`online` column being set too late

The `online` columns sole purpose is to act as a sort of lock on characters to inform any external applications (control panels, etc) that the character is logged in and should not be modified. As it stands now any external application which relies on this data can be mislead into assuming it can make changes when it cannot. This makes any website relying on this column vulnerable to an exploit.

[b]Currently all Athena forks are subject to this vulnerability.[/b] The bug is straight forward and the solution is surprisingly simple. Currently upon character select (case 0x66) mmo_char_fromsql() is called upon prior to set_char_online(). In fact, set_char_online() is called at the very end of this case. While this makes sense when thinking of the `online` column for simply display purposes, when you think of it in the way people are using it an obvious problem emerges. Between those two functions an external application may write or remove data, which will then be overwritten later by the server when the character is saved.

This is what the server does:
Calls mmo_char_fromsql() which loads inventory, cart_inventory, storage, etc.
Does some processing.
Calls set_char_online() which sets `online`=1

Imagine a control panel that does this:
Reads `char` for online=0, all are 0 so the user is offline
Reads `storage` for items, finds one it's looking for
Removes said item.

Now imagine they overlap like this:
[CP] Reads `char` for online=0, all are 0 so the user is offline
[Server] Calls mmo_char_fromsql() which loads inventory, cart_inventory, storage, etc.
[CP] Reads `storage` for items, finds one it's looking for
[Server] Does some processing.
[CP] Removes said item.
[Server] Calls set_char_online() which sets `online`=1

In this situation, the server will never check back with the database, the removal of the item will be undone the next time map server pushes data to be saved.

The fix is quite simple, the online column is never used by the server other than in UPDATE statements. This is a feature purely for the benefit of external applications.

Simply change set_char_online() to occur prior to mmo_char_fromsql(). It seems that this works fine:[code=auto:0]... case 0x66: ... Sql_FreeResult(sql_handle); set_char_online(-2,char_id,sd->account_id); mmo_char_fromsql(char_id, &char_dat, true); ... [/code]It may also be a good idea to run set_char_offline() in the cases of failure inside of that switch. I've tested this lightly and it seems to work.