Replace outdated URLs

Fix logic error in server duplicate check
Fix average client calculation
2025-10-16 16:20:11 +02:00 · 2025-10-16 13:45:09 +02:00 · 2025-02-17 19:55:30 +01:00 · 2025-02-17 19:38:27 +01:00 · 2025-02-17 19:38:27 +01:00 · 2025-02-17 19:38:27 +01:00
12 changed files with 771 additions and 401 deletions
--- a/.editorconfig
+++ b/.editorconfig
@@ -0,0 +1,8 @@
+root = true
+
+[*]
+charset = utf-8
+indent_style = tab
+indent_size = 4
+trim_trailing_whitespace = true
+insert_final_newline = true
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,28 @@
+name: lint
+
+on:
+  push:
+    paths:
+      - '**.py'
+      - 'requirements.txt'
+  pull_request:
+    paths:
+      - '**.py'
+      - 'requirements.txt'
+
+jobs:
+
+  pylint:
+    runs-on: ubuntu-latest
+    container:
+      image: python:3.11-slim
+    steps:
+      - uses: actions/checkout@v3
+      - name: Install deps
+        run: |
+          pip install -r requirements.txt
+          pip install pylint
+
+      - name: Lint
+        run: |
+          pylint -E --fail-on=E server.py
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,8 @@
 *~
 node_modules
 __pycache__
-static/list.json
-static/servers.js
-config.py
-
+/store.json
+/static/list.json
+/static/servers.js
+/config.py
+/*.mmdb
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-Minetest server list
+Luanti server list
 ====================

 Setting up the webpage
@@ -9,124 +9,141 @@ the server list webpage template.

 First install node.js, e.g.:

-	# apt-get install nodejs
-	# # OR:
-	# pacman -S nodejs
+```sh
+apt-get install nodejs
+# OR:
+yum install nodejs
+```

 Then install doT.js and its dependencies:

-	$ npm install dot commander mkdirp
+```sh
+npm install dot "commander@11.1.0" mkdirp
+```

 And finally compile the template:

-	$ cd static
-	$ ../node_modules/dot/bin/dot-packer -s .
+```sh
+cd static
+../node_modules/dot/bin/dot-packer -s .
+```

-You can now serve the webpage by copying the files in static/ to your web root, or by [starting the server list](#setting-up-the-server).
+You can now serve the webpage by copying the files in `static/` to your web root, or by [starting the server list](#setting-up-the-server).


 Embedding the server list in a page
 -----------------------------------

-	<head>
-		...
-		<script>
-			var master = {
-				root: 'http://servers.minetest.net/',
-				limit: 10,
-				clients_min: 1,
-				no_flags: 1,
-				no_ping: 1,
-				no_uptime: 1
-			};
-		</script>
-		...
-	</head>
-	<body>
-		...
-		<div id="server_list"></div>
-		...
-	</body>
-	<script src="list.js"></script>
-
+```html
+<head>
+	...
+	<script>
+		var master = {
+			root: 'https://servers.luanti.org/',
+			limit: 10,
+			clients_min: 1,
+			no_flags: true,
+			no_ping: true,
+			no_uptime: true
+		};
+	</script>
+	...
+</head>
+<body>
+	...
+	<div id="server_list"></div>
+	...
+	<script defer src="https://servers.luanti.org/list.js"></script>
+</body>
+```

 Setting up the server
 ---------------------

  1. Install Python 3 and pip:

-	pacman -S python python-pip
-	# OR:
-	apt-get install python3 python3-pip
+```sh
+apt-get install python3 python3-pip
+# OR:
+yum install python3 python3-pip
+```

  2. Install required Python packages:

-	# You might have to use pip3 if your system defaults to Python 2
-	pip install -r requirements.txt
+	pip3 install -r requirements.txt

-  3. If using in production, install uwsgi and it's python plugin:
+  3. If using in production, install uwsgi and its python plugin:

-	pacman -S uwsgi uwsgi-plugin-python
-	# OR:
-	apt-get install uwsgi uwsgi-plugin-python
-	# OR:
-	pip install uwsgi
+```sh
+apt-get install uwsgi-plugin-python3
+# OR:
+yum install uwsgi uwsgi-plugin-python3
+```

  4. Configure the server by adding options to `config.py`.
-       See `config-example.py` for defaults.
+     See `config-example.py` for defaults.

  5. Start the server:

-	$ ./server.py
-	$ # Or for production:
-	$ uwsgi -s /tmp/minetest-master.sock --plugin python -w server:app --enable-threads
-	$ # Then configure according to http://flask.pocoo.org/docs/deploying/uwsgi/
+```sh
+./server.py
+# Or for production:
+uwsgi -s /run/serverlist.sock --plugins python3 -w server:app -T --threads 2
+# then configure according to https://flask.palletsprojects.com/en/stable/deploying/uwsgi/
+```

  7. (optional) Configure the proxy server, if any.  You should make the server
-	load static files directly from the static directory.  Also, `/list`
-	should be served from `list.json`.  Example for nginx:
+	 load static files directly from the static directory.  Also, `/list`
+	 should be served from `list.json`.  Example for nginx:

-	root /path/to/server/static;
-	rewrite ^/list$ /list.json;
-	try_files $uri @uwsgi;
-	location @uwsgi {
-		uwsgi_pass ...;
-	}
+```sh
+root /path/to/server/static;
+
+rewrite ^/$ /index.html break;
+rewrite ^/list$ /list.json break;
+
+location = /list.json { expires 20s; }
+
+try_files $uri @uwsgi;
+location @uwsgi {
+	include uwsgi_params;
+	uwsgi_pass unix:/run/serverlist.sock;
+}
+```

 Setting up the server (Apache version)
---------------------
+--------------------------------------

-If you wish to use Apache to host the server list, do steps 1-2, 4, above. Additionally install/enable mod_wsgi and an Apache site config like the following:
+If you wish to use Apache to host the server list, do steps 1-2, 4, above.
+Additionally install/enable mod_wsgi and an Apache site config like the following:

-		# This config assumes you have the server list at DocumentRoot.
-		# Visitors to the server list in this config would visit http://local.server/ and
-		# apache would serve up the output from server.py. Static resources would be served
-		# from http://local.server/static.
+```sh
+# This config assumes you have the server list at DocumentRoot.
+# Visitors to the server list in this config would visit http://local.server/ and
+# apache would serve up the output from server.py.

-		# Where are the minetest-server files located?
-		DocumentRoot /var/games/minetest/serverlist
+# Where are the serverlist files located?
+DocumentRoot /var/games/luanti/serverlist

-		# Serve up server.py at the root of the URL.
-		WSGIScriptAlias / /var/games/minetest/serverlist/server.py
+# Serve up server.py at the root of the URL.
+WSGIScriptAlias / /var/games/luanti/serverlist/server.py

-		# The name of the function that we call when we invoke server.py
-		WSGICallableObject app
+# The name of the function that we call when we invoke server.py
+WSGICallableObject app

-		# These options are necessary to enable Daemon mode. Without this, you'll have strange behavior
-		# with servers dropping off your list! You can tweak threads as needed. See mod_wsgi documentation.
-		WSGIProcessGroup minetest-serverlist
-		WSGIDaemonProcess minetest-serverlist threads=2
+# These options are necessary to enable Daemon mode. Without this, you'll have strange behavior
+# with servers dropping off your list! You can tweak threads as needed. See mod_wsgi documentation.
+WSGIProcessGroup luanti-serverlist
+WSGIDaemonProcess luanti-serverlist threads=2

