Multiple Changes to Acore-CMS user and admin experience.

src/acore-wp-plugin/src/Components/AdminPanel/Pages/ElunaSettings.php

@@ -6,6 +6,7 @@
     <h2> <?= __('AzerothCore Settings', Opts::I()->page_alias) ?></h2>
     <p>Configure database connection for Eluna script that need use of the CMS.</p>
     <form name="form-acore-eluna-settings" method="post" action="">
+        <?php wp_nonce_field('acore_eluna_settings_save', 'acore_eluna_settings_nonce'); ?>
         <div class="row">
             <div class="col-sm-6">
                 <div class="card p-0">

src/acore-wp-plugin/src/Components/AdminPanel/Pages/PVPRewards.php

@@ -14,6 +14,7 @@
                     <h5>Give rewards</h5>
                     <hr>
                     <form name="pvp-rewards" method="post" id="pvp-rewards" class="initial-form hide-if-no-js">
+                        <?php wp_nonce_field('acore_pvp_rewards_save', 'acore_pvp_rewards_nonce'); ?>
                         <input type="hidden" name="page" value="<?= ACORE_SLUG . '-pvp-rewards'; ?>" />
                         <table class="form-table table table-borderless" role="presentation">
                             <tbody>

src/acore-wp-plugin/src/Components/AdminPanel/SettingsController.php

@@ -44,6 +44,8 @@ public function loadSettings() {
             // If they did, this hidden field will be set to 'Y'
 
             if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+                check_admin_referer('acore_realm_settings_save', 'acore_realm_settings_nonce');
+
                 foreach (Opts::I()->getConfs() as $key => $value) {
                     if (isset($_POST[$key])) {
                         $this->storeConf($key, $_POST[$key]);
@@ -84,6 +86,8 @@ public function loadElunaSettings() {
             // If they did, this hidden field will be set to 'Y'
 
             if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+                check_admin_referer('acore_eluna_settings_save', 'acore_eluna_settings_nonce');
+
                 foreach (Opts::I()->getConfs() as $key => $value) {
                     if (isset($_POST[$key])) {
                         $this->storeConf($key, $_POST[$key]);
@@ -131,6 +135,7 @@ public function loadPvpRewards() {
         //! DEV NOTE: Put the rest of stuff within try { ... } check to handle every exception properly
         try {
             if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+                check_admin_referer('acore_pvp_rewards_save', 'acore_pvp_rewards_nonce');
                 global $wpdb;
                 $tableResult = $wpdb->query("CREATE TEMPORARY TABLE temp_pvp_rewards (
                 `account` VARCHAR(255) COLLATE utf8_unicode_ci,
@@ -385,6 +390,8 @@ public function loadTools() {
         //! DEV NOTE: Put the rest of stuff within try { ... } check to handle every exception properly
         try {
             if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+                check_admin_referer('acore_tools_save', 'acore_tools_nonce');
+
                 foreach (Opts::I()->getConfs() as $key => $value) {
                     if (isset($_POST[$key])) {
                         if ($key == 'acore_name_unlock_allowed_banned_names_table') {

src/acore-wp-plugin/src/Components/CharactersMenu/CharactersController.php

@@ -14,10 +14,18 @@ public function __construct() {
 
     public function loadHome() {
         if ($_SERVER["REQUEST_METHOD"] == "POST") {
-            $this->saveCharacterOrder();
-            ?>
-            <div class="updated"><p><strong>Character settings succesfully saved.</strong></p></div>
-            <?php
+            check_admin_referer('acore_character_order', 'acore_character_order_nonce');
+            if (isset($_POST["acore_reset_order"])) {
+                $this->resetCharacterOrder();
+                ?>
+                <div class="updated"><p><strong>Character order reset successfully.</strong></p></div>
+                <?php
+            } else {
+                $this->saveCharacterOrder();
+                ?>
+                <div class="updated"><p><strong>Character settings succesfully saved.</strong></p></div>
+                <?php
+            }
         }
 
