Jump to content

AnnieRuru

Script Developers
  • Content Count

    1677
  • Joined

  • Last visited

  • Days Won

    245

Reputation Activity

  1. Upvote
    AnnieRuru got a reaction from Habilis in LOGIN REWARD VIA LAST MAC   
    @Habilis
    ahem ... getitembound should do most of the trick
    although like what you did with Trade permission is ... yeah more painful
     
  2. Upvote
    AnnieRuru reacted to w0wZukuBg in [Showcase] Arena R4   
    Check out my first release - a map with trains for routes 
    between Einbroch and Lighthalzen here:
     
  3. Upvote
    AnnieRuru reacted to w0wZukuBg in [Showcase] Arena R4   
    Hello, I found this object at 1 @ rev when I looked through the list of
    of kRO locations. I liked it, it's more like an effect. This barrier on
    my map is marked by cells through which you can only shoot.
    And you can enter the zone only from the north side.

    Hi, I decided to support the section a little 
  4. Upvote
    AnnieRuru got a reaction from Begin in Modify reward script   
    @Begin
    the script was already done with reset at 12am every day
    however due to the information that meko said ...
    I'm going to revise this script ...
    prontera,155,180,5 script Reward NPC 4_F_FAIRYKID4,{ .@date = atoi( gettimestr("%Y%m%d", 20 ) ); mes "["+ strnpcinfo(NPC_NAME) +"]"; if ( #reward_daytime == .@date ) { mes "You have claimed the reward today."; close; } if ( @reward_timestamp && @reward_timestamp + .countdown <= gettimetick(2) ) { mes "Here is the surprise reward"; getitembound Poring_Coin, 1, 1; #reward_daytime = .@date; close; } if ( @reward_timestamp ) { mes "Countdown timer..."; .@timeleft = @reward_timestamp + .countdown - gettimetick(2); mes .@timeleft /3600 +" hour "+ .@timeleft %3600/60 +" min "+ .@timeleft %60 +" sec left"; close; } mes "Hello "+ strcharinfo(PC_NAME) +", I am here to give you a daily Surprise Reward. Do you want to have it?"; next; select "Yes, sure !!"; mes "["+ strnpcinfo(NPC_NAME) +"]"; mes "You can claim the reward in 5 hours time."; close2; addtimer .countdown *1000, strnpcinfo(NPC_NAME) +"::OnClaimReward"; @reward_timestamp = gettimetick(2); end; OnClaimReward: dispbottom "You can claim Daily Login Reward now."; end; OnInit: // .countdown = 5*60*60; // 5 hours .countdown = 5; } no longer use IP address, but use account bound items
    so that means, this script will give out the reward every day, reset on 12am, and the item give out is account bound
    .... probably the better way for not abuse the reward than the script I posted earlier
  5. Upvote
    AnnieRuru reacted to MikZ in LOGIN REWARD VIA LAST MAC   
    @AnnieRuru its okay. 
    I somehow just edit it with the common query command and change the ip to unique_id. Somehow it worked fine for daily login.
    Wonder if you have any suggestion or tips to improve this. I don't kinda understand the script cuz im noob. but that this mean every 00:00 server time you will be able to get coin or 24hr from last talked to the npc?
    prontera,164,173,5 script Daily Login 4_F_FAIRYKID4,{ // $ip_reward_daytime = 0; query_sql("SELECT `last_unique_id` from `login` WHERE `account_id` = "+getcharid(3),@lui$); mes "["+ strnpcinfo(NPC_NAME) +"]"; if ( $ip_reward_daytime != atoi( gettimestr("%Y%m%d", 20 ) ) ) { $ip_reward_daytime = atoi( gettimestr("%Y%m%d", 20 ) ); deletearray $ip_reward$; } .@size = getarraysize( $ip_reward$ ); while ( @lui$ != $ip_reward$[.@i] && .@i < .@size ) { ++.@i; } if ( .@i < .@size ) { mes "You have claimed the reward."; close; } if ( @ip_reward && @ip_reward + .countdown <= gettimetick(2) ) { mes "Here is the surprise reward"; getitem 25045, 1; $ip_reward$[ getarraysize( $ip_reward$ ) ] = @lui$; close; } if ( @ip_reward ) { mes "Countdown timer..."; .@timeleft = @ip_reward + .countdown - gettimetick(2); mes .@timeleft /3600 +" hour "+ .@timeleft %3600/60 +" min "+ .@timeleft %60 +" sec left"; close; } mes "Hello "+ strcharinfo(PC_NAME) +", I am here to give you a daily Surprise Reward. Do you want to have it?"; next; select "Yes, sure !!"; mes "["+ strnpcinfo(NPC_NAME) +"]"; mes "You can claim the reward after an hour."; close2; addtimer .countdown *1000, strnpcinfo(NPC_NAME) +"::OnClaimReward"; @ip_reward = gettimetick(2); end; OnClaimReward: dispbottom "You can claim Daily Login Reward now."; end; OnInit: .countdown = 1*60*60; // 5 hours // .countdown = 5; }  
  6. Upvote
    AnnieRuru reacted to meko in LOGIN REWARD VIA LAST MAC   
    IP addresses and mac addresses do not uniquely identify people. Most home internet users have dynamic IP addresses assigned by their ISP, so it changes over time, and some ISPs even assign a different one every single time the router is rebooted (ie: Orange). Even with a static IP, nothing prevents anyone from using a VPN, tor, or any other anonymity tool. IP addresses may also be shared: some schools, dormitories, and organizations have a single address for every single computer on its network, so you could end up mistaking hundreds of people as the same person. Some computers themselves are also shared (ie: with coworkers, family members, friends, …). As for mac addresses, they can very easily be spoofed, and one could even make a script to change their mac address every minute if they wanted to... so yeah, that's a bad idea too.
    If this still does not discourage you from using mac addresses, feel free to add this "feature" to Hercules: https://github.com/HerculesWS/Hercules/issues/1734
     
