Skip to content

feat(mail-return): add mail return tool page#180

Merged
Helias merged 2 commits intoazerothcore:masterfrom
Nyeriah:mail
Mar 26, 2026
Merged

feat(mail-return): add mail return tool page#180
Helias merged 2 commits intoazerothcore:masterfrom
Nyeriah:mail

Conversation

@Nyeriah
Copy link
Copy Markdown
Member

@Nyeriah Nyeriah commented Mar 25, 2026

Summary

  • Adds a new Mail Return tool page under Profile menu
  • Users can select a character to view sent mails that have not yet been read by the recipient
  • Each mail displays the receiver's nameplate (race/class icons, level), subject, sent/expiry dates, attached items (as Wowhead links with tooltips and icons), and money
  • Clicking "Return" executes .mail return <receiverName> <mailId> via SOAP to return the mail to the sender

Security

  • All SQL queries use prepared statements with bound parameters
  • charGuid and mailId validated as numeric and cast to intval()
  • Account ownership verified server-side before listing or returning mails
  • Receiver existence verified from database before SOAP execution
  • SOAP command uses database-sourced names, never user input
  • HTML output escaped with esc_html(), esc_attr(), esc_url(), esc_js()

Test plan

  • Log in to the CMS and navigate to Profile → Mail Return
  • Select a character and verify sent unread mails are listed
  • Verify items display as Wowhead links with icons and tooltips
  • Click Return on a mail and verify it is returned to the sender in-game
  • Verify returned mail disappears from the list
  • Verify you cannot return mails from characters you don't own
  • Verify already-read mails are not listed

🤖 Generated with Claude Code

Add a new tool page under Profile that allows users to return
sent mails that have not yet been read by the recipient.

- Character selector shows user's characters (senders)
- Lists unread sent mails with receiver nameplate (race/class icons)
- Displays attached items as Wowhead links with tooltips and icons
- Shows mail metadata (subject, sent date, expiry date, money)
- Return action executes `.mail return` via SOAP
- Security: prepared statements, intval casting, account ownership
  validation, receiver verification, XSS escaping (esc_html,
  esc_attr, esc_url, esc_js)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@TheSCREWEDSoftware
Copy link
Copy Markdown
Contributor

Requires: azerothcore/azerothcore-wotlk#25213 to be merged

@Helias Helias merged commit 3203e18 into azerothcore:master Mar 26, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants