Character CP

Registe · Jul 11, 2009

Heey i dont understand the ban and unban wtf?

Mootie · Jul 11, 2009

Registe said:
Heey i dont understand the ban and unban wtf?

Necrooo o:

On topic:
This cp is 100% sql injection vulnerable. I've seen many big private servers using it and I've got an admin account on ones like musara flyff, lanzflyff, ect. I wont do harm with them, but I'm doing this to show you people that sql injections can be powerful.

There are many ways to prevent this. It isn't that hard to code one yourself with a bit of research, but if you want the easy way, there are many on google.

Cookies+an input scanner system is a nice way.

Just a word of advice to all private servers.

Registe · Jul 11, 2009

Re: [WEB][Rhisis]Character CP

caja said:

And then the location

PHP:

header("Location: changejob.php");

Example

PHP:

		if ($act == 'transy')
		{
			$id = $_GET["charid"];
			$matchrows = mysql_query("SELECT * FROM characters AS c INNER JOIN accounts AS a ON a.username = c.accountname WHERE c.id = $id AND a.username = '$user'") or die(mysql_error());
			$checkrows = mysql_num_rows($matchrows);
			if ($checkrows != 0)
			{
				$id = $_GET["charid"];
				$query = mysql_query("SELECT * FROM characters WHERE id = $id") or die(mysql_error());
				$get = mysql_fetch_array($query);
				$sex = $get['sex'];
				
				if ($sex == 0) 
				{ 
				mysql_query("UPDATE characters SET sex = 1 WHERE id = $id") or die(mysql_error()); 
				header("Location: changejob.php");
				}
				if ($sex == 1) 
				{ 
				mysql_query("UPDATE characters SET sex = 0 WHERE id = $id") or die(mysql_error()); 
				header("Location: changejob.php");
				}
			}
		}

Normal user can't see admin panel

In config.php write this

PHP:

// access levels
$gmalvl = 800; // GM Control Panel
$adminalvl = 1000; // Admin Control Panel

Then go to changejob and add this

PHP:

		$query = mysql_query("SELECT * FROM accounts WHERE username = '$user'") or die(mysql_error()); //REMEMBER query!
		$fetch = mysql_fetch_assoc($query);
		$access = $fetch['accesslevel'];
		echo "<table style='margin-top: 5px; border-style: inset; border-width: 1px; border-spacing: 0px; font-size: 9pt;' width='98%' height='25' align='center'><tr valign='center'><td>";
		echo "<div style='float: left; margin-left: 5px;'><b>Welcome $user     </b>";
		echo "  <a href='http://yourweb.com'>Home</a>  <font size='1pt'>|</font>";
		echo "  <a href='changejob.php?a=senha'>Change Password</a>  <font size='1pt'>|</font>";
		echo "  <a href='http://yourchat.com'>Live Chat</a>  <font size='1pt'>|</font>";
		echo "  <a href='logout.php'>Logout</a></div>";
		echo "</td></tr></table>";
		if (($access >= $gmalvl) && ($access < $adminalvl)) 
		{ 
			echo "<table style='margin-top: 2px; border-style: inset; border-width: 1px; border-spacing: 0px; font-size: 9pt;' width='98%' height='25' align='center'><tr valign='center'><td>";
			echo "  <b>GM Options:</b>      <a href='changejob.php?a=ban'>Ban Account/IP!</a>  ";
			echo "</td></tr></table>";
		}	
		else if (($access >= $adminalvl) && ($access > $gmalvl)) 
		{ 
			echo "<table style='margin-top: 2px; border-style: inset; border-width: 1px; border-spacing: 0px; font-size: 9pt;' width='98%' height='25' align='center'><tr valign='center'><td>";
			echo "  <b>Admin Options:</b>      <a href='changejob.php?a=ban'>Ban Account/IP!</a>  ";
			echo "<font size='1pt'>|</font>  <a href='changejob.php?a=adpanel'>Admin Panel</a>  ";
			echo "<font size='1pt'>|</font>  <a href='changejob.php?a=dbcontrol'>Database Controller</a>  ";
			echo "</td></tr></table>";
		}

