L2 Final Epilogue — Web Panel

A drop-in PHP web panel for L2J Final Epilogue game servers. Player dashboard, voting, donations, multi-language support, and a two-tier admin system — all in a single self-contained folder.

Dark fantasy aesthetic · CSRF-protected · Mobile-first · Zero JS dependencies for core flows

Features

Public landing page

Live server-status banner (TCP probe to game-server port, falls back to DB-reachable)
Hall of Fame (top 5 by level), Top Voters of the week
Configurable hero copy, server rates, and feature toggles — all editable from the admin UI
Inline login form, register CTA
Auto-detected language with manual override (7 locales)

Player dashboard

Account summary: total Adena across all characters, character count, highest level
Per-character roster with level, class, PvP/PK, Adena, online status
Auto-detects active character if multiple on the account

Voting

Hopzone integration with three verification modes: trust (no check), json_api, text_api
Per-account cooldown (default 12h, configurable)
Item rewards delivered directly to the chosen character's inventory
Audit log + per-week top voters leaderboard

Donations

PayPal (Smart Buttons SDK with server-side capture verification)
Stripe (hosted Checkout + HMAC-verified webhooks)
Editable package catalog (CRUD in admin UI — price, item, quantity, sort order)
Three layers of fraud protection (see Anti-fraud guarantees)
Audit log of every donation attempt (paid, pending, failed, mismatch)

Two-tier admin

Admin (accessLevel ≥ 7): ban/unban, character moderation, edit non-sensitive settings
Super-Admin (accessLevel ≥ 100): promote/demote other admins, edit payment & reCAPTCHA keys, delete accounts
Visual lock indicators (🔒) on restricted UI; server-side gating regardless of UI state

Internationalization

7 languages: English (default), Spanish, Russian, Portuguese, French, German, Slovak
Browser-language auto-detection via Accept-Language header
Manual override stored in 1-year cookie
Easy to add more languages — just drop a file in lang/

Security

CSRF tokens on every state-changing form (hash_equals comparison)
POST → redirect → GET to prevent resubmission
Session regeneration on login
Constant-time password comparison
Webhook signature verification (Stripe HMAC; PayPal server-side capture)

Screenshots

Live previews ship with the zip. Open index-{lang}-preview.html in any browser to see each language render without booting PHP.

Public landing	Player dashboard	Admin overview
Hero with login + status banner	Adena ledger + character roster	Ban / promote / character moderation

Requirements


PHP	7.4 or newer (8.x recommended)
PHP extensions	`pdo_mysql`, `curl`, `json`, `mbstring`, `openssl`
Database	MySQL 5.7+ / MariaDB 10.3+ — same DB the L2J server uses
Web server	Apache 2.4+ or nginx 1.18+ with PHP-FPM
HTTPS	Required for production (Stripe/PayPal webhooks won't fire on HTTP)

Quick Start

# 1. Drop the panel folder onto your web root
unzip l2-panel.zip -d /var/www/

# 2. Edit DB credentials
cd /var/www/l2-panel
nano inc/config.php      # set DB_HOST, DB_NAME, DB_USER, DB_PASS

# 3. Bootstrap your first super-admin in MySQL
mysql -u root -p l2jdb -e "
  UPDATE accounts SET accessLevel = 100 WHERE login = 'your_login';
"

# 4. (Optional) Set ownership for the web user
chown -R www-data:www-data /var/www/l2-panel

# 5. Browse to https://your-domain/
#    Sign in with your L2J account → click 'Admin' in the nav

That's it. The custom panel tables (web_settings, web_votes, web_vote_config, web_donate_packages, web_donations) are created automatically on first read — no schema migration needed.

Configuration

Database connection

Edit inc/config.php — the only file you must touch:

define('DB_HOST', '127.0.0.1');
define('DB_PORT', 3306);
define('DB_NAME', 'l2jdb');         // Login server DB (`accounts` table)
define('DB_USER', 'root');
define('DB_PASS', '');

// If your login + game DBs are split, set the game-server schema here.
// Most L2J Final Epilogue setups use one DB — leave it the same.
define('GAME_DB_NAME', 'l2jdb');

Everything else is editable from the admin panel — no PHP edits required for currency, server status probe, donation packages, voting config, forum URL, reCAPTCHA, or copy.

