More backend stuff:
- Modernised password hashing; newer algorithm, transparent upgrade at login; better auth tokens and Remember Me cookies
- Migrate old Trade Block code into new auto-loading API classes; no functionality change for now, but lays foundation for user-facing improvements
Plus a few fixes and tweaks:
- Remove a few duplicate CSS file includes
- Various follow-up tweaks to Point Raffle; better messaging on page; daily jackpot booster
I think there's more to do with Point Raffle page, but hopefully it's a touch better than it was.
More security/robustness updates, plus a quality-of-life improvement for avatar uploads.
We now impose strict Content-Security-Policy headers site-wide, which hopefully will go unnoticed, but will reduce attack surface and mitigate some low-effort exploits. Suspicious activity on the registration page will impose an automatic IP ban, and CAPTCHA now required, since it's a nice modern accessible one now.
A regression on the Credit Multiplier page has been fixed, so credit submissions should work again. Additionally, player and guild avatar images now accept up to 2048x2048 images, which we will downscale to 1024x1024 for the master image, from which we will create various thumbnail sizes for use throughout the game. Slightly tidier setup than before.
Any problems at all, please post in the forum and we'll be sure to address them.
The Point Raffle page now limits tickets to 20% of current total tickets bought; you can buy more when other players buy extra and your share drops. This will stop one player buying millions of tickets and having a near certain chance of winning.
Additionally, each day, if Point Raffle is below its 10-participant limit, a random active player will be gifted a ticket to nudge things along.