    There's really no silver bullet to really be sure of the identity of someone, but one of the approaches that kinda works is to make abuse costly on abusers, while not imposing a huge burden on non-abusers. What works best is doing a physical verification instead of a digital one when someone creates an account. For example, most social media platforms now ask you to provide and validate a phone number. This means if someone were to bypass this verification they would have to have more than one phone. Some sites, such as Paypal, go even further ask you for your credit card number (or bank account number) and then do a transaction on it (usually $1), to see if the card is valid. This means you would have to have more than one credit card if you want to bypass this verification, which implies physically going to your bank, making an appointment, and opening a new account. Some (such as Google) prefer to snail mail you an envelope containing a code, which you then have to enter on their website. To abuse this you would need more than one street address. Keep in mind that this only makes it harder on would-be abusers and that nothing can 100% fingerprint someone. Even DNA profiling isn't perfect.
  7. Upvote
    AnnieRuru got a reaction from MikZ in LOGIN REWARD VIA LAST MAC   
    the script you posted made by me ...
    sorry as I don't own Gepard, I don't know how it works so I couldn't make this system for you
    and what meko said was spot on,
    just reminded the IP address detection method on this script can just bypass by restarting the modem
    the mac address system though ...
    sry maybe I was out from RO scene too long ?
    2 years ago I heard that mac address is something that is only possible by adding a 3rd party program running in the background ...
    and this makes me assume that Gepard is also something 3rd party program ... stuffs
  8. Upvote
    AnnieRuru reacted to TheReturn in Willing to pay for this agit defender script   
    you can check it out here:
     
