Merge remote-tracking branch 'upstream/master' into anti_registeratio…

…n_spam

.deepsource.toml

@@ -0,0 +1,14 @@
+version = 1
+
+[[analyzers]]
+name = "php"
+
+[[analyzers]]
+name = "javascript"
+
+[[analyzers]]
+name = "sql"
+
+exclude_files = [
+	"lib/phpmailer/**",
+]

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,49 @@
+name: Bug Report
+description: Create an Issue that details broken or unexpected behaviour
+labels: [Bug Report]
+body:
+- type: textarea
+  attributes:
+    label: Environment
+    description: |
+      examples:
+        - **PHP**: 8.1
+        - **MySQL**: MariaDB 10
+    value: |
+        - PHP: 
+        - MySQL: 
+    render: Markdown
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Current Behavior
+    description: A concise description of what you're experiencing.
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Expected Behavior
+    description: A concise description of what you expected to happen.
+  validations:
+    required: false
+- type: textarea
+  attributes:
+    label: Steps To Reproduce
+    description: Steps to reproduce the behavior.
+    placeholder: |
+      1. In this environment...
+      2. With this config...
+      3. Open page '...'
+      4. See error...
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Anything else?
+    description: |
+      Links? References? Anything that will give us more context about the issue you are encountering!
+
+      Tip: You can attach images or log files by clicking this area to highlight it and then dragging files in.
+  validations:
+    required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Forum Support
+    url: https://rathena.org/board/forum/21-web-support/
+    about: You can obtain support for FluxCP on our forum.
+  - name: Discord Support
+    url: https://discord.gg/kMeMXWEvSV
+    about: Chat with others in our fluxcp-support channel.

.github/ISSUE_TEMPLATE/enhancement_request.yml

@@ -0,0 +1,11 @@
+name: Enhancement Request
+description: Submit your request for changes to existing code to provide more functionality or QoL changes.
+title: "Enhancement Request"
+labels: [Enhancement Request]
+body:
+- type: textarea
+  attributes:
+    label: Provide Details
+    description: Give as much information as possible in order to get the discussion going.
+  validations:
+    required: true

.github/PULL_REQUEST_TEMPLATE/pull_request_template.md

@@ -0,0 +1,6 @@
+Fixes # .
+
+Changes proposed in this Pull Request:
+ * ?
+ * ?
+ * ?

.github/pull_request_template.md

@@ -0,0 +1,6 @@
+Fixes # .
+
+Changes proposed in this Pull Request:
+ * ?
+ * ?
+ * ?

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: "36 3 * * 3"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ javascript ]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+          queries: +security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: "/language:${{ matrix.language }}"

.gitignore

@@ -18,3 +18,13 @@
 # Caches
 /data/tmp/*.php
 /data/tmp/*.cache
+/data/tmp/emblems
+
+# Non-Default Themes
+/themes/*
+!/themes/default
+!/themes/bootstrap
+!/themes/installer
+
+# Import Configs
+/config/import

README.md

@@ -1,9 +1,9 @@
 FluxCP
 ======
-[![Total alerts](https://img.shields.io/lgtm/alerts/g/rathena/FluxCP.svg?logo=lgtm&logoWidth=18&color=orange)](https://lgtm.com/projects/g/rathena/FluxCP/alerts/)
+[![DeepSource](https://app.deepsource.com/gh/rathena/FluxCP.svg/?label=active+issues&show_trend=true&token=nhkIfid6qRIZxl2INWaaV4Qb)](https://app.deepsource.com/gh/rathena/FluxCP/?ref=repository-badge)
 [![Open Issues](https://img.shields.io/github/issues/rathena/FluxCP.svg?logo=github&logoWidth=18&color=yellow)](https://lgtm.com/projects/g/rathena/FluxCP/alerts/)
 [![Open PRs](https://img.shields.io/github/issues-pr/rathena/FluxCP.svg?logo=github&logoWidth=18&color=blue)](https://lgtm.com/projects/g/rathena/FluxCP/alerts/)
-[![Codacy Badge](https://api.codacy.com/project/badge/Grade/d842cd47636244668f3093151b288eff)](https://www.codacy.com/app/rathena/FluxCP?utm_source=github.com&utm_medium=referral&utm_content=rathena/FluxCP&utm_campaign=Badge_Grade)
+[![Codacy Badge](https://app.codacy.com/project/badge/Grade/4d1c0a43c0864764b3d3dc5ed2d93192)](https://www.codacy.com/gh/rathena/FluxCP/dashboard?utm_source=github.com&utm_medium=referral&utm_content=rathena/FluxCP&utm_campaign=Badge_Grade)
 
 Flux Control Panel (FluxCP) for rAthena servers.
 
