Update version numbers to 1.5

We were technically already using 22.04 for a bit, it got updated without us noticing since the version was set to `ubuntu-latest`.
Affix the version to 22.04 so that it doesn't get unexpectedly updated again, and update the artifact's zip to reflect the change.

.dockerignore

@@ -0,0 +1 @@
+version.h

.github/workflows/check-builds.yaml

@@ -53,7 +53,7 @@ jobs:
       - name: Upload build artifact
         uses: actions/upload-artifact@v2
         with:
-          name: 'ubuntu20_04-bin-x64-${{ env.SHORT_SHA }}'
+          name: 'ubuntu22_04-bin-x64-${{ env.SHORT_SHA }}'
           path: bin
 
   windows-build:
@@ -112,7 +112,7 @@ jobs:
 
   copy-artifacts:
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs: [windows-build, ubuntu-build]
     env:
       BOT_SSH_KEY: ${{ secrets.BOT_SSH_KEY }}

.vscode/launch.json

@@ -0,0 +1,26 @@
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Debug (Linux)",
+            "type": "cppdbg",
+            "request": "launch",
+            "program": "${workspaceFolder}/bin/fusion",
+            "cwd": "${workspaceFolder}"
+        },
+        {
+            "name": "Debug (Windows)",
+            "type": "cppvsdbg",
+            "request": "launch",
+            "program": "${workspaceFolder}/bin/Debug/winfusion.exe",
+            "cwd": "${workspaceFolder}"
+        },
+        {
+            "name": "Release (Windows)",
+            "type": "cppvsdbg",
+            "request": "launch",
+            "program": "${workspaceFolder}/bin/Release/winfusion.exe",
+            "cwd": "${workspaceFolder}"
+        }
+    ]
+}

CMakeLists.txt

@@ -44,7 +44,7 @@ add_executable(openfusion ${SOURCES})
 set_target_properties(openfusion PROPERTIES OUTPUT_NAME ${BIN_NAME})
 
 # find sqlite3 and use it
-find_package(sqlite3 REQUIRED)
+find_package(SQLite3 REQUIRED)
 target_include_directories(openfusion PRIVATE ${SQLite3_INCLUDE_DIRS})
 target_link_libraries(openfusion PRIVATE ${SQLite3_LIBRARIES})
 
@@ -56,5 +56,5 @@ set_property(TARGET openfusion PROPERTY VS_DEBUGGER_WORKING_DIRECTORY "${CMAKE_S
 # It's not something you should do, but it's there if you need it...
 if (NOT CMAKE_GENERATOR MATCHES "Visual Studio" AND NOT CMAKE_CXX_COMPILER_ID STREQUAL "MSVC" AND NOT CMAKE_GENERATOR MATCHES "MinGW Makefiles")
 	find_package(Threads REQUIRED)
-	target_link_libraries(openfusion pthread)
+	target_link_libraries(openfusion PRIVATE pthread)
 endif()

Dockerfile

@@ -0,0 +1,21 @@
+FROM debian:latest
+
+WORKDIR /usr/src/app
+
+RUN apt-get -y update && apt-get install -y \
+git \
+clang \
+make \
+libsqlite3-dev
+
+COPY . ./
+
+RUN make -j8
+
+# tabledata should be copied from the host;
+# clone it there before building the container
+#RUN git submodule update --init --recursive
+
+CMD ["./bin/fusion"]
+
+LABEL Name=openfusion Version=0.0.1

LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020-2022 OpenFusion Contributors
+Copyright (c) 2020-2023 OpenFusion Contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -13,21 +13,23 @@ OpenFusion is a reverse-engineered server for FusionFall. It primarily targets v
 
 ### Getting Started
 #### Method A: Installer (Easiest)
-1. Download the client installer by clicking [here](https://github.com/OpenFusionProject/OpenFusion/releases/download/1.4/OpenFusionClient-1.4-Installer.exe) - choose to run the file.
+1. Download the client installer by clicking [here](https://github.com/OpenFusionProject/OpenFusion/releases/download/1.5/OpenFusionClient-1.5-Installer.exe) - choose to run the file.
 2. After a few moments, the client should open: you will be given a choice between two public servers by default. Select the one you wish to play and click connect.
 3. To create an account, simply enter the details you wish to use at the login screen then click Log In. Do *not* click register, as this will just lead to a blank screen.
 4. Make a new character, and enjoy the game! Your progress will be saved automatically, and you can resume playing by entering the login details you used in step 3.
 
 #### Method B: Standalone .zip file
-1. Download the client from [here](https://github.com/OpenFusionProject/OpenFusion/releases/download/1.4/OpenFusionClient-1.4.zip).
+1. Download the client from [here](https://github.com/OpenFusionProject/OpenFusion/releases/download/1.5/OpenFusionClient-1.5.zip).
 2. Extract it to a folder of your choice. Note: if you are upgrading from an older version, it is preferable to start with a fresh folder rather than overwriting a previous install.
 3. Run OpenFusionClient.exe - you will be given a choice between two public servers by default. Select the one you wish to play and click connect.
 4. To create an account, simply enter the details you wish to use at the login screen then click Log In. Do *not* click register, as this will just lead to a blank screen.
 5. Make a new character, and enjoy the game! Your progress will be saved automatically, and you can resume playing by entering the login details you used in step 4.
 
+Instructions for getting the client to run on Linux through Wine can be found [here](https://github.com/OpenFusionProject/OpenFusion/wiki/Running-the-game-client-on-Linux).
+
 ### Hosting a server
 
-1. Grab `OpenFusionServer-1.4-original.zip` or `OpenFusionServer-1.4-academy.zip` from [here](https://github.com/OpenFusionProject/OpenFusion/releases/tag/1.4).
+1. Grab `OpenFusionServer-1.5-original.zip` or `OpenFusionServer-1.5-academy.zip` from [here](https://github.com/OpenFusionProject/OpenFusion/releases/tag/1.5).
 2. Extract it to a folder of your choice, then run `winfusion.exe` (Windows) or `fusion` (Linux) to start the server.
 3. Add a new server to the client's list:
     1. For Description, enter anything you want. This is what will show up in the server list.
@@ -35,7 +37,7 @@ OpenFusion is a reverse-engineered server for FusionFall. It primarily targets v
     3. Lastly Game Version - select `beta-20100104` if you downloaded the original zip, or `beta-20111013` if you downloaded the academy zip.
 5. Once you've added the server to the list, connect to it and log in. If you're having trouble with this, refer to steps 4 and 5 from the previous section.
 
-If you want, [compiled binaries (artifacts) for each functional commit can be found here.](http://cdn.dexlabs.systems/of-builds/)
+If you want to run the latest development builds of the server, [compiled binaries (artifacts) for each functional commit can be found here.](http://cdn.dexlabs.systems/of-builds/)
 
 For a more detailed overview of the game's architecture and how to configure it, read the following sections.
 
@@ -81,7 +83,7 @@ This just works if you're all under the same LAN, but if you want to play over t
 
 ## Compiling 
 
-OpenFusion has one external dependency: SQLite. You can install it on Windows using `vcpkg`, and on Unix/Linux using your distribution's package manager. For a more indepth guide on how to set up vcpkg, [read this guide on the wiki](https://github.com/OpenFusionProject/OpenFusion/wiki/Installing-SQLite-on-Windows-using-vcpkg).
+OpenFusion has one external dependency: SQLite. The oldest compatible version is `3.33.0`. You can install it on Windows using `vcpkg`, and on Unix/Linux using your distribution's package manager. For a more indepth guide on how to set up vcpkg, [read this guide on the wiki](https://github.com/OpenFusionProject/OpenFusion/wiki/Installing-SQLite-on-Windows-using-vcpkg).
 
