ajout admin panel

registration/application/include/database.php

@@ -0,0 +1,46 @@
+<?php
+/**
+ * @author Amin Mahmoudi (MasterkinG)
+ * @copyright    Copyright (c) 2019 - 2022, MsaterkinG32 Team, Inc. (https://masterking32.com)
+ * @link    https://masterking32.com
+ * @Description : It's not masterking32 framework !
+ **/
+
+use Medoo\Medoo;
+
+class database
+{
+    public static $auth;
+    public static $chars;
+
+    public static function db_connect()
+    {
+        self::$auth = new Medoo([
+            'database_type' => 'mysql',
+            'database_name' => get_config('db_auth_dbname'),
+            'server' => get_config('db_auth_host'),
+            'username' => get_config('db_auth_user'),
+            'password' => get_config('db_auth_pass'),
+            'charset' => 'utf8',
+            'collation' => 'utf8_general_ci',
+            'port' => get_config('db_auth_port')
+        ]);
+
+        foreach (get_config("realmlists") as $realm) {
+            if (!empty($realm["realmid"]) && !empty($realm["db_host"]) && !empty($realm["db_port"]) && !empty($realm["db_user"]) && !empty($realm["db_pass"]) && !empty($realm["db_name"])) {
+                self::$chars[$realm["realmid"]] = new Medoo([
+                    'database_type' => 'mysql',
+                    'database_name' => $realm["db_name"],
+                    'server' => $realm["db_host"],
+                    'username' => $realm["db_user"],
+                    'password' => $realm["db_pass"],
+                    'charset' => 'utf8',
+                    'collation' => 'utf8_general_ci',
+                    'port' => $realm["db_port"]
+                ]);
+            } else {
+                die("Missing char database required field.");
+            }
+        }
+    }
+}

registration/application/include/functions.php

@@ -0,0 +1,343 @@
+<?php
+/**
+ * @author Amin Mahmoudi (MasterkinG)
+ * @copyright    Copyright (c) 2019 - 2022, MsaterkinG32 Team, Inc. (https://masterking32.com)
+ * @link    https://masterking32.com
+ * @Description : It's not masterking32 framework !
+ **/
+
+use PHPMailer\PHPMailer\PHPMailer;
+use PHPMailer\PHPMailer\Exception;
+
+$error_msg = "";
+$success_msg = "";
+
+function getIP()
+{
+    if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
+        //ip from share internet
+        $ip = $_SERVER['HTTP_CLIENT_IP'];
+    } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+        //ip pass from proxy
+        $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
+    } else {
+        $ip = $_SERVER['REMOTE_ADDR'];
+    }
+    return $ip;
+}
+
+function get_config($name)
+{
+    global $config;
+    if (!empty($name)) {
+        if (isset($config[$name])) {
+            return $config[$name];
+        }
+    }
+    return false;
+}
+
+function error_msg($input = false)
+{
+    global $error_error;
+    if (!empty($error_error)) {
+        echo "<p class=\"alert alert-danger\">$error_error</p>";
+    } elseif (!empty($input)) {
+        $error_error = $input;
+    }
+}
+
+function success_msg($input = false)
+{
+    global $success_msg;
+    if (!empty($success_msg)) {
+        echo "<p class=\"alert alert-success\">$success_msg</p>";
+    } elseif (!empty($input)) {
+        $success_msg = $input;
+    }
+}
+
+function GetRaceID($race)
+{
+    switch ($race) {
+        case "HUMAN":
+            return 1;
+        case "ORC":
+            return 2;
+        case "DWARF":
+            return 3;
+        case "NIGHTELF":
+            return 4;
+        case "SCOURGE":
+            return 5;
+        case "TAUREN":
+            return 6;
+        case "GNOME":
+            return 7;
+        case "TROLL":
+            return 8;
+        case "BLOODELF":
+            return 10;
+        case "DRAENEI":
+            return 11;
+        default:
+            exit("error");
+    }
+}
+
+function GetClassID($class)
+{
+    switch ($class) {
+        case "WARRIOR":
+            return 1;
+        case "PALADIN":
+            return 2;
+        case "HUNTER":
+            return 3;
+        case "ROGUE":
+            return 4;
+        case "PRIEST":
+            return 5;
+        case "DEATHKNIGHT":
+            return 6;
+        case "SHAMAN":
+            return 7;
+        case "MAGE":
+            return 8;
+        case "WARLOCK":
+            return 9;
+        case "DRUID":
+            return 11;
+        default:
+            exit("<br>YOUR CHARACTER CLASS IS NOT BLIZZLIKE FOR 3.3.5a<br>");
+    }
+}
+
+function get_human_time_from_sec($seconds)
+{
+    $interval = new DateInterval("PT{$seconds}S");
+    $now = new DateTimeImmutable('now', new DateTimeZone('utc'));
+    return $now->diff($now->add($interval))->format('%a:%h:%i');
+}
+
+function send_phpmailer($email, $subject, $message)
+{
+    try {
+        $mail = new PHPMailer(true);
+        if (get_config('debug_mode')) {
+            $mail->SMTPDebug = 2;
+        }
+        $mail->isSMTP();
+        $mail->Host = get_config('smtp_host');
+        $mail->SMTPAuth = get_config('smtp_auth');
+        $mail->Username = get_config('smtp_user');
+        $mail->Password = get_config('smtp_pass');
+        $mail->SMTPSecure = get_config('smtp_secure');
+        $mail->Port = get_config('smtp_port');
+
+        //Recipients
+        $mail->setFrom(get_config('smtp_mail'));
+        $mail->addAddress($email);     // Add a recipient
+        $mail->addReplyTo(get_config('smtp_mail'));
+
+        // Content
+        $mail->isHTML(true);
+        $mail->Subject = $subject;
+        $mail->Body = $message;
+
+        $mail->send();
+    } catch (Exception $e) {
+        if (get_config('debug_mode')) {
+            echo 'Message: ' . $e->getMessage();
+        }
+    }
+    return true;
+}
+
+function generateRandomString($length = 10)