  9. Upvote
    AnnieRuru got a reaction from Begin in Modify reward script   
    @Begin
    prontera,155,180,5 script Reward NPC 4_F_FAIRYKID4,{ // $ip_reward_daytime = 0; mes "["+ strnpcinfo(NPC_NAME) +"]"; if ( $ip_reward_daytime != atoi( gettimestr("%Y%m%d", 20 ) ) ) { $ip_reward_daytime = atoi( gettimestr("%Y%m%d", 20 ) ); deletearray $ip_reward$; } .@size = getarraysize( $ip_reward$ ); while ( getcharip() != $ip_reward$[.@i] && .@i < .@size ) { ++.@i; } if ( .@i < .@size ) { mes "You have claimed the reward with this IP address."; close; } if ( @ip_reward && @ip_reward + .countdown <= gettimetick(2) ) { mes "Here is the surprise reward"; getitem Poring_Coin, 1; $ip_reward$[ getarraysize( $ip_reward$ ) ] = getcharip(); close; } if ( @ip_reward ) { mes "Countdown timer..."; .@timeleft = @ip_reward + .countdown - gettimetick(2); mes .@timeleft /3600 +" hour "+ .@timeleft %3600/60 +" min "+ .@timeleft %60 +" sec left"; close; } mes "Hello "+ strcharinfo(PC_NAME) +", I am here to give you a daily Surprise Reward. Do you want to have it?"; next; select "Yes, sure !!"; mes "["+ strnpcinfo(NPC_NAME) +"]"; mes "You can claim the reward in 5 hours time."; close2; addtimer .countdown *1000, strnpcinfo(NPC_NAME) +"::OnClaimReward"; @ip_reward = gettimetick(2); end; OnClaimReward: dispbottom "You can claim Daily Login Reward now."; end; OnInit: .countdown = 5*60*60; // 5 hours // .countdown = 5; }
  10. Upvote
    AnnieRuru got a reaction from xVec in Russian Roulette   
    Download: 1.1
    script
    just join the event and then AFK there and wait for the luck ...
    the last one who has enough patience ... or you are just god damn lucky ... might win this event

     
  11. Upvote
    AnnieRuru got a reaction from Legend in Russian Roulette   
    Download: 1.1
    script
    just join the event and then AFK there and wait for the luck ...
    the last one who has enough patience ... or you are just god damn lucky ... might win this event

     
  12. Upvote
    AnnieRuru got a reaction from TheReturn in Russian Roulette   
    Download: 1.1
    script
    just join the event and then AFK there and wait for the luck ...
    the last one who has enough patience ... or you are just god damn lucky ... might win this event

     
  13. Upvote
    AnnieRuru got a reaction from Rebel in Russian Roulette   
    Download: 1.1
    script
    just join the event and then AFK there and wait for the luck ...
    the last one who has enough patience ... or you are just god damn lucky ... might win this event

     
  14. Upvote
    AnnieRuru got a reaction from anacondaq in Sample Questlog & Achievement script   
    Download: 1.1
    sample quest log
    Download: 1.1
    sample daily quest
    these are 5 sample quests using quest log system
    this was actually made as a sample script inside a script support section in eathena forum
    original topic from eathena
    thanks to paradog eathena admin that makes eathena forum down, almost gonna remake everything from scratch
    luckily I got a few segment here and there in my old hard-disk so doesn't take too much time to write this sample
    Quest #1
    typical talk to npc A, then npc B ... etc
    demonstrate how to use *checkquest
    Quest #2
    collect item quest
    just checkitem with it
    I still don't know how to use the client to trace is the item collecting has completed or not
    Quest #3
    kill monster quest
    demonstrate how to use *checkquest( x, HUNTING )
    Quest #4
    typical talk to npc A, then npc B ... BUT with a time limit
    demonstrate how to use *checkquest( x, PLAYTIME )
    Quest#5
    if player having this quest, player can *getitem by killing this monster
    see https://github.com/HerculesWS/Hercules/blob/stable/db/quest_db.conf#L45-L50

     

    and I want to remind this is just a sample script
    usually make for source modification on quest log system (now is 3rd time I think ?)
     
     
     
    2 sample script for daily system
    1. Daily item giver ...
    although I think this should done with attendance system ...
    2. Daily hunting ...
    self explain ...


     
     
    [109991] = { UI_Type = 0, group = "CHATTING", major = 4, minor = 0, title = "Tavern Helper", content = { summary = "Visit the Tavern Master", details = "Visit the Tavern Master in Prontera." }, resource = { [1] = { text = "Acolyte Trouble" }, [2] = { text = "Gemstone shortage" }, [3] = { text = "Poring Problem" }, [4] = { text = "Hand over the Artifact" }, [5] = { text = "Shining Rocker" } }, reward = { title = 991 }, score = 5 }, [109992] = { UI_Type = 1, group = "GOAL_ACHIEVE", major = 6, minor = 0, title = "Complete Daily Quest for 30 times", content = { summary = "Complete Daily Quest", details = "Complete Daily Quest for 30 times and you can earn some nice rewards!" }, resource = { [1] = { text = "Collect Daily Items 30 times", count = 30 }, [2] = { text = "Complete Daily Quest 30 times", count = 30 } }, reward = { title = 992, item = 513 }, score = 30 }, UI_TYPE
    - display a bar like in the daily quest screenshot
    - 0: in the [resource], doesn't support [count]
    - 1: support [count]
    group:
    - read from data\texture\À¯ÀúÀÎÅÍÆäÀ̽º\achievement