Site settings (in the panel)

Sign in as an admin → click Admin → Settings. The page is organized into fieldsets:

Section	What lives here
Branding & copy	Site name, hero tagline, footer note, forum URL
Game Server	Silver item ID, silver label, game-server host + port for live status probe
Server rates	Decorative rate display on the landing page
Sections to show	Hall of Fame, Top Voters, Chronicle features, Server rates
reCAPTCHA 🔒	Enable + site/secret keys (super-admin only)

Admin tiers

Two access levels, mapped to L2J's accessLevel column:

Tier	accessLevel	Bootstrap	Can do
Player	0	(default)	Login, vote, donate
Admin (GM)	≥ 7	`UPDATE accounts SET accessLevel = 7 WHERE login = 'gm';`	Ban/unban, reset passwords, character moderation, non-sensitive settings
Super-Admin	≥ 100	`UPDATE accounts SET accessLevel = 100 WHERE login = 'owner';`	All admin actions plus promote/demote others, edit reCAPTCHA & payment keys, delete accounts

The constants ADMIN_ACCESS_LEVEL and SUPER_ADMIN_ACCESS_LEVEL in inc/config.php can be tuned if your L2J fork uses different conventions.

Voting (Hopzone)

Configure under Admin → Voting.

Field	Description
Status	Master enable/disable
Hopzone URL	Full URL to your server's Hopzone listing
Cooldown	Hours between votes per account (default 12)
Verify mode	`trust` / `json_api` / `text_api` (see below)
API key	If using `json_api` or `text_api`
Reward item ID	L2J item id (default 57 = Adena)
Reward count	Quantity granted per vote

Verify modes

trust — claim the reward immediately on return. Easiest setup, but can be gamed by anyone who reloads the claim page.
json_api — checks Hopzone's JSON API. Recommended.
text_api — for legacy Hopzone deployments returning plain text.

The verify URL accepts {KEY} and {IP} placeholders that get substituted at request time.

Donations

Configure under Admin → Donations. The page has four blocks:

Stat cards — today / 30-day / all-time totals
Package catalog — edit price, item id, count, sort, enabled flag
Master toggle + currency + thank-you message
PayPal + Stripe provider blocks (both 🔒 super-admin only)

Stripe setup

Stripe Dashboard → Developers → Webhooks → Add endpoint:
```
https://your-domain/path-to-panel/stripe-webhook.php
```
Subscribe to event: checkout.session.completed
Copy the signing secret (whsec_…)
In the panel: paste your pk_live_…, sk_live_…, and whsec_… keys
The "✓ Active" indicator turns green when all three are filled

PayPal setup

PayPal Developer Dashboard → My Apps & Credentials
Create a REST API app, note the Client ID + Secret
In the panel: paste them in, choose Sandbox (testing) or Live
The "✓ Active" indicator turns green when both fields are filled

PayPal uses the JavaScript SDK with server-side capture verification — no webhook URL required (the browser-side flow is finalized by a server call from donate-paypal.php).

Anti-fraud guarantees

Three independent layers — each works on its own:

Server-generated reference IDs. Clients never propose them — the panel mints a 24-char random hex per donation attempt.
Provider transaction-ID dedup. The web_donations table has a UNIQUE(provider, tx_id) constraint. Replays fail at the database level.
Amount + currency re-check. Before granting items, the panel re-validates the captured amount and currency against the original package. Mismatches go to status mismatch and refuse to grant.

The receiving character should ideally be offline when the webhook fires — L2J's IdFactory race is well known and unrelated to this panel. The thank-you page nudges users in that direction.

reCAPTCHA

Optional Google reCAPTCHA v2 ("I'm not a robot") on login + register.

