Custom PileZoneLogic zones had no CardZone, so moving a card into one
left the CardItem drawn at its old spot. Create a hidden PileZone in
onCustomZoneAdded so cards are reparented and hidden.
Folds in the closed#7410 (Move AnnotationDialog from game/ logic to
game_graphics/) now that layers 1-2 are closed and this stack bottoms on
master directly:
- Add game_graphics/dialogs/dlg_annotation.{h,cpp} and move the
QInputDialog subclass there; game/ no longer declares any widget type.
- Add game/player/token_info.h and game/player/move_top_cards_until_options.h.
- Move CardMenuActionType to game/player/card_menu_action_type.h.
- Graphics dialog headers include the new game/ headers instead of
defining the structs themselves.
No behavior change.
* [Installer][Client] Back up user data before old uninstallers can delete it
* [Installer][Client] Fix stale backup resurrection, batch session backups, extend coverage
NSIS: clear stale %TEMP% backup and only arm restore when something was copied, directory-existence checks, back up loose .dec decks, drop downloaded pics but keep pics\CUSTOM.
Helper: single session dir per run (ms timestamps), same-basename disambiguation, partial copies still report their location.
* [Installer][Client] Fix review findings: throttle backups, NSIS old dir, portable messaging
* [Installer][Client] Fix review findings: backup markers, NSIS relocate, size cap
* [Installer][Client] Fix review findings: sounds, session coverage, NSIS wording
Client: back up data/sounds in portable mode and mention it in the
warning; reuse a recent session only when complete and covering the
current sources (source manifest), estimate size only for fresh copies,
normalize dedup via isInsideDir.
Helper: source manifest per session with sessionCoversSources(), clear
out-params on all failure paths.
NSIS: document defensive portable branch, merge backup over surviving
data/ to repair partial deletes, copy (not move) wording in relocate,
note .txt exclusion in deck notice.
* [Installer][Client] Fix review findings: stale backup, empty reuse, relocate, portable warning
NSIS: wipe TEMP backup once per run to avoid resurrecting deleted files,
check data dir existence in relocate so dir-only trees are moved.
Client: never reuse a recent session for an empty source set, only fall
back to a covering session on copy failure, warn fresh portable installs
instead of staying silent.
* [Installer][Client] Fix review findings: usable session reuse, loose decks, NSIS pics, symlinks
* [Installer][Client] Fix portable backup exclusions in offender merge
* [Client] Split at-risk data warning into focused helpers
Ricky's nit on the 200+ line warnAboutDataPathsInProgramDir: extract
collection (portable/installed), backup, message building and dialog
into named helpers. No behavior change, all tr() strings untouched.
* [Client] Read path settings inside isPortableBackupExcluded
* [Client] Make stateless at-risk helpers static
* [Client] Extract at-risk data warning out of MainWindow
* [Installer][Client] Fix review findings: subdir backup, portable warning, backup API
NSIS:
- Back up unknown top-level install subdirs (e.g. <installdir>\decks),
not just loose deck files, so the 3.1.1 -> new upgrade no longer loses
data folders the old RMDir /r deletes before the client ever runs.
Payload dirs (plugins/translations/sounds/themes) stay in place to avoid
restoring stale DLLs; restore + relocate handle the new backup set and
the one-time notice covers both decks and folders.
- Restart the %TEMP% backup when the 32/64-bit passes point at different
dirs instead of merging (which restored one dir's files into the other);
document that only the last pass relocates and the %TEMP% copy is not
a durable second copy.
Client:
- Drop the portable at-risk warning: portable installs never shipped an
uninstaller and portable updates preserve data/, so every portable user
got a spurious dialog plus daily host-machine copies.
- AtRiskDataWarning is now a plain class with Q_DECLARE_TR_FUNCTIONS
instead of QObject+Q_OBJECT; logging category renamed to
at_risk_data_warning; MainWindow wrapper inlined into startupConfigCheck.
- Lower the synchronous startup backup cap 500 -> 200 MB.
Utility/tests:
- Remove test-only backupAtRiskPath()/findRecentBackupSession() and the
no-marker/no-manifest legacy paths; isBackupSessionComplete() now
requires the complete marker; tests updated to the plural API.
* [Client] Restore collectInstalledAtRiskPaths per review
a23e02b5 removed the definition along with the portable helpers,
breaking the build (undefined reference at link time, and
isInsideAnyDir unused under -Werror on Arch/Debian 13). Restores
the 202c0d65 version (pathsInsideDir plus loose top-level deck
files) as suggested.
