Merge pull request #273 from simoleo89/fix/wired-dev-compile

fix(build): restore emulator package

.github/workflows/build-release.yml

@@ -3,6 +3,7 @@ name: Build & Release JAR
 on:
   push:
     branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: write

Database Updates/003_live_required_schema.sql

@@ -435,6 +435,16 @@ ON DUPLICATE KEY UPDATE
     `triggers_talking_furniture` = VALUES(`triggers_talking_furniture`);
 
 INSERT IGNORE INTO `emulator_texts` (`key`, `value`) VALUES
+    ('commands.description.acc_modtool_room_info', 'Allows viewing room information in the moderation tool.'),
+    ('commands.description.cmd_add_youtube_playlist', ':add_youtube <base_item_id> <youtube_playlist_id>'),
+    ('commands.description.cmd_disablemassmentions', ':disablemassmentions'),
+    ('commands.description.cmd_disablementions', ':disablementions'),
+    ('commands.description.cmd_give_prefix', ':giveprefix <username> <text> <color> [icon] [effect]'),
+    ('commands.description.cmd_hidewired', ':hidewired'),
+    ('commands.description.cmd_list_prefixes', ':listprefixes <username>'),
+    ('commands.description.cmd_remove_prefix', ':removeprefix <username> <id|all>'),
+    ('commands.description.cmd_setroom_template', ':setroom_template'),
+    ('commands.description.cmd_update_youtube_playlists', ':update_youtube'),
     ('commands.keys.cmd_setroom_template', 'setroom_template;set_room_template'),
     ('commands.succes.cmd_setroom_template.verify', 'Copy the current room "%roomname%" to room_templates? Type :setroom_template %generic.yes% to confirm.'),
     ('commands.succes.cmd_setroom_template', 'Room saved as template id %id% with %items% items (%skipped% skipped - item_id not in items_base).'),

Database Updates/009_mentions_wordfilter.sql

@@ -37,6 +37,10 @@ VALUES
 ON DUPLICATE KEY UPDATE
     `comment` = VALUES(`comment`);
 
+INSERT IGNORE INTO `emulator_texts` (`key`, `value`) VALUES
+    ('commands.description.cmd_disablementions', ':disablementions'),
+    ('commands.description.cmd_disablemassmentions', ':disablemassmentions');
+
 
 -- ----------------------------------------------------------------------------
 -- 3. Emulator settings: cooldowns, caps and alias lists

Database Updates/010_furnidata_edit_log.sql

@@ -19,4 +19,50 @@ CREATE TABLE IF NOT EXISTS `furnidata_edit_log` (
 
 INSERT IGNORE INTO `emulator_settings` (`key`,`value`) VALUES
 ('items.furnidata.edit.backup.keep','10'),
-('items.furnidata.edit.ratelimit.ms','2000');
+('items.furnidata.edit.ratelimit.ms','2000'),
+-- Server-authoritative furni names (source of truth = furnidata JSON)
+('items.furnidata.names.enabled','true'),
+('items.furnidata.path',''),
+('items.furnidata.max.bytes','67108864'),
+-- Live-reload watcher
+('items.furnidata.watch.enabled','true'),
+('items.furnidata.watch.debounce.ms','750'),
+('items.furnidata.watch.min.interval.ms','5000'),
+('items.furnidata.delta.cap','500'),
+-- Furni editor: import official names/descriptions from Habbo
+('furni.editor.import.url','https://www.habbo.com/gamedata/furnidata_json/1'),
+('furni.editor.import.cache.ms','600000');
+
+START TRANSACTION;
+DROP TEMPORARY TABLE IF EXISTS cleanup_furnidata_settings;
+CREATE TEMPORARY TABLE cleanup_furnidata_settings (
+    `key` VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL PRIMARY KEY
+);
+INSERT INTO cleanup_furnidata_settings (`key`) VALUES
+    ('items.furnidata.names.enabled'),
+    ('items.furnidata.path'),
+    ('items.furnidata.max.bytes'),
+    ('items.furnidata.watch.enabled'),
+    ('items.furnidata.watch.debounce.ms'),
+    ('items.furnidata.watch.min.interval.ms'),
+    ('items.furnidata.delta.cap'),
+    ('furni.editor.import.url'),
+    ('furni.editor.import.cache.ms');
+
+-- Preview rows that will be removed.
+SELECT es.`key`, es.`value`
+FROM emulator_settings es
+JOIN cleanup_furnidata_settings cfs ON cfs.`key` = es.`key`
+ORDER BY es.`key`;
+
+DELETE es
+FROM emulator_settings es
+JOIN cleanup_furnidata_settings cfs ON cfs.`key` = es.`key`;
+
+-- Preview remaining matching rows inside the transaction.
+SELECT COUNT(*) AS remaining_furnidata_settings
+FROM emulator_settings es
+JOIN cleanup_furnidata_settings cfs ON cfs.`key` = es.`key`;
+
+-- Safe default. Change to COMMIT after reviewing the preview.
+ROLLBACK;

Database Updates/011_navigator_group_filter.sql

@@ -0,0 +1,9 @@
+-- Navigator search filters - companion to the gameserver fix for the catalog
+-- 'Find groups to join!' button (navigator/search/hotel_view/group:).
+
+INSERT IGNORE INTO `navigator_filter` (`key`, `field`, `compare`, `database_query`) VALUES
+('anything', 'getName', 'contains', 'SELECT rooms.* FROM rooms WHERE rooms.name LIKE ?'),
+('roomname', 'getName', 'contains', 'SELECT rooms.* FROM rooms WHERE rooms.name LIKE ?'),
+('owner', 'getOwnerName', 'equals_ignore_case', 'SELECT rooms.* FROM rooms WHERE rooms.owner_name LIKE ?'),
+('tag', 'getTags', 'contains', 'SELECT rooms.* FROM rooms WHERE rooms.tags LIKE ?'),
+('group', 'getGuildName', 'contains', 'SELECT rooms.* FROM rooms INNER JOIN guilds ON guilds.room_id = rooms.id WHERE guilds.name LIKE ?');

Database Updates/012_earnings_center.sql

@@ -0,0 +1,132 @@
+CREATE TABLE IF NOT EXISTS `users_earnings_claims` (
+  `id` int(11) NOT NULL AUTO_INCREMENT,
+  `user_id` int(11) NOT NULL,
+  `category` varchar(64) NOT NULL,
+  `period_key` varchar(32) NOT NULL,
+  `claimed_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `users_earnings_claims_unique_period` (`user_id`, `category`, `period_key`),
+  KEY `users_earnings_claims_user_id` (`user_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+INSERT IGNORE INTO `emulator_settings` (`key`, `value`, `comment`) VALUES
+('earnings.enabled', '0', 'Enable the emulator-owned earnings center reward hub.'),
+('earnings.daily_gift.enabled', '1', 'Enable daily gift earnings row.'),
+('earnings.daily_gift.cooldown.seconds', '86400', 'Cooldown in seconds for daily gift earnings claims.'),
+('earnings.daily_gift.credits', '0', 'Credits granted by daily gift earnings claims.'),
+('earnings.daily_gift.pixels', '0', 'Pixels granted by daily gift earnings claims.'),
+('earnings.daily_gift.points', '0', 'Seasonal points granted by daily gift earnings claims.'),
+('earnings.daily_gift.points.type', '5', 'Seasonal point type granted by daily gift earnings claims.'),
+('earnings.games.enabled', '1', 'Enable games earnings row.'),
+('earnings.games.cooldown.seconds', '86400', 'Cooldown in seconds for games earnings claims.'),
+('earnings.games.credits', '0', 'Credits granted by games earnings claims.'),
+('earnings.games.pixels', '0', 'Pixels granted by games earnings claims.'),
+('earnings.games.points', '0', 'Seasonal points granted by games earnings claims.'),
+('earnings.games.points.type', '5', 'Seasonal point type granted by games earnings claims.'),
+('earnings.achievements.enabled', '1', 'Enable achievements earnings row.'),
+('earnings.achievements.cooldown.seconds', '86400', 'Cooldown in seconds for achievements earnings claims.'),
+('earnings.achievements.credits', '0', 'Credits granted by achievements earnings claims.'),
+('earnings.achievements.pixels', '0', 'Pixels granted by achievements earnings claims.'),
+('earnings.achievements.points', '0', 'Seasonal points granted by achievements earnings claims.'),
+('earnings.achievements.points.type', '5', 'Seasonal point type granted by achievements earnings claims.'),
+('earnings.marketplace.enabled', '1', 'Enable marketplace earnings row.'),
+('earnings.marketplace.cooldown.seconds', '86400', 'Cooldown in seconds for marketplace earnings claims.'),
+('earnings.marketplace.credits', '0', 'Credits granted by marketplace earnings claims.'),
+('earnings.marketplace.pixels', '0', 'Pixels granted by marketplace earnings claims.'),
+('earnings.marketplace.points', '0', 'Seasonal points granted by marketplace earnings claims.'),
+('earnings.marketplace.points.type', '5', 'Seasonal point type granted by marketplace earnings claims.'),
+('earnings.hc_payday.enabled', '1', 'Enable HC payday earnings row.'),
+('earnings.hc_payday.cooldown.seconds', '86400', 'Cooldown in seconds for HC payday earnings claims.'),
+('earnings.hc_payday.credits', '0', 'Credits granted by HC payday earnings claims.'),
+('earnings.hc_payday.pixels', '0', 'Pixels granted by HC payday earnings claims.'),
+('earnings.hc_payday.points', '0', 'Seasonal points granted by HC payday earnings claims.'),
+('earnings.hc_payday.points.type', '5', 'Seasonal point type granted by HC payday earnings claims.'),
+('earnings.level_progress.enabled', '1', 'Enable level progress earnings row.'),
+('earnings.level_progress.cooldown.seconds', '86400', 'Cooldown in seconds for level progress earnings claims.'),
+('earnings.level_progress.credits', '0', 'Credits granted by level progress earnings claims.'),
+('earnings.level_progress.pixels', '0', 'Pixels granted by level progress earnings claims.'),
+('earnings.level_progress.points', '0', 'Seasonal points granted by level progress earnings claims.'),
+('earnings.level_progress.points.type', '5', 'Seasonal point type granted by level progress earnings claims.'),
+('earnings.donations.enabled', '1', 'Enable donations earnings row.'),
+('earnings.donations.cooldown.seconds', '86400', 'Cooldown in seconds for donations earnings claims.'),
+('earnings.donations.credits', '0', 'Credits granted by donations earnings claims.'),
+('earnings.donations.pixels', '0', 'Pixels granted by donations earnings claims.'),
+('earnings.donations.points', '0', 'Seasonal points granted by donations earnings claims.'),
+('earnings.donations.points.type', '5', 'Seasonal point type granted by donations earnings claims.'),
+('earnings.bonus_bag.enabled', '1', 'Enable bonus bag earnings row.'),
+('earnings.bonus_bag.cooldown.seconds', '86400', 'Cooldown in seconds for bonus bag earnings claims.'),
+('earnings.bonus_bag.credits', '0', 'Credits granted by bonus bag earnings claims.'),
+('earnings.bonus_bag.pixels', '0', 'Pixels granted by bonus bag earnings claims.'),
+('earnings.bonus_bag.points', '0', 'Seasonal points granted by bonus bag earnings claims.'),
+('earnings.bonus_bag.points.type', '5', 'Seasonal point type granted by bonus bag earnings claims.'),
+('earnings.mystery_boxes.enabled', '1', 'Enable mystery boxes earnings row.'),
+('earnings.mystery_boxes.cooldown.seconds', '86400', 'Cooldown in seconds for mystery boxes earnings claims.'),
+('earnings.mystery_boxes.credits', '0', 'Credits granted by mystery boxes earnings claims.'),
+('earnings.mystery_boxes.pixels', '0', 'Pixels granted by mystery boxes earnings claims.'),
+('earnings.mystery_boxes.points', '0', 'Seasonal points granted by mystery boxes earnings claims.'),
+('earnings.mystery_boxes.points.type', '5', 'Seasonal point type granted by mystery boxes earnings claims.'),
+('earnings.club_job.enabled', '1', 'Enable club and job earnings row.'),
+('earnings.club_job.cooldown.seconds', '86400', 'Cooldown in seconds for club and job earnings claims.'),
+('earnings.club_job.credits', '0', 'Credits granted by club and job earnings claims.'),
+('earnings.club_job.pixels', '0', 'Pixels granted by club and job earnings claims.'),
+('earnings.club_job.points', '0', 'Seasonal points granted by club and job earnings claims.'),
+('earnings.club_job.points.type', '5', 'Seasonal point type granted by club and job earnings claims.');
+
+INSERT IGNORE INTO `emulator_settings` (`key`, `value`, `comment`) VALUES
+('earnings.daily_gift.badge', '', 'Badge code granted by daily gift earnings claims.'),
+('earnings.daily_gift.item_id', '0', 'Items base id granted by daily gift earnings claims.'),
+('earnings.daily_gift.item.quantity', '1', 'Furni quantity granted by daily gift earnings claims.'),
+('earnings.daily_gift.hc.days', '0', 'HC days granted by daily gift earnings claims.'),
+('earnings.games.badge', '', 'Badge code granted by games earnings claims.'),
+('earnings.games.item_id', '0', 'Items base id granted by games earnings claims.'),
+('earnings.games.item.quantity', '1', 'Furni quantity granted by games earnings claims.'),
+('earnings.games.hc.days', '0', 'HC days granted by games earnings claims.'),
+('earnings.achievements.badge', '', 'Badge code granted by achievements earnings claims.'),
+('earnings.achievements.item_id', '0', 'Items base id granted by achievements earnings claims.'),
+('earnings.achievements.item.quantity', '1', 'Furni quantity granted by achievements earnings claims.'),
+('earnings.achievements.hc.days', '0', 'HC days granted by achievements earnings claims.'),
+('earnings.marketplace.badge', '', 'Badge code granted by marketplace earnings claims.'),
+('earnings.marketplace.item_id', '0', 'Items base id granted by marketplace earnings claims.'),
+('earnings.marketplace.item.quantity', '1', 'Furni quantity granted by marketplace earnings claims.'),
+('earnings.marketplace.hc.days', '0', 'HC days granted by marketplace earnings claims.'),
+('earnings.hc_payday.badge', '', 'Badge code granted by HC payday earnings claims.'),
+('earnings.hc_payday.item_id', '0', 'Items base id granted by HC payday earnings claims.'),
+('earnings.hc_payday.item.quantity', '1', 'Furni quantity granted by HC payday earnings claims.'),
+('earnings.hc_payday.hc.days', '0', 'HC days granted by HC payday earnings claims.'),
+('earnings.level_progress.badge', '', 'Badge code granted by level progress earnings claims.'),
+('earnings.level_progress.item_id', '0', 'Items base id granted by level progress earnings claims.'),
+('earnings.level_progress.item.quantity', '1', 'Furni quantity granted by level progress earnings claims.'),
+('earnings.level_progress.hc.days', '0', 'HC days granted by level progress earnings claims.'),
+('earnings.donations.badge', '', 'Badge code granted by donations earnings claims.'),
+('earnings.donations.item_id', '0', 'Items base id granted by donations earnings claims.'),
+('earnings.donations.item.quantity', '1', 'Furni quantity granted by donations earnings claims.'),
+('earnings.donations.hc.days', '0', 'HC days granted by donations earnings claims.'),
+('earnings.bonus_bag.badge', '', 'Badge code granted by bonus bag earnings claims.'),
+('earnings.bonus_bag.item_id', '0', 'Items base id granted by bonus bag earnings claims.'),
+('earnings.bonus_bag.item.quantity', '1', 'Furni quantity granted by bonus bag earnings claims.'),
+('earnings.bonus_bag.hc.days', '0', 'HC days granted by bonus bag earnings claims.'),
+('earnings.mystery_boxes.badge', '', 'Badge code granted by mystery boxes earnings claims.'),
+('earnings.mystery_boxes.item_id', '0', 'Items base id granted by mystery boxes earnings claims.'),
+('earnings.mystery_boxes.item.quantity', '1', 'Furni quantity granted by mystery boxes earnings claims.'),
+('earnings.mystery_boxes.hc.days', '0', 'HC days granted by mystery boxes earnings claims.'),
+('earnings.club_job.badge', '', 'Badge code granted by club and job earnings claims.'),
+('earnings.club_job.item_id', '0', 'Items base id granted by club and job earnings claims.'),
+('earnings.club_job.item.quantity', '1', 'Furni quantity granted by club and job earnings claims.'),
+('earnings.club_job.hc.days', '0', 'HC days granted by club and job earnings claims.');
+
+INSERT IGNORE INTO `emulator_settings` (`key`, `value`, `comment`) VALUES
+('earnings.daily_gift.native.enabled', '0', 'Use native hotel subsystem data for daily gift earnings claims when available.'),
+('earnings.games.native.enabled', '0', 'Use native hotel subsystem data for games earnings claims when available.'),
+('earnings.achievements.native.enabled', '1', 'Use achievement score thresholds for achievements earnings claims.'),
+('earnings.marketplace.native.enabled', '1', 'Use marketplace sold item payouts for marketplace earnings claims.'),
+('earnings.hc_payday.native.enabled', '1', 'Use unclaimed HC payday logs for HC payday earnings claims.'),
+('earnings.level_progress.native.enabled', '1', 'Use talent track levels for level progress earnings claims.'),
+('earnings.donations.native.enabled', '0', 'Use native hotel subsystem data for donations earnings claims when available.'),
+('earnings.bonus_bag.native.enabled', '0', 'Use native hotel subsystem data for bonus bag earnings claims when available.'),
+('earnings.mystery_boxes.native.enabled', '0', 'Use native hotel subsystem data for mystery boxes earnings claims when available.'),
+('earnings.club_job.native.enabled', '0', 'Use native hotel subsystem data for club and job earnings claims when available.');
+
+INSERT IGNORE INTO `emulator_settings` (`key`, `value`, `comment`) VALUES
+('earnings.achievements.min_score', '1', 'Minimum achievement score required before achievements earnings can be claimed.'),
+('earnings.achievements.score.step', '100', 'Achievement score bucket size used to prevent repeated claims for the same progress band.'),
+('earnings.level_progress.min_level', '1', 'Minimum citizenship/helper talent level required before level progress earnings can be claimed.');

Database Updates/Own_Database_RunFirst/011_HotelLogin.sql

@@ -49,6 +49,7 @@ INSERT INTO `permission_definitions` (`permission_key`, `rank_7`, `comment`) VAL
 ON DUPLICATE KEY UPDATE `rank_7` = VALUES(`rank_7`);
 
 INSERT INTO `emulator_texts` (`key`, `value`) VALUES
+  ('commands.description.cmd_setroom_template',   ':setroom_template'),
   ('commands.keys.cmd_setroom_template',           'setroom_template;set_room_template'),
   ('commands.succes.cmd_setroom_template.verify',  'Copy the current room "%roomname%" to room_templates? Type :setroom_template %generic.yes% to confirm.'),
   ('commands.succes.cmd_setroom_template',         'Room saved as template id %id% with %items% items (%skipped% skipped - item_id not in items_base).'),

Database Updates/Own_Database_RunFirst/016_custom_prefixes_setup.sql

@@ -301,6 +301,7 @@ INSERT IGNORE INTO `custom_prefixes_catalog`
 
 INSERT IGNORE INTO `emulator_texts` (`key`, `value`) VALUES
     -- GivePrefix command
+    ('commands.description.cmd_give_prefix', ':giveprefix <username> <text> <color> [icon] [effect]'),
     ('commands.keys.cmd_give_prefix', 'giveprefix'),
     ('commands.error.cmd_give_prefix.usage', 'Usage: :giveprefix <username> <text> <color> [icon] [effect]'),
     ('commands.error.cmd_give_prefix.invalid_color', 'Invalid color format. Use hex format (#FF0000).'),
@@ -308,12 +309,14 @@ INSERT IGNORE INTO `emulator_texts` (`key`, `value`) VALUES
     ('commands.error.cmd_give_prefix.user_not_found', 'User not found or not online.'),
     ('commands.succes.cmd_give_prefix', 'Prefix {%prefix%} successfully given to %user%!'),
     -- ListPrefixes command
+    ('commands.description.cmd_list_prefixes', ':listprefixes <username>'),
     ('commands.keys.cmd_list_prefixes', 'listprefixes'),
     ('commands.error.cmd_list_prefixes.usage', 'Usage: :listprefixes <username>'),
     ('commands.error.cmd_list_prefixes.user_not_found', 'User not found or not online.'),
     ('commands.succes.cmd_list_prefixes.header', 'Prefixes of %user%:'),
     ('commands.succes.cmd_list_prefixes.empty', '%user% has no prefixes.'),
     -- RemovePrefix command
+    ('commands.description.cmd_remove_prefix', ':removeprefix <username> <id|all>'),
     ('commands.keys.cmd_remove_prefix', 'removeprefix'),
     ('commands.error.cmd_remove_prefix.usage', 'Usage: :removeprefix <username> <id|all>'),
     ('commands.error.cmd_remove_prefix.user_not_found', 'User not found or not online.'),

Database Updates/Own_Database_RunFirst/021_furnidata_config.sql

@@ -1,27 +0,0 @@
--- 021_furnidata_config.sql
--- Seeds the furnidata feature config keys read at runtime by
--- FurnitureTextProvider / FurnidataReader / FurnidataWatcher and
--- FurniEditorImportTextEvent. Without these rows a fresh install logs
--- "Config key not found" for each (ConfigurationManager logs ERROR even
--- when a default is supplied) and the values are not editable from the DB.
---
--- Notes:
---  * *.enabled keys are read via Boolean.parseBoolean → use true/false (NOT 1/0).
---  * items.furnidata.path is intentionally empty: when blank the source is
---    derived from furni.editor.asset.base.path (seeded by 004_furni_editor.sql)
---    → <base>/furnidata (split-tier) or <base>/FurnitureData.json (single file).
---  * Editor write-path keys (items.furnidata.edit.*) are seeded by 020.
-
-INSERT IGNORE INTO `emulator_settings` (`key`,`value`) VALUES
--- Server-authoritative furni names (source of truth = furnidata JSON)
-('items.furnidata.names.enabled','true'),
-('items.furnidata.path',''),
-('items.furnidata.max.bytes','67108864'),
--- Live-reload watcher
-('items.furnidata.watch.enabled','true'),
-('items.furnidata.watch.debounce.ms','750'),
-('items.furnidata.watch.min.interval.ms','5000'),
-('items.furnidata.delta.cap','500'),
--- Furni editor: import official names/descriptions from Habbo
-('furni.editor.import.url','https://www.habbo.it/gamedata/furnidata_json/1'),
-('furni.editor.import.cache.ms','600000');

Database Updates/Set Rooms wallitems/fix_room_paint_null.sql

@@ -0,0 +1,15 @@
+-- Fix NULL room paint columns
+--
+-- Some legacy/imported rooms have NULL in paper_wall / paper_floor / paper_landscape.
+-- The server compares these with .equals("0.0") on room entry, which throws a
+-- NullPointerException (RoomManager.openRoom) and prevents the room from loading.
+-- This normalizes existing NULL values and re-enforces the NOT NULL DEFAULT '0.0'
+-- constraint so it cannot happen again.
+
+UPDATE `rooms` SET `paper_wall`      = '0.0' WHERE `paper_wall`      IS NULL;
+UPDATE `rooms` SET `paper_floor`     = '0.0' WHERE `paper_floor`     IS NULL;
+UPDATE `rooms` SET `paper_landscape` = '0.0' WHERE `paper_landscape` IS NULL;
+
+ALTER TABLE `rooms` MODIFY COLUMN `paper_wall`      VARCHAR(50) NOT NULL DEFAULT '0.0';
+ALTER TABLE `rooms` MODIFY COLUMN `paper_floor`     VARCHAR(50) NOT NULL DEFAULT '0.0';
+ALTER TABLE `rooms` MODIFY COLUMN `paper_landscape` VARCHAR(50) NOT NULL DEFAULT '0.0';

Default Database/FullDatabase.sql

@@ -15355,7 +15355,9 @@ INSERT INTO `emulator_texts` (`key`, `value`) VALUES
 	('commands.cmd_promote_offer.list', 'All available offers (%amount%):<br>%list%'),
 	('commands.cmd_promote_offer.list.entry', '%id%: %title% %description%'),
 	('commands.description.acc_debug', ':test [header] i:1 s:a b:1'),
+	('commands.description.acc_modtool_room_info', 'Allows viewing room information in the moderation tool.'),
 	('commands.description.cmd_about', ':about'),
+	('commands.description.cmd_add_youtube_playlist', ':add_youtube <base_item_id> <youtube_playlist_id>'),
 	('commands.description.cmd_alert', ':alert <username> <message>'),
 	('commands.description.cmd_allow_trading', 'Enables / Disables the tradelock for a user.'),
 	('commands.description.cmd_badge', ':badge <username> <badge>'),
@@ -15379,6 +15381,8 @@ INSERT INTO `emulator_texts` (`key`, `value`) VALUES
 	('commands.description.cmd_danceall', ':danceall <dance id>'),
 	('commands.description.cmd_diagonal', ':diagonal'),
 	('commands.description.cmd_disable_effects', ':disableffects'),
+	('commands.description.cmd_disablemassmentions', ':disablemassmentions'),
+	('commands.description.cmd_disablementions', ':disablementions'),
 	('commands.description.cmd_disconnect', ':disconnect <username>'),
 	('commands.description.cmd_duckets', ':duckets <username> <amount>'),
 	('commands.description.cmd_ejectall', ':ejectall'),
@@ -15395,11 +15399,13 @@ INSERT INTO `emulator_texts` (`key`, `value`) VALUES
 	('commands.description.cmd_freeze_bots', ':freezebots'),
 	('commands.description.cmd_furnidata', ':furnidata'),
 	('commands.description.cmd_gift', ':gift <username> <itemid>'),
+	('commands.description.cmd_give_prefix', ':giveprefix <username> <text> <color> [icon] [effect]'),
 	('commands.description.cmd_give_rank', ':giverank <username> <rank>'),
 	('commands.description.cmd_ha', ':ha <message>'),
 	('commands.description.cmd_hal', ':hal <url> <message>'),
 	('commands.description.cmd_hand_item', ':handitem <itemid>'),
 	('commands.description.cmd_happyhour', ':happyhour'),
+	('commands.description.cmd_hidewired', ':hidewired'),
 	('commands.description.cmd_hoverboard', ':hoverboard'),
 	('commands.description.cmd_hug', ':hug <username>'),
 	('commands.description.cmd_invisible', ':invisible'),
@@ -15408,6 +15414,7 @@ INSERT INTO `emulator_texts` (`key`, `value`) VALUES
 	('commands.description.cmd_kill', ':kill <username>'),
 	('commands.description.cmd_kiss', ':kiss <username>'),
 	('commands.description.cmd_lay', ':lay'),
+	('commands.description.cmd_list_prefixes', ':listprefixes <username>'),
 	('commands.description.cmd_machine_ban', ':machineban <username> [reason]'),
 	('commands.description.cmd_massbadge', ':massbadge <badge>'),
 	('commands.description.cmd_masscredits', ':masscredits <amount>'),
@@ -15429,6 +15436,7 @@ INSERT INTO `emulator_texts` (`key`, `value`) VALUES
 	('commands.description.cmd_push', ':push <username>'),
 	('commands.description.cmd_redeem', ':redeem'),
 	('commands.description.cmd_reload_room', ':reload_room'),
+	('commands.description.cmd_remove_prefix', ':removeprefix <username> <id|all>'),
 	('commands.description.cmd_roomalert', ':roomalert <message>'),
 	('commands.description.cmd_roombadge', ':roombadge <badge>'),
 	('commands.description.cmd_roomcredits', ':roomcredits <amount>'),
@@ -15444,6 +15452,7 @@ INSERT INTO `emulator_texts` (`key`, `value`) VALUES
 	('commands.description.cmd_set', ':set info'),
 	('commands.description.cmd_setmax', ':setmax <amount>'),
 	('commands.description.cmd_setpublic', ':setpublic'),
+	('commands.description.cmd_setroom_template', ':setroom_template'),
 	('commands.description.cmd_setrotation', ':rot;rotation'),
 	('commands.description.cmd_setspeed', ':setspeed <speed>'),
 	('commands.description.cmd_setstate', ':ss'),
@@ -15486,6 +15495,7 @@ INSERT INTO `emulator_texts` (`key`, `value`) VALUES
 	('commands.description.cmd_update_polls', ':update_polls'),
 	('commands.description.cmd_update_texts', ':update_texts'),
 	('commands.description.cmd_update_wordfilter', ':update_word_filter'),
+	('commands.description.cmd_update_youtube_playlists', ':update_youtube'),
 	('commands.description.cmd_userinfo', ':userinfo <username>'),
 	('commands.description.cmd_welcome', ':welcome <username>'),
 	('commands.description.cmd_word_quiz', ':wordquiz <question>'),

Emulator/pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>com.eu.habbo</groupId>
     <artifactId>Habbo</artifactId>
-    <version>4.2.39</version>
+    <version>4.2.44</version>
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -66,7 +66,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.2.5</version>
+                <version>3.5.2</version>
             </plugin>
         </plugins>
     </build>
@@ -83,21 +83,21 @@
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-all</artifactId>
-            <version>4.1.115.Final</version>
+            <version>4.2.15.Final</version>
         </dependency>
 
         <!-- GSON -->
         <dependency>
             <groupId>com.google.code.gson</groupId>
             <artifactId>gson</artifactId>
-            <version>2.11.0</version>
+            <version>2.14.0</version>
         </dependency>
 
         <!-- MariaDB Connector/J (native driver for MariaDB) -->
         <dependency>
             <groupId>org.mariadb.jdbc</groupId>
             <artifactId>mariadb-java-client</artifactId>
-            <version>3.5.1</version>
+            <version>3.5.8</version>
             <scope>runtime</scope>
         </dependency>
 
@@ -113,7 +113,38 @@
         <dependency>
             <groupId>com.zaxxer</groupId>
             <artifactId>HikariCP</artifactId>
-            <version>6.2.1</version>
+            <version>7.0.2</version>
+            <scope>compile</scope>
+        </dependency>
+
+        <!-- Caffeine cache - high-performance local caching for hot emulator lookups -->
+        <dependency>
+            <groupId>com.github.ben-manes.caffeine</groupId>
+            <artifactId>caffeine</artifactId>
+            <version>3.2.4</version>
+            <scope>compile</scope>
+        </dependency>
+
+        <!-- Resilience4j - rate limits and circuit breakers for RCON/HTTP/external integrations -->
+        <dependency>
+            <groupId>io.github.resilience4j</groupId>
+            <artifactId>resilience4j-ratelimiter</artifactId>
+            <version>2.4.0</version>
+            <scope>compile</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>io.github.resilience4j</groupId>
+            <artifactId>resilience4j-circuitbreaker</artifactId>
+            <version>2.4.0</version>
+            <scope>compile</scope>
+        </dependency>
+
+        <!-- Hibernate Validator - Jakarta Bean Validation for packet/RCON/admin DTO guards -->
+        <dependency>
+            <groupId>org.hibernate.validator</groupId>
+            <artifactId>hibernate-validator</artifactId>
+            <version>9.1.0.Final</version>
             <scope>compile</scope>
         </dependency>
 
@@ -121,7 +152,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.17.0</version>
+            <version>3.20.0</version>
             <scope>compile</scope>
         </dependency>
 