 You have two choices for compiling OpenFusion: the included Makefile and the included CMakeLists file.
 

docker-compose.yml

@@ -0,0 +1,12 @@
+version: '3.4'
+
+services:
+  openfusion:
+    image: openfusion
+    build:
+      context: .
+      dockerfile: ./Dockerfile
+    ports:
+      - "23000:23000"
+      - "23001:23001"
+      - "8003:8003"

src/BuiltinCommands.cpp

@@ -69,31 +69,41 @@ static void setValuePlayer(CNSocket* sock, CNPacketData* data) {
 
     // Handle serverside value-changes
     switch (setData->iSetValueType) {
-    case 1:
+    case CN_GM_SET_VALUE_TYPE__HP:
-        plr->HP = setData->iSetValue;
+        response.iSetValue = plr->HP = setData->iSetValue;
         break;
-    case 2:
+    case CN_GM_SET_VALUE_TYPE__WEAPON_BATTERY :
         plr->batteryW = setData->iSetValue;
+
         // caps
         if (plr->batteryW > 9999)
             plr->batteryW = 9999;
+
+        response.iSetValue = plr->batteryW;
         break;
-    case 3:
+    case CN_GM_SET_VALUE_TYPE__NANO_BATTERY:
         plr->batteryN = setData->iSetValue;
+
         // caps
         if (plr->batteryN > 9999)
             plr->batteryN = 9999;
+
+        response.iSetValue = plr->batteryN;
         break;
-    case 4:
+    case CN_GM_SET_VALUE_TYPE__FUSION_MATTER:
         Missions::updateFusionMatter(sock, setData->iSetValue - plr->fusionmatter);
+        response.iSetValue = plr->fusionmatter;
         break;
-    case 5:
+    case CN_GM_SET_VALUE_TYPE__CANDY:
-        plr->money = setData->iSetValue;
+        response.iSetValue = plr->money = setData->iSetValue;
+        break;
+    case CN_GM_SET_VALUE_TYPE__SPEED:
+    case CN_GM_SET_VALUE_TYPE__JUMP:
+        response.iSetValue = setData->iSetValue;
         break;
     }
 
     response.iPC_ID = setData->iPC_ID;
-    response.iSetValue = setData->iSetValue;
     response.iSetValueType = setData->iSetValueType;
 
     sock->sendPacket(response, P_FE2CL_GM_REP_PC_SET_VALUE);

src/Combat.cpp

@@ -56,14 +56,10 @@ static std::pair<int,int> getDamage(int attackPower, int defensePower, bool shou
     return ret;
 }
 
-static void pcAttackNpcs(CNSocket *sock, CNPacketData *data) {
+static bool checkRapidFire(CNSocket *sock, int targetCount) {
-    auto pkt = (sP_CL2FE_REQ_PC_ATTACK_NPCs*)data->buf;
     Player *plr = PlayerManager::getPlayer(sock);
-    auto targets = (int32_t*)data->trailers;
-
-    // rapid fire anti-cheat
-    // TODO: move this out of here, when generalizing packet frequency validation
     time_t currTime = getTime();
+
     if (currTime - plr->lastShot < plr->fireRate * 80)
         plr->suspicionRating += plr->fireRate * 100 + plr->lastShot - currTime; // gain suspicion for rapid firing
     else if (currTime - plr->lastShot < plr->fireRate * 180 && plr->suspicionRating > 0)
@@ -71,15 +67,28 @@ static void pcAttackNpcs(CNSocket *sock, CNPacketData *data) {
 
     plr->lastShot = currTime;
 
-    if (pkt->iNPCCnt > 3) // 3+ targets should never be possible
+    // 3+ targets should never be possible
-        plr->suspicionRating += 10000;
+    if (targetCount > 3)
+        plr->suspicionRating += 10001;
 
-    if (plr->suspicionRating > 10000) { // kill the socket when the player is too suspicious
+    // kill the socket when the player is too suspicious
+    if (plr->suspicionRating > 10000) {
         sock->kill();
         CNShardServer::_killConnection(sock);
-        return;
+        return true;
     }
 
+    return false;
+}
+
+static void pcAttackNpcs(CNSocket *sock, CNPacketData *data) {
+    auto pkt = (sP_CL2FE_REQ_PC_ATTACK_NPCs*)data->buf;
+    Player *plr = PlayerManager::getPlayer(sock);
+    auto targets = (int32_t*)data->trailers;
+
+    // kick the player if firing too rapidly
+    if (settings::ANTICHEAT && checkRapidFire(sock, pkt->iNPCCnt))
+        return;
 
     /*
      * IMPORTANT: This validates memory safety in addition to preventing

src/CustomCommands.cpp

@@ -358,23 +358,19 @@ static void npcRotateCommand(std::string full, std::vector<std::string>& args, C
     int angle = (plr->angle + 180) % 360;
     NPCManager::updateNPCPosition(npc->appearanceData.iNPC_ID, npc->x, npc->y, npc->z, npc->instanceID, angle);
 
-    // if it's a gruntwork NPC, rotate in-place
+    bool isGruntworkNpc = true;
-    if (TableData::RunningMobs.find(npc->appearanceData.iNPC_ID) != TableData::RunningMobs.end()) {
-        NPCManager::updateNPCPosition(npc->appearanceData.iNPC_ID, npc->x, npc->y, npc->z, npc->instanceID, angle);
 
-        Chat::sendServerMessage(sock, "[NPCR] Successfully set angle to " + std::to_string(angle) + " for gruntwork NPC "
+    // add a rotation entry to the gruntwork file, unless it's already a gruntwork NPC
-            + std::to_string(npc->appearanceData.iNPC_ID));
+    if (TableData::RunningMobs.find(npc->appearanceData.iNPC_ID) == TableData::RunningMobs.end()) {
-    } else {
         TableData::RunningNPCRotations[npc->appearanceData.iNPC_ID] = angle;
-
+        isGruntworkNpc = false;
-        Chat::sendServerMessage(sock, "[NPCR] Successfully set angle to " + std::to_string(angle) + " for NPC "
-            + std::to_string(npc->appearanceData.iNPC_ID));
     }
 
-    // update rotation clientside
+    Chat::sendServerMessage(sock, "[NPCR] Successfully set angle to " + std::to_string(angle) +
-    INITSTRUCT(sP_FE2CL_NPC_ENTER, pkt);
+        " for " + (isGruntworkNpc ? "gruntwork " : "") + "NPC " + std::to_string(npc->appearanceData.iNPC_ID));
-    pkt.NPCAppearanceData = npc->appearanceData;
+
-    sock->sendPacket(pkt, P_FE2CL_NPC_ENTER);
+    // update rotation clientside by refreshing the player's chunks (same as the /refresh command)
+    PlayerManager::updatePlayerPositionForWarp(sock, plr->x, plr->y, plr->z, plr->instanceID);
 }
 
 static void refreshCommand(std::string full, std::vector<std::string>& args, CNSocket* sock) {

src/Email.cpp

@@ -93,7 +93,7 @@ static void emailReceiveItemSingle(CNSocket* sock, CNPacketData* data) {
     auto pkt = (sP_CL2FE_REQ_PC_RECV_EMAIL_ITEM*)data->buf;
     Player* plr = PlayerManager::getPlayer(sock);
 
