[Release] HeroZServer - Hero Zero Server Files (still in development) - flash 123

• PHP 8.3 + MySQL 8.4 + Apache (Laragon)
• Flash SWF client running through Ruffle.rs works in Chrome, no Flash needed
• Node.js WebSocket server for real-time push
• Local CDN proxy for Akamai assets (CORS workaround)

• Did a full analysis of the Flash client 234 total actions defined in the SWF source
• 180 server handlers implemented, 170 matching SWF actions = 87% gameplay coverage
• 38 actions not needed (payments, ads, SSO, Kongregate, game testing stuff)
• 26 implementable actions still missing - friend system, event quests, resource requests
• Full cross-reference report with priority tiers for what to tackle next

• Real-time WebSocket server - messages, goals, everything syncs instantly, no more waiting on polls
• Email system with PHPMailer + MySQL queue - password reset works like the original game (two-step with token)
• Admin panel from scratch - Bootstrap 5, dark theme, manage users, characters (categorized inventory, give items), guilds, item template catalog (779 items with filters), messages, emails, events, vouchers, server config
• Multi-language support across all pages (PL / EN / PT-BR)

• All 243 achievements working with milestone progression and rewards
• 9 reward types (gold, donuts, stat points, XP, items, training, energy, boosters, sidekicks)
• 63 out of 67 goal types fully tracked - the remaining 4 are blocked by systems that don't exist in the original server code
• Progress syncs in real-time via WebSocket after every action
• Tracking working for equipment, leaderboard, shop, boosters, guild battles, sidekicks and more

• 3 daily + 2 weekly rotating objectives, unlocks at level 40
• Collectible item drops on reward claims
• Renewal cost scaling, instant finish for donuts
• Integrated with quests, duels, training, work, dungeons and league fights

• All 7 reward types working - coins, XP, stat points, quest energy, training sessions, boosters and items
• Item rewards generate random equipment (type 1-7) with quality scaling based on how many reels match 3 match gives top quality, 2 match gives mid, no match gives basic
• Booster rewards with 3 tiers (quest, stats, work) duration stacks with any active booster
• Sidekick symbol falls back to coins since the SWF reward dialog has no display logic for sidekicks
• Anti-exploit protection - server-side MySQL lock prevents double-spin during the animation window where the SWF briefly re-enables the spin button
• Slot machine chat feed working - shows recent wins to other players in real-time

• Weekly competitive events with XP, honor, and guild honor leaderboards
• CLI lifecycle script for starting, ending and checking tournament status
• Rewards - donuts for top character rankings, guild premium currency for top guilds
• Leaderboards show real-time progress during the tournament week
• All three tabs working - XP, honor, and guild honor with proper guild emblem display

• Server-wide boss events with HP tracking, damage ranking and reward distribution
• Full two-step attack flow matching how the real game works - timer phase, then fight resolution with battle animation, then summary dialog with damage dealt and ranking
• Instant finish with donuts, attack cancellation, and active attack persistence across page refreshes
• Boss defeat triggers socket push to all connected players
• CLI lifecycle script for spawning, processing and checking boss status
• Rewards update in real-time after each attack - coins, XP, items, energy refills, training sessions
• Event localization pulled from CDN translation files (PT/EN/PL)

• Sewing machine - change item skins for gold or donuts, tracks owned templates
• 33 costume collection sets with milestone rewards (stat points, items, training, energy)
• Pattern progress tracked automatically when buying items or claiming goal rewards

• Guild dungeons - full attack and join flow with NPC team battles and goal tracking
• Guild leader elections - vote-based leadership transfers with majority resolution, auto-finishes when all members have voted
• Guild artifact release - spend premium currency with cooldown timer and active battle checks
• Guild invitation decline with 72-hour expiration validation
• Guild dungeon battle reward claiming with item placement

• Type 10 inventory items generate 1-3 random equipment pieces (rare/epic quality)
• Items added to owned templates and costume pattern tracking automatically

• Change email with password verification and duplicate check
• Account deletion with full cascade cleanup of all related data
• Stat redistribution with total point validation
• Message item claiming from attachments

• 13 themed events: Halloween, Summer, Xmas (x2), Winter Olympics, Carnival, Easter, Ghostbusters, World Cup (x2), Birthday, Octoberfest, Olympia Rio
• Timed objectives players need to complete before the event ends
• 11 objective tracking types: quests, duels, training, honor, energy, world boss, event items, sewing, shop refresh
• Event item drops on quest completion with configurable chance per item
• Admin panel to activate/deactivate events with date picker - only 1 event active at a time
• Progress tracked automatically across all reward handlers