+{
+    $characters = '0123456789abcdefghijklmnopqrstuvwxyz';
+    $charactersLength = strlen($characters);
+    $randomString = '';
+    for ($i = 0; $i < $length; $i++) {
+        $randomString .= $characters[rand(0, $charactersLength - 1)];
+    }
+    return $randomString;
+}
+
+
+function RemoteCommandWithSOAP($COMMAND)
+{
+    global $soap_connection_info;
+
+    if (empty($COMMAND)) {
+        return false;
+    }
+
+    try {
+        $conn = new SoapClient(NULL, array(
+            'location' => 'http://' . get_config('soap_host') . ':' . get_config('soap_port') . '/',
+            'uri' => get_config('soap_uri'),
+            'style' => get_config('soap_style'),
+            'login' => get_config('soap_username'),
+            'password' => get_config('soap_password')
+        ));
+        $conn->executeCommand(new SoapParam($COMMAND, 'command'));
+        unset($conn);
+        return true;
+    } catch (Exception $e) {
+        return false;
+    }
+}
+
+function validate_hcaptcha($value)
+{
+    try {
+        $data = array(
+            'secret' => get_config('captcha_secret'),
+            'response' => $_POST['h-captcha-response']
+        );
+        $verify = curl_init();
+        curl_setopt($verify, CURLOPT_URL, "https://hcaptcha.com/siteverify");
+        curl_setopt($verify, CURLOPT_POST, true);
+        curl_setopt($verify, CURLOPT_POSTFIELDS, http_build_query($data));
+        curl_setopt($verify, CURLOPT_RETURNTRANSFER, true);
+        $response = curl_exec($verify);
+        $responseData = json_decode($response);
+        if ($responseData->success) {
+            return true;
+        }
+    } catch (Exception $e) {
+    }
+
+    return false;
+}
+
+function validate_recaptcha($value)
+{
+    try {
+        $verify = curl_init();
+        curl_setopt($verify, CURLOPT_URL, "https://www.google.com/recaptcha/api/siteverify?secret=" . get_config('captcha_secret') . "&response=" . $_POST['g-recaptcha-response']);
+        curl_setopt($verify, CURLOPT_RETURNTRANSFER, true);
+        $response = curl_exec($verify);
+        $responseData = json_decode($response, true);
+        if ($responseData["success"] == true) {
+            return true;
+        }
+    } catch (Exception $e) {
+    }
+
+    return false;
+}
+
+function captcha_validation()
+{
+    if (empty(get_config('captcha_type')) && !empty($_POST['captcha']) && !empty($_SESSION['captcha'])) {
+        if (strtolower($_SESSION['captcha']) != strtolower($_POST['captcha'])) {
+            error_msg('Captcha is not valid.');
+            return false;
+        }
+        unset($_SESSION['captcha']);
+    } else if (!empty(get_config('captcha_type')) && get_config('captcha_type') > 2) {
+        return true;
+    } elseif (!empty(get_config('captcha_type')) && get_config('captcha_type') == 1 && !empty($_POST['h-captcha-response'])) {
+        if (!validate_hcaptcha($_POST['h-captcha-response'])) {
+            error_msg('HCaptcha is not valid.');
+            return false;
+        }
+    } elseif (!empty(get_config('captcha_type')) && get_config('captcha_type') == 2 && !empty($_POST['g-recaptcha-response'])) {
+        if (!validate_recaptcha($_POST['g-recaptcha-response'])) {
+            error_msg('ReCaptcha is not valid.');
+            return false;
+        }
+    } else {
+        error_msg('Captcha is required.');
+        return false;
+    }
+
+    return true;
+}
+
+function getCaptchaJS()
+{
+    if (!empty(get_config('captcha_type'))) {
+        if (get_config('captcha_type') == 1) {
+            return '<script src="https://hcaptcha.com/1/api.js?hl=' . get_config('captcha_language') . '" async defer></script><style>.h-captcha { display: inline-block;}</style>';
+        } else if (get_config('captcha_type') == 2) {
+            return '<script src="https://www.google.com/recaptcha/api.js?hl=' . get_config('captcha_language') . '" async defer></script><style>.g-recaptcha { display: inline-block;}</style>';
+        }
+    }
+
+    return '';
+}
+
+function GetCaptchaHTML()
+{
+    if (!empty(get_config('captcha_type'))) {
+        if (get_config('captcha_type') == 1) {
+            return '<div class="row text-center"><div class="col-md-12 text-center"><div class="h-captcha" data-sitekey="' . get_config('captcha_key') . '" style=\'margin:10px auto\'></div></div></div>';
+        } else if (get_config('captcha_type') == 2) {
+            return '<div class="row text-center"><div class="col-md-12 text-center"><div class="g-recaptcha" data-sitekey="' . get_config('captcha_key') . '" style=\'margin:10px auto\'></div></div></div>';
+        } else {
+            return '';
+        }
+    }
+
+    return '<div class="input-group"><span class="input-group">Captcha</span><input type="text" class="form-control" placeholder="Captcha" name="captcha"></div><p style="text-align: center;margin-top: 10px;"><img src="' . user::$captcha->inline() . '" style="border - radius: 5px;"/></p>';
+}
+
+// Its from Trinitycore/account-creator
+function calculateSRP6Verifier($username, $password, $salt)
+{
+    // algorithm constants
+    $g = gmp_init(7);
+    $N = gmp_init('894B645E89E1535BBDAD5B8B290650530801B18EBFBF5E8FAB3C82872A3E9BB7', 16);
+
+    // calculate first hash
+    $h1 = sha1(strtoupper($username . ':' . $password), TRUE);
+
+    // calculate second hash
+    $h2 = sha1($salt . $h1, TRUE);
+
+    // convert to integer (little-endian)
+    $h2 = gmp_import($h2, 1, GMP_LSW_FIRST);
+
+    // g^h2 mod N
+    $verifier = gmp_powm($g, $h2, $N);
+
+    // convert back to a byte array (little-endian)
+    $verifier = gmp_export($verifier, 1, GMP_LSW_FIRST);
+
+    // pad to 32 bytes, remember that zeros go on the end in little-endian!
+    $verifier = str_pad($verifier, 32, chr(0), STR_PAD_RIGHT);
+
+    // done!
