Dev Titan.TF

This site serves as a public repository for all of our developers' latest commits to our internal development repositories. It only shows the names of the files that have been revised as well as the date they were updated. A green border surrounds commits that have been deployed to live servers. , and indicate the build status which are still under development or testing.

Builds marked with the MASTER tag are builds that are ready to be deployed or have been deployed after merging from our development branch, while builds under the DEV tag are under development or internal testing.

But why is that? We switched to a smaller, more frequent incremental update scheme with Patch 2.1.94. Before we release a patch note, anyone will be able to see when our servers were updated and what had changed.

Build Directory

Last Updated: Oct 26, 2026 03:40 PM +0800

Server MASTER Website MASTER API MASTER AOT MASTER

MASTERServer Builds
View Repository

View CommitChanges
feat: Added new taunts

View CommitChanges
Update server list

View CommitChanges
Added missing configs

View CommitChanges
Fixed bans DB

View CommitChanges
Fix DB

View CommitChanges
Update DB

View CommitChanges
Removed SG servers

View CommitChanges
Updated hub mapcycle

View CommitChanges
Updated hub mapcycle

View CommitChanges
Spray name location center text

View CommitChanges
Updated gamedata

View CommitChanges
Updated paths

View CommitChanges
Fixed FF2 in Hub

View CommitChanges
Readded Freak Fortress to Hub

View CommitChanges
Added hightower randomizer to server list

View CommitChanges
Removed mvm_darkcells

MASTERWebsite Builds
View Repository

View CommitChanges
titan_debit/titan_credit: succeed for a 0 amount

A 0 UPDATE changes no row, so affectedRows() was 0 and the helpers reported failure:
free mystery boxes, 100%-off items and 0-total carts failed with "not enough money"
since PR #76.

Co-Authored-By: Claude Opus 5.5

View CommitChanges
Fix regressions from the PR #76 hardening found in a page-by-page review

- settings/sessions: Revoke and Edit sent the numeric session id, but revoke_token.php and
session.php still looked sessions up by token, so neither worked. Both now use the id,
scoped to the logged-in owner.
- external admin/events/exchange/law: bundle.js loads its own jQuery and dropped the CSRF
header hook, so admin follow-up Request/Reject/Submit and gem order Delivered/Failed got
a silent 403. Re-attach the hook after bundle.js like the accounts layout already does.
- commands, chat server list, chat emotes: stored entities were escaped a second time
(<item id>, &amp; in "Joining..", emotes with ' never matched).
- forum category description: staff-written link showed as a raw tag; render it
through AntiXSS like command descriptions.
- events/workshop comments and workshop submissions: stored raw again but read back with
stripcslashes(), which ate backslashes; keep the escaped storage format.
- profiles: post/comment reports sent report_reason, the endpoints read reason.
- Track the root layout_session.php shim (legacy include path) that production already uses.

Co-Authored-By: Claude Opus 5.5

View CommitChanges
Fix sanitizer source showing as text in post/comment feeds

PR #76 pasted a window.titanSafeHtml / titanSafeHtmlV2 definition into 16 files, including AJAX
fragments (load_posts, load_new_posts, load_user_posts, load_comments, ...). Callers insert those with
$(data).hide().appendTo(...).fadeIn(), and fadeIn sets display:block on the top-level

View CommitChanges
load_server_stats: index-friendly 24h window for the server graph

Same condition as before for the INT date column, but lets MySQL range-scan the new
server_stat(ip, date) index instead of reading every row for the server.

Co-Authored-By: Claude Opus 5.5

View CommitChanges
load_statistics: make the time-window predicates index-friendly

'UNIX_TIMESTAMP(NOW()) - date <= N' can't use an index; 'date >= UNIX_TIMESTAMP(NOW()) - N'
is the same condition for these INT columns and can. Together with the new indexes
(server_stat(ip, date), and date on connect/disconnect/chat) the snapshot drops from
~12 min to ~4 min.

Co-Authored-By: Claude Opus 5.5

View CommitChanges
api/statistics: render load_statistics.php in-process when run from cron

The page takes ~12 minutes on the current server_stat table, well past Cloudflare's
100 s origin timeout, so the HTTPS self-fetch always failed and api/statistics.html was
stuck at Aug 31. From the CLI, include it with output buffering instead, and write the
snapshot atomically. The HTTP path (CRON_SECRET) is unchanged.