• Ignore/unignore characters from the mailbox
• Blocked users see "unknown recipient" when trying to send

• JSON responses breaking from PHP 8 deprecation warnings
• MySQL 8.x strict mode failing on legacy table schemas
• Fight reward calculations treating wins as losses
• Dungeons not regenerating after completion
• Goal coin rewards being way off (formula mismatch with SWF)
• Duel reward claims crashing because winner field was read from the wrong DB table
• Guild emblem with default values crashing the entire SWF UI
• League opponent list boundary bug in demotion conditions
• Guild dungeon battle resolution was incomplete - NPC teams weren't being processed
• In-game messaging crash from Unicode regex bug on PHP 8.x
• Duel and league stamina regeneration exceeding maximum caps
• Slot machine always winning due to hardcoded debug values instead of random rolls
• Slot machine chat showing NaN - PHP 8 json_decode returning stdClass instead of array
• World boss battle records missing profile stats causing SWF crash on completion dialog
• World boss attacks stuck after language change due to missing attack data on login
• World boss reward display not updating after attacks until page refresh
• Tournament end crashing on MySQL 8 due to UNSIGNED integer underflow when stats decreased during tournament
• Tournament guild honor leaderboard crashing because SWF expected short field names for guild emblem data
• Config::get() crashing on missing keys - replaced ?: pattern with proper default argument in multiple handlers
• SQL injection in admin panel search queries - switched to prepared statements
• Admin destructive actions now require POST with CSRF token
• And a bunch more smaller stuff

• 2.0.0 (2026-03-21) - Event quest system with 13 themed events, admin events panel, 11 objective types, event item drops
• 1.1.0 (2026-03-19) - Message ignore system, server-side message blocking, 1 new DB table
• 1.0.6 (2026-03-18) - Quick win handlers (locale, ToS, quest refresh, logout, error logging), league fight rewards fix
• 1.0.5 (2026-03-15) - Guild battle history, voucher/promo code system with admin panel, item validation safety
• 1.0.4 (2026-03-15) - 10 new handlers: guild leader elections with majority voting, guild artifact release with cooldown, decline guild invitations, claim dungeon battle rewards, claim message item attachments, change email, delete account, stat redistribution. Fixed Config::get() crash pattern across multiple handlers. Full SWF compatibility report - analyzed all 234 client actions against server, documented 28 missing with priority tiers
• 1.0.3 (2026-03-14) - Slot machine fully operational with all 7 reward types, item generation, booster stacking, and double-spin exploit protection. World boss attack flow rewritten to match SWF two-step process, battle records include full profile stats, active attacks persist across refreshes. Tournament leaderboards fixed - guild honor tab no longer crashes, end-of-week processing handles stat decreases correctly
• 1.0.2 (2026-03-13) - Admin items page reworked into read-only template catalog, character inventory categorized by location (equipped/bag/shop/bank), give item tool with bag or bank destination
• 1.0.1 (2026-03-13) - Fixed in-game messaging crash, sent message format, stamina regeneration exceeding caps, admin SQL injection and CSRF on destructive actions
• 1.0.0 (2026-03-10) - Initial release with all core systems: Ruffle.rs integration, email system, admin panel, goals, herobook, tournaments, world boss, sewing machine, costume collections, guild dungeons, surprise box, socket server

Quote:

Originally Posted by lujekk It's great that someone has taken on the task of continuing the project