-    if (pkt->iSlotNum < 0 || pkt->iSlotNum >= AINVEN_COUNT || pkt->iSlotNum < 1 || pkt->iSlotNum > 4)
+    if (pkt->iSlotNum < 0 || pkt->iSlotNum >= AINVEN_COUNT || pkt->iEmailItemSlot < 1 || pkt->iEmailItemSlot > 4)
         return; // sanity check
 
     // get email item from db and delete it
@@ -252,11 +252,26 @@ static void emailSend(CNSocket* sock, CNPacketData* data) {
         if (attachment.ItemInven.iID == 0)
             continue;
 
+        sItemBase* item = &pkt->aItem[i].ItemInven;
+        sItemBase* real = &plr->Inven[attachment.iSlotNum];
+
         resp.aItem[i] = attachment;
         attachments.push_back(attachment.ItemInven);
         attSlots.push_back(attachment.iSlotNum);
-        // delete item
+        if (real->iOpt <= item->iOpt) // delete item (if they attached the whole stack)
-        plr->Inven[attachment.iSlotNum] = { 0, 0, 0, 0 };
+            *real = { 0, 0, 0, 0 };
+        else // otherwise, decrement the item
+            real->iOpt -= item->iOpt;
+
+        // HACK: update the slot
+        INITSTRUCT(sP_FE2CL_PC_ITEM_MOVE_SUCC, itemResp);
+        itemResp.iFromSlotNum = attachment.iSlotNum;
+        itemResp.iToSlotNum = attachment.iSlotNum;
+        itemResp.FromSlotItem = *real;
+        itemResp.ToSlotItem = *real;
+        itemResp.eFrom = (int32_t)Items::SlotType::INVENTORY;
+        itemResp.eTo = (int32_t)Items::SlotType::INVENTORY;
+        sock->sendPacket(itemResp, P_FE2CL_PC_ITEM_MOVE_SUCC);
     }
 
     int cost = pkt->iCash + 50 + 20 * attachments.size(); // attached taros + postage
@@ -276,7 +291,7 @@ static void emailSend(CNSocket* sock, CNPacketData* data) {
         0 // DeleteTime (unimplemented)
     };
 
-    if (!Database::sendEmail(&email, attachments)) {
+    if (!Database::sendEmail(&email, attachments, plr)) {
         plr->money += cost; // give money back
         // give items back
         while (!attachments.empty()) {

src/PlayerManager.cpp

@@ -28,17 +28,12 @@ using namespace PlayerManager;
 
 std::map<CNSocket*, Player*> PlayerManager::players;
 
-static void addPlayer(CNSocket* key, Player& plr) {
+static void addPlayer(CNSocket* key, Player *plr) {
-    Player *p = new Player();
+    players[key] = plr;
+    plr->chunkPos = Chunking::INVALID_CHUNK;
+    plr->lastHeartbeat = 0;
 
-    // copy object into heap memory
+    std::cout << getPlayerName(plr) << " has joined!" << std::endl;
-    *p = plr;
-
-    players[key] = p;
-    p->chunkPos = Chunking::INVALID_CHUNK;
-    p->lastHeartbeat = 0;
-
-    std::cout << getPlayerName(p) << " has joined!" << std::endl;
     std::cout << players.size() << " players" << std::endl;
 }
 
@@ -224,69 +219,73 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
         return;
     }
 
-    // for convenience
+    Player *plr = new Player();
-    Player& plr = lm->plr;
+    Database::getPlayer(plr, lm->playerId);
-
-    plr.groupCnt = 1;
-    plr.iIDGroup = plr.groupIDs[0] = plr.iID;
 
     // check if account is already in use
-    if (isAccountInUse(plr.accountId)) {
+    if (isAccountInUse(plr->accountId)) {
         // kick the other player
-        exitDuplicate(plr.accountId);
+        exitDuplicate(plr->accountId);
+
+        // re-read the player from disk, in case it was just flushed
+        *plr = {};
+        Database::getPlayer(plr, lm->playerId);
     }
 
-    response.iID = plr.iID;
+    plr->groupCnt = 1;
+    plr->iIDGroup = plr->groupIDs[0] = plr->iID;
+
+    response.iID = plr->iID;
     response.uiSvrTime = getTime();
-    response.PCLoadData2CL.iUserLevel = plr.accountLevel;
+    response.PCLoadData2CL.iUserLevel = plr->accountLevel;
-    response.PCLoadData2CL.iHP = plr.HP;
+    response.PCLoadData2CL.iHP = plr->HP;
-    response.PCLoadData2CL.iLevel = plr.level;
+    response.PCLoadData2CL.iLevel = plr->level;
-    response.PCLoadData2CL.iCandy = plr.money;
+    response.PCLoadData2CL.iCandy = plr->money;
-    response.PCLoadData2CL.iFusionMatter = plr.fusionmatter;
+    response.PCLoadData2CL.iFusionMatter = plr->fusionmatter;
-    response.PCLoadData2CL.iMentor = plr.mentor;
+    response.PCLoadData2CL.iMentor = plr->mentor;
     response.PCLoadData2CL.iMentorCount = 1; // how many guides the player has had
-    response.PCLoadData2CL.iX = plr.x;
+    response.PCLoadData2CL.iX = plr->x;
-    response.PCLoadData2CL.iY = plr.y;
+    response.PCLoadData2CL.iY = plr->y;
-    response.PCLoadData2CL.iZ = plr.z;
+    response.PCLoadData2CL.iZ = plr->z;
-    response.PCLoadData2CL.iAngle = plr.angle;
+    response.PCLoadData2CL.iAngle = plr->angle;
-    response.PCLoadData2CL.iBatteryN = plr.batteryN;
+    response.PCLoadData2CL.iBatteryN = plr->batteryN;
-    response.PCLoadData2CL.iBatteryW = plr.batteryW;
+    response.PCLoadData2CL.iBatteryW = plr->batteryW;
     response.PCLoadData2CL.iBuddyWarpTime = 60; // sets 60s warp cooldown on login
 
-    response.PCLoadData2CL.iWarpLocationFlag = plr.iWarpLocationFlag;
+    response.PCLoadData2CL.iWarpLocationFlag = plr->iWarpLocationFlag;
-    response.PCLoadData2CL.aWyvernLocationFlag[0] = plr.aSkywayLocationFlag[0];
+    response.PCLoadData2CL.aWyvernLocationFlag[0] = plr->aSkywayLocationFlag[0];
-    response.PCLoadData2CL.aWyvernLocationFlag[1] = plr.aSkywayLocationFlag[1];
+    response.PCLoadData2CL.aWyvernLocationFlag[1] = plr->aSkywayLocationFlag[1];
 
     response.PCLoadData2CL.iActiveNanoSlotNum = -1;
     response.PCLoadData2CL.iFatigue = 50;
-    response.PCLoadData2CL.PCStyle = plr.PCStyle;
+    response.PCLoadData2CL.PCStyle = plr->PCStyle;
 