@@ -24,7 +24,7 @@ What's New?
 * Pre-integrated themes:
 	- default
 	- Bootstrap
-	
+
 * Built-In:
 	- News and Pages CMS with integrated TinyMCE
 	- Service Desk (ITIL Incident Management style support ticket system)
@@ -55,7 +55,7 @@ Join the Discussion
 ---------
 We have a discord server separate from rAthena just for FluxCP stuff!
 The channels there can be used to obtain help, discuss testing, view anonymous feedback log, Github commits, etc.
-https://discord.gg/0XP9qqhUV9GLSfCh
+https://discord.gg/kMeMXWEvSV
 
 
 Extra Credits

config/access.php

@@ -98,9 +98,6 @@
 		'item'		=> array(
 			'index'			=> AccountLevel::ANYONE,
 			'view'			=> AccountLevel::ANYONE,
-			'add'			=> AccountLevel::ADMIN,
-			'edit'			=> AccountLevel::ADMIN,
-			'copy'			=> AccountLevel::ADMIN,
             'iteminfo'		=> AccountLevel::ADMIN
 		),
 		'monster'	=> array(

config/application.php

@@ -18,8 +18,10 @@
 	'ItemImageNameFormat'		=> '%d.png',				// The filename format for item images (defaults to {itemid}.png).
 	'MonsterImageNameFormat'	=> '%d.gif',				// The filename format for monster images (defaults to {monsterid}.gif).
 	'JobImageNameFormat'		=> '%d.gif',				// The filename format for job images (defaults to {jobid}.gif).
+	'DivinePrideIntegration'	=> true,					// Dowload monsters and items images from https://www.divine-pride.net if it's not exist.
 	'ForceEmptyEmblem'			=> false,					// Forcefully display empty guild emblems, helpful when you don't have GD2 installed.
 	'EmblemCacheInterval'		=> 12,						// Hourly interval to re-cache guild emblems (set to 0 to disable emblem cache).
+	'EmblemUseWebservice'		=> true,					// Load emblems from WebService?
 	'SessionCookieExpire'		=> 48,						// Duration in hours.
 	'AdminMenuGroupLevel'		=> AccountLevel::LOWGM,		// The starting group ID for which module actions are moved into the admin menu for display.
 	'DateDefaultTimezone'		=> 'UTC',					// The default timezone, consult the PHP manual for valid timezones: http://php.net/timezones (null for defaut system TZ)
@@ -56,7 +58,7 @@
 	'RequireChangeConfirm'		=> false,					// Require confirmation when changing e-mail addresses.
 	'EmailConfirmExpire'		=> 48,						// E-mail confirmations expire hours. Unconfirmed accounts will expire after this period of time.
 	'PendingRegistration'		=> false,					// Requires 'RequireEmailConfirm' to be true. Prevents new registration if ip address has a pending registration on selected mail.
-	'PincodeEnabled'		=> true,					// Whether or not the pincode system is enabled in your server. (Check your char_athena.conf file. Enabled by default.)
+	'PincodeEnabled'			=> true,					// Whether or not the pincode system is enabled in your server. (Check your char_athena.conf file. Enabled by default.)
 	'MailerFromAddress'			=> 'noreply@localhost',		// The e-mail address displayed in the From field.
 	'MailerFromName'			=> 'MailerName',			// The name displayed with the From e-mail address.
 	'MailerUseSMTP'				=> false,					// Whether or not to use a separate SMTP server for sending mail.
@@ -78,15 +80,15 @@
 	'ShowRenderDetails'			=> true,					// Shows the "page rendered in X seconds" and "number of queries executed: X" in the default theme.
 	'UseCleanUrls'				=> false,					// Set to true if you're running Apache and it supports mod_rewrite and .htaccess files.
 	'DebugMode'					=> false,					// Set to false to minimize technical details from being output by Flux. WARNING: DO NOT USE THIS OPTION ON A PUBLICALLY-ACCESSIBLE CP.
-	'UseCaptcha'				=> true,					// Use CAPTCHA image for account registration to prevent automated account creations. (Requires GD2/FreeType2)
+	'UseCaptcha'				=> false,					// Use CAPTCHA image for account registration to prevent automated account creations. (Requires GD2/FreeType2)