• Slot Machine - All 7 reward types fully working: coins, XP, stat points, quest energy, training sessions, boosters and items. Item rewards generate random equipment with quality scaling based on reel matches. Booster rewards stack duration with active boosters. Server-side double-spin protection prevents exploiting the brief window where the SWF re-enables the button during animation. Chat feed shows recent wins in real-time.
• Tournaments - Weekly events with XP, honor and guild honor leaderboards. CLI script handles the full lifecycle (start/end/status). Top players get donuts, top guilds get premium currency. All three leaderboard tabs fully working with guild emblem display.
• World Boss - Server-wide boss fights with HP tracking and damage rankings. Players attack with booster-reduced timers, boss defeat pushes a sync to all connected clients. CLI script for spawn/process/check. Rewards include coins, XP, items, energy and training sessions.
• Sewing Machine - Change item skins for gold or donuts. Tracks all owned item templates per type.
• Costume Collections - 33 themed sets with milestone rewards (stat points, items, training, energy). Progress tracked automatically on item purchases and goal rewards.
• Guild Dungeons - Full attack and join flow now working. NPC team generation, complete battle resolution, goal tracking for fights won.
• Surprise Box - Open type 10 items for 1-3 random equipment pieces. Items feed into owned templates and pattern tracking.
• Guild Leader Elections - Vote-based leadership transfers with majority resolution. Auto-finishes when all eligible members have voted, or when the vote duration expires.
• Guild Artifacts - Release artifacts for premium currency with cooldown timer and active battle checks.
• Account Management - Change email with password verification, account deletion with full cascade cleanup, stat redistribution with point validation, claim item attachments from messages.

• 44 new goals now tracked thanks to the new systems - sewing (2), costumes (33), guild dungeons (2), surprise box (1), world boss (3), tournaments (3)
• Total: 63 out of 67 goal types fully working. The remaining 4 are permanently blocked (no handler exists in the original server code)

• Guild leader election system - initiate votes, cast ballots with majority-based resolution, auto-finish when all members voted or time expires
• Guild artifact release - spend premium currency with cooldown and active battle checks
• Guild invitation decline with 72-hour expiration validation
• Guild dungeon battle reward claiming with gold and optional item placement
• Message item claiming - collect items attached to messages via flag_value
• Account email change with password verification and duplicate check
• Account deletion with full cascade cleanup of all related data (items, quests, duels, guild membership, etc.)
• Stat redistribution with total point validation against base stat minimum
• Costume pattern selection stub (SWF notification only, no server action needed)
• Fixed Config::get() crash pattern - was using ?: which throws on missing keys, replaced with proper 2nd argument default in releaseArtifact, voteForGuildLeader and reskillCharacterStats
• Full SWF compatibility report - cross-referenced all 234 client actions against 171 server handlers, documented the 28 still missing with implementation priority tiers

• Slot machine fully operational - enabled by updating expired event dates, all 7 SWF-supported reward types implemented
• Slot machine item rewards - random equipment (type 1-7) generated on matching reels, quality scales with how many match (3 same = top quality, 2 same = mid, none = basic)
• Slot machine booster rewards - 3 tiers (quest/stats/work) with duration stacking on active boosters
• Sidekick reel falls back to coins since the SWF reward dialog has no sidekick display logic
• Fixed slot machine always winning - replaced hardcoded debug values with actual random rolls per reel
• Fixed slot machine chat showing NaN - PHP 8 json_decode without the array flag returns stdClass which breaks current()
• Fixed slot machine double-spin exploit - added MySQL GET_LOCK for sub-second race conditions and a DB check for the full animation window (~7-9 seconds)
• Rewrote the world boss attack flow to match the real game's two-step process - timer phase runs the fight on completion, then a separate finish call returns the summary without fighting again
• Battle records now save full profile stats for both player and NPC, fixing a crash on the attack completion dialog
• Active attacks now persist across page refreshes and language changes - the login response includes pending attack data so the SWF can restore the timer
• Reward display (coins, XP, ranking) updates in real-time after each attack instead of requiring a page refresh
• Added instant finish with donuts and attack cancellation handlers
• Event localization now pulls from CDN translation files so descriptions, briefings and summary texts show up in PT/EN/PL instead of raw key strings
• Fixed tournament end crashing on MySQL 8 when character or guild stats decreased during the tournament week - unsigned integer subtraction was overflowing
• Fixed tournament guild honor leaderboard crashing because the SWF expected short field names for guild data and emblem settings

• Items page reworked into a read-only catalog of all 779 item templates with search, type, quality and pattern filters
• Character inventory now shows items split by location - equipped, bag, shop and bank - instead of a flat list
• New "Give Item" tool picks from the template catalog and auto-generates stats based on character level, with a choice to send to bag or bank

