= 70300) session_set_cookie_params(['lifetime'=>0,'path'=>'/','secure'=>$secureCookie,'httponly'=>true,'samesite'=>'Lax']); session_start(); function h($v): string { return htmlspecialchars((string)$v, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'); } function json_out($payload, int $status=200): void { http_response_code($status); header('Content-Type: application/json; charset=utf-8'); echo json_encode($payload, JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES); exit; } function db(array $config): PDO { $file=(string)($config['db_file'] ?? (__DIR__.'/data/boardgamestars.sqlite')); $dir=dirname($file); if(!is_dir($dir)) @mkdir($dir,0755,true); $pdo=new PDO('sqlite:'.$file,null,null,[PDO::ATTR_ERRMODE=>PDO::ERRMODE_EXCEPTION,PDO::ATTR_DEFAULT_FETCH_MODE=>PDO::FETCH_ASSOC]); $pdo->exec('PRAGMA busy_timeout=5000'); install_schema($pdo); return $pdo; } function ensure_columns(PDO $pdo, string $table, array $columns): void { $existing=[]; try{$rows=$pdo->query('PRAGMA table_info('.$table.')')->fetchAll();}catch(Throwable $e){$rows=[];} foreach($rows as $row)$existing[(string)$row['name']]=true; foreach($columns as $name=>$def) if(!isset($existing[$name])) $pdo->exec('ALTER TABLE '.$table.' ADD COLUMN '.$name.' '.$def); } function install_schema(PDO $pdo): void { $pdo->exec("CREATE TABLE IF NOT EXISTS players (player_id TEXT PRIMARY KEY, secret_hash TEXT NOT NULL, public_name TEXT NOT NULL, avatar TEXT DEFAULT '', silver_balance INTEGER NOT NULL DEFAULT 0, gold_balance INTEGER NOT NULL DEFAULT 0, elo INTEGER NOT NULL DEFAULT 1000, last_daily_bonus_date TEXT NOT NULL DEFAULT '', base_bonus_granted_at INTEGER NOT NULL DEFAULT 0, gold_code_redeem_count INTEGER NOT NULL DEFAULT 0, last_gold_code_redeemed_at INTEGER NOT NULL DEFAULT 0, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)"); ensure_columns($pdo,'players',['is_network_player'=>'INTEGER NOT NULL DEFAULT 0','locked_identity'=>'INTEGER NOT NULL DEFAULT 0','stats_visible'=>'INTEGER NOT NULL DEFAULT 1','last_seen_at'=>'INTEGER NOT NULL DEFAULT 0','wins'=>'INTEGER NOT NULL DEFAULT 0','losses'=>'INTEGER NOT NULL DEFAULT 0','games_played'=>'INTEGER NOT NULL DEFAULT 0']); $pdo->exec("CREATE TABLE IF NOT EXISTS ledger (id TEXT PRIMARY KEY, ts INTEGER NOT NULL, player_id TEXT NOT NULL, type TEXT NOT NULL, currency TEXT NOT NULL, amount INTEGER NOT NULL, reason TEXT NOT NULL, related_id TEXT DEFAULT '', meta TEXT DEFAULT '')"); $pdo->exec("CREATE INDEX IF NOT EXISTS ledger_player_ts ON ledger(player_id, ts DESC)"); $pdo->exec("CREATE TABLE IF NOT EXISTS admin_star_codes (code_hash TEXT PRIMARY KEY, code_prefix TEXT NOT NULL, currency TEXT NOT NULL DEFAULT 'gold', amount INTEGER NOT NULL DEFAULT 0, max_redemptions INTEGER NOT NULL DEFAULT 1, redeemed_count INTEGER NOT NULL DEFAULT 0, status TEXT NOT NULL DEFAULT 'active', note TEXT DEFAULT '', created_by TEXT DEFAULT 'admin', created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL DEFAULT 0, last_redeemed_at INTEGER NOT NULL DEFAULT 0)"); $pdo->exec("CREATE INDEX IF NOT EXISTS admin_star_codes_prefix ON admin_star_codes(code_prefix)"); $pdo->exec("CREATE TABLE IF NOT EXISTS admin_star_code_redemptions (id TEXT PRIMARY KEY, ts INTEGER NOT NULL, code_hash TEXT NOT NULL, code_prefix TEXT NOT NULL, player_id TEXT NOT NULL, currency TEXT NOT NULL, amount INTEGER NOT NULL, meta TEXT DEFAULT '')"); $pdo->exec("CREATE INDEX IF NOT EXISTS admin_star_redemptions_player_ts ON admin_star_code_redemptions(player_id, ts DESC)"); } function body(): array { $raw=file_get_contents('php://input'); $data=json_decode($raw?:'',true); return is_array($data)?