@@ -137,7 +168,7 @@
         <dependency>
             <groupId>org.jsoup</groupId>
             <artifactId>jsoup</artifactId>
-            <version>1.18.3</version>
+            <version>1.22.2</version>
             <scope>compile</scope>
         </dependency>
 
@@ -145,14 +176,14 @@
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-api</artifactId>
-            <version>2.0.16</version>
+            <version>2.0.18</version>
         </dependency>
 
         <!-- Logback -->
         <dependency>
             <groupId>ch.qos.logback</groupId>
             <artifactId>logback-classic</artifactId>
-            <version>1.5.15</version>
+            <version>1.5.34</version>
             <scope>compile</scope>
         </dependency>
 
@@ -160,14 +191,7 @@
         <dependency>
             <groupId>org.fusesource.jansi</groupId>
             <artifactId>jansi</artifactId>
-            <version>2.4.1</version>
+            <version>2.4.3</version>
-        </dependency>
-
-        <!-- Joda Time -->
-        <dependency>
-            <groupId>joda-time</groupId>
-            <artifactId>joda-time</artifactId>
-            <version>2.13.0</version>
         </dependency>
 
         <!-- jBCrypt � used by the built-in /api/auth/* HTTP login handler
@@ -183,14 +207,14 @@
         <dependency>
             <groupId>org.eclipse.angus</groupId>
             <artifactId>jakarta.mail</artifactId>
-            <version>2.0.3</version>
+            <version>2.0.5</version>
         </dependency>
 
         <!-- JUnit Jupiter -->
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter</artifactId>
-            <version>5.10.2</version>
+            <version>6.1.0</version>
             <scope>test</scope>
         </dependency>
     </dependencies>

Emulator/src/main/java/com/eu/habbo/Emulator.java

@@ -18,6 +18,8 @@ import com.eu.habbo.plugin.events.emulator.EmulatorStartShutdownEvent;
 import com.eu.habbo.plugin.events.emulator.EmulatorStoppedEvent;
 import com.eu.habbo.threading.ThreadPooling;
 import com.eu.habbo.util.imager.badges.BadgeImager;
+import com.eu.habbo.util.logback.ConsoleStyle;
+import org.fusesource.jansi.AnsiConsole;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -38,6 +40,12 @@ public final class Emulator {
     private static final Logger LOGGER = LoggerFactory.getLogger(Emulator.class);
     private static final String OS_NAME = (System.getProperty("os.name") != null ? System.getProperty("os.name") : "Unknown");
     private static final String CLASS_PATH = (System.getProperty("java.class.path") != null ? System.getProperty("java.class.path") : "Unknown");
+    private static final String ANSI_RESET = "\u001B[0m";
+    private static final String ANSI_BOLD = "\u001B[1m";
+    private static final String ANSI_CYAN = "\u001B[36m";
+    private static final String ANSI_GREEN = "\u001B[32m";
+    private static final String ANSI_YELLOW = "\u001B[33m";
+    private static final String ANSI_DIM = "\u001B[2m";
 
     // Fallback version, only used when running outside a packaged jar (e.g. from
     // the IDE). In production the version comes from the jar manifest below.
@@ -65,7 +73,6 @@ public final class Emulator {
                     "██║ ╚═╝ ██║╚██████╔╝██║  ██║██║ ╚████║██║██║ ╚████║╚██████╔╝███████║   ██║   ██║  ██║██║  ██║\n" +
                     "╚═╝     ╚═╝ ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝╚═╝  ╚═══╝ ╚═════╝ ╚══════╝   ╚═╝   ╚═╝  ╚═╝╚═╝  ╚═╝\n" +
                     "Still Rocking in 2026.\n";
-
     public static String build = "";
     public static long buildTimestamp = -1L;
 
@@ -104,14 +111,12 @@ public final class Emulator {
 
     public static void main(String[] args) throws Exception {
         try {
-            if (OS_NAME.startsWith("Windows") && !CLASS_PATH.contains("idea_rt.jar")) {
+            boolean styledConsole = shouldStyleConsole(
-                ch.qos.logback.classic.Logger root = (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(Logger.ROOT_LOGGER_NAME);
+                    System.getenv(),
-                ConsoleAppender<ILoggingEvent> appender = (ConsoleAppender<ILoggingEvent>) root.getAppender("Console");
+                    System.console() != null,
-
+                    OS_NAME,
-                appender.stop();
+                    System.getProperty("habbo.console.style", "auto"));
-                appender.setWithJansi(true);
+            configureAnsiConsole(styledConsole);
-                appender.start();
-            }
 
             Locale.setDefault(Locale.of("en"));
             setBuild();
@@ -119,7 +124,7 @@ public final class Emulator {
             ConsoleCommand.load();
             Emulator.logging = new Logging();
 
-            System.out.println(logo);
+            System.out.println(startupHero(styledConsole));
 
             long startTime = System.nanoTime();
 
@@ -153,14 +158,21 @@ public final class Emulator {
             Emulator.config.register("camera.price.points.type", "5");
             Emulator.config.register("camera.render.delay", "5");
             Emulator.config.register("hotel.timezone", java.time.ZoneId.systemDefault().getId());
+            Emulator.config.register("gui.enabled", "0");
+            Emulator.config.register("gui.autostart.enabled", "0");
+            Emulator.config.register("rcon.rate_limit.enabled", "1");
+            Emulator.config.register("rcon.rate_limit.limit_for_period", "60");
+            Emulator.config.register("rcon.rate_limit.refresh_period_ms", "1000");
+            Emulator.config.register("rcon.rate_limit.timeout_ms", "0");
+            Emulator.config.register("rcon.execute_command.denied_permissions", "cmd_shutdown;cmd_give_rank");
+            Emulator.config.register("rcon.execute_command.allowed_permissions", "");
+            Emulator.config.register("rcon.max_payload_bytes", "65536");
+            Emulator.config.register("nitro.secure.api.max_payload_bytes", "65536");
+            Emulator.config.register("nitro.secure.config.max_file_bytes", "2097152");
+            Emulator.config.register("nitro.secure.gamedata.max_file_bytes", "16777216");
+            registerEarningsSettings();
             String hotelTimezoneId = Emulator.getConfig().getValue("hotel.timezone", java.time.ZoneId.systemDefault().getId());
-            System.out.println();
+            System.out.println(startupCard(hotelTimezoneId));
-            LOGGER.info("https://github.com/duckietm/Arcturus-Morningstar-Extended, ");
-            System.out.println();
-            LOGGER.info("This project is for educational purposes only. This Emulator is an open-source fork of Arcturus created by TheGeneral.");
-            LOGGER.info("Version: {}", version);
-            LOGGER.info("Build: {}", build);
-            LOGGER.info("Build Timestamp: {} [{}]", formatBuildTimestamp(buildTimestamp, hotelTimezoneId), hotelTimezoneId);
             Emulator.texts.register("camera.permission", "You don't have permission to use the camera!");
             Emulator.texts.register("camera.wait", "Please wait %seconds% seconds before making another picture.");
             Emulator.texts.register("camera.error.creation", "Failed to create your picture. *sadpanda*");
@@ -198,7 +210,7 @@ public final class Emulator {
             Emulator.isReady = true;
             Emulator.timeStarted = getIntUnixTimestamp();
 
-            if (Emulator.getConfig().getBoolean("gui.enabled", true)) {
+            if (shouldLaunchGui()) {
                 EmulatorDashboard.launch();
             }
 
@@ -310,6 +322,97 @@ public final class Emulator {
         return -1L;
     }
 
+    static String startupCard(String hotelTimezoneId) {
+        return "\n" +
+                "+----------------------------------------------------------------+\n" +
+                "| Arcturus Morningstar Extended                                  |\n" +
+                "| Source : github.com/duckietm/Arcturus-Morningstar-Extended     |\n" +
+                "| Scope  : Educational open-source fork by TheGeneral            |\n" +
+                "| Version: " + version + "\n" +
+                "| Build  : " + build + "\n" +
+                "| Time   : " + formatBuildTimestamp(buildTimestamp, hotelTimezoneId) + " [" + hotelTimezoneId + "]\n" +
+                "+----------------------------------------------------------------+\n";
+    }
+
+    static String startupHero() {
+        return startupHero(false);
+    }
+
+    static String startupHero(boolean styled) {
+        if (styled) {
+            return "\n" +
+                    ANSI_CYAN +
+                    "   __  __  ___  ____  _   _ ___ _   _  ____ ____ _____  _    ____  \n" +
+                    "  |  \\/  |/ _ \\|  _ \\| \\ | |_ _| \\ | |/ ___/ ___|_   _|/ \\  |  _ \\ \n" +
+                    "  | |\\/| | | | | |_) |  \\| || ||  \\| | |  _\\___ \\ | | / _ \\ | |_) |\n" +
+                    "  | |  | | |_| |  _ <| |\\  || || |\\  | |_| |___) || |/ ___ \\|  _ < \n" +
+                    "  |_|  |_|\\___/|_| \\_\\_| \\_|___|_| \\_|\\____|____/ |_/_/   \\_\\_| \\_\\\n" +
+                    ANSI_RESET +
+                    "\n" +
+                    ANSI_DIM + "+------------------------------------------------------------------------------+" + ANSI_RESET + "\n" +
+                    "| " + ANSI_BOLD + ANSI_GREEN + "[OK] MORNINGSTAR EXTENDED" + ANSI_RESET + fit("", 50) + " |\n" +
+                    "| " + ANSI_DIM + "Arcturus game server runtime" + ANSI_RESET + fit("", 48) + " |\n" +
+                    ANSI_DIM + "+------------------------------------------------------------------------------+" + ANSI_RESET + "\n" +
+                    "| " + ANSI_YELLOW + "[VER]" + ANSI_RESET + " Version : " + fit(version, 57) + " |\n" +
+                    "| " + ANSI_YELLOW + "[BLD]" + ANSI_RESET + " Build   : " + fit(build.isBlank() ? "UNKNOWN" : build, 57) + " |\n" +
+                    "| " + ANSI_YELLOW + "[JVM]" + ANSI_RESET + " Runtime : " + fit("Java " + System.getProperty("java.version", "unknown") + " / styled console output", 57) + " |\n" +
+                    ANSI_DIM + "+------------------------------------------------------------------------------+" + ANSI_RESET + "\n";
+        }
+
+        return "\n" +
+                "   __  __  ___  ____  _   _ ___ _   _  ____ ____ _____  _    ____  \n" +
+                "  |  \\/  |/ _ \\|  _ \\| \\ | |_ _| \\ | |/ ___/ ___|_   _|/ \\  |  _ \\ \n" +
+                "  | |\\/| | | | | |_) |  \\| || ||  \\| | |  _\\___ \\ | | / _ \\ | |_) |\n" +
+                "  | |  | | |_| |  _ <| |\\  || || |\\  | |_| |___) || |/ ___ \\|  _ < \n" +
+                "  |_|  |_|\\___/|_| \\_\\_| \\_|___|_| \\_|\\____|____/ |_/_/   \\_\\_| \\_\\\n" +
+                "\n" +
+                "+------------------------------------------------------------------------------+\n" +
+                "| MORNINGSTAR EXTENDED                                                         |\n" +
+                "| Arcturus game server runtime                                                  |\n" +
+                "+------------------------------------------------------------------------------+\n" +
+                "| Version : " + fit(version, 63) + " |\n" +
+                "| Build   : " + fit(build.isBlank() ? "UNKNOWN" : build, 63) + " |\n" +
+                "| Runtime : " + fit("Java " + System.getProperty("java.version", "unknown") + " / universal console output", 63) + " |\n" +
+                "+------------------------------------------------------------------------------+\n";
+    }
+
+    static boolean shouldStyleConsole(Map<String, String> environment, boolean interactiveConsole, String osName, String styleProperty) {
+        return ConsoleStyle.isEnabled(environment, interactiveConsole, osName, styleProperty);
+    }
+
+    static void configureAnsiConsole(boolean styledConsole) {
+        if (!styledConsole || !OS_NAME.startsWith("Windows") || CLASS_PATH.contains("idea_rt.jar")) {
+            return;
+        }
+
+        try {
+            AnsiConsole.systemInstall();
+
+            ch.qos.logback.classic.Logger root = (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(Logger.ROOT_LOGGER_NAME);
+            ConsoleAppender<ILoggingEvent> appender = (ConsoleAppender<ILoggingEvent>) root.getAppender("Console");
+            if (appender != null) {
+                appender.stop();
+                appender.setWithJansi(true);
+                appender.start();
+            }
+        } catch (Throwable e) {
+            LOGGER.debug("Unable to install Jansi console bridge; continuing with raw console output.", e);
+        }
+    }
+
+    static boolean shouldLaunchGui() {
+        return Emulator.getConfig() != null && Emulator.getConfig().getBoolean("gui.autostart.enabled", false);
+    }
+
+    private static String fit(String value, int width) {
+        String safe = value == null ? "" : value;
+        if (safe.length() > width) {
+            return safe.substring(0, Math.max(0, width - 3)) + "...";
+        }
+
+        return String.format("%-" + width + "s", safe);
+    }
+
     private static String formatBuildTimestamp(long buildTimestamp, String timezoneId) {
         if (buildTimestamp <= 0) {
             return "UNKNOWN";
@@ -390,6 +493,42 @@ public final class Emulator {
         return gameServer;
     }
 
+    private static void registerEarningsSettings() {
+        Emulator.config.register("earnings.enabled", "0");
+
+        String[] categories = {
+                "daily_gift",
+                "games",
+                "achievements",
+                "marketplace",
+                "hc_payday",
+                "level_progress",
+                "donations",
+                "bonus_bag",
+                "mystery_boxes",
+                "club_job"
+        };
+
+        for (String category : categories) {
+            String prefix = "earnings." + category + ".";
+            Emulator.config.register(prefix + "enabled", "1");
+            Emulator.config.register(prefix + "cooldown.seconds", "86400");
+            Emulator.config.register(prefix + "credits", "0");
+            Emulator.config.register(prefix + "pixels", "0");
+            Emulator.config.register(prefix + "points", "0");
+            Emulator.config.register(prefix + "points.type", "5");
+            Emulator.config.register(prefix + "badge", "");
+            Emulator.config.register(prefix + "item_id", "0");
+            Emulator.config.register(prefix + "item.quantity", "1");
+            Emulator.config.register(prefix + "hc.days", "0");
+            Emulator.config.register(prefix + "native.enabled", (category.equals("marketplace") || category.equals("hc_payday") || category.equals("achievements") || category.equals("level_progress")) ? "1" : "0");
+        }
+
+        Emulator.config.register("earnings.achievements.min_score", "1");
+        Emulator.config.register("earnings.achievements.score.step", "100");
+        Emulator.config.register("earnings.level_progress.min_level", "1");
+    }
+
     public static RCONServer getRconServer() {
         return rconServer;
     }

Emulator/src/main/java/com/eu/habbo/core/TextsManager.java

@@ -52,6 +52,10 @@ public class TextsManager {
         return this.texts.getProperty(key, defaultValue);
     }
 
+    public String getValueQuietly(String key, String defaultValue) {
+        return this.texts.getProperty(key, defaultValue);
+    }
+
     public boolean getBoolean(String key) {
         return this.getBoolean(key, false);
     }

Emulator/src/main/java/com/eu/habbo/database/DatabasePool.java

@@ -79,6 +79,14 @@ class DatabasePool {
             databaseConfiguration.addDataSourceProperty("useLocalSessionState",     "true");
             databaseConfiguration.addDataSourceProperty("cacheResultSetMetadata",   "true");
             databaseConfiguration.addDataSourceProperty("elideSetAutoCommits",      "true");
+
+            // Fail fast instead of pinning a pooled connection (and its worker
+            // thread) indefinitely on a stalled/slow MariaDB. HikariCP's
+            // connectionTimeout only bounds the pool *borrow*; these bound the
+            // actual socket/connect round-trip. Overridable via db.params.
+            databaseConfiguration.addDataSourceProperty("socketTimeout",  "30000");
+            databaseConfiguration.addDataSourceProperty("connectTimeout", "10000");
+            databaseConfiguration.addDataSourceProperty("tcpKeepAlive",   "true");
             databaseConfiguration.addDataSourceProperty("maintainTimeStats",        "false");
 
             databaseConfiguration.setPoolName("HabboHikariPool");

Emulator/src/main/java/com/eu/habbo/habbohotel/achievements/AchievementManager.java

@@ -100,9 +100,9 @@ public class AchievementManager {
         if (oldLevel != null && (oldLevel.level == achievement.levels.size() && currentProgress >= oldLevel.progress)) //Maximum achievement gotten.
             return;
 
-        habbo.getHabboStats().setProgress(achievement, currentProgress + amount);
+        int newProgress = habbo.getHabboStats().incrementProgress(achievement, amount);
 
-        AchievementLevel newLevel = achievement.getLevelForProgress(currentProgress + amount);
+        AchievementLevel newLevel = achievement.getLevelForProgress(newProgress);
 
         if (AchievementManager.TALENTTRACK_ENABLED) {
             for (TalentTrackType type : TalentTrackType.values()) {

Emulator/src/main/java/com/eu/habbo/habbohotel/bots/BotManager.java

@@ -179,23 +179,31 @@ public class BotManager {
     }
 
     public void pickUpBot(Bot bot, Habbo habbo) {
-        HabboInfo receiverInfo = habbo == null ? Emulator.getGameEnvironment().getHabboManager().getHabboInfo(bot.getOwnerId()) : habbo.getHabboInfo();
-
         if (bot != null) {
+            HabboInfo receiverInfo = resolvePickupReceiver(bot, habbo);
+            Room botRoom = bot.getRoom();
+            if (receiverInfo == null || botRoom == null) {
+                return;
+            }
+
             BotPickUpEvent pickedUpEvent = new BotPickUpEvent(bot, habbo);
             Emulator.getPluginManager().fireEvent(pickedUpEvent);
 
             if (pickedUpEvent.isCancelled())
                 return;
 
-            if (habbo == null || (bot.getOwnerId() == habbo.getHabboInfo().getId() || habbo.hasPermission(Permission.ACC_ANYROOMOWNER))) {
+            Room currentRoom = habbo != null ? habbo.getHabboInfo().getCurrentRoom() : null;
+            if (habbo == null
+                    || bot.getOwnerId() == habbo.getHabboInfo().getId()
+                    || habbo.hasPermission(Permission.ACC_ANYROOMOWNER)
+                    || (currentRoom != null && (currentRoom.getOwnerId() == habbo.getHabboInfo().getId() || habbo.hasPermission(Permission.ACC_PLACEFURNI)))) {
                 if (habbo != null && !habbo.hasPermission(Permission.ACC_UNLIMITED_BOTS) && habbo.getInventory().getBotsComponent().getBots().size() >= BotManager.MAXIMUM_BOT_INVENTORY_SIZE) {
                     habbo.alert(Emulator.getTexts().getValue("error.bots.max.inventory").replace("%amount%", BotManager.MAXIMUM_BOT_INVENTORY_SIZE + ""));
                     return;
                 }
 
-                bot.onPickUp(habbo, receiverInfo.getCurrentRoom());
+                bot.onPickUp(habbo, botRoom);
-                receiverInfo.getCurrentRoom().removeBot(bot);
+                botRoom.removeBot(bot);
                 bot.stopFollowingHabbo();
                 bot.setOwnerId(receiverInfo.getId());
                 bot.setOwnerName(receiverInfo.getUsername());
@@ -211,6 +219,14 @@ public class BotManager {
         }
     }
 
+    private HabboInfo resolvePickupReceiver(Bot bot, Habbo picker) {
+        if (picker != null && bot.getOwnerId() == picker.getHabboInfo().getId()) {
+            return picker.getHabboInfo();
+        }
+
+        return Emulator.getGameEnvironment().getHabboManager().getHabboInfo(bot.getOwnerId());
+    }
+
     public Bot loadBot(ResultSet set) {
         try {
             String type = set.getString("type");

Emulator/src/main/java/com/eu/habbo/habbohotel/catalog/CatalogItem.java

@@ -174,6 +174,14 @@ public class CatalogItem implements ISerialize, Runnable, Comparable<CatalogItem
         return this.offerId;
     }
 
+    public int getSearchOfferId() {
+        if (this.offerId > 0) {
+            return this.offerId;
+        }
+
+        return haveOffer(this) ? this.id : -1;
+    }
+
     public boolean isLimited() {
         return this.limitedStack > 0;
     }

Emulator/src/main/java/com/eu/habbo/habbohotel/catalog/CatalogManager.java

@@ -494,10 +494,11 @@ public class CatalogManager {
                     item = new CatalogItem(set);
                     page.addItem(item);
 
-                    if (item.getOfferId() != -1) {
+                    int searchOfferId = item.getSearchOfferId();
-                        page.addOfferId(item.getOfferId());
+                    if (searchOfferId != -1) {
+                        page.addOfferId(searchOfferId);
 
-                        this.offerDefs.put(item.getOfferId(), item.getId());
+                        this.offerDefs.put(searchOfferId, item.getId());
                     }
                 } else
                     item.update(set);
@@ -711,18 +712,22 @@ public class CatalogManager {
             return;
         }
 
-        if (voucher.isExhausted()) {
+        Voucher.ClaimResult claimResult = voucher.claimForUser(habbo.getHabboInfo().getId());
-            client.sendResponse(new RedeemVoucherErrorComposer(Emulator.getGameEnvironment().getCatalogManager().deleteVoucher(voucher) ? RedeemVoucherErrorComposer.INVALID_CODE : RedeemVoucherErrorComposer.TECHNICAL_ERROR));
+        switch (claimResult) {
-            return;
+            case CLAIMED:
+                break;
+            case EXHAUSTED:
+                client.sendResponse(new RedeemVoucherErrorComposer(Emulator.getGameEnvironment().getCatalogManager().deleteVoucher(voucher) ? RedeemVoucherErrorComposer.INVALID_CODE : RedeemVoucherErrorComposer.TECHNICAL_ERROR));
+                return;
+            case USER_LIMIT:
+                client.sendResponse(new ModToolIssueHandledComposer("You have exceeded the limit for redeeming this voucher."));
+                return;
+            case FAILED:
+            default:
+                client.sendResponse(new RedeemVoucherErrorComposer(RedeemVoucherErrorComposer.TECHNICAL_ERROR));
+                return;
         }
 
-        if (voucher.hasUserExhausted(habbo.getHabboInfo().getId())) {
-            client.sendResponse(new ModToolIssueHandledComposer("You have exceeded the limit for redeeming this voucher."));
-            return;
-        }
-
-        voucher.addHistoryEntry(habbo.getHabboInfo().getId());
-
         if (voucher.points > 0) {
             client.getHabbo().givePoints(voucher.pointsType, voucher.points);
         }
@@ -1247,6 +1252,11 @@ public class CatalogManager {
                                     Guild guild = Emulator.getGameEnvironment().getGuildManager().getGuild(guildId);
 
                                     if (guild != null && Emulator.getGameEnvironment().getGuildManager().getGuildMember(guild, habbo) != null) {
+                                        if (baseItem.getName().equals("guild_forum") && guild.getOwnerId() != habbo.getHabboInfo().getId()) {
+                                            habbo.getClient().sendResponse(new AlertPurchaseFailedComposer(AlertPurchaseFailedComposer.SERVER_ERROR));
+                                            return;
+                                        }
+
                                         InteractionGuildFurni habboItem = (InteractionGuildFurni) Emulator.getGameEnvironment().getItemManager().createItem(habbo.getClient().getHabbo().getHabboInfo().getId(), baseItem, limitedStack, limitedNumber, extradata);
                                         habboItem.setExtradata("");
                                         habboItem.needsUpdate(true);

Emulator/src/main/java/com/eu/habbo/habbohotel/catalog/Voucher.java

@@ -14,6 +14,13 @@ import java.util.List;
 public class Voucher {
     private static final Logger LOGGER = LoggerFactory.getLogger(Voucher.class);
 
+    public enum ClaimResult {
+        CLAIMED,
+        EXHAUSTED,
+        USER_LIMIT,
+        FAILED
+    }
+
     public final int id;
     public final String code;
     public final int credits;
@@ -58,18 +65,34 @@ public class Voucher {
         return this.amount > 0 && this.history.size() >= this.amount;
     }
 
-    public void addHistoryEntry(int userId) {
+    public synchronized ClaimResult claimForUser(int userId) {
-        int timestamp = Emulator.getIntUnixTimestamp();
+        if (this.isExhausted()) {
-        this.history.add(new VoucherHistoryEntry(this.id, userId, timestamp));
+            return ClaimResult.EXHAUSTED;
+        }
 
+        if (this.hasUserExhausted(userId)) {
+            return ClaimResult.USER_LIMIT;
+        }
+
+        int timestamp = Emulator.getIntUnixTimestamp();
+        if (!this.insertHistoryEntry(userId, timestamp)) {
+            return ClaimResult.FAILED;
+        }
+
+        this.history.add(new VoucherHistoryEntry(this.id, userId, timestamp));
+        return ClaimResult.CLAIMED;
+    }
+
+    private boolean insertHistoryEntry(int userId, int timestamp) {
         try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement("INSERT INTO voucher_history (`voucher_id`, `user_id`, `timestamp`) VALUES (?, ?, ?)")) {
             statement.setInt(1, this.id);
             statement.setInt(2, userId);
             statement.setInt(3, timestamp);
 
-            statement.execute();
+            return statement.executeUpdate() > 0;
         } catch (SQLException e) {
             LOGGER.error("Caught SQL exception", e);
+            return false;
         }
     }
 }

Emulator/src/main/java/com/eu/habbo/habbohotel/catalog/marketplace/MarketPlace.java

@@ -28,6 +28,8 @@ import java.util.List;
 
 public class MarketPlace {
     private static final Logger LOGGER = LoggerFactory.getLogger(MarketPlace.class);
+    public static final int MINIMUM_LISTING_PRICE = 1;
+    public static final int MAXIMUM_LISTING_PRICE = 1_000_000_000;
 
     //Configuration. Loaded from database & updated accordingly.
     public static boolean MARKETPLACE_ENABLED = true;
@@ -56,6 +58,10 @@ public class MarketPlace {
     public static void takeBackItem(Habbo habbo, int offerId) {
         MarketPlaceOffer offer = habbo.getInventory().getOffer(offerId);
 
+        if (offer == null) {
+            return;
+        }
+
         if (!Emulator.getPluginManager().fireEvent(new MarketPlaceItemCancelledEvent(offer)).isCancelled()) {
             takeBackItem(habbo, offer);
         }
@@ -119,7 +125,7 @@ public class MarketPlace {
 
     public static List<MarketPlaceOffer> getOffers(int minPrice, int maxPrice, String search, int sort) {
         List<MarketPlaceOffer> offers = new ArrayList<>(10);
-        String query = "SELECT B.* FROM marketplace_items a INNER JOIN (SELECT b.item_id AS base_item_id, b.limited_data AS ltd_data, marketplace_items.*, AVG(price) as avg, MIN(marketplace_items.price) as minPrice, MAX(marketplace_items.price) as maxPrice, COUNT(*) as number, (SELECT COUNT(*) FROM marketplace_items c INNER JOIN items as items_b ON c.item_id = items_b.id WHERE state = 2 AND items_b.item_id = base_item_id AND DATE(from_unixtime(sold_timestamp)) = CURDATE()) as sold_count_today FROM marketplace_items INNER JOIN items b ON marketplace_items.item_id = b.id INNER JOIN items_base bi ON b.item_id = bi.id INNER JOIN catalog_items ci ON bi.id = ci.item_ids WHERE price = (SELECT MIN(e.price) FROM marketplace_items e, items d WHERE e.item_id = d.id AND d.item_id = b.item_id AND e.state = 1 AND e.timestamp > ? GROUP BY d.item_id) AND state = 1 AND timestamp > ?";
+        String query = "SELECT B.* FROM marketplace_items a INNER JOIN (SELECT b.item_id AS base_item_id, b.limited_data AS ltd_data, marketplace_items.*, AVG(price) as avg, MIN(marketplace_items.price) as minPrice, MAX(marketplace_items.price) as maxPrice, COUNT(*) as number, (SELECT COUNT(*) FROM marketplace_items c INNER JOIN items as items_b ON c.item_id = items_b.id WHERE state = 2 AND items_b.item_id = base_item_id AND DATE(from_unixtime(sold_timestamp)) = CURDATE()) as sold_count_today FROM marketplace_items INNER JOIN items b ON marketplace_items.item_id = b.id INNER JOIN items_base bi ON b.item_id = bi.id INNER JOIN catalog_items ci ON bi.id = ci.item_ids WHERE price = (SELECT MIN(e.price) FROM marketplace_items e, items d WHERE e.item_id = d.id AND d.item_id = b.item_id AND e.state = 1 AND e.timestamp > ? AND e.price BETWEEN ? AND ? GROUP BY d.item_id) AND state = 1 AND timestamp > ? AND marketplace_items.price BETWEEN ? AND ?";
         if (minPrice > 0) {
             query += " AND CEIL(price + (price / 100)) >= ?";
         }
@@ -163,7 +169,11 @@ public class MarketPlace {
         try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement(query)) {
             int paramIndex = 1;
             statement.setInt(paramIndex++, Emulator.getIntUnixTimestamp() - 172800);
+            statement.setInt(paramIndex++, MINIMUM_LISTING_PRICE);
+            statement.setInt(paramIndex++, MAXIMUM_LISTING_PRICE);
             statement.setInt(paramIndex++, Emulator.getIntUnixTimestamp() - 172800);
+            statement.setInt(paramIndex++, MINIMUM_LISTING_PRICE);
+            statement.setInt(paramIndex++, MAXIMUM_LISTING_PRICE);
             if (minPrice > 0) {
                 statement.setInt(paramIndex++, minPrice);
             }
@@ -171,8 +181,9 @@ public class MarketPlace {
                 statement.setInt(paramIndex++, maxPrice);
             }
             if (!search.isEmpty()) {
-                statement.setString(paramIndex++, "%" + search + "%");
+                String likeSearch = "%" + com.eu.habbo.util.SqlLikeEscaper.escape(search) + "%";
-                statement.setString(paramIndex++, "%" + search + "%");
+                statement.setString(paramIndex++, likeSearch);
+                statement.setString(paramIndex++, likeSearch);
             }
 
             try (ResultSet set = statement.executeQuery()) {
@@ -264,7 +275,13 @@ public class MarketPlace {
                                 itemSet.first();
 
                                 if (itemSet.getRow() > 0) {
-                                    int price = MarketPlace.calculateCommision(set.getInt("price"));
+                                    int rawPrice = set.getInt("price");
+                                    if (!isValidListingPrice(rawPrice)) {
+                                        sendErrorMessage(client, set.getInt("item_id"), offerId);
+                                        return;
+                                    }
+
+                                    int price = MarketPlace.calculateCommision(rawPrice);
                                     if (set.getInt("state") != 1) {
                                         sendErrorMessage(client, set.getInt("item_id"), offerId);
                                     } else if ((MARKETPLACE_CURRENCY == 0 && price > client.getHabbo().getHabboInfo().getCredits()) || (MARKETPLACE_CURRENCY > 0 && price > client.getHabbo().getHabboInfo().getCurrencyAmount(MARKETPLACE_CURRENCY))) {
@@ -278,8 +295,9 @@ public class MarketPlace {
                                             return;
                                         }
 