-
-		<Directory /var/games/minetest/serverlist>
-			Require all granted
-		</Directory>
-
-	</VirtualHost>
+<Directory /var/games/luanti/serverlist>
+	Require all granted
+</Directory>
+```

 License
 -------

-The Minetest server list code is licensed under the GNU Lesser General Public
+The Luanti server list code is licensed under the GNU Lesser General Public
 License version 2.1 or later (LGPLv2.1+).  A LICENSE.txt file should have been
 supplied with your copy of this software containing a copy of the license.
--- a/config-example.py
+++ b/config-example.py
@@ -7,8 +7,8 @@ HOST = "127.0.0.1"
 # Port for development server to listen on
 PORT = 5000

-# Amount of time, in seconds, after which servers are removed from the list
-# if they haven't updated their listings.  Note: By default Minetest servers
+# Amount of time, is seconds, after which servers are removed from the list
+# if they haven't updated their listings.  Note: By default Luanti servers
 # only announce once every 5 minutes, so this should be more than 300.
 PURGE_TIME = 350

@@ -16,18 +16,15 @@ PURGE_TIME = 350
 # e.g. ['2620:101::44']
 BANNED_IPS = []

-# List of banned servers as host/port pairs, domains must be lowercase
-# e.g. ['1.2.3.4/30000', 'server.example.net', 'server.example.net/30001']
+# List of banned servers as host/port pairs
+# e.g. ['1.2.3.4/30000', 'lowercase.hostname', 'lowercase.hostname/30001']
 BANNED_SERVERS = []

-# List of banned domain suffixes, must be lowercase
-# e.g. ['.example.net', 'server.example.com']
-BANNED_DOMAINS = []
-
-# List of domain suffixes that should not get a point bonus (e.g. free domains), must be lowercase
-IRREPUTABLE_DOMAINS = ['.cf', '.ga', '.gq', '.ml', '.tk']
-
 # Creates server entries if a server sends an 'update' and there is no entry yet.
 # This should only be used to populate the server list after list.json was deleted.
 # This WILL cause problems such as mapgen, mods and privilege information missing from the list
 ALLOW_UPDATE_WITHOUT_OLD = False
+
+# Reject servers with private addresses and domain names.
+# Enable this if you are running a list on the public internet.
+REJECT_PRIVATE_ADDRESSES = False
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,2 +1,2 @@
-Flask>=0.10
-maxminddb-geolite2>=2018.703
+Flask>=2.0.0
+maxminddb>=2.0.0
--- a/server.py
+++ b/server.py
@@ -1,18 +1,69 @@
 #!/usr/bin/env python3
-import os, re, sys, json, time, socket, ipaddress
+import os
+import json
+import time
+import socket
 from threading import Thread, RLock
-from geolite2 import geolite2
+from glob import glob

-from flask import Flask, request, send_from_directory
+import maxminddb
+from flask import Flask, request, send_from_directory, make_response

+LIST_SAVE_INTERVAL = 5

 app = Flask(__name__, static_url_path = "")

 # Load configuration
 app.config.from_pyfile("config-example.py")  # Use example for defaults
 if os.path.isfile(os.path.join(app.root_path, "config.py")):
-        app.config.from_pyfile("config.py")
+	app.config.from_pyfile("config.py")

+tmp = glob(os.path.join(app.root_path, "dbip-country-lite-*.mmdb"))
+if tmp:
+	reader = maxminddb.open_database(tmp[0], maxminddb.MODE_AUTO)
+else:
+	app.logger.warning(
+		"For working GeoIP download the database from "+
+		"https://db-ip.com/db/download/ip-to-country-lite and place the "+
+		".mmdb file in the app root folder."
+	)
+	reader = None
+
+# Helpers
+
+# checkRequestAddress() error codes
+ADDR_IS_PRIVATE      = 1
+ADDR_IS_INVALID      = 2
+ADDR_IS_INVALID_PORT = 3
+ADDR_IS_UNICODE      = 4
+ADDR_IS_EXAMPLE      = 5
+
+ADDR_ERROR_HELP_TEXTS = {
+	ADDR_IS_PRIVATE: "The server_address you provided is private or local. "
+		"It is only reachable in your local network.\n"
+		"If you meant to host a public server, adjust the setting and make sure your "
+		"firewall is permitting connections (e.g. port forwarding).",
+	ADDR_IS_INVALID: "The server_address you provided is invalid.\n"
+		"If you don't have a domain name, try removing the setting from your configuration.",
+	ADDR_IS_INVALID_PORT: "The server_address you provided is invalid.\n"
+		"Note that the value must not include a port number.",
+	ADDR_IS_UNICODE: "The server_address you provided includes Unicode characters.\n"
+		"For domain names you have to use the punycode notation.",
+	ADDR_IS_EXAMPLE: "The server_address you provided is an example value.",
+}
+
+def geoip_lookup_continent(ip):
+	if ip.startswith("::ffff:"):
+		ip = ip[7:]
+
+	if not reader:
+		return
+	geo = reader.get(ip)
+
+	if geo and "continent" in geo:
+		return geo["continent"]["code"]
+	else:
+		app.logger.warning("Unable to get GeoIP continent data for %s.", ip)

 # Views

@@ -22,14 +73,26 @@ def index():


@app.route("/list")
-def list():
-	# We have to make sure that the list isn't cached,
-	# since the list isn't really static.
-	return send_from_directory(app.static_folder, "list.json",
-			cache_timeout=0)
+def list_json():
+	# We have to make sure that the list isn't cached for too long,
+	# since it isn't really static.
+	return send_from_directory(app.static_folder, "list.json", max_age=LIST_SAVE_INTERVAL)


-@app.route("/announce", methods=["GET", "POST"])
+@app.route("/geoip")
+def geoip():
+	continent = geoip_lookup_continent(request.remote_addr)
+
+	resp = make_response({
+		"continent": continent, # null on error
+	})
+	resp.cache_control.max_age = 7 * 86400
+	resp.cache_control.private = True
+
+	return resp
+
+
+@app.post("/announce")
 def announce():
 	ip = request.remote_addr
 	if ip.startswith("::ffff:"):
@@ -38,112 +101,101 @@ def announce():
 	if ip in app.config["BANNED_IPS"]:
 		return "Banned (IP).", 403

-	data = request.values["json"]
-
-	if len(data) > 8192:
+	json_data = request.form["json"]
+	if len(json_data) > 8192:
 		return "JSON data is too big.", 413

 	try:
-		server = json.loads(data)
-	except:
+		req = json.loads(json_data)
+	except json.JSONDecodeError:
 		return "Unable to process JSON data.", 400

-	if type(server) != dict:
+	if not isinstance(req, dict):
 		return "JSON data is not an object.", 400

-	if not "action" in server:
-		return "Missing action field.", 400
-
-	action = server["action"]
+	action = req.pop("action", "")
 	if action not in ("start", "update", "delete"):
 		return "Invalid action field.", 400

-	if action == "start":
-		server["uptime"] = 0
+	req["ip"] = ip

-	server["ip"] = ip
-
-	if not "port" in server:
-		server["port"] = 30000
-	#### Compatability code ####
+	if not "port" in req:
+		req["port"] = 30000
+	#### Compatibility code ####
 	# port was sent as a string instead of an integer
-	elif type(server["port"]) == str:
-		server["port"] = int(server["port"])
-	#### End compatability code ####
+	elif isinstance(req["port"], str):
+		req["port"] = int(req["port"])
+	#### End compatibility code ####