     // client doesnt read this, it gets it from charinfo
-    // response.PCLoadData2CL.PCStyle2 = plr.PCStyle2;
+    // response.PCLoadData2CL.PCStyle2 = plr->PCStyle2;
     // inventory
     for (int i = 0; i < AEQUIP_COUNT; i++)
-        response.PCLoadData2CL.aEquip[i] = plr.Equip[i];
+        response.PCLoadData2CL.aEquip[i] = plr->Equip[i];
     for (int i = 0; i < AINVEN_COUNT; i++)
-        response.PCLoadData2CL.aInven[i] = plr.Inven[i];
+        response.PCLoadData2CL.aInven[i] = plr->Inven[i];
     // quest inventory
     for (int i = 0; i < AQINVEN_COUNT; i++)
-        response.PCLoadData2CL.aQInven[i] = plr.QInven[i];
+        response.PCLoadData2CL.aQInven[i] = plr->QInven[i];
     // nanos
     for (int i = 1; i < SIZEOF_NANO_BANK_SLOT; i++) {
-        response.PCLoadData2CL.aNanoBank[i] = plr.Nanos[i];
+        response.PCLoadData2CL.aNanoBank[i] = plr->Nanos[i];
     }
     for (int i = 0; i < 3; i++) {
-        response.PCLoadData2CL.aNanoSlots[i] = plr.equippedNanos[i];
+        response.PCLoadData2CL.aNanoSlots[i] = plr->equippedNanos[i];
     }
     // missions in progress
     for (int i = 0; i < ACTIVE_MISSION_COUNT; i++) {
-        if (plr.tasks[i] == 0)
+        if (plr->tasks[i] == 0)
             break;
-        response.PCLoadData2CL.aRunningQuest[i].m_aCurrTaskID = plr.tasks[i];
+        response.PCLoadData2CL.aRunningQuest[i].m_aCurrTaskID = plr->tasks[i];
-        TaskData &task = *Missions::Tasks[plr.tasks[i]];
+        TaskData &task = *Missions::Tasks[plr->tasks[i]];
         for (int j = 0; j < 3; j++) {
             response.PCLoadData2CL.aRunningQuest[i].m_aKillNPCID[j] = (int)task["m_iCSUEnemyID"][j];
-            response.PCLoadData2CL.aRunningQuest[i].m_aKillNPCCount[j] = plr.RemainingNPCCount[i][j];
+            response.PCLoadData2CL.aRunningQuest[i].m_aKillNPCCount[j] = plr->RemainingNPCCount[i][j];
             /*
              * client doesn't care about NeededItem ID and Count,
              * it gets Count from Quest Inventory
@@ -296,12 +295,12 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
             */
         }
     }
-    response.PCLoadData2CL.iCurrentMissionID = plr.CurrentMissionID;
+    response.PCLoadData2CL.iCurrentMissionID = plr->CurrentMissionID;
 
     // completed missions
     // the packet requires 32 items, but the client only checks the first 16 (shrug)
     for (int i = 0; i < 16; i++) {
-        response.PCLoadData2CL.aQuestFlag[i] = plr.aQuestFlag[i];
+        response.PCLoadData2CL.aQuestFlag[i] = plr->aQuestFlag[i];
     }
 
     // Computress tips
@@ -310,11 +309,11 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
         response.PCLoadData2CL.iFirstUseFlag2 = UINT64_MAX;
     }
     else {
-        response.PCLoadData2CL.iFirstUseFlag1 = plr.iFirstUseFlag[0];
+        response.PCLoadData2CL.iFirstUseFlag1 = plr->iFirstUseFlag[0];
-        response.PCLoadData2CL.iFirstUseFlag2 = plr.iFirstUseFlag[1];
+        response.PCLoadData2CL.iFirstUseFlag2 = plr->iFirstUseFlag[1];
     }
 
-    plr.instanceID = INSTANCE_OVERWORLD; // the player should never be in an instance on enter
+    plr->instanceID = INSTANCE_OVERWORLD; // the player should never be in an instance on enter
 
     sock->setEKey(CNSocketEncryption::createNewKey(response.uiSvrTime, response.iID + 1, response.PCLoadData2CL.iFusionMatter + 1));
     sock->setFEKey(lm->FEKey);
@@ -325,14 +324,14 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
     // transmit MOTD after entering the game, so the client hopefully changes modes on time
     Chat::sendServerMessage(sock, settings::MOTDSTRING);
 
-    // copy Player object into the shard
+    // transfer ownership of Player object into the shard (still valid in this function though)
     addPlayer(sock, plr);
 
     // check if there is an expiring vehicle
-    Items::checkItemExpire(sock, getPlayer(sock));
+    Items::checkItemExpire(sock, plr);
 
     // set player equip stats
-    Items::setItemStats(getPlayer(sock));
+    Items::setItemStats(plr);
 
     Missions::failInstancedMissions(sock);
 
@@ -343,9 +342,9 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
 
     for (auto& pair : players)
         if (pair.second->notify)
-            Chat::sendServerMessage(pair.first, "[ADMIN]" + getPlayerName(&plr) + " has joined.");
+            Chat::sendServerMessage(pair.first, "[ADMIN]" + getPlayerName(plr) + " has joined.");
 
-    // deallocate lm (and therefore the plr object)
+    // deallocate lm
     delete lm;
 }
 

src/TableData.cpp

@@ -37,6 +37,22 @@ public:
     const char *what() const throw() { return msg.c_str(); }
 };
 
+/*
+ * We must refuse to run if an invalid NPC type is found in the JSONs, especially
+ * the gruntwork file. If we were to just skip loading invalid NPCs, they would get
+ * silently dropped from the gruntwork file, which would be confusing in situations
+ * where a gruntwork file for the wrong game build was accidentally loaded.
+ */
+static void ensureValidNPCType(int type, std::string filename) {
+    // last known NPC type
+    int npcLimit = NPCManager::NPCData.back()["m_iNpcNumber"];
+
+    if (type > npcLimit) {
+        std::cout << "[FATAL] " << filename << " contains an invalid NPC type: " << type << std::endl;
+        exit(1);
+    }
+}
+
 /*
  * Create a full and properly-paced path by interpolating between keyframes.
  */
@@ -662,6 +678,8 @@ static void loadEggs(json& eggData, int32_t* nextId) {
  * Load gruntwork output, if it exists
  */
 static void loadGruntworkPre(json& gruntwork, int32_t* nextId) {
+    if (gruntwork.is_null())
+        return;
 
     try {
         auto paths = gruntwork["paths"];
@@ -711,8 +729,8 @@ static void loadGruntworkPre(json& gruntwork, int32_t* nextId) {
 }
 
 static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
-
+    if (gruntwork.is_null())
-    if (gruntwork.is_null()) return;
+        return;
 
     try {
         // skyway paths
@@ -764,6 +782,8 @@ static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
             int id = (*nextId)--;
             uint64_t instanceID = mob.find("iMapNum") == mob.end() ? INSTANCE_OVERWORLD : (int)mob["iMapNum"];
 
+            ensureValidNPCType((int)mob["iNPCType"], settings::GRUNTWORKJSON);
+
             if (NPCManager::NPCData[(int)mob["iNPCType"]]["m_iTeam"] == 2) {
                 npc = new Mob(mob["iX"], mob["iY"], mob["iZ"], instanceID, mob["iNPCType"],
                     NPCManager::NPCData[(int)mob["iNPCType"]], id);
@@ -783,6 +803,9 @@ static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
         auto groups = gruntwork["groups"];
         for (auto _group = groups.begin(); _group != groups.end(); _group++) {
             auto leader = _group.value();
+
+            ensureValidNPCType((int)leader["iNPCType"], settings::GRUNTWORKJSON);
+
             auto td = NPCManager::NPCData[(int)leader["iNPCType"]];
             uint64_t instanceID = leader.find("iMapNum") == leader.end() ? INSTANCE_OVERWORLD : (int)leader["iMapNum"];
 