+    return $verifier;
+}
+
+// Returns SRP6 parameters to register this username/password combination with
+function getRegistrationData($username, $password)
+{
+    // generate a random salt
+    $salt = random_bytes(32);
+
+    // calculate verifier using this salt
+    $verifier = calculateSRP6Verifier($username, $password, $salt);
+
+    // done - this is what you put in the account table!
+    return array($salt, $verifier);
+}
+
+//From TrinityCore/AOWOW
+function verifySRP6($user, $pass, $salt, $verifier)
+{
+    $g = gmp_init(7);
+    $N = gmp_init('894B645E89E1535BBDAD5B8B290650530801B18EBFBF5E8FAB3C82872A3E9BB7', 16);
+    $x = gmp_import(
+        sha1($salt . sha1(strtoupper($user . ':' . $pass), TRUE), TRUE),
+        1,
+        GMP_LSW_FIRST
+    );
+    $v = gmp_powm($g, $x, $N);
+    return ($verifier === str_pad(gmp_export($v, 1, GMP_LSW_FIRST), 32, chr(0), STR_PAD_RIGHT));
+}

registration/application/include/status.php

@@ -0,0 +1,92 @@
+<?php
+/**
+ * @author Amin Mahmoudi (MasterkinG)
+ * @copyright    Copyright (c) 2019 - 2022, MsaterkinG32 Team, Inc. (https://masterking32.com)
+ * @link    https://masterking32.com
+ * @Description : It's not masterking32 framework !
+ **/
+
+use Gregwar\Captcha\CaptchaBuilder;
+use Medoo\Medoo;
+
+class status
+{
+    public static function get_character_by_guid($realmID, $guid)
+    {
+        if (!empty($guid)) {
+            $datas = database::$chars[$realmID]->select("characters", array("name", "race", "class", "gender", "level"), ["AND" => ["guid[=]" => $guid]]);
+            if (!empty($datas[0]["level"])) {
+                return $datas[0];
+            }
+        }
+        return false;
+    }
+
+    public static function get_top_achievements($realmID)
+    {
+        $datas = database::$chars[$realmID]->query("SELECT guid, COUNT(*) as total FROM character_achievement GROUP BY guid ORDER BY total DESC LIMIT 10;")->fetchAll();
+        if (!empty($datas[0]["guid"])) {
+            return $datas;
+        }
+        return false;
+    }
+
+    public static function get_top_arenateams($realmID)
+    {
+        $datas = database::$chars[$realmID]->select("arena_team", array("arenaTeamId", "name", "captainGuid", "rating"), ['LIMIT' => 10, "ORDER" => ["rating" => "DESC"]]);
+        if (!empty($datas[0]["arenaTeamId"])) {
+            return $datas;
+        }
+        return false;
+    }
+
+    public static function get_top_killers($realmID)
+    {
+        $datas = database::$chars[$realmID]->select("characters", array("name", "race", "class", "gender", "level", "totalKills"), ['LIMIT' => 10, "ORDER" => ["totalKills" => "DESC"]]);
+        if (!empty($datas[0]["totalKills"])) {
+            return $datas;
+        }
+        return false;
+    }
+
+    public static function get_top_arenapoints($realmID)
+    {
+        $datas = database::$chars[$realmID]->select("characters", array("name", "race", "class", "gender", "level", "arenaPoints"), ['LIMIT' => 10, "ORDER" => ["arenaPoints" => "DESC"]]);
+        if (!empty($datas[0]["arenaPoints"])) {
+            return $datas;
+        }
+        return false;
+    }
+
+    public static function get_top_honorpoints($realmID)
+    {
+        if (get_config('expansion') >= 6) {
+            $datas = database::$chars[$realmID]->select("characters", array("name", "race", "class", "gender", "level", "honorLevel", "honor"), ['LIMIT' => 10, "ORDER" => ["honorLevel" => "DESC", "honor" => "DESC"]]);
+        } else {
+            $datas = database::$chars[$realmID]->select("characters", array("name", "race", "class", "gender", "level", "totalHonorPoints"), ['LIMIT' => 10, "ORDER" => ["totalHonorPoints" => "DESC"]]);
+        }
+
+        if (!empty($datas[0]["level"])) {
+            return $datas;
+        }
+        return false;
+    }
+
+    public static function get_top_playtime($realmID)
+    {
+        $datas = database::$chars[$realmID]->select("characters", array("name", "race", "class", "gender", "level", "totaltime"), ["ORDER" => ["totaltime" => "DESC"], 'LIMIT' => 10]);
+        if (!empty($datas[0]["totaltime"])) {
+            return $datas;
+        }
+        return false;
+    }
+
+    public static function get_top_guild_by_member($realmID)
+    {
+        $datas = database::$chars[$realmID]->query("SELECT guildid,name,leaderguid FROM guild WHERE guildid IN (SELECT guildid from guild_member GROUP by guildid ORDER by COUNT(*) DESC) LIMIT 10;")->fetchAll();
+        if (!empty($datas[0]["name"])) {
+            return $datas;
+        }
+        return false;
+    }
+}

registration/application/include/user.php

@@ -0,0 +1,769 @@
+<?php
+/**
+ * @author Amin Mahmoudi (MasterkinG)
+ * @copyright    Copyright (c) 2019 - 2022, MsaterkinG32 Team, Inc. (https://masterking32.com)
+ * @link    https://masterking32.com
+ * @Description : It's not masterking32 framework !
