Merge dev -> main for v5 release

.dockerignore

@@ -7,3 +7,5 @@ docs
 .git
 !.git/HEAD
 !.git/refs/*
+config/
+!config/defaults-*.json

.github/workflows/publish-image.yml

@@ -25,6 +25,7 @@ jobs:
             echo ::set-output name=channel::"latest"
             echo ::set-output name=version::main_$(cat VERSION)-${GITHUB_SHA::6}
           elif [[ "$GITHUB_REF" == "refs/heads/"* ]]; then
+            echo ::set-output name=channel::${GITHUB_REF/refs\/heads\//}-"latest"
             echo ::set-output name=version::${GITHUB_REF/refs\/heads\//}-$(cat VERSION)-${GITHUB_SHA::6}
           elif [[ "$GITHUB_REF" == "refs/tags/"* ]]; then
             echo ::set-output name=channel::${GITHUB_REF/refs\/tags\//}
@@ -60,3 +61,5 @@ jobs:
           token: ${{ secrets.TELEGRAM_TOKEN }}
           message: "New Docker image has been built: ${{ steps.meta.outputs.tags }}"
           disable_web_page_preview: true
+          disable_notification: true
+

.gitignore

@@ -5,6 +5,7 @@
 /access/**
 /custom/**
 /ddos/**
+/core/tools/hash.php
 !/access/.gitkeep
 !/custom/.gitkeep
 !/ddos/.gitkeep

.htaccess

@@ -1,11 +1,23 @@
-# Block access to all dot files
-RedirectMatch 404 /\..*$
+# Deny everything by default
+Order deny,allow
+Deny from all
 
-# Block access to .git files and folders
-RedirectMatch 404 /\.git
+# Allow plain requests that get routed to index.php
+<FilesMatch "^$">
+    Allow from all
+</FilesMatch>
 
-# Block access to .json and .sql files
-RedirectMatch 404 /*\.(json|sql)$
+# Allow endpoints we expect to be called directly
+<FilesMatch "(index|raidpicture)\.php$">
+    Allow from all
+</FilesMatch>
 
-# Block access to specifc folders
-RedirectMatch 404 /(access|config|custom|ddos|lang|sql|screens)/
+# Allow webhook setup, it's just static
+<Files "webhook.html">
+    Allow from all
+</Files>
+
+# Allow metrics without appending /
+<Files "metrics">
+    Allow from all
+</Files>

VERSION

@@ -1 +1 @@
-4
+6

commands/delete.php

@@ -6,93 +6,64 @@
 //debug_log($update);
 //debug_log($data);
 
-// Check access.
-bot_access_check($update, 'access-bot');
+if($botUser->accessCheck('delete-own', true)) {
+  $userRestriction = 'AND raids.user_id = ?';
+  $binds = [$update['message']['chat']['id']];
+}elseif($botUser->accessCheck('delete-all', true)) {
+  $userRestriction = '';
+  $binds = [];
+}else {
+  $botUser->denyAccess();
+}
+
+$query = my_query('
+  SELECT  raids.*, gyms.gym_name
+  FROM    raids
+  LEFT JOIN gyms
+  ON      raids.gym_id = gyms.id
+  WHERE   raids.end_time > UTC_TIMESTAMP
+  ' . $userRestriction . '
+  ORDER BY raids.end_time ASC
+  LIMIT 20
+', $binds);
 
-// Count results.
-$count = 0;
-$own_sql = "";
-$own_arr = [];
-if(!bot_access_check($update, 'delete', true) && bot_access_check($update,'delete-own',true)) {
-    $own_sql = "AND users.user_id = :user_id";
-    $own_arr = [":user_id"=>$update['message']['from']['id']];
+if($query->rowCount() == 0) {
+  $msg = '<b>' . getTranslation('no_active_raids_found') . '</b>';
+  send_message(create_chat_object([$update['message']['chat']['id']]), $msg);
+  exit;
 }
+
 // Init text and keys.
 $text = '';
 $keys = [];
 
-try {
+while ($row = $query->fetch()) {
+  // Set text and keys.
+  $text .= $row['gym_name'] . CR;
+  $now = utcnow();
+  $today = dt2date($now);
+  $raid_day = dt2date($row['start_time']);
+  $start = dt2time($row['start_time']);
+  $end = dt2time($row['end_time']);
+  $text .= get_local_pokemon_name($row['pokemon'], $row['pokemon_form']) . SP . '—' . SP . (($raid_day == $today) ? '' : ($raid_day . ', ')) . $start . SP . getTranslation('to') . SP . $end . CR . CR;
+  $keys[] = button($row['gym_name'], ['raids_delete', 'r' => $row['id']]);
 