-	if "%s/%d" % (server["ip"], server["port"]) in app.config["BANNED_SERVERS"]:
+	if "%s/%d" % (req["ip"], req["port"]) in app.config["BANNED_SERVERS"]:
+		return "Banned (Server).", 403
+	elif "address" in req and "%s/%d" % (req["address"].lower(), req["port"]) in app.config["BANNED_SERVERS"]:
+		return "Banned (Server).", 403
+	elif "address" in req and req["address"].lower() in app.config["BANNED_SERVERS"]:
 		return "Banned (Server).", 403
-	elif "address" in server:
-		# Normalize address for ban checks
-		server["address"] = server["address"].lower().rstrip(".")
-		if f'{server["address"]}/{server["port"]}' in app.config["BANNED_SERVERS"] or \
-				server["address"] in app.config["BANNED_SERVERS"]:
-			return "Banned (Server).", 403
-		for domain in app.config["BANNED_DOMAINS"]:
-			if server["address"].endswith(domain):
-				return "Banned (Domain).", 403

-	old = serverList.get(ip, server["port"])
+	old = serverList.get(ip, req["port"])

 	if action == "delete":
 		if not old:
 			return "Server not found."
 		serverList.remove(old)
-		serverList.save()
 		return "Removed from server list."
-	elif not checkRequest(server):
-		return "Invalid JSON data.", 400
+
+	if not checkRequestSchema(req):
+		return "JSON data does not conform to schema.", 400
+	elif not checkRequest(req):
+		return "Incorrect JSON data.", 400

 	if action == "update" and not old:
-		if app.config["ALLOW_UPDATE_WITHOUT_OLD"]:
+		if app.config["ALLOW_UPDATE_WITHOUT_OLD"] and req["uptime"] > 0:
 			action = "start"
 		else:
 			return "Server to update not found."

-	server["update_time"] = int(time.time())
+	server = Server.from_request(req)

-	if action == "start":
-		server["start"] = int(time.time())
-		tracker.push("%s:%d" % (server["ip"], server["port"]), server["start"])
-	else:
-		server["start"] = old["start"]
+	# Since 'address' isn't the primary key it can change
+	if action == "start" or old.address != server.address:
+		err = checkRequestAddress(server)
+		if err:
+			return ADDR_ERROR_HELP_TEXTS[err], 400

-	if "clients_list" in server:
-		server["clients"] = len(server["clients_list"])
+	server.track_update(old, action == "update")

-	server["clients_top"] = max(server["clients"], old["clients_top"]) if old else server["clients"]
-
-	if "url" in server:
-		url = server["url"]
-		if not any(url.startswith(p) for p in ["http://", "https://", "//"]):
-			del server["url"]
-
-	# Make sure that startup options are saved
-	if action == "update":
-		for field in ("dedicated", "rollback", "mapgen", "privs",
-				"can_see_far_names", "mods"):
-			if field in old:
-				server[field] = old[field]
-
-	# Popularity
-	if old:
-		server["updates"] = old["updates"] + 1
-		# This is actually a count of all the client numbers we've received,
-		# it includes clients that were on in the previous update.
-		server["total_clients"] = old["total_clients"] + server["clients"]
-	else:
-		server["updates"] = 1
-		server["total_clients"] = server["clients"]
-	server["pop_v"] = server["total_clients"] / server["updates"]
+	err = errorTracker.get(server.get_error_pk())

 	finishRequestAsync(server)

+	if err:
+		warn, text = err
+		if warn:
+			text = ("Request has been filed and the previous one was successful, "
+				"but take note:\n" + text)
+		else:
+			text = ("Request has been filed, "
+				"but the previous request encountered the following error:\n" + text)
+		return text, 409
 	return "Request has been filed.", 202

 # Utilities

+# check if something is a domain name (approximate)
+def isDomain(s):
+	return "." in s and s.rpartition(".")[2][0].isalpha()
+
+# Safely writes JSON data to a file
+def dumpJsonToFile(filename, data):
+	with open(filename + "~", "w", encoding="utf-8") as fd:
+		json.dump(data, fd,
+			indent = "\t" if app.config["DEBUG"] else None,
+			separators = (',', ': ') if app.config["DEBUG"] else (',', ':')
+		)
+	os.replace(filename + "~", filename)
+
 # Returns ping time in seconds (up), False (down), or None (error).
 def serverUp(info):
+	sock = None
 	try:
 		sock = socket.socket(info[0], info[1], info[2])
 		sock.settimeout(3)
@@ -156,7 +208,7 @@ def serverUp(info):
 		# [7] u8        type (PACKET_TYPE_ORIGINAL)
 		buf = b"\x4f\x45\x74\x03\x00\x00\x00\x01"
 		sock.send(buf)
-		start = time.time()
+		start = time.monotonic()
 		# receive reliable packet of type CONTROL, subtype SET_PEER_ID,
 		#     with our assigned peer id as data
 		# [0] u32        protocol_id (PROTOCOL_ID)
@@ -168,7 +220,7 @@ def serverUp(info):
 		# [11] u8        controltype (CONTROLTYPE_SET_PEER_ID)
 		# [12] session_t peer_id_new
 		data = sock.recv(1024)
-		end = time.time()
+		end = time.monotonic()
 		if not data:
 			return False
 		peer_id = data[12:14]
@@ -181,18 +233,61 @@ def serverUp(info):
 		# [8] u8        controltype (CONTROLTYPE_DISCO)
 		buf = b"\x4f\x45\x74\x03" + peer_id + b"\x00\x00\x03"
 		sock.send(buf)
-		sock.close()
 		return end - start
-	except socket.timeout:
+	except (socket.timeout, socket.error):
 		return False
-	except:
+	except Exception as e:
+		app.logger.warning("Unexpected exception during serverUp: %r", e)
 		return None
+	finally:
+		if sock:
+			sock.close()
+
+
+def checkRequestAddress(server):
+	name = server.address.lower()
+
+	# example value from minetest.conf
+	EXAMPLE_TLDS = (".example.com", ".example.net", ".example.org")
+	if name == "game.minetest.net" or any(name.endswith(s) for s in EXAMPLE_TLDS):
+		return ADDR_IS_EXAMPLE
+
+	# length limit for good measure
+	if len(name) > 255:
+		return ADDR_IS_INVALID
+	# characters invalid in DNS names and IPs
+	if any(c in name for c in " @#/*\"'\t\v\r\n\x00") or name.startswith("-"):
+		return ADDR_IS_INVALID
+	# if not ipv6, there must be at least one dot (two components)
+	# Note: This is not actually true ('com' is valid domain), but we'll assume
+	#       nobody who owns a TLD will ever host a Luanti server on the root domain.
+	#       getaddrinfo also allows specifying IPs as integers, we don't want people
+	#       to do that either.
+	if ":" not in name and "." not in name:
+		return ADDR_IS_INVALID
+
+	if app.config["REJECT_PRIVATE_ADDRESSES"]:
+		# private IPs (there are more but in practice these are 99% of cases)
+		PRIVATE_NETS = ("10.", "192.168.", "127.", "0.")
+		if any(name.startswith(s) for s in PRIVATE_NETS):
+			return ADDR_IS_PRIVATE
+		# reserved TLDs
+		RESERVED_TLDS = (".localhost", ".local", ".internal")
+		if name == "localhost" or any(name.endswith(s) for s in RESERVED_TLDS):
+			return ADDR_IS_PRIVATE
+
+	# ipv4/domain with port -or- ipv6 bracket notation
+	if ("." in name and ":" in name) or (":" in name and "[" in name):
+		return ADDR_IS_INVALID_PORT
+
+	# unicode in hostname
+	# Not sure about Python but the Luanti client definitely doesn't support it.
+	if any(ord(c) > 127 for c in name):
+		return ADDR_IS_UNICODE