+ **/
+
+use Gregwar\Captcha\CaptchaBuilder;
+use Medoo\Medoo;
+
+class user
+{
+    public static $captcha;
+
+    public static function post_handler()
+    {
+        if (!empty($_GET['restore']) && !empty($_GET['key'])) {
+            self::restorepassword_setnewpw($_GET['restore'], $_GET['key']);
+        }
+
+        if (!empty($_GET['enabletfa']) && !empty($_GET['account'])) {
+            self::account_set_2fa($_GET['enabletfa'], $_GET['account']);
+        }
+
+        if (!empty($_POST['submit'])) {
+            self::tfa_enable();
+            if (get_config('battlenet_support')) {
+                self::bnet_register();
+                self::bnet_changepass();
+            } else {
+                self::normal_register();
+                self::normal_changepass();
+            }
+            self::restorepassword();
+            if (empty(get_config('captcha_type'))) {
+                unset($_SESSION['captcha']);
+                self::$captcha = new CaptchaBuilder;
+                self::$captcha->build();
+                $_SESSION['captcha'] = self::$captcha->getPhrase();
+            }
+        } else {
+            if (empty(get_config('captcha_type'))) {
+                unset($_SESSION['captcha']);
+                self::$captcha = new CaptchaBuilder;
+                self::$captcha->build();
+                $_SESSION['captcha'] = self::$captcha->getPhrase();
+            }
+        }
+    }
+
+    /**
+     * Battle.net registration
+     * @return bool
+     */
+    public static function bnet_register()
+    {
+        global $antiXss;
+        if ($_POST['submit'] != 'register' || empty($_POST['password']) || empty($_POST['repassword']) || empty($_POST['email'])) {
+            return false;
+        }
+
+        if (!captcha_validation()) {
+            return false;
+        }
+
+        if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
+            error_msg('Use valid email.');
+            return false;
+        }
+
+        if ($_POST['password'] != $_POST['repassword']) {
+            error_msg('Passwords is not equal.');
+            return false;
+        }
+
+        if (!(strlen($_POST['password']) >= 4 && strlen($_POST['password']) <= 16)) {
+            error_msg('Password length is not valid.');
+            return false;
+        }
+
+        if (!self::check_email_exists(strtoupper($_POST["email"]))) {
+            error_msg('Username or Email is exists.');
+            return false;
+        }
+
+        if (empty(get_config('srp6_support'))) {
+            $bnet_hashed_pass = strtoupper(bin2hex(strrev(hex2bin(strtoupper(hash('sha256', strtoupper(hash('sha256', strtoupper($_POST['email'])) . ':' . strtoupper($_POST['password']))))))));
+            database::$auth->insert('battlenet_accounts', [
+                'email' => $antiXss->xss_clean(strtoupper($_POST['email'])),
+                'sha_pass_hash' => $antiXss->xss_clean($bnet_hashed_pass)
+            ]);
+
+            $bnet_account_id = database::$auth->id();
+            $username = $bnet_account_id . '#1';
+            $hashed_pass = strtoupper(sha1(strtoupper($username . ':' . $_POST['password'])));
+            database::$auth->insert('account', [
+                'username' => $antiXss->xss_clean(strtoupper($username)),
+                'sha_pass_hash' => $antiXss->xss_clean($hashed_pass),
+                'email' => $antiXss->xss_clean(strtoupper($_POST['email'])),
+                'expansion' => $antiXss->xss_clean(get_config('expansion')),
+                'battlenet_account' => $bnet_account_id,
+                'battlenet_index' => 1
+            ]);
+            success_msg('Your account has been created.');
+            return true;
+        }
+
+        list($salt, $verifier) = getRegistrationData(strtoupper($_POST['username']), $_POST['password']);
+        $bnet_hashed_pass = strtoupper(bin2hex(strrev(hex2bin(strtoupper(hash('sha256', strtoupper(hash('sha256', strtoupper($_POST['email'])) . ':' . strtoupper($_POST['password']))))))));
+        database::$auth->insert('battlenet_accounts', [
+            'email' => $antiXss->xss_clean(strtoupper($_POST['email'])),
+            'sha_pass_hash' => $antiXss->xss_clean($bnet_hashed_pass)
+        ]);
+
+        $bnet_account_id = database::$auth->id();
+        $username = $bnet_account_id . '#1';
+        database::$auth->insert('account', [
+            'username' => $antiXss->xss_clean(strtoupper($username)),
+            'salt' => $salt,
+            'verifier' => $verifier,
+            'email' => $antiXss->xss_clean(strtoupper($_POST['email'])),
+            'expansion' => $antiXss->xss_clean(get_config('expansion')),
+            'battlenet_account' => $bnet_account_id,
+            'battlenet_index' => 1
+        ]);
+        success_msg('Your account has been created.');
+        return true;
+    }
+
+    /**
+     * Registration without battle net servers.
+     * @return bool
+     */
+    public static function normal_register()
+    {
+        global $antiXss;
+        if ($_POST['submit'] != 'register' || empty($_POST['password']) || empty($_POST['username']) || empty($_POST['repassword']) || empty($_POST['email'])) {
+            return false;
+        }
+
+        if (!captcha_validation()) {
+            return false;
+        }
+
+        if (!preg_match('/^[0-9A-Z-_]+$/', strtoupper($_POST['username']))) {
+            error_msg('Use valid characters for username.');
+            return false;
+        }
+
+        if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
+            error_msg('Use valid email.');
+            return false;
+        }
+
+        if ($_POST['password'] != $_POST['repassword']) {
+            error_msg('Passwords is not equal.');
+            return false;
+        }
+
+        if (!(strlen($_POST['password']) >= 4 && strlen($_POST['password']) <= 16)) {
+            error_msg('Password length is not valid.');
+            return false;
+        }
+
+        if (!(strlen($_POST['username']) >= 2 && strlen($_POST['username']) <= 16)) {
+            error_msg('Username length is not valid.');
+            return false;
+        }
+
+        if (!get_config('multiple_email_use') && !self::check_email_exists(strtoupper($_POST['email']))) {
+            error_msg('Email is exists.');
+            return false;
+        }
+
+        if (!self::check_username_exists(strtoupper($_POST['username']))) {
+            error_msg('Username is exists.');
+            return false;
+        }
+
+        if (empty(get_config('soap_for_register'))) {
+            if (empty(get_config('srp6_support'))) {
+                $hashed_pass = strtoupper(sha1(strtoupper($_POST['username'] . ':' . $_POST['password'])));
+                database::$auth->insert('account', [
+                    'username' => $antiXss->xss_clean(strtoupper($_POST['username'])),
+                    'sha_pass_hash' => $antiXss->xss_clean($hashed_pass),
+                    'email' => $antiXss->xss_clean(strtoupper($_POST['email'])),
+                    //'reg_mail' => $antiXss->xss_clean(strtoupper($_POST['email'])),
+                    'expansion' => $antiXss->xss_clean(get_config('expansion'))
+                ]);
+                success_msg('Your account has been created.');
+                return true;
+            }
+
+            list($salt, $verifier) = getRegistrationData(strtoupper($_POST['username']), $_POST['password']);