$data:$_POST; } function normalize_code($code): string { $code=strtoupper((string)$code); $code=preg_replace('/[^A-Z0-9]/','',$code); return substr($code??'',0,80); } function code_hash(string $code, array $config): string { return hash_hmac('sha256', normalize_code($code), (string)($config['server_secret'] ?? '')); } function amount($v, int $min=1, int $max=10000000): int { if(is_string($v))$v=trim($v); if(!is_numeric($v))return 0; $n=(int)floor((float)$v); return ($n>=$min&&$n<=$max)?$n:0; } function make_code(string $currency): string { $prefix=$currency==='silver'?'BGS-SIL':'BGS-GOLD'; $alphabet='ABCDEFGHJKLMNPQRSTUVWXYZ23456789'; $parts=[]; for($p=0;$p<3;$p++){ $s=''; for($i=0;$i<4;$i++) $s.=$alphabet[random_int(0,strlen($alphabet)-1)]; $parts[]=$s; } return $prefix.'-'.implode('-',$parts); } function create_codes(PDO $pdo, array $config, array $data): array { $currency=strtolower((string)($data['currency']??'gold')); if(!in_array($currency,['silver','gold'],true)) return ['status'=>'invalid_currency']; $amt=amount($data['amount']??0,1,10000000); $count=amount($data['count']??1,1,200); $maxRed=amount($data['maxRedemptions']??1,1,10000); if($amt<=0||$count<=0) return ['status'=>'invalid_amount']; $expiresDays=(int)($data['expiresDays']??0); $expiresAt=$expiresDays>0 ? time()+($expiresDays*86400) : 0; $note=trim(substr((string)($data['note']??''),0,160)); $now=time(); $codes=[]; $stmt=$pdo->prepare('INSERT INTO admin_star_codes (code_hash, code_prefix, currency, amount, max_redemptions, redeemed_count, status, note, created_by, created_at, expires_at, last_redeemed_at) VALUES (?, ?, ?, ?, ?, 0, ?, ?, ?, ?, ?, 0)'); for($i=0;$i<$count;$i++){ do{ $code=make_code($currency); $hash=code_hash($code,$config); $exists=$pdo->prepare('SELECT 1 FROM admin_star_codes WHERE code_hash=?'); $exists->execute([$hash]); } while($exists->fetch()); $prefix=substr(normalize_code($code),0,12); $stmt->execute([$hash,$prefix,$currency,$amt,$maxRed,'active',$note,'admin_currency',$now,$expiresAt]); $codes[]=['code'=>$code,'currency'=>$currency,'amount'=>$amt,'maxRedemptions'=>$maxRed,'expiresAt'=>$expiresAt,'note'=>$note]; } return ['status'=>'ok','codes'=>$codes]; } function adjust_wallet(PDO $pdo, array $data): array { $playerId=trim((string)($data['playerId']??'')); if(!preg_match('/^[A-Za-z0-9_\-]{3,100}$/',$playerId)) return ['status'=>'invalid_player_id']; $silver=(int)($data['silverDelta']??0); $gold=(int)($data['goldDelta']??0); if($silver===0&&$gold===0)return ['status'=>'no_change']; if(abs($silver)>10000000||abs($gold)>10000000)return ['status'=>'amount_too_large']; $reason=trim(substr((string)($data['reason']??'Admin-Korrektur'),0,140)); if($reason==='')$reason='Admin-Korrektur'; $now=time(); $pdo->exec('BEGIN IMMEDIATE'); try{ $stmt=$pdo->prepare('SELECT * FROM players WHERE player_id=? LIMIT 1'); $stmt->execute([$playerId]); $row=$stmt->fetch(); if(!$row){$pdo->exec('ROLLBACK'); return ['status'=>'player_not_found'];} $newSilver=(int)$row['silver_balance']+$silver; $newGold=(int)$row['gold_balance']+$gold; if($newSilver<0||$newGold<0){$pdo->exec('ROLLBACK'); return ['status'=>'balance_would_be_negative','silverBalance'=>(int)$row['silver_balance'],'goldBalance'=>(int)$row['gold_balance']];} $pdo->prepare('UPDATE players SET silver_balance=?, gold_balance=?, updated_at=? WHERE player_id=?')