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [Client] Tell the user when their playmat art is blocked
A server DENY rule silently drops banned playmat art: SetPlaymat fails
with no handler and DeckSelect strips the mat while answering RespOk.
Surface both cases with the same critical message box the banner card
art flow uses. DeckSelect strips are detected by comparing the
requested mat, passed via PendingCommand extraData, against the
server-echoed deck. Notices dedupe per card and reset on success.
* [Client] Gate playmat blocked notice on RespFunctionNotAllowed per review
Only SetPlaymat with RespFunctionNotAllowed signals a card art DENY
rule. Older servers answer RespInvalidCommand and strip the mat from
DeckSelect, so drop the DeckSelect comparison to avoid false
blacklisted popups on pre-playmat servers.
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
Co-authored-by: BruebachL <bruebachl@users.noreply.github.com>
* [Completer] Highlight popup rows without rewriting the line edit
Selecting a popup row with ClearAndSelect emits selectionChanged, which
QCompleter turns into highlighted() and QLineEdit turns into setText().
Since be2c16eca5 (#7466) that rewrites the typed text on every completion
reset / arrow-key press (e.g. typing "A" becomes "Axe" and cannot be
edited), regressing the 514014dc00 (#7447) fix that used NoUpdate.
Add selectWithoutRewrite(), which blocks the selection-model signals while
applying ClearAndSelect so the highlight stays visible without touching
the line edit, then syncs the preview manually. Route both the
above-popup auto-select and Up/Down navigation through it, and handle
Up/Down for below-popups too instead of falling through to Qt's
rewriting default. Enter/click acceptance via activated() is unchanged.
* [Completer] Repaint popup highlight after silent selection change
Blocking the selection model's signals also suppresses the view's own
selectionChanged/currentChanged repaints, so force a viewport update
after restoring signals. Use EnsureVisible to match Qt's normal scroll
behaviour.
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [Security] Add per-address rate limiting for auth endpoints
Introduce a thread-safe RateLimiter that tracks attempts per key
(IP address) within a sliding time window, and wire it into the
authentication endpoints:
- Login: failed login attempts from an address are counted; once the
configured maximum is exceeded within the window, further logins
from that address are rejected with RespTooManyRequests. A
successful login clears the failed attempts for that address.
- Registration: implement the previously stubbed
tooManyRegistrationAttempts, limiting how many accounts can be
created per address per window.
- Forgot-password: throttle both the email-request and the
email-challenge paths per address.
New [security] settings with defaults:
max_login_attempts_per_ip=5 / login_attempt_window_seconds=900
max_registrations_per_ip=2 / registration_window_seconds=3600
max_forgot_password_requests_per_ip=3 / forgot_password_window_seconds=3600
Adds unit tests for the RateLimiter (window limit, over-limit
blocking, clearing, per-key independence).
Took 3 minutes
* [Server] Fix rate limiter: disable semantics, draining window, bounded keys, pre-work login gate
- recordAttempt()/isBlocked() return false when maxAttempts <= 0 or windowSeconds <= 0, so the documented 'set to 0 to disable' actually disables instead of blocking every address permanently
- Keys at their limit are rejected without recording, so repeated attempts at the attacker's pace cannot keep sliding the window and holding the lockout open; a block now clears once the recorded attempts age out of windowSeconds
- Attempts map is bounded: an opportunistic prune (every 60s) erases keys whose attempts have fully aged out
- Login is throttled before the work: isLoginRateLimited() (a new virtual on Server, backed by isBlocked()) gates loginUser(), so a locked-out address no longer burns a database round trip and password verification per attempt
- recordAttemptAt()/isBlockedAt() time seams make the sliding-window behaviour deterministically testable; tests rewritten for the real semantics (no reliance on the maxAttempts=0 bug, no sleeps)
* [Server] Inform client of login/registration rate limit timeout
- Add retryAfterSeconds/retryAfterSecondsAt to RateLimiter to compute
seconds until oldest attempt exits the sliding window
- Expose loginRateLimitRemainingSeconds via Server/Servatrice
- Include denied_end_time (absolute epoch) in RespTooManyRequests for
login pre-auth and when transitioning to lockout after failed attempt
- Include denied_end_time in registration rate limit response
- Client: show retry time for login RespTooManyRequests
- Client: simplify registration RespTooManyRequests message to show
retry time when provided
- Add test for retryAfterSecondsAt
* [Client] Restore registration guidance and drop duplicated rate limit reason
The registration RespTooManyRequests case now only shows the retry-after
copy when the server actually sent a denied_end_time; the per-email account
cap path (no end time) falls back to the previous guidance about already
having an account and contacting the server operator.