+            database::$auth->insert('account', [
+                'username' => $antiXss->xss_clean(strtoupper($_POST['username'])),
+                'salt' => $salt,
+                'verifier' => $verifier,
+                'email' => $antiXss->xss_clean(strtoupper($_POST['email'])),
+                //'reg_mail' => $antiXss->xss_clean(strtoupper($_POST['email'])),
+                'expansion' => $antiXss->xss_clean(get_config('expansion'))
+            ]);
+            success_msg('Your account has been created.');
+            return true;
+        }
+
+        $command = str_replace('{USERNAME}', $antiXss->xss_clean(strtoupper($_POST['username'])), get_config('soap_ca_command'));
+        $command = str_replace('{PASSWORD}', $antiXss->xss_clean($_POST['password']), $command);
+        $command = str_replace('{EMAIL}', $antiXss->xss_clean(strtoupper($_POST['email'])), $command);
+        if (RemoteCommandWithSOAP($command)) {
+            if (!empty(get_config('soap_asa_command'))) {
+                $command_addon = str_replace('{USERNAME}', $antiXss->xss_clean(strtoupper($_POST['username'])), get_config('soap_asa_command'));
+                $command_addon = str_replace('{EXPANSION}', get_config('expansion'), $command_addon);
+                RemoteCommandWithSOAP($command_addon);
+            }
+
+            database::$auth->update('account', [
+                'email' => $antiXss->xss_clean(strtoupper($_POST['email']))
+            ], ['username' => Medoo::raw('UPPER(:username)', [':username' => $antiXss->xss_clean(strtoupper($_POST['username']))])]);
+
+            success_msg('Your account has been created.');
+        } else {
+            error_msg('ERROR!, Please try again!');
+        }
+
+        return true;
+    }
+
+    /**
+     * Change password for Battle.net Cores.
+     * @return bool
+     */
+    public static function bnet_changepass()
+    {
+        global $antiXss;
+
+        if (!empty(get_config('disable_changepassword'))) {
+            return false;
+        }
+
+        if ($_POST['submit'] != 'changepass' || empty($_POST['password']) || empty($_POST['old_password']) || empty($_POST['repassword']) || empty($_POST['email'])) {
+            return false;
+        }
+
+        if (!captcha_validation()) {
+            return false;
+        }
+
+        if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
+            error_msg('Use valid email.');
+            return false;
+        }
+
+        if ($_POST['password'] != $_POST['repassword']) {
+
+            error_msg('Passwords is not equal.');
+            return false;
+        }
+
+        if (!(strlen($_POST['password']) >= 4 && strlen($_POST['password']) <= 16)) {
+            error_msg('Password length is not valid.');
+            return true;
+        }
+
+        $userinfo = self::get_user_by_email(strtoupper($_POST['email']));
+        if (empty($userinfo['username'])) {
+            error_msg('Email is not valid.');
+            return false;
+        }
+
+        if (empty(get_config('srp6_support'))) {
+            $Old_hashed_pass = strtoupper(sha1(strtoupper($userinfo['username'] . ':' . $_POST['old_password'])));
+            $hashed_pass = strtoupper(sha1(strtoupper($userinfo['username'] . ':' . $_POST['password'])));
+
+            if (strtoupper($userinfo['sha_pass_hash']) != $Old_hashed_pass) {
+                error_msg('Old password is not valid.');
+                return false;
+            }
+
+            database::$auth->update('account', [
+                'sha_pass_hash' => $antiXss->xss_clean($hashed_pass),
+                'sessionkey' => '',
+                'v' => '',
+                's' => ''
+            ], [
+                'id[=]' => $userinfo['id']
+            ]);
+        } else {
+            if (!verifySRP6($userinfo['username'], $_POST['old_password'], $userinfo['salt'], $userinfo['verifier'])) {
+                error_msg('Old password is not valid.');
+                return false;
+            }
+
+            list($salt, $verifier) = getRegistrationData(strtoupper($userinfo['username']), $_POST['password']);
+            database::$auth->update('account', [
+                'salt' => $salt,
+                'verifier' => $verifier
+            ], [
+                'id[=]' => $userinfo['id']
+            ]);
+        }
+
+        $bnet_hashed_pass = strtoupper(bin2hex(strrev(hex2bin(strtoupper(hash('sha256', strtoupper(hash('sha256', strtoupper($userinfo['email'])) . ':' . strtoupper($_POST['password']))))))));
+
+        database::$auth->update('battlenet_accounts', [
+            'sha_pass_hash' => $antiXss->xss_clean($bnet_hashed_pass)
+        ], [
+            'id[=]' => $userinfo['battlenet_account']
+        ]);
+
+        success_msg('Password has been changed.');
+        return true;
+    }
+
+    /**
+     * Change password for normal servers.
+     * @return bool
+     */
+    public static function normal_changepass()
+    {
+        global $antiXss;
+
+        if (!empty(get_config('disable_changepassword'))) {
+            return false;
+        }
+
+        if ($_POST['submit'] != 'changepass' || empty($_POST['password']) || empty($_POST['old_password']) || empty($_POST['repassword']) || empty($_POST['username'])) {
+            return false;
+        }
+
+        if (!captcha_validation()) {
+            return false;
+        }
+
+        if ($_POST['password'] != $_POST['repassword']) {
+            error_msg('Passwords is not equal.');
+            return false;
+        }
+
+        if (!(strlen($_POST['password']) >= 4 && strlen($_POST['password']) <= 16)) {
+            error_msg('Password length is not valid.');
+            return false;
+        }
+
+        $userinfo = self::get_user_by_username(strtoupper($_POST['username']));
+        if (empty($userinfo['username'])) {
+            error_msg('Username is not valid.');
+            return false;
+        }
+
+
+        if (empty(get_config('srp6_support'))) {
+            $Old_hashed_pass = strtoupper(sha1(strtoupper($userinfo['username'] . ':' . $_POST['old_password'])));
+            $hashed_pass = strtoupper(sha1(strtoupper($userinfo['username'] . ':' . $_POST['password'])));
+            if (strtoupper($userinfo['sha_pass_hash']) != $Old_hashed_pass) {
+                error_msg('Old password is not valid.');
+                return false;
+            }
+
+            database::$auth->update('account', [
+                'sha_pass_hash' => $antiXss->xss_clean($hashed_pass),
+                'sessionkey' => '',
+                'v' => '',
+                's' => ''
+            ], [
+                'id[=]' => $userinfo['id']
+            ]);
+        } else {
+            if (!verifySRP6($userinfo['username'], $_POST['old_password'], $userinfo['salt'], $userinfo['verifier'])) {
+                error_msg('Old password is not valid.');
+                return false;
+            }
+
+            list($salt, $verifier) = getRegistrationData(strtoupper($userinfo['username']), $_POST['password']);
+            database::$auth->update('account', [
+                'salt' => $salt,
+                'verifier' => $verifier
+            ], [
+                'id[=]' => $userinfo['id']
+            ]);
+        }
+
+        success_msg('Password has been changed.');
+        return true;
+    }
+
+    /**
+     * Change password for normal servers.