 	'UseLoginCaptcha'			=> false,					// Use CAPTCHA image for account logins. (Requires GD2/FreeType2)
 	'EnableReCaptcha'			=> false,					// Enables the use of reCAPTCHA instead of Flux's native GD2 library (http://www.google.com/recaptcha)
 	'ReCaptchaPublicKey'		=> '...',					// This is your reCAPTCHA public key [REQUIRED FOR RECAPTCHA] (sign up at http://www.google.com/recaptcha)
 	'ReCaptchaPrivateKey'		=> '...',					// This is your reCAPTCHA private key [REQUIRED FOR RECAPTCHA] (sign up at http://www.google.com/recaptcha)
 	'ReCaptchaTheme'			=> 'light',					// ReCaptcha theme to use (Value: dark or light) (see: https://developers.google.com/recaptcha/docs/display#render_param)
 	'DisplaySinglePages'		=> true,					// Whether or not to display paging for single page results.
 	'ForwardYears'				=> 15,						// (Visual) The number of years to display ahead of the current year in date inputs.
-	'BackwardYears'				=> 30,						// (Visual) The number of years to display behind the current year in date inputs.
+	'BackwardYears'				=> 60,						// (Visual) The number of years to display behind the current year in date inputs.
 	'ColumnSortAscending'		=> ' ▲',					// (Visual) Text displayed for ascending sorted column names.
 	'ColumnSortDescending'		=> ' ▼',					// (Visual) Text displayed for descending sorted column names.
 	'CreditExchangeRate'		=> 1.0,						// The rate at which credits are exchanged for dollars.
@@ -96,13 +98,28 @@
 	'MoneyThousandsSymbol'		=> ',',						// (Visual) Thousandths place separator (a period in European currencies).
 	'MoneyDecimalSymbol'		=> '.',						// (Visual) Decimal separator (a comma in European currencies).
 	'AcceptDonations'			=> true,					// Whether or not to accept donations.
-	'PayPalIpnUrl'				=> 'www.sandbox.paypal.com',// The URL for PayPal's IPN responses (www.paypal.com for live and www.sandbox.paypal.com for testing)
+	'PayPalIpnUrl'				=> 'www.paypal.com',		// The ipnpb.paypal.com and ipnpb.sandbox.paypal.com endpoints only accept HTTPS connections. If you currently use www.paypal.com, you should move to ipnpb.paypal.com when you update your code to use HTTPS.
 	'PayPalBusinessEmail'		=> 'admin@localhost',		// Enter the e-mail under which you have registered your business account.
 	'PayPalReceiverEmails'		=> array(					// These are the receiver e-mail addresses who are allowed to receive payment.
 		//'admin2@localhost',								// -- This array may be empty if you only use one e-mail
 		//'admin3@localhost'								// -- because your Business Email is also checked.
 	),
 	'PaypalHackNotify'          => true,                    // Send email notification if hack attempt detected (Notification will be send for each address in list PayPalBusinessEmail and PayPalReceiverEmails)
+	'PayPalAllowedHosts'        => array(					// PayPal IP list https://www.paypal.com/fm/smarthelp/article/what-are-the-ip-addresses-for-live-paypal-servers-ts1056
+		'ipn.sandbox.paypal.com',
+		'notify.paypal.com',
+		'66.211.170.66',
+		'173.0.81.1',
+		'173.0.81.0/24',
+		'173.0.81.33',
+		'173.0.81.65',
+		'173.0.81.140',
+		'64.4.240.0/21',
+		'64.4.248.0/22',
+		'6.211.168.0/22',
+		'173.0.80.0/20',
+		'91.243.72.0/23'
+	),
 	'GStorageLeaderOnly'		=> false,					// Only allow guild leader to view guild storage rather than all members?
 	'DivorceKeepChild'			=> false,					// Keep child after divorce?
 	'DivorceKeepRings'			=> false,					// Keep wedding rings after divorce?
@@ -156,7 +173,7 @@
 	'BlacksmithRankingLimit'	=> 20,						//
 	'HomunRankingLimit'			=> 20,						//
 	'MVPRankingLimit'			=> 20,						//
-	
+
 	'RankingHideGroupLevel'		=> AccountLevel::LOWGM,		//
 	'InfoHideZenyGroupLevel'	=> AccountLevel::LOWGM,		// Minimum group level of account to hide zeny from in server information page.
 