 # fieldName: (Required, Type, SubType)
 fields = {
-	"action": (True, "str"),
-
 	"address": (False, "str"),
 	"port": (False, "int"),

@@ -220,38 +315,83 @@ fields = {
 	"creative": (False, "bool"),
 	"dedicated": (False, "bool"),
 	"damage": (False, "bool"),
-	"liquid_finite": (False, "bool"),
 	"pvp": (False, "bool"),
 	"password": (False, "bool"),
 	"rollback": (False, "bool"),
 	"can_see_far_names": (False, "bool"),
 }

-def checkRequest(server):
+def checkRequestSchema(req):
 	for name, data in fields.items():
-		if not name in server:
-			if data[0]: return False
-			else: continue
+		if not name in req:
+			if data[0]:
+				return False
+			continue
 		#### Compatibility code ####
-		# Accept strings in boolean fields but convert it to a
-		# boolean, because old servers sent some booleans as strings.
-		if data[1] == "bool" and type(server[name]).__name__ == "str":
-			server[name] = True if server[name].lower() in ("true", "1") else False
-			continue
-		# Accept strings in integer fields but convert it to an
-		# integer, for interoperability with e.g. minetest.write_json.
-		if data[1] == "int" and type(server[name]).__name__ == "str":
-			server[name] = int(server[name])
-			continue
+		if isinstance(req[name], str):
+			# Accept strings in boolean fields but convert it to a
+			# boolean, because old servers sent some booleans as strings.
+			if data[1] == "bool":
+				req[name] = req[name].lower() in ("true", "1")
+				continue
+			# Accept strings in integer fields but convert it to an
+			# integer, for interoperability with e.g. core.write_json().
+			if data[1] == "int":
+				req[name] = int(req[name])
+				continue
 		#### End compatibility code ####
-		if type(server[name]).__name__ != data[1]:
+		if type(req[name]).__name__ != data[1]:
 			return False
 		if len(data) >= 3:
-			for item in server[name]:
+			for item in req[name]:
 				if type(item).__name__ != data[2]:
 					return False
 	return True

+def checkRequest(req):
+	# check numbers
+	for field in ("clients", "clients_max", "uptime", "game_time", "lag", "proto_min", "proto_max"):
+		if field in req and req[field] < 0:
+			return False
+
+	if req["proto_min"] > req["proto_max"]:
+		return False
+
+	BAD_CHARS = " \t\v\r\n\x00\x27"
+
+	# URL must be absolute and http(s)
+	if "url" in req:
+		url = req["url"]
+		if not url or not any(url.startswith(p) for p in ["http://", "https://"]) or \
+			any(c in url for c in BAD_CHARS):
+			del req["url"]
+
+	# reject funny business in client or mod list
+	if "clients_list" in req:
+		req["clients"] = len(req["clients_list"])
+		for val in req["clients_list"]:
+			if not val or any(c in val for c in BAD_CHARS):
+				return False
+
+	if "mods" in req:
+		for val in req["mods"]:
+			if not val or any(c in val for c in BAD_CHARS):
+				return False
+
+	# sanitize some text
+	for field in ("gameid", "mapgen", "version", "privs"):
+		if field in req:
+			s = req[field]
+			for c in BAD_CHARS:
+				s = s.replace(c, "")
+			req[field] = s
+
+	# default value
+	if "address" not in req or not req["address"]:
+		req["address"] = req["ip"]
+
+	return True
+

 def finishRequestAsync(server):
 	th = Thread(name = "ServerListThread",
@@ -260,88 +400,224 @@ def finishRequestAsync(server):
 	th.start()


-def asyncFinishThread(server):
-	checkAddress = False
-	if not "address" in server or not server["address"]:
-		server["address"] = server["ip"]
-	else:
-		checkAddress = True
+def asyncFinishThread(server: 'Server'):
+	errorTracker.remove(server.get_error_pk())

 	try:
-		info = socket.getaddrinfo(server["address"],
-			server["port"],
+		info = socket.getaddrinfo(server.address,
+			server.port,
 			type=socket.SOCK_DGRAM,
 			proto=socket.SOL_UDP)
 	except socket.gaierror:
-		app.logger.warning("Unable to get address info for %s." % (server["address"],))
+		err = "Unable to get address info for %s" % server.address
+		app.logger.warning(err)
+		errorTracker.put(server.get_error_pk(), (False, err))
 		return

-	if checkAddress:
-		addresses = set(data[4][0] for data in info)
-		if not server["ip"] in addresses:
-			app.logger.warning("Invalid IP %s for address %s (address valid for %s)."
-					% (server["ip"], server["address"], addresses))
-			return
-
-	reader = geolite2.reader()
-	try:
-		geo = reader.get(server["ip"])
-	except geoip2.errors.GeoIP2Error:
-		app.logger.warning("GeoIP lookup failure for %s." % (server["ip"],))
-
-	if geo and "continent" in geo:
-		server["geo_continent"] = geo["continent"]["code"]
+	if server.ip == server.address:
+		server.verifyLevel = 3
 	else:
-		app.logger.warning("Unable to get GeoIP Continent data for %s."
-				% (server["ip"],))
+		addresses = set(data[4][0] for data in info)
+		have_v4 = any(d[0] == socket.AF_INET for d in info)
+		have_v6 = any(d[0] == socket.AF_INET6 for d in info)
+		if server.ip in addresses:
+			server.verifyLevel = 3
+		elif (":" in server.ip and not have_v6) or ("." in server.ip and not have_v4):
+			# If the client is ipv6 and there is no ipv6 on the domain (or the inverse)
+			# then the check cannot possibly ever succeed.
+			# Because this often happens accidentally just tolerate it.
+			server.verifyLevel = 2
+		else:
+			err = "Requester IP %s does not match host %s" % (server.ip, server.address)
+			if isDomain(server.address):
+				err += " (valid: %s)" % " ".join(addresses)
+			app.logger.warning(err)
+			# handle as warning
+			errorTracker.put(server.get_error_pk(), (True, err))
+			server.verifyLevel = 1

-	server["ping"] = serverUp(info[0])
-	if not server["ping"]:
-		app.logger.warning("Server %s:%d has no ping."
-				% (server["address"], server["port"]))
+	# do this here since verifyLevel is now set
+	if serverList.checkDuplicate(server):
+		err = "Server %s port %d already exists on the list" % (server.address, server.port)
+		app.logger.warning(err)
+		errorTracker.put(server.get_error_pk(), (False, err))
 		return

-	del server["action"]
+	geo = geoip_lookup_continent(info[-1][4][0])
+	if geo:
+		server.meta["geo_continent"] = geo

+	ping = serverUp(info[0])
+	if not ping:
+		err = "Server %s port %d did not respond to ping" % (server.address, server.port)
+		if isDomain(server.address):
+			err += " (tried %s)" % info[0][4][0]
+		app.logger.warning(err)
+		errorTracker.put(server.get_error_pk(), (False, err))
+		return
+	server.meta["ping"] = round(ping, 5)
+
+	# success!
 	serverList.update(server)