Get keys at Google reCAPTCHA admin (use v2 Checkbox)
Sign in to the panel as a super-admin
Admin → Settings → reCAPTCHA: paste site key + secret key, tick "Enable"

Regular admins see the fieldset locked with a 🔒 badge — they can read but not modify. Server-side gating drops any tampered POSTs.

Internationalization

Supported languages out of the box:


🇬🇧 English	🇪🇸 Español	🇷🇺 Русский	🇵🇹 Português	🇫🇷 Français	🇩🇪 Deutsch	🇸🇰 Slovenčina

How it works

?lang=de   →   cookie l2_lang   →   Accept-Language header   →   en (default)

The first signal that resolves to a supported locale wins. Explicit choices via the picker set a 1-year cookie at Path=/, SameSite=Lax.

Adding a new language

Copy lang/en.php to lang/<code>.php (e.g. lang/it.php)
Translate the values — leave keys untouched

Add an entry to supported_languages() in auth.php:

'it' => ['name' => 'Italiano', 'flag' => '🇮🇹'],

Missing keys in any locale automatically fall back to English — partial translations are safe.

Scope

Translation covers player-facing pages only: index, login, register, dashboard, vote, donate, donate-paypal, donate-return. Admin pages remain English by design — they're a tool for one or two operators, not for end-users.

File Layout

l2-panel/
├── README.md
├── style.css                    ← single-file stylesheet (~2700 lines)
│
│   ── Public + player pages (entry points / bookmarkable URLs) ──
├── index.php                    ← public landing page
├── login.php                    ← sign-in
├── register.php                 ← sign-up
├── logout.php
├── dashboard.php                ← player dashboard (chars + Adena)
├── vote.php                     ← Hopzone voting
├── donate.php                   ← donation package picker
├── donate-paypal.php            ← PayPal SDK interim page
├── donate-return.php            ← post-payment landing (Stripe success_url)
├── lang.php                     ← language switcher endpoint
│
│   ── Webhooks (URLs registered with Stripe / PayPal — DO NOT MOVE) ──
├── stripe-webhook.php           ← Stripe HMAC-verified webhook
├── paypal-confirm.php           ← PayPal server-side order capture
│
├── admin/                       ← admin pages — gated by require_admin()
│   ├── index.php                ← server overview
│   ├── accounts.php             ← account moderation (ban/promote/etc)
│   ├── characters.php           ← character moderation
│   ├── voting.php               ← Hopzone config + audit log
│   ├── donations.php            ← Stripe/PayPal config + audit log
│   └── settings.php             ← site copy, rates, reCAPTCHA, game-server probe
│
├── inc/                         ← shared PHP partials (web access denied)
│   ├── .htaccess                ← deny all (Apache 2.2 + 2.4)
│   ├── config.php               ← DB credentials, tier constants, session setup
│   ├── auth.php                 ← all helpers — auth, CSRF, voting,
│   │                              donations, settings, i18n, base_url()
│   ├── nav.php                  ← shared player+admin navigation
│   ├── admin-header.php         ← admin page chrome (top)
│   └── admin-footer.php         ← admin page chrome (bottom)
│
└── lang/                        ← translation tables (web access denied)
    ├── .htaccess                ← deny all
    ├── en.php                   ← canonical English (181 keys)
    ├── es.php                   ← Spanish
    ├── ru.php                   ← Russian
    ├── pt.php                   ← Portuguese
    ├── fr.php                   ← French
    ├── de.php                   ← German
    └── sk.php                   ← Slovak

Why this split? Player pages stay at root so existing bookmarks (/dashboard.php, /vote.php, /donate.php) keep working. Webhook endpoints stay at root so Stripe/PayPal configurations don't need to be re-registered. Admin pages move to admin/ so URLs become cleaner (/admin/accounts.php instead of /admin-accounts.php). Shared partials move to inc/ with an .htaccess deny rule so they can't be hit directly via URL — they're only loaded via require_once from other pages. Translation tables in lang/ likewise.