    major
    - 1: General tab
    - 2: Adventure tab
    - 3: Battle tab
    - 4: Quest tab
    - 5: Memorial tab
    - 6: Feat tab
  15. Upvote
    AnnieRuru got a reaction from Helena in Annieruru emp BG   
    http://upaste.me/c7b7498104f6c72df
    you know ... this script do exactly the same thing as the previous one ...
    now you can see the script just look totally different
    EDIT: although I don't know you are also obsess with instanced battleground or not ... since both hercules and rathena also can do it
  16. Upvote
    AnnieRuru got a reaction from Helena in Annieruru emp BG   
    hercules<=>rathena battleground/instance/mob-controller script commands are totally different
    I also have to admit hercules one are always on the harder side
    ... this is not funny matter .... just ... well ... see how the script grow in size comparative to rathena ones,
    and you'll understand why until today I still haven't convert my arathi basin on rathena into hercules
    http://upaste.me/f08349808ea0ba1b1
  17. Upvote
    AnnieRuru got a reaction from MikZ in CUSTOM ITEM SCRIPT FOR @GO   
    assuming you have this https://github.com/HerculesWS/Hercules/blob/stable/npc/mapflag/town.txt
    prontera,150,185,5 script test 1_F_MARIA,{ input .@map$; if ( getmapusers( .@map$ ) == -1 ) dispbottom "no such map"; else if ( !getmapflag( .@map$, mf_town ) ) dispbottom "not a town"; else atcommand "@go "+ .@map$; // yeah lazy to note down the coordinate, so use atcommand end; }  
  18. Upvote
    AnnieRuru got a reaction from luizragna in Help Learning Instance and how it works. <3   
    similar topic appear in rathena forum
    prontera,155,180,0 script Test Instance 1_F_MARIA,{ if ( has_instance2("guild_vs2") >= 0 ) { // dispbottom has_instance2("guild_vs2") +" destroy"; instance_destroy has_instance2("guild_vs2"); } if ( ( .@ins = instance_create( "Test Instance", getcharid(CHAR_ID_ACCOUNT), IOT_CHAR ) ) < 0 ) { mes "error : "+ .@ins; close; } if ( !getstrlen( instance_attachmap( "guild_vs2", .@ins, true, ( getcharid(CHAR_ID_ACCOUNT) )+"INST" ) ) ) { mes "error : 5"; instance_destroy .@ins; close; } instance_set_timeout 3600, 15, .@ins; instance_init .@ins; warp has_instance("guild_vs2"), 49,49; end; } guild_vs2,49,49,5 script test dialog 1_F_MARIA,{ dispbottom strnpcinfo(NPC_MAP); mesf "%d monsters on this map", 'amount; next; select "Destroy"; instance_destroy; end; OnInstanceInit: monster has_instance("guild_vs2"), 49,49, "--ja--", PORING, 10, instance_npcname( strnpcinfo(NPC_NAME) )+"::OnMobDead"; 'amount = 10; end; OnMobDead: --'amount; if ( !'amount ) instance_announce -1, "all monster killed", bc_map; end; } few things noted for hercules ones
    1. hercules has more instance related script commands, but also make this more flexible to write once you learn them all
    a. hercules has *instance_attach script command, make sure this script command is added before trying do anything instance related in the register npc
    b. hercules has to emulate the map name with *instance_attachmap if the map name doesn't follow the syntax <number>@<5 string limit>
    2. hercules instance ID start from 0, rathena instance ID start from 1
    a. make sure the instance_announce is set to -1
    3. hercules seems cannot *instance_destroy inside the instance map itself ... has to rely on *instance_set_timeout of the timeout value
  19. Upvote
    AnnieRuru got a reaction from MikZ in King Of Emperium Hill ROYAL Rumble   
    script -> http://upaste.me/94e94979017edd8ef
    plugin -> http://upaste.me/d74c497892f91a6d6
    @MikZ next time should ask on the forum instead of bombard my PM box
    and its your own topic too
  20. Upvote
    AnnieRuru got a reaction from TheReturn in Help Learning Instance and how it works. <3   
    similar topic appear in rathena forum