+                                        int soldTimestamp = Emulator.getIntUnixTimestamp();
                                         try (PreparedStatement updateOffer = connection.prepareStatement("UPDATE marketplace_items SET state = 2, sold_timestamp = ? WHERE id = ? AND state = 1")) {
-                                            updateOffer.setInt(1, Emulator.getIntUnixTimestamp());
+                                            updateOffer.setInt(1, soldTimestamp);
                                             updateOffer.setInt(2, offerId);
                                             int updated = updateOffer.executeUpdate();
                                             if (updated == 0) {
@@ -306,7 +324,11 @@ public class MarketPlace {
                                         client.sendResponse(new MarketplaceBuyErrorComposer(MarketplaceBuyErrorComposer.REFRESH, 0, offerId, price));
 
                                         if (habbo != null) {
-                                            habbo.getInventory().getOffer(offerId).setState(MarketPlaceState.SOLD);
+                                            MarketPlaceOffer offer = habbo.getInventory().getOffer(offerId);
+                                            if (offer != null) {
+                                                offer.setState(MarketPlaceState.SOLD);
+                                                offer.setSoldTimestamp(soldTimestamp);
+                                            }
                                         }
                                     }
                                 }
@@ -352,7 +374,7 @@ public class MarketPlace {
         if (item == null || client == null)
             return false;
 
-        if (!item.getBaseItem().allowMarketplace() || price < 0)
+        if (!item.getBaseItem().allowMarketplace() || !isValidListingPrice(price))
             return false;
 
         MarketPlaceItemOfferedEvent event = new MarketPlaceItemOfferedEvent(client.getHabbo(), item, price);
@@ -368,6 +390,11 @@ public class MarketPlace {
         event.item.setFromGift(false);
 
         MarketPlaceOffer offer = new MarketPlaceOffer(event.item, event.price, client.getHabbo());
+        if (!offer.isPersisted()) {
+            LOGGER.warn("Marketplace offer insert failed for user {} item {}", client.getHabbo().getHabboInfo().getId(), event.item.getId());
+            return false;
+        }
+
         client.getHabbo().getInventory().addMarketplaceOffer(offer);
         client.getHabbo().getInventory().getItemsComponent().removeHabboItem(event.item);
         item.setUserId(-1);
@@ -387,11 +414,12 @@ public class MarketPlace {
         synchronized (client.getHabbo().getInventory()) {
             for (MarketPlaceOffer offer : offers) {
                 if (offer.getState().equals(MarketPlaceState.SOLD)) {
-                    client.getHabbo().getInventory().removeMarketplaceOffer(offer);
+                    if (removeUser(offer)) {
-                    credits += offer.getPrice();
+                        client.getHabbo().getInventory().removeMarketplaceOffer(offer);
-                    removeUser(offer);
+                        credits += offer.getPrice();
-                    offer.needsUpdate(true);
+                        offer.needsUpdate(true);
-                    Emulator.getThreading().run(offer);
+                        Emulator.getThreading().run(offer);
+                    }
                 }
             }
         }
@@ -405,18 +433,24 @@ public class MarketPlace {
         }
     }
 
-    private static void removeUser(MarketPlaceOffer offer) {
+    private static boolean removeUser(MarketPlaceOffer offer) {
         try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement("UPDATE marketplace_items SET user_id = ? WHERE id = ?")) {
             statement.setInt(1, -1);
             statement.setInt(2, offer.getOfferId());
-            statement.execute();
+            return statement.executeUpdate() > 0;
         } catch (SQLException e) {
             LOGGER.error("Caught SQL exception", e);
+            return false;
         }
     }
 
 
     public static int calculateCommision(int price) {
-        return price + (int) Math.ceil(price / 100.0);
+        long commission = price + (long) Math.ceil(price / 100.0);
+        return commission > Integer.MAX_VALUE ? Integer.MAX_VALUE : (int) commission;
+    }
+
+    public static boolean isValidListingPrice(int price) {
+        return price >= MINIMUM_LISTING_PRICE && price <= MAXIMUM_LISTING_PRICE;
     }
 }

Emulator/src/main/java/com/eu/habbo/habbohotel/catalog/marketplace/MarketPlaceOffer.java

@@ -98,6 +98,10 @@ public class MarketPlaceOffer implements Runnable {
         return this.offerId;
     }
 
+    public boolean isPersisted() {
+        return this.offerId > 0;
+    }
+
     public void setOfferId(int offerId) {
         this.offerId = offerId;
     }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/AlertCommand.java

@@ -32,6 +32,11 @@ public class AlertCommand extends Command {
         Habbo habbo = Emulator.getGameEnvironment().getHabboManager().getHabbo(targetUsername);
 
         if (habbo != null) {
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
+                gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
+                return true;
+            }
+
             habbo.alert(message + "\r\n    -" + gameClient.getHabbo().getHabboInfo().getUsername());
             gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.succes.cmd_alert.message_send").replace("%user%", targetUsername), RoomChatMessageBubbles.ALERT);
         } else {

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/BanCommand.java

@@ -9,6 +9,8 @@ import com.eu.habbo.habbohotel.users.Habbo;
 import com.eu.habbo.habbohotel.users.HabboInfo;
 import com.eu.habbo.habbohotel.users.HabboManager;
 
+import java.util.List;
+
 public class BanCommand extends Command {
     public BanCommand() {
         super("cmd_ban", Emulator.getTexts().getValue("commands.keys.cmd_ban").split(";"));
@@ -58,7 +60,7 @@ public class BanCommand extends Command {
             return true;
         }
 
-        if (target.getRank().getId() >= gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+        if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), target)) {
             gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
             return true;
         }
@@ -72,7 +74,13 @@ public class BanCommand extends Command {
             }
         }
 
-        ModToolBan ban = Emulator.getGameEnvironment().getModToolManager().ban(target.getId(), gameClient.getHabbo(), reason.toString(), banTime, ModToolBanType.ACCOUNT, -1).get(0);
+        List<ModToolBan> bans = Emulator.getGameEnvironment().getModToolManager().ban(target.getId(), gameClient.getHabbo(), reason.toString(), banTime, ModToolBanType.ACCOUNT, -1);
+        if (bans == null || bans.isEmpty()) {
+            gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.user_offline"), RoomChatMessageBubbles.ALERT);
+            return true;
+        }
+
+        ModToolBan ban = bans.get(0);
         gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.succes.cmd_ban.ban_issued").replace("%user%", target.getUsername()).replace("%time%", ban.expireDate - Emulator.getIntUnixTimestamp() + "").replace("%reason%", ban.reason), RoomChatMessageBubbles.ALERT);
 
         return true;

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/CommandTargetGuard.java

@@ -0,0 +1,46 @@
+package com.eu.habbo.habbohotel.commands;
+
+import com.eu.habbo.Emulator;
+import com.eu.habbo.habbohotel.permissions.Rank;
+import com.eu.habbo.habbohotel.users.Habbo;
+import com.eu.habbo.habbohotel.users.HabboInfo;
+
+final class CommandTargetGuard {
+    private CommandTargetGuard() {
+    }
+
+    static boolean canTarget(Habbo moderator, Habbo target) {
+        return target != null && canTarget(moderator, target.getHabboInfo());
+    }
+
+    static boolean canTarget(Habbo moderator, HabboInfo target) {
+        if (moderator == null || target == null || moderator.getHabboInfo().getId() == target.getId()) {
+            return false;
+        }
+
+        int moderatorRankId = moderator.getHabboInfo().getRank().getId();
+        int targetRankId = target.getRank().getId();
+
+        return targetRankId < moderatorRankId || isCoreRank(moderatorRankId) && targetRankId <= moderatorRankId;
+    }
+
+    static boolean canAssignRank(Habbo moderator, Rank rank) {
+        if (moderator == null || rank == null) {
+            return false;
+        }
+
+        int moderatorRankId = moderator.getHabboInfo().getRank().getId();
+        int targetRankId = rank.getId();
+
+        return targetRankId < moderatorRankId || isCoreRank(moderatorRankId) && targetRankId <= moderatorRankId;
+    }
+
+    private static boolean isCoreRank(int rankId) {
+        int highestRankId = Emulator.getGameEnvironment().getPermissionsManager().getAllRanks().stream()
+                .mapToInt(Rank::getId)
+                .max()
+                .orElse(0);
+
+        return highestRankId > 0 && rankId >= highestRankId;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/CommandsCommand.java

@@ -18,7 +18,7 @@ public class CommandsCommand extends Command {
 
         for (Command c : commands) {
             String textKey = "commands.description." + c.permission;
-            String commandText = Emulator.getTexts().getValue(textKey, "");
+            String commandText = Emulator.getTexts().getValueQuietly(textKey, "");
             String commandLine = ":" + c.keys[0];
             String description = "";
 

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/DisconnectCommand.java

@@ -29,7 +29,7 @@ public class DisconnectCommand extends Command {
             return true;
         }
 
-        if (target.getHabboInfo().getRank().getId() > gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+        if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), target)) {
             gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_disconnect.higher_rank"), RoomChatMessageBubbles.ALERT);
             return true;
         }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/GivePrefixCommand.java

@@ -47,6 +47,11 @@ public class GivePrefixCommand extends Command {
             return true;
         }
 
+        if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), target)) {
+            gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
+            return true;
+        }
+
         UserPrefix prefix = new UserPrefix(target.getHabboInfo().getId(), text, color, icon, effect);
         prefix.run();
         target.getInventory().getPrefixesComponent().addPrefix(prefix);

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/GiveRankCommand.java

@@ -36,7 +36,7 @@ public class GiveRankCommand extends Command {
             }
 
             if (rank != null) {
-                if (rank.getId() > gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+                if (!CommandTargetGuard.canAssignRank(gameClient.getHabbo(), rank)) {
                     gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_give_rank.higher").replace("%username%", params[1]).replace("%id%", rank.getName()), RoomChatMessageBubbles.ALERT);
                     return true;
                 }
@@ -44,7 +44,7 @@ public class GiveRankCommand extends Command {
                 HabboInfo habbo = HabboManager.getOfflineHabboInfo(params[1]);
 
                 if (habbo != null) {
-                    if (habbo.getRank().getId() > gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+                    if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
                         gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_give_rank.higher.other").replace("%username%", params[1]).replace("%id%", rank.getName()), RoomChatMessageBubbles.ALERT);
                         return true;
                     }
@@ -63,4 +63,4 @@ public class GiveRankCommand extends Command {
         gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.errors.cmd_give_rank.not_found").replace("%id%", params[2]).replace("%username%", params[1]), RoomChatMessageBubbles.ALERT);
         return true;
     }
-}
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/IPBanCommand.java

@@ -8,6 +8,8 @@ import com.eu.habbo.habbohotel.users.Habbo;
 import com.eu.habbo.habbohotel.users.HabboInfo;
 import com.eu.habbo.habbohotel.users.HabboManager;
 
+import java.util.List;
+
 public class IPBanCommand extends Command {
     public final static int TEN_YEARS = 315569260;
 
@@ -45,17 +47,17 @@ public class IPBanCommand extends Command {
                 return true;
             }
 
-            if (habbo.getRank().getId() >= gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
                 gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
                 return true;
             }
 
-            Emulator.getGameEnvironment().getModToolManager().ban(habbo.getId(), gameClient.getHabbo(), reason.toString(), TEN_YEARS, ModToolBanType.IP, -1);
+            List<?> bans = Emulator.getGameEnvironment().getModToolManager().ban(habbo.getId(), gameClient.getHabbo(), reason.toString(), TEN_YEARS, ModToolBanType.IP, -1);
-            count++;
+            count += bans != null ? bans.size() : 0;
             for (Habbo h : Emulator.getGameServer().getGameClientManager().getHabbosWithIP(habbo.getIpLogin())) {
                 if (h != null) {
-                    count++;
+                    bans = Emulator.getGameEnvironment().getModToolManager().ban(h.getHabboInfo().getId(), gameClient.getHabbo(), reason.toString(), TEN_YEARS, ModToolBanType.IP, -1);
-                    Emulator.getGameEnvironment().getModToolManager().ban(h.getHabboInfo().getId(), gameClient.getHabbo(), reason.toString(), TEN_YEARS, ModToolBanType.IP, -1);
+                    count += bans != null ? bans.size() : 0;
                 }
             }
         } else {

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/MachineBanCommand.java

@@ -8,6 +8,8 @@ import com.eu.habbo.habbohotel.users.Habbo;
 import com.eu.habbo.habbohotel.users.HabboInfo;
 import com.eu.habbo.habbohotel.users.HabboManager;
 
+import java.util.List;
+
 public class MachineBanCommand extends Command {
     public MachineBanCommand() {
         super("cmd_machine_ban", Emulator.getTexts().getValue("commands.keys.cmd_machine_ban").split(";"));
@@ -41,12 +43,13 @@ public class MachineBanCommand extends Command {
                 return true;
             }
 
-            if (habbo.getRank().getId() >= gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
                 gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
                 return true;
             }
 
-            count = Emulator.getGameEnvironment().getModToolManager().ban(habbo.getId(), gameClient.getHabbo(), reason.toString(), IPBanCommand.TEN_YEARS, ModToolBanType.MACHINE, -1).size();
+            List<?> bans = Emulator.getGameEnvironment().getModToolManager().ban(habbo.getId(), gameClient.getHabbo(), reason.toString(), IPBanCommand.TEN_YEARS, ModToolBanType.MACHINE, -1);
+            count = bans != null ? bans.size() : 0;
 
 
         } else {
@@ -58,4 +61,4 @@ public class MachineBanCommand extends Command {
 
         return true;
     }
-}
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/MuteCommand.java

@@ -29,6 +29,11 @@ public class MuteCommand extends Command {
                 return true;
             }
 
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
+                gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
+                return true;
+            }
+
             int duration = Integer.MAX_VALUE;
 
             if (params.length == 3) {

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/RedeemCommand.java

@@ -32,35 +32,44 @@ public class RedeemCommand extends Command {
         for (HabboItem item : gameClient.getHabbo().getInventory().getItemsComponent().getItemsAsValueCollection()) {
             if (item.getBaseItem().getName().startsWith("CF_") || item.getBaseItem().getName().startsWith("CFC_") || item.getBaseItem().getName().startsWith("DF_") || item.getBaseItem().getName().startsWith("PF_")) {
                 if (item.getUserId() == gameClient.getHabbo().getHabboInfo().getId()) {
-                    items.add(item);
+                    boolean redeemable = false;
                     if ((item.getBaseItem().getName().startsWith("CF_") || item.getBaseItem().getName().startsWith("CFC_")) && !item.getBaseItem().getName().contains("_diamond_")) {
-                        try {
+                        Integer amount = parsePositiveRedeemValue(item.getBaseItem().getName(), 1);
-                            credits += Integer.parseInt(item.getBaseItem().getName().split("_")[1]);
+                        if (amount != null) {
-                        } catch (Exception e) {
+                            Integer total = addRedeemValue(credits, amount);
+                            if (total != null) {
+                                credits = total;
+                                redeemable = true;
+                            }
                         }
 
                     } else if (item.getBaseItem().getName().startsWith("PF_")) {
-                        try {
+                        Integer amount = parsePositiveRedeemValue(item.getBaseItem().getName(), 1);
-                            pixels += Integer.parseInt(item.getBaseItem().getName().split("_")[1]);
+                        if (amount != null) {
-                        } catch (Exception e) {
+                            Integer total = addRedeemValue(pixels, amount);
+                            if (total != null) {
+                                pixels = total;
+                                redeemable = true;
+                            }
                         }
                     } else if (item.getBaseItem().getName().startsWith("DF_")) {
-                        int pointsType;
+                        Integer pointsType = parsePositiveRedeemValue(item.getBaseItem().getName(), 1);
-                        int pointsAmount;
+                        Integer pointsAmount = parsePositiveRedeemValue(item.getBaseItem().getName(), 2);
 
-                        pointsType = Integer.parseInt(item.getBaseItem().getName().split("_")[1]);
+                        if (pointsType != null && pointsAmount != null && addRedeemPoints(points, pointsType, pointsAmount)) {
-                        pointsAmount = Integer.parseInt(item.getBaseItem().getName().split("_")[2]);
+                            redeemable = true;
-
+                        }
-                        points.adjustOrPutValue(pointsType, pointsAmount, pointsAmount);
                     }
                     else if (item.getBaseItem().getName().startsWith("CF_diamond_")) {
-                        int pointsType;
+                        Integer pointsAmount = parsePositiveRedeemValue(item.getBaseItem().getName(), 2);
-                        int pointsAmount;
 
-                        pointsType = 5;
+                        if (pointsAmount != null && addRedeemPoints(points, 5, pointsAmount)) {
-                        pointsAmount = Integer.parseInt(item.getBaseItem().getName().split("_")[2]);
+                            redeemable = true;
+                        }
+                    }
 
-                        points.adjustOrPutValue(pointsType, pointsAmount, pointsAmount);
+                    if (redeemable) {
+                        items.add(item);
                     }
                 }
             }
@@ -103,4 +112,41 @@ public class RedeemCommand extends Command {
 
         return true;
     }
+
+    static Integer parsePositiveRedeemValue(String itemName, int index) {
+        if (itemName == null) {
+            return null;
+        }
+
+        String[] parts = itemName.split("_");
+        if (index < 0 || index >= parts.length) {
+            return null;
+        }
+
+        try {
+            int value = Integer.parseInt(parts[index]);
+            return value > 0 ? value : null;
+        } catch (NumberFormatException e) {
+            return null;
+        }
+    }
+
+    static Integer addRedeemValue(int current, int amount) {
+        try {
+            return Math.addExact(current, amount);
+        } catch (ArithmeticException e) {
+            return null;
+        }
+    }
+
+    static boolean addRedeemPoints(TIntIntMap points, int pointsType, int amount) {
+        int current = points.get(pointsType);
+        Integer total = addRedeemValue(current, amount);
+        if (total == null) {
+            return false;
+        }
+
+        points.put(pointsType, total);
+        return true;
+    }
 }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/RemovePrefixCommand.java

@@ -31,6 +31,11 @@ public class RemovePrefixCommand extends Command {
             return true;
         }
 
+        if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), target)) {
+            gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
+            return true;
+        }
+
         if (prefixIdStr.equalsIgnoreCase("all")) {
             List<UserPrefix> prefixes = target.getInventory().getPrefixesComponent().getPrefixes();
             for (UserPrefix prefix : prefixes) {

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/SuperbanCommand.java

@@ -41,7 +41,7 @@ public class SuperbanCommand extends Command {
                 return true;
             }
 
-            if (habbo.getRank().getId() >= gameClient.getHabbo().getHabboInfo().getRank().getId()) {
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
                 gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
                 return true;
             }
@@ -56,4 +56,4 @@ public class SuperbanCommand extends Command {
 
         return true;
     }
-}
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/UnmuteCommand.java

@@ -23,6 +23,11 @@ public class UnmuteCommand extends Command {
             gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_unmute.not_found").replace("%user%", params[1]), RoomChatMessageBubbles.ALERT);
             return true;
         } else {
+            if (!CommandTargetGuard.canTarget(gameClient.getHabbo(), habbo)) {
+                gameClient.getHabbo().whisper(Emulator.getTexts().getValue("commands.error.cmd_ban.target_rank_higher"), RoomChatMessageBubbles.ALERT);
+                return true;
+            }
+
             if (!habbo.getHabboStats().allowTalk() || (habbo.getHabboInfo().getCurrentRoom() != null && habbo.getHabboInfo().getCurrentRoom().isMuted(habbo))) {
                 if (!habbo.getHabboStats().allowTalk()) {
                     habbo.unMute();

Emulator/src/main/java/com/eu/habbo/habbohotel/earnings/EarningsCategory.java

@@ -0,0 +1,38 @@
+package com.eu.habbo.habbohotel.earnings;
+
+import java.util.Arrays;
+import java.util.Optional;
+
+public enum EarningsCategory {
+    DAILY_GIFT("daily_gift"),
+    GAMES("games"),
+    ACHIEVEMENTS("achievements"),
+    MARKETPLACE("marketplace"),
+    HC_PAYDAY("hc_payday"),
+    LEVEL_PROGRESS("level_progress"),
+    DONATIONS("donations"),
+    BONUS_BAG("bonus_bag"),
+    MYSTERY_BOXES("mystery_boxes"),
+    CLUB_JOB("club_job");
+
+    private final String key;
+
+    EarningsCategory(String key) {
+        this.key = key;
+    }
+
+    public String getKey() {
+        return key;
+    }
+
+    public static Optional<EarningsCategory> fromKey(String key) {
+        if (key == null || key.isBlank()) {
+            return Optional.empty();
+        }
+
+        String normalized = key.trim().toLowerCase();
+        return Arrays.stream(values())
+                .filter(category -> category.key.equals(normalized))
+                .findFirst();
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/earnings/EarningsCenterManager.java

