index.php

<?php
require_once 'config/config.php';
require_once 'program/include/iniset.php';

session_name("Asteroid2Id");
session_start(['use_strict_mode' => true]);

$odb = new ods_db();
if (!$odb->open()) {
    var_dump('DB connect error: ' . $odb->error->getMessage());
}
$pdo = $odb->db;

if (!empty($_SESSION['uid'])) {
    guardIp($pdo, $_SESSION['uid'], $_SESSION['role'], $_SESSION['userid']);
}

$route = $_GET['do'] ?? 'home';

if ($route === 'login' && $_SERVER['REQUEST_METHOD'] === 'POST') {

    $login = trim($_POST['login'] ?? $_POST['inputLogin'] ?? '');
    $pass = $_POST['pass'] ?? $_POST['inputPassword'] ?? '';

    $stmt = $pdo->prepare('SELECT id, password_hash, role FROM user WHERE login = ?');
    $stmt->execute([$login]);
    $u = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($u && password_verify($pass, $u['password_hash'])) {

        $_SESSION['uid'] = $u['id'];
        $_SESSION['role'] = $u['role'];
        $_SESSION['userid'] = $login;
        $_SESSION['admin'] = ($u['role'] === 'admin');
        $_SESSION['login'] = $login;

        guardIp($pdo, $u['id'], $u['role'], $login);

        header('Location: ./');
        exit;
    }

    $error = 'Неверный логин или пароль';
}

$base_uri = dirname($_SERVER["PHP_SELF"]);
if ($base_uri == '/')
    $base_uri = '';


if (isset($_GET['n'])) {
    $ds = new ods_device();
    $ds->run();
    exit;
}

if (isset($_GET['asterisk'])) {
    if (in_array($_SERVER['REMOTE_ADDR'], $config['aster_whitelist'])) {
        $aster = new ods_aster();

        if (isset($_GET['fn']) && $_GET['fn'] == 'callconfirm') {
            if (isset($_GET['id']) && isset($_GET['dialstatus']) && isset($_GET['hangupcause'])) {
                $ok = $aster->callconfirm($_GET['id'], $_GET['hangupcause'], $_GET['dialstatus']);
                echo $ok ? 'OK' : 'ERROR';
            }
        }

        if (isset($_GET['fn']) && $_GET['fn'] == 'incall') {
            if (isset($_GET['cid']) && isset($_GET['did'])) {
                $ok = $aster->incall($_GET['did'], $_GET['cid']);
                echo $ok ? 'OK' : 'ERROR';
            }
        }
    } else {
        header("HTTP/1.1 403 Forbidden");
        echo 'Access denied';
    }
    exit;
}

if (strpos($_SERVER['REQUEST_URI'], 'images/tiles/') !== false) {
    session_write_close();
    if (isset($_SESSION['userid'])) {
        $tiles = new ods_tiles();
        $tiles->run($base_uri);
    } else
        header("HTTP/1.1 401 Unauthorized");

    exit;
}


if (strpos($_SERVER['REQUEST_URI'], 'images/') !== false) {
    session_write_close();
    if (isset($_SESSION['userid'])) {
        $svg = new ods_svg();
        $svg->run();
    } else
        header("HTTP/1.1 401 Unauthorized");
    exit;
}

$mui = new ods_mui();
$language = $mui->langDetect();
$mui->changeLang($language);

if (strpos($_SERVER['REQUEST_URI'], 'js/') !== false) {
    session_write_close();
    if (isset($_SESSION['userid'])) {
        $js = new ods_js();
        $js->run();
    } else
        header("HTTP/1.1 401 Unauthorized");
    exit;
}

if ('api' == @$_GET['do']) {
    session_write_close();
    if (isset($_SESSION['userid'])) {
        $api = new ods_api();
        $api->run();
    } else
        header("HTTP/1.1 401 Unauthorized");
    exit;
}

$loader = new Twig_Loader_Filesystem('templates');
$options = array();
if ($config['debug'])
    $options['cache'] = false;
else
    $options['cache'] = 'cache/twig_c_cache';
$twig = new Twig_Environment($loader, $options);
$twig->addExtension(new Twig_Extensions_Extension_I18n());

$loginfail = "hide";

//$template = 'apppage.html';
$template = 'map.html';
if ('login' == @$_GET['do']) {
    $template = 'login.html';
    if (isset($_SESSION['userid']))
        unset($_SESSION['userid']);
} else {
    if (!isset($_SESSION['userid'])) {
        $loc = $base_uri . '/' . '?do=login';
        $uri = $_SERVER['REQUEST_URI'];
        if (!empty($uri) && !stristr($uri, "login"))
            $loc .= '&b=' . urlencode($uri);
        if (empty($_SERVER['HTTPS'])) {
            sleep(2);
            $loc = $base_uri . '/' . '?do=login';
        }
        header("Location: $loc");
    }
}
if ($template != 'login.html') {
    $do = 'form';
    if (isset($_GET['do']))
        $do = $_GET['do'];