    prontera,155,180,0 script Test Instance 1_F_MARIA,{ if ( has_instance2("guild_vs2") >= 0 ) { // dispbottom has_instance2("guild_vs2") +" destroy"; instance_destroy has_instance2("guild_vs2"); } if ( ( .@ins = instance_create( "Test Instance", getcharid(CHAR_ID_ACCOUNT), IOT_CHAR ) ) < 0 ) { mes "error : "+ .@ins; close; } if ( !getstrlen( instance_attachmap( "guild_vs2", .@ins, true, ( getcharid(CHAR_ID_ACCOUNT) )+"INST" ) ) ) { mes "error : 5"; instance_destroy .@ins; close; } instance_set_timeout 3600, 15, .@ins; instance_init .@ins; warp has_instance("guild_vs2"), 49,49; end; } guild_vs2,49,49,5 script test dialog 1_F_MARIA,{ dispbottom strnpcinfo(NPC_MAP); mesf "%d monsters on this map", 'amount; next; select "Destroy"; instance_destroy; end; OnInstanceInit: monster has_instance("guild_vs2"), 49,49, "--ja--", PORING, 10, instance_npcname( strnpcinfo(NPC_NAME) )+"::OnMobDead"; 'amount = 10; end; OnMobDead: --'amount; if ( !'amount ) instance_announce -1, "all monster killed", bc_map; end; } few things noted for hercules ones
    1. hercules has more instance related script commands, but also make this more flexible to write once you learn them all
    a. hercules has *instance_attach script command, make sure this script command is added before trying do anything instance related in the register npc
    b. hercules has to emulate the map name with *instance_attachmap if the map name doesn't follow the syntax <number>@<5 string limit>
    2. hercules instance ID start from 0, rathena instance ID start from 1
    a. make sure the instance_announce is set to -1
    3. hercules seems cannot *instance_destroy inside the instance map itself ... has to rely on *instance_set_timeout of the timeout value
  21. Upvote
    AnnieRuru got a reaction from grimmm in Help Learning Instance and how it works. <3   
    similar topic appear in rathena forum
    prontera,155,180,0 script Test Instance 1_F_MARIA,{ if ( has_instance2("guild_vs2") >= 0 ) { // dispbottom has_instance2("guild_vs2") +" destroy"; instance_destroy has_instance2("guild_vs2"); } if ( ( .@ins = instance_create( "Test Instance", getcharid(CHAR_ID_ACCOUNT), IOT_CHAR ) ) < 0 ) { mes "error : "+ .@ins; close; } if ( !getstrlen( instance_attachmap( "guild_vs2", .@ins, true, ( getcharid(CHAR_ID_ACCOUNT) )+"INST" ) ) ) { mes "error : 5"; instance_destroy .@ins; close; } instance_set_timeout 3600, 15, .@ins; instance_init .@ins; warp has_instance("guild_vs2"), 49,49; end; } guild_vs2,49,49,5 script test dialog 1_F_MARIA,{ dispbottom strnpcinfo(NPC_MAP); mesf "%d monsters on this map", 'amount; next; select "Destroy"; instance_destroy; end; OnInstanceInit: monster has_instance("guild_vs2"), 49,49, "--ja--", PORING, 10, instance_npcname( strnpcinfo(NPC_NAME) )+"::OnMobDead"; 'amount = 10; end; OnMobDead: --'amount; if ( !'amount ) instance_announce -1, "all monster killed", bc_map; end; } few things noted for hercules ones
    1. hercules has more instance related script commands, but also make this more flexible to write once you learn them all
    a. hercules has *instance_attach script command, make sure this script command is added before trying do anything instance related in the register npc
    b. hercules has to emulate the map name with *instance_attachmap if the map name doesn't follow the syntax <number>@<5 string limit>
    2. hercules instance ID start from 0, rathena instance ID start from 1
    a. make sure the instance_announce is set to -1
    3. hercules seems cannot *instance_destroy inside the instance map itself ... has to rely on *instance_set_timeout of the timeout value
  22. Upvote
    AnnieRuru got a reaction from LordJasz in Mission board 'only once' doesn't work.   
    2.4b http://upaste.me/0c8149627b3ddc0c6
    - fix a typo in mission limitation can do daily or only once, actually allows to do twice instead of once
    - fix a typo in mission time limit, if your mission no.2/3/4 has expired, the script always says slot no.1
    @Helena
    2.4c http://upaste.me/7c9c496344829d36f
    - fix this f*cking deny usage once again ...this time when submit a mission, the getarraysize calculation is made AFTER declare the datetime format
    - if the whole board is set to EVERYDAY, remove the player side deny usage variable completely on the next day
  23. Upvote
    AnnieRuru got a reaction from xVec in King of Emperium Hill   
    got a PM from rAthena member ask me to fix this
    yeah both rathena patch and hercules plugin ... all broken
    so ....
    update to 1.2
    Script
    Plugin for Hercules
    Patch for rAthena
  24. Upvote
    AnnieRuru reacted to bWolfie in [Guide] Mapcache Generation 2018   