@@ -0,0 +1,570 @@
+package com.eu.habbo.habbohotel.earnings;
+
+import com.eu.habbo.Emulator;
+import com.eu.habbo.habbohotel.catalog.marketplace.MarketPlace;
+import com.eu.habbo.habbohotel.users.Habbo;
+import com.eu.habbo.habbohotel.users.HabboBadge;
+import com.eu.habbo.habbohotel.users.subscriptions.SubscriptionHabboClub;
+import com.eu.habbo.messages.outgoing.users.AddUserBadgeComposer;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.SQLIntegrityConstraintViolationException;
+import java.time.Clock;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+
+public class EarningsCenterManager {
+    public static final String CONFIG_PREFIX = "earnings.";
+    private static final int DEFAULT_COOLDOWN_SECONDS = 86400;
+    private static final int DEFAULT_POINTS_TYPE = 5;
+    private static final int MAX_CONFIGURED_REWARD = 1_000_000;
+    private static final int MAX_ITEM_QUANTITY = 100;
+    private static final int MAX_HC_DAYS = 365;
+
+    private final ConfigSource config;
+    private final ClaimRepository claims;
+    private final RewardApplier rewards;
+    private final NativeIntegration nativeIntegration;
+    private final Clock clock;
+
+    public EarningsCenterManager() {
+        this(new EmulatorConfigSource(), new JdbcClaimRepository(), new HabboRewardApplier(), new DefaultNativeIntegration(), Clock.systemUTC());
+    }
+
+    public EarningsCenterManager(ConfigSource config, ClaimRepository claims, RewardApplier rewards, Clock clock) {
+        this(config, claims, rewards, new NoopNativeIntegration(), clock);
+    }
+
+    public EarningsCenterManager(ConfigSource config, ClaimRepository claims, RewardApplier rewards, NativeIntegration nativeIntegration, Clock clock) {
+        this.config = config;
+        this.claims = claims;
+        this.rewards = rewards;
+        this.nativeIntegration = nativeIntegration;
+        this.clock = clock;
+    }
+
+    public List<EarningsEntry> getEntries(Habbo habbo) {
+        int userId = getUserId(habbo);
+        int now = now();
+        List<EarningsEntry> entries = new ArrayList<>();
+
+        for (EarningsCategory category : EarningsCategory.values()) {
+            entries.add(buildEntry(habbo, userId, category, now));
+        }
+
+        return entries;
+    }
+
+    public EarningsClaimResult claim(Habbo habbo, String categoryKey) {
+        Optional<EarningsCategory> requestedCategory = EarningsCategory.fromKey(categoryKey);
+        if (requestedCategory.isEmpty()) {
+            return new EarningsClaimResult(null, EarningsClaimResult.Status.UNKNOWN_CATEGORY, null);
+        }
+
+        return claim(habbo, requestedCategory.get());
+    }
+
+    public List<EarningsClaimResult> claimAll(Habbo habbo) {
+        List<EarningsClaimResult> results = new ArrayList<>();
+
+        for (EarningsCategory category : EarningsCategory.values()) {
+            results.add(claim(habbo, category));
+        }
+
+        return results;
+    }
+
+    private EarningsClaimResult claim(Habbo habbo, EarningsCategory category) {
+        int userId = getUserId(habbo);
+        int now = now();
+        CategoryDefinition definition = loadDefinition(habbo, category);
+
+        if (!definition.enabled()) {
+            return new EarningsClaimResult(category, EarningsClaimResult.Status.DISABLED, buildEntry(habbo, userId, category, now));
+        }
+
+        if (this.nativeIntegration.handles(category) && nativeEnabled(category)) {
+            return claimNative(habbo, userId, category, now, definition);
+        }
+
+        if (definition.rewards().isEmpty()) {
+            return new EarningsClaimResult(category, EarningsClaimResult.Status.NO_REWARD, buildEntry(habbo, userId, category, now));
+        }
+
+        if (!isEligibleForProgressClaim(habbo, category)) {
+            return new EarningsClaimResult(category, EarningsClaimResult.Status.NO_REWARD, buildEntry(habbo, userId, category, now));
+        }
+
+        String periodKey = periodKey(habbo, category, now, definition.cooldownSeconds());
+
+        try {
+            if (!this.claims.recordClaim(userId, category.getKey(), periodKey, now)) {
+                return new EarningsClaimResult(category, EarningsClaimResult.Status.ALREADY_CLAIMED, buildEntry(habbo, userId, category, now));
+            }
+
+            this.rewards.grant(habbo, definition.rewards());
+            return new EarningsClaimResult(category, EarningsClaimResult.Status.SUCCESS, buildEntry(habbo, userId, category, now));
+        } catch (SQLException e) {
+            try {
+                this.claims.removeClaim(userId, category.getKey(), periodKey);
+            } catch (SQLException ignored) {
+            }
+            return new EarningsClaimResult(category, EarningsClaimResult.Status.ERROR, buildEntry(habbo, userId, category, now));
+        }
+    }
+
+    private EarningsClaimResult claimNative(Habbo habbo, int userId, EarningsCategory category, int now, CategoryDefinition definition) {
+        try {
+            if (definition.rewards().isEmpty() || !this.nativeIntegration.hasClaim(habbo, category)) {
+                return new EarningsClaimResult(category, EarningsClaimResult.Status.NO_REWARD, buildEntry(habbo, userId, category, now));
+            }
+
+            return this.nativeIntegration.claim(habbo, category)
+                    ? new EarningsClaimResult(category, EarningsClaimResult.Status.SUCCESS, buildEntry(habbo, userId, category, now))
+                    : new EarningsClaimResult(category, EarningsClaimResult.Status.ERROR, buildEntry(habbo, userId, category, now));
+        } catch (SQLException e) {
+            return new EarningsClaimResult(category, EarningsClaimResult.Status.ERROR, buildEntry(habbo, userId, category, now));
+        }
+    }
+
+    private EarningsEntry buildEntry(Habbo habbo, int userId, EarningsCategory category, int now) {
+        CategoryDefinition definition = loadDefinition(habbo, category);
+        boolean claimable = false;
+        int nextClaimAt = 0;
+
+        if (definition.enabled() && !definition.rewards().isEmpty()) {
+            if (this.nativeIntegration.handles(category) && nativeEnabled(category)) {
+                try {
+                    claimable = this.nativeIntegration.hasClaim(habbo, category);
+                } catch (SQLException e) {
+                    claimable = false;
+                }
+
+                return new EarningsEntry(category, true, claimable, 0, definition.rewards());
+            }
+
+            if (!isEligibleForProgressClaim(habbo, category)) {
+                return new EarningsEntry(category, true, false, 0, definition.rewards());
+            }
+
+            String periodKey = periodKey(habbo, category, now, definition.cooldownSeconds());
+
+            try {
+                claimable = !this.claims.hasClaim(userId, category.getKey(), periodKey);
+                nextClaimAt = claimable ? 0 : nextPeriodStart(now, definition.cooldownSeconds());
+            } catch (SQLException e) {
+                claimable = false;
+                nextClaimAt = nextPeriodStart(now, definition.cooldownSeconds());
+            }
+        }
+
+        return new EarningsEntry(category, definition.enabled(), claimable, nextClaimAt, definition.rewards());
+    }
+
+    private CategoryDefinition loadDefinition(Habbo habbo, EarningsCategory category) {
+        String key = CONFIG_PREFIX + category.getKey() + ".";
+        boolean enabled = this.config.getBoolean(CONFIG_PREFIX + "enabled", false)
+                && this.config.getBoolean(key + "enabled", true);
+        int cooldown = Math.max(60, this.config.getInt(key + "cooldown.seconds", DEFAULT_COOLDOWN_SECONDS));
+        int pointsType = Math.max(0, this.config.getInt(key + "points.type", DEFAULT_POINTS_TYPE));
+        List<EarningsReward> rewards = new ArrayList<>();
+
+        if (nativeEnabled(category) && this.nativeIntegration.handles(category)) {
+            try {
+                rewards.addAll(this.nativeIntegration.rewards(habbo, category));
+            } catch (SQLException ignored) {
+            }
+        } else {
+            addReward(rewards, EarningsReward.TYPE_CREDITS, this.config.getInt(key + "credits", 0), 0);
+            addReward(rewards, EarningsReward.TYPE_PIXELS, this.config.getInt(key + "pixels", 0), 0);
+            addReward(rewards, EarningsReward.TYPE_POINTS, this.config.getInt(key + "points", 0), pointsType);
+            addBadgeReward(rewards, this.config.getValue(key + "badge", ""));
+            addItemReward(rewards, this.config.getInt(key + "item_id", 0), this.config.getInt(key + "item.quantity", 1));
+            addHcReward(rewards, this.config.getInt(key + "hc.days", 0));
+        }
+
+        return new CategoryDefinition(enabled, cooldown, rewards);
+    }
+
+    private boolean nativeEnabled(EarningsCategory category) {
+        return this.config.getBoolean(CONFIG_PREFIX + category.getKey() + ".native.enabled", true);
+    }
+
+    private boolean isEligibleForProgressClaim(Habbo habbo, EarningsCategory category) {
+        if (!nativeEnabled(category) || habbo == null || habbo.getHabboStats() == null) {
+            return true;
+        }
+
+        if (category == EarningsCategory.ACHIEVEMENTS) {
+            int minimumScore = Math.max(1, this.config.getInt(CONFIG_PREFIX + category.getKey() + ".min_score", 1));
+            return habbo.getHabboStats().getAchievementScore() >= minimumScore;
+        }
+
+        if (category == EarningsCategory.LEVEL_PROGRESS) {
+            int minimumLevel = Math.max(0, this.config.getInt(CONFIG_PREFIX + category.getKey() + ".min_level", 1));
+            int highestLevel = Math.max(habbo.getHabboStats().citizenshipLevel, habbo.getHabboStats().helpersLevel);
+            return highestLevel >= minimumLevel;
+        }
+
+        return true;
+    }
+
+    private void addReward(List<EarningsReward> rewards, String type, int amount, int pointsType) {
+        int clampedAmount = Math.min(Math.max(0, amount), MAX_CONFIGURED_REWARD);
+        if (clampedAmount > 0) {
+            rewards.add(new EarningsReward(type, clampedAmount, pointsType));
+        }
+    }
+
+    private void addBadgeReward(List<EarningsReward> rewards, String badgeCode) {
+        if (badgeCode == null || !badgeCode.matches("[A-Za-z0-9_\\-]{1,64}")) {
+            return;
+        }
+
+        rewards.add(new EarningsReward(EarningsReward.TYPE_BADGE, 1, 0, badgeCode));
+    }
+
+    private void addItemReward(List<EarningsReward> rewards, int itemId, int quantity) {
+        if (itemId <= 0 || quantity <= 0) {
+            return;
+        }
+
+        rewards.add(new EarningsReward(EarningsReward.TYPE_ITEM, Math.min(quantity, MAX_ITEM_QUANTITY), 0, String.valueOf(itemId)));
+    }
+
+    private void addHcReward(List<EarningsReward> rewards, int days) {
+        if (days <= 0) {
+            return;
+        }
+
+        rewards.add(new EarningsReward(EarningsReward.TYPE_HC_DAYS, Math.min(days, MAX_HC_DAYS), 0));
+    }
+
+    private int getUserId(Habbo habbo) {
+        if (habbo == null || habbo.getHabboInfo() == null) {
+            return 0;
+        }
+
+        return habbo.getHabboInfo().getId();
+    }
+
+    private int now() {
+        return (int) (this.clock.instant().getEpochSecond());
+    }
+
+    private String periodKey(Habbo habbo, EarningsCategory category, int now, int cooldownSeconds) {
+        if (nativeEnabled(category) && habbo != null && habbo.getHabboStats() != null) {
+            if (category == EarningsCategory.ACHIEVEMENTS) {
+                int scoreStep = Math.max(1, this.config.getInt(CONFIG_PREFIX + category.getKey() + ".score.step", 100));
+                return "score:" + (habbo.getHabboStats().getAchievementScore() / scoreStep);
+            }
+
+            if (category == EarningsCategory.LEVEL_PROGRESS) {
+                int highestLevel = Math.max(habbo.getHabboStats().citizenshipLevel, habbo.getHabboStats().helpersLevel);
+                return "level:" + highestLevel;
+            }
+        }
+
+        return String.valueOf(now / cooldownSeconds);
+    }
+
+    private int nextPeriodStart(int now, int cooldownSeconds) {
+        return ((now / cooldownSeconds) + 1) * cooldownSeconds;
+    }
+
+    private record CategoryDefinition(boolean enabled, int cooldownSeconds, List<EarningsReward> rewards) {
+    }
+
+    public interface ConfigSource {
+        boolean getBoolean(String key, boolean defaultValue);
+
+        int getInt(String key, int defaultValue);
+
+        String getValue(String key, String defaultValue);
+    }
+
+    public interface ClaimRepository {
+        boolean hasClaim(int userId, String category, String periodKey) throws SQLException;
+
+        boolean recordClaim(int userId, String category, String periodKey, int claimedAt) throws SQLException;
+
+        void removeClaim(int userId, String category, String periodKey) throws SQLException;
+    }
+
+    public interface RewardApplier {
+        void grant(Habbo habbo, List<EarningsReward> rewards) throws SQLException;
+    }
+
+    public interface NativeIntegration {
+        boolean handles(EarningsCategory category);
+
+        boolean hasClaim(Habbo habbo, EarningsCategory category) throws SQLException;
+
+        List<EarningsReward> rewards(Habbo habbo, EarningsCategory category) throws SQLException;
+
+        boolean claim(Habbo habbo, EarningsCategory category) throws SQLException;
+    }
+
+    private static class EmulatorConfigSource implements ConfigSource {
+        @Override
+        public boolean getBoolean(String key, boolean defaultValue) {
+            return Emulator.getConfig().getBoolean(key, defaultValue);
+        }
+
+        @Override
+        public int getInt(String key, int defaultValue) {
+            return Emulator.getConfig().getInt(key, defaultValue);
+        }
+
+        @Override
+        public String getValue(String key, String defaultValue) {
+            return Emulator.getConfig().getValue(key, defaultValue);
+        }
+    }
+
+    private static class JdbcClaimRepository implements ClaimRepository {
+        @Override
+        public boolean hasClaim(int userId, String category, String periodKey) throws SQLException {
+            try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+                 PreparedStatement statement = connection.prepareStatement("SELECT 1 FROM users_earnings_claims WHERE user_id = ? AND category = ? AND period_key = ? LIMIT 1")) {
+                statement.setInt(1, userId);
+                statement.setString(2, category);
+                statement.setString(3, periodKey);
+                return statement.executeQuery().next();
+            }
+        }
+
+        @Override
+        public boolean recordClaim(int userId, String category, String periodKey, int claimedAt) throws SQLException {
+            try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+                 PreparedStatement statement = connection.prepareStatement("INSERT INTO users_earnings_claims (user_id, category, period_key, claimed_at) VALUES (?, ?, ?, FROM_UNIXTIME(?))")) {
+                statement.setInt(1, userId);
+                statement.setString(2, category);
+                statement.setString(3, periodKey);
+                statement.setInt(4, claimedAt);
+                return statement.executeUpdate() == 1;
+            } catch (SQLIntegrityConstraintViolationException duplicate) {
+                return false;
+            }
+        }
+
+        @Override
+        public void removeClaim(int userId, String category, String periodKey) throws SQLException {
+            try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+                 PreparedStatement statement = connection.prepareStatement("DELETE FROM users_earnings_claims WHERE user_id = ? AND category = ? AND period_key = ? LIMIT 1")) {
+                statement.setInt(1, userId);
+                statement.setString(2, category);
+                statement.setString(3, periodKey);
+                statement.executeUpdate();
+            }
+        }
+    }
+
+    private static class HabboRewardApplier implements RewardApplier {
+        @Override
+        public void grant(Habbo habbo, List<EarningsReward> rewards) throws SQLException {
+            if (habbo == null) {
+                return;
+            }
+
+            for (EarningsReward reward : rewards) {
+                switch (reward.getType()) {
+                    case EarningsReward.TYPE_CREDITS -> habbo.giveCredits(reward.getAmount());
+                    case EarningsReward.TYPE_PIXELS -> habbo.givePixels(reward.getAmount());
+                    case EarningsReward.TYPE_POINTS -> habbo.givePoints(reward.getPointsType(), reward.getAmount());
+                    case EarningsReward.TYPE_BADGE -> grantBadge(habbo, reward.getData());
+                    case EarningsReward.TYPE_ITEM -> grantItem(habbo, Integer.parseInt(reward.getData()), reward.getAmount());
+                    case EarningsReward.TYPE_HC_DAYS -> grantHcDays(habbo, reward.getAmount());
+                    default -> {
+                    }
+                }
+            }
+        }
+
+        private void grantBadge(Habbo habbo, String badgeCode) throws SQLException {
+            if (habbo.getInventory().getBadgesComponent().hasBadge(badgeCode)) {
+                return;
+            }
+
+            HabboBadge badge = new HabboBadge(0, badgeCode, 0, habbo);
+            badge.run();
+            habbo.getInventory().getBadgesComponent().addBadge(badge);
+            if (habbo.getClient() != null) {
+                habbo.getClient().sendResponse(new AddUserBadgeComposer(badge));
+            }
+        }
+
+        private void grantItem(Habbo habbo, int itemId, int quantity) throws SQLException {
+            if (!itemExists(itemId)) {
+                throw new SQLException("Unknown earnings item reward " + itemId);
+            }
+
+            try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+                 PreparedStatement statement = connection.prepareStatement("INSERT INTO items (user_id, item_id, extra_data) VALUES (?, ?, '')")) {
+                for (int i = 0; i < quantity; i++) {
+                    statement.setInt(1, habbo.getHabboInfo().getId());
+                    statement.setInt(2, itemId);
+                    statement.addBatch();
+                }
+
+                statement.executeBatch();
+            }
+        }
+
+        private boolean itemExists(int itemId) throws SQLException {
+            try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+                 PreparedStatement statement = connection.prepareStatement("SELECT id FROM items_base WHERE id = ? LIMIT 1")) {
+                statement.setInt(1, itemId);
+                try (ResultSet set = statement.executeQuery()) {
+                    return set.next();
+                }
+            }
+        }
+
+        private void grantHcDays(Habbo habbo, int days) throws SQLException {
+            int now = Emulator.getIntUnixTimestamp();
+            int current = habbo.getHabboStats().getClubExpireTimestamp();
+            int newExpire = (current > now ? current : now) + (days * 86400);
+
+            habbo.getHabboStats().setClubExpireTimestamp(newExpire);
+
+            try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+                 PreparedStatement statement = connection.prepareStatement("UPDATE users_settings SET club_expire_timestamp = ? WHERE user_id = ? LIMIT 1")) {
+                statement.setInt(1, newExpire);
+                statement.setInt(2, habbo.getHabboInfo().getId());
+                statement.executeUpdate();
+            }
+        }
+    }
+
+    private static class NoopNativeIntegration implements NativeIntegration {
+        @Override
+        public boolean handles(EarningsCategory category) {
+            return false;
+        }
+
+        @Override
+        public boolean hasClaim(Habbo habbo, EarningsCategory category) {
+            return false;
+        }
+
+        @Override
+        public List<EarningsReward> rewards(Habbo habbo, EarningsCategory category) {
+            return List.of();
+        }
+
+        @Override
+        public boolean claim(Habbo habbo, EarningsCategory category) {
+            return false;
+        }
+    }
+
+    private static class DefaultNativeIntegration implements NativeIntegration {
+        @Override
+        public boolean handles(EarningsCategory category) {
+            return category == EarningsCategory.MARKETPLACE || category == EarningsCategory.HC_PAYDAY;
+        }
+
+        @Override
+        public boolean hasClaim(Habbo habbo, EarningsCategory category) throws SQLException {
+            return !rewards(habbo, category).isEmpty();
+        }
+
+        @Override
+        public List<EarningsReward> rewards(Habbo habbo, EarningsCategory category) throws SQLException {
+            if (habbo == null) {
+                return List.of();
+            }
+
+            if (category == EarningsCategory.MARKETPLACE) {
+                int soldPriceTotal = habbo.getInventory().getSoldPriceTotal();
+                if (soldPriceTotal <= 0) {
+                    return List.of();
+                }
+
+                if (MarketPlace.MARKETPLACE_CURRENCY == 0) {
+                    return List.of(new EarningsReward(EarningsReward.TYPE_CREDITS, soldPriceTotal, 0));
+                }
+
+                return List.of(new EarningsReward(EarningsReward.TYPE_POINTS, soldPriceTotal, MarketPlace.MARKETPLACE_CURRENCY));
+            }
+
+            if (category == EarningsCategory.HC_PAYDAY) {
+                return hcPaydayRewards(habbo);
+            }
+
+            return List.of();
+        }
+
+        @Override
+        public boolean claim(Habbo habbo, EarningsCategory category) throws SQLException {
+            if (habbo == null || habbo.getClient() == null) {
+                return false;
+            }
+
+            if (category == EarningsCategory.MARKETPLACE) {
+                if (habbo.getInventory().getSoldPriceTotal() <= 0) {
+                    return false;
+                }
+
+                MarketPlace.getCredits(habbo.getClient());
+                return true;
+            }
+
+            if (category == EarningsCategory.HC_PAYDAY) {
+                if (hcPaydayRewards(habbo).isEmpty()) {
+                    return false;
+                }
+
+                SubscriptionHabboClub.processUnclaimed(habbo);
+                return true;
+            }
+
+            return false;
+        }
+
+        private List<EarningsReward> hcPaydayRewards(Habbo habbo) throws SQLException {
+            List<EarningsReward> rewards = new ArrayList<>();
+
+            try (Connection connection = Emulator.getDatabase().getDataSource().getConnection();
+                 PreparedStatement statement = connection.prepareStatement("SELECT currency, SUM(total_payout) AS amount FROM logs_hc_payday WHERE user_id = ? AND claimed = 0 GROUP BY currency")) {
+                statement.setInt(1, habbo.getHabboInfo().getId());
+
+                try (ResultSet set = statement.executeQuery()) {
+                    while (set.next()) {
+                        EarningsReward reward = currencyReward(set.getString("currency"), set.getInt("amount"));
+                        if (reward != null) {
+                            rewards.add(reward);
+                        }
+                    }
+                }
+            }
+
+            return rewards;
+        }
+
+        private EarningsReward currencyReward(String currency, int amount) {
+            if (amount <= 0) {
+                return null;
+            }
+
+            String normalized = currency == null ? "" : currency.trim().toLowerCase();
+            return switch (normalized) {
+                case "credits", "credit", "coins", "coin" -> new EarningsReward(EarningsReward.TYPE_CREDITS, amount, 0);
+                case "duckets", "ducket", "pixels", "pixel" -> new EarningsReward(EarningsReward.TYPE_PIXELS, amount, 0);
+                case "diamonds", "diamond" -> new EarningsReward(EarningsReward.TYPE_POINTS, amount, 5);
+                default -> {
+                    try {
+                        yield new EarningsReward(EarningsReward.TYPE_POINTS, amount, Math.max(0, Integer.parseInt(normalized)));
+                    } catch (NumberFormatException e) {
+                        yield null;
+                    }
+                }
+            };
+        }
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/earnings/EarningsClaimResult.java

@@ -0,0 +1,42 @@
+package com.eu.habbo.habbohotel.earnings;
+
+public class EarningsClaimResult {
+    public enum Status {
+        SUCCESS,
+        DISABLED,
+        UNKNOWN_CATEGORY,
+        ALREADY_CLAIMED,
+        NO_REWARD,
+        ERROR
+    }
+
+    private final EarningsCategory category;
+    private final Status status;
+    private final EarningsEntry entry;
+
+    public EarningsClaimResult(EarningsCategory category, Status status, EarningsEntry entry) {
+        this.category = category;
+        this.status = status;
+        this.entry = entry;
+    }
+
+    public EarningsCategory getCategory() {
+        return category;
+    }
+
+    public String getCategoryKey() {
+        return category == null ? "" : category.getKey();
+    }
+
+    public Status getStatus() {
+        return status;
+    }
+
+    public boolean isSuccess() {
+        return status == Status.SUCCESS;
+    }
+
+    public EarningsEntry getEntry() {
+        return entry;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/earnings/EarningsEntry.java

@@ -0,0 +1,39 @@
+package com.eu.habbo.habbohotel.earnings;
+
+import java.util.List;
+
+public class EarningsEntry {
+    private final EarningsCategory category;
+    private final boolean enabled;
+    private final boolean claimable;
+    private final int nextClaimAt;
+    private final List<EarningsReward> rewards;
+
+    public EarningsEntry(EarningsCategory category, boolean enabled, boolean claimable, int nextClaimAt, List<EarningsReward> rewards) {
+        this.category = category;
+        this.enabled = enabled;
+        this.claimable = claimable;
+        this.nextClaimAt = Math.max(0, nextClaimAt);
+        this.rewards = List.copyOf(rewards);
+    }
+
+    public EarningsCategory getCategory() {
+        return category;
+    }
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public boolean isClaimable() {
+        return claimable;
+    }
+
+    public int getNextClaimAt() {
+        return nextClaimAt;
+    }
+
+    public List<EarningsReward> getRewards() {
+        return rewards;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/earnings/EarningsReward.java

@@ -0,0 +1,42 @@
+package com.eu.habbo.habbohotel.earnings;
+
+public class EarningsReward {
+    public static final String TYPE_CREDITS = "credits";
+    public static final String TYPE_PIXELS = "pixels";
+    public static final String TYPE_POINTS = "points";
+    public static final String TYPE_BADGE = "badge";
+    public static final String TYPE_ITEM = "item";
+    public static final String TYPE_HC_DAYS = "hc_days";
+
+    private final String type;
+    private final int amount;
+    private final int pointsType;
+    private final String data;
+
+    public EarningsReward(String type, int amount, int pointsType) {
+        this(type, amount, pointsType, "");
+    }
+
+    public EarningsReward(String type, int amount, int pointsType, String data) {
+        this.type = type;
+        this.amount = Math.max(0, amount);
+        this.pointsType = Math.max(0, pointsType);
+        this.data = data == null ? "" : data;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public int getAmount() {
+        return amount;
+    }
+
+    public int getPointsType() {
+        return pointsType;
+    }
+
+    public String getData() {
+        return data;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/gameclients/GameClient.java

@@ -14,6 +14,7 @@ import org.slf4j.LoggerFactory;
 
 import java.util.ArrayList;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicBoolean;
 
 public class GameClient {
 
@@ -24,6 +25,7 @@ public class GameClient {
 	private final LatencyTracker latencyTracker;
 
     private Habbo habbo;
+    private final AtomicBoolean disposed = new AtomicBoolean(false);
     private boolean handshakeFinished;
     private String machineId = "";
     private String ssoTicket = "";
@@ -149,6 +151,14 @@ public class GameClient {
     }
 
     public void dispose() {
+        this.dispose(true);
+    }
+
+    public void dispose(boolean allowSessionResume) {
+        if (!this.disposed.compareAndSet(false, true)) {
+            return;
+        }
+
         try {
             this.channel.close();
 
@@ -161,7 +171,7 @@ public class GameClient {
                 // appena ripristinata (era la causa del "Bye"/kick al 2° reconnect).
                 if (this.habbo.getClient() == this && this.habbo.isOnline()) {
                     // Try to park the habbo in the grace period instead of immediate disconnect
-                    boolean parked = SessionResumeManager.getInstance().parkHabbo(this.habbo, this.ssoTicket);
+                    boolean parked = allowSessionResume && SessionResumeManager.getInstance().parkHabbo(this.habbo, this.ssoTicket);
 
                     if (!parked) {
                         // No grace period configured — immediate disconnect as before
@@ -177,4 +187,4 @@ public class GameClient {
             LOGGER.error("Caught exception", e);
         }
     }
-}
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/gameclients/GameClientManager.java

@@ -43,14 +43,34 @@ public class GameClientManager {
 
 
     public void disposeClient(GameClient client) {
-        this.disposeClient(client.getChannel());
+        if (client == null) {
+            return;
+        }
+
+        this.disposeClient(client.getChannel(), true);
+    }
+
+    public void forceDisposeClient(GameClient client) {
+        if (client == null) {
+            return;
+        }
+
+        this.disposeClient(client.getChannel(), false);
     }
 
     private void disposeClient(Channel channel) {
+        this.disposeClient(channel, true);
+    }
+
+    private void disposeClient(Channel channel, boolean allowSessionResume) {
+        if (channel == null) {
+            return;
+        }
+
         GameClient client = channel.attr(GameServerAttributes.CLIENT).get();
 
         if (client != null) {
-            client.dispose();
+            client.dispose(allowSessionResume);
         }
         channel.deregister();
         channel.attr(GameServerAttributes.CLIENT).set(null);
@@ -190,4 +210,4 @@ public class GameClientManager {
             CFKeepAlive();
         }, 30000);
     }
-}
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/gameclients/SessionResumeManager.java

@@ -71,6 +71,15 @@ public class SessionResumeManager {
             }
         }, graceSeconds * 1000);
 
+        if (future == null) {
+            // The scheduler refused the grace-expiry task (pool saturated or
+            // shutting down). Parking now would leave a GhostSession that nothing
+            // can ever reap (the Habbo + room refs pinned for the JVM lifetime),
+            // so disconnect immediately instead.
+            performFullDisconnect(habbo);
+            return false;
+        }
+
         ghostSessions.put(userId, new GhostSession(habbo, ssoTicket, future, previousEffectId, previousEffectEnd));
 
         applyPausedEffect(habbo);

Emulator/src/main/java/com/eu/habbo/habbohotel/guilds/GuildBadgeBuilder.java

@@ -0,0 +1,52 @@
+package com.eu.habbo.habbohotel.guilds;
+
+import com.eu.habbo.messages.ClientMessage;
+import com.eu.habbo.util.PacketGuard;
+
+public final class GuildBadgeBuilder {
+    public static final int MAX_BADGE_PARTS = 5;
+    private static final int INTS_PER_PART = 3;
+    private static final int BYTES_PER_INT = 4;
+    private static final int MAX_PART_ID = 999;
+    private static final int MAX_COLOR_ID = 99;
+    private static final int MAX_POSITION = 8;
+
+    private GuildBadgeBuilder() {
+    }
+
+    public static String readBadge(ClientMessage packet, int flatPartValueCount) {
+        if (flatPartValueCount % INTS_PER_PART != 0) {
+            return null;
+        }
+
+        int partCount = flatPartValueCount / INTS_PER_PART;
+        if (!PacketGuard.isCountInRange(partCount, 1, MAX_BADGE_PARTS)
+                || !PacketGuard.hasFixedWidthEntries(packet, flatPartValueCount, BYTES_PER_INT)) {
+            return null;
+        }
+
+        StringBuilder badge = new StringBuilder(partCount * 6);
+        for (int partIndex = 0; partIndex < partCount; partIndex++) {
+            int id = packet.readInt();
+            int color = packet.readInt();
+            int position = packet.readInt();
+
+            if (!isValidPart(id, color, position)) {
+                return null;
+            }
+
+            badge.append(partIndex == 0 ? "b" : "s");
+            badge.append(id < 100 ? "0" : "").append(id < 10 ? "0" : "").append(id);
+            badge.append(color < 10 ? "0" : "").append(color);
+            badge.append(position);
+        }
+
+        return badge.toString();
+    }
+
+    private static boolean isValidPart(int id, int color, int position) {
+        return id >= 0 && id <= MAX_PART_ID
+                && color >= 0 && color <= MAX_COLOR_ID
+                && position >= 0 && position <= MAX_POSITION;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/guilds/GuildManager.java

@@ -291,11 +291,12 @@ public class GuildManager {
                         }
                     }
                 } else if (!error) {
-                    try (PreparedStatement statement = connection.prepareStatement("UPDATE guilds_members SET level_id = ?, member_since = ? WHERE user_id = ? AND guild_id = ?")) {
+                    try (PreparedStatement statement = connection.prepareStatement("UPDATE guilds_members SET level_id = ?, member_since = ? WHERE user_id = ? AND guild_id = ? AND level_id = ?")) {
                         statement.setInt(1, GuildRank.MEMBER.type);
                         statement.setInt(2, Emulator.getIntUnixTimestamp());
                         statement.setInt(3, userId);
                         statement.setInt(4, guild.getId());
+                        statement.setInt(5, GuildRank.REQUESTED.type);
                         statement.execute();
                     }
                 }
@@ -421,9 +422,9 @@ public class GuildManager {
 
         try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement("SELECT users.username, users.look, guilds_members.* FROM guilds_members INNER JOIN users ON guilds_members.user_id = users.id WHERE guilds_members.guild_id = ?  " + (rankQuery(levelId)) + " AND users.username LIKE ? ORDER BY level_id, member_since ASC LIMIT ?, ?")) {
             statement.setInt(1, guild.getId());
-            statement.setString(2, "%" + query + "%");
+            statement.setString(2, "%" + com.eu.habbo.util.SqlLikeEscaper.escape(query) + "%");
             statement.setInt(3, page * 14);
-            statement.setInt(4, (page * 14) + 14);
+            statement.setInt(4, 14);
 
             try (ResultSet set = statement.executeQuery()) {
                 while (set.next()) {
@@ -440,7 +441,7 @@ public class GuildManager {
     public int getGuildMembersCount(Guild guild, int page, int levelId, String query) {
         try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement("SELECT COUNT(*) FROM guilds_members INNER JOIN users ON guilds_members.user_id = users.id WHERE guilds_members.guild_id = ?  " + (rankQuery(levelId)) + " AND users.username LIKE ? ORDER BY level_id, member_since ASC")) {
             statement.setInt(1, guild.getId());
-            statement.setString(2, "%" + query + "%");
+            statement.setString(2, "%" + com.eu.habbo.util.SqlLikeEscaper.escape(query) + "%");
 
             try (ResultSet set = statement.executeQuery()) {
                 while (set.next()) {

Emulator/src/main/java/com/eu/habbo/habbohotel/guilds/forums/ForumThread.java

@@ -101,21 +101,27 @@ public class ForumThread implements Runnable, ISerialize {
             if (statement.executeUpdate() < 1)
                 return null;
 
-            ResultSet set = statement.getGeneratedKeys();
+            try (ResultSet set = statement.getGeneratedKeys()) {
-            if (set.next()) {
+                if (set.next()) {
-                int threadId = set.getInt(1);
+                    int threadId = set.getInt(1);
-                createdThread = new ForumThread(threadId, guild.getId(), opener.getHabboInfo().getId(), subject, 0, timestamp, timestamp, ForumThreadState.OPEN, false, false, 0, null);
+                    createdThread = new ForumThread(threadId, guild.getId(), opener.getHabboInfo().getId(), subject, 0, timestamp, timestamp, ForumThreadState.OPEN, false, false, 0, null);
-                cacheThread(createdThread);
+                    cacheThread(createdThread);
-
+                }
-                ForumThreadComment comment = ForumThreadComment.create(createdThread, opener, message);
-                createdThread.addComment(comment);
-
-                Emulator.getPluginManager().fireEvent(new GuildForumThreadCreated(createdThread));
             }
         } catch (SQLException e) {
             LOGGER.error("Caught SQL exception", e);
         }
 
+        // ForumThreadComment.create() opens its OWN connection; do it after the
+        // thread's connection has been released to avoid holding two pooled
+        // connections simultaneously per forum-thread creation.
+        if (createdThread != null) {
+            ForumThreadComment comment = ForumThreadComment.create(createdThread, opener, message);
+            createdThread.addComment(comment);
+
+            Emulator.getPluginManager().fireEvent(new GuildForumThreadCreated(createdThread));
+        }
+
         return createdThread;
     }
 

Emulator/src/main/java/com/eu/habbo/habbohotel/guilds/forums/ForumThreadComment.java

@@ -98,12 +98,13 @@ public class ForumThreadComment implements Runnable, ISerialize {
             if (statement.executeUpdate() < 1)
                 return null;
 
-            ResultSet set = statement.getGeneratedKeys();
+            try (ResultSet set = statement.getGeneratedKeys()) {
-            if (set.next()) {
+                if (set.next()) {
-                int commentId = set.getInt(1);
+                    int commentId = set.getInt(1);
-                createdComment = new ForumThreadComment(commentId, thread.getThreadId(), poster.getHabboInfo().getId(), message, timestamp, ForumThreadState.OPEN, 0);
+                    createdComment = new ForumThreadComment(commentId, thread.getThreadId(), poster.getHabboInfo().getId(), message, timestamp, ForumThreadState.OPEN, 0);
 
-                Emulator.getPluginManager().fireEvent(new GuildForumThreadCommentCreated(createdComment));
+                    Emulator.getPluginManager().fireEvent(new GuildForumThreadCommentCreated(createdComment));
+                }
             }
         } catch (SQLException e) {
             LOGGER.error("Caught SQL exception", e);

Emulator/src/main/java/com/eu/habbo/habbohotel/items/FurnidataEntryBuilder.java

@@ -0,0 +1,52 @@
+package com.eu.habbo.habbohotel.items;
+
+/**
+ * Builds a complete furnidata entry object (single-line JSON5) from an {@link Item}
+ * (its items_base row) plus a display name/description. Used by the Furni Editor
+ * upsert path when a furni has no furnidata entry yet. Field shape mirrors the
+ * hotel's existing furnidata entries; {@code id} is the item's sprite id so the
+ * renderer resolves the furni's name/data by typeId.
+ */
+public final class FurnidataEntryBuilder {
+
+    private FurnidataEntryBuilder() {}
+
+    public static String build(Item item, String name, String description) {
+        String classname = item.getName() != null ? item.getName() : "";
+        String safeName = (name != null && !name.isBlank()) ? name
+                : (item.getFullName() != null && !item.getFullName().isBlank()) ? item.getFullName()
+                : classname;
+        String safeDesc = description != null ? description : "";
+        String customParams = item.getCustomParams() != null ? item.getCustomParams() : "";
+
+        StringBuilder b = new StringBuilder(256);
+        b.append("{\"id\":").append(item.getSpriteId());
+        b.append(",\"classname\":\"").append(esc(classname)).append('"');
+        b.append(",\"revision\":0,\"category\":\"unknown\",\"defaultdir\":0");
+        b.append(",\"xdim\":").append(item.getWidth());
+        b.append(",\"ydim\":").append(item.getLength());
+        b.append(",\"partcolors\":{\"color\":[]}");
+        b.append(",\"name\":\"").append(esc(safeName)).append('"');
+        b.append(",\"description\":\"").append(esc(safeDesc)).append('"');
+        b.append(",\"adurl\":\"\",\"offerid\":-1,\"buyout\":false,\"rentofferid\":-1,\"rentbuyout\":false,\"bc\":false,\"excludeddynamic\":false");
+        b.append(",\"customparams\":\"").append(esc(customParams)).append('"');
+        b.append(",\"specialtype\":1");
+        b.append(",\"canstandon\":").append(item.allowWalk());
+        b.append(",\"cansiton\":").append(item.allowSit());
+        b.append(",\"canlayon\":").append(item.allowLay());
+        b.append('}');
+        return b.toString();
+    }
+
+    /** Escape for a JSON string value; collapse control chars to spaces. */
+    private static String esc(String v) {
+        StringBuilder b = new StringBuilder(v.length() + 8);
+        for (int i = 0; i < v.length(); i++) {
+            char c = v.charAt(i);
+            if (c == '"' || c == '\\') b.append('\\').append(c);
+            else if (c == '\n' || c == '\r' || c == '\t') b.append(' ');
+            else b.append(c);
+        }
+        return b.toString();
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/items/FurnidataSourceResolver.java

@@ -36,30 +36,36 @@ public final class FurnidataSourceResolver {
     public static Source resolve() {
         try {
             String override = Emulator.getConfig().getValue("items.furnidata.path", "");
-            if (!override.isEmpty()) {
-                Path p = Paths.get(override);
-                if (Files.exists(p)) return new Source(p, Files.isDirectory(p), Status.RESOLVED, "items.furnidata.path");
-                return new Source(p, Files.isDirectory(p), Status.SOURCE_MISSING, "items.furnidata.path does not exist");
-            }
-
             String rendererConfigPath = Emulator.getConfig().getValue("furni.editor.renderer.config.path", "");
             String assetBasePath = Emulator.getConfig().getValue("furni.editor.asset.base.path", "");
 
-            if (!rendererConfigPath.isEmpty()) {
+            return resolveConfigured(override, rendererConfigPath, assetBasePath);
-                Source fromRenderer = resolveFromRendererConfig(Paths.get(rendererConfigPath), assetBasePath.isEmpty() ? null : Paths.get(assetBasePath));
-                if (fromRenderer.ok() || fromRenderer.status() == Status.UNRESOLVED_PLACEHOLDER) return fromRenderer;
-            }
-
-            Source fallback = resolveFromAssetBase(assetBasePath);
-            if (fallback != null) return fallback;
-
-            return new Source(null, false, Status.CONFIG_MISSING, "No furnidata source config found");
         } catch (Exception e) {
             LOGGER.warn("FurnidataSourceResolver failed", e);
             return new Source(null, false, Status.ERROR, e.getMessage() != null ? e.getMessage() : "Resolver error");
         }
     }
 
+    public static Source resolveConfigured(String legacyOverridePath, String rendererConfigPath, String assetBasePath) {
+        if (rendererConfigPath != null && !rendererConfigPath.isEmpty()) {
+            Source fromRenderer = resolveFromRendererConfig(Paths.get(rendererConfigPath), assetBasePath == null || assetBasePath.isEmpty() ? null : Paths.get(assetBasePath));
+            if (fromRenderer.ok() || fromRenderer.status() == Status.UNRESOLVED_PLACEHOLDER) return fromRenderer;
+        }
+
+        Source fromAssetBase = resolveFromAssetBase(assetBasePath);
+        if (fromAssetBase != null && fromAssetBase.ok()) return fromAssetBase;
+
+        if (legacyOverridePath != null && !legacyOverridePath.isEmpty()) {
+            Path p = Paths.get(legacyOverridePath);
+            if (Files.exists(p)) return new Source(p, Files.isDirectory(p), Status.RESOLVED, "items.furnidata.path fallback");
+            return new Source(p, Files.isDirectory(p), Status.SOURCE_MISSING, "items.furnidata.path fallback does not exist");
+        }
+
+        if (fromAssetBase != null) return fromAssetBase;
+
+        return new Source(null, false, Status.CONFIG_MISSING, "No furnidata source config found");
+    }
+
     public static Source resolveFromRendererConfig(Path rendererConfig, Path assetBase) {
         try {
             if (rendererConfig == null || !Files.exists(rendererConfig)) {