@@ -803,6 +826,9 @@ static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
                 int followerCount = 0;
                 for (json::iterator _fol = followers.begin(); _fol != followers.end(); _fol++) {
                     auto follower = _fol.value();
+
+                    ensureValidNPCType((int)follower["iNPCType"], settings::GRUNTWORKJSON);
+
                     auto tdFol = NPCManager::NPCData[(int)follower["iNPCType"]];
                     Mob* tmpFol = new Mob((int)leader["iX"] + (int)follower["iOffsetX"], (int)leader["iY"] + (int)follower["iOffsetY"], leader["iZ"], leader["iAngle"], instanceID, follower["iNPCType"], tdFol, *nextId);
 
@@ -859,10 +885,9 @@ static void loadNPCs(json& npcData) {
             npcID += NPC_ID_OFFSET;
             int instanceID = npc.find("iMapNum") == npc.end() ? INSTANCE_OVERWORLD : (int)npc["iMapNum"];
             int type = (int)npc["iNPCType"];
-            if (NPCManager::NPCData[type].is_null()) {
+
-                std::cout << "[WARN] NPC type " << type << " not found; skipping (json#" << _npc.key() << ")" << std::endl;
+            ensureValidNPCType(type, settings::NPCJSON);
-                continue;
+
-            }
 #ifdef ACADEMY
             // do not spawn NPCs in the future
             if (npc["iX"] > 512000 && npc["iY"] < 256000)
@@ -904,10 +929,9 @@ static void loadMobs(json& npcData, int32_t* nextId) {
             int npcID = std::strtol(_npc.key().c_str(), nullptr, 10); // parse ID string to integer
             npcID += MOB_ID_OFFSET;
             int type = (int)npc["iNPCType"];
-            if (NPCManager::NPCData[type].is_null()) {
+
-                std::cout << "[WARN] NPC type " << type << " not found; skipping (json#" << _npc.key() << ")" << std::endl;
+            ensureValidNPCType(type, settings::MOBJSON);
-                continue;
+
-            }
             auto td = NPCManager::NPCData[type];
             uint64_t instanceID = npc.find("iMapNum") == npc.end() ? INSTANCE_OVERWORLD : (int)npc["iMapNum"];
 
@@ -935,7 +959,10 @@ static void loadMobs(json& npcData, int32_t* nextId) {
         for (json::iterator _group = groupData.begin(); _group != groupData.end(); _group++) {
             auto leader = _group.value();
             int leadID = std::strtol(_group.key().c_str(), nullptr, 10); // parse ID string to integer
+
             leadID += MOB_GROUP_ID_OFFSET;
+            ensureValidNPCType(leader["iNPCType"], settings::MOBJSON);
+
             auto td = NPCManager::NPCData[(int)leader["iNPCType"]];
             uint64_t instanceID = leader.find("iMapNum") == leader.end() ? INSTANCE_OVERWORLD : (int)leader["iMapNum"];
             auto followers = leader["aFollowers"];
@@ -965,6 +992,9 @@ static void loadMobs(json& npcData, int32_t* nextId) {
                 int followerCount = 0;
                 for (json::iterator _fol = followers.begin(); _fol != followers.end(); _fol++) {
                     auto follower = _fol.value();
+
+                    ensureValidNPCType(follower["iNPCType"], settings::MOBJSON);
+
                     auto tdFol = NPCManager::NPCData[(int)follower["iNPCType"]];
                     Mob* tmpFol = new Mob((int)leader["iX"] + (int)follower["iOffsetX"], (int)leader["iY"] + (int)follower["iOffsetY"], leader["iZ"], leader["iAngle"], instanceID, follower["iNPCType"], tdFol, *nextId);
 
@@ -1070,19 +1100,39 @@ void TableData::init() {
     };
 
     // load JSON data into tables
-    std::ifstream fstream;
     for (int i = 0; i < 7; i++) {
         std::pair<json*, std::string>& table = tables[i];
+
+        // scope for fstream
+        {
+            std::ifstream fstream;
             fstream.open(settings::TDATADIR + "/" + table.second); // open file
-        if (!fstream.fail()) {
+
-            fstream >> *table.first; // load file contents into table
+            // did we fail to open the file?
-        } else {
+            if (fstream.fail()) {
-            if (table.first != &gruntwork) { // gruntwork isn't critical
+                // gruntwork isn't critical
+                if (table.first == &gruntwork)
+                    continue;
+
                 std::cerr << "[FATAL] Critical tdata file missing: " << table.second << std::endl;
                 exit(1);
             }
+
+            // is the file empty?
+            if (fstream.peek() == std::ifstream::traits_type::eof()) {
+                // tolerate empty gruntwork file
+                if (table.first == &gruntwork) {
+                    std::cout << "[WARN] The gruntwork file is empty" << std::endl;
+                    continue;
+                }
+
+                std::cerr << "[FATAL] Critical tdata file is empty: " << table.second << std::endl;
+                exit(1);
+            }
+
+            // load file contents into table
+            fstream >> *table.first;
         }
-        fstream.close();
 
         // patching: load each patch directory specified in the config file
 
@@ -1097,11 +1147,11 @@ void TableData::init() {
             std::string patchModuleName = *it;
             std::string patchFile = settings::PATCHDIR + patchModuleName + "/" + table.second;
             try {
+                std::ifstream fstream;
                 fstream.open(patchFile);
                 fstream >> patch; // load into temporary json object
                 std::cout << "[INFO] Patching " << patchFile << std::endl;
                 patchJSON(table.first, &patch); // patch
-                fstream.close();
             } catch (const std::exception& err) {
                 // no-op
             }

src/Trading.cpp

@@ -1,5 +1,6 @@
 #include "Trading.hpp"
 #include "PlayerManager.hpp"
+#include "db/Database.hpp"
 
 using namespace Trading;
 
@@ -269,6 +270,8 @@ static void tradeConfirm(CNSocket* sock, CNPacketData* data) {
         otherSock->sendPacket(msg, P_FE2CL_GM_REP_PC_ANNOUNCE);
         return;
     }
+
+    Database::commitTrade(plr, plr2);
 }
 
 static void tradeConfirmCancel(CNSocket* sock, CNPacketData* data) {

src/Vendors.cpp

@@ -1,6 +1,9 @@
 #include "Vendors.hpp"
 #include "Rand.hpp"
 
+// 7 days
+#define VEHICLE_EXPIRY_DURATION 604800
+
 using namespace Vendors;
 
 std::map<int32_t, std::vector<VendorListing>> Vendors::VendorTables;
@@ -53,8 +56,8 @@ static void vendorBuy(CNSocket* sock, CNPacketData* data) {
 