@@ -197,8 +214,8 @@
 
 	'AdminMenuNewStyle'			=> true,					// Use new-style admin menu;  Applies to 'default' theme.
 	'EnablePeakDisplay'			=> true,					// Display Peak User count on Server Status page.
-	
-	
+
+
 // News Options
 	'CMSNewsOnHomepage'			=> true,					// Display News on Home Page instead of "You've Just Installed FluxCP" message?
 	'CMSNewsType'				=> 1,						// Type = source of news feed:
@@ -220,10 +237,12 @@
 // Discord Webhooks
 	'DiscordUseWebhook'			=> false,
 	'DiscordWebhookURL'			=> 'enter_webhook_url_from_discord_here',
-	'DiscordSendOnRegister'			=> true,
-	'DiscordSendOnNewTicket'		=> true,
-	'DiscordSendOnWebCommand'		=> true,
-	'DiscordSendOnMarketing'		=> true,
+    'DiscordSendOnRegister'     => true, // Sends a channel message when someone registers
+    'DiscordSendOnNewTicket'    => true, // Sends a channel message when someone submits a new ticket to the Service Desk
+    'DiscordSendOnWebCommand'   => true, // Sends a channel message when someone uses the Web Command feature in FluxCP
+    'DiscordSendOnMarketing'    => true, // Sends a channel message when someone uses the Send Email feature in FluxCP
+
+	'TinyMCEKey'				=> 'no-key',				// Register for a key at https://www.tiny.cloud/my-account/dashboard/
 
 	// These are the main menu items that should be displayed by themes.
 	// They route to modules and actions.  Whether they are displayed or
@@ -236,8 +255,8 @@
 			//'ForumLabel'		=> array('module' => 'forums'), 						// Built-in forum link
 			'NewsLabel'			=> array('module' => 'news'),
 			// Sample items for pages function.
-			'DownloadsLabel'		=> array('module' => 'pages','action'=>'content&path=downloads'),
-			'RulesLabel'			=> array('module' => 'pages','action'=>'content&path=rules'),
+			'DownloadsLabel'		=> array('module' => 'pages','action'=>'content','param'=>array('path'=>'downloads')),
+			'RulesLabel'			=> array('module' => 'pages','action'=>'content','param'=>array('path'=>'rules')),
 			// End sample items for pages function.
 		),
 		'AccountLabel'		=> array(
@@ -291,7 +310,7 @@
 			//'Economy'		=> array('module' => 'economy')
 		)
 	),
-	
+
 	// Sub-menu items that are displayed for any action belonging to a
 	// particular module. The format it simple.
 	'SubMenuItems'	=> array(
@@ -376,7 +395,6 @@
 		),
 		'item'			=> array(
 			'index'			=> 'List Items',
-			'add'			=> 'Add Item',
 			'iteminfo'		=> 'Add Item Info',
 		),
 		'pages'			=> array(
@@ -401,7 +419,7 @@
 			'index'			=> 'Buyers',
 		),
 	),
-	
+
 	'AllowMD5PasswordSearch'		=> false,
 	'ReallyAllowMD5PasswordSearch'	=> false, // Are you POSITIVELY sure?
 
@@ -437,9 +455,9 @@
 	// Shouldn't touch this either.
 	'ItemTypes'						=> include('itemtypes.php'),
 
-	// Special Item Types with their corresponding names (For Weapons & Ammo by default).
+	// Item SubTypes with their corresponding names.
 	// Shouldn't touch this either.
-	'ItemTypes2'					=> include('itemtypes2.php'),
+	'ItemSubTypes'					=> include('itemsubtypes.php'),
 
 	// Common Equip Location Combinations with their corresponding names.
 	// Shouldn't touch this unless you've added custom combinations.
@@ -472,6 +490,7 @@
 
 	// rA monster modes mapping.
 	'MonsterModes'					=> include('monstermode.php'),
+	'MonsterAI'						=> include('monster_ai.php'),
 
 	// Item shop categories.
 	'ShopCategories'				=> include('shopcategories.php'),
@@ -488,6 +507,15 @@
 	// Castle names.
 	'CastleNames'					=> include('castlenames.php'),
 
+	// Trade restrictions.
+	'TradeRestriction'				=> include('trade_restrictions.php'),
+
+	// Item flags.
+	'ItemFlags'						=> include('itemsflags.php'),
+
+	// Item random options.
+	'RandomOptions'					=> include('item_randoptions.php'),
+
 	// DON'T TOUCH. THIS IS FOR DEVELOPERS.
 	'FluxTables'		=> array(
 		'CreditsTable'			=> 'cp_credits',