Co-Authored-By: Claude Opus 5.5

View CommitChanges
security: no localhost exemption for cron/server-key endpoints

titan_require_shared_secret() let any header-less request from 127.0.0.1 through without
CRON_SECRET/SERVER_API_KEY, so any local process (or SSRF in another site on the host)
could run draw_*/reset_*/invoice jobs. Cron runs as the PHP CLI now, so only the CLI
bypasses the key. Removes titan_is_local_request() (no other callers) and updates
SECURITY.md and the per-script header comments.

Co-Authored-By: Claude Opus 5.5

View CommitChanges
load_statistics: guard the divide-by-zero that killed the page since Aug 31

The commented-out

still runs its PHP and divided by ($playercount + recent24total),
which is 0 for servers without recent sessions, so the cron snapshot (api/statistics.html)
never regenerated. Print 0.0 in that case; output is unchanged otherwise.

Co-Authored-By: Claude Opus 5.5

View CommitChanges
GetAvatar: drop the per-render get_headers() probe to Steam's CDN

Every avatar did a blocking HTTPS round trip (~250 on /emotes, ~7s page). The probe
compared against 'HTTP/1.0 404 Not Found', which Steam's CDN (HTTP/1.1) never sends,
so it always returned the URL anyway. Same return values; empty/all-zero hashes now
fall back to the default avatar without any network I/O.

Co-Authored-By: Claude Opus 5.5

View CommitChanges
Deploy: point at new server, pin actions to SHAs, drop insecure set-env

- host 154.26.138.195 -> 168.119.126.46 (old IP unreachable, deploys timed out)
- pin actions/checkout, appleboy/discord-action and appleboy/scp-action to release
commit SHAs instead of @master/@v1 (the scp step receives the root deploy key)
- version.sh writes WEB_BUILD via $GITHUB_ENV; remove ACTIONS_ALLOW_UNSECURE_COMMANDS

Co-Authored-By: Claude Opus 5.5

View CommitChanges
Merge pull request #76: security hardening (php2shell mitigations, secrets, SQLi/XSS/CSRF/authz/economy)

Security hardening: php2shell mitigations, secrets out of git, SQLi/XSS/CSRF/authz/economy fixes

View CommitChanges
Add owner deployment and rotation checklist to SECURITY.md

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
npm audit fix for external/* front-end toolchains

Lockfile-only, semver-compatible updates (tinymce 5.10.9, summernote 0.8.20, tagify
3.25, datatables 1.13.11, jquery-validation 1.22.1, moment 2.31); 70 -> 45 advisories
per project. No major bumps; the node-sass build was already broken on Node 22.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Harden legacy novus section

Parameterized queries, escaped output and safe redirects.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Harden accounts, admin, events, exchange and law sub-sites

Same treatment for external/*: placeholders, escaping, CSRF, role/ownership checks,
cron keys, Discord webhook names instead of URLs, CSRF script in the sub-site layouts
(including after bundle.js replaces jQuery).

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Harden remaining pages and endpoints

Parameterized queries, escaped output, CSRF on settings/session/notification actions,
session tokens no longer rendered into other pages, private inventory respected,
steam:// auto-connect limited to known servers.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

MASTERAPI Builds
View Repository

View CommitChanges
Fixed strip_components

View CommitChanges
Updated deploy workflow

View CommitChanges
Fix Deploy

View CommitChanges
Test Deploy

View CommitChanges
Finished get blogs API

View CommitChanges
Initial commit

MASTERAOT Builds
View Repository

View CommitChanges
Added spawns for badwater

View CommitChanges
Copy stripper configs to build package

View CommitChanges
Fixed compile error

View CommitChanges
Updated tips

View CommitChanges
Fixed stripper deploy

View CommitChanges
Added spawns for upward

View CommitChanges
Moved out from disabled plugins

View CommitChanges
Updated workflows

View CommitChanges
Updated package workflow

View CommitChanges
Updated deploy workflow

View CommitChanges
- Disable auto map change
- Updated deploy workflow

View CommitChanges
Fixed deploy

View CommitChanges
Fixed deploy

View CommitChanges
Fixed deploy

View CommitChanges
Fixed missing bot spawns on cp_steel

View CommitChanges
Fixed not deploying to AOT official server