     // if vehicle
     if (req->Item.iType == 10) {
-        // set time limit: current time + 7days
+        // set time limit: current time + expiry duration
-        req->Item.iTimeLimit = getTimestamp() + 604800;
+        req->Item.iTimeLimit = getTimestamp() + VEHICLE_EXPIRY_DURATION;
     }
 
     if (slot != req->iInvenSlotNum) {
@@ -224,12 +227,20 @@ static void vendorTable(CNSocket* sock, CNPacketData* data) {
     INITSTRUCT(sP_FE2CL_REP_PC_VENDOR_TABLE_UPDATE_SUCC, resp);
 
     for (int i = 0; i < (int)listings.size() && i < 20; i++) { // 20 is the max
-        sItemBase base;
+        sItemBase base = {};
         base.iID = listings[i].id;
-        base.iOpt = 0;
-        base.iTimeLimit = 0;
         base.iType = listings[i].type;
 
+        /*
+         * Set vehicle expiry value.
+         *
+         * Note: sItemBase.iTimeLimit in the context of vendor listings contains
+         * a duration, unlike in most other contexts where it contains the
+         * expiration timestamp.
+         */
+        if (listings[i].type == 10)
+            base.iTimeLimit = VEHICLE_EXPIRY_DURATION;
+
         sItemVendor vItem;
         vItem.item = base;
         vItem.iSortNum = listings[i].sort;

src/core/CNProtocol.cpp

@@ -41,7 +41,8 @@ int CNSocketEncryption::xorData(uint8_t* buffer, uint8_t* key, int size) {
 uint64_t CNSocketEncryption::createNewKey(uint64_t uTime, int32_t iv1, int32_t iv2) {
     uint64_t num = (uint64_t)(iv1 + 1);
     uint64_t num2 = (uint64_t)(iv2 + 1);
-    uint64_t dEKey = (uint64_t)(*(uint64_t*)&defaultKey[0]);
+    uint64_t dEKey;
+    memcpy(&dEKey, defaultKey, sizeof(dEKey));
     return dEKey * (uTime * num * num2);
 }
 
@@ -65,7 +66,7 @@ CNPacketData::CNPacketData(void *b, uint32_t t, int l, int trnum, void *trs):
 // ========================================================[[ CNSocket ]]========================================================
 
 CNSocket::CNSocket(SOCKET s, struct sockaddr_in &addr, PacketHandler ph): sock(s), sockaddr(addr), pHandler(ph) {
-    EKey = (uint64_t)(*(uint64_t*)&CNSocketEncryption::defaultKey[0]);
+    memcpy(&EKey, CNSocketEncryption::defaultKey, sizeof(EKey));
 }
 
 bool CNSocket::sendData(uint8_t* data, int size) {
@@ -109,7 +110,11 @@ bool CNSocket::isAlive() {
 }
 
 void CNSocket::kill() {
+    if (!alive)
+        return;
+
     alive = false;
+
 #ifdef _WIN32
     shutdown(sock, SD_BOTH);
     closesocket(sock);
@@ -241,9 +246,10 @@ void CNSocket::step() {
     if (readSize <= 0) {
         // we aren't reading a packet yet, try to start looking for one
         int recved = recv(sock, (buffer_t*)readBuffer, sizeof(int32_t), 0);
-        if (recved == 0) {
+        if (recved >= 0 && recved < sizeof(int32_t)) {
-            // the socket was closed normally
+            // too little data for readSize or the socket was closed normally (when 0 bytes were read)
             kill();
+            return;
         } else if (!SOCKETERROR(recved)) {
             // we got our packet size!!!!
             readSize = *((int32_t*)readBuffer);
@@ -264,11 +270,12 @@ void CNSocket::step() {
     }
 
     if (readSize > 0 && readBufferIndex < readSize) {
-        // read until the end of the packet! (or at least try too)
+        // read until the end of the packet (or at least try to)
         int recved = recv(sock, (buffer_t*)(readBuffer + readBufferIndex), readSize - readBufferIndex, 0);
         if (recved == 0) {
             // the socket was closed normally
             kill();
+            return;
         } else if (!SOCKETERROR(recved))
             readBufferIndex += recved;
         else if (OF_ERRNO != OF_EWOULD) {
@@ -411,9 +418,9 @@ void CNServer::addPollFD(SOCKET s) {
     fds.push_back({s, POLLIN});
 }
 
-void CNServer::removePollFD(int i) {
+void CNServer::removePollFD(int fd) {
     auto it = fds.begin();
-    while (it != fds.end() && it->fd != fds[i].fd)
+    while (it != fds.end() && it->fd != fd)
         it++;
     assert(it != fds.end());
 
@@ -458,7 +465,7 @@ void CNServer::start() {
                 if (!setSockNonblocking(sock, newConnectionSocket))
                     continue;
 
-                std::cout << "New connection! " << inet_ntoa(address.sin_addr) << std::endl;
+                std::cout << "New " << serverType << " connection! " << inet_ntoa(address.sin_addr) << std::endl;
 
                 addPollFD(newConnectionSocket);
 
@@ -473,10 +480,15 @@ void CNServer::start() {
             } else {
                 std::lock_guard<std::mutex> lock(activeCrit); // protect operations on connections
 
+                // halt packet handling if server is shutting down
+                if (!active)
+                    return;
+
                 // player sockets
                 if (connections.find(fds[i].fd) == connections.end()) {
-                    std::cout << "[WARN] Event on non-existant socket?" << std::endl;
+                    std::cout << "[FATAL] Event on non-existent socket: " << fds[i].fd << std::endl;
-                    continue; // just to be safe
+                    assert(0);
+                    /* not reached */
                 }
 
                 CNSocket* cSock = connections[fds[i].fd];
@@ -485,22 +497,29 @@ void CNServer::start() {
                 if (fds[i].revents & ~POLLIN)
                     cSock->kill();
 
-                if (cSock->isAlive()) {
+                if (cSock->isAlive())
                     cSock->step();
-                } else {
-                    killConnection(cSock);
-                    connections.erase(fds[i].fd);
-                    delete cSock;
-
-                    removePollFD(i);
-
-                    // a new entry was moved to this position, so we check it again
-                    i--;
-                }
             }
         }
 
         onStep();
+
+        // clean up dead connection sockets
+        auto it = connections.begin();
+        while (it != connections.end()) {
+            CNSocket *cSock = it->second;
+
+            if (!cSock->isAlive()) {
+                killConnection(cSock);
+                it = connections.erase(it);
+
+                removePollFD(cSock->sock);
+
+                delete cSock;
+            } else {
+                it++;
+            }
+        }
     }
 }
 

src/core/CNProtocol.hpp

@@ -230,6 +230,7 @@ protected:
     const size_t STARTFDSCOUNT = 8; // number of initial PollFD slots
     std::vector<PollFD> fds;
 
+    std::string serverType = "invalid";
     SOCKET sock;
     uint16_t port;
     socklen_t addressSize;

src/core/CNShared.cpp

@@ -32,7 +32,7 @@ void CNShared::pruneLoginMetadata(CNServer *serv, time_t currTime) {
         auto& sk = it->first;
         auto& lm = it->second;
 
-        if (lm->timestamp + CNSHARED_TIMEOUT > currTime) {
+        if (currTime > lm->timestamp + CNSHARED_TIMEOUT) {
             std::cout << "[WARN] Pruning hung connection attempt" << std::endl;
 
             // deallocate object and remove map entry

src/core/CNShared.hpp

@@ -11,14 +11,14 @@
 #include "Player.hpp"
 