Drop the canned denied_reason_str from the new login rate limit branches so
the client no longer prints the same sentence twice.
* [Server] Exempt trusted_sources from auth rate limits
Addresses in security/trusted_sources bypass per-address limits, matching
the existing max_users_per_address bypass in initSession. Without this,
Webatrice behind local nginx (all clients as 127.0.0.1) would lock out
every web user after 5 mistyped passwords, and cap the whole server at
2 registrations / 3 forgot-password requests per window.
Adds Servatrice::isRateLimitExempt helper; recordFailedLogin,
isLoginRateLimited, recordRegistrationAttempt and
recordForgotPasswordAttempt all check it.
# Conflicts:
# servatrice/src/servatrice.cpp
* [Server] Key login rate limit by (address, username)
A successful login cleared the whole per-IP failure history, so 4 bad
guesses plus 1 self-login (or guest UnknownUser login) from the same
address bypassed the limiter. Failures are now bucketed per
(address, lowercase username) and a success clears only its own pair.
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [Completer] Minimum size popup, fall back to compact design if not possible.
Took 15 minutes
Took 6 seconds
Took 5 minutes
* [Completer] Fix popup going offscreen by clamping in screen coordinates
The position clamping in applyPopupWidth() was comparing popup->pos()
(parent coordinates) against screen->availableGeometry() (screen
coordinates). When the parent widget is not at the screen origin the
clamping computed a position in the wrong coordinate space, placing the
popup offscreen. Convert to global coordinates first, clamp, then map
back to parent coordinates.
* [Completer] Clamp popup from geometry() in screen coordinates
setMinimumWidth() already widens the popup synchronously, so the old
width() < minWidth guard never ran and the popup grew past the right
screen edge. The popup is also a top-level Qt::Popup window, so move()
takes global coordinates and the mapFromGlobal round-trip moved it to
the top-left of the screen. Clamp x from geometry() after
setMinimumWidth() and move(QPoint(clampedX, popup->y())) directly.
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [Oracle] Don't report a cancelled card database update as successful (#3470)
Took 3 minutes
* [Oracle] Only report cancel when nothing was saved yet
Rejecting the wizard after SaveSetsPage or a download page already
wrote the database to disk still replaced cards.xml on disk, but
wasCancelled() forced exit code 1 so Cockatrice skipped the reload.
Track successful saves with OracleWizard::markDatabaseSaved() and only
treat a cancel as a failure when nothing was saved.
* [Oracle] Restore updater stderr in card update error dialog
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [Style] Confirm broken Windows styles with a dialog offering Fusion
* [Style] Address review nits on broken style dialog
Extract Fusion index lookup into findFusionIndex helper and add all
message box buttons before choosing the default button.
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [Game] Raise rubber band above count label and collapse multi-selection on click
Raise rubber band on start and collapse multi-selection to clicked card when left-clicking an already-selected card with no modifiers.
* [Game] Collapse multi-selection on release instead of press
Collapsing at press time dropped the selection before the drag started,
which broke dragging multiple cards. Keep the selection on press and
collapse it on release when the pointer stayed within the drag
distance.
* [Game] Defer selection collapse until the double-click window passes
A release without drag collapsed the multi-selection immediately, so a
double-click that followed (playSelected acts on scene()->selectedItems())
only ever saw the single clicked card. When the card handles
double-clicks on the selection, arm the collapse on a single-shot timer
for QApplication::doubleClickInterval() instead and cancel it from the
double-click handler; a new press disarms the other cards and a
selection-count guard covers rubber-band/ctrl changes meanwhile.
* [Game] Keep sideboard multi-selection on double-click
DeckViewCard overrides doubleClickActsOnSelection to preserve the
selection, restoring master behavior where double-clicking moves all
selected cards between main and side. DeckView cancels any pending
collapse before reading the selection.
* [Game] Remove duplicated inline selection-collapse declarations
* [Game] Fix DeckView collapse call visibility and multi-selection collapse
Make cancelPendingSelectionCollapse() public so DeckView can call it on
selected DeckViewCards. Always arm the deferred collapse on release
instead of skipping cards whose double-click acts on the selection;
the double-click-interval timer plus the cancel calls in
CardItem::mouseDoubleClickEvent and DeckView::mouseDoubleClickEvent
already preserve the selection for double-clicks.