• Fixed in-game message sending crashing the SWF - the message filter regex was using a Unicode property class without the required modifier, causing PHP 8.x to silently return NULL and empty out the message
• Fixed sent message response format not matching what the SWF expects - character info wasn't keyed by ID like the message list endpoint does
• Fixed admin panel message compose submitting twice on a single click
• Fixed duel and league stamina regeneration exceeding maximum caps
• Fixed duel reward claims crashing with "unknown error" - the winner field was being read from the wrong DB table (Duel instead of Battle)
• Fixed guild emblem with default values (shape 0) crashing the entire SWF UI - emblem asset arrays start at index 1, not 0
• Fixed league opponent list boundary bug in demotion conditions
• Fixed guild dungeon battle resolution - NPC teams weren't being processed correctly
• Fixed SQL injection in admin search queries - switched from addslashes to prepared statements across all controllers
• Destructive admin actions (ban, delete, max stats, etc.) now require POST with CSRF token instead of plain GET links

• 1.0.4 (2026-03-15) - 10 new handlers: guild leader elections, artifact release, decline invitations, dungeon rewards, message items, email change, account deletion, stat redistribution. Config::get() crash fix. Full SWF compatibility report (234 actions, 86% coverage)
• 1.0.3 (2026-03-14) - Slot machine fully operational with all 7 reward types, item generation, booster stacking and double-spin protection. World boss attack flow rewritten to match SWF two-step process, battle profile stats, attack persistence across refreshes, real-time reward updates, event localization from CDN. Tournament leaderboards fixed - guild honor tab working, end-of-week processing handles stat decreases correctly
• 1.0.2 (2026-03-13) - Admin items catalog, categorized character inventory, give item with bag/bank destination
• 1.0.1 (2026-03-13) - Messaging crash, stamina caps, sent message format, admin SQL injection and CSRF fixes
• 1.0.0 (2026-03-12) - Initial release with all core systems

• Friend system (5 handlers) - add/remove friends, friend bar, invitations
• Event quests (4 handlers) - timed objectives with 10 tracking types and 6 reward types
• Resource requests (8 handlers) - send energy/spins to friends (depends on friend system)
• Voucher / promo codes (3 handlers) - code validation and rewards
• Message ignore system (3 handlers) - block messages from specific players
• Guild battle history (2 handlers) - query existing battle table
• Quick wins (9 handlers) - locale, ToS acceptance, session refresh, shop/quest pool refresh

• Voucher / promo code system - redeem codes for gold, donuts, stat points, energy, training sessions. Supports usage limits, level and locale restrictions, expiry dates, and per-user codes
• Admin voucher panel - create, view, toggle, delete vouchers with full redemption log (who used it, when, which character)
• Guild battle history - view past guild attacks, defenses and dungeon fights with enemy guild emblems and reward details
• Item validation safety - Player::getItems() and Player::createItem() now filter out items with identifiers not in GameSettings templates, preventing SWF crashes from invalid items
• Fixed voucher redemption not updating donuts in real-time (premium_currency is on user object, not character)
• Fixed new_user_voucher_ids format - SWF expects JSON array, not comma-separated string
• 2 new DB tables: vouchers, voucher_redemptions

-- Voucher system (v1.0.5)
CREATE TABLE IF NOT EXISTS `vouchers` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `code` varchar(50) NOT NULL,
  `rewards` text NOT NULL,
  `uses_max` int(11) NOT NULL DEFAULT '1',
  `uses_current` int(11) NOT NULL DEFAULT '0',
  `min_level` int(11) NOT NULL DEFAULT '0',
  `locale` varchar(10) NOT NULL DEFAULT '',
  `user_id` int(11) NOT NULL DEFAULT '0',
  `ts_start` int(11) NOT NULL DEFAULT '0',
  `ts_end` int(11) NOT NULL DEFAULT '0',
  `ts_creation` int(11) NOT NULL DEFAULT '0',
  `status` tinyint(4) NOT NULL DEFAULT '1',
  PRIMARY KEY (`id`),
  UNIQUE KEY `idx_code` (`code`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

CREATE TABLE IF NOT EXISTS `voucher_redemptions` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `voucher_id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `character_id` int(11) NOT NULL DEFAULT '0',
  `ts_redeemed` int(11) NOT NULL DEFAULT '0',
  PRIMARY KEY (`id`),
  UNIQUE KEY `idx_unique` (`voucher_id`, `user_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

• 1.0.5 (2026-03-15) - Guild battle history, voucher/promo code system with admin panel, item validation safety, 2 new DB tables

• Friend system - add/remove friends, friend bar, invitations
• Event quests - timed objectives with 10 tracking types and 6 reward types
• Resource requests - send energy/spins to friends (depends on friend system)
• Message ignore system - block messages from specific players
• Quick wins - locale, ToS acceptance, session refresh, shop/quest pool refresh