-class UptimeTracker:
-	def  __init__(self):
-		self.d = {}
-		self.cleanTime = 0
-		self.lock = RLock()
-	def push(self, id, ts):
-		with self.lock:
-			if time.time() >= self.cleanTime: # clear once in a while
-				self.d.clear()
-				self.cleanTime = time.time() + 48*60*60
+# represents a single server on the list
+class Server:
+	PROPS = ("startTime", "updateCount", "updateTime", "totalClients", "verifyLevel")

-			if id in self.d:
-				self.d[id] = self.d[id][-1:] + [ts]
-			else:
-				self.d[id] = [0, ts]
-	# returns the before-last start time, in bulk
-	def getStartTimes(self):
-		ret = {}
-		with self.lock:
-			for k, v in self.d.items():
-				ret[k] = v[0]
+	def __init__(self, ip: str, port: str, address: str, meta: dict):
+		# IP of announce requester (PRIMARY KEY)
+		self.ip = ip
+		# port of server (PRIMARY KEY)
+		self.port = port
+		# connectable domain or IP
+		self.address = address
+		# public metadata
+		self.meta = meta
+		# unix time of first update
+		self.startTime = 0
+		# number of updates received
+		self.updateCount = 0
+		# unix time of last update received
+		self.updateTime = 0
+		# total clients counted over all updates
+		self.totalClients = 0
+		# how well the IP verification was passed (bigger is better)
+		self.verifyLevel = 0
+
+	# creates an instance from the data of an announce request
+	@classmethod
+	def from_request(cls, data):
+		ip = data["ip"]
+		port = data["port"]
+		address = data["address"]
+		for k in ("ip", "port", "address", "action"):
+			data.pop(k, 0)
+		return cls(ip, port, address, data)
+
+	# creates an instance from persisted data
+	@classmethod
+	def from_storage(cls, data):
+		p = data.pop()
+		obj = cls(*data)
+		for k in cls.PROPS:
+			if k in p:
+				setattr(obj, k, p[k])
+		return obj
+
+	# returns data to persist
+	def to_storage(self):
+		p = {k: getattr(self, k) for k in self.PROPS}
+		return (self.ip, self.port, self.address, self.meta, p)
+
+	# returns server dict intended for public list
+	def to_list_json(self):
+		ret = self.meta.copy()
+		ret["address"] = self.address
+		ret["port"] = self.port
+		ret["pop_v"] = self.get_average_clients()
 		return ret

+	# returns a primary key suitable for saving and replaying an error unique to a
+	# server that was announced.
+	def get_error_pk(self):
+		# some failures depend on the client IP too
+		return (self.ip, self.port, self.address)
+
+	def get_average_clients(self):
+		if self.updateCount:
+			# FIXME: this is quite biased to servers that are new (or restart often)
+			return round(self.totalClients / self.updateCount)
+		return 0
+
+	# calculate score for server list ranking (higher values first)
+	def get_score(self):
+		points = 0
+		meta = self.meta
+
+		# 1 per client
+		points += meta["clients"]
+
+		# Penalize highly loaded servers to improve player distribution
+		cap = int(meta["clients_max"] * 0.80)
+		if meta["clients"] > cap:
+			points -= meta["clients"] - cap
+
+		# 1 per month of age, limited to 8
+		points += min(8, meta["game_time"] / (60*60*24*30))
+
+		# 1/2 per average client, limited to 4
+		points += min(4, self.get_average_clients() / 2)
+
+		# -8 for unrealistic max_clients
+		if meta["clients_max"] > 200:
+			points -= 8
+
+		# -8 per second of ping over 0.4s
+		if meta["ping"] > 0.4:
+			points -= (meta["ping"] - 0.4) * 8
+
+		# reduction to 60% for servers that support both legacy (v4) and v5 clients
+		if meta["proto_min"] <= 32 and meta["proto_max"] > 36:
+			points *= 0.6
+
+		return points
+
+	def track_update(self, old: 'Server', is_update: bool):
+		# this might look a bit strange, but once a `Server` object is put into
+		# list it becomes immutable since it's under lock. So we have to copy
+		# stuff we need from the old object, and then replace it later.
+		assert old or not is_update
+		self.startTime = old.startTime if old else int(time.time())
+		self.updateTime = int(time.time())
+
+		# Make sure that startup options are saved
+		if is_update:
+			for field in ("dedicated", "rollback", "mapgen", "privs",
+					"can_see_far_names", "mods"):
+				if field in old.meta:
+					self.meta[field] = old.meta[field]
+		else:
+			self.meta["uptime"] = 0
+
+		# Popularity
+		if old:
+			self.updateCount = old.updateCount + 1
+			self.totalClients = old.totalClients + self.meta["clients"]
+			self.meta["clients_top"] = max(self.meta["clients"], old.meta["clients_top"])
+		else:
+			self.updateCount = 1
+			self.meta["clients_top"] = self.totalClients = self.meta["clients"]
+
+	# check if *this* server is a logical duplicate of the other one
+	def is_duplicate(self, other: 'Server'):
+		if self.port == other.port and self.address.lower() == other.address.lower():
+			# if everything matches it's not a duplicate but literally the same
+			if self.ip == other.ip:
+				return False
+			# we have a duplicate but the more trusted one gets to stay
+			return self.verifyLevel < other.verifyLevel
+		return False
+
+
+# Represents an ordered list of server instances as well as methods
+# to persist it.
 class ServerList:
 	def __init__(self):
 		self.list = []
 		self.maxServers = 0
 		self.maxClients = 0
+		self.storagePath = os.path.join(app.root_path, "store.json")
+		self.publicPath = os.path.join(app.static_folder, "list.json")
+		self.modified = True
 		self.lock = RLock()
+
 		self.load()
-		self.purgeOld()

 	def getWithIndex(self, ip, port):
 		with self.lock:
 			for i, server in enumerate(self.list):
-				if server["ip"] == ip and server["port"] == port:
+				if server.ip == ip and server.port == port:
 					return (i, server)
 		return (None, None)

@@ -349,92 +625,35 @@ class ServerList:
 		i, server = self.getWithIndex(ip, port)
 		return server

+	# returns true if the given server shouldn't be on the list
+	def checkDuplicate(self, other_server: Server):
+		with self.lock:
+			for server in self.list:
+				if other_server.is_duplicate(server):
+					return True
+		return False
+
 	def remove(self, server):
 		with self.lock:
 			try:
 				self.list.remove(server)
-			except:
-				pass
-
-	def sort(self):
-		start_times = tracker.getStartTimes()
-
-		def server_points(server):
-			points = 0
-
-			# 1 per client, but only 1/8 per "guest" client
-			if "clients_list" in server:
-				for name in server["clients_list"]:
-					if re.match(r"[A-Z][a-z]{3,}[1-9][0-9]{2,3}", name):
-						points += 1/8
-					else:
-						points += 1
-			else:
-				# Old server (1/4 per client)
-				points = server["clients"] / 4
-
-			# Penalize highly loaded servers to improve player distribution.
-			# Note: This doesn't just make more than 80% of max players stop
-			# increasing your points, it can actually reduce your points
-			# if you have guests.
-			cap = int(server["clients_max"] * 0.80)
-			if server["clients"] > cap:
-				points -= server["clients"] - cap
-
-			# 8 for servers with a reputable domain name
-			try:
-				ipaddress.ip_address(server["address"])
 			except ValueError:
-				for domain in app.config["IRREPUTABLE_DOMAINS"]:
-					if server["address"].endswith(domain):
-						break
-				else:
-					points += 8
-
-			# 1 per month of age, limited to 8
-			points += min(8, server["game_time"] / (60*60*24*30))
-
-			# 1/2 per average client, limited to 4
-			points += min(4, server["pop_v"] / 2)
-
-			# -8 for unrealistic max_clients
-			if server["clients_max"] > 200:
-				points -= 8
-
-			# -8 per second of ping over 0.4s
-			if server["ping"] > 0.4:
-				points -= (server["ping"] - 0.4) * 8
-
-			# Up to -8 for less than an hour of uptime (penalty linearly decreasing)
-			# only if the server has restarted before within the last 2 hours
-			HOUR_SECS = 60 * 60
-			uptime = server["uptime"]
-			if uptime < HOUR_SECS:
-				start_time = start_times.get("%s:%d" % (server["ip"], server["port"]), 0)
-				if start_time >= time.time() - 2 * HOUR_SECS:
-					points -= ((HOUR_SECS - uptime) / HOUR_SECS) * 8
-
-			# reduction to 40% for servers that support both legacy (v4) and v5 clients
-			if server["proto_min"] <= 32 and server["proto_max"] > 36:
-				points *= 0.4
-
-			return points
-
-		with self.lock:
-			self.list.sort(key=server_points, reverse=True)
+				return
+			self.modified = True