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [GameSelector] Persist quick-filter toolbar edits and repair filter settings migration
- Save game-filter parameters on toolbar changes, debounced with flush on close
- Repair pre-camelCase gamefilters.ini keys in place on startup
- Map the legacy creator-name filter to hostNameFilter
- Balance begin/endFilterChange in GamesProxyModel::refresh
- Align the hideIgnoredUserGames default between model and settings
- Cover the migration with regression tests
* [Review] Address RickyRister comments on filter persistence
- Rename game-type prefix constants to SCREAMING_SNAKE to match
MIGRATION_SENTINEL_KEY and project style
- Document why GameSelector destructor flushes a pending debounced
filter save (toolbar path has no other writer)
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [CardDB] Reload when the first run enables all sets
checkUnknownSets() enabled every set when none was enabled, but the
database had already been parsed under that empty enablement, so the
parsers had stripped every printing. It only notified the models and never
reloaded, leaving the deck editor's card database display empty until the
next launch.
Route the all-sets-enabled case through the same reload the new-sets path
uses, and skip caching a snapshot whose sets are all disabled.
* [CardDB] Own checkUnknownSets after startup and fix the cache skip
The loader's initialLoadComplete guard skipped checkUnknownSets() on the
first successful load of the session, so a download that landed after
startupConfigCheck() and the onboarding wizard had already run (e.g.
skipping the wizard download and fetching later from the menu) left every
set disabled and the deck editor blank until the next launch. The guard
also let the check run on the worker before the queued snapshot swap, and
alongside reloadCardDatabasesAndNotify()'s own check, double-emitting
cardDatabaseNewSetsFound on manual reloads.
Move the check to the callers that load after startup: the post-update,
custom-import, and spoiler paths run it via a QFutureWatcher once the
finished snapshot has been swapped in, and the loader's synchronous
path-change reload runs it directly.
Judge the cache skip by the parsed sets' own enablement, what the parsers
actually saw, instead of getEnabledSetNames(), which reports empty for the
noop controller even though it enables every set. Wait for the first-run
reparse before opening Manage Sets so the dialog cannot bind to the
pre-reload set instances.
* [CardDB] Queue post-reload check and unblock first-run Manage Sets
reloadCardDatabasesAndNotify() no longer emits cardDatabaseEnabledSetsChanged after the swap's Reset already rebuilt the models (second 36k rebuild froze startup), and its follow-up checkUnknownSets() is queued to the GUI thread so it sees swapped-in data. cardDatabaseAllNewSetsEnabled() chains Welcome/Manage Sets off a QFutureWatcher instead of waitForFinished() blocking the event loop during the reparse.
* [CardDB] Batch the first-run enable-all into a single settings flush
checkUnknownSets() enabled every set with ~3 QSettings rewrite cycles per set (sort key, known, enabled), and each setValue re-opens and re-syncs the whole cardDatabase.ini. With a full database (874 sets) that froze the GUI thread for ~9s after the database download (LagMonitor: event loop stalled for 9129 ms, measured offscreen with a real 59MB cards.xml), reading as a total application hang that recovers on its own.
Persist the enable-all through the controller's batched saveSets() in a single flush instead, mirroring what SetsModel::save() already does: CardSetList::enableAllBatched() assigns fresh sort keys and marks every set known+enabled in memory, then writes all records at once. SetSaveData gains the isKnown flag so the batch covers all three options, and SetsModel::save() passes the sets' known state through (unchanged behavior there).
Also drop the cardDatabaseEnabledSetsChanged emission from the all-sets-enabled branch: the reload chained off cardDatabaseAllNewSetsEnabled rebuilds the models from the re-parsed snapshot via cardDatabaseReset, so emitting both rebuilt the 36k-card models twice on the GUI thread.
Adds a cache-invalidation test driving the real checkUnknownSets() first-run path.
* [CardDB] Batch the new-sets-found enable-all the same way
The first-run batching fixed the 874-set case, but the new-sets-found dialog path (enableAllUnknownSets/markAllSetsAsKnown) still wrote per set and per option, each setValue re-opening and re-syncing the whole cardDatabase.ini. Users with hundreds of custom sets hit the same multi-second GUI stall when answering the dialog.
Persist both through the controller's batched saveSets() in a single flush, writing only changed sets (so the common no-op check skips the flush entirely). Removes the now-unused write-through CardSetList methods (enableAll, enableAllUnknown, markAllAsKnown, guessSortKeys) so the batched flush is the only way to persist bulk set changes.
Extends the test controller mock with per-write/batched-flush counters and adds tests asserting both dialog paths persist with exactly one flush and zero individual writes.
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
Spectator join/leave events were triggering the game tab's attention
indicator (exclamation mark and taskbar alert) for players who often
leave the tab open while waiting for an opponent. This made spectator
activity a false alarm.