All cross-page links use the base_url() helper so the panel works the same whether deployed at /, /panel/, or any other subdirectory.

Database Schema

The panel reads two existing L2J tables and creates five of its own. Custom tables are created automatically — no migration script needed.

Existing L2J tables (read-only mostly)

Table	Used for
`accounts`	login, password, accessLevel, lastactive, lastIP
`characters`	char list, level, classid, online, pvpkills, pkkills
`items`	summing inventory/paperdoll/warehouse for "total Adena"

Tables the panel creates

Table	Purpose
`web_settings`	k/v store for site settings (currency, copy, reCAPTCHA, payment keys)
`web_vote_config`	per-topsite voting config (Hopzone)
`web_votes`	audit log of every vote claim
`web_donate_packages`	editable donation catalog
`web_donations`	every donation attempt with status (`pending`, `paid`, `failed`, `mismatch`)

The web_donations table has UNIQUE(provider, tx_id) to prevent webhook replay attacks at the database level.

Security


Passwords	L2J's native `Base64(SHA-1(plaintext))` — same hash the game uses, so panel and client share a single credential
Constant-time login	`verify_account()` always runs `hash_equals` against either the real or a dummy hash, so non-existent accounts take the same time as wrong-password attempts (closes the user-enumeration timing oracle)
CSRF	Token in session + hidden form field; `hash_equals` comparison; `X-CSRF-Token` header accepted for JSON endpoints
Sessions	Cookie hardened with `HttpOnly`, `SameSite=Lax`, and `Secure` on HTTPS (auto-detected including `X-Forwarded-Proto`); regenerated on login AND register (anti-fixation); name configurable via `SESSION_NAME`
Language cookie	`SameSite=Lax` + `Secure` on HTTPS; the `lang.php` switcher strips CRLF/null from `?return=` and rejects non-relative paths to prevent open-redirect and response-splitting
POST-redirect-GET	Every admin action redirects after the DB write to prevent resubmission
Webhook verification	Stripe HMAC signature with constant-time compare; PayPal server-side order-capture verification
Idempotency	`UNIQUE(provider, tx_id)` on donations + `status='paid'` short-circuit in `fulfill_donation()`
Self-protection	Admins can't ban/demote themselves; regular admins can't act on super-admins
Server-side gating	Tampered POSTs that try to escalate privilege or write super-only fields are dropped silently
Output escaping	All user data goes through `htmlspecialchars()`; placeholder substitution in `t()` escapes too
No raw SQL with user input	All queries use PDO prepared statements
No DB-error leakage to users	Public pages (login, register, dashboard, vote, donate) catch `PDOException` and show a generic "Database error" message; the actual exception is `error_log()`'d for the admin to inspect
CSS browser parity	All `backdrop-filter` rules paired with `-webkit-backdrop-filter` so glassmorphism effects render correctly on Safari iOS/macOS

Customization

Branding

Most copy is editable in the admin Settings page — no PHP edits needed.

Visual theme

Single stylesheet at style.css (~2,650 lines). Design tokens at the top:

:root {
    --gold:     #d4a857;
    --gold-hi:  #e6c074;
    --gold-lo:  #8a6f3a;
    --emerald:  #6fae7a;
    --crimson:  #b94a4a;
    --bg-0:     #07070b;
    --bg-1:     #0e0d14;
    /* …more */
}

Tweak these, the rest of the system follows.

Currency

L2 Final Epilogue uses Adena (item id 57) by default. To use a custom coin (Donate Coin, Silver Coin, etc.), edit Admin → Settings → Game Server → Silver item ID + Silver label. No file edits required.

Adding admin pages

Each admin page follows the same template:

<?php
require_once __DIR__ . '/auth.php';
require_admin();           // or require_super_admin() for sensitive ones

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    check_csrf();
    // …handle action…
    header('Location: ' . basename(__FILE__));
    exit;
}

require __DIR__ . '/admin-header.php';
?>

<h1 class="page-title">Your Page</h1>
<!-- markup -->

<?php require __DIR__ . '/admin-footer.php'; ?>

Then add a sub-nav entry in nav.php under $adminItems.

