Site Update: Back to Building Games

For the past two months I've been working behind the scenes to clean up the foundations of YouPlayIt. The site has been running on a codebase that's over 20 years old, and a lot of the underlying machinery was either out of date or carrying problems nobody had time to fix. None of this recent work of mine added any features. But it all had to happen before I could responsibly start touching game code again. With the help of Claude Code I was able to tackle this in bulk.

Here's what got done.

Security

The site had serious SQL injection exposure across most of its database operations. This is the kind of vulnerability that lets a hostile user craft inputs that take over a database. I rewrote every public-facing part of the site that talks to the database to close that kind of attack off completely. Login, registration, profile changes, email changes, and game move submission across all six games are now hardened. This was the most significant and time consuming of all the work.

I also removed some leftover debugging output that was accidentally printing internal database information onto pages during normal use. There are a handful of other known minor weaknesses are documented and queued. They're known, they're not the highest priority right now, risk is small, damage is negligible, and they will get worked through.

Infrastructure

The Java engine that runs Gonzaga was on a version of Java that hasn't received security updates in years. I upgraded it to the current supported version and rebuilt all the game engine components against it. The service that keeps the engine running was also migrated off an old commercial wrapper onto a modern open-source one. While I was in there I also fixed a longstanding typo in the code that nobody had ever bothered to correct. This was the second largest item that had to be corrected before I could move on.

Donations

The PayPal donation badge had been broken since before I took over the site in 2018. Every time someone donated, I was running database updates by hand. It turned out the PayPal mechanism this site relied on was broken at the PayPal account level and had been for years, with no fix available short of getting PayPal's engineering team involved. Instead of dealing with that nightmare, I switched the donation flow over to a different PayPal mechanism that works. Donations now process automatically end-to-end: badges update, audit records get written, and thank-you emails go out without me touching anything.

Operations

The site finally has proper source control again. For years, the live server was the only copy of the running code, and any mistake was permanent. There are now two private code repositories, automated sync between my dev environment and the live server, and a documented procedure for everything from deploying a change to archiving dead files. Traffic analytics are now running so I can actually see what's getting used.

I also archived 77 dead files from the active codebase, captured a full snapshot of the database structure, and wrote roughly seven separate documents covering how the site works, what's broken, what's been fixed, and what's deferred. The original codebase is mostly in Italian (variable names and comments), and there's now a growing English glossary so future work doesn't keep tripping over translation guesses.

What's next

The foundations are now in a state where I can actually work on the things that matter to you: game mechanics, longstanding game bugs, and new features. The first item on that list is the tailing bug. See the forum for my idea on this. After that, I'm going to start looking at the open bug list and the feature requests that have been sitting around.

Thank you for your patience while none of this was visible from the outside. If you noticed nothing changing for two months, that's exactly the outcome I was aiming for. The site stays up, the games stay running, and everything underneath is now in much better shape.