rest_url( CSDT_DevTools::HISCORE_NS ),
'nonce' => wp_create_nonce( CSDT_DevTools::SCORE_NONCE_ACTION ),
)
) . ';',
'before'
);
wp_print_scripts( array( 'csdt-404' ) );
?>
runner|jetpack|racer|miner|asteroids|snake|spaceinvaders|mrdo)',
array(
array(
'methods' => 'GET',
'callback' => array( __CLASS__, 'rest_get_hiscore' ),
// Public leaderboard read, no authentication required.
'permission_callback' => '__return_true',
'args' => array(
'game' => array(
'required' => true,
'type' => 'string',
),
),
),
array(
'methods' => 'POST',
'callback' => array( __CLASS__, 'rest_set_hiscore' ),
// Open to guests by design (the 404 mini-games), so the gate is the
// score nonce the 404 page prints, checked before the callback runs.
'permission_callback' => array( __CLASS__, 'hiscore_write_allowed' ),
'args' => array(
'game' => array(
'required' => true,
'type' => 'string',
),
'score' => array(
'required' => true,
'type' => 'integer',
'minimum' => 1,
'maximum' => 999999,
),
'name' => array(
'required' => true,
'type' => 'string',
'maxLength' => 30,
),
),
),
)
);
}
/** Returns the top-10 leaderboard for one game. */
public static function rest_get_hiscore( WP_REST_Request $request ): WP_REST_Response {
$game = sanitize_key( $request->get_param( 'game' ) );
$raw = get_option( 'csdt_devtools_leaderboard_' . $game, '' );
$lb = $raw ? json_decode( $raw, true ) : array();
if ( ! is_array( $lb ) ) {
$lb = array(); }
return rest_ensure_response( array( 'leaderboard' => $lb ) );
}
/**
* Permission check for a score submission: the request must carry the score nonce.
*
* @param WP_REST_Request $request The request.
* @return true|WP_Error
*/
public static function hiscore_write_allowed( WP_REST_Request $request ) {
$nonce = $request->get_header( 'x_wp_score_nonce' );
if ( ! $nonce || ! wp_verify_nonce( sanitize_text_field( $nonce ), CSDT_DevTools::SCORE_NONCE_ACTION ) ) {
return new WP_Error( 'forbidden', __( 'Invalid nonce.', 'cloudscale-cyber-devtools' ), array( 'status' => 403 ) );
}
return true;
}
/** Inserts a score into the top-10 leaderboard for one game. The nonce is checked by hiscore_write_allowed(). */
public static function rest_set_hiscore( WP_REST_Request $request ) {
$game = sanitize_key( $request->get_param( 'game' ) );
$score = (int) $request->get_param( 'score' );
$name = sanitize_text_field( $request->get_param( 'name' ) );
$score_caps = array(
'runner' => 999999,
'jetpack' => 999999,
'racer' => 999999,
'miner' => 2000,
'asteroids' => 999999,
'snake' => 9990,
'spaceinvaders' => 99990,
'mrdo' => 99990,
);
if ( isset( $score_caps[ $game ] ) && $score > $score_caps[ $game ] ) {
return new WP_Error( 'score_invalid', __( 'Score exceeds maximum for this game.', 'cloudscale-cyber-devtools' ), array( 'status' => 422 ) );
}
// Rate limit: max 5 submissions per IP per game per 10 minutes. Use the
// CF-validated client IP (not raw REMOTE_ADDR, which is the edge IP behind
// Cloudflare and would collapse all visitors into one bucket).
$ip = CSDT_DevTools::get_client_ip();
$ip_key = 'csdt_devtools_rl_' . md5( $ip . $game );
$count = (int) get_transient( $ip_key );
if ( $count >= 5 ) {
return new WP_Error( 'rate_limited', __( 'Too many score submissions. Try again later.', 'cloudscale-cyber-devtools' ), array( 'status' => 429 ) );
}
set_transient( $ip_key, $count + 1, 600 );
$raw = get_option( 'csdt_devtools_leaderboard_' . $game, '' );
$lb = $raw ? json_decode( $raw, true ) : array();
if ( ! is_array( $lb ) ) {
$lb = array(); }
foreach ( $lb as $entry ) {
if ( (int) $entry['score'] === $score && $entry['name'] === $name ) {
return rest_ensure_response(
array(
'ok' => false,
'leaderboard' => $lb,
)
);
}
}
$lowest = isset( $lb[9] ) ? (int) $lb[9]['score'] : 0;
if ( count( $lb ) >= 10 && $score <= $lowest ) {
return rest_ensure_response(
array(
'ok' => false,
'leaderboard' => $lb,
)
);
}
$lb[] = array(
'score' => $score,
'name' => $name,
);
usort( $lb, fn( $a, $b ) => (int) $b['score'] - (int) $a['score'] );
$lb = array_slice( $lb, 0, 10 );
update_option( 'csdt_devtools_leaderboard_' . $game, wp_json_encode( $lb ), false );
return rest_ensure_response(
array(
'ok' => true,
'leaderboard' => $lb,
)
);
}
/** AJAX handler: saves the 404 enable toggle and colour scheme. */
public static function ajax_save_404_settings(): void {
check_ajax_referer( 'csdt_devtools_404_settings', 'nonce' );
if ( ! current_user_can( 'manage_options' ) ) {
wp_die( esc_html__( 'Forbidden.', 'cloudscale-cyber-devtools' ) );
}
$custom_404 = isset( $_POST['custom_404'] ) ? ( absint( wp_unslash( $_POST['custom_404'] ) ) ? 1 : 0 ) : 0;
update_option( CSDT_DevTools::CUSTOM_404_OPTION, $custom_404 );
if ( isset( $_POST['scheme'] ) ) {
$schemes = self::get_404_schemes();
$scheme_key = sanitize_key( wp_unslash( $_POST['scheme'] ) );
if ( isset( $schemes[ $scheme_key ] ) ) {
update_option( CSDT_DevTools::SCHEME_404_OPTION, $scheme_key );
}
}
wp_send_json_success(
array(
'custom_404' => $custom_404,
'scheme' => get_option( CSDT_DevTools::SCHEME_404_OPTION, 'ocean' ),
)
);
}
/** Renders the 404 Games settings panel. */
public static function render_404_panel(): void {
$current_scheme = get_option( CSDT_DevTools::SCHEME_404_OPTION, 'ocean' );
$enabled = (bool) get_option( CSDT_DevTools::CUSTOM_404_OPTION, 0 );
?>
🎮 404 GAMES PAGE
'Enable',
'rec' => 'Toggle',
'desc' => 'When enabled, replaces the default WordPress 404 page with a fun interactive page featuring 8 mini-games: Runner, Jetpack, Racer, Miner, Asteroids, Snake, Digger and Alien Defence. No theme dependency, works even if the active theme is broken.',
),
array(
'name' => 'Colour Scheme',
'rec' => 'Optional',
'desc' => 'Choose from 12 built-in colour palettes. Use Preview 404 to see the result, then click Save Scheme to apply it to your live 404 page, clicking a swatch alone does not save it.',
),
)
);
?>