Ban/Unban account
Add this

PHP:

		if ($act == 'ban')
		{
			$success = $_GET["playerbaned"];
			$query = mysql_query("SELECT * FROM accounts WHERE username = '$user'") or die(mysql_error());
			$get = mysql_fetch_array($query);
			$access = $get['accesslevel'];
			if ($access >= 800)
			{
				echo "<fieldset><legend>  <b><a href='changejob.php'>BAN PLAYER</a></b>  </legend>";
				echo "<center><b>Warning</b>: Character name and the account of the character will be banned!<br><br>";
				echo '<form method="post" action="changejob.php?a=doban">';
				echo '<b>Character Name:</b>: <input type="text" name="charban">';
				if ($success == 1) { echo '<input type="submit" value="Ban Player" name="Ban Player"> <h3>Account has been Banned!</h3>'; }
				ELSE if ($success == 2) { echo '<input type="submit" value="Ban Player" name="Ban Player"> <h3>Character does not exist!</h3>'; }
				else { echo '<input type="submit" value="Ban Player" name="Ban Player">'; }
				echo '</form></center>';
				echo '<center><a href="changejob.php?a=listbans"><b>View all banned accounts</b></a>';
				echo "</fieldset>";
			}
			ELSE if ($access < $gmalvl)
			{
				echo "<center><h3>No acess for this area!</h3></center>";
			}
		}
		if ($act == 'listbans')
		{
			$query = mysql_query("SELECT * FROM accounts WHERE username = '$user'") or die(mysql_error());
			$get = mysql_fetch_array($query);
			$access = $get['accesslevel'];
			if ($access >= $gmalvl)
			{
				$checkbans = mysql_query("SELECT * FROM accounts WHERE accesslevel <= 0 ORDER BY id ASC") or die(mysql_error());
				$getlist = mysql_num_rows($checkbans);
				if ($getlist == 0)
				{
					echo "<fieldset><legend>  <b> <a href='changejob.php'>BAN LIST</a> </b>  </legend>";
					echo "<b>Click the user to remove the Ban!</b>";
					echo "<br><br>";
					echo "</fieldset>";
				}
				else
				{
					echo "<fieldset><legend>  <b> <a href='changejob.php'>BAN LIST</a> </b>  </legend>";
					echo " <br>";
					$listem = $getlist;
					while ($fetch = mysql_fetch_assoc($checkbans))
					{
						$listem--;
						$loginname = $fetch['username'];
						$id = $fetch['id'];
						
						echo "<br><a href='changejob.php?a=unban&id=$id'>$loginname</a> (Characters: ";
						
						$checkchars = mysql_query("SELECT * FROM characters WHERE accountname = '$loginname'") or die(mysql_error());
						$getcharlist = mysql_num_rows($checkchars);
						if ($checkchars == 0)
							echo "None";
						else 
						$listchars = $getcharlist;
						while ($get = mysql_fetch_assoc($checkchars))
						{
							$listchars--;
							$charname = $get['charname'];
							
							echo $charname;
							if ($listchars != 0) { echo ", "; }
						}
							
						echo ")";
						if ($listem != 0) { echo ""; }
					}
					if ($checkbans != 0)
					{
						echo "</fieldset>";
					}
				}
			}
			ELSE if ($access < $gmalvl)
			{
				echo "<center><h3>No acess for this area!</h3></center>";
			}
		}
		if ($act == 'unban')
		{
			$query = mysql_query("SELECT * FROM accounts WHERE username = '$user'") or die(mysql_error());
			$get = mysql_fetch_array($query);
			$access = $get['accesslevel'];
			if ($access >= $gmalvl)
			{
				$id = $_GET["id"];
				
				$unban = mysql_query("UPDATE accounts SET accesslevel = 100 WHERE id = '$id'") or die(mysql_error());
				header("Location: changejob.php?a=listbans");
			}
			ELSE if ($access < $gmalvl)
			{
				echo "<center><h3>No rights for this area!</h3></center>";
			}
		}
		if ($act == 'doban')
		{
			$query = mysql_query("SELECT * FROM accounts WHERE username = '$user'") or die(mysql_error());
			$get = mysql_fetch_array($query);
			$access = $get['accesslevel'];
			if ($access >= $gmalvl)
			{
				$chartoban = stripslashes($_POST["charban"]);
				if(!empty($_POST["charban"]) && !empty($_POST["charbanres"])){
					if (isSet($_POST["charban"]) ? trim($_POST['charban'])  : '')
					{
						if(preg_match("/^[0-9a-zA-Z_]{5,}$/", $_POST["charban"]) === 0)
						{
							unset($_POST["charban"]);
							header("Location: changejob.php?a=ban&playerbaned=2");
						}
						else
						{
						