 	def purgeOld(self):
 		cutoff = int(time.time()) - app.config["PURGE_TIME"]
 		with self.lock:
 			count = len(self.list)
-			self.list = [server for server in self.list if cutoff <= server["update_time"]]
+			self.list = [server for server in self.list if cutoff <= server.updateTime]
 			if len(self.list) < count:
-				self.save()
+				self.modified = True

 	def load(self):
+		# TODO?: this is a poor man's database. maybe we should use sqlite3?
 		with self.lock:
 			try:
-				with open(os.path.join(app.static_folder, "list.json"), "r") as fd:
+				with open(self.storagePath, "r", encoding="utf-8") as fd:
 					data = json.load(fd)
 			except FileNotFoundError:
 				return
@@ -442,60 +661,117 @@ class ServerList:
 			if not data:
 				return

-			self.list = data["list"]
-			self.maxServers = data["total_max"]["servers"]
-			self.maxClients = data["total_max"]["clients"]
+			self.list = list(Server.from_storage(x) for x in data["list"])
+			self.maxServers = data["maxServers"]
+			self.maxClients = data["maxClients"]
+
+			# rewrite once in case writing format or so changed
+			self.modified = True

 	def save(self):
 		with self.lock:
-			servers = len(self.list)
+			self._saveStorage()
+			self._savePublic()
+			self.modified = False
+
+	def _saveStorage(self):
+		with self.lock:
+			if not self.modified:
+				return
+
+			out_list = list(server.to_storage() for server in self.list)
+			dumpJsonToFile(self.storagePath, {
+				"list": out_list,
+				"maxServers": self.maxServers,
+				"maxClients": self.maxClients
+			})
+
+	def _savePublic(self):
+		with self.lock:
+			if not self.modified and os.path.exists(self.publicPath):
+				return
+
+			# sort, but don't modify internal list
+			sorted_list = sorted(self.list,
+				key=(lambda server: server.get_score()), reverse=True)
+
+			out_list = []
+			servers = len(sorted_list)
 			clients = 0
-			for server in self.list:
-				clients += server["clients"]
+			for server in sorted_list:
+				out_list.append(server.to_list_json())
+				clients += server.meta["clients"]

 			self.maxServers = max(servers, self.maxServers)
 			self.maxClients = max(clients, self.maxClients)

-			list_path = os.path.join(app.static_folder, "list.json")
-			with open(list_path + "~", "w") as fd:
-				json.dump({
-						"total": {"servers": servers, "clients": clients},
-						"total_max": {"servers": self.maxServers, "clients": self.maxClients},
-						"list": self.list
-					},
-					fd,
-					indent = "\t" if app.config["DEBUG"] else None,
-					separators = (', ', ': ') if app.config["DEBUG"] else (',', ':')
-				)
-			os.replace(list_path + "~", list_path)
+			dumpJsonToFile(self.publicPath, {
+				"total": {"servers": servers, "clients": clients},
+				"total_max": {"servers": self.maxServers, "clients": self.maxClients},
+				"list": out_list
+			})

 	def update(self, server):
 		with self.lock:
-			i, old = self.getWithIndex(server["ip"], server["port"])
+			i, old = self.getWithIndex(server.ip, server.port)
 			if i is not None:
 				self.list[i] = server
 			else:
 				self.list.append(server)
+			self.modified = True

-			self.sort()
-			self.save()

-class PurgeThread(Thread):
+class ErrorTracker:
+	VALIDITY_TIME = 600
+
 	def __init__(self):
-		Thread.__init__(self)
-		self.daemon = True
+		self.table = {}
+		self.lock = RLock()
+
+	def put(self, k, info):
+		with self.lock:
+			self.table[k] = (time.monotonic() + ErrorTracker.VALIDITY_TIME, info)
+
+	def remove(self, k):
+		with self.lock:
+			self.table.pop(k, None)
+
+	def get(self, k):
+		with self.lock:
+			e = self.table.get(k)
+		if e and e[0] >= time.monotonic():
+			return e[1]
+
+	def cleanup(self):
+		with self.lock:
+			now = time.monotonic()
+			table = {k: e for k, e in self.table.items() if e[0] >= now}
+			self.table = table
+
+
+class TimerThread(Thread):
+	def __init__(self):
+		super().__init__(name="TimerThread", daemon=True)
 	def run(self):
+		next_cleanup = 0
 		while True:
-			time.sleep(60)
-			serverList.purgeOld()
+			time.sleep(max(1, LIST_SAVE_INTERVAL))
+
+			if time.monotonic() >= next_cleanup:
+				serverList.purgeOld()
+				errorTracker.cleanup()
+				next_cleanup = time.monotonic() + 60
+
+			serverList.save()
+

 # Globals / Startup

-tracker = UptimeTracker()
-
 serverList = ServerList()

-PurgeThread().start()
+errorTracker = ErrorTracker()
+
+TimerThread().start()

 if __name__ == "__main__":
 	app.run(host = app.config["HOST"], port = app.config["PORT"])
--- a/static/index.html
+++ b/static/index.html
@@ -2,10 +2,11 @@
 <html>
 <head>
 	<meta charset="utf-8">
-	<title>Minetest server list</title>
+	<title>Luanti server list</title>
+	<link rel="stylesheet" href="modern-normalize.min.css">
 	<style>
 		body {
-			font-family: Roboto, Ubuntu, "Segoe UI", sans;
+			margin: .5em;
 		}
 		a {
 			color: #336B87;
@@ -13,6 +14,10 @@
 		a:visited {
 			color: #336BA1;
 		}
+		hr {
+			border: 0;
+			border-top: 3px solid #53ac56;
+		}
 		@media only screen and (max-width: 1024px) {
 			#server_list table .version, #server_list table .flags, #server_list table .uptime {
 				display: none;
@@ -24,6 +29,8 @@
 	</script>
 </head>
 <body>
+	<span class="h"><strong>Luanti server list</strong> | <a href="https://www.luanti.org/get-involved/#reporting-issues">Contact</a> | <a href="https://www.luanti.org/app-privacy-policy/">Privacy</a></span>
+	<hr />
 	<div id="server_list"></div>
 	<script src="list.js"></script>
 </body>
--- a/static/list.js
+++ b/static/list.js
@@ -1,16 +1,21 @@
 var master;
-if (!master) master = {};
-if (typeof(master.root) == 'undefined')	master.root = window.location.href;
-if (!master.output)	master.output = '#server_list';
-if (!master.list)	master.list = "list";
-if (!master.list_root)	master.list_root = master.root;
-if (!master.list_url)	master.list_url = master.list_root + master.list;
+if (!master)
+	master = {};
+if (!master.root)
+	master.root = window.location.href;
+if (!master.list)
+	master.list = "list";
+if (!master.list_root)
+	master.list_root = master.root;
+if (!master.list_url)
+	master.list_url = master.list_root + master.list;
 master.cached_json = null;