• setUserLocale handler - saves language preference when changing locale in-game
• setUserLatestToS handler - accepts Terms of Service dialog
• refreshQuests handler - refreshes quest list when quest booster expires or leaving guild with active booster
• logoutUser handler - clears all session IDs and cookie on logout (was empty stub)
• gameReportError handler - logs SWF client errors to server/cache/swf_errors.log (was empty stub)
• Fixed league fight rewards crash - winner field was being read from the wrong table
• Fixed league division boundary bug - promote and demote could trigger on the same request at exact boundary values

• Message ignore system - ignore/unignore characters from the mailbox, blocked users can't send you messages
• Ignore button on message read dialog blocks all future messages from that sender
• Ignored users tab in mailbox shows who you've blocked with date
• Designore button to unblock users
• Blocked users see "unknown recipient" when trying to send - doesn't reveal they were blocked
• getMessageList now returns the full ignored characters list on load
• New DB table: message_ignored_characters

-- Message ignore system (v1.1.0)
CREATE TABLE IF NOT EXISTS `message_ignored_characters` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `character_id` int(11) NOT NULL,
  `ignored_character_id` int(11) NOT NULL,
  `ts_creation` int(11) NOT NULL DEFAULT '0',
  PRIMARY KEY (`id`),
  UNIQUE KEY `idx_unique` (`character_id`, `ignored_character_id`),
  KEY `idx_character` (`character_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

• 1.1.0 (2026-03-19) - Message ignore system, server-side message blocking, 1 new DB table
• 1.0.6 (2026-03-18) - Quick win handlers (locale, ToS, quest refresh, logout, error logging), league fight fix
• 1.0.5 (2026-03-15) - Guild battle history, voucher/promo code system with admin panel, item validation safety

• Friend system - add/remove friends, friend bar, invitations
• Event quests - timed objectives with 10 tracking types and 6 reward types
• Resource requests - send energy/spins to friends (depends on friend system)

• 13 themed events: Halloween, Summer, Xmas (x2), Winter Olympics, Carnival, Easter, Ghostbusters, World Cup (x2), Birthday, Octoberfest, Olympia Rio
• Each event has timed objectives players need to complete before the event ends
• 11 objective tracking types: quests completed, duels fought, training, honor earned, energy used, world boss defeated, event items collected, sewing machine used, shop refreshed, fight quests won, time quests completed
• Event item drops on quest completion with configurable drop chance per item
• 3 reward items generated per event (event-specific or random epic/rare)
• Progress tracked automatically in quest, duel, training, work, league and dungeon reward handlers
• Admin panel to activate/deactivate events with date picker - only 1 event active at a time
• Deactivating an event expires all player records immediately, no need for players to relog
• 4 new handlers: assignEventQuest, claimEventQuestObjectiveRewards, claimEventQuestRewards, instantFinishEventQuestObjective
• New DB table: event_quests

-- Event quest system (v2.0.0)
CREATE TABLE IF NOT EXISTS event_quests (
    id INT AUTO_INCREMENT PRIMARY KEY,
    character_id INT NOT NULL,
    identifier VARCHAR(100) NOT NULL,
    status INT NOT NULL DEFAULT 1,
    end_date VARCHAR(30) NOT NULL DEFAULT '',
    objective1_value INT NOT NULL DEFAULT 0,
    objective2_value INT NOT NULL DEFAULT 0,
    objective3_value INT NOT NULL DEFAULT 0,
    objective4_value INT NOT NULL DEFAULT 0,
    objective5_value INT NOT NULL DEFAULT 0,
    objective6_value INT NOT NULL DEFAULT 0,
    rewards TEXT NOT NULL,
    reward_item1_id INT NOT NULL DEFAULT 0,
    reward_item2_id INT NOT NULL DEFAULT 0,
    reward_item3_id INT NOT NULL DEFAULT 0,
    ts_creation INT NOT NULL DEFAULT 0,
    INDEX idx_character (character_id),
    INDEX idx_status (status)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

• 2.0.0 (2026-03-21) - Event quest system with 13 themed events, admin panel, 11 objective types, event item drops
• 1.1.0 (2026-03-19) - Message ignore system, server-side message blocking
• 1.0.6 (2026-03-18) - Quick win handlers (locale, ToS, quest refresh, logout, error logging), league fight fix