+     * @return bool
+     */
+    public static function restorepassword()
+    {
+        global $antiXss;
+        if ($_POST['submit'] != 'restorepassword') {
+            return false;
+        }
+
+        if (get_config('battlenet_support') && empty($_POST['email'])) {
+            return false;
+        } elseif (!get_config('battlenet_support') && empty($_POST['username'])) {
+            return false;
+        }
+
+        if (!captcha_validation()) {
+            return false;
+        }
+
+        if (get_config('battlenet_support')) {
+            if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
+                error_msg('Use a valid email.');
+                return false;
+            }
+
+            $userinfo = self::get_user_by_email(strtoupper($_POST['email']));
+            if (empty($userinfo['email'])) {
+                error_msg('Email is not valid.');
+                return false;
+            }
+
+            $field_acc = $userinfo['email'];
+        } else {
+            if (!preg_match('/^[0-9A-Z-_]+$/', strtoupper($_POST['username']))) {
+                error_msg('Use a valid username.');
+                return false;
+            }
+
+            $userinfo = self::get_user_by_username(strtoupper($_POST['username']));
+            if (empty($userinfo['email'])) {
+                error_msg('Username is not valid.');
+                return false;
+            }
+
+            $field_acc = $userinfo['username'];
+        }
+
+        if (!isset($userinfo['restore_key'])) {
+            self::add_password_key_to_acctbl();
+        }
+
+        $restore_key = strtolower(md5(time() . mt_rand(1000, 9999)) . mt_rand(10000, 99999));
+        database::$auth->update('account', [
+            'restore_key' => $antiXss->xss_clean($restore_key)
+        ], [
+            'id[=]' => $userinfo['id']
+        ]);
+
+        $restorepass_URL = get_config('baseurl') . '/index.php?restore=' . strtolower($field_acc) . '&key=' . $restore_key;
+        $message = "For restore you game account open <a href='$restorepass_URL' target='_blank'>this link</a>: <BR>$restorepass_URL";
+        send_phpmailer(strtolower($userinfo['email']), 'Restore Account Password', $message);
+        success_msg('Check your email, (Check SPAM/Junk too).');
+        return true;
+    }
+
+    public static function restorepassword_setnewpw($user_data, $restore_key)
+    {
+        global $antiXss;
+        if (empty($user_data) || empty($restore_key)) {
+            return false;
+        }
+
+        if ($restore_key == 1 || strlen($restore_key) < 30) {
+            return false;
+        }
+
+        if (get_config('battlenet_support')) {
+            if (!filter_var($user_data, FILTER_VALIDATE_EMAIL)) {
+                return false;
+            }
+
+            $userinfo = self::get_user_by_email(strtoupper($user_data));
+        } else {
+            if (!preg_match('/^[0-9A-Z-_]+$/', strtoupper($user_data))) {
+                error_msg('Use a valid username.');
+                return false;
+            }
+
+            $userinfo = self::get_user_by_username(strtoupper($user_data));
+        }
+
+        if (empty($userinfo['email'])) {
+            return false;
+        }
+
+        if ($userinfo['restore_key'] != $restore_key) {
+            return false;
+        }
+
+        $new_password = generateRandomString(12);
+
+        if (get_config('battlenet_support')) {
+            $message = 'Your new account information : <br>Email: ' . strtolower($userinfo['email']) . '<br>Password: ' . $new_password;
+            if (empty(get_config('srp6_support'))) {
+                $hashed_pass = strtoupper(sha1(strtoupper($userinfo['username'] . ':' . $new_password)));
+                database::$auth->update('account', [
+                    'sha_pass_hash' => $antiXss->xss_clean($hashed_pass),
+                    'sessionkey' => '',
+                    'v' => '',
+                    's' => '',
+                    'restore_key' => '1'
+                ], [
+                    'id[=]' => $userinfo['id']
+                ]);
+            } else {
+                list($salt, $verifier) = getRegistrationData(strtoupper($userinfo['username']), $new_password);
+                database::$auth->update('account', [
+                    'salt' => $salt,
+                    'verifier' => $verifier,
+                    'restore_key' => '1'
+                ], [
+                    'id[=]' => $userinfo['id']
+                ]);
+            }
+
+            $bnet_hashed_pass = strtoupper(bin2hex(strrev(hex2bin(strtoupper(hash('sha256', strtoupper(hash('sha256', strtoupper($userinfo['email'])) . ':' . strtoupper($new_password))))))));
+            database::$auth->update('battlenet_accounts', [
+                'sha_pass_hash' => $antiXss->xss_clean($bnet_hashed_pass)
+            ], [
+                'id[=]' => $userinfo['battlenet_account']
+            ]);
+        } else {
+            $message = 'Your new account information : <br>Username: ' . strtolower($userinfo['username']) . '<br>Password: ' . $new_password;
+            if (empty(get_config('soap_for_register'))) {
+                if (empty(get_config('srp6_support'))) {
+                    $hashed_pass = strtoupper(sha1(strtoupper($userinfo['username'] . ':' . $new_password)));
+                    database::$auth->update('account', [
+                        'sha_pass_hash' => $antiXss->xss_clean($hashed_pass),
+                        'sessionkey' => '',
+                        'v' => '',
+                        's' => '',
+                        'restore_key' => '1'
+                    ], [
+                        'id[=]' => $userinfo['id']
+                    ]);
+                } else {
+                    list($salt, $verifier) = getRegistrationData(strtoupper($userinfo['username']), $new_password);
+                    database::$auth->update('account', [
+                        'salt' => $salt,
+                        'verifier' => $verifier,