 // Utility functions used by the templating code

 function humanTime(seconds) {
-	if (typeof(seconds) != "number") return '?';
+	if (typeof(seconds) != "number")
+		return '?';
 	var conv = {
 		y: 31536000,
 		d: 86400,
@@ -26,25 +31,25 @@ function humanTime(seconds) {
 }

 function escapeHTML(str) {
-	if(!str) return str;
+	if (!str)
+		return str;
 	return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 }

 function addressString(server) {
-	var isIPv6 = server.address.indexOf(":") != -1;
-	var addrStr = (isIPv6 ? '[' : '') +
-		escapeHTML(server.address) +
-		(isIPv6 ? ']' : '');
+	var addrStr = server.address;
+	if (addrStr.indexOf(':') != -1)
+		addrStr = '[' + addrStr + ']';
 	var shortStr = addrStr;
 	addrStr += ':' + server.port;
 	var str = '<span'
-	if (shortStr.length > 25) {
-		shortStr = shortStr.substr(0, 23) + "&hellip;";
-		str += ' title="' + addrStr + '"'
+	if (shortStr.length > 26) {
+		shortStr = shortStr.substring(0, 25) + "\u2026";
+		str += ' title="' + escapeHTML(addrStr) + '"'
 	}
 	if (server.port != 30000)
 		shortStr += ':' + server.port;
-	return str + '>' + shortStr + '</span>';
+	return str + '>' + escapeHTML(shortStr) + '</span>';
 }

 function tooltipString(str) {
@@ -53,54 +58,80 @@ function tooltipString(str) {
 }

 function hoverList(name, list) {
-	if (!list || list.length == 0) return '';
+	if (!list || list.length == 0)
+		return '';
 	var str = '<div class="mts_hover_list">'
-	str += '<b>' + name + '</b> (' + list.length + ')<br />';
+	str += '<b>' + escapeHTML(name) + '</b> (' + list.length + ')<br />';
 	for (var i in list) {
 		str += escapeHTML(list[i]) + '<br />';
 	}
 	return str + '</div>';
 }

-function hoverString(name, string) {
-	if (!string) return '';
+function hoverString(name, str) {
+	if (!str)
+		return '';
+	if (typeof(str) != 'string')
+		str = str.toString();
 	return '<div class="mts_hover_list">'
-		+ '<b>' + name + '</b>:<br />'
-		+ escapeHTML(string) + '<br />'
+		+ '<b>' + escapeHTML(name) + '</b>:<br />'
+		+ escapeHTML(str) + '<br />'
 		+ '</div>';
 }

 function constantWidth(str, width) {
-	return '<span class="mts_cwidth" style="width:' + width + 'em;">' + str + '</span>';
+	if (typeof(str) != 'string')
+		str = str.toString();
+	return '<span class="mts_cwidth" style="width:' + width + 'em;">' + escapeHTML(str) + '</span>';
 }

 // Code that fetches & displays the actual list

-function draw(json) {
+master.draw = function(json) {
 	if (json == null)
 		return;

-	var html = window.render.servers(json);
-	jQuery(master.output).html(html);
-	jQuery('.proto_select', master.output).on('change', function(e) {
-		master.proto_range = e.target.value;
-		draw(master.cached_json); // re-render
-	});
-}
+	// pre-filter by chosen protocol range
+	var tmp = master.proto_range ? JSON.parse(master.proto_range) : null;
+	if (tmp) {
+		json = {
+			list: json.list.filter(function(server) {
+				return !(tmp[0] > server.proto_max || tmp[1] < server.proto_min);
+			}),
+			total: {clients: 0},
+			total_max: {clients: "?", servers: "?"}
+		};
+		json.list.forEach(function(server) { json.total.clients += server.clients; });
+		json.total.servers = json.list.length;
+	}

-function get() {
+	var html = window.render.servers(json);
+	jQuery('#server_list').html(html);
+
+	jQuery('.proto_select', '#server_list').on('change', function(e) {
+		master.proto_range = e.target.value;
+		master.draw(master.cached_json); // re-render
+	});
+};
+
+master.get = function() {
 	jQuery.getJSON(master.list_url, function(json) {
 		master.cached_json = json;
-		draw(json);
+		master.draw(json);
 	});
-}
+};

-function loaded(){
-	if (!master.no_refresh) {
-		setInterval(get, 60 * 1000);
-	}
-	get();
-}
+master.loaded = function() {
+	if (!master.no_refresh)
+		setInterval(master.get, 60 * 1000);
+	master.get();
+};
+
+master.showAll = function() {
+	delete master.min_clients;
+	delete master.limit;
+	master.get();
+};


 // https://github.com/pyrsmk/toast
@@ -108,8 +139,8 @@ this.toast=function(){var e=document,t=e.getElementsByTagName("head")[0],n=this.

 toast(master.root + 'style.css', master.root + 'servers.js', function() {
 	if (typeof(jQuery) != 'undefined')
-		return loaded();
+		return master.loaded();
 	else
-		toast('//ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js', loaded);
+		toast('//ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js', master.loaded);
 });