							$banreason = htmlspecialchars($_POST["charbanres"]); 
							$findchar = mysql_query("SELECT * FROM characters WHERE charname = '$chartoban'") or die(mysql_error());
							$checkchar = mysql_num_rows($findchar);
							if ($checkchar == 0)
							{
								echo "<center><h3>This character could not be found!</h3></center>";
							}
							else
							{
								$query = mysql_query("SELECT * FROM characters WHERE charname = '$chartoban'") or die(mysql_error());
								$getacc = mysql_fetch_array($query);
								$account = $getacc['accountname'];
								
								$doban = mysql_query("UPDATE accounts SET accesslevel = 0 , bancomment='".$banreason."' WHERE username = '$account'") or die(mysql_error());
								unset($_POST["charban"]);
								header("Location: changejob.php?a=ban&playerbaned=1");
							}
						}
					}
					else
					{
						echo "<center><h3>Please enter an existing character!</h3></center>";
					}
				}else{
				
					echo "<center><h3>Character Name and enter!</h3></center>";
				
				}
			}
			ELSE if ($access < $gmalvl)
			{
				echo "<center><h3>No rights for this area!</h3></center>";
			}
		}

This is what i dont get :glare:

FrostElite · Jul 11, 2009

Good job on the Necro Registe

Registe · Jul 11, 2009

What is Necro?D

:

BBim · Jul 11, 2009

mootie said:
Just a word of advice to all private servers.

I already tryied to tell that to people, most of them ignore because they cant make a new one and nobody released a fix for it.

FrostElite said:
Good job on the Necro Registe

Good job on the Spam FrostElite

Mootie · Jul 11, 2009

BBim said:
I already tryied to tell that to people, most of them ignore because they cant make a new one and nobody released a fix for it.

Good job on the Spam FrostElite

I have a fix for it. When my brother stops fantasizing about Megan Fox Ill release it. :3
(hint: not anytime soon.)

Registe · Jul 11, 2009

BBim said:
I already tryied to tell that to people, most of them ignore because they cant make a new one and nobody released a fix for it.

Good job on the Spam FrostElite

I hate u guys -.- (joking)

FlyFFLover · Jul 29, 2009

Got Any Kinda Voting Panel I Can Have,?
Realy Need One,Please Send Link

Thank`s :O Nice Work There

!

Blackbox · Jul 29, 2009

FlyFFLover said:
Got Any Kinda Voting Panel I Can Have,?
Realy Need One,Please Send Link

Thank`s :O Nice Work There !

http://forum.ragezone.com/5148534-post63.html

Can you do less begging/leeching/spamming?

kenneth308 · Aug 4, 2009

whats the difference of

Character CP for Rhisis

AND

Character CP for Cali

?

BBim · Aug 4, 2009

kenneth308 said:
whats the difference of

Character CP for Rhisis

AND

Character CP for Cali

?

Rhisis is one server file, with own db structure, Caali is another, with another db structure, since a CP needs to connect to db, they must have the correct table and fields name.

Atreyia · Aug 5, 2009

How exactly do I add this?

mverma22 · Aug 6, 2009

I just have one Tiny problem with your amazing CP. The rebirth doesnt work for me. Even when My Charecter is 120 - H with more than 500m in inventory. I somehow got it to work after setting $rebirthcost to 0, but then what happens in that when I rebirth it takes all the money from my inventory. It would be awesome if you could offer me a solution to this.

ihton · Aug 8, 2009

Doh, I have some problems...
Any admin option works properly (It doesn't work, xD)

Character CP

Registe

Newbie Spellweaver

Mootie

Not working on UnitedFlyf

Registe

Newbie Spellweaver

FrostElite

Ragezone OG

Registe

Newbie Spellweaver

BBim

Divine Celestial

Mootie

Not working on UnitedFlyf

Registe

Newbie Spellweaver

FlyFFLover

Initiate Mage

Blackbox

Found a place to live.

kenneth308

Newbie Spellweaver

BBim

Divine Celestial

Atreyia

Experienced Elementalist

mverma22

Initiate Mage

ihton

Newbie Spellweaver

RaGEZONE Sponsor

About RaGEZONE

Forum Statistics

RaGEZONE Partners