    As of Release v2018.03.13, the method to generate mapcache for Hercules has changed. A lot of people. myself included, were confused as to how it works. In this thread, I will do my best to explain the new way to generate your cache. This guide is intended to help people using the old system, not to aid new people (i.e. never generated mapcache before), so if you are new, some of it may seem like alien talk.
    Old (your source predates [is older than] Feb 18, 2018)
    In the old system, there were two ways to generate mapcache
    You could run the mapcache executable in Hercules root folder. Or use a program such as WeeMapCache to edit in your required mapcache. These two methods would generate or alter your required mapcache located in db/[pre-re or re]/map_cache.dat. However, they are no longer supported.
    New (your source is using Release v2018.03.13 or newer)
    The new system involves the use of the new 'mapcache' plugin to generate files. Some quick points:
    db/[pre-re or re]/map_cache.dat has been dropped (no longer supported). In its place are individual .mcache files for every map located in maps/[pre-re or re]/ Mapcache executable has been removed. Replaced with the mapcache plugin (src/plugins/mapcache.c). How to generate the mapcache?
    Same as before, check conf/map/maps.conf and db/map_index.txt have all the maps you want to cache. Your maps need to exist somewhere in your repository! There are two ways for the plugin to find them:
    a. Place all your maps, including resnametable.txt, inside the data folder of your Hercules repo. I.e. Hercules/data/prontera.gat/gnd/gnd/rsw (note: I forget if all three files are needed).
    b. OR Configure your conf/grf-files.txt to tell it where to find your GRF(s) which contains your maps. Build the mapcache plugin. On linux, this can be done by running the following command:
    make plugin.mapcache
    If using MSVC, compile as you would any other plugin. Execute plugin. This can be done using the following command:
    ./map-server --load-plugin mapcache [param]
    In windows, just remove the './' and run the commands in your command prompt. The params:
    The first thing you should do is run
    ./map-server --load-plugin mapcache --help
    A list of usable parameters will appear. Here are the ones you need to know for mapcache:
    [Info]:   --convert-old-mapcache         Converts an old db/pre-re/map_cache.dat file to the new format. [Mapcache] [Info]:   --rebuild-mapcache             Rebuilds the entire mapcache folder (maps/pre-re/), using db/map_index.txt as index. [Mapcache] [Info]:   --map <name>                   Rebuilds an individual map's cache into maps/pre-re/ (usage: --map <map_name_without_extension>). [Mapcache] [Info]:   --fix-md5                      Updates the checksum for the files in maps/pre-re/, using db/map_index.txt as index (see PR #1981). [Mapcache] ./map-server --load-plugin mapcache --convert-old-mapcache
    Rebuild all the .mcache files using your old db/[pre-re or re]map_cache.dat file.
    NOTE: You should only run this command when you have an old map_cache.dat file you need to convert.
    ./map-server --load-plugin mapcache --rebuild-mapcache
    Rebuild all the .mcache files using your map files specified in step 2 of generation.
    NOTE: You should only run this command in special circumstances. This erases ALL the existing mapcache and rebuilds it with whatever files you provide it. If you don't have the required files, the build will fail and you will be left with missing mapcache files, meaning you won't be able to access those particular maps.
    ./map-server --load-plugin mapcache --map <name>
    Rebuild the .mcache file for the map name you specify. E.g. if you replace <name> with prontera, the maps/[pre-re or re]/prontera.mcache file will be rebuilt.
    NOTE: This is the best command to run, as it only caches a single map at a time.
    ./map-server --load-plugin mapcache --fix-md5
    I don't know what checksum is for.
    The End
    Feel free to ask for help here. I'll try to answer questions re: mapcache if possible. And if you think anything needs correcting or added, let me know.
    Hope this helps!
  25. Upvote
    AnnieRuru got a reaction from Cabrera in Advance SQL commands   
    1. When to use escape_sql script command
     