Emulator/src/main/java/com/eu/habbo/habbohotel/items/FurnidataWatcher.java

@@ -115,32 +115,39 @@ public class FurnidataWatcher {
         }
     }
 
-    private void onChange() {
+    private void onChange() throws InterruptedException {
+        // Re-index under the shared furnidata lock so the watcher and editor
+        // writes never swap the index concurrently. The lock is released before
+        // the throttle/broadcast below so a slow broadcast can't stall editor saves.
+        List<FurnidataEntry> delta;
         FurnidataLock.LOCK.lock();
         try {
             Path source = this.provider.getSource();
             if (source == null) return;
-
+            delta = this.provider.reindex(new FurnidataReader(source, this.maxBytes).read());
-            List<FurnidataEntry> delta = this.provider.reindex(new FurnidataReader(source, this.maxBytes).read());
-            if (delta.isEmpty()) return;
-
-            long now = System.currentTimeMillis();
-            if (now - this.lastBroadcast < this.minIntervalMs) {
-                LOGGER.info("FurnidataWatcher: {} changes indexed but broadcast skipped (min interval) — clients update on next change or reconnect", delta.size());
-                return;
-            }
-            this.lastBroadcast = now;
-
-            FurnitureDataReloadComposer composer = (delta.size() > this.deltaCap)
-                ? new FurnitureDataReloadComposer(FurnitureDataReloadComposer.MODE_RELOAD_HINT, List.of())
-                : new FurnitureDataReloadComposer(FurnitureDataReloadComposer.MODE_DELTA, delta);
-
-            broadcast(composer);
-            LOGGER.info("FurnidataWatcher: broadcast {} ({} entries)",
-                delta.size() > this.deltaCap ? "reload-hint" : "delta", delta.size());
         } finally {
             FurnidataLock.LOCK.unlock();
         }
+        if (delta.isEmpty()) return;
+
+        // Min-interval throttle: the index has already been swapped, so we must
+        // not drop this delta (the next reindex would diff against the updated
+        // index and never re-emit it). Instead, defer the broadcast until the
+        // interval elapses. Running on a dedicated daemon thread, sleeping is
+        // safe; file events arriving meanwhile coalesce into the next cycle.
+        long sinceLast = System.currentTimeMillis() - this.lastBroadcast;
+        if (sinceLast < this.minIntervalMs) {
+            Thread.sleep(this.minIntervalMs - sinceLast);
+        }
+        this.lastBroadcast = System.currentTimeMillis();
+
+        FurnitureDataReloadComposer composer = (delta.size() > this.deltaCap)
+            ? new FurnitureDataReloadComposer(FurnitureDataReloadComposer.MODE_RELOAD_HINT, List.of())
+            : new FurnitureDataReloadComposer(FurnitureDataReloadComposer.MODE_DELTA, delta);
+
+        broadcast(composer);
+        LOGGER.info("FurnidataWatcher: broadcast {} ({} entries)",
+            delta.size() > this.deltaCap ? "reload-hint" : "delta", delta.size());
     }
 
     private void broadcast(FurnitureDataReloadComposer composer) {

Emulator/src/main/java/com/eu/habbo/habbohotel/items/FurnidataWriter.java

@@ -56,6 +56,98 @@ public class FurnidataWriter {
         return true;
     }
 
+    /** Outcome of a {@link #create} attempt. */
+    public enum CreateResult { CREATED, ALREADY_EXISTS, ID_COLLISION, NO_TARGET, IO_ERROR }
+
+    /**
+     * Append a brand-new furnidata entry (upsert's "create" half). Refuses if the
+     * classname already exists (caller should edit instead) or if {@code id} is
+     * already used by a DIFFERENT classname (id collision would break the
+     * {@code roomItem.name.<id>} / typeId resolution on the renderer). The complete
+     * entry object is built by the caller (see FurnidataEntryBuilder) and inserted
+     * right after the opening '[' of the matching section's "furnitype" array.
+     *
+     * @param classname  new classname (must be absent from furnidata)
+     * @param id         furnidata id (= item sprite id); must not collide
+     * @param type       FLOOR -> roomitemtypes, WALL -> wallitemtypes
+     * @param entryJson5 the complete entry object as a single-line JSON5 string
+     * @param createTier split-tier only: the tier dir to write into (e.g. "custom"); ignored for single-file
+     */
+    public CreateResult create(String classname, int id, FurnitureType type, String entryJson5, String createTier) {
+        String cn = classname == null ? "" : classname.trim().toLowerCase(java.util.Locale.ROOT);
+        if (cn.isEmpty() || entryJson5 == null || entryJson5.isBlank()) return CreateResult.NO_TARGET;
+
+        // Guard: duplicate classname / id collision (scan the whole source).
+        for (FurnidataEntry e : new FurnidataReader(source, maxBytes).read()) {
+            String ecn = e.classname() == null ? "" : e.classname().trim().toLowerCase(java.util.Locale.ROOT);
+            if (ecn.equals(cn)) return CreateResult.ALREADY_EXISTS;
+            if (e.id() == id) return CreateResult.ID_COLLISION;
+        }
+
+        try {
+            Path target = resolveCreateTarget(createTier);
+            if (target == null) return CreateResult.NO_TARGET;
+
+            String raw = Files.readString(target, StandardCharsets.UTF_8);
+            String section = (type == FurnitureType.WALL) ? "wallitemtypes" : "roomitemtypes";
+            int open = furnitypeArrayOpenIndex(raw, section);
+            if (open < 0) return CreateResult.NO_TARGET; // section/array absent in target file
+
+            String edited = raw.substring(0, open) + "\n" + entryJson5 + "," + raw.substring(open);
+            backup(target);
+            atomicWrite(target, edited);
+            return CreateResult.CREATED;
+        } catch (IOException e) {
+            return CreateResult.IO_ERROR;
+        }
+    }
+
+    /** Single-file: the source. Split-tier: the create-tier file (created with a shell if absent). */
+    private Path resolveCreateTarget(String createTier) throws IOException {
+        if (!directory) return source;
+        String tier = (createTier == null || createTier.isBlank()) ? "custom" : createTier.trim();
+        Path base = source.toAbsolutePath().normalize();
+        Path tierDir = safeResolve(base, tier);
+        if (tierDir == null) return null;
+        if (!Files.isDirectory(tierDir)) Files.createDirectories(tierDir);
+        for (String fileName : manifestList(tierDir, "files", List.of())) {
+            Path f = safeResolve(base, tierDir.resolve(fileName).toString());
+            if (f != null && Files.isRegularFile(f)) return f;
+        }
+        Path def = tierDir.resolve("furnidata.json5");
+        if (!Files.exists(def)) {
+            Files.writeString(def,
+                "{\n  \"roomitemtypes\": { \"furnitype\": [\n] },\n  \"wallitemtypes\": { \"furnitype\": [\n] }\n}\n",
+                StandardCharsets.UTF_8);
+        }
+        return def;
+    }
+
+    /** Index just after the '[' that opens {@code <section>.furnitype}, or -1 if absent. String-aware. */
+    static int furnitypeArrayOpenIndex(String raw, String section) {
+        int s = indexOfKey(raw, section, 0);
+        if (s < 0) return -1;
+        int ft = indexOfKey(raw, "furnitype", s);
+        if (ft < 0) return -1;
+        boolean inStr = false; char q = 0;
+        for (int i = ft; i < raw.length(); i++) {
+            char c = raw.charAt(i);
+            if (inStr) { if (c == '\\') i++; else if (c == q) inStr = false; continue; }
+            if (c == '"' || c == '\'') { inStr = true; q = c; }
+            else if (c == '[') return i + 1;
+        }
+        return -1;
+    }
+
+    /** First occurrence of a quoted key ("key" or 'key') at/after {@code from}, or -1. */
+    private static int indexOfKey(String raw, String key, int from) {
+        int a = raw.indexOf("\"" + key + "\"", from);
+        int b = raw.indexOf("'" + key + "'", from);
+        if (a < 0) return b;
+        if (b < 0) return a;
+        return Math.min(a, b);
+    }
+
     /** For single-file just returns the file; for split-tier, the tier file that contains cn. */
     private Path locateFile(String cn) throws IOException {
         if (!directory) {

Emulator/src/main/java/com/eu/habbo/habbohotel/items/FurnitureTextProvider.java

@@ -27,6 +27,7 @@ public class FurnitureTextProvider {
     private final boolean enabled;
     private volatile Map<String, FurniText> index = Map.of();
     private volatile Path source;
+    private volatile String sourceDescription = "unknown";
     private FurnidataWatcher watcher;
 
     public FurnitureTextProvider(boolean enabled) {
@@ -47,7 +48,7 @@ public class FurnitureTextProvider {
                 return;
             }
             reindex(new FurnidataReader(this.source, DEFAULT_MAX_BYTES).read());
-            LOGGER.info("FurnitureTextProvider: indexed {} furnidata names from {}", this.index.size(), this.source);
+            LOGGER.info("Furniture Text Provider -> Indexed! ({} names, source: {})", this.index.size(), this.sourceDescription);
 
             if (Boolean.parseBoolean(Emulator.getConfig().getValue("items.furnidata.watch.enabled", "true"))) {
                 if (this.watcher != null) this.watcher.stop();
@@ -88,9 +89,12 @@ public class FurnitureTextProvider {
         }
     }
 
-    private static Path resolveSource() {
+    private Path resolveSource() {
         FurnidataSourceResolver.Source source = FurnidataSourceResolver.resolve();
-        if (source.ok()) return source.path();
+        if (source.ok()) {
+            this.sourceDescription = source.message();
+            return source.path();
+        }
         LOGGER.warn("FurnitureTextProvider: no furnidata source resolved ({}) - {}", source.status(), source.message());
         return null;
     }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/Item.java

@@ -45,7 +45,7 @@ public class Item implements ISerialize {
     }
 
     public static boolean isPet(Item item) {
-        return item.getName().toLowerCase().startsWith("a0 pet");
+        return item != null && item.getName() != null && item.getName().toLowerCase().startsWith("a0 pet");
     }
 
     public static boolean isBot(Item item) {
@@ -121,26 +121,19 @@ public class Item implements ISerialize {
         this.customParams = set.getString("customparams");
         this.clothingOnWalk = set.getString("clothing_on_walk");
 
-        if (!set.getString("vending_ids").isEmpty()) {
+        int[] vendingIds = ItemDataGuard.parsePositiveIntList(set.getString("vending_ids"));
+        if (vendingIds.length > 0) {
             this.vendingItems = new TIntArrayList();
-            String[] vendingIds = set.getString("vending_ids").replace(";", ",").split(",");
+            for (int vendingId : vendingIds) {
-            for (String s : vendingIds) {
+                this.vendingItems.add(vendingId);
-                this.vendingItems.add(Integer.parseInt(s.replace(" ", "")));
             }
+        } else {
+            this.vendingItems = new TIntArrayList();
         }
 
         //if(this.interactionType.getType() == InteractionMultiHeight.class || this.interactionType.getType().isAssignableFrom(InteractionMultiHeight.class))
         {
-            if (set.getString("multiheight").contains(";")) {
+            this.multiHeights = ItemDataGuard.parseHeights(set.getString("multiheight"));
-                String[] s = set.getString("multiheight").split(";");
-                this.multiHeights = new double[s.length];
-
-                for (int i = 0; i < s.length; i++) {
-                    this.multiHeights[i] = Double.parseDouble(s[i]);
-                }
-            } else {
-                this.multiHeights = new double[0];
-            }
         }
 
         this.rotations = 4;
@@ -254,6 +247,10 @@ public class Item implements ISerialize {
     }
 
     public int getRandomVendingItem() {
+        if (this.vendingItems == null || this.vendingItems.isEmpty()) {
+            return 0;
+        }
+
         return this.vendingItems.get(Emulator.getRandom().nextInt(this.vendingItems.size()));
     }
 
@@ -273,21 +270,23 @@ public class Item implements ISerialize {
 
     @Override
     public void serialize(ServerMessage message) {
-        message.appendString(this.type.code.toLowerCase());
+        message.appendString(this.type == null ? "" : this.type.code.toLowerCase());
 
         if (type == FurnitureType.BADGE) {
-            message.appendString(this.customParams);
+            message.appendString(ItemDataGuard.safeString(this.customParams));
         } else {
             message.appendInt(this.spriteId);
 
-            if (this.getName().contains("wallpaper_single") || this.getName().contains("floor_single") || this.getName().contains("landscape_single")) {
+            String itemName = ItemDataGuard.safeString(this.getName());
-                message.appendString(this.name.split("_")[2]);
+            if (itemName.contains("wallpaper_single") || itemName.contains("floor_single") || itemName.contains("landscape_single")) {
+                String[] nameParts = itemName.split("_");
+                message.appendString(nameParts.length > 2 ? nameParts[2] : "");
             } else if (type == FurnitureType.ROBOT) {
-                message.appendString(this.customParams);
+                message.appendString(ItemDataGuard.safeString(this.customParams));
-            } else if (name.equalsIgnoreCase("poster")) {
+            } else if (itemName.equalsIgnoreCase("poster")) {
-                message.appendString(this.customParams);
+                message.appendString(ItemDataGuard.safeString(this.customParams));
-            } else if (name.startsWith("SONG ")) {
+            } else if (itemName.startsWith("SONG ")) {
-                message.appendString(this.customParams);
+                message.appendString(ItemDataGuard.safeString(this.customParams));
             } else {
                 message.appendString("");
             }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/ItemDataGuard.java

@@ -0,0 +1,82 @@
+package com.eu.habbo.habbohotel.items;
+
+final class ItemDataGuard {
+    static final int MAX_EXTRA_DATA_LENGTH = 1000;
+
+    private ItemDataGuard() {
+    }
+
+    static String safeString(String value) {
+        return value == null ? "" : value;
+    }
+
+    static String normalizeExtraData(String value) {
+        String safe = safeString(value);
+        return safe.length() > MAX_EXTRA_DATA_LENGTH ? safe.substring(0, MAX_EXTRA_DATA_LENGTH) : safe;
+    }
+
+    static int parsePositiveInt(String value) {
+        try {
+            int parsed = Integer.parseInt(safeString(value).trim());
+            return parsed > 0 ? parsed : 0;
+        } catch (NumberFormatException e) {
+            return 0;
+        }
+    }
+
+    static int[] parsePositiveIntList(String value) {
+        String safe = safeString(value).replace(";", ",").replace(".", ",");
+        if (safe.isBlank()) {
+            return new int[0];
+        }
+
+        String[] parts = safe.split(",");
+        int[] parsed = new int[parts.length];
+        int count = 0;
+
+        for (String part : parts) {
+            int id = parsePositiveInt(part);
+            if (id > 0) {
+                parsed[count++] = id;
+            }
+        }
+
+        if (count == parsed.length) {
+            return parsed;
+        }
+
+        int[] compact = new int[count];
+        System.arraycopy(parsed, 0, compact, 0, count);
+        return compact;
+    }
+
+    static double[] parseHeights(String value) {
+        String safe = safeString(value);
+        if (safe.isBlank() || !safe.contains(";")) {
+            return new double[0];
+        }
+
+        String[] parts = safe.split(";");
+        double[] parsed = new double[parts.length];
+        int count = 0;
+
+        for (String part : parts) {
+            try {
+                double height = Double.parseDouble(part.trim());
+                if (Double.isFinite(height)) {
+                    parsed[count++] = height;
+                }
+            } catch (NumberFormatException e) {
+                // Ignore malformed DB values and keep the remaining heights usable.
+            }
+        }
+
+        if (count == parsed.length) {
+            return parsed;
+        }
+
+        double[] compact = new double[count];
+        System.arraycopy(parsed, 0, compact, 0, count);
+        return compact;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/items/ItemManager.java

@@ -566,6 +566,10 @@ public class ItemManager {
 
 
     public int calculateCrackState(int count, int max, Item baseItem) {
+        if (count <= 0 || max <= 0 || baseItem == null || baseItem.getStateCount() <= 0) {
+            return 0;
+        }
+
         return (int) Math.floor((1.0D / ((double) max / (double) count) * baseItem.getStateCount()));
     }
 
@@ -574,7 +578,8 @@ public class ItemManager {
     }
 
     public Item getCrackableReward(int itemId) {
-        return this.getItem(this.crackableRewards.get(itemId).getRandomReward());
+        CrackableReward reward = this.crackableRewards.get(itemId);
+        return reward == null ? null : this.getItem(reward.getRandomReward());
     }
 
 
@@ -604,6 +609,12 @@ public class ItemManager {
     }
 
     public HabboItem createItem(int habboId, Item item, int limitedStack, int limitedSells, String extraData) {
+        if (habboId <= 0 || item == null) {
+            return null;
+        }
+
+        extraData = ItemDataGuard.normalizeExtraData(extraData);
+
         try (Connection connection = Emulator.getDatabase().getDataSource().getConnection(); PreparedStatement statement = connection.prepareStatement("INSERT INTO items (user_id, item_id, extra_data, limited_data) VALUES (?, ?, ?, ?)", Statement.RETURN_GENERATED_KEYS)) {
             statement.setInt(1, habboId);
             statement.setInt(2, item.getId());
@@ -673,6 +684,12 @@ public class ItemManager {
     }
 
     public HabboItem handleRecycle(Habbo habbo, String itemId) {
+        int rewardItemId = ItemDataGuard.parsePositiveInt(itemId);
+        if (habbo == null || habbo.getHabboInfo() == null || rewardItemId <= 0
+                || Emulator.getGameEnvironment().getCatalogManager().ecotronItem == null) {
+            return null;
+        }
+
         String extradata = Calendar.getInstance().get(Calendar.DAY_OF_MONTH) + "-" + (Calendar.getInstance().get(Calendar.MONTH) + 1) + "-" + Calendar.getInstance().get(Calendar.YEAR);
 
         HabboItem item = null;
@@ -686,7 +703,7 @@ public class ItemManager {
                 try (PreparedStatement preparedStatement = connection.prepareStatement("INSERT INTO items_presents (item_id, base_item_reward) VALUES (?, ?)")) {
                     while (set.next() && item == null) {
                         preparedStatement.setInt(1, set.getInt(1));
-                        preparedStatement.setInt(2, Integer.parseInt(itemId));
+                        preparedStatement.setInt(2, rewardItemId);
                         preparedStatement.addBatch();
                         item = new InteractionDefault(set.getInt(1), habbo.getHabboInfo().getId(), Emulator.getGameEnvironment().getCatalogManager().ecotronItem, extradata, 0, 0);
                     }
@@ -829,6 +846,10 @@ public class ItemManager {
     }
 
     public HabboItem createGift(String username, Item item, String extraData, int limitedStack, int limitedSells) {
+        if (username == null || username.isBlank() || item == null) {
+            return null;
+        }
+
         Habbo habbo = Emulator.getGameEnvironment().getHabboManager().getHabbo(username);
 
         int userId = 0;
@@ -857,13 +878,13 @@ public class ItemManager {
     }
 
     public HabboItem createGift(int userId, Item item, String extraData, int limitedStack, int limitedSells) {
-        if (userId == 0)
+        if (userId <= 0 || item == null)
             return null;
 
-        if (extraData.length() > 1000) {
+        if (extraData != null && extraData.length() > ItemDataGuard.MAX_EXTRA_DATA_LENGTH) {
             LOGGER.error("Extradata exceeds maximum length of 1000 characters: {}", extraData);
-            extraData = extraData.substring(0, 1000);
         }
+        extraData = ItemDataGuard.normalizeExtraData(extraData);
 
         HabboItem gift = this.createItem(userId, item, limitedStack, limitedSells, extraData);
 
@@ -879,7 +900,7 @@ public class ItemManager {
     }
 
     public Item getItem(int itemId) {
-        if (itemId < 0)
+        if (itemId <= 0)
             return null;
 
         return this.items.get(itemId);
@@ -890,12 +911,16 @@ public class ItemManager {
     }
 
     public Item getItem(String itemName) {
+        if (itemName == null || itemName.isBlank()) {
+            return null;
+        }
+
         TIntObjectIterator<Item> item = this.items.iterator();
 
         for (int i = this.items.size(); i-- > 0; ) {
             try {
                 item.advance();
-                if (item.value().getName().equalsIgnoreCase(itemName)) {
+                if (item.value() != null && item.value().getName() != null && item.value().getName().equalsIgnoreCase(itemName)) {
                     return item.value();
                 }
             } catch (NoSuchElementException e) {

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/InteractionGift.java

@@ -13,11 +13,13 @@ import org.slf4j.LoggerFactory;
 
 import java.sql.ResultSet;
 import java.sql.SQLException;
+import java.util.concurrent.atomic.AtomicBoolean;
 
 public class InteractionGift extends HabboItem {
     private static final Logger LOGGER = LoggerFactory.getLogger(InteractionGift.class);
 
     public boolean explode = false;
+    private final AtomicBoolean opening = new AtomicBoolean(false);
     private int[] itemId;
     private int colorId = 0;
     private int ribbonId = 0;
@@ -46,6 +48,15 @@ public class InteractionGift extends HabboItem {
         }
     }
 
+    /**
+     * Claims the right to open this gift, returning true exactly once. Guards
+     * against two near-simultaneous OpenRecycleBox packets both scheduling an
+     * (async, delayed) OpenGift before the wrapper is removed from the room.
+     */
+    public boolean tryStartOpening() {
+        return this.opening.compareAndSet(false, true);
+    }
+
     @Override
     public void serializeExtradata(ServerMessage serverMessage) {
         //serverMessage.appendInt(this.colorId * 1000 + this.ribbonId);

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/InteractionMultiHeight.java

@@ -65,9 +65,8 @@ public class InteractionMultiHeight extends HabboItem {
                 if (this.getBaseItem().getMultiHeights().length > 0) {
                     this.setExtradata("" + (Integer.parseInt(this.getExtradata()) + 1) % (this.getBaseItem().getMultiHeights().length));
                     this.needsUpdate(true);
-                    room.updateTiles(room.getLayout().getTilesAt(room.getLayout().getTile(this.getX(), this.getY()), this.getBaseItem().getWidth(), this.getBaseItem().getLength(), this.getRotation()));
+                    room.updateItem(this);
-                    room.updateItemState(this);
+                    this.updateUnitsOnItem(room);
-                    //room.sendComposer(new UpdateStackHeightComposer(this.getX(), this.getY(), this.getBaseItem().getMultiHeights()[Integer.valueOf(this.getExtradata())] * 256.0D).compose());
                 }
             }
         }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/InteractionRentableSpace.java

@@ -3,6 +3,7 @@ package com.eu.habbo.habbohotel.items.interactions;
 import com.eu.habbo.Emulator;
 import com.eu.habbo.habbohotel.gameclients.GameClient;
 import com.eu.habbo.habbohotel.items.Item;
+import com.eu.habbo.habbohotel.permissions.Permission;
 import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.habbohotel.rooms.RoomLayout;
 import com.eu.habbo.habbohotel.rooms.RoomUnit;
@@ -133,12 +134,18 @@ public class InteractionRentableSpace extends HabboItem {
         if (habbo.getHabboStats().isRentingSpace())
             return;
 
-        if (habbo.getHabboInfo().getCredits() < this.rentCost())
+        int cost = this.rentCost();
+        boolean hasInfiniteCredits = habbo.hasPermission(Permission.ACC_INFINITE_CREDITS);
+        if (!hasInfiniteCredits && habbo.getHabboInfo().getCredits() < cost)
             return;
 
         if (habbo.getHabboStats().getClubExpireTimestamp() < Emulator.getIntUnixTimestamp())
             return;
 
+        if (!hasInfiniteCredits) {
+            habbo.giveCredits(-cost);
+        }
+
         this.setRenterId(habbo.getHabboInfo().getId());
         this.setRenterName(habbo.getHabboInfo().getUsername());
         this.setEndTimestamp(Emulator.getIntUnixTimestamp() + (7 * 86400));

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/InteractionWired.java

@@ -2,6 +2,7 @@ package com.eu.habbo.habbohotel.items.interactions;
 
 import com.eu.habbo.Emulator;
 import com.eu.habbo.habbohotel.items.Item;
+import com.eu.habbo.habbohotel.items.interactions.wired.WiredInputGuard;
 import com.eu.habbo.habbohotel.items.interactions.wired.WiredSettings;
 import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.habbohotel.rooms.RoomUnit;
@@ -18,6 +19,7 @@ import java.sql.SQLException;
 import java.util.Iterator;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicBoolean;
 
 /**
  * Base abstract class for all wired furniture items (triggers, effects, conditions, extras).
@@ -61,7 +63,11 @@ public abstract class InteractionWired extends InteractionDefault {
      */
     private static final long CACHE_EXPIRY_MS = 5 * 60 * 1000;
     
-    private long cooldown;
+    private volatile long cooldown;
+    // Ensures one box is processed by a single thread at a time, so the
+    // cooldown check-and-set in WiredHandler can't double-fire when a packet
+    // thread and the room cycle thread trigger the same box concurrently.
+    private final AtomicBoolean processing = new AtomicBoolean(false);
     private final ConcurrentHashMap<Long, Long> userExecutionCache = new ConcurrentHashMap<>();
 
     InteractionWired(ResultSet set, Item baseItem) throws SQLException {
@@ -149,6 +155,15 @@ public abstract class InteractionWired extends InteractionDefault {
         this.cooldown = newMillis;
     }
 
+    /** Claims exclusive processing of this box; returns false if another thread is already in it. */
+    public boolean tryBeginProcessing() {
+        return this.processing.compareAndSet(false, true);
+    }
+
+    public void endProcessing() {
+        this.processing.set(false);
+    }
+
     @Override
     public boolean allowWiredResetState() {
         return false;
@@ -216,39 +231,18 @@ public abstract class InteractionWired extends InteractionDefault {
 
     public static WiredSettings readSettings(ClientMessage packet, boolean isEffect)
     {
-        int intParamCount = packet.readInt();
+        int[] intParams = WiredInputGuard.readIntParams(packet);
-        if (intParamCount < 0 || intParamCount > 100) {
+        String stringParam = WiredInputGuard.readStringParam(packet);
-            throw new IllegalArgumentException("Invalid intParamCount: " + intParamCount);
+        int[] itemIds = WiredInputGuard.readFurniIds(packet);
-        }
-        int[] intParams = new int[intParamCount];
-
-        for(int i = 0; i < intParamCount; i++)
-        {
-            intParams[i] = packet.readInt();
-        }
-
-        String stringParam = packet.readString();
-
-        int itemCount = packet.readInt();
-        int selectionLimit = Emulator.getConfig() != null ? Emulator.getConfig().getInt("hotel.wired.furni.selection.count", 5) : 5;
-        if (itemCount < 0 || itemCount > selectionLimit * 20) {
-            throw new IllegalArgumentException("Invalid itemCount: " + itemCount + " exceeds maximum allowed limit");
-        }
-        int[] itemIds = new int[itemCount];
-
-        for(int i = 0; i < itemCount; i++)
-        {
-            itemIds[i] = packet.readInt();
-        }
 
         WiredSettings settings = new WiredSettings(intParams, stringParam, itemIds, -1);
 
         if(isEffect)
         {
-            settings.setDelay(packet.readInt());
+            settings.setDelay(WiredInputGuard.normalizeDelay(packet.readInt()));
         }
 
-        settings.setStuffTypeSelectionCode(packet.readInt());
+        settings.setStuffTypeSelectionCode(WiredInputGuard.normalizeStuffSelectionCode(packet.readInt()));
         return settings;
     }
 }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/pets/InteractionPetBreedingNest.java

@@ -190,6 +190,14 @@ public class InteractionPetBreedingNest extends HabboItem {
     }
 
     public void breed(Habbo habbo, String name, int petOneId, int petTwoId) {
+        // Guard before the destructive delete below: a crafted packet can call
+        // this on a nest that isn't full, which would delete the nest furni and
+        // then NPE on petOne/petTwo in the async runnable (losing the furni).
+        if (habbo == null || this.petOne == null || this.petTwo == null
+                || habbo.getHabboInfo().getCurrentRoom() == null) {
+            return;
+        }
+
         Emulator.getThreading().run(new QueryDeleteHabboItem(this.getId()));
 
         this.setExtradata("2");

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/WiredInputGuard.java

@@ -0,0 +1,90 @@
+package com.eu.habbo.habbohotel.items.interactions.wired;
+
+import com.eu.habbo.Emulator;
+import com.eu.habbo.messages.ClientMessage;
+
+import java.util.Arrays;
+
+public final class WiredInputGuard {
+    public static final int MAX_INT_PARAMS = 100;
+    public static final int MAX_STRING_PARAM_LENGTH = 1024;
+    public static final int MAX_ABSOLUTE_FURNI_IDS = 100;
+    public static final int DEFAULT_MAX_DELAY = 20;
+    public static final int MAX_ABSOLUTE_DELAY = 3600;
+    public static final int MIN_STUFF_SELECTION_CODE = -1;
+    public static final int MAX_STUFF_SELECTION_CODE = 2;
+
+    private WiredInputGuard() {
+    }
+
+    public static int[] readIntParams(ClientMessage packet) {
+        int count = packet.readInt();
+        if (count < 0 || count > MAX_INT_PARAMS) {
+            throw new IllegalArgumentException("Invalid wired int param count");
+        }
+
+        int[] values = new int[count];
+        for (int i = 0; i < count; i++) {
+            values[i] = packet.readInt();
+        }
+        return values;
+    }
+
+    public static String readStringParam(ClientMessage packet) {
+        String value = packet.readString();
+        if (value == null || value.isEmpty()) {
+            return "";
+        }
+
+        return value.length() > MAX_STRING_PARAM_LENGTH
+                ? value.substring(0, MAX_STRING_PARAM_LENGTH)
+                : value;
+    }
+
+    public static int[] readFurniIds(ClientMessage packet) {
+        int count = packet.readInt();
+        int maxCount = maxFurniSelectionCount();
+        if (count < 0 || count > maxCount) {
+            throw new IllegalArgumentException("Invalid wired furni selection count");
+        }
+
+        int[] values = new int[count];
+        int accepted = 0;
+        for (int i = 0; i < count; i++) {
+            int itemId = packet.readInt();
+            if (itemId > 0) {
+                values[accepted++] = itemId;
+            }
+        }
+
+        return accepted == values.length ? values : Arrays.copyOf(values, accepted);
+    }
+
+    public static int normalizeDelay(int delay) {
+        return Math.max(0, Math.min(delay, maxDelay()));
+    }
+
+    public static int normalizeStuffSelectionCode(int code) {
+        if (code < MIN_STUFF_SELECTION_CODE || code > MAX_STUFF_SELECTION_CODE) {
+            return MIN_STUFF_SELECTION_CODE;
+        }
+
+        return code;
+    }
+
+    public static int maxFurniSelectionCount() {
+        int selectionLimit = Emulator.getConfig() != null
+                ? Emulator.getConfig().getInt("hotel.wired.furni.selection.count", 5)
+                : 5;
+        selectionLimit = Math.max(1, selectionLimit);
+        return Math.min(MAX_ABSOLUTE_FURNI_IDS, selectionLimit * 20);
+    }
+
+    public static int maxDelay() {
+        int configured = Emulator.getConfig() != null
+                ? Emulator.getConfig().getInt("hotel.wired.max_delay", DEFAULT_MAX_DELAY)
+                : DEFAULT_MAX_DELAY;
+        configured = Math.max(0, configured);
+        return Math.min(MAX_ABSOLUTE_DELAY, configured);
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/WiredLegacyDataGuard.java

