From a6dba7e628641677f41dd613e195e13fb44ce347 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 6 May 2026 23:47:15 +0000
Subject: [PATCH] fix: address code review - explicit column list in fallback
 query, extract raw XML toggle into named function

Agent-Logs-Url: https://github.com/GameServerPanel/GSP/sessions/aecffd5d-b644-4e4d-b13e-b392e78d4606

Co-authored-by: iaretechnician <2749183+iaretechnician@users.noreply.github.com>
---
 modules/billing/serverlist.php          | 5 ++++-
 modules/config_games/config_servers.php | 3 ++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/modules/billing/serverlist.php b/modules/billing/serverlist.php
index e8887838..35c60c1c 100644
--- a/modules/billing/serverlist.php
+++ b/modules/billing/serverlist.php
@@ -51,7 +51,10 @@ $result_services = $db->query($qry_services);
 if (!$result_services) {
     // config_homes join may not exist on all installs; fall back to services-only query
     $where_clause_fallback = str_replace('bs.', '', $where_clause);
-    $qry_services_fallback = "SELECT *, NULL AS cfg_game_name, NULL AS cfg_game_key
+    $qry_services_fallback = "SELECT service_id, home_cfg_id, enabled, service_name, description,
+                                      img_url, price_monthly, slot_min_qty, slot_max_qty,
+                                      remote_server_id,
+                                      NULL AS cfg_game_name, NULL AS cfg_game_key
                                FROM {$table_prefix}billing_services
                                {$where_clause_fallback}
                                ORDER BY service_name";
diff --git a/modules/config_games/config_servers.php b/modules/config_games/config_servers.php
index 6ead9475..c4fc149f 100644
--- a/modules/config_games/config_servers.php
+++ b/modules/config_games/config_servers.php
@@ -1155,7 +1155,8 @@ function exec_ogp_module() {
 					echo "<hr style='margin:24px 0;border-color:#333'>";
 					echo "<h3 style='margin-bottom:8px'>Full Raw XML Editor</h3>";
 					echo "<div class='xml-raw-warning'>&#x26A0; <strong>Warning:</strong> Saving raw XML bypasses the guided editor. The file will be validated against the schema before saving. Invalid XML will be rejected.</div>";
-					echo "<button type='button' id='raw_xml_toggle_btn' class='xml-raw-toggle' onclick=\"(function(){var s=document.getElementById('raw_xml_section');var b=document.getElementById('raw_xml_toggle_btn');if(s.style.display!=='block'){s.style.display='block';b.textContent='Hide Raw XML Editor';}else{s.style.display='none';b.textContent='Show Raw XML Editor';}})();\">Show Raw XML Editor</button>";
+					echo "<script>function gspToggleRawXml(){var s=document.getElementById('raw_xml_section');var b=document.getElementById('raw_xml_toggle_btn');if(s.style.display!=='block'){s.style.display='block';b.textContent='Hide Raw XML Editor';}else{s.style.display='none';b.textContent='Show Raw XML Editor';}}</script>";
+					echo "<button type='button' id='raw_xml_toggle_btn' class='xml-raw-toggle' onclick='gspToggleRawXml()'>Show Raw XML Editor</button>";
 					echo "<div id='raw_xml_section' class='xml-raw-section'>";
 					echo "<form action='?m=config_games&amp;home_cfg_id=".$home_cfg_id."' method='post'>";
 					echo "<input type='hidden' name='home_cfg_id' value='".(int)$home_cfg_id."'>";