    .
    input .@haha$; dispbottom .@haha$; dispbottom escape_sql(.@haha$); it doesn't has much differences, because it only affect 3 special characters
    ' <- single quotation mark
    " <- double quotation mark
    \ <- left slash
    if I input -> haha"lala'hehe <-
    it will return -> haha\"lala\'hehe <-
    this is what we call, Escape a character
    in hercules script, we also know we can use " symbol in any string input
    mes "Susan says :\" Today I ate 3 eggs \"."; where in the game client, you can see the " symbol in the npc msg box
    let's say I have a sql script like this
    prontera,153,171,5 script Show Characters 1_F_MARIA,{ mes "input name, I'll show you all characters name it has on that player's account"; input .@name$; .@nb = query_sql("SELECT `char_id`, `name` FROM `char` WHERE `name` LIKE '"+ .@name$ +"'", .@cid, .@name$); if ( !.@nb ) { mes "no result"; close; } for ( .@i = 0; .@i < .@nb; ++.@i ) mes .@cid[.@i] +" "+ .@name$[.@i]; close; } this script has a possibility to be hacked
    because to perform sql injection, I can enclose the string with quotation mark, then use another sql command to hack
    BUT with an escape_sql command, if the user want to enclose the string with quotation mark to hack the script
    the escape_sql command escaped the string, the quotation mark the user input will be escaped
    thus the script will become impossible to hack
    just now that script was for string input
    prontera,153,171,5 script Show Characters 1_F_MARIA,{ mes "input account ID, I'll show you all characters name it has on that player's account"; input .@aid$; .@nb = query_sql("SELECT `char_id`, `name` FROM `char` WHERE `account_id` = "+ escape_sql(.@aid$), .@cid, .@name$); if ( !.@nb ) { mes "no result"; close; } for ( .@i = 0; .@i < .@nb; ++.@i ) mes .@cid[.@i] +" "+ .@name$[.@i]; close; } this is another stupid case.
    1. the scripter use string input while the script just needed a number
    2. even with escape_sql command over there, there is no quotation mark at all
    yes this script also has a risk to be hack
    because escape_sql only escape quotation mark.
    that hacker don't even have to input quotation mark because it is a number
    and an injection query can be sent without any quotation mark input
    there are 2 ways to solve this
    either use numeric variable for the input command
    or enclose that ....
    ..... WHERE `account_id` = '"+ escape_sql(.@aid$) +"'", .... with single quotation mark, when the hacker input a quotation mark will be escaped by escape_sql command
    Reference : https://www.w3schools.com/sql/sql_injection.asp
    escape_sql command for another thing is
    if the player register their names containing ' or ", these characters are escaped
    only happens when the server have no restriction on the creation of players name
    hercules\conf\char\char-server.conf
    // Manage possible letters/symbol in the name of charater. Control character (0x00-0x1f) are never accepted. Possible values are: // NOTE: Applies to character, party and guild names. // 0: no restriction (default) // 1: only letters/symbols in 'name_letters' option. // 2: Letters/symbols in 'name_letters' option are forbidden. All others are possibles. name_option: 1  
    and this was what happened to my SQL dota pvpladder script
    Silo's Babies <-- this is a guild name
    you can see the 5th string has a single quotation mark
    with escape_sql command, that string will turn into
    Silo\'s Babies <-- the quotation mark is escaped when send to sql query
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.