         $accId = ACoreServices::I()->getAcoreAccountId();
@@ -38,6 +46,16 @@ public function getView() {
         return $this->view;
     }
 
+    private function resetCharacterOrder() {
+        $accId = ACoreServices::I()->getAcoreAccountId();
+        $conn = ACoreServices::I()->getCharacterEm()->getConnection();
+        $stmt = $conn->prepare(
+            "UPDATE `characters` SET `order` = NULL WHERE `account` = ? AND `deleteDate` IS NULL"
+        );
+        $stmt->bindValue(1, $accId);
+        $stmt->executeQuery();
+    }
+
     private function saveCharacterOrder() {
         if (!isset($_POST) || !isset($_POST["characterorder"])) {
             return;

src/acore-wp-plugin/src/Components/CharactersMenu/CharactersView.php

@@ -2,6 +2,8 @@
 
 namespace ACore\Components\CharactersMenu;
 
+use ACore\Utils\AcoreCharColors;
+
 class CharactersView {
     private $controller;
 
@@ -16,44 +18,47 @@ public function __construct($controller) {
     public function getHomeRender($characters) {
         ob_start();
         wp_enqueue_style('bootstrap-css', '//cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css', array(), '5.1.3');
-        wp_enqueue_style('acore-css', ACORE_URL_PLG . 'web/assets/css/main.css', array(), '0.1');
+        wp_enqueue_style('acore-css', ACORE_URL_PLG . 'web/assets/css/main.css', array(), '0.5');
         wp_enqueue_script('bootstrap-js', '//cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.bundle.min.js', array(), '5.1.3');
         wp_enqueue_script('jquery-ui-sortable');
         ?>
         <div class="wrap">
-            <h2>Characters Settings</h2>
-            <p>Check some details and configure of your characters.</p>
-
             <div class="row">
                 <div class="col-sm-4">
                     <div class="card">
                         <div class="card-body">
-                            <h3>Order</h3>
-                            <p>Change the order in which the characters appear in your in-game character selection screen.</p>
+                            <h3>Order Character Screen</h3>
+                            <p>Change the order in which the characters appear in your in-game character selection screen, by dragging them, matches in-game position.</p>
                             <hr>
                             <form action="" method="POST" novalidate="novalidate">
+                                <?php wp_nonce_field('acore_character_order', 'acore_character_order_nonce'); ?>
 
-                                <ul id="acore-characters-order" class="list-unstyled">
-                                    <?php foreach ($characters as $char) { ?>
+                                <ul id="acore-characters-order" class="acore-char-list list-unstyled">
+                                    <?php $charPos = 0; foreach ($characters as $char) {
+                                        $clsStyle = AcoreCharColors::rowStyle(intval($char["class"]), intval($char["race"]));
+                                        $charPos++;
+                                        $displayPos = $char['order'] !== null ? intval($char['order']) + 1 : $charPos;
+                                    ?>
                                         <li>
-                                            <div class="menu-item-bar">
-                                                <div class="menu-item-handle ui-sortable-handle">
-                                                    <span class="item-title menu-item-title"><?= $char["name"] ?></span>
-                                                    <span class="item-controls">
-                                                    <span class="item-type">
-                                                        level <?= $char["level"] ?>&ensp;
-                                                        <img src="<?= ACORE_URL_PLG . "web/assets/race/" . $char["race"] . ($char["gender"] == 0 ? "m" : "f") . ".webp"; ?>">
-                                                        <img src="<?= ACORE_URL_PLG . "web/assets/class/" . $char["class"] . ".webp"; ?>">
-                                                    </span>
-                                                </div>
+                                            <div class="acore-char-row" style="<?= esc_attr($clsStyle) ?>">
+                                                <span class="acore-char-pos"><?= $displayPos ?></span>
+                                                <span class="acore-char-name"><?= esc_html($char["name"]) ?></span>
+                                                <span class="acore-char-meta">
+                                                    <span class="acore-level" data-exp="<?= AcoreCharColors::expansionSlug(intval($char["level"])) ?>" title="<?= esc_attr(AcoreCharColors::expansionLabel(intval($char["level"]))) ?>">Level <?= intval($char["level"]) ?></span>
+                                                    <img class="race-icon" height="32" width="32" title="<?= esc_attr(AcoreCharColors::getRaceName(intval($char["race"]))) ?>" src="<?= esc_url(ACORE_URL_PLG . "web/assets/race/" . intval($char["race"]) . (intval($char["gender"]) == 0 ? "m" : "f") . ".webp") ?>">
+                                                    <img class="class-icon" height="32" width="32" title="<?= esc_attr(AcoreCharColors::getClassName(intval($char["class"]))) ?>" src="<?= esc_url(ACORE_URL_PLG . "web/assets/class/" . intval($char["class"]) . ".webp") ?>">
+                                                </span>
                                             </div>
-                                            <input name="characterorder[]" value="<?= $char["guid"] ?>">
+                                            <input type="hidden" name="characterorder[]" value="<?= esc_attr($char["guid"]) ?>">
                                         </li>
                                     <?php } ?>
                                 </ul>
 