-    $query = '
-        SELECT
-            raids.*, gyms.lat ,
-            gyms.lon ,
-            gyms.address ,
-            gyms.gym_name ,
-            gyms.ex_gym ,
-            users. NAME
-        FROM
-            raids
-        LEFT JOIN gyms ON raids.gym_id = gyms.id
-        LEFT JOIN users ON raids.user_id = users.user_id
-        WHERE
-            raids.end_time > UTC_TIMESTAMP()
-        '.$own_sql.'
-        ORDER BY
-            raids.end_time ASC
-        LIMIT 20
-    ';
-    $statement = $dbh->prepare( $query );
-    $statement->execute($own_arr);
-    while ($row = $statement->fetch()) {
-        // Set text and keys.
-        $text .= $row['gym_name'] . CR;
-        $now = utcnow();
-        $today = dt2date($now);
-        $raid_day = dt2date($row['start_time']);
-        $start = dt2time($row['start_time']);
-        $end = dt2time($row['end_time']);
-        $text .= get_local_pokemon_name($row['pokemon'], $row['pokemon_form']) . SP . '—' . SP . (($raid_day == $today) ? '' : ($raid_day . ', ')) . $start . SP . getTranslation('to') . SP . $end . CR . CR;
-        $keys[] = array(
-            'text'          => $row['gym_name'],
-            'callback_data' => $row['id'] . ':raids_delete:0'
-        );
-
-        // Counter++
-        $count = $count + 1;
-    }
 }
-catch (PDOException $exception) {
 
-    error_log($exception->getMessage());
-    $dbh = null;
-    exit;
-}
+// Get the inline key array.
+$keys = inline_key_array($keys, 1);
 
-// Set message.
-if($count == 0) {
-    $msg = '<b>' . getTranslation('no_active_raids_found') . '</b>';
-} else {
-    // Get the inline key array.
-    $keys = inline_key_array($keys, 1);
+// Add exit key.
+$keys[][] = button(getTranslation('abort'), 'exit');
 
-    // Add exit key.
-    $keys[] = [
-        [
-            'text'          => getTranslation('abort'),
-            'callback_data' => '0:exit:0'
-        ]
-    ];
 
-    // Build message.
-    $msg = '<b>' . getTranslation('list_all_active_raids') . ':</b>' . CR;
-    $msg .= $text;
-    $msg .= '<b>' . getTranslation('select_gym_name') . '</b>' . CR;
-}
+// Build message.
+$msg = '<b>' . getTranslation('list_all_active_raids') . ':</b>' . CR;
+$msg .= $text;
+$msg .= '<b>' . getTranslation('select_gym_name') . '</b>' . CR;
 
 // Build callback message string.
 $callback_response = 'OK';
 
 // Send message.
-send_message($update['message']['chat']['id'], $msg, $keys, ['reply_markup' => ['selective' => true, 'one_time_keyboard' => true]]);
-?>
+send_message(create_chat_object([$update['message']['chat']['id']]), $msg, $keys, ['reply_markup' => ['selective' => true, 'one_time_keyboard' => true]]);

commands/events.php

@@ -0,0 +1,28 @@
+<?php
+// Write to log.
+debug_log('EVENTS()');
+
+// For debug.
+//debug_log($update);
+//debug_log($data);
+
+// Check access.
+$botUser->accessCheck('event-manage');
+
+$q = my_query('SELECT * FROM events');
+
+$msg = '<b>' . getTranslation('events_manage') . '</b>' . CR;
+
+foreach($q->fetchAll() as $event) {
+  if($event['id'] == EVENT_ID_EX) $event['name'] = getTranslation('Xstars');
+  if(empty($event['description'])) $event['description'] = '<i>' . getTranslation('events_no_description') . '</i>';
+  $msg .= '<u>' . $event['name'] . '</u>' . CR;
+  $msg .= $event['description'] . CR . CR;
+}
+
+$keys[][] = button(getTranslation('events_manage'), 'events');
+$keys[][] = button(getTranslation('events_create'), 'events_add');
+$keys[][] = button(getTranslation('done'), ['exit', 'd' => '1']);
+
+// Send message.
+send_message(create_chat_object([$update['message']['chat']['id']]), $msg, $keys, ['reply_markup' => ['selective' => true, 'one_time_keyboard' => true]]);