Add web admin panel for accounts/characters (login, GM rights, live stats)

New "webadmin" service (Flask + PyMySQL, port 8081) backing a small
server-rendered admin UI:
- Login gated on an existing game account: only accounts with
  accesslevel >= ADMIN_MIN_ACCESSLEVEL (default 900) get in. Password
  is MD5-hashed before comparison since the game client hashes it
  client-side before it ever hits the wire -- accounts.password is
  always an MD5 hex digest, confirmed against existing DB rows.
- Accounts: list/search, create, edit accesslevel/active/password.
- Characters: list/search, create (mirrors the real char-creation
  INSERT in Src/Char Server/charpackets.cpp -- only account_name,
  char_name, face, hairStyle, sex are set, everything else relies on
  the table's own defaults), edit core stats (level, zuly, attributes,
  hp/mp, stat/skill points) and isgm/isdev flags directly.

All queries are parameterized (no string-formatted SQL). No CSRF
protection or rate limiting yet -- acceptable for a small
already-behind-a-high-accesslevel-gate private server, worth
revisiting before ever exposing this port publicly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
ThomasandClaude Sonnet 5 committed 2026-07-09 07:46:07 +02:00
1 parent f053a06920
commit 9829688a85
14 files changed
+610

No files matched your search

+18
View File
@@ -0,0 +1,18 @@
{% extends "base.html" %}
{% block title %}Dashboard - ROSS Admin{% endblock %}
{% block content %}
<div class="grid">
<div class="card">
<h3 style="margin-top:0;">Accounts</h3>
<p style="font-size:32px;margin:0;">{{ accounts_n }}</p>
<p><a class="btn small" href="{{ url_for('accounts') }}">verwalten</a>
<a class="btn small secondary" href="{{ url_for('new_account') }}">+ neu</a></p>
</div>
<div class="card">
<h3 style="margin-top:0;">Charaktere</h3>
<p style="font-size:32px;margin:0;">{{ chars_n }}</p>
<p><a class="btn small" href="{{ url_for('characters') }}">verwalten</a>
<a class="btn small secondary" href="{{ url_for('new_character') }}">+ neu</a></p>
</div>
</div>
{% endblock %}