->execute([$newSilver,$newGold,$now,$playerId]); $meta=json_encode(['source'=>'admin_currency','reason'=>$reason],JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES); if($silver!==0)$pdo->prepare('INSERT INTO ledger (id, ts, player_id, type, currency, amount, reason, related_id, meta) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)')->execute([bin2hex(random_bytes(12)),$now,$playerId,$silver>0?'credit':'debit','silver',abs($silver),'admin_wallet_adjust','admin_currency',$meta]); if($gold!==0)$pdo->prepare('INSERT INTO ledger (id, ts, player_id, type, currency, amount, reason, related_id, meta) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)')->execute([bin2hex(random_bytes(12)),$now,$playerId,$gold>0?'credit':'debit','gold',abs($gold),'admin_wallet_adjust','admin_currency',$meta]); $pdo->exec('COMMIT'); return ['status'=>'ok','playerId'=>$playerId,'silverBalance'=>$newSilver,'goldBalance'=>$newGold]; } catch(Throwable $e){ if($pdo->inTransaction())$pdo->rollBack(); throw $e; } } function overview(PDO $pdo): array { $players=$pdo->query("SELECT player_id, public_name, silver_balance, gold_balance, elo, is_network_player, locked_identity, updated_at FROM players WHERE stats_visible=1 ORDER BY updated_at DESC LIMIT 5000")->fetchAll(); $codes=$pdo->query("SELECT c.*, COALESCE(r.redemptions,0) redemptions, COALESCE(r.last_player,'') last_player FROM admin_star_codes c LEFT JOIN (SELECT code_hash, COUNT(*) redemptions, MAX(player_id) last_player FROM admin_star_code_redemptions GROUP BY code_hash) r ON r.code_hash=c.code_hash ORDER BY c.created_at DESC LIMIT 300")->fetchAll(); $actions=$pdo->query("SELECT l.*, p.public_name FROM ledger l LEFT JOIN players p ON p.player_id=l.player_id WHERE l.reason IN ('admin_wallet_adjust','admin_code_redeem') ORDER BY l.ts DESC LIMIT 300")->fetchAll(); return ['status'=>'ok','players'=>$players,'codes'=>$codes,'actions'=>$actions,'now'=>time()]; } $adminPasswordHash=(string)($config['admin_stats_password_hash']??''); $authError=''; if(isset($_GET['logout'])){$_SESSION=[];session_destroy();header('Location: admin_currency.php');exit;} if(($_SERVER['REQUEST_METHOD']??'GET')==='POST' && isset($_POST['admin_password'])){ $pw=(string)$_POST['admin_password']; if($adminPasswordHash!=='' && password_verify($pw,$adminPasswordHash)){session_regenerate_id(true);$_SESSION['bgs_stats_admin']=true;header('Location: admin_currency.php');exit;} $authError='Falsches Passwort.'; } $authenticated=!empty($_SESSION['bgs_stats_admin']); if($authenticated && isset($_GET['ajax'])){ try{ $pdo=db($config); $data=body(); $ajax=(string)$_GET['ajax']; if($ajax==='overview')json_out(overview($pdo)); if($ajax==='create_codes')json_out(create_codes($pdo,$config,$data)); if($ajax==='adjust_wallet')json_out(adjust_wallet($pdo,$data)); json_out(['status'=>'unknown_action'],404);} catch(Throwable $e){error_log('BGS currency admin error: '.$e->getMessage());json_out(['status'=>'temporary_unavailable','message'=>$e->getMessage()],500);} } if(!$authenticated && isset($_GET['ajax'])) json_out(['status'=>'forbidden'],403); ?>BoardGameStars Währungsadmin

⭐ BoardGameStars Währungsadmin

Geschützt mit demselben Admin-Passwort wie die Statistik.



⭐ BoardGameStars Währungsadmin

Silber-/Goldcodes erzeugen und Wallets direkt erhöhen oder korrigieren.

StatistikLogout

Codes erzeugen













Wallet direkt erhöhen/korrigieren

Positive Werte erhöhen. Negative Werte korrigieren nach unten, nie unter 0.











User auswählen

Erzeugte Admin-Codes

Admin-Buchungen und Code-Einlösungen