    $clearuri = strtok($_SERVER['REQUEST_URI'], '?');

    if (in_array($clearuri, [$base_uri, $base_uri . '/'])) {
        //$fn='map';
        $loc = $base_uri . '/' . 'map';
        header("Location: $loc");
        exit();
    } else
        $fn = basename($clearuri);

    if (isset($_GET['fn']))
        $fn = $_GET['fn'];

    if ('form' == $do)
        $template = $fn . '.html';
}

try {
    $template = $twig->loadTemplate($template);
} catch (Exception $e) {
    $debug['error'] = $e->getMessage();
    $template = $twig->loadTemplate('404.html');
}

//$form = new ods_form();

$head['title'] = _("Asteroid");

$params = array(
    'version' => $config['version'],
    'configtime' => $config['time'],
    'languages' => $config['languages'],
    'language' => $language,
    'language_ts' => $mui->poTime(),
    'head' => $head,
    'user' => @ $_SESSION['userid'],
    'admin' => @ $_SESSION['admin'],
    'demo' => @ $_SESSION['demo'],
    '_GET' => @$_GET,
    'base_uri' => $base_uri,
    'debugmode' => $config['debug'],
    'dim_width' => $config['dim_width'],
    'dim_maxvalue' => $config['dim_maxvalue'],
    'dim_percent' => $config['dim_percent'],
    'wide_tiles' => $config['wide_tiles'],
    'phone_letters' => $config['phone_letters'],
    'phone_format' => $config['phone_format'],
    'domain' => $_SERVER['SERVER_NAME'],
    'appdata' => $appdata,
    'template' => $template
);

if ($params['debugmode'])
    $params['debug'] = $debug;
header("Content-Security-Policy: default-src 'self' 'unsafe-inline'; img-src * 'self' data: https:;");
//  header("Content-Security-Policy: default-src 'self' 'unsafe-inline'; img-src 'self' data:;");
if ($template == 'login.html') {
    $params['loginfail'] = $loginfail;
    header('Cache-Control:  no-cache, must-revalidate');
} elseif ($template == '404.html') {
    header('Cache-Control:  no-store, no-cache, must-revalidate, max-age=0');
    header($_SERVER['SERVER_PROTOCOL'] . " 404 Not Found");
} elseif (isset($_SESSION['userid'])) {
    $kstr = filemtime('templates/' . $template);
    $kstr .= filemtime('config/config.php');
    $kstr .= filemtime('index.php');
    $kstr .= @$_SESSION['userid'];
    $etag = md5($kstr) . '.' . $language;

    if (substr_count($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip')) {
        header('Content-Encoding: gzip');
        ob_start('ob_gzhandler');
    }
    header('Cache-Control: private, must-revalidate');
    header("Etag: $etag");
    header('Vary: Accept-Encoding, Cookie');
    header_remove("Pragma");
    header_remove("Expires");

    if (isset($_SERVER['HTTP_IF_NONE_MATCH']) && trim($_SERVER['HTTP_IF_NONE_MATCH']) == $etag) {
        header($_SERVER['SERVER_PROTOCOL'] . " 304 Not Modified");
        exit;
    }
}
if (strpos($_SERVER['REQUEST_URI'], '/users') !== false) {
    if ($_SESSION['userid'] !== 'odmin') {
        header('HTTP/1.1 403 Forbidden');
        exit('Access denied');
    }

    require_once 'program/include/ods_admin.php';
    $adm = new ods_admin($pdo);

    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        $uid = (int)($_POST['uid'] ?? 0);
        $act = $_POST['action'] ?? '';

        try {
            switch ($act) {

                case 'reset_ip':
                    $adm->resetIp($uid);
                    header('Location: users?resetok=1'); exit;

                case 'reset_device':
                    $adm->resetDevice($uid);
                    header('Location: users?devok=1'); exit;

                case 'lock_ips':
                    $adm->lockIps($uid);
                    header('Location: users?lockok=1'); exit;

                case 'delete_user':
                    if ($uid === (int)$_SESSION['uid']) {
                        header('Location: users?error=own'); exit;
                    }
                    $adm->deleteUser($uid);
                    header('Location: users?delok=1'); exit;

                default:
                    $adm->createUser($_POST);
                    header('Location: users?ok='.urlencode($_POST['login'])); exit;
            }

        } catch (Exception $e) {
            header('Location: users?error='.urlencode($e->getMessage())); exit;
        }
    }

    $users = $adm->listUsers();
    $template = $twig->loadTemplate('users.html');
    $page = [
        'ok'      => $_GET['ok']      ?? null,
        'resetok' => $_GET['resetok'] ?? null,
        'devok'   => $_GET['devok']   ?? null,
        'lockok'  => $_GET['lockok']  ?? null,
        'delok'   => $_GET['delok']   ?? null,
        'error'   => ($_GET['error'] ?? null) === 'own'
            ? 'Cannot delete your own account'
            : ($_GET['error'] ?? null),
        'users'   => $users,
    ];

    echo $twig->render('users.html', array_merge($params, $page));
    $odb->close();
    exit;
}
echo $template->render($params);
$odb->close();