@@ -0,0 +1,48 @@
+package com.eu.habbo.habbohotel.items.interactions.wired;
+
+import com.eu.habbo.habbohotel.rooms.Room;
+import com.eu.habbo.habbohotel.users.HabboItem;
+
+import java.util.ArrayList;
+import java.util.List;
+
+public final class WiredLegacyDataGuard {
+    public static final int DEFAULT_MAX_DELAY = 20;
+
+    private WiredLegacyDataGuard() {
+    }
+
+    public static int parseDelay(String value) {
+        try {
+            int parsed = Integer.parseInt(value == null ? "" : value.trim());
+            return Math.max(0, Math.min(parsed, DEFAULT_MAX_DELAY));
+        } catch (NumberFormatException e) {
+            return 0;
+        }
+    }
+
+    public static List<HabboItem> parseRoomItems(String value, Room room) {
+        List<HabboItem> items = new ArrayList<>();
+        if (room == null || value == null || value.isBlank()) {
+            return items;
+        }
+
+        for (String part : value.split(";")) {
+            try {
+                int itemId = Integer.parseInt(part.trim());
+                if (itemId <= 0) {
+                    continue;
+                }
+
+                HabboItem item = room.getHabboItem(itemId);
+                if (item != null) {
+                    items.add(item);
+                }
+            } catch (NumberFormatException e) {
+                // Ignore malformed legacy ids and keep loading the remaining items.
+            }
+        }
+
+        return items;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/WiredNumericInputGuard.java

@@ -0,0 +1,38 @@
+package com.eu.habbo.habbohotel.items.interactions.wired;
+
+import com.eu.habbo.Emulator;
+
+public final class WiredNumericInputGuard {
+    public static final int DEFAULT_MAX_REWARD_AMOUNT = 1000;
+    public static final int DEFAULT_MAX_RESPECT_AMOUNT = 100;
+    public static final int MAX_ABSOLUTE_AMOUNT = 100000;
+
+    private WiredNumericInputGuard() {
+    }
+
+    public static int parsePositiveAmount(String value, int maxAmount) {
+        try {
+            int parsed = Integer.parseInt(value == null ? "" : value.trim());
+            if (parsed <= 0) {
+                return 0;
+            }
+
+            return Math.min(parsed, Math.max(1, Math.min(maxAmount, MAX_ABSOLUTE_AMOUNT)));
+        } catch (NumberFormatException e) {
+            return 0;
+        }
+    }
+
+    public static int maxRewardAmount() {
+        return configuredMax("hotel.wired.reward.max_amount", DEFAULT_MAX_REWARD_AMOUNT);
+    }
+
+    public static int maxRespectAmount() {
+        return configuredMax("hotel.wired.respect.max_amount", DEFAULT_MAX_RESPECT_AMOUNT);
+    }
+
+    private static int configuredMax(String key, int fallback) {
+        int configured = Emulator.getConfig() != null ? Emulator.getConfig().getInt(key, fallback) : fallback;
+        return Math.max(1, Math.min(configured, MAX_ABSOLUTE_AMOUNT));
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/WiredTimerInputGuard.java

@@ -0,0 +1,45 @@
+package com.eu.habbo.habbohotel.items.interactions.wired;
+
+public final class WiredTimerInputGuard {
+    public static final int MAX_TIMER_MS = 24 * 60 * 60 * 1000;
+
+    private WiredTimerInputGuard() {
+    }
+
+    public static int fromClientUnits(int units, int stepMs, int minMs) {
+        return fromClientUnits(units, stepMs, minMs, MAX_TIMER_MS);
+    }
+
+    public static int fromClientUnits(int units, int stepMs, int minMs, int maxMs) {
+        if (units < 1 || stepMs < 1) {
+            return minMs;
+        }
+
+        long value = (long) units * stepMs;
+        return clamp(value, minMs, maxMs);
+    }
+
+    public static int normalizeStoredMillis(Integer millis, int minMs, int fallbackMs) {
+        return normalizeStoredMillis(millis, minMs, fallbackMs, MAX_TIMER_MS);
+    }
+
+    public static int normalizeStoredMillis(Integer millis, int minMs, int fallbackMs, int maxMs) {
+        if (millis == null || millis < minMs) {
+            return fallbackMs;
+        }
+
+        return clamp(millis.longValue(), minMs, maxMs);
+    }
+
+    private static int clamp(long value, int minMs, int maxMs) {
+        if (value < minMs) {
+            return minMs;
+        }
+
+        if (value > maxMs) {
+            return maxMs;
+        }
+
+        return (int) value;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionActorDir.java

@@ -111,7 +111,13 @@ public class WiredConditionActorDir extends InteractionWiredCondition {
         }
 
         if (wiredData.startsWith("{")) {
-            JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            JsonData data;
+            try {
+                data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            } catch (RuntimeException exception) {
+                this.onPickUp();
+                return;
+            }
 
             if (data == null) {
                 return;
@@ -157,15 +163,15 @@ public class WiredConditionActorDir extends InteractionWiredCondition {
         return (this.directionMask & (1 << direction)) != 0;
     }
 
-    private int normalizeDirectionMask(int value) {
+    int normalizeDirectionMask(int value) {
         return value & ALL_DIRECTIONS_MASK;
     }
 
-    private int normalizeUserSource(int value) {
+    int normalizeUserSource(int value) {
         return WiredSourceUtil.isDefaultUserSource(value) ? value : WiredSourceUtil.SOURCE_TRIGGER;
     }
 
-    private int normalizeQuantifier(int value) {
+    int normalizeQuantifier(int value) {
         return (value == QUANTIFIER_ANY) ? QUANTIFIER_ANY : QUANTIFIER_ALL;
     }
 

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionCounterTimeMatches.java

@@ -111,19 +111,21 @@ public class WiredConditionCounterTimeMatches extends InteractionWiredCondition
 
     @Override
     public void loadWiredData(ResultSet set, Room room) throws SQLException {
-        this.items.clear();
+        this.resetSettings();
-        this.comparison = COMPARISON_EQUAL;
-        this.minutes = 0;
-        this.halfSecondSteps = 0;
-        this.furniSource = WiredSourceUtil.SOURCE_TRIGGER;
-        this.quantifier = QUANTIFIER_ALL;
 
         String wiredData = set.getString("wired_data");
         if (wiredData == null || wiredData.isEmpty() || !wiredData.startsWith("{")) {
             return;
         }
 
-        JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        JsonData data;
+        try {
+            data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        } catch (RuntimeException exception) {
+            this.resetSettings();
+            return;
+        }
+
         if (data == null) {
             return;
         }
@@ -131,7 +133,7 @@ public class WiredConditionCounterTimeMatches extends InteractionWiredCondition
         this.comparison = this.normalizeComparison(data.comparison);
         this.minutes = this.normalizeMinutes(data.minutes);
         this.halfSecondSteps = this.normalizeHalfSecondSteps(data.halfSecondSteps);
-        this.furniSource = data.furniSource;
+        this.furniSource = this.normalizeFurniSource(data.furniSource);
         this.quantifier = this.normalizeQuantifier(data.quantifier);
 
         if (data.itemIds == null) {
@@ -139,6 +141,10 @@ public class WiredConditionCounterTimeMatches extends InteractionWiredCondition
         }
 
         for (Integer id : data.itemIds) {
+            if (id == null) {
+                continue;
+            }
+
             HabboItem item = room.getHabboItem(id);
             if (item instanceof InteractionGameUpCounter) {
                 this.items.add(item);
@@ -195,7 +201,7 @@ public class WiredConditionCounterTimeMatches extends InteractionWiredCondition
         this.comparison = (params.length > 0) ? this.normalizeComparison(params[0]) : COMPARISON_EQUAL;
         this.minutes = (params.length > 1) ? this.normalizeMinutes(params[1]) : 0;
         this.halfSecondSteps = (params.length > 2) ? this.normalizeHalfSecondSteps(params[2]) : 0;
-        this.furniSource = (params.length > 3) ? params[3] : WiredSourceUtil.SOURCE_TRIGGER;
+        this.furniSource = (params.length > 3) ? this.normalizeFurniSource(params[3]) : WiredSourceUtil.SOURCE_TRIGGER;
         this.quantifier = (params.length > 4) ? this.normalizeQuantifier(params[4]) : QUANTIFIER_ALL;
 
         this.items.clear();
@@ -224,6 +230,15 @@ public class WiredConditionCounterTimeMatches extends InteractionWiredCondition
         return true;
     }
 
+    private void resetSettings() {
+        this.items.clear();
+        this.comparison = COMPARISON_EQUAL;
+        this.minutes = 0;
+        this.halfSecondSteps = 0;
+        this.furniSource = WiredSourceUtil.SOURCE_TRIGGER;
+        this.quantifier = QUANTIFIER_ALL;
+    }
+
     private void refresh(Room room) {
         THashSet<HabboItem> remove = new THashSet<>();
 
@@ -256,7 +271,7 @@ public class WiredConditionCounterTimeMatches extends InteractionWiredCondition
         }
     }
 
-    private int normalizeComparison(int value) {
+    int normalizeComparison(int value) {
         if (value < COMPARISON_LESS || value > COMPARISON_GREATER) {
             return COMPARISON_EQUAL;
         }
@@ -264,18 +279,30 @@ public class WiredConditionCounterTimeMatches extends InteractionWiredCondition
         return value;
     }
 
-    private int normalizeMinutes(int value) {
+    int normalizeMinutes(int value) {
         return Math.max(0, Math.min(MAX_MINUTES, value));
     }
 
-    private int normalizeHalfSecondSteps(int value) {
+    int normalizeHalfSecondSteps(int value) {
         return Math.max(0, Math.min(MAX_HALF_SECOND_STEPS, value));
     }
 
-    private int normalizeQuantifier(int value) {
+    int normalizeQuantifier(int value) {
         return (value == QUANTIFIER_ANY) ? QUANTIFIER_ANY : QUANTIFIER_ALL;
     }
 
+    int normalizeFurniSource(int value) {
+        switch (value) {
+            case WiredSourceUtil.SOURCE_SELECTED:
+            case WiredSourceUtil.SOURCE_SELECTOR:
+            case WiredSourceUtil.SOURCE_SIGNAL:
+            case WiredSourceUtil.SOURCE_TRIGGER:
+                return value;
+            default:
+                return WiredSourceUtil.SOURCE_TRIGGER;
+        }
+    }
+
     static class JsonData {
         int comparison;
         int minutes;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionDateRangeActive.java

@@ -53,8 +53,7 @@ public class WiredConditionDateRangeActive extends InteractionWiredCondition {
     @Override
     public boolean saveData(WiredSettings settings) {
         if(settings.getIntParams().length < 2) return false;
-        this.startDate = settings.getIntParams()[0];
+        this.applyRange(settings.getIntParams()[0], settings.getIntParams()[1]);
-        this.endDate = settings.getIntParams()[1];
         return true;
     }
 
@@ -80,20 +79,28 @@ public class WiredConditionDateRangeActive extends InteractionWiredCondition {
 
     @Override
     public void loadWiredData(ResultSet set, Room room) throws SQLException {
+        this.onPickUp();
         String wiredData = set.getString("wired_data");
+        if (wiredData == null || wiredData.isEmpty()) {
+            this.applyRange(0, 0);
+            return;
+        }
 
         if (wiredData.startsWith("{")) {
             JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
-            this.startDate = data.startDate;
+            if (data == null) {
-            this.endDate = data.endDate;
+                this.applyRange(0, 0);
+                return;
+            }
+            this.applyRange(data.startDate, data.endDate);
         } else {
             String[] data = wiredData.split("\t");
 
             if (data.length == 2) {
                 try {
-                    this.startDate = Integer.parseInt(data[0]);
+                    this.applyRange(Integer.parseInt(data[0]), Integer.parseInt(data[1]));
-                    this.endDate = Integer.parseInt(data[1]);
                 } catch (Exception e) {
+                    this.applyRange(0, 0);
                 }
             }
         }
@@ -105,6 +112,12 @@ public class WiredConditionDateRangeActive extends InteractionWiredCondition {
         this.endDate = 0;
     }
 
+    private void applyRange(int startDate, int endDate) {
+        int[] range = WiredDateRangeInputGuard.normalizeRange(startDate, endDate);
+        this.startDate = range[0];
+        this.endDate = range[1];
+    }
+
     static class JsonData {
         int startDate;
         int endDate;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionFurniHaveFurni.java

@@ -92,21 +92,35 @@ public class WiredConditionFurniHaveFurni extends InteractionWiredCondition {
 
     @Override
     public void loadWiredData(ResultSet set, Room room) throws SQLException {
+        this.onPickUp();
         String wiredData = set.getString("wired_data");
+        if (wiredData == null || wiredData.isEmpty()) {
+            return;
+        }
 
         if (wiredData.startsWith("{")) {
-            JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            JsonData data;
-            this.all = data.all;
+            try {
-            this.furniSource = data.furniSource;
+                data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            } catch (RuntimeException exception) {
+                this.onPickUp();
+                return;
+            }
 
-            for(int id : data.itemIds) {
+            if (data == null) {
+                return;
+            }
+
+            this.all = data.all;
+            this.furniSource = WiredFurniConditionInputGuard.normalizeFurniSource(data.furniSource);
+
+            for(int id : WiredFurniConditionInputGuard.sanitizeItemIds(data.itemIds, WiredManager.MAXIMUM_FURNI_SELECTION)) {
                 HabboItem item = room.getHabboItem(id);
 
                 if (item != null) {
                     this.items.add(item);
                 }
             }
-
         } else {
             String[] data = wiredData.split(":");
 
@@ -114,21 +128,18 @@ public class WiredConditionFurniHaveFurni extends InteractionWiredCondition {
                 this.all = (data[0].equals("1"));
 
                 if (data.length == 2) {
-                    String[] items = data[1].split(";");
+                    for (int id : WiredFurniConditionInputGuard.parseLegacyItemIds(data[1], WiredManager.MAXIMUM_FURNI_SELECTION)) {
+                        HabboItem item = room.getHabboItem(id);
 
-                    for (String s : items) {
+                        if (item != null) {
-                        HabboItem item = room.getHabboItem(Integer.parseInt(s));
-
-                        if (item != null)
                             this.items.add(item);
+                        }
                     }
                 }
             }
             this.furniSource = this.items.isEmpty() ? WiredSourceUtil.SOURCE_TRIGGER : WiredSourceUtil.SOURCE_SELECTED;
         }
-        if (this.furniSource == WiredSourceUtil.SOURCE_TRIGGER && !this.items.isEmpty()) {
+        this.furniSource = WiredFurniConditionInputGuard.selectedOrNormalizedFurniSource(this.furniSource, !this.items.isEmpty());
-            this.furniSource = WiredSourceUtil.SOURCE_SELECTED;
-        }
     }
 
     @Override
@@ -172,14 +183,12 @@ public class WiredConditionFurniHaveFurni extends InteractionWiredCondition {
 
         int[] params = settings.getIntParams();
         this.all = params[0] == 1;
-        this.furniSource = (params.length > 1) ? params[1] : WiredSourceUtil.SOURCE_TRIGGER;
+        this.furniSource = (params.length > 1) ? WiredFurniConditionInputGuard.normalizeFurniSource(params[1]) : WiredSourceUtil.SOURCE_TRIGGER;
 
         int count = settings.getFurniIds().length;
         if (count > Emulator.getConfig().getInt("hotel.wired.furni.selection.count")) return false;
 
-        if (count > 0 && this.furniSource == WiredSourceUtil.SOURCE_TRIGGER) {
+        this.furniSource = WiredFurniConditionInputGuard.selectedOrNormalizedFurniSource(this.furniSource, count > 0);
-            this.furniSource = WiredSourceUtil.SOURCE_SELECTED;
-        }
 
         this.items.clear();
 
@@ -198,6 +207,18 @@ public class WiredConditionFurniHaveFurni extends InteractionWiredCondition {
         return true;
     }
 
+    int normalizeFurniSource(int value) {
+        switch (value) {
+            case WiredSourceUtil.SOURCE_SELECTED:
+            case WiredSourceUtil.SOURCE_SELECTOR:
+            case WiredSourceUtil.SOURCE_SIGNAL:
+            case WiredSourceUtil.SOURCE_TRIGGER:
+                return value;
+            default:
+                return WiredSourceUtil.SOURCE_TRIGGER;
+        }
+    }
+
     private void refresh() {
         THashSet<HabboItem> items = new THashSet<>();
 

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionFurniHaveHabbo.java

@@ -89,15 +89,18 @@ public class WiredConditionFurniHaveHabbo extends InteractionWiredCondition {
 
     @Override
     public void loadWiredData(ResultSet set, Room room) throws SQLException {
-        this.items.clear();
+        this.onPickUp();
         String wiredData = set.getString("wired_data");
+        if (wiredData == null || wiredData.isEmpty()) {
+            return;
+        }
 
         if (wiredData.startsWith("{")) {
             JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
-            this.furniSource = data.furniSource;
+            this.furniSource = WiredFurniConditionInputGuard.normalizeFurniSource(data.furniSource);
             this.all = data.all;
 
-            for(int id : data.itemIds) {
+            for(int id : WiredFurniConditionInputGuard.sanitizeItemIds(data.itemIds, WiredManager.MAXIMUM_FURNI_SELECTION)) {
                 HabboItem item = room.getHabboItem(id);
 
                 if (item != null) {
@@ -107,23 +110,19 @@ public class WiredConditionFurniHaveHabbo extends InteractionWiredCondition {
         } else {
             String[] data = wiredData.split(":");
 
-            if (data.length >= 1) {
+            if (data.length >= 2) {
+                for (int id : WiredFurniConditionInputGuard.parseLegacyItemIds(data[1], WiredManager.MAXIMUM_FURNI_SELECTION)) {
+                    HabboItem item = room.getHabboItem(id);
 
-                String[] items = data[1].split(";");
+                    if (item != null) {
-
-                for (String s : items) {
-                    HabboItem item = room.getHabboItem(Integer.parseInt(s));
-
-                    if (item != null)
                         this.items.add(item);
+                    }
                 }
             }
             this.furniSource = this.items.isEmpty() ? WiredSourceUtil.SOURCE_TRIGGER : WiredSourceUtil.SOURCE_SELECTED;
             this.all = false;
         }
-        if (this.furniSource == WiredSourceUtil.SOURCE_TRIGGER && !this.items.isEmpty()) {
+        this.furniSource = WiredFurniConditionInputGuard.selectedOrNormalizedFurniSource(this.furniSource, !this.items.isEmpty());
-            this.furniSource = WiredSourceUtil.SOURCE_SELECTED;
-        }
     }
 
     @Override
@@ -162,11 +161,9 @@ public class WiredConditionFurniHaveHabbo extends InteractionWiredCondition {
 
         int[] params = settings.getIntParams();
         this.all = (params.length > 0) && (params[0] == 1);
-        this.furniSource = (params.length > 1) ? params[1] : ((params.length > 0 && params[0] > 1) ? params[0] : WiredSourceUtil.SOURCE_TRIGGER);
+        this.furniSource = (params.length > 1) ? WiredFurniConditionInputGuard.normalizeFurniSource(params[1]) : ((params.length > 0 && params[0] > 1) ? WiredFurniConditionInputGuard.normalizeFurniSource(params[0]) : WiredSourceUtil.SOURCE_TRIGGER);
 
-        if (count > 0 && this.furniSource == WiredSourceUtil.SOURCE_TRIGGER) {
+        this.furniSource = WiredFurniConditionInputGuard.selectedOrNormalizedFurniSource(this.furniSource, count > 0);
-            this.furniSource = WiredSourceUtil.SOURCE_SELECTED;
-        }
 
         this.items.clear();
 
@@ -186,6 +183,18 @@ public class WiredConditionFurniHaveHabbo extends InteractionWiredCondition {
         return true;
     }
 
+    int normalizeFurniSource(int value) {
+        switch (value) {
+            case WiredSourceUtil.SOURCE_SELECTED:
+            case WiredSourceUtil.SOURCE_SELECTOR:
+            case WiredSourceUtil.SOURCE_SIGNAL:
+            case WiredSourceUtil.SOURCE_TRIGGER:
+                return value;
+            default:
+                return WiredSourceUtil.SOURCE_TRIGGER;
+        }
+    }
+
     protected boolean hasAvatarOnItem(HabboItem item, Room room, Collection<Habbo> habbos, Collection<Bot> bots, Collection<Pet> pets) {
         RoomTile baseTile = room.getLayout().getTile(item.getX(), item.getY());
         if (baseTile == null) return false;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionFurniTypeMatch.java

@@ -52,6 +52,10 @@ public class WiredConditionFurniTypeMatch extends InteractionWiredCondition {
 
     @Override
     public boolean evaluate(WiredContext ctx) {
+        if (ctx == null) {
+            return false;
+        }
+
         if (this.quantifier == QUANTIFIER_ANY) {
             return this.evaluateAnyMatches(ctx);
         }
@@ -158,7 +162,14 @@ public class WiredConditionFurniTypeMatch extends InteractionWiredCondition {
         }
 
         if (wiredData.startsWith("{")) {
-            JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            JsonData data;
+            try {
+                data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            } catch (RuntimeException exception) {
+                this.onPickUp();
+                return;
+            }
+
             if (data == null) {
                 return;
             }
@@ -310,8 +321,8 @@ public class WiredConditionFurniTypeMatch extends InteractionWiredCondition {
         }
     }
 
-    private void loadItems(Room room, List<Integer> itemIds, THashSet<HabboItem> target) {
+    void loadItems(Room room, List<Integer> itemIds, THashSet<HabboItem> target) {
-        if (itemIds == null) {
+        if (room == null || itemIds == null || target == null) {
             return;
         }
 
@@ -335,7 +346,7 @@ public class WiredConditionFurniTypeMatch extends InteractionWiredCondition {
                 .collect(Collectors.joining(";"));
     }
 
-    private List<Integer> parseIds(String value) {
+    List<Integer> parseIds(String value) {
         List<Integer> result = new ArrayList<>();
         if (value == null || value.isEmpty()) {
             return result;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionHabboCount.java

@@ -16,6 +16,7 @@ import java.sql.SQLException;
 
 public class WiredConditionHabboCount extends InteractionWiredCondition {
     public static final WiredConditionType type = WiredConditionType.USER_COUNT;
+    static final int MAX_USER_COUNT_LIMIT = 1000;
 
     private int lowerLimit = 0;
     private int upperLimit = 50;
@@ -31,6 +32,10 @@ public class WiredConditionHabboCount extends InteractionWiredCondition {
 
     @Override
     public boolean evaluate(WiredContext ctx) {
+        if (ctx == null || ctx.room() == null) {
+            return false;
+        }
+
         int count = (this.userSource == WiredSourceUtil.SOURCE_TRIGGER)
                 ? ctx.room().getUserCount()
                 : WiredSourceUtil.resolveUsers(ctx, this.userSource).size();
@@ -55,20 +60,29 @@ public class WiredConditionHabboCount extends InteractionWiredCondition {
 
     @Override
     public void loadWiredData(ResultSet set, Room room) throws SQLException {
+        this.onPickUp();
+
         String wiredData = set.getString("wired_data");
+        if (wiredData == null || wiredData.isEmpty()) {
+            return;
+        }
 
         if (wiredData.startsWith("{")) {
             JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
-            this.lowerLimit = data.lowerLimit;
+            this.applyLimits(data.lowerLimit, data.upperLimit);
-            this.upperLimit = data.upperLimit;
+            this.userSource = WiredConditionInputGuard.normalizeUserSource(data.userSource);
-            this.userSource = data.userSource;
         } else {
             String[] data = wiredData.split(":");
 
-            this.lowerLimit = Integer.parseInt(data[0]);
+            if (data.length >= 2) {
-            this.upperLimit = Integer.parseInt(data[1]);
+                try {
-            this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
+                    this.applyLimits(Integer.parseInt(data[0].trim()), Integer.parseInt(data[1].trim()));
+                } catch (NumberFormatException ignored) {
+                    // malformed legacy data — keep the constructed defaults
+                }
+            }
         }
+        this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
     }
 
     @Override
@@ -104,14 +118,19 @@ public class WiredConditionHabboCount extends InteractionWiredCondition {
     @Override
     public boolean saveData(WiredSettings settings) {
         if(settings.getIntParams().length < 2) return false;
-        this.lowerLimit = settings.getIntParams()[0];
-        this.upperLimit = settings.getIntParams()[1];
         int[] params = settings.getIntParams();
-        this.userSource = (params.length > 2) ? params[2] : WiredSourceUtil.SOURCE_TRIGGER;
+        this.applyLimits(params[0], params[1]);
+        this.userSource = (params.length > 2) ? WiredConditionInputGuard.normalizeUserSource(params[2]) : WiredSourceUtil.SOURCE_TRIGGER;
 
         return true;
     }
 
+    private void applyLimits(int lowerLimit, int upperLimit) {
+        int[] limits = WiredConditionInputGuard.normalizeUserCountRange(lowerLimit, upperLimit);
+        this.lowerLimit = limits[0];
+        this.upperLimit = limits[1];
+    }
+
     static class JsonData {
         int lowerLimit;
         int upperLimit;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionHabboHasEffect.java

@@ -18,6 +18,7 @@ import java.util.List;
 public class WiredConditionHabboHasEffect extends InteractionWiredCondition {
     protected static final int QUANTIFIER_ALL = 0;
     protected static final int QUANTIFIER_ANY = 1;
+    protected static final int MAX_EFFECT_ID = 10_000;
 
     public static final WiredConditionType type = WiredConditionType.ACTOR_WEARS_EFFECT;
 
@@ -86,15 +87,34 @@ public class WiredConditionHabboHasEffect extends InteractionWiredCondition {
 
     @Override
     public void loadWiredData(ResultSet set, Room room) throws SQLException {
+        this.onPickUp();
         String wiredData = set.getString("wired_data");
+        if (wiredData == null || wiredData.isEmpty()) {
+            this.onPickUp();
+            return;
+        }
 
         if (wiredData.startsWith("{")) {
-            JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            JsonData data;
-            this.effectId = data.effectId;
+            try {
-            this.userSource = data.userSource;
+                data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            } catch (RuntimeException ignored) {
+                this.onPickUp();
+                return;
+            }
+            if (data == null) {
+                this.onPickUp();
+                return;
+            }
+            this.effectId = WiredUserConditionInputGuard.normalizeEffectId(data.effectId);
+            this.userSource = WiredUserConditionInputGuard.normalizeUserSource(data.userSource);
             this.quantifier = this.normalizeQuantifier(data.quantifier, QUANTIFIER_ANY);
         } else {
-            this.effectId = Integer.parseInt(wiredData);
+            try {
+                this.effectId = WiredUserConditionInputGuard.normalizeEffectId(Integer.parseInt(wiredData));
+            } catch (NumberFormatException ignored) {
+                this.effectId = 0;
+            }
             this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
             this.quantifier = QUANTIFIER_ANY;
         }
@@ -134,8 +154,8 @@ public class WiredConditionHabboHasEffect extends InteractionWiredCondition {
     public boolean saveData(WiredSettings settings) {
         if(settings.getIntParams().length < 1) return false;
         int[] params = settings.getIntParams();
-        this.effectId = params[0];
+        this.effectId = WiredUserConditionInputGuard.normalizeEffectId(params[0]);
-        this.userSource = (params.length > 1) ? params[1] : WiredSourceUtil.SOURCE_TRIGGER;
+        this.userSource = (params.length > 1) ? WiredUserConditionInputGuard.normalizeUserSource(params[1]) : WiredSourceUtil.SOURCE_TRIGGER;
         this.quantifier = (params.length > 2) ? this.normalizeQuantifier(params[2], QUANTIFIER_ANY) : QUANTIFIER_ANY;
 
         return true;
@@ -153,6 +173,14 @@ public class WiredConditionHabboHasEffect extends InteractionWiredCondition {
         return (value == QUANTIFIER_ANY) ? QUANTIFIER_ANY : QUANTIFIER_ALL;
     }
 
+    protected int normalizeEffectId(int value) {
+        return Math.max(0, Math.min(MAX_EFFECT_ID, value));
+    }
+
+    protected int normalizeUserSource(int value) {
+        return WiredSourceUtil.isDefaultUserSource(value) ? value : WiredSourceUtil.SOURCE_TRIGGER;
+    }
+
     static class JsonData {
         int effectId;
         int userSource;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionHabboHasHandItem.java

@@ -10,17 +10,15 @@ import com.eu.habbo.habbohotel.wired.core.WiredManager;
 import com.eu.habbo.habbohotel.wired.core.WiredContext;
 import com.eu.habbo.habbohotel.wired.core.WiredSourceUtil;
 import com.eu.habbo.messages.ServerMessage;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.util.List;
 
 public class WiredConditionHabboHasHandItem extends InteractionWiredCondition {
-    private static final Logger LOGGER = LoggerFactory.getLogger(WiredConditionHabboHasHandItem.class);
     protected static final int QUANTIFIER_ALL = 0;
     protected static final int QUANTIFIER_ANY = 1;
+    protected static final int MAX_HAND_ITEM_ID = 10_000;
 
     public static final WiredConditionType type = WiredConditionType.ACTOR_HAS_HANDITEM;
 
@@ -62,9 +60,9 @@ public class WiredConditionHabboHasHandItem extends InteractionWiredCondition {
     @Override
     public boolean saveData(WiredSettings settings) {
         if(settings.getIntParams().length < 1) return false;
-        this.handItem = this.normalizeHandItem(settings.getIntParams()[0]);
+        this.handItem = WiredUserConditionInputGuard.normalizeHandItemId(settings.getIntParams()[0]);
         int[] params = settings.getIntParams();
-        this.userSource = (params.length > 1) ? params[1] : WiredSourceUtil.SOURCE_TRIGGER;
+        this.userSource = (params.length > 1) ? WiredUserConditionInputGuard.normalizeUserSource(params[1]) : WiredSourceUtil.SOURCE_TRIGGER;
         this.quantifier = (params.length > 2) ? this.normalizeQuantifier(params[2]) : QUANTIFIER_ALL;
 
         return true;
@@ -99,21 +97,35 @@ public class WiredConditionHabboHasHandItem extends InteractionWiredCondition {
 
     @Override
     public void loadWiredData(ResultSet set, Room room) throws SQLException {
-        try {
+        String wiredData = set.getString("wired_data");
-            String wiredData = set.getString("wired_data");
+        if (wiredData == null || wiredData.isEmpty()) {
+            this.onPickUp();
+            return;
+        }
 
-            if (wiredData.startsWith("{")) {
+        if (wiredData.startsWith("{")) {
-                JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            JsonData data;
-                this.handItem = this.normalizeHandItem(data.handItemId);
+            try {
-                this.userSource = data.userSource;
+                data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
-                this.quantifier = this.normalizeQuantifier(data.quantifier);
+            } catch (RuntimeException ignored) {
-            } else {
+                this.onPickUp();
-                this.handItem = this.normalizeHandItem(Integer.parseInt(wiredData));
+                return;
-                this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
-                this.quantifier = QUANTIFIER_ALL;
             }
-        } catch (Exception e) {
+            if (data == null) {
-            LOGGER.error("Caught exception", e);
+                this.onPickUp();
+                return;
+            }
+            this.handItem = WiredUserConditionInputGuard.normalizeHandItemId(data.handItemId);
+            this.userSource = WiredUserConditionInputGuard.normalizeUserSource(data.userSource);
+            this.quantifier = this.normalizeQuantifier(data.quantifier);
+        } else {
+            try {
+                this.handItem = WiredUserConditionInputGuard.normalizeHandItemId(Integer.parseInt(wiredData));
+            } catch (NumberFormatException ignored) {
+                this.handItem = 0;
+            }
+            this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
+            this.quantifier = QUANTIFIER_ALL;
         }
     }
 
