index.php

<?php
require_once 'config/config.php';
require_once 'program/include/iniset.php';

session_name("Asteroid2Id");
session_start(['use_strict_mode' => true]);

$pdo = null; $odb = null;
$AUTH_MODE = $config['auth_mode'] ?? 'hybrid';
function db_open_lazy() {
    global $pdo, $odb;
    if ($pdo) return $pdo;
    $odb = new ods_db();
    if (!$odb->open()) { return null; }
    $pdo = $odb->db;
    return $pdo;
}

function login_via_db(string $login, string $pass): bool {
    global $pdo, $config;
    $pdo = db_open_lazy();
    if (!$pdo) return false;

    $stmt = $pdo->prepare('SELECT id, login, password_hash, role FROM user WHERE login = ?');
    $stmt->execute([$login]);
    $u = $stmt->fetch(PDO::FETCH_ASSOC);
    if (!$u || !password_verify($pass, $u['password_hash'])) return false;

    $_SESSION['uid']    = (int)$u['id'];
    $_SESSION['role']   = $u['role'];
    $_SESSION['userid'] = $u['login'];
    $_SESSION['admin']  = ($u['role'] === 'admin');
    $_SESSION['db_user']= true;

    guardIp($pdo, (int)$u['id'], $u['role'], $u['login']);
    return true;
}

function hybrid_autocreate_if_needed(string $login, string $pass): void {
    global $config, $pdo;
    if (empty($config['hybrid_autocreate'])) return;

    $pdo = db_open_lazy();
    if (!$pdo) return;

    $role = in_array($login, $config['admin'] ?? [], true) ? 'admin' : 'user';
    $chk = $pdo->prepare('SELECT id FROM user WHERE login=?');
    $chk->execute([$login]);
    if ($chk->fetch()) return;

    $hash = password_hash($pass, PASSWORD_DEFAULT);
    $ins  = $pdo->prepare('INSERT INTO user(login,password_hash,role,legit_ips,dev_token) VALUES (?,?,?,?,NULL)');
    $ins->execute([$login, $hash, $role, '[]']);
}

if (!empty($_SESSION['uid']) && !empty($_SESSION['db_user'])) {
    $pdo = db_open_lazy();
    if ($pdo) {
        guardIp($pdo, (int)$_SESSION['uid'], $_SESSION['role'] ?? 'user', $_SESSION['userid'] ?? '');
    }
}

$route = $_GET['do'] ?? 'home';

$loginfail = "hide";
if (isset($_POST['inputLogin']) && isset($_POST['inputPassword'])) {

    $login = trim($_POST['inputLogin']);
    $pass  = $_POST['inputPassword'];

    if ($AUTH_MODE === 'db') {
        if (login_via_db($login, $pass)) {
            $loc = !empty($_POST['back']) ? $_POST['back'] : '?do=form';
            header("Location: $loc"); exit;
        }
        $loginfail = "show";
    }
    elseif ($AUTH_MODE === 'hybrid') {
        if (login_via_db($login, $pass)) {
            $loc = !empty($_POST['back']) ? $_POST['back'] : '?do=form';
            header("Location: $loc"); exit;
        }

        $legacy_ok = (
            (in_array($login, $config['admin'] ?? []) && $pass === ($config['admin_pass'][array_search($login, $config['admin'])] ?? '')) ||
            (in_array($login, $config['user']  ?? []) && $pass === ($config['user_pass'][array_search($login, $config['user'])] ?? '')) ||
            (in_array($login, $config['demo']  ?? []) && $pass === ($config['demo_pass'][array_search($login, $config['demo'])] ?? ''))
        );

        if ($legacy_ok) {
            $_SESSION['userid'] = $login;
            $_SESSION['admin']  = in_array($login, $config['admin'] ?? [], true);
            $_SESSION['demo']   = in_array($login, $config['demo']  ?? [], true);

            hybrid_autocreate_if_needed($login, $pass);

            $loc = !empty($_POST['back']) ? $_POST['back'] : '?do=form';
            header("Location: $loc"); exit;
        }

        $loginfail = "show";
    }
    else {
        if(
            ($login == ($config['admin'][0] ?? null) && $pass == ($config['admin_pass'][0] ?? null)) ||
            ($login == ($config['admin'][1] ?? null) && $pass == ($config['admin_pass'][1] ?? null)) ||
            ($login == ($config['admin'][2] ?? null) && $pass == ($config['admin_pass'][2] ?? null)) ||
            ($login == ($config['admin'][3] ?? null) && $pass == ($config['admin_pass'][3] ?? null)) ||
            ($login == ($config['admin'][4] ?? null) && $pass == ($config['admin_pass'][4] ?? null)) ||
            ($login == ($config['admin'][5] ?? null) && $pass == ($config['admin_pass'][5] ?? null)) ||
            ($login == ($config['user'][0]  ?? null) && $pass == ($config['user_pass'][0]  ?? null)) ||
            ($login == ($config['user'][1]  ?? null) && $pass == ($config['user_pass'][1]  ?? null)) ||
            ($login == ($config['user'][2]  ?? null) && $pass == ($config['user_pass'][2]  ?? null)) ||
            ($login == ($config['demo'][0]  ?? null) && $pass == ($config['demo_pass'][0]  ?? null)) ||
            ($login == ($config['demo'][1]  ?? null) && $pass == ($config['demo_pass'][1]  ?? null))
        ) {
            $_SESSION['userid'] = $login;
            $_SESSION['admin']  = in_array($login, $config['admin'] ?? [], true);
            $_SESSION['demo']   = in_array($login, $config['demo']  ?? [], true);

