A Control Panel For Whoever Runs The Server

This one is almost entirely for whoever runs the server. If you are playing on someone else’s, the only thing you will notice is that game masters can now be given exactly as much power as they need and no more.

Added

• An admin area in the website that ships with the server. Sign in and, if your account has the level for it, there is an Admin link in the header. Behind it: the server’s live state, every rate the server reads, the staff list, and buttons to reload settings, announce to everyone online and start a shutdown.
• Server rates are editable from the browser, and they take effect without a restart. Player experience, animus experience, experience lost on death, ground loot chance, mining speed, mastery gain, force liver accumulation and dark hole rewards. Leave a field empty and the server uses the value from its own data files, so clearing a box puts it back the way it was. Saving works with the game server stopped too; it says so, and the values are picked up next start.
• Five staff levels, granted per account and per game. Player, Moderator, Game Master, Administrator and Super Administrator, each one able to do everything below it. The same login can be a Super Administrator on your Golden Age server and an ordinary player on the next server you run. The control panel opens at Administrator; editing settings and handing out levels needs Super Administrator.
• Game master commands are tiered. Every command now requires a level rather than just “is staff”, so you can hand somebody the tools to move players and spawn items without also handing them the ability to shut the server down. Type %help in game and you get the commands your own account may run, and nothing else.
• A way to make your first administrator on a fresh server. Start the website and it prints a one time password in the console, and writes it to SUPER_PASSWORD in settings.cfg. Sign in on your own site with any email address and that password in place of the real one, and that account becomes a Super Administrator. It is single use, it is blanked the moment somebody uses it, and it is only ever generated while nobody holds the top level, so once your server has an administrator the door is gone.
• tools/gmadmin in the archive, for anyone who would rather not use the panel. It lists staff, searches accounts, creates them, sets passwords, and grants or revokes a level. It reads your own settings.cfg, works with the server stopped, and needs nothing installed on the default database.

Changed

• The built in [email protected] account no longer ships with staff powers. Its password is published in our source and in every copy of this archive, which made it an administrator that anybody who downloaded the server already knew the password to. It is now an ordinary account, and the first real administrator is the one you make yourself with the password above or with gmadmin. If you were relying on it, grant your own account a level before you upgrade.
• Revoking somebody’s staff level now takes effect immediately. Their level is checked when they type a command, rather than once when they entered the world, so a level you take away stops working without waiting for them to log out.
• Sign in is rate limited, per address and per account, and a failed sign in no longer takes a measurably different amount of time depending on whether the email is registered.

Fixed

• The website read the client’s own address header without question. Behind a proxy that is correct, and directly exposed it let a caller write whatever address it wanted into the audit log and past any per address limit.
• The launcher connection answered nothing at all for a message it did not understand. The caller then waited for its own timeout and reported the server as not running, which sent operators to look at a server that was fine.