ThomasandClaude Sonnet 5
9829688a85
New "webadmin" service (Flask + PyMySQL, port 8081) backing a small server-rendered admin UI: - Login gated on an existing game account: only accounts with accesslevel >= ADMIN_MIN_ACCESSLEVEL (default 900) get in. Password is MD5-hashed before comparison since the game client hashes it client-side before it ever hits the wire -- accounts.password is always an MD5 hex digest, confirmed against existing DB rows. - Accounts: list/search, create, edit accesslevel/active/password. - Characters: list/search, create (mirrors the real char-creation INSERT in Src/Char Server/charpackets.cpp -- only account_name, char_name, face, hairStyle, sex are set, everything else relies on the table's own defaults), edit core stats (level, zuly, attributes, hp/mp, stat/skill points) and isgm/isdev flags directly. All queries are parameterized (no string-formatted SQL). No CSRF protection or rate limiting yet -- acceptable for a small already-behind-a-high-accesslevel-gate private server, worth revisiting before ever exposing this port publicly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
26 lines
1.1 KiB
HTML
26 lines
1.1 KiB
HTML
{% extends "base.html" %}
|
|
{% block title %}Accounts - ROSS Admin{% endblock %}
|
|
{% block content %}
|
|
<div class="searchbar">
|
|
<form method="get" style="display:flex;gap:10px;flex:1;">
|
|
<input type="text" name="q" placeholder="Username suchen..." value="{{ q }}">
|
|
<button type="submit">Suchen</button>
|
|
</form>
|
|
<a class="btn" href="{{ url_for('new_account') }}">+ Neuer Account</a>
|
|
</div>
|
|
<table>
|
|
<tr><th>ID</th><th>Username</th><th>Accesslevel</th><th>Aktiv</th><th>Online</th><th>Last IP</th><th></th></tr>
|
|
{% for a in accounts %}
|
|
<tr>
|
|
<td>{{ a.id }}</td>
|
|
<td>{{ a.username }}</td>
|
|
<td>{{ a.accesslevel }}</td>
|
|
<td>{% if a.active %}<span class="badge ok">ja</span>{% else %}<span class="badge off">nein</span>{% endif %}</td>
|
|
<td>{% if a.online %}<span class="badge ok">online</span>{% else %}<span class="badge off">offline</span>{% endif %}</td>
|
|
<td>{{ a.lastip }}</td>
|
|
<td class="row-actions"><a class="btn small" href="{{ url_for('edit_account', account_id=a.id) }}">bearbeiten</a></td>
|
|
</tr>
|
|
{% endfor %}
|
|
</table>
|
|
{% endblock %}
|