 /*
- * Connecions time out after 15 minutes, checked every 30 seconds.
+ * Connecions time out after 5 minutes, checked every 30 seconds.
  */
-#define CNSHARED_TIMEOUT 900000
+#define CNSHARED_TIMEOUT 300000
 #define CNSHARED_PERIOD 30000
 
 struct LoginMetadata {
     uint64_t FEKey;
-    Player plr;
+    int32_t playerId;
     time_t timestamp;
 };
 

src/db/Database.hpp

@@ -41,6 +41,7 @@ namespace Database {
         uint64_t Timestamp;
     };
     
+    void init();
     void open();
     void close();
 
@@ -52,7 +53,8 @@ namespace Database {
     bool banPlayer(int playerId, std::string& reason);
     bool unbanPlayer(int playerId);
 
-    void updateSelected(int accountId, int playerId);
+    void updateSelected(int accountId, int slot);
+    void updateSelectedByPlayerId(int accountId, int playerId);
     
     bool validateCharacter(int characterID, int userID);
     bool isNameFree(std::string firstName, std::string lastName);
@@ -78,7 +80,9 @@ namespace Database {
 
     // getting players
     void getPlayer(Player* plr, int id);
+    bool _updatePlayer(Player *player);
     void updatePlayer(Player *player);
+    void commitTrade(Player *plr1, Player *plr2);
     
     // buddies
     int getNumBuddies(Player* player);
@@ -98,7 +102,7 @@ namespace Database {
     void deleteEmailAttachments(int playerID, int index, int slot);
     void deleteEmails(int playerID, int64_t* indices);
     int getNextEmailIndex(int playerID);
-    bool sendEmail(EmailData* data, std::vector<sItemBase> attachments);
+    bool sendEmail(EmailData* data, std::vector<sItemBase> attachments, Player *sender);
 
     // racing
     RaceRanking getTopRaceRanking(int epID, int playerID);

src/db/email.cpp

@@ -152,7 +152,8 @@ void Database::updateEmailContent(EmailData* data) {
     sqlite3_step(stmt);
     int attachmentsCount = sqlite3_column_int(stmt, 0);
 
-    data->ItemFlag = (data->Taros > 0 || attachmentsCount > 0) ? 1 : 0; // set attachment flag dynamically
+    // set attachment flag dynamically
+    data->ItemFlag = (data->Taros > 0 || attachmentsCount > 0) ? 1 : 0;
 
     sqlite3_finalize(stmt);
 
@@ -265,7 +266,7 @@ int Database::getNextEmailIndex(int playerID) {
     return (index > 0 ? index + 1 : 1);
 }
 
-bool Database::sendEmail(EmailData* data, std::vector<sItemBase> attachments) {
+bool Database::sendEmail(EmailData* data, std::vector<sItemBase> attachments, Player *sender) {
     std::lock_guard<std::mutex> lock(dbCrit);
 
     sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
@@ -330,6 +331,13 @@ bool Database::sendEmail(EmailData* data, std::vector<sItemBase> attachments) {
         sqlite3_reset(stmt);
     }
     sqlite3_finalize(stmt);
+
+    if (!_updatePlayer(sender)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return false;
+    }
+
     sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
     return true;
 }

src/db/init.cpp

@@ -236,7 +236,20 @@ static int getTableSize(std::string tableName) {
     return result;
 }
 
+void Database::init() {
+    std::cout << "[INFO] Built with libsqlite " SQLITE_VERSION << std::endl;
+
+    if (sqlite3_libversion_number() != SQLITE_VERSION_NUMBER)
+        std::cout << "[INFO] Using libsqlite " << std::string(sqlite3_libversion()) << std::endl;
+
+    if (sqlite3_libversion_number() < MIN_SUPPORTED_SQLITE_NUMBER) {
+        std::cerr << "[FATAL] Runtime sqlite version too old. Minimum compatible version: " MIN_SUPPORTED_SQLITE << std::endl;
+        exit(1);
+    }
+}
+
 void Database::open() {
+
     // XXX: move locks here
     int rc = sqlite3_open(settings::DBPATH.c_str(), &db);
     if (rc != SQLITE_OK) {

src/db/internal.hpp

@@ -3,6 +3,15 @@
 #include "db/Database.hpp"
 #include <sqlite3.h>
 
+#define MIN_SUPPORTED_SQLITE_NUMBER 3033000
+#define MIN_SUPPORTED_SQLITE "3.33.0"
+// we can't use this in #error, since it doesn't expand macros
+
+// Compile-time libsqlite version check
+#if SQLITE_VERSION_NUMBER < MIN_SUPPORTED_SQLITE_NUMBER
+#error libsqlite version too old. Minimum compatible version: 3.33.0
+#endif
+
 extern std::mutex dbCrit;
 extern sqlite3 *db;
 

src/db/login.cpp

@@ -79,6 +79,29 @@ void Database::updateSelected(int accountId, int slot) {
         std::cout << "[WARN] Database fail on updateSelected(): " << sqlite3_errmsg(db) << std::endl;
 }
 
+void Database::updateSelectedByPlayerId(int accountId, int32_t playerId) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    const char* sql = R"(
+        UPDATE Accounts SET
+            Selected = p.Slot,
+            LastLogin = (strftime('%s', 'now'))
+        FROM (SELECT Slot From Players WHERE PlayerId = ?) AS p
+        WHERE AccountID = ?;
+        )";
+
+    sqlite3_stmt* stmt;
+
+    sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
+    sqlite3_bind_int(stmt, 1, playerId);
+    sqlite3_bind_int(stmt, 2, accountId);
+    int rc = sqlite3_step(stmt);
+    sqlite3_finalize(stmt);
+
+    if (rc != SQLITE_DONE)
+        std::cout << "[WARN] Database fail on updateSelectedByPlayerId(): " << sqlite3_errmsg(db) << std::endl;
+}
+
 bool Database::validateCharacter(int characterID, int userID) {
     std::lock_guard<std::mutex> lock(dbCrit);
 

src/db/player.cpp

@@ -285,11 +285,13 @@ void Database::getPlayer(Player* plr, int id) {
     sqlite3_finalize(stmt);
 }
 
-void Database::updatePlayer(Player *player) {
+/*
-    std::lock_guard<std::mutex> lock(dbCrit);
+ * Low-level function to save a player to DB.
-
+ * Must be run in a SQL transaction and with dbCrit locked.
-    sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
+ * The caller manages the transacstion, so if this function returns false,
-
+ * the caller must roll it back.
+ */
+bool Database::_updatePlayer(Player *player) {
     const char* sql = R"(
         UPDATE Players
         SET
@@ -336,10 +338,8 @@ void Database::updatePlayer(Player *player) {
     sqlite3_bind_int(stmt, 21, player->iID);
 
     if (sqlite3_step(stmt) != SQLITE_DONE) {
-        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
         sqlite3_finalize(stmt);
-        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return false;
-        return;
     }
 
     sqlite3_finalize(stmt);
@@ -375,10 +375,8 @@ void Database::updatePlayer(Player *player) {
         rc = sqlite3_step(stmt);
 
         if (rc != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
@@ -395,10 +393,8 @@ void Database::updatePlayer(Player *player) {
         sqlite3_bind_int(stmt, 6, player->Inven[i].iTimeLimit);
 
         if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
@@ -415,10 +411,8 @@ void Database::updatePlayer(Player *player) {
         sqlite3_bind_int(stmt, 6, player->Bank[i].iTimeLimit);
 
         if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
@@ -451,10 +445,8 @@ void Database::updatePlayer(Player *player) {
         sqlite3_bind_int(stmt, 4, player->QInven[i].iID);
 
         if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
@@ -487,10 +479,8 @@ void Database::updatePlayer(Player *player) {
         sqlite3_bind_int(stmt, 4, player->Nanos[i].iStamina);
 
         if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
@@ -524,14 +514,47 @@ void Database::updatePlayer(Player *player) {
         sqlite3_bind_int(stmt, 5, player->RemainingNPCCount[i][2]);
 
         if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
             sqlite3_finalize(stmt);
-            return;
+            return false;
         }
         sqlite3_reset(stmt);
     }
 