                                 <?php if (!empty($characters)) { ?>
-                                    <input type="submit" name="submit" class="button button-primary" value="Save Order">
+                                    <div style="display:flex; justify-content:space-between; align-items:center; margin-top:8px;">
+                                        <input type="submit" name="submit" class="button button-primary" value="Save Order">
+                                        <input type="submit" name="acore_reset_order" class="button acore-btn-danger" value="Reset Order">
+                                    </div>
                                 <?php } ?>
                             </form>
                         </div>
@@ -62,12 +67,23 @@ public function getHomeRender($characters) {
             </div>
         </div>
 
-        <script type="text/javascript">
-            jQuery(document).ready(function($) {
-                $("#acore-characters-order").sortable();
+        <!-- .acore-btn-danger styling lives in theme.css (shared light/dark) -->
+
+        <script>
+        jQuery(document).ready(function($) {
+            $("#acore-characters-order").sortable({
+                update: function(event, ui) {
+                    var order = [];
+                    $("#acore-characters-order li").each(function(index) {
+                        var input = $(this).find("input[name='characterorder[]']");
+                        order.push(input.val());
+                        $(this).find(".acore-char-pos").text(index + 1);
+                    });
+                }
             });
+            $("#acore-characters-order").disableSelection();
+        });
         </script>
-
         <?php
         return ob_get_clean();
     }

src/acore-wp-plugin/src/Components/MailReturnMenu/MailReturnController.php

@@ -64,7 +64,7 @@ public static function getSentUnreadMails($charGuid)
 
         // Get mails sent by this character that are unread by the receiver
         // messageType = 0 means player mail
-        $query = "SELECT m.`id`, m.`subject`, m.`has_items`, m.`money`,
+        $query = "SELECT m.`id`, m.`subject`, m.`has_items`, m.`money`, m.`cod`,
                 m.`expire_time`, m.`deliver_time`,
                 rc.`name` AS receiver_name, rc.`race` AS receiver_race,
                 rc.`class` AS receiver_class, rc.`gender` AS receiver_gender,
@@ -94,7 +94,7 @@ public static function getSentUnreadMails($charGuid)
             $placeholders = implode(',', array_fill(0, count($mailIds), '?'));
             $worldDb = Opts::I()->acore_db_world_name;
             $itemQuery = "SELECT mi.`mail_id`, ii.`itemEntry`, ii.`count`,
-                    it.`name` AS item_name
+                    it.`name` AS item_name, it.`Quality` AS item_quality
                 FROM `mail_items` mi
                 JOIN `item_instance` ii ON mi.`item_guid` = ii.`guid`
                 JOIN `$worldDb`.`item_template` it ON ii.`itemEntry` = it.`entry`