--- a/static/modern-normalize.min.css
+++ b/static/modern-normalize.min.css
@@ -0,0 +1,9 @@
+/**
+ * Minified by jsDelivr using clean-css v5.3.2.
+ * Original file: /npm/modern-normalize@3.0.1/modern-normalize.css
+ *
+ * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files
+ */
+/*! modern-normalize v3.0.1 | MIT License | https://github.com/sindresorhus/modern-normalize */
+*,::after,::before{box-sizing:border-box}html{font-family:system-ui,'Segoe UI',Roboto,Helvetica,Arial,sans-serif,'Apple Color Emoji','Segoe UI Emoji';line-height:1.15;-webkit-text-size-adjust:100%;tab-size:4}body{margin:0}b,strong{font-weight:bolder}code,kbd,pre,samp{font-family:ui-monospace,SFMono-Regular,Consolas,'Liberation Mono',Menlo,monospace;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}table{border-color:currentcolor}button,input,optgroup,select,textarea{font-family:inherit;font-size:100%;line-height:1.15;margin:0}[type=button],[type=reset],[type=submit],button{-webkit-appearance:button}legend{padding:0}progress{vertical-align:baseline}::-webkit-inner-spin-button,::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}summary{display:list-item}
+/*# sourceMappingURL=/sm/d2d8cd206fb9f42f071e97460f3ad9c875edb5e7a4b10f900a83cdf8401c53a9.map */
--- a/static/servers.jst
+++ b/static/servers.jst
@@ -7,8 +7,8 @@
 	{{? master.show_proto_select}}
 	, Protocol: <select class="proto_select">
 		<option value="">All</option>
-		<option value="[11,32]" {{? master.proto_range=='[11,32]'}}selected{{?}}>11-32 (Minetest 0.4)</option>
-		<option value="[37,99]" {{? master.proto_range=='[37,99]'}}selected{{?}}>37 (Minetest 5.0)</option>
+		<option value="[11,32]" {{? master.proto_range=='[11,32]'}}selected{{?}}>11-32 (0.4 series)</option>
+		<option value="[37,99]" {{? master.proto_range=='[37,99]'}}selected{{?}}>37+ (5.0 or newer)</option>
 	</select>{{?}}
 </div>
 {{?}}
@@ -16,7 +16,7 @@
 	<thead><tr>
 		{{? !master.no_address}}<th>Address[:Port]</th>{{?}}
 		{{? !master.no_clients}}<th>Players / Max{{? !master.no_avgtop}}<br/>Average / Top{{?}}</th>{{?}}
-		{{? !master.no_version}}<th class="version">Version, Subgame[, Mapgen]</th>{{?}}
+		{{? !master.no_version}}<th class="version">Version, Game, Mapgen</th>{{?}}
 		{{? !master.no_name}}<th>Name</th>{{?}}
 		{{? !master.no_description}}<th>Description</th>{{?}}
 		{{? !master.no_flags}}<th class="flags">Flags</th>{{?}}
@@ -24,11 +24,9 @@
 		{{? !master.no_ping}}<th>Ping, Lag</th>{{?}}
 	</tr></thead>
 	<tbody>
-	{{ var tmp = master.proto_range ? JSON.parse(master.proto_range) : null;}}
 	{{~it.list :server:index}}
 	{{ if (master.limit && index + 1 > master.limit) break;}}
 	{{ if (master.min_clients && server.clients < master.min_clients) continue;}}
-	{{ if (tmp && (tmp[0] > server.proto_max || tmp[1] < server.proto_min)) continue;}}
 	<tr>
 		{{? !master.no_address}}
 		<td class="address">
@@ -49,7 +47,7 @@
 		{{? !master.no_name}}
 		<td class="name">
 			{{? server.url}}
-				<a href="{{!server.url}}">{{=tooltipString(server.name)}}</a>
+				<a href="{{!server.url}}" target="_blank">{{=tooltipString(server.name)}}</a>
 			{{??}}
 				{{=tooltipString(server.name)}}
 			{{?}}
@@ -65,8 +63,6 @@
 			{{=server.damage ? 'Dmg ' : ''}}
 			{{=server.pvp ? 'PvP ' : ''}}
 			{{=server.password ? 'Pwd ' : ''}}
-			{{=server.rollback ? 'Rol ' : ''}}
-			{{=server.can_see_far_names ? 'Far ' : ''}}
 		</td>{{?}}
 		{{? !master.no_uptime}}
 		<td class="uptime">
@@ -81,5 +77,5 @@
 	</tbody>
 </table>
 {{? master.min_clients || master.limit}}
-	<a href="javascript:delete master.min_clients; delete master.limit; get();">Show more...</a>
+	<a href="javascript:master.showAll()">Show all...</a>
 {{?}}
--- a/static/style.css
+++ b/static/style.css
@@ -50,7 +50,7 @@
 	max-width: 32ch;
 }
 #server_list td.description {
-	max-width: 64ch;
+	max-width: 70ch;
 }

 .mts_hover_list {
Author	SHA1	Message	Date
sfan5	fda88af676	Replace outdated URLs	2025-10-16 16:20:11 +02:00
sfan5	2f66e1deca	Fix logic error in server duplicate check	2025-10-16 13:45:09 +02:00
sfan5	258add93e0	Fix average client calculation	2025-02-17 19:55:30 +01:00
sfan5	de30a4e1ac	Limit updates of list to disk to every 5s	2025-02-17 19:38:27 +01:00
sfan5	b93b50ad11	Move sorting into save operation	2025-02-17 19:38:27 +01:00
sfan5	431ac110c7	Adjust legacy support penalty	2025-02-17 19:38:27 +01:00
sfan5	aedabc50a8	Logically deduplicate servers on list	2025-02-17 19:38:27 +01:00
sfan5	6df3b93f48	Encapsulate server data into class, split persistency	2025-02-17 19:38:27 +01:00
sfan5	f71be0af67	Drop intended verification changes As discussed internally there are some edge cases where this would require unreasonable changes on the server owner's part	2025-02-17 19:38:27 +01:00
sfan5	cd0f2a56d0	Add editorconfig	2025-02-17 19:38:27 +01:00
sfan5	4d320bbcf5	Set short max_age for list.json	2024-11-03 12:42:37 +01:00
sfan5	5d191896f3	Some documentation adjustments	2024-11-03 12:38:50 +01:00
sfan5	77951100b9	Apply Luanti rename	2024-11-02 18:25:05 +01:00
sfan5	6edaa91315	Rework domain verification a bit (#67 ) Co-authored-by: ShadowNinja <ShadowNinja@users.noreply.github.com>	2024-10-22 22:53:17 +02:00
sfan5	a8a9d92077	Fix some complaints from pylint	2024-10-14 23:54:06 +02:00
sfan5	3d08cd4ff4	Report delayed errors (#66 )	2024-10-14 22:39:09 +02:00
sfan5	dcc8d5ec74	Get rid of uptime tracking and point penalty closes #37	2024-10-05 15:22:54 +02:00
sfan5	df032cb47c	Some adjustments to script and template	2024-10-04 11:32:23 +02:00
sfan5	967c1a0b51	Apply modern-normalize CSS	2024-10-04 11:26:27 +02:00
sfan5	4533842e41	Add contact and privacy links	2024-10-04 10:44:55 +02:00
sfan5	1f1af8828c	Check request data more carefully	2024-07-08 19:51:55 +02:00
sfan5	4584459fca	Don't penalize no clients_list	2024-07-08 18:53:26 +02:00
sfan5	85aff93b02	Fix templating instructions	2024-03-28 16:03:12 +01:00
ROllerozxa	17b52cd647	Subgame -> Game in serverlist frontend	2024-03-28 15:55:04 +01:00
sfan5	78e6c48c85	Drop support for announce via GET	2024-03-06 23:07:08 +01:00
sfan5	cb8fa58df4	Sanity check server addresses against common mistakes	2024-03-03 23:57:09 +01:00
sfan5	c02ed9f07a	Fix serverUp error handling	2024-03-03 23:57:09 +01:00
sfan5	d945b26f9f	Add minimal lint workflow	2024-03-02 18:55:10 +01:00
sfan5	12ed8aff60	Use 'sans-serif' in font CSS sans is a non-portable alias for sans-serif	2023-07-09 15:52:47 +02:00
Buckaroo Banzai	6fba704bb0	use `max_age` instead of `cache_timeout` (for flask > 2.0)	2023-05-05 10:36:08 +02:00
sfan5	218f8d9bc5	Fix cache control for geoip response Storing this in public caches is not actually safe.	2022-09-20 22:49:13 +02:00
sfan5	b0fed2e9f7	Switch GeoIP backend to be able to use an up-to-date database	2022-09-20 22:23:11 +02:00
sofar	d2f09370f7	Add interface for client to lookup it's own continent (#34 ) This adds `/geoip` which returns a json object with one key-value pair, `continent` = `unknown` or one of `NA`, `SA` etc. plus a 200 exit code, or a 500 code if things went south badly.	2022-09-20 21:53:04 +02:00
sfan5	84a40e406b	Remove "guest" user penalty Much overdue as the mobile apps that justified this are long gone closes #50, closes #17	2021-09-05 21:06:57 +02:00
sfan5	2f4ffde916	Recalculate stats with protocol filter applied closes #49	2021-09-05 20:47:37 +02:00