            $loc = !empty($_POST['back']) ? $_POST['back'] : '?do=form';
            header("Location: $loc"); exit;
        }
        else $loginfail = "show";
    }
}

$base_uri = dirname($_SERVER["PHP_SELF"]);
if ($base_uri == '/')
    $base_uri = '';


if (isset($_GET['n'])) {
    $ds = new ods_device();
    $ds->run();
    exit;
}

if (isset($_GET['asterisk'])) {
    if (in_array($_SERVER['REMOTE_ADDR'], $config['aster_whitelist'])) {
        $aster = new ods_aster();

        if (isset($_GET['fn']) && $_GET['fn'] == 'callconfirm') {
            if (isset($_GET['id']) && isset($_GET['dialstatus']) && isset($_GET['hangupcause'])) {
                $ok = $aster->callconfirm($_GET['id'], $_GET['hangupcause'], $_GET['dialstatus']);
                echo $ok ? 'OK' : 'ERROR';
            }
        }

        if (isset($_GET['fn']) && $_GET['fn'] == 'incall') {
            if (isset($_GET['cid']) && isset($_GET['did'])) {
                $ok = $aster->incall($_GET['did'], $_GET['cid']);
                echo $ok ? 'OK' : 'ERROR';
            }
        }
    } else {
        header("HTTP/1.1 403 Forbidden");
        echo 'Access denied';
    }
    exit;
}

if (strpos($_SERVER['REQUEST_URI'], 'images/tiles/') !== false) {
    session_write_close();
    if (isset($_SESSION['userid'])) {
        $tiles = new ods_tiles();
        $tiles->run($base_uri);
    } else
        header("HTTP/1.1 401 Unauthorized");

    exit;
}


if (strpos($_SERVER['REQUEST_URI'], 'images/') !== false) {
    session_write_close();
    if (isset($_SESSION['userid'])) {
        $svg = new ods_svg();
        $svg->run();
    } else
        header("HTTP/1.1 401 Unauthorized");
    exit;
}

$mui = new ods_mui();
$language = $mui->langDetect();
$mui->changeLang($language);

if (strpos($_SERVER['REQUEST_URI'], 'js/') !== false) {
    session_write_close();
    if (isset($_SESSION['userid'])) {
        $js = new ods_js();
        $js->run();
    } else
        header("HTTP/1.1 401 Unauthorized");
    exit;
}

if ('api' == @$_GET['do']) {
    session_write_close();
    if (isset($_SESSION['userid'])) {
        $api = new ods_api();
        $api->run();
    } else
        header("HTTP/1.1 401 Unauthorized");
    exit;
}

$loader = new Twig_Loader_Filesystem('templates');
$options = array();
if ($config['debug'])
    $options['cache'] = false;
else
    $options['cache'] = 'cache/twig_c_cache';
$twig = new Twig_Environment($loader, $options);
$twig->addExtension(new Twig_Extensions_Extension_I18n());

$template = 'map.html';
if ('login' == @$_GET['do']) {
    $template = 'login.html';
    if (isset($_SESSION['userid']))
        unset($_SESSION['userid']);
} else {
    if (!isset($_SESSION['userid'])) {
        $loc = $base_uri . '/' . '?do=login';
        $uri = $_SERVER['REQUEST_URI'];
        if (!empty($uri) && !stristr($uri, "login"))
            $loc .= '&b=' . urlencode($uri);
        if (empty($_SERVER['HTTPS'])) {
            sleep(2);
            $loc = $base_uri . '/' . '?do=login';
        }
        header("Location: $loc");
    }
}
if ($template != 'login.html') {
    $do = 'form';
    if (isset($_GET['do']))
        $do = $_GET['do'];

    $clearuri = strtok($_SERVER['REQUEST_URI'], '?');

    if (in_array($clearuri, [$base_uri, $base_uri . '/'])) {
        //$fn='map';
        $loc = $base_uri . '/' . 'map';
        header("Location: $loc");
        exit();
    } else
        $fn = basename($clearuri);

    if (isset($_GET['fn']))
        $fn = $_GET['fn'];

    if ('form' == $do)
        $template = $fn . '.html';
}

try {
    $template = $twig->loadTemplate($template);
} catch (Exception $e) {
    $debug['error'] = $e->getMessage();
    $template = $twig->loadTemplate('404.html');
}