@@ -156,14 +168,14 @@ public class WiredConditionHabboHasHandItem extends InteractionWiredCondition {
         return true;
     }
 
-    protected int normalizeHandItem(int value) {
-        return Math.max(0, value);
-    }
-
     protected int normalizeQuantifier(int value) {
         return (value == QUANTIFIER_ANY) ? QUANTIFIER_ANY : QUANTIFIER_ALL;
     }
 
+    protected int normalizeUserSource(int value) {
+        return WiredSourceUtil.isDefaultUserSource(value) ? value : WiredSourceUtil.SOURCE_TRIGGER;
+    }
+
     static class JsonData {
         int handItemId;
         int userSource;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionHabboWearsBadge.java

@@ -20,6 +20,7 @@ import java.util.List;
 public class WiredConditionHabboWearsBadge extends InteractionWiredCondition {
     protected static final int QUANTIFIER_ALL = 0;
     protected static final int QUANTIFIER_ANY = 1;
+    protected static final int MAX_BADGE_CODE_LENGTH = 64;
 
     public static final WiredConditionType type = WiredConditionType.ACTOR_WEARS_BADGE;
 
@@ -37,6 +38,10 @@ public class WiredConditionHabboWearsBadge extends InteractionWiredCondition {
 
     @Override
     public boolean evaluate(WiredContext ctx) {
+        if (ctx == null || ctx.room() == null) {
+            return false;
+        }
+
         Room room = ctx.room();
         List<RoomUnit> targets = WiredSourceUtil.resolveUsers(ctx, this.userSource);
         if (targets.isEmpty()) return false;
@@ -102,15 +107,30 @@ public class WiredConditionHabboWearsBadge extends InteractionWiredCondition {
 
     @Override
     public void loadWiredData(ResultSet set, Room room) throws SQLException {
+        this.onPickUp();
         String wiredData = set.getString("wired_data");
+        if (wiredData == null) {
+            this.onPickUp();
+            return;
+        }
 
         if (wiredData.startsWith("{")) {
-            JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            JsonData data;
-            this.badge = data.badge;
+            try {
-            this.userSource = data.userSource;
+                data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            } catch (RuntimeException ignored) {
+                this.onPickUp();
+                return;
+            }
+            if (data == null) {
+                this.onPickUp();
+                return;
+            }
+            this.badge = WiredUserConditionInputGuard.normalizeBadgeCode(data.badge);
+            this.userSource = WiredUserConditionInputGuard.normalizeUserSource(data.userSource);
             this.quantifier = this.normalizeQuantifier(data.quantifier, QUANTIFIER_ANY);
         } else {
-            this.badge = wiredData;
+            this.badge = WiredUserConditionInputGuard.normalizeBadgeCode(wiredData);
             this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
             this.quantifier = QUANTIFIER_ANY;
         }
@@ -147,9 +167,9 @@ public class WiredConditionHabboWearsBadge extends InteractionWiredCondition {
 
     @Override
     public boolean saveData(WiredSettings settings) {
-        this.badge = settings.getStringParam();
+        this.badge = WiredUserConditionInputGuard.normalizeBadgeCode(settings.getStringParam());
         int[] params = settings.getIntParams();
-        this.userSource = (params.length > 0) ? params[0] : WiredSourceUtil.SOURCE_TRIGGER;
+        this.userSource = (params.length > 0) ? WiredUserConditionInputGuard.normalizeUserSource(params[0]) : WiredSourceUtil.SOURCE_TRIGGER;
         this.quantifier = (params.length > 1) ? this.normalizeQuantifier(params[1], QUANTIFIER_ANY) : QUANTIFIER_ANY;
 
         return true;
@@ -167,6 +187,19 @@ public class WiredConditionHabboWearsBadge extends InteractionWiredCondition {
         return (value == QUANTIFIER_ANY) ? QUANTIFIER_ANY : QUANTIFIER_ALL;
     }
 
+    protected String normalizeBadge(String value) {
+        if (value == null) {
+            return "";
+        }
+
+        String normalized = value.trim();
+        return normalized.length() <= MAX_BADGE_CODE_LENGTH ? normalized : normalized.substring(0, MAX_BADGE_CODE_LENGTH);
+    }
+
+    protected int normalizeUserSource(int value) {
+        return WiredSourceUtil.isDefaultUserSource(value) ? value : WiredSourceUtil.SOURCE_TRIGGER;
+    }
+
     static class JsonData {
         String badge;
         int userSource;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionHasAltitude.java

@@ -97,7 +97,14 @@ public class WiredConditionHasAltitude extends InteractionWiredCondition {
             return;
         }
 
-        JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        JsonData data;
+        try {
+            data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        } catch (RuntimeException exception) {
+            this.onPickUp();
+            return;
+        }
+
         if (data == null) {
             return;
         }
@@ -112,6 +119,10 @@ public class WiredConditionHasAltitude extends InteractionWiredCondition {
         }
 
         for (Integer id : data.itemIds) {
+            if (id == null) {
+                continue;
+            }
+
             HabboItem item = room.getHabboItem(id);
             if (item != null) {
                 this.items.add(item);
@@ -225,7 +236,7 @@ public class WiredConditionHasAltitude extends InteractionWiredCondition {
         }
     }
 
-    private int normalizeComparison(int value) {
+    int normalizeComparison(int value) {
         if (value < COMPARISON_LESS || value > COMPARISON_GREATER) {
             return COMPARISON_EQUAL;
         }
@@ -233,11 +244,11 @@ public class WiredConditionHasAltitude extends InteractionWiredCondition {
         return value;
     }
 
-    private int normalizeQuantifier(int value) {
+    int normalizeQuantifier(int value) {
         return (value == QUANTIFIER_ANY) ? QUANTIFIER_ANY : QUANTIFIER_ALL;
     }
 
-    private int normalizeFurniSource(int value) {
+    int normalizeFurniSource(int value) {
         switch (value) {
             case WiredSourceUtil.SOURCE_SELECTED:
             case WiredSourceUtil.SOURCE_SELECTOR:
@@ -249,12 +260,12 @@ public class WiredConditionHasAltitude extends InteractionWiredCondition {
         }
     }
 
-    private double normalizeAltitude(double value) {
+    double normalizeAltitude(double value) {
         double clampedValue = Math.max(0.0D, Math.min(Room.MAXIMUM_FURNI_HEIGHT, value));
         return BigDecimal.valueOf(clampedValue).setScale(2, RoundingMode.HALF_UP).doubleValue();
     }
 
-    private double parseAltitudeOrDefault(String value) {
+    double parseAltitudeOrDefault(String value) {
         if (value == null || value.trim().isEmpty()) {
             return 0.0D;
         }
@@ -266,7 +277,7 @@ public class WiredConditionHasAltitude extends InteractionWiredCondition {
         }
     }
 
-    private String formatAltitude(double value) {
+    String formatAltitude(double value) {
         BigDecimal decimal = BigDecimal.valueOf(this.normalizeAltitude(value)).stripTrailingZeros();
         return (decimal.scale() < 0 ? decimal.setScale(0, RoundingMode.DOWN) : decimal).toPlainString();
     }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionInputGuard.java

@@ -0,0 +1,57 @@
+package com.eu.habbo.habbohotel.items.interactions.wired.conditions;
+
+import com.eu.habbo.habbohotel.games.GameTeamColors;
+import com.eu.habbo.habbohotel.wired.core.WiredSourceUtil;
+
+public final class WiredConditionInputGuard {
+    public static final int MAX_USER_COUNT_LIMIT = 1000;
+    public static final int MAX_TIMER_CYCLES = 24 * 60 * 60 * 2;
+
+    private WiredConditionInputGuard() {
+    }
+
+    public static GameTeamColors normalizeTeamColor(GameTeamColors value, GameTeamColors fallback) {
+        return (value != null) ? value : fallback;
+    }
+
+    public static GameTeamColors normalizeTeamColorType(int value, GameTeamColors fallback) {
+        for (GameTeamColors color : GameTeamColors.values()) {
+            if (color.type == value) {
+                return color;
+            }
+        }
+
+        return fallback;
+    }
+
+    public static int normalizeUserSource(int value) {
+        return WiredSourceUtil.isDefaultUserSource(value) ? value : WiredSourceUtil.SOURCE_TRIGGER;
+    }
+
+    public static int normalizeTimerCycles(int value) {
+        if (value < 0) {
+            return 0;
+        }
+
+        return Math.min(value, MAX_TIMER_CYCLES);
+    }
+
+    public static int[] normalizeUserCountRange(int lowerLimit, int upperLimit) {
+        int lower = clampUserCount(lowerLimit);
+        int upper = clampUserCount(upperLimit);
+
+        if (lower > upper) {
+            return new int[]{upper, lower};
+        }
+
+        return new int[]{lower, upper};
+    }
+
+    private static int clampUserCount(int value) {
+        if (value < 0) {
+            return 0;
+        }
+
+        return Math.min(value, MAX_USER_COUNT_LIMIT);
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionLessTimeElapsed.java

@@ -52,12 +52,13 @@ public class WiredConditionLessTimeElapsed extends InteractionWiredCondition {
         try {
             if (wiredData.startsWith("{")) {
                 JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
-                this.cycles = data.cycles;
+                this.cycles = WiredConditionInputGuard.normalizeTimerCycles(data.cycles);
             } else {
                 if (!wiredData.equals(""))
-                    this.cycles = Integer.parseInt(wiredData);
+                    this.cycles = WiredConditionInputGuard.normalizeTimerCycles(Integer.parseInt(wiredData));
             }
         } catch (Exception e) {
+            this.cycles = 0;
         }
     }
 
@@ -90,10 +91,14 @@ public class WiredConditionLessTimeElapsed extends InteractionWiredCondition {
     @Override
     public boolean saveData(WiredSettings settings) {
         if(settings.getIntParams().length < 1) return false;
-        this.cycles = settings.getIntParams()[0];
+        this.cycles = WiredConditionInputGuard.normalizeTimerCycles(settings.getIntParams()[0]);
         return true;
     }
 
+    int normalizeCycles(int value) {
+        return Math.max(0, Math.min(WiredConditionMoreTimeElapsed.MAX_CYCLES, value));
+    }
+
     static class JsonData {
         int cycles;
 

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionMatchDate.java

@@ -125,7 +125,14 @@ public class WiredConditionMatchDate extends InteractionWiredCondition {
         }
 
         if (wiredData.startsWith("{")) {
-            JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            JsonData data;
+            try {
+                data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            } catch (RuntimeException exception) {
+                this.reset();
+                return;
+            }
+
             if (data == null) {
                 return;
             }
@@ -193,7 +200,7 @@ public class WiredConditionMatchDate extends InteractionWiredCondition {
         }
     }
 
-    private int normalizeMode(int value) {
+    int normalizeMode(int value) {
         if (value < MODE_SKIP || value > MODE_RANGE) {
             return MODE_SKIP;
         }
@@ -201,20 +208,20 @@ public class WiredConditionMatchDate extends InteractionWiredCondition {
         return value;
     }
 
-    private int normalizeDay(int value) {
+    int normalizeDay(int value) {
         return Math.max(1, Math.min(31, value));
     }
 
-    private int normalizeYear(int value) {
+    int normalizeYear(int value) {
         return Math.max(1, Math.min(9999, value));
     }
 
-    private int normalizeWeekdayMask(int value) {
+    int normalizeWeekdayMask(int value) {
         int normalized = value & ALL_WEEKDAYS_MASK;
         return (normalized == 0) ? ALL_WEEKDAYS_MASK : normalized;
     }
 
-    private int normalizeMonthMask(int value) {
+    int normalizeMonthMask(int value) {
         int normalized = value & ALL_MONTHS_MASK;
         return (normalized == 0) ? ALL_MONTHS_MASK : normalized;
     }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionMatchStatePosition.java

@@ -87,7 +87,7 @@ public class WiredConditionMatchStatePosition extends InteractionWiredCondition
         this.direction = params[1] == 1;
         this.position = params[2] == 1;
         this.altitude = (params.length > 3) && (params[3] == 1);
-        this.furniSource = (params.length > 4) ? params[4] : ((params.length > 3 && params[3] > 1) ? params[3] : WiredSourceUtil.SOURCE_TRIGGER);
+        this.furniSource = (params.length > 4) ? WiredMatchPositionInputGuard.normalizeFurniSource(params[4], false) : ((params.length > 3 && params[3] > 1) ? WiredMatchPositionInputGuard.normalizeFurniSource(params[3], false) : WiredSourceUtil.SOURCE_TRIGGER);
         this.quantifier = (params.length > 5) ? this.normalizeQuantifier(params[5]) : QUANTIFIER_ALL;
 
         Room room = Emulator.getGameEnvironment().getRoomManager().getRoom(this.getRoomId());
@@ -108,11 +108,17 @@ public class WiredConditionMatchStatePosition extends InteractionWiredCondition
                 this.settings.add(new WiredMatchFurniSetting(item.getId(), item.getExtradata(), item.getRotation(), item.getX(), item.getY(), item.getZ()));
         }
 
+        this.furniSource = WiredMatchPositionInputGuard.normalizeFurniSource(this.furniSource, !this.settings.isEmpty());
+
         return true;
     }
 
     @Override
     public boolean evaluate(WiredContext ctx) {
+        if (ctx == null || ctx.room() == null) {
+            return false;
+        }
+
         this.refresh();
 
         if (this.settings.isEmpty())
@@ -126,6 +132,10 @@ public class WiredConditionMatchStatePosition extends InteractionWiredCondition
     }
 
     protected boolean evaluateAllTargetsMatch(WiredContext ctx) {
+        if (ctx == null || ctx.room() == null) {
+            return false;
+        }
+
         Room room = ctx.room();
 
         if (this.furniSource != WiredSourceUtil.SOURCE_SELECTED) {
@@ -159,6 +169,10 @@ public class WiredConditionMatchStatePosition extends InteractionWiredCondition
     }
 
     protected boolean evaluateAnyTargetMatches(WiredContext ctx) {
+        if (ctx == null || ctx.room() == null) {
+            return false;
+        }
+
         Room room = ctx.room();
 
         if (this.furniSource != WiredSourceUtil.SOURCE_SELECTED) {
@@ -247,44 +261,84 @@ public class WiredConditionMatchStatePosition extends InteractionWiredCondition
 
     @Override
     public void loadWiredData(ResultSet set, Room room) throws SQLException {
+        this.onPickUp();
         String wiredData = set.getString("wired_data");
+        if (wiredData == null || wiredData.isEmpty()) {
+            return;
+        }
 
         if (wiredData.startsWith("{")) {
-            JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            JsonData data;
+            try {
+                data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            } catch (RuntimeException exception) {
+                this.onPickUp();
+                return;
+            }
+
+            if (data == null) {
+                return;
+            }
+
             this.state = data.state;
             this.position = data.position;
             this.direction = data.direction;
             this.altitude = data.altitude;
-            if (data.settings != null) {
+            this.settings.addAll(WiredMatchPositionInputGuard.sanitizeSettings(data.settings, room));
-                this.settings.addAll(data.settings);
+            this.furniSource = WiredMatchPositionInputGuard.normalizeFurniSource(data.furniSource, !this.settings.isEmpty());
-            }
-            this.furniSource = data.furniSource;
             this.quantifier = this.normalizeQuantifier(data.quantifier);
         } else {
             String[] data = wiredData.split(":");
 
-            int itemCount = Integer.parseInt(data[0]);
+            if (data.length >= 5) {
+                try {
+                    int itemCount = Math.min(Integer.parseInt(data[0]), WiredManager.MAXIMUM_FURNI_SELECTION);
 
-            String[] items = data[1].split(";");
+                    String[] items = data[1].split(";");
 
-            for (int i = 0; i < itemCount; i++) {
+                    for (int i = 0; i < itemCount && i < items.length; i++) {
-                String[] stuff = items[i].split("-");
+                        WiredMatchFurniSetting setting = this.parseLegacySetting(items[i], room);
+                        if (setting != null) {
+                            this.settings.add(setting);
+                        }
+                    }
 
-                if (stuff.length >= 6)
+                    this.state = data[2].equals("1");
-                    this.settings.add(new WiredMatchFurniSetting(Integer.parseInt(stuff[0]), stuff[1], Integer.parseInt(stuff[2]), Integer.parseInt(stuff[3]), Integer.parseInt(stuff[4]), Double.parseDouble(stuff[5])));
+                    this.direction = data[3].equals("1");
-                else if (stuff.length >= 5)
+                    this.position = data[4].equals("1");
-                    this.settings.add(new WiredMatchFurniSetting(Integer.parseInt(stuff[0]), stuff[1], Integer.parseInt(stuff[2]), Integer.parseInt(stuff[3]), Integer.parseInt(stuff[4])));
+                } catch (NumberFormatException ignored) {
+                    // malformed legacy data — keep whatever was parsed plus defaults
+                }
             }
 
-            this.state = data[2].equals("1");
-            this.direction = data[3].equals("1");
-            this.position = data[4].equals("1");
             this.altitude = false;
-            this.furniSource = this.settings.isEmpty() ? WiredSourceUtil.SOURCE_TRIGGER : WiredSourceUtil.SOURCE_SELECTED;
+            this.furniSource = WiredMatchPositionInputGuard.normalizeFurniSource(WiredSourceUtil.SOURCE_TRIGGER, !this.settings.isEmpty());
             this.quantifier = QUANTIFIER_ALL;
         }
     }
 
+    private WiredMatchFurniSetting parseLegacySetting(String value, Room room) {
+        String[] parts = value.split("-", 6);
+        if (parts.length < 5) {
+            return null;
+        }
+
+        try {
+            double z = (parts.length >= 6) ? Double.parseDouble(parts[5]) : 0.0D;
+            return WiredMatchPositionInputGuard.sanitizeParts(
+                    Integer.parseInt(parts[0]),
+                    parts[1],
+                    Integer.parseInt(parts[2]),
+                    Integer.parseInt(parts[3]),
+                    Integer.parseInt(parts[4]),
+                    z,
+                    room
+            );
+        } catch (NumberFormatException ignored) {
+            return null;
+        }
+    }
+
     @Override
     public void onPickUp() {
         this.settings.clear();
@@ -296,10 +350,58 @@ public class WiredConditionMatchStatePosition extends InteractionWiredCondition
         this.quantifier = QUANTIFIER_ALL;
     }
 
-    private int normalizeQuantifier(int value) {
+    int normalizeQuantifier(int value) {
         return (value == QUANTIFIER_ANY) ? QUANTIFIER_ANY : QUANTIFIER_ALL;
     }
 
+    int normalizeFurniSource(int value) {
+        switch (value) {
+            case WiredSourceUtil.SOURCE_TRIGGER:
+            case WiredSourceUtil.SOURCE_SELECTED:
+            case WiredSourceUtil.SOURCE_SELECTOR:
+            case WiredSourceUtil.SOURCE_SIGNAL:
+                return value;
+            default:
+                return WiredSourceUtil.SOURCE_TRIGGER;
+        }
+    }
+
+    WiredMatchFurniSetting normalizeSetting(WiredMatchFurniSetting setting) {
+        if (setting == null || setting.item_id <= 0) {
+            return null;
+        }
+
+        int rotation = Math.max(0, Math.min(7, setting.rotation));
+        int x = Math.max(0, setting.x);
+        int y = Math.max(0, setting.y);
+        double z = Math.max(0.0D, Math.min(Room.MAXIMUM_FURNI_HEIGHT, setting.z));
+
+        return new WiredMatchFurniSetting(setting.item_id, setting.state, rotation, x, y, z);
+    }
+
+    WiredMatchFurniSetting parseLegacySetting(String[] values) {
+        if (values == null || values.length < 5) {
+            return null;
+        }
+
+        try {
+            int itemId = Integer.parseInt(values[0]);
+            if (itemId <= 0) {
+                return null;
+            }
+
+            String state = values[1];
+            int rotation = Integer.parseInt(values[2]);
+            int x = Integer.parseInt(values[3]);
+            int y = Integer.parseInt(values[4]);
+            double z = values.length >= 6 ? Double.parseDouble(values[5]) : 0.0D;
+
+            return this.normalizeSetting(new WiredMatchFurniSetting(itemId, state, rotation, x, y, z));
+        } catch (RuntimeException exception) {
+            return null;
+        }
+    }
+
     protected void refresh() {
         Room room = Emulator.getGameEnvironment().getRoomManager().getRoom(this.getRoomId());
 

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionMatchTime.java

@@ -126,7 +126,14 @@ public class WiredConditionMatchTime extends InteractionWiredCondition {
         }
 
         if (wiredData.startsWith("{")) {
-            JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            JsonData data;
+            try {
+                data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+            } catch (RuntimeException exception) {
+                this.reset();
+                return;
+            }
+
             if (data == null) {
                 return;
             }
@@ -195,7 +202,7 @@ public class WiredConditionMatchTime extends InteractionWiredCondition {
         }
     }
 
-    private int normalizeMode(int value) {
+    int normalizeMode(int value) {
         if (value < MODE_SKIP || value > MODE_RANGE) {
             return MODE_SKIP;
         }
@@ -203,11 +210,11 @@ public class WiredConditionMatchTime extends InteractionWiredCondition {
         return value;
     }
 
-    private int normalizeHour(int value) {
+    int normalizeHour(int value) {
         return Math.max(0, Math.min(23, value));
     }
 
-    private int normalizeMinuteOrSecond(int value) {
+    int normalizeMinuteOrSecond(int value) {
         return Math.max(0, Math.min(59, value));
     }
 

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionMoreTimeElapsed.java

@@ -16,6 +16,7 @@ import java.sql.SQLException;
 
 public class WiredConditionMoreTimeElapsed extends InteractionWiredCondition {
     private static final WiredConditionType type = WiredConditionType.TIME_MORE_THAN;
+    static final int MAX_CYCLES = 1_000_000;
 
     private int cycles;
 
@@ -52,12 +53,13 @@ public class WiredConditionMoreTimeElapsed extends InteractionWiredCondition {
         try {
             if (wiredData.startsWith("{")) {
                 JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
-                this.cycles = data.cycles;
+                this.cycles = WiredConditionInputGuard.normalizeTimerCycles(data.cycles);
             } else {
                 if (!wiredData.equals(""))
-                    this.cycles = Integer.parseInt(wiredData);
+                    this.cycles = WiredConditionInputGuard.normalizeTimerCycles(Integer.parseInt(wiredData));
             }
         } catch (Exception e) {
+            this.cycles = 0;
         }
     }
 
@@ -90,10 +92,14 @@ public class WiredConditionMoreTimeElapsed extends InteractionWiredCondition {
     @Override
     public boolean saveData(WiredSettings settings) {
         if(settings.getIntParams().length < 1) return false;
-        this.cycles = settings.getIntParams()[0];
+        this.cycles = WiredConditionInputGuard.normalizeTimerCycles(settings.getIntParams()[0]);
         return true;
     }
 
+    int normalizeCycles(int value) {
+        return Math.max(0, Math.min(MAX_CYCLES, value));
+    }
+
     static class JsonData {
         int cycles;
 

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionNotFurniHaveFurni.java

@@ -99,9 +99,9 @@ public class WiredConditionNotFurniHaveFurni extends InteractionWiredCondition {
         if (wiredData.startsWith("{")) {
             JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
             this.all = data.all;
-            this.furniSource = data.furniSource;
+            this.furniSource = WiredFurniConditionInputGuard.normalizeFurniSource(data.furniSource);
 
-            for (int id : data.itemIds) {
+            for (int id : WiredFurniConditionInputGuard.sanitizeItemIds(data.itemIds, WiredManager.MAXIMUM_FURNI_SELECTION)) {
                 HabboItem item = room.getHabboItem(id);
 
                 if (item != null) {
@@ -115,10 +115,8 @@ public class WiredConditionNotFurniHaveFurni extends InteractionWiredCondition {
                 this.all = (data[0].equals("1"));
 
                 if (data.length == 2) {
-                    String[] items = data[1].split(";");
+                    for (int id : WiredFurniConditionInputGuard.parseLegacyItemIds(data[1], WiredManager.MAXIMUM_FURNI_SELECTION)) {
-
+                        HabboItem item = room.getHabboItem(id);
-                    for (String s : items) {
-                        HabboItem item = room.getHabboItem(Integer.parseInt(s));
 
                         if (item != null)
                             this.items.add(item);
@@ -127,9 +125,7 @@ public class WiredConditionNotFurniHaveFurni extends InteractionWiredCondition {
             }
             this.furniSource = this.items.isEmpty() ? WiredSourceUtil.SOURCE_TRIGGER : WiredSourceUtil.SOURCE_SELECTED;
         }
-        if (this.furniSource == WiredSourceUtil.SOURCE_TRIGGER && !this.items.isEmpty()) {
+        this.furniSource = WiredFurniConditionInputGuard.selectedOrNormalizedFurniSource(this.furniSource, !this.items.isEmpty());
-            this.furniSource = WiredSourceUtil.SOURCE_SELECTED;
-        }
     }
 
     @Override
@@ -172,14 +168,12 @@ public class WiredConditionNotFurniHaveFurni extends InteractionWiredCondition {
         if(settings.getIntParams().length < 1) return false;
         int[] params = settings.getIntParams();
         this.all = params[0] == 1;
-        this.furniSource = (params.length > 1) ? params[1] : WiredSourceUtil.SOURCE_TRIGGER;
+        this.furniSource = (params.length > 1) ? WiredFurniConditionInputGuard.normalizeFurniSource(params[1]) : WiredSourceUtil.SOURCE_TRIGGER;
 
         int count = settings.getFurniIds().length;
         if (count > Emulator.getConfig().getInt("hotel.wired.furni.selection.count")) return false;
 
-        if (count > 0 && this.furniSource == WiredSourceUtil.SOURCE_TRIGGER) {
+        this.furniSource = WiredFurniConditionInputGuard.selectedOrNormalizedFurniSource(this.furniSource, count > 0);
-            this.furniSource = WiredSourceUtil.SOURCE_SELECTED;
-        }
 
         this.items.clear();
 

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionNotFurniHaveHabbo.java

@@ -95,10 +95,10 @@ public class WiredConditionNotFurniHaveHabbo extends InteractionWiredCondition {
 
         if (wiredData.startsWith("{")) {
             WiredConditionFurniHaveHabbo.JsonData data = WiredManager.getGson().fromJson(wiredData, WiredConditionFurniHaveHabbo.JsonData.class);
-            this.furniSource = data.furniSource;
+            this.furniSource = WiredFurniConditionInputGuard.normalizeFurniSource(data.furniSource);
             this.all = data.all;
 
-            for(int id : data.itemIds) {
+            for(int id : WiredFurniConditionInputGuard.sanitizeItemIds(data.itemIds, WiredManager.MAXIMUM_FURNI_SELECTION)) {
                 HabboItem item = room.getHabboItem(id);
 
                 if (item != null) {
@@ -108,11 +108,9 @@ public class WiredConditionNotFurniHaveHabbo extends InteractionWiredCondition {
         } else {
             String[] data = wiredData.split(":");
 
-            if (data.length >= 1) {
+            if (data.length >= 2) {
-                String[] items = data[1].split(";");
+                for (int id : WiredFurniConditionInputGuard.parseLegacyItemIds(data[1], WiredManager.MAXIMUM_FURNI_SELECTION)) {
-
+                    HabboItem item = room.getHabboItem(id);
-                for (String s : items) {
-                    HabboItem item = room.getHabboItem(Integer.parseInt(s));
 
                     if (item != null)
                         this.items.add(item);
@@ -121,9 +119,7 @@ public class WiredConditionNotFurniHaveHabbo extends InteractionWiredCondition {
             this.furniSource = this.items.isEmpty() ? WiredSourceUtil.SOURCE_TRIGGER : WiredSourceUtil.SOURCE_SELECTED;
             this.all = false;
         }
-        if (this.furniSource == WiredSourceUtil.SOURCE_TRIGGER && !this.items.isEmpty()) {
+        this.furniSource = WiredFurniConditionInputGuard.selectedOrNormalizedFurniSource(this.furniSource, !this.items.isEmpty());
-            this.furniSource = WiredSourceUtil.SOURCE_SELECTED;
-        }
     }
 
     @Override
@@ -161,11 +157,9 @@ public class WiredConditionNotFurniHaveHabbo extends InteractionWiredCondition {
 
         int[] params = settings.getIntParams();
         this.all = (params.length > 0) && (params[0] == 1);
-        this.furniSource = (params.length > 1) ? params[1] : ((params.length > 0 && params[0] > 1) ? params[0] : WiredSourceUtil.SOURCE_TRIGGER);
+        this.furniSource = (params.length > 1) ? WiredFurniConditionInputGuard.normalizeFurniSource(params[1]) : ((params.length > 0 && params[0] > 1) ? WiredFurniConditionInputGuard.normalizeFurniSource(params[0]) : WiredSourceUtil.SOURCE_TRIGGER);
 
-        if (count > 0 && this.furniSource == WiredSourceUtil.SOURCE_TRIGGER) {
+        this.furniSource = WiredFurniConditionInputGuard.selectedOrNormalizedFurniSource(this.furniSource, count > 0);
-            this.furniSource = WiredSourceUtil.SOURCE_SELECTED;
-        }
 
         this.items.clear();
 

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionNotFurniTypeMatch.java

@@ -20,6 +20,10 @@ public class WiredConditionNotFurniTypeMatch extends WiredConditionFurniTypeMatc
 
     @Override
     public boolean evaluate(WiredContext ctx) {
+        if (ctx == null) {
+            return false;
+        }
+
         if (this.getQuantifier() == QUANTIFIER_ANY) {
             return !this.evaluateAllMatches(ctx);
         }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionNotHabboCount.java

@@ -6,8 +6,8 @@ import com.eu.habbo.habbohotel.items.interactions.wired.WiredSettings;
 import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.habbohotel.rooms.RoomUnit;
 import com.eu.habbo.habbohotel.wired.WiredConditionType;
-import com.eu.habbo.habbohotel.wired.core.WiredManager;
 import com.eu.habbo.habbohotel.wired.core.WiredContext;
+import com.eu.habbo.habbohotel.wired.core.WiredManager;
 import com.eu.habbo.habbohotel.wired.core.WiredSourceUtil;
 import com.eu.habbo.messages.ServerMessage;
 
@@ -31,6 +31,10 @@ public class WiredConditionNotHabboCount extends InteractionWiredCondition {
 
     @Override
     public boolean evaluate(WiredContext ctx) {
+        if (ctx == null || ctx.room() == null) {
+            return false;
+        }
+
         int count = (this.userSource == WiredSourceUtil.SOURCE_TRIGGER)
                 ? ctx.room().getUserCount()
                 : WiredSourceUtil.resolveUsers(ctx, this.userSource).size();
@@ -55,25 +59,34 @@ public class WiredConditionNotHabboCount extends InteractionWiredCondition {
 