+                        'restore_key' => '1'
+                    ], [
+                        'id[=]' => $userinfo['id']
+                    ]);
+                }
+            } else {
+                $command = str_replace('{USERNAME}', $antiXss->xss_clean(strtoupper($userinfo['username'])), get_config('soap_cp_command'));
+                $command = str_replace('{PASSWORD}', $antiXss->xss_clean($new_password), $command);
+                if (RemoteCommandWithSOAP($command)) {
+                    success_msg('Password has been changed.');
+                    database::$auth->update('account', [
+                        'restore_key' => '1'
+                    ], [
+                        'id[=]' => $userinfo['id']
+                    ]);
+                } else {
+                    error_msg('ERROR!, Please try again!');
+                    return false;
+                }
+            }
+        }
+
+        send_phpmailer(strtolower($userinfo['email']), 'New Account Password', $message);
+        success_msg('Check your email for new password, (Check SPAM/Junk too).');
+        return false;
+    }
+
+    public
+    static function check_email_exists($email)
+    {
+        if (!empty($email)) {
+            $datas = database::$auth->select('account', ['id'], ['email' => Medoo::raw('UPPER(:email)', [':email' => $email])]);
+            if (empty($datas[0])) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    public
+    static function get_user_by_email($email)
+    {
+        if (!empty($email)) {
+            $datas = database::$auth->select('account', '*', ['email' => Medoo::raw('UPPER(:email)', [':email' => strtoupper($email)])]);
+            if (!empty($datas[0]['username'])) {
+                return $datas[0];
+            }
+        }
+        return false;
+    }
+
+    public
+    static function get_user_by_username($username)
+    {
+        if (!empty($username)) {
+            $datas = database::$auth->select('account', '*', ['username' => Medoo::raw('UPPER(:username)', [':username' => strtoupper($username)])]);
+            if (!empty($datas[0]['username'])) {
+                return $datas[0];
+            }
+        }
+        return false;
+    }
+
+    /**
+     * @param $username
+     * @return bool
+     */
+    public
+    static function check_username_exists($username)
+    {
+        if (!empty($username)) {
+            $datas = database::$auth->select('account', ['id'], ['username' => Medoo::raw('UPPER(:username)', [':username' => $username])]);
+            if (empty($datas[0])) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    public
+    static function get_online_players($realmID)
+    {
+        $datas = database::$chars[$realmID]->select('characters', array('name', 'race', 'class', 'gender', 'level'), ['LIMIT' => 49, 'ORDER' => ['level' => 'DESC'], 'online[=]' => 1]);
+        if (!empty($datas[0]['name'])) {
+            return $datas;
+        }
+        return false;
+    }
+
+    public
+    static function get_online_players_count($realmID)
+    {
+        $datas = database::$chars[$realmID]->count('characters', ['online[=]' => 1]);
+        if (!empty($datas)) {
+            return $datas;
+        }
+        return 0;
+    }
+
+    public
+    static function add_password_key_to_acctbl()
+    {
+        database::$auth->query("ALTER TABLE `account` ADD COLUMN `restore_key` varchar(255) NULL DEFAULT '1';");
+        return true;
+    }
+
+    /**
+     * Enable 2fa
+     * @return bool
+     */
+    public static function tfa_enable()
+    {
+        global $antiXss;
+
+        if (empty(get_config('2fa_support'))) {
+            return false;
+        }
+
+        if (empty($_POST['submit']) || $_POST['submit'] != 'etfa' || empty($_POST['email']) || (empty(get_config('battlenet_support')) && empty($_POST['username']))) {
+            return false;
+        }
+
+        if (!captcha_validation()) {
+            return false;
+        }
+
+        $userinfo = self::get_user_by_email(strtoupper($_POST['email']));
+        if (empty($userinfo['id'])) {
+            error_msg('Account is not valid.');
+            return false;
+        }
+
+        if (empty(get_config('battlenet_support')) && strtolower($userinfo['username']) != strtolower($_POST['username'])) {
+            error_msg('Account is not valid.');
+            return false;
+        }
+
+        $verify_key = md5(strtolower($userinfo['email']) . "_" . time() . rand(1, 999999));
+
+        if (!isset($userinfo['restore_key'])) {
+            self::add_password_key_to_acctbl();
+        }
+
+        database::$auth->update('account', [
+            'restore_key' => $antiXss->xss_clean($verify_key)
+        ], [
+            'id[=]' => $userinfo['id']
+        ]);
+
+        $account = $userinfo['email'];
+        if (empty(get_config('battlenet_support'))) {
+            $account = $userinfo['username'];
+        }
+
+        $restorepass_URL = get_config('baseurl') . '/index.php?enabletfa=' . strtolower($verify_key) . '&account=' . strtolower($account);
+        $message = "Hey, to enable Two-Factor Authentication (2FA), Please open  <a href='$restorepass_URL' target='_blank'>this link</a>: <BR>$restorepass_URL";
+        send_phpmailer(strtolower($userinfo['email']), 'Enable Account 2FA', $message);
+        success_msg('Check your email, (Check SPAM/Junk too).');
+        return true;
+    }
+
+    public static function account_set_2fa($verify_key, $account)
+    {
+        global $antiXss;
+
+        if (empty(get_config('2fa_support'))) {
+            return false;
+        }
+
+        if (empty($verify_key) || empty($account)) {
+            return false;
+        }
+
+        if ($verify_key == 1 || strlen($verify_key) < 30) {
+            return false;
+        }
+
+        $acc_name = "";
+        if (get_config('battlenet_support')) {
+            if (!filter_var($account, FILTER_VALIDATE_EMAIL)) {
+                return false;
+            }
+
+            $userinfo = self::get_user_by_email(strtoupper($account));