Troubleshooting

"Database error: SQLSTATE[HY000] [2002] Connection refused"

Your DB_HOST / DB_PORT is wrong, MySQL isn't running, or it's not listening on TCP. Test with:

mysql -h 127.0.0.1 -P 3306 -u $DB_USER -p $DB_NAME -e 'SELECT 1'

"Forbidden — this page is for game masters only" after I set accessLevel=7

The session is cached. Sign out, sign back in, then try again. The account's accessLevel is checked fresh on each request, but session identity isn't refreshed unless you log out.

The Online/Offline pill always shows OFFLINE

The TCP probe needs a configured host. Go to Admin → Settings → Game Server, fill in gameserver_host (e.g. 127.0.0.1) and gameserver_port (default 7777), save. The "✓ Game server is responding" indicator below confirms the probe works.

Empty host = probe disabled = falls back to "DB-reachable" check, which will only show OFFLINE if MySQL itself is down.

Stripe payments succeed but the reward never lands

Your webhook isn't reaching the panel. Check:

HTTPS — Stripe refuses to deliver to http://
Endpoint URL — must match exactly what's in Admin → Donations
Signing secret — copy from Stripe dashboard, no leading/trailing whitespace
Server logs — look for stripe-webhook.php requests; 401 = bad signature, 200 = good
Subscribed event — must include checkout.session.completed

You can re-trigger a webhook from Stripe's dashboard for any past test payment without making a new charge.

PayPal payments succeed but the reward never lands

PayPal uses server-side capture, not webhooks. If the JS SDK's onApprove callback fires but the panel doesn't grant the reward, check the browser console — paypal-confirm.php returns JSON with the result. Most common cause: client ID/secret mismatch between what the SDK loads (public key) and what the server uses (secret key).

"That action requires super-admin privileges" but I'm an admin

Promotion/demotion, account deletion, payment keys, and reCAPTCHA keys are restricted to super-admins (accessLevel ≥ 100). Run:

UPDATE accounts SET accessLevel = 100 WHERE login = 'your_login';

Then sign out and back in.

The language switcher doesn't persist between visits

The cookie is l2_lang at Path=/, SameSite=Lax. If your panel lives at a sub-path and the cookie's Path doesn't match, browsers won't send it back. The default Path=/ covers all cases — only change it if you know what you're doing.

"Cannot delete account — still has characters"

Intentional. Delete the characters in-game (or via the admin UI's character moderation page) before deleting the account. This protects against orphan rows in characters that would otherwise crash the L2J server on next boot.

Character is online during donation/vote — they don't see the items

L2J's IdFactory caches inventory in-memory while a character is online. Items inserted via SQL won't appear until the character relogs. The thank-you page already mentions this — you can pre-empt the support ticket by reminding players up-front in your forum.

License

MIT — do whatever you want, attribution appreciated but not required.

Lineage II is a registered trademark of NCSOFT Corp. This panel is an unofficial fan project and is not affiliated with NCSOFT.

Contributing

PRs welcome. Before submitting:

Run the audit script in auth.php (CSRF coverage, brace balance, key parity)
Test responsive layout at 375 / 768 / 1280 px
If you add UI strings, update all 7 locale files — en.php is the source of truth, missing keys fall back to English but UI consistency suffers

For new features, open an issue first to discuss scope.

Name		Name	Last commit message	Last commit date
admin		admin
inc		inc
lang		lang
README.md		README.md
dashboard.php		dashboard.php
donate-paypal.php		donate-paypal.php
donate-return.php		donate-return.php
donate.php		donate.php
index.php		index.php
lang.php		lang.php
login.php		login.php
logout.php		logout.php
paypal-confirm.php		paypal-confirm.php
register.php		register.php
stripe-webhook.php		stripe-webhook.php
style.css		style.css
vote.php		vote.php

Latest commit

History

Folders and files

Repository files navigation