$head['title'] = _("Asteroid");

$params = array(
    'version' => $config['version'],
    'configtime' => $config['time'],
    'languages' => $config['languages'],
    'language' => $language,
    'language_ts' => $mui->poTime(),
    'head' => $head,
    'user' => @ $_SESSION['userid'],
    'admin' => @ $_SESSION['admin'],
    'demo' => @ $_SESSION['demo'],
    '_GET' => @$_GET,
    'base_uri' => $base_uri,
    'debugmode' => $config['debug'],
    'dim_width' => $config['dim_width'],
    'dim_maxvalue' => $config['dim_maxvalue'],
    'dim_percent' => $config['dim_percent'],
    'wide_tiles' => $config['wide_tiles'],
    'phone_letters' => $config['phone_letters'],
    'phone_format' => $config['phone_format'],
    'domain' => $_SERVER['SERVER_NAME'],
    'appdata' => $appdata,
    'template' => $template
);

if ($params['debugmode'])
    $params['debug'] = $debug;
header("Content-Security-Policy: default-src 'self' 'unsafe-inline'; img-src * 'self' data: https:;");
//  header("Content-Security-Policy: default-src 'self' 'unsafe-inline'; img-src 'self' data:;");
if ($template == 'login.html') {
    $params['loginfail'] = $loginfail;
    header('Cache-Control:  no-cache, must-revalidate');
} elseif ($template == '404.html') {
    header('Cache-Control:  no-store, no-cache, must-revalidate, max-age=0');
    header($_SERVER['SERVER_PROTOCOL'] . " 404 Not Found");
} elseif (isset($_SESSION['userid'])) {
    $kstr = filemtime('templates/' . $template);
    $kstr .= filemtime('config/config.php');
    $kstr .= filemtime('index.php');
    $kstr .= @$_SESSION['userid'];
    $etag = md5($kstr) . '.' . $language;

    if (substr_count($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip')) {
        header('Content-Encoding: gzip');
        ob_start('ob_gzhandler');
    }
    header('Cache-Control: private, must-revalidate');
    header("Etag: $etag");
    header('Vary: Accept-Encoding, Cookie');
    header_remove("Pragma");
    header_remove("Expires");

    if (isset($_SERVER['HTTP_IF_NONE_MATCH']) && trim($_SERVER['HTTP_IF_NONE_MATCH']) == $etag) {
        header($_SERVER['SERVER_PROTOCOL'] . " 304 Not Modified");
        exit;
    }
}
if (strpos($_SERVER['REQUEST_URI'], '/users') !== false) {
    if ($_SESSION['userid'] !== 'odmin') {
        header('HTTP/1.1 403 Forbidden');
        exit('Access denied');
    }
    $pdo = db_open_lazy();
    if (!$pdo) {
        header('HTTP/1.1 500 Internal Server Error'); exit('DB error');
    }

    require_once 'program/include/ods_admin.php';
    $adm = new ods_admin($pdo);

    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        $uid = (int)($_POST['uid'] ?? 0);
        $act = $_POST['action'] ?? '';

        try {
            switch ($act) {

                case 'reset_ip':
                    $adm->resetIp($uid);
                    header('Location: users?resetok=1'); exit;

                case 'reset_device':
                    $adm->resetDevice($uid);
                    header('Location: users?devok=1'); exit;

                case 'lock_ips':
                    $adm->lockIps($uid);
                    header('Location: users?lockok=1'); exit;

                case 'delete_user':
                    if ($uid === (int)$_SESSION['uid']) {
                        header('Location: users?error=own'); exit;
                    }
                    $adm->deleteUser($uid);
                    header('Location: users?delok=1'); exit;

                default:
                    $adm->createUser($_POST);
                    header('Location: users?ok='.urlencode($_POST['login'])); exit;
            }

        } catch (Exception $e) {
            header('Location: users?error='.urlencode($e->getMessage())); exit;
        }
    }

    $users = $adm->listUsers();
    $template = $twig->loadTemplate('users.html');
    $page = [
        'ok'      => $_GET['ok']      ?? null,
        'resetok' => $_GET['resetok'] ?? null,
        'devok'   => $_GET['devok']   ?? null,
        'lockok'  => $_GET['lockok']  ?? null,
        'delok'   => $_GET['delok']   ?? null,
        'sessionUid' => $_SESSION['uid'],
        'error'   => ($_GET['error'] ?? null) === 'own'
            ? 'Cannot delete your own account'
            : ($_GET['error'] ?? null),
        'users'   => $users,
    ];

    echo $twig->render('users.html', array_merge($params, $page));
    $odb->close();
    exit;
}
echo $template->render($params);
if ($odb) { $odb->close(); }