+            $acc_name = $userinfo['email'];
+        } else {
+            if (!preg_match('/^[0-9A-Z-_]+$/', strtoupper($account))) {
+                return false;
+            }
+
+            $userinfo = self::get_user_by_username(strtoupper($account));
+            $acc_name = $userinfo['username'];
+        }
+
+        if (empty($userinfo['email'])) {
+            return false;
+        }
+
+        if ($userinfo['restore_key'] != $verify_key) {
+            return false;
+        }
+
+        $ga = new PHPGangsta_GoogleAuthenticator();
+        $tfa_key = $ga->createSecret();
+
+        database::$auth->update('account', [
+            'restore_key' => '1'
+        ], [
+            'id[=]' => $userinfo['id']
+        ]);
+
+        $command = str_replace('{USERNAME}', $antiXss->xss_clean(strtoupper($userinfo['username'])), get_config('soap_2d_command'));
+        RemoteCommandWithSOAP($command);
+        $command = str_replace('{USERNAME}', $antiXss->xss_clean(strtoupper($userinfo['username'])), get_config('soap_2e_command'));
+        $command = str_replace('{SECRET}', $tfa_key, $command);
+        RemoteCommandWithSOAP($command);
+
+        $acc_name = str_replace('-', '', $acc_name);
+        $acc_name = str_replace('.', '', $acc_name);
+        $acc_name = str_replace('_', '', $acc_name);
+        $acc_name = str_replace('@', '', $acc_name);
+
+        $message = 'Two-Factor Authentication (2FA) enabled on your account.<br>Please scan the barcode with Google Authenticator.<BR>';
+        $message .= '<img src="' . $ga->getQRCodeGoogleUrl($acc_name, $tfa_key) . '"><BR>';
+        $message .= 'or you can add this code to Google Authenticator: <B>' . $tfa_key . '</B>.<BR>';
+
+        send_phpmailer(strtolower($userinfo['email']), 'Account 2FA enabled', $message);
+        success_msg('Account 2FA enabled please check your email, (Check SPAM/Junk too).');
+    }
+}

registration/application/include/vote.php

@@ -0,0 +1,119 @@
+<?php
+/**
+ * @author Amin Mahmoudi (MasterkinG)
+ * @copyright    Copyright (c) 2019 - 2022, MsaterkinG32 Team, Inc. (https://masterking32.com)
+ * @link    https://masterking32.com
+ * @Description : It's not masterking32 framework
+ * @TODO: Add vote verify system.
+ **/
+
+use Medoo\Medoo;
+
+class vote
+{
+    public static function post_handler()
+    {
+        if (get_config('vote_system') && !empty($_POST['account']) && !empty($_POST['siteid'])) {
+            self::do_vote($_POST['account'], $_POST['siteid']);
+        }
+    }
+
+    /**
+     * Validate account and do vote.
+     * @return bool
+     */
+    public static function do_vote($account, $siteID)
+    {
+        global $antiXss;
+        $vote_sites = get_config('vote_sites');
+        if (!is_numeric($siteID) || empty($vote_sites[$siteID - 1])) {
+            error_msg('Vote site is not valid!');
+            return false;
+        }
+
+        if (get_config('battlenet_support')) {
+            if (!filter_var($account, FILTER_VALIDATE_EMAIL)) {
+                error_msg('Use valid email.');
+                return false;
+            }
+
+            $acc_data = user::get_user_by_email($account);
+        } else {
+            if (!preg_match('/^[0-9A-Z-_]+$/', strtoupper($account))) {
+                error_msg('Use valid characters for username.');
+                return false;
+            }
+
+            $acc_data = user::get_user_by_username($account);
+        }
+
+        if (empty($acc_data['id'])) {
+            error_msg('Account is not valid.');
+            return false;
+        }
+
+        if (!isset($acc_data['votePoints'])) {
+            self::setup_vote_table();
+        }
+        $siteID--;
+        database::$auth->delete('votes', ['votedate[<]' => date("Y-m-d H:i:s", time() - 43200)]);
+
+        if (!empty(self::get_vote_by_IP($siteID)) || !empty(self::get_vote_by_account($siteID, $acc_data['id']))) {
+            error_msg('You already voted on this website.');
+            return false;
+        }
+
+        database::$auth->insert('votes', [
+            'ip' => $antiXss->xss_clean(strtoupper(getIP())),
+            'vote_site' => $antiXss->xss_clean($siteID),
+            'accountid' => $antiXss->xss_clean($acc_data['id'])
+        ]);
+
+        database::$auth->update('account', [
+            'votePoints' => $antiXss->xss_clean($acc_data['votePoints'] + 1)
+        ], [
+            'id[=]' => $acc_data['id']
+        ]);
+
+        header('location: ' . $vote_sites[$siteID]['site_url']);
+        exit();
+    }
+
+    public static function get_vote_by_IP($siteID)
+    {
+        $datas = database::$auth->select('votes', '*', ["AND" => ['ip' => Medoo::raw('UPPER(:ip)', [':ip' => strtoupper(getIP())]), 'vote_site[=]' => $siteID]]);
+        if (!empty($datas[0]['id'])) {
+            return $datas;
+        }
+
+        return false;
+    }
+
+    public static function get_vote_by_account($siteID, $accountID)
+    {
+        $datas = database::$auth->select('votes', '*', ["AND" => ['accountid[=]' => $accountID, 'vote_site[=]' => $siteID]]);
+        if (!empty($datas[0]['id'])) {
+            return $datas;
+        }
+
+        return false;
+    }
+
+    public static function setup_vote_table()
+    {
+        database::$auth->query("ALTER TABLE `account` ADD COLUMN `votePoints` varchar(255) NULL DEFAULT '0';");
+        database::$auth->query("
+            CREATE TABLE `votes` (
+              `id` bigint(255) NOT NULL AUTO_INCREMENT,
+              `ip` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
+              `vote_site` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
+              `accountid` bigint(255) NULL DEFAULT 0,
+              `votedate` timestamp(0) NULL DEFAULT current_timestamp(0),
+              `done` int(10) NOT NULL DEFAULT 0,
+              PRIMARY KEY (`id`) USING BTREE
+            ) ENGINE = InnoDB AUTO_INCREMENT = 1 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
+        ");
+
+        return true;
+    }
+}