Add web admin panel for accounts/characters (login, GM rights, live stats)
New "webadmin" service (Flask + PyMySQL, port 8081) backing a small server-rendered admin UI: - Login gated on an existing game account: only accounts with accesslevel >= ADMIN_MIN_ACCESSLEVEL (default 900) get in. Password is MD5-hashed before comparison since the game client hashes it client-side before it ever hits the wire -- accounts.password is always an MD5 hex digest, confirmed against existing DB rows. - Accounts: list/search, create, edit accesslevel/active/password. - Characters: list/search, create (mirrors the real char-creation INSERT in Src/Char Server/charpackets.cpp -- only account_name, char_name, face, hairStyle, sex are set, everything else relies on the table's own defaults), edit core stats (level, zuly, attributes, hp/mp, stat/skill points) and isgm/isdev flags directly. All queries are parameterized (no string-formatted SQL). No CSRF protection or rate limiting yet -- acceptable for a small already-behind-a-high-accesslevel-gate private server, worth revisiting before ever exposing this port publicly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
1 parent
f053a06920
commit
9829688a85
14 files changed
+610
No files matched your search
@@ -0,0 +1,33 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}{{ account.username }} - ROSS Admin{% endblock %}
|
||||
{% block content %}
|
||||
<div class="card" style="max-width:480px;">
|
||||
<h2 style="margin-top:0;">Account: {{ account.username }}</h2>
|
||||
<form method="post">
|
||||
<label>Accesslevel (100 = normaler Spieler, 900 = Admin)</label>
|
||||
<input type="number" name="accesslevel" value="{{ account.accesslevel }}">
|
||||
<label><input type="checkbox" name="active" style="width:auto;" {% if account.active %}checked{% endif %}> Aktiv</label>
|
||||
<label>Neues Passwort (leer lassen = unverändert)</label>
|
||||
<input type="password" name="password" placeholder="unverändert">
|
||||
<div style="margin-top:20px;">
|
||||
<button type="submit">Speichern</button>
|
||||
<a class="btn secondary" href="{{ url_for('accounts') }}">Zurück</a>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h3 style="margin-top:0;">Charaktere auf diesem Account</h3>
|
||||
<table>
|
||||
<tr><th>Name</th><th>Level</th><th></th></tr>
|
||||
{% for c in chars %}
|
||||
<tr>
|
||||
<td>{{ c.char_name }}</td>
|
||||
<td>{{ c.level }}</td>
|
||||
<td><a class="btn small" href="{{ url_for('edit_character', char_id=c.id) }}">bearbeiten</a></td>
|
||||
</tr>
|
||||
{% else %}
|
||||
<tr><td colspan="3">Keine Charaktere.</td></tr>
|
||||
{% endfor %}
|
||||
</table>
|
||||
</div>
|
||||
{% endblock %}
|
||||
Reference in new issue
Block a user