This site serves as a public repository for all of our developers' latest commits to our internal development repositories. It only shows the names of the files that have been revised as well as the date they were updated. A green border surrounds commits that have been deployed to live servers. , and indicate the build status which are still under development or testing.
Builds marked with the MASTER tag are builds that are ready to be deployed or have been deployed after merging from our development branch, while builds under the DEV tag are under development or internal testing.
But why is that? We switched to a smaller, more frequent incremental update scheme with Patch 2.1.94. Before we release a patch note, anyone will be able to see when our servers were updated and what had changed.
Last Updated: Oct 26, 2026 03:45 PM +0800
View CommitChanges
feat: Added new taunts
View CommitChanges
Update server list
View CommitChanges
Added missing configs
View CommitChanges
Fixed bans DB
View CommitChanges
Fix DB
View CommitChanges
Update DB
View CommitChanges
Removed SG servers
View CommitChanges
Updated hub mapcycle
View CommitChanges
Updated hub mapcycle
View CommitChanges
Spray name location center text
View CommitChanges
Updated gamedata
View CommitChanges
Updated paths
View CommitChanges
Fixed FF2 in Hub
View CommitChanges
Readded Freak Fortress to Hub
View CommitChanges
Added hightower randomizer to server list
View CommitChanges
Removed mvm_darkcells
View CommitChanges
titan_debit/titan_credit: succeed for a 0 amount
A 0 UPDATE changes no row, so affectedRows() was 0 and the helpers reported failure:
free mystery boxes, 100%-off items and 0-total carts failed with "not enough money"
since PR #76.
Co-Authored-By: Claude Opus 5.5
View CommitChanges
Fix regressions from the PR #76 hardening found in a page-by-page review
- settings/sessions: Revoke and Edit sent the numeric session id, but revoke_token.php and
session.php still looked sessions up by token, so neither worked. Both now use the id,
scoped to the logged-in owner.
- external admin/events/exchange/law: bundle.js loads its own jQuery and dropped the CSRF
header hook, so admin follow-up Request/Reject/Submit and gem order Delivered/Failed got
a silent 403. Re-attach the hook after bundle.js like the accounts layout already does.
- commands, chat server list, chat emotes: stored entities were escaped a second time
(<item id>, & in "Joining..", emotes with ' never matched).
- forum category description: staff-written link showed as a raw tag; render it
through AntiXSS like command descriptions.
- events/workshop comments and workshop submissions: stored raw again but read back with
stripcslashes(), which ate backslashes; keep the escaped storage format.
- profiles: post/comment reports sent report_reason, the endpoints read reason.
- Track the root layout_session.php shim (legacy include path) that production already uses.
Co-Authored-By: Claude Opus 5.5
View CommitChanges
Fix sanitizer source showing as text in post/comment feeds
PR #76 pasted a window.titanSafeHtml / titanSafeHtmlV2 definition into 16 files, including AJAX
fragments (load_posts, load_new_posts, load_user_posts, load_comments, ...). Callers insert those with
$(data).hide().appendTo(...).fadeIn(), and fadeIn sets display:block on the top-level