     @Override
     public void loadWiredData(ResultSet set, Room room) throws SQLException {
+        this.onPickUp();
+
         String wiredData = set.getString("wired_data");
+        if (wiredData == null || wiredData.isEmpty()) {
+            return;
+        }
 
         if (wiredData.startsWith("{")) {
             WiredConditionHabboCount.JsonData data = WiredManager.getGson().fromJson(wiredData, WiredConditionHabboCount.JsonData.class);
-            this.lowerLimit = data.lowerLimit;
+            this.applyLimits(data.lowerLimit, data.upperLimit);
-            this.upperLimit = data.upperLimit;
+            this.userSource = WiredConditionInputGuard.normalizeUserSource(data.userSource);
-            this.userSource = data.userSource;
         } else {
             String[] data = wiredData.split(":");
-            this.lowerLimit = Integer.parseInt(data[0]);
+            if (data.length >= 2) {
-            this.upperLimit = Integer.parseInt(data[1]);
+                try {
-            this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
+                    this.applyLimits(Integer.parseInt(data[0].trim()), Integer.parseInt(data[1].trim()));
+                } catch (NumberFormatException ignored) {
+                    // malformed legacy data — keep the constructed defaults
+                }
+            }
         }
+        this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
     }
 
     @Override
     public void onPickUp() {
-        this.upperLimit = 0;
+        this.lowerLimit = 10;
-        this.lowerLimit = 20;
+        this.upperLimit = 20;
         this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
     }
 
@@ -103,14 +116,19 @@ public class WiredConditionNotHabboCount extends InteractionWiredCondition {
     @Override
     public boolean saveData(WiredSettings settings) {
         if(settings.getIntParams().length < 2) return false;
-        this.lowerLimit = settings.getIntParams()[0];
-        this.upperLimit = settings.getIntParams()[1];
         int[] params = settings.getIntParams();
-        this.userSource = (params.length > 2) ? params[2] : WiredSourceUtil.SOURCE_TRIGGER;
+        this.applyLimits(params[0], params[1]);
+        this.userSource = (params.length > 2) ? WiredConditionInputGuard.normalizeUserSource(params[2]) : WiredSourceUtil.SOURCE_TRIGGER;
 
         return true;
     }
 
+    private void applyLimits(int lowerLimit, int upperLimit) {
+        int[] limits = WiredConditionInputGuard.normalizeUserCountRange(lowerLimit, upperLimit);
+        this.lowerLimit = limits[0];
+        this.upperLimit = limits[1];
+    }
+
     static class JsonData {
         int lowerLimit;
         int upperLimit;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionNotMatchStatePosition.java

@@ -22,6 +22,10 @@ public class WiredConditionNotMatchStatePosition extends WiredConditionMatchStat
 
     @Override
     public boolean evaluate(WiredContext ctx) {
+        if (ctx == null || ctx.room() == null) {
+            return false;
+        }
+
         this.refresh();
 
         if (this.getMatchFurniSettings().isEmpty()) {

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionTeamGameBase.java

@@ -29,6 +29,7 @@ abstract class WiredConditionTeamGameBase extends InteractionWiredCondition {
     protected static final int COMPARISON_EQUAL = 1;
     protected static final int COMPARISON_HIGHER = 2;
     protected static final int TEAM_TRIGGERER = 0;
+    protected static final int MAX_SCORE = 1_000_000;
 
     private static final GameTeamColors[] SUPPORTED_TEAM_COLORS = new GameTeamColors[] {
             GameTeamColors.RED,
@@ -96,7 +97,11 @@ abstract class WiredConditionTeamGameBase extends InteractionWiredCondition {
     }
 
     protected int normalizeScore(int value) {
-        return Math.max(0, value);
+        if (value < 0) {
+            return 0;
+        }
+
+        return Math.min(value, MAX_SCORE);
     }
 
     protected int normalizeExplicitTeamType(int value) {

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionTeamHasRank.java

@@ -65,7 +65,13 @@ public class WiredConditionTeamHasRank extends WiredConditionTeamGameBase {
             return;
         }
 
-        JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        JsonData data;
+        try {
+            data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        } catch (RuntimeException ignored) {
+            this.resetSettings();
+            return;
+        }
         if (data == null) {
             return;
         }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionTeamHasScore.java

@@ -66,7 +66,13 @@ public class WiredConditionTeamHasScore extends WiredConditionTeamGameBase {
             return;
         }
 
-        JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        JsonData data;
+        try {
+            data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        } catch (RuntimeException ignored) {
+            this.resetSettings();
+            return;
+        }
         if (data == null) {
             return;
         }

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionTeamMember.java

@@ -97,12 +97,12 @@ public class WiredConditionTeamMember extends InteractionWiredCondition {
 
             if (wiredData.startsWith("{")) {
                 JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
-                this.teamColor = data.teamColor;
+                this.teamColor = WiredConditionInputGuard.normalizeTeamColor(data.teamColor, GameTeamColors.RED);
-                this.userSource = data.userSource;
+                this.userSource = WiredConditionInputGuard.normalizeUserSource(data.userSource);
                 this.quantifier = this.normalizeQuantifier(data.quantifier, QUANTIFIER_ANY);
             } else {
                 if (!wiredData.equals(""))
-                    this.teamColor = GameTeamColors.values()[Integer.parseInt(wiredData)];
+                    this.teamColor = WiredConditionInputGuard.normalizeTeamColorType(Integer.parseInt(wiredData), GameTeamColors.RED);
                 this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
                 this.quantifier = QUANTIFIER_ANY;
             }
@@ -147,8 +147,8 @@ public class WiredConditionTeamMember extends InteractionWiredCondition {
     public boolean saveData(WiredSettings settings) {
         if(settings.getIntParams().length < 1) return false;
         int[] params = settings.getIntParams();
-        this.teamColor = GameTeamColors.values()[params[0]];
+        this.teamColor = WiredConditionInputGuard.normalizeTeamColorType(params[0], GameTeamColors.RED);
-        this.userSource = (params.length > 1) ? params[1] : WiredSourceUtil.SOURCE_TRIGGER;
+        this.userSource = (params.length > 1) ? WiredConditionInputGuard.normalizeUserSource(params[1]) : WiredSourceUtil.SOURCE_TRIGGER;
         this.quantifier = (params.length > 2) ? this.normalizeQuantifier(params[2], QUANTIFIER_ALL) : QUANTIFIER_ANY;
 
         return true;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionTriggerOnFurni.java

@@ -42,6 +42,10 @@ public class WiredConditionTriggerOnFurni extends InteractionWiredCondition {
 
     @Override
     public boolean evaluate(WiredContext ctx) {
+        if (ctx == null || ctx.room() == null) {
+            return false;
+        }
+
         this.refresh();
 
         List<RoomUnit> userTargets = WiredSourceUtil.resolveUsers(ctx, this.userSource);
@@ -104,16 +108,19 @@ public class WiredConditionTriggerOnFurni extends InteractionWiredCondition {
 
     @Override
     public void loadWiredData(ResultSet set, Room room) throws SQLException {
-        this.items.clear();
+        this.onPickUp();
         String wiredData = set.getString("wired_data");
+        if (wiredData == null || wiredData.isEmpty()) {
+            return;
+        }
 
         if (wiredData.startsWith("{")) {
             JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
-            this.furniSource = data.furniSource;
+            this.furniSource = WiredFurniConditionInputGuard.normalizeFurniSource(data.furniSource);
-            this.userSource = data.userSource;
+            this.userSource = WiredFurniConditionInputGuard.normalizeUserSource(data.userSource);
             this.quantifier = this.normalizeQuantifier(data.quantifier);
 
-            for(int id : data.itemIds) {
+            for(int id : WiredFurniConditionInputGuard.sanitizeItemIds(data.itemIds, WiredManager.MAXIMUM_FURNI_SELECTION)) {
                 HabboItem item = room.getHabboItem(id);
 
                 if (item != null) {
@@ -121,10 +128,8 @@ public class WiredConditionTriggerOnFurni extends InteractionWiredCondition {
                 }
             }
         } else {
-            String[] data = wiredData.split(";");
+            for (int id : WiredFurniConditionInputGuard.parseLegacyItemIds(wiredData, WiredManager.MAXIMUM_FURNI_SELECTION)) {
-
+                HabboItem item = room.getHabboItem(id);
-            for (String s : data) {
-                HabboItem item = room.getHabboItem(Integer.parseInt(s));
 
                 if (item != null) {
                     this.items.add(item);
@@ -134,9 +139,7 @@ public class WiredConditionTriggerOnFurni extends InteractionWiredCondition {
             this.userSource = WiredSourceUtil.SOURCE_TRIGGER;
             this.quantifier = QUANTIFIER_ALL;
         }
-        if (this.furniSource == WiredSourceUtil.SOURCE_TRIGGER && !this.items.isEmpty()) {
+        this.furniSource = WiredFurniConditionInputGuard.selectedOrNormalizedFurniSource(this.furniSource, !this.items.isEmpty());
-            this.furniSource = WiredSourceUtil.SOURCE_SELECTED;
-        }
     }
 
     @Override
@@ -182,13 +185,11 @@ public class WiredConditionTriggerOnFurni extends InteractionWiredCondition {
         if (count > Emulator.getConfig().getInt("hotel.wired.furni.selection.count")) return false;
 
         int[] params = settings.getIntParams();
-        this.furniSource = (params.length > 0) ? params[0] : WiredSourceUtil.SOURCE_TRIGGER;
+        this.furniSource = (params.length > 0) ? WiredFurniConditionInputGuard.normalizeFurniSource(params[0]) : WiredSourceUtil.SOURCE_TRIGGER;
-        this.userSource = (params.length > 1) ? params[1] : WiredSourceUtil.SOURCE_TRIGGER;
+        this.userSource = (params.length > 1) ? WiredFurniConditionInputGuard.normalizeUserSource(params[1]) : WiredSourceUtil.SOURCE_TRIGGER;
         this.quantifier = (params.length > 2) ? this.normalizeQuantifier(params[2]) : QUANTIFIER_ALL;
 
-        if (count > 0 && this.furniSource == WiredSourceUtil.SOURCE_TRIGGER) {
+        this.furniSource = WiredFurniConditionInputGuard.selectedOrNormalizedFurniSource(this.furniSource, count > 0);
-            this.furniSource = WiredSourceUtil.SOURCE_SELECTED;
-        }
 
         this.items.clear();
 
@@ -233,6 +234,22 @@ public class WiredConditionTriggerOnFurni extends InteractionWiredCondition {
         return (value == QUANTIFIER_ANY) ? QUANTIFIER_ANY : QUANTIFIER_ALL;
     }
 
+    int normalizeFurniSource(int value) {
+        switch (value) {
+            case WiredSourceUtil.SOURCE_SELECTED:
+            case WiredSourceUtil.SOURCE_SELECTOR:
+            case WiredSourceUtil.SOURCE_SIGNAL:
+            case WiredSourceUtil.SOURCE_TRIGGER:
+                return value;
+            default:
+                return WiredSourceUtil.SOURCE_TRIGGER;
+        }
+    }
+
+    int normalizeUserSource(int value) {
+        return WiredSourceUtil.isDefaultUserSource(value) ? value : WiredSourceUtil.SOURCE_TRIGGER;
+    }
+
     @Override
     public WiredConditionOperator operator() {
         return WiredConditionOperator.AND;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionTriggererMatch.java

@@ -33,6 +33,7 @@ public class WiredConditionTriggererMatch extends InteractionWiredCondition {
     protected static final int QUANTIFIER_ALL = 0;
     protected static final int QUANTIFIER_ANY = 1;
     protected static final int SOURCE_SPECIFIED_USERNAME = 101;
+    protected static final int MAX_USERNAME_LENGTH = 64;
 
     public static final WiredConditionType type = WiredConditionType.TRIGGERER_MATCH;
 
@@ -84,7 +85,14 @@ public class WiredConditionTriggererMatch extends InteractionWiredCondition {
             return;
         }
 
-        JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        JsonData data;
+        try {
+            data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        } catch (RuntimeException exception) {
+            this.resetSettings();
+            return;
+        }
+
         if (data == null) {
             return;
         }
@@ -284,7 +292,7 @@ public class WiredConditionTriggererMatch extends InteractionWiredCondition {
         return "";
     }
 
-    private int normalizeEntityType(int value) {
+    int normalizeEntityType(int value) {
         switch (value) {
             case ENTITY_HABBO:
             case ENTITY_PET:
@@ -295,19 +303,19 @@ public class WiredConditionTriggererMatch extends InteractionWiredCondition {
         }
     }
 
-    private int normalizeAvatarMode(int value) {
+    int normalizeAvatarMode(int value) {
         return (value == AVATAR_MODE_CERTAIN) ? AVATAR_MODE_CERTAIN : AVATAR_MODE_ANY;
     }
 
-    private int normalizeQuantifier(int value) {
+    int normalizeQuantifier(int value) {
         return (value == QUANTIFIER_ANY) ? QUANTIFIER_ANY : QUANTIFIER_ALL;
     }
 
-    private int normalizePrimaryUserSource(int value) {
+    int normalizePrimaryUserSource(int value) {
         return WiredSourceUtil.isDefaultUserSource(value) ? value : WiredSourceUtil.SOURCE_TRIGGER;
     }
 
-    private int normalizeCompareUserSource(int value) {
+    int normalizeCompareUserSource(int value) {
         switch (value) {
             case WiredSourceUtil.SOURCE_CLICKED_USER:
             case SOURCE_SPECIFIED_USERNAME:
@@ -317,8 +325,13 @@ public class WiredConditionTriggererMatch extends InteractionWiredCondition {
         }
     }
 
-    private String normalizeUsername(String value) {
+    String normalizeUsername(String value) {
-        return (value == null) ? "" : value.trim();
+        if (value == null) {
+            return "";
+        }
+
+        String normalized = value.trim();
+        return normalized.length() <= MAX_USERNAME_LENGTH ? normalized : normalized.substring(0, MAX_USERNAME_LENGTH);
     }
 
     protected static class MatchResult {

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionUserPerformsAction.java

@@ -87,7 +87,13 @@ public class WiredConditionUserPerformsAction extends InteractionWiredCondition
             return;
         }
 
-        JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        JsonData data;
+        try {
+            data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        } catch (RuntimeException ignored) {
+            this.resetSettings();
+            return;
+        }
 
         if (data == null) {
             return;
@@ -253,7 +259,7 @@ public class WiredConditionUserPerformsAction extends InteractionWiredCondition
         }
 
         long timestamp = (Long) timestampValue;
-        if ((System.currentTimeMillis() - timestamp) > TRANSIENT_ACTION_WINDOW_MS) {
+        if (!WiredUserActionInputGuard.isRecentTimestamp(timestamp, System.currentTimeMillis(), TRANSIENT_ACTION_WINDOW_MS)) {
             return false;
         }
 

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionVariableAgeMatch.java

@@ -35,6 +35,7 @@ public class WiredConditionVariableAgeMatch extends WiredConditionHasVariable {
     private static final int DURATION_UNIT_WEEKS = 5;
     private static final int DURATION_UNIT_MONTHS = 6;
     private static final int DURATION_UNIT_YEARS = 7;
+    static final int MAX_DURATION_AMOUNT = 1_000_000;
 
     protected int compareValue = COMPARE_VALUE_CREATED;
     protected int comparison = COMPARISON_LOWER_THAN;
@@ -97,7 +98,7 @@ public class WiredConditionVariableAgeMatch extends WiredConditionHasVariable {
         this.targetType = (params.length > 0) ? normalizeTargetTypeExtended(params[0]) : TARGET_USER;
         this.compareValue = (params.length > 1) ? normalizeCompareValue(params[1]) : COMPARE_VALUE_CREATED;
         this.comparison = (params.length > 2) ? normalizeComparison(params[2]) : COMPARISON_LOWER_THAN;
-        this.durationAmount = Math.max(0, (params.length > 3) ? params[3] : 0);
+        this.durationAmount = normalizeDurationAmount((params.length > 3) ? params[3] : 0);
         this.durationUnit = (params.length > 4) ? normalizeDurationUnit(params[4]) : DURATION_UNIT_SECONDS;
         this.userSource = (params.length > 5) ? normalizeUserSource(params[5]) : WiredSourceUtil.SOURCE_TRIGGER;
         this.furniSource = (params.length > 6) ? normalizeFurniSource(params[6]) : WiredSourceUtil.SOURCE_TRIGGER;
@@ -130,6 +131,10 @@ public class WiredConditionVariableAgeMatch extends WiredConditionHasVariable {
 
     @Override
     public boolean evaluate(WiredContext ctx) {
+        if (ctx == null) {
+            return false;
+        }
+
         Room room = ctx.room();
 
         if (room == null || this.variableToken == null || this.variableToken.isEmpty() || !isCustomVariableToken(this.variableToken)) {
@@ -192,7 +197,7 @@ public class WiredConditionVariableAgeMatch extends WiredConditionHasVariable {
                 this.targetType = normalizeTargetTypeExtended(data.targetType);
                 this.compareValue = normalizeCompareValue(data.compareValue);
                 this.comparison = normalizeComparison(data.comparison);
-                this.durationAmount = Math.max(0, data.durationAmount);
+                this.durationAmount = normalizeDurationAmount(data.durationAmount);
                 this.durationUnit = normalizeDurationUnit(data.durationUnit);
                 this.userSource = normalizeUserSource(data.userSource);
                 this.furniSource = normalizeFurniSource(data.furniSource);
@@ -345,8 +350,8 @@ public class WiredConditionVariableAgeMatch extends WiredConditionHasVariable {
         return Math.max(0L, System.currentTimeMillis() - timestampMs);
     }
 
-    private static long durationToMillis(int amount, int unit) {
+    static long durationToMillis(int amount, int unit) {
-        long normalizedAmount = Math.max(0L, amount);
+        long normalizedAmount = normalizeDurationAmount(amount);
 
         return switch (unit) {
             case DURATION_UNIT_MILLISECONDS -> normalizedAmount;
@@ -367,22 +372,26 @@ public class WiredConditionVariableAgeMatch extends WiredConditionHasVariable {
         return left * right;
     }
 
-    private static int normalizeTargetTypeExtended(int value) {
+    static int normalizeDurationAmount(int value) {
+        return Math.max(0, Math.min(MAX_DURATION_AMOUNT, value));
+    }
+
+    static int normalizeTargetTypeExtended(int value) {
         return switch (value) {
             case TARGET_FURNI, TARGET_CONTEXT, TARGET_ROOM -> value;
             default -> TARGET_USER;
         };
     }
 
-    private static int normalizeCompareValue(int value) {
+    static int normalizeCompareValue(int value) {
         return (value == COMPARE_VALUE_UPDATED) ? COMPARE_VALUE_UPDATED : COMPARE_VALUE_CREATED;
     }
 
-    private static int normalizeComparison(int value) {
+    static int normalizeComparison(int value) {
         return (value == COMPARISON_HIGHER_THAN) ? COMPARISON_HIGHER_THAN : COMPARISON_LOWER_THAN;
     }
 
-    private static int normalizeDurationUnit(int value) {
+    static int normalizeDurationUnit(int value) {
         return switch (value) {
             case DURATION_UNIT_MILLISECONDS, DURATION_UNIT_SECONDS, DURATION_UNIT_MINUTES, DURATION_UNIT_HOURS,
                 DURATION_UNIT_DAYS, DURATION_UNIT_WEEKS, DURATION_UNIT_MONTHS, DURATION_UNIT_YEARS -> value;

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredConditionVariableValueMatch.java

@@ -51,6 +51,7 @@ public class WiredConditionVariableValueMatch extends WiredConditionHasVariable
     private static final int COMPARISON_NOT_EQUAL = 5;
     private static final String DELIM = "\t";
     private static final String FURNI_DELIM = ";";
+    static final int MAX_ABS_REFERENCE_CONSTANT = 1_000_000_000;
 
     protected int comparison = COMPARISON_EQUAL;
     protected int referenceMode = REFERENCE_CONSTANT;
@@ -123,7 +124,7 @@ public class WiredConditionVariableValueMatch extends WiredConditionHasVariable
         int nextTargetType = normalizeTargetTypeExtended(param(params, 0, TARGET_USER));
         int nextComparison = normalizeComparison(param(params, 1, COMPARISON_EQUAL));
         int nextReferenceMode = normalizeReferenceMode(param(params, 2, REFERENCE_CONSTANT));
-        int nextReferenceConstantValue = param(params, 3, 0);
+        int nextReferenceConstantValue = normalizeReferenceConstantValue(param(params, 3, 0));
         int nextReferenceTargetType = normalizeTargetTypeExtended(param(params, 4, TARGET_USER));
         int nextUserSource = normalizeUserSource(param(params, 5, WiredSourceUtil.SOURCE_TRIGGER));
         int nextFurniSource = normalizeFurniSource(param(params, 6, WiredSourceUtil.SOURCE_TRIGGER));
@@ -168,6 +169,10 @@ public class WiredConditionVariableValueMatch extends WiredConditionHasVariable
 
     @Override
     public boolean evaluate(WiredContext ctx) {
+        if (ctx == null) {
+            return false;
+        }
+
         Room room = ctx.room();
 
         if (room == null || this.variableToken == null || this.variableToken.isEmpty()) {
@@ -220,14 +225,21 @@ public class WiredConditionVariableValueMatch extends WiredConditionHasVariable
         String wiredData = set.getString("wired_data");
         if (wiredData == null || wiredData.isEmpty() || !wiredData.startsWith("{")) return;
 
-        JsonData data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        JsonData data;
+        try {
+            data = WiredManager.getGson().fromJson(wiredData, JsonData.class);
+        } catch (RuntimeException exception) {
+            this.onPickUp();
+            return;
+        }
+
         if (data == null) return;
 
         this.targetType = normalizeTargetTypeExtended(data.targetType);
         this.setVariableToken(normalizeVariableToken((data.variableToken != null) ? data.variableToken : ((data.variableItemId > 0) ? String.valueOf(data.variableItemId) : "")));
         this.comparison = normalizeComparison(data.comparison);
         this.referenceMode = normalizeReferenceMode(data.referenceMode);
-        this.referenceConstantValue = data.referenceConstantValue;
+        this.referenceConstantValue = normalizeReferenceConstantValue(data.referenceConstantValue);
         this.referenceTargetType = normalizeTargetTypeExtended(data.referenceTargetType);
         this.setReferenceVariableToken(normalizeVariableToken((data.referenceVariableToken != null) ? data.referenceVariableToken : ((data.referenceVariableItemId > 0) ? String.valueOf(data.referenceVariableItemId) : "")));
         this.userSource = normalizeUserSource(data.userSource);
@@ -737,32 +749,36 @@ public class WiredConditionVariableValueMatch extends WiredConditionHasVariable
         return (params.length > index) ? params[index] : fallback;
     }
 
-    private static int normalizeTargetTypeExtended(int value) {
+    static int normalizeTargetTypeExtended(int value) {
         return switch (value) {
             case TARGET_FURNI, TARGET_CONTEXT, TARGET_ROOM -> value;
             default -> TARGET_USER;
         };
     }
 
-    private static int normalizeReferenceMode(int value) {
+    static int normalizeReferenceMode(int value) {
         return (value == REFERENCE_VARIABLE) ? REFERENCE_VARIABLE : REFERENCE_CONSTANT;
     }
 
-    private static int normalizeReferenceFurniSource(int value) {
+    static int normalizeReferenceFurniSource(int value) {
         return switch (value) {
             case SOURCE_SECONDARY_SELECTED, WiredSourceUtil.SOURCE_SELECTOR, WiredSourceUtil.SOURCE_SIGNAL -> value;
             default -> WiredSourceUtil.SOURCE_TRIGGER;
         };
     }
 
-    private static int normalizeComparison(int value) {
+    static int normalizeComparison(int value) {
         return switch (value) {
             case COMPARISON_GREATER_THAN, COMPARISON_GREATER_THAN_OR_EQUAL, COMPARISON_LESS_THAN_OR_EQUAL, COMPARISON_LESS_THAN, COMPARISON_NOT_EQUAL -> value;
             default -> COMPARISON_EQUAL;
         };
     }
 
-    private static int parseInteger(String value) {
+    static int normalizeReferenceConstantValue(int value) {
+        return Math.max(-MAX_ABS_REFERENCE_CONSTANT, Math.min(MAX_ABS_REFERENCE_CONSTANT, value));
+    }
+
+    static int parseInteger(String value) {
         try {
             return (value == null || value.trim().isEmpty()) ? 0 : Integer.parseInt(value.trim());
         } catch (NumberFormatException e) {

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredDateRangeInputGuard.java

@@ -0,0 +1,21 @@
+package com.eu.habbo.habbohotel.items.interactions.wired.conditions;
+
+public final class WiredDateRangeInputGuard {
+    private WiredDateRangeInputGuard() {
+    }
+
+    public static int[] normalizeRange(int startDate, int endDate) {
+        int start = normalizeTimestamp(startDate);
+        int end = normalizeTimestamp(endDate);
+
+        if (start > end) {
+            return new int[]{0, 0};
+        }
+
+        return new int[]{start, end};
+    }
+
+    public static int normalizeTimestamp(int value) {
+        return Math.max(0, value);
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredFurniConditionInputGuard.java

@@ -0,0 +1,76 @@
+package com.eu.habbo.habbohotel.items.interactions.wired.conditions;
+
+import com.eu.habbo.habbohotel.wired.core.WiredSourceUtil;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
+public final class WiredFurniConditionInputGuard {
+    private WiredFurniConditionInputGuard() {
+    }
+
+    public static int normalizeFurniSource(int value) {
+        switch (value) {
+            case WiredSourceUtil.SOURCE_SELECTED:
+            case WiredSourceUtil.SOURCE_SELECTOR:
+            case WiredSourceUtil.SOURCE_SIGNAL:
+            case WiredSourceUtil.SOURCE_TRIGGER:
+                return value;
+            default:
+                return WiredSourceUtil.SOURCE_TRIGGER;
+        }
+    }
+
+    public static int normalizeUserSource(int value) {
+        return WiredSourceUtil.isDefaultUserSource(value) ? value : WiredSourceUtil.SOURCE_TRIGGER;
+    }
+
+    public static int selectedOrNormalizedFurniSource(int value, boolean hasSelectedItems) {
+        int source = normalizeFurniSource(value);
+        return (hasSelectedItems && source == WiredSourceUtil.SOURCE_TRIGGER)
+                ? WiredSourceUtil.SOURCE_SELECTED
+                : source;
+    }
+
+    public static List<Integer> sanitizeItemIds(Collection<Integer> itemIds, int maxCount) {
+        List<Integer> result = new ArrayList<>();
+        if (itemIds == null || maxCount < 1) {
+            return result;
+        }
+
+        for (Integer itemId : itemIds) {
+            if (itemId == null || itemId < 1 || result.size() >= maxCount) {
+                continue;
+            }
+
+            result.add(itemId);
+        }
+
+        return result;
+    }
+
+    public static List<Integer> parseLegacyItemIds(String value, int maxCount) {
+        List<Integer> result = new ArrayList<>();
+        if (value == null || value.isBlank() || maxCount < 1) {
+            return result;
+        }
+
+        for (String part : value.split("[;,:\\t]")) {
+            if (result.size() >= maxCount) {
+                break;
+            }
+
+            try {
+                int id = Integer.parseInt(part.trim());
+                if (id > 0) {
+                    result.add(id);
+                }
+            } catch (NumberFormatException ignored) {
+                // Ignore malformed legacy item ids.
+            }
+        }
+
+        return result;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredMatchPositionInputGuard.java

@@ -0,0 +1,92 @@
+package com.eu.habbo.habbohotel.items.interactions.wired.conditions;
+
+import com.eu.habbo.habbohotel.rooms.Room;
+import com.eu.habbo.habbohotel.users.HabboItem;
+import com.eu.habbo.habbohotel.wired.WiredMatchFurniSetting;
+import com.eu.habbo.habbohotel.wired.core.WiredManager;
+import com.eu.habbo.habbohotel.wired.core.WiredSourceUtil;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
+public final class WiredMatchPositionInputGuard {
+    public static final int MAX_STATE_LENGTH = 512;
+
+    private WiredMatchPositionInputGuard() {
+    }
+
+    public static int normalizeFurniSource(int value, boolean hasSelectedSettings) {
+        int source = switch (value) {
+            case WiredSourceUtil.SOURCE_SELECTED, WiredSourceUtil.SOURCE_SELECTOR,
+                    WiredSourceUtil.SOURCE_SIGNAL, WiredSourceUtil.SOURCE_TRIGGER -> value;
+            default -> WiredSourceUtil.SOURCE_TRIGGER;
+        };
+
+        return (hasSelectedSettings && source == WiredSourceUtil.SOURCE_TRIGGER)
+                ? WiredSourceUtil.SOURCE_SELECTED
+                : source;
+    }
+
+    public static List<WiredMatchFurniSetting> sanitizeSettings(Collection<WiredMatchFurniSetting> settings, Room room) {
+        List<WiredMatchFurniSetting> result = new ArrayList<>();
+        if (settings == null || room == null) {
+            return result;
+        }
+
+        for (WiredMatchFurniSetting setting : settings) {
+            WiredMatchFurniSetting normalized = sanitizeSetting(setting, room);
+            if (normalized != null) {
+                result.add(normalized);
+            }
+
+            if (result.size() >= WiredManager.MAXIMUM_FURNI_SELECTION) {
+                break;
+            }
+        }
+
+        return result;
+    }
+
+    public static WiredMatchFurniSetting sanitizeSetting(WiredMatchFurniSetting setting, Room room) {
+        if (setting == null || room == null) {
+            return null;
+        }
+
+        return sanitizeParts(setting.item_id, setting.state, setting.rotation, setting.x, setting.y, setting.z, room);
+    }
+
+    public static WiredMatchFurniSetting sanitizeParts(int itemId, String state, int rotation, int x, int y, double z, Room room) {
+        if (itemId < 1 || room == null) {
+            return null;
+        }
+
+        HabboItem item = room.getHabboItem(itemId);
+        if (item == null || rotation < 0 || rotation > 7 || !Double.isFinite(z)) {
+            return null;
+        }
+
+        if (x < Short.MIN_VALUE || x > Short.MAX_VALUE || y < Short.MIN_VALUE || y > Short.MAX_VALUE) {
+            return null;
+        }
+
+        if (room.getLayout() != null && room.getLayout().getTile((short) x, (short) y) == null) {
+            return null;
+        }
+
+        return new WiredMatchFurniSetting(itemId, normalizeState(state), rotation, x, y, z);
+    }
+
+    public static String normalizeState(String state) {
+        if (state == null) {
+            return "";
+        }
+
+        String normalized = state.replace('\t', ' ').replace('\r', ' ').replace('\n', ' ');
+        if (normalized.length() > MAX_STATE_LENGTH) {
+            return normalized.substring(0, MAX_STATE_LENGTH);
+        }
+
+        return normalized;
+    }
+}

Emulator/src/main/java/com/eu/habbo/habbohotel/items/interactions/wired/conditions/WiredUserActionInputGuard.java

@@ -0,0 +1,14 @@
+package com.eu.habbo.habbohotel.items.interactions.wired.conditions;
+
+public final class WiredUserActionInputGuard {
+    private WiredUserActionInputGuard() {
+    }
+
+    public static boolean isRecentTimestamp(long timestamp, long now, long windowMs) {
+        if (timestamp < 1 || timestamp > now || windowMs < 1) {
+            return false;
+        }
+
+        return (now - timestamp) <= windowMs;
+    }
+}