Only emit the user event when an actual player joins or leaves, keeping
spectator joins/leaves quiet.
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [Game] Invalidate view when hiding replaced card menu
Hide any visible card menu before replacing and invalidate viewport.
* [Game] Fix viewport update compile error in setCardMenu
QWidget::update has no QRectF overload, and sceneRect is in scene
coordinates rather than viewport coordinates anyway, so invalidate the
whole viewport instead.
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
An open [[ card link now takes precedence over a space-preceded @
mention, so typing an @ before a card no longer shadows the card
completer.
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
- Remove the third close option (Resolve with note...) so closing a
report is one of two clear actions
- Make Resolve always prompt for the optional resolution note, matching
Dismiss, and rename the button to Resolve...
- Halve the resolveReport signature now that every caller prompts
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [Report] Add report reopen action for closed reports
- New Command_ReportReopen moderator command (extension 1206) with server
handler that reopens resolved/dismissed reports, resets resolution state
and notified, and records the reopening note in the audit log
- Reopen... button in the report queue action bar, gated to resolved and
dismissed reports, with optional note prompt and tooltip
- Success confirmations for Assign, Resolve/Dismiss and Reopen now survive
the list refresh via a pending status message instead of being clobbered
- Dispatch/auth coverage in server_moderator_role_test
* [Report] Surface resolution audit info in report details
- Add resolved_by_name to ServerInfo_Report and join resolved_by users in
the report list, my-list and details queries
- Render resolution note and resolved-at/by in the report detail pane
instead of duplicating the description into the chat log context
* [Report] Add context menu to report queue rows
- Open the standard UserContextMenu on right-click/Menu key for the
reported user, selecting the row first so the details panel matches
the menu target
- Carry the reported user's level in ServerInfo_Report so the menu
shows the same actions as the user list, with an IsUser fallback for
deleted or unregistered users
- Wire the Private chat action through TabReport to TabSupervisor and
retranslate the menu on live language switches
* [Server] Fix reported_user_level column indices in report queries
The SELECT lists resolved_by_name at index 10, shifting room_id to 11,
replay_id to 12, reported_user_id to 13 and reported_user_admin to 14.
The code read 12/13, so 'user exists' meant 'a replay exists' and the
admin flags came from the user id (e.g. id 5 -> admin+judge; users
without a replay reported as unregistered, hiding registered-only
actions). Fixed in cmdReportList and cmdReportMyList, plus the column
comment.
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
- Add resolved_by_name to ServerInfo_Report and join resolved_by users in
the report list, my-list and details queries
- Render resolution note and resolved-at/by in the report detail pane
instead of duplicating the description into the chat log context
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
- New Command_ReportReopen moderator command (extension 1206) with server
handler that reopens resolved/dismissed reports, resets resolution state
and notified, and records the reopening note in the audit log
- Reopen... button in the report queue action bar, gated to resolved and
dismissed reports, with optional note prompt and tooltip
- Success confirmations for Assign, Resolve/Dismiss and Reopen now survive
the list refresh via a pending status message instead of being clobbered
- Dispatch/auth coverage in server_moderator_role_test
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [UI] Fix auto-completion acceptance on Space/Tab/Enter
* [UI] Accept current completion when no item selected in popup
* [UI] Also accept completion on focus out when none selected
* [UI] Keep focus in chat on Tab completion acceptance
* [UI] Prevent Tab from moving focus when no completion popup
* [UI] Refocus on Tab when completing
* [UI] Let focusOut handle Tab completion acceptance
* [UI] Restore Tab behavior to match original (handle in focusOut)
* [UI] Defer refocus on Tab to avoid focus chain issues
* [UI] Auto-select first completion match in popup
* [UI] Auto-select first match when completer popup resets
* Revert "[UI] Auto-select first match when completer popup resets"
This reverts commit c7a3de3595.
* Revert "[UI] Auto-select first completion match in popup"
This reverts commit ae0dfb8622.
* [UI] Ensure completion selection updates on model changes
* Revert "[UI] Ensure completion selection updates on model changes"
This reverts commit 686bbef5b2.
* [UI] Highlight the selected completion in chat popups
The card completer's above-variant moved the current row with
NoUpdate, so the delegate never painted the selection border, and it
used Select which accumulated highlights while navigating. Use
ClearAndSelect so only the current row is highlighted and the old one is
cleared.
The mention popup opened with no current row at all, so nothing was
highlighted and there was no visual hint of what Enter would insert.
Select the row currentCompletion() uses, and install a delegate that
mirrors the active highlight into the inactive group so the selection
stays visible when the transient popup is not the active window.
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
