">
</li>
<?php } ?>
</ul>

<?php if (!empty($characters)) { ?>
<input type="submit" name="submit" class="button button-primary" value="Save Order">
<div style="display:flex; justify-content:space-between; align-items:center; margin-top:8px;">
<input type="submit" name="submit" class="button button-primary" value="Save Order">
<input type="submit" name="acore_reset_order" class="button acore-btn-danger" value="Reset Order">
</div>
<?php } ?>
</form>
</div>
Expand All @@ -62,12 +67,23 @@ public function getHomeRender($characters) {
</div>
</div>

<script type="text/javascript">
jQuery(document).ready(function($) {
$("#acore-characters-order").sortable();
<!-- .acore-btn-danger styling lives in theme.css (shared light/dark) -->

<script>
jQuery(document).ready(function($) {
$("#acore-characters-order").sortable({
update: function(event, ui) {
var order = [];
$("#acore-characters-order li").each(function(index) {
var input = $(this).find("input[name='characterorder[]']");
order.push(input.val());
$(this).find(".acore-char-pos").text(index + 1);
});
}
});
$("#acore-characters-order").disableSelection();
});
</script>

<?php
return ob_get_clean();
}
Expand Down
4 changes: 2 additions & 2 deletions src/acore-wp-plugin/src/Components/MailReturnMenu/MailReturnController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ public static function getSentUnreadMails($charGuid)

// Get mails sent by this character that are unread by the receiver
// messageType = 0 means player mail
$query = "SELECT m.`id`, m.`subject`, m.`has_items`, m.`money`,
$query = "SELECT m.`id`, m.`subject`, m.`has_items`, m.`money`, m.`cod`,
m.`expire_time`, m.`deliver_time`,
rc.`name` AS receiver_name, rc.`race` AS receiver_race,
rc.`class` AS receiver_class, rc.`gender` AS receiver_gender,
Expand Down Expand Up @@ -94,7 +94,7 @@ public static function getSentUnreadMails($charGuid)
$placeholders = implode(',', array_fill(0, count($mailIds), '?'));
$worldDb = Opts::I()->acore_db_world_name;
$itemQuery = "SELECT mi.`mail_id`, ii.`itemEntry`, ii.`count`,
it.`name` AS item_name
it.`name` AS item_name, it.`Quality` AS item_quality
FROM `mail_items` mi
JOIN `item_instance` ii ON mi.`item_guid` = ii.`guid`
JOIN `$worldDb`.`item_template` it ON ii.`itemEntry` = it.`entry`
Expand Down
Loading
Loading