-    sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
     sqlite3_finalize(stmt);
+
+    return true;
+}
+
+void Database::updatePlayer(Player *player) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
+
+    if (!_updatePlayer(player)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return;
+    }
+
+    sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
+}
+
+void Database::commitTrade(Player *plr1, Player *plr2) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
+
+    if (!_updatePlayer(plr1)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return;
+    }
+
+    if (!_updatePlayer(plr2)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return;
+    }
+
+    sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
 }

src/main.cpp

@@ -98,6 +98,9 @@ void initsignals() {
 }
 
 int main() {
+    std::cout << "[INFO] OpenFusion v" GIT_VERSION << std::endl;
+    std::cout << "[INFO] Protocol version: " << PROTOCOL_VERSION << std::endl;
+
 #ifdef _WIN32
     WSADATA wsaData;
     if (WSAStartup(MAKEWORD(1, 1), &wsaData) != 0) {
@@ -105,15 +108,15 @@ int main() {
         exit(EXIT_FAILURE);
     }
 #endif
+
     initsignals();
     settings::init();
-
+    Database::init();
-    std::cout << "[INFO] OpenFusion v" GIT_VERSION << std::endl;
-    std::cout << "[INFO] Protocol version: " << PROTOCOL_VERSION << std::endl;
-    std::cout << "[INFO] Intializing Packet Managers..." << std::endl;
-
     Rand::init(getTime());
     TableData::init();
+
+    std::cout << "[INFO] Intializing Packet Managers..." << std::endl;
+
     PlayerManager::init();
     PlayerMovement::init();
     BuiltinCommands::init();
@@ -132,9 +135,10 @@ int main() {
     Email::init();
     Groups::init();
     Racing::init();
-    Database::open();
     Trading::init();
 
+    Database::open();
+
     switch (settings::EVENTMODE) {
     case 0: break; // no event
     case 1: std::cout << "[INFO] Event active. Hey, Hey It's Knishmas!" << std::endl; break;

src/servers/CNLoginServer.cpp

@@ -11,6 +11,7 @@
 std::map<CNSocket*, CNLoginData> CNLoginServer::loginSessions;
 
 CNLoginServer::CNLoginServer(uint16_t p) {
+    serverType = "login";
     port = p;
     pHandler = &CNLoginServer::handlePacket;
     init();
@@ -208,9 +209,12 @@ void CNLoginServer::login(CNSocket* sock, CNPacketData* data) {
     // send the resp in with original key
     sock->sendPacket(resp, P_LS2CL_REP_LOGIN_SUCC);
 
+    uint64_t defaultKey;
+    memcpy(&defaultKey, CNSocketEncryption::defaultKey, sizeof(defaultKey));
+
     // update keys
     sock->setEKey(CNSocketEncryption::createNewKey(resp.uiSvrTime, resp.iCharCount + 1, resp.iSlotNum + 1));
-    sock->setFEKey(CNSocketEncryption::createNewKey((uint64_t)(*(uint64_t*)&CNSocketEncryption::defaultKey[0]), login->iClientVerC, 1));
+    sock->setFEKey(CNSocketEncryption::createNewKey(defaultKey, login->iClientVerC, 1));
 
     DEBUGLOG(
         std::cout << "Login Server: Login success. Welcome " << userLogin << " [" << loginSessions[sock].userID << "]" << std::endl;
@@ -471,11 +475,7 @@ void CNLoginServer::characterSelect(CNSocket* sock, CNPacketData* data) {
     LoginMetadata *lm = new LoginMetadata();
     lm->FEKey = sock->getFEKey();
     lm->timestamp = getTime();
-
+    lm->playerId = selection->iPC_UID;
-    Database::getPlayer(&lm->plr, selection->iPC_UID);
-    // this should never happen but for extra safety
-    if (lm->plr.iID == 0)
-        return invalidCharacter(sock);
 
     resp.iEnterSerialKey = Rand::cryptoRand();
 
@@ -485,7 +485,7 @@ void CNLoginServer::characterSelect(CNSocket* sock, CNPacketData* data) {
     sock->sendPacket(resp, P_LS2CL_REP_SHARD_SELECT_SUCC);
 
     // update current slot in DB
-    Database::updateSelected(loginSessions[sock].userID, lm->plr.slot);
+    Database::updateSelectedByPlayerId(loginSessions[sock].userID, selection->iPC_UID);
 }
 
 void CNLoginServer::finishTutorial(CNSocket* sock, CNPacketData* data) {

src/servers/CNShardServer.cpp

@@ -16,6 +16,7 @@ std::map<uint32_t, PacketHandler> CNShardServer::ShardPackets;
 std::list<TimerEvent> CNShardServer::Timers;
 
 CNShardServer::CNShardServer(uint16_t p) {
+    serverType = "shard";
     port = p;
     pHandler = &CNShardServer::handlePacket;
     REGISTER_SHARD_TIMER(keepAliveTimer, 4000);
@@ -115,6 +116,10 @@ void CNShardServer::kill() {
 void CNShardServer::onStep() {
     time_t currTime = getTime();
 
+    // do not evaluate timers if the server is shutting down
+    if (!active)
+        return;
+
     for (TimerEvent& event : Timers) {
         if (event.scheduledEvent == 0) {
             // event hasn't been queued yet, go ahead and do that

src/settings.cpp

@@ -20,6 +20,7 @@ bool settings::LOCALHOSTWORKAROUND = true;
 time_t settings::TIMEOUT = 60000;
 int settings::VIEWDISTANCE = 25600;
 bool settings::SIMULATEMOBS = true;
+bool settings::ANTICHEAT = true;
 
 // default spawn point
 #ifndef ACADEMY
@@ -108,6 +109,7 @@ void settings::init() {
     ACCLEVEL = reader.GetInteger("shard", "accountlevel", ACCLEVEL);
     EVENTMODE = reader.GetInteger("shard", "eventmode", EVENTMODE);
     DISABLEFIRSTUSEFLAG = reader.GetBoolean("shard", "disablefirstuseflag", DISABLEFIRSTUSEFLAG);
+    ANTICHEAT = reader.GetBoolean("shard", "anticheat", ANTICHEAT);
     MONITORENABLED = reader.GetBoolean("monitor", "enabled", MONITORENABLED);
     MONITORPORT = reader.GetInteger("monitor", "port", MONITORPORT);
     MONITORINTERVAL = reader.GetInteger("monitor", "interval", MONITORINTERVAL);

src/settings.hpp

@@ -10,6 +10,7 @@ namespace settings {
     extern int SHARDPORT;
     extern std::string SHARDSERVERIP;
     extern bool LOCALHOSTWORKAROUND;
+    extern bool ANTICHEAT;
     extern time_t TIMEOUT;
     extern int VIEWDISTANCE;
     extern bool SIMULATEMOBS;