submit.php

<?php
/**
 * ExploitInject Central Form Shield & Rate-Limiter Endpoint
 * Proxies submissions to FormFarm, enforces 5-min IP/Email rate limits,
 * blocks bot spam like "Robertkashy", and attaches real IP & Country.
 */

header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, X-Requested-With');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}

$RATE_LIMIT_SECONDS = 300; // 5 minutes
$CACHE_FILE = __DIR__ . '/.rate_limit_cache.json';

// FormFarm Endpoint Mapping
$FORM_ENDPOINTS = [
    'connect'      => 'https://form.codewithtanim.works/f/7b1f93e7e128ca95',
    'customdev'    => 'https://form.codewithtanim.works/f/6bf4080dfd608ce7',
    'order'        => 'https://form.codewithtanim.works/f/3ea86707b152e669',
    'consultation' => 'https://form.codewithtanim.works/f/f8871eaef6723a52',
    'join'         => 'https://form.codewithtanim.works/f/2cef8dd7a9c0099c',
    'nodia'        => 'https://form.codewithtanim.works/f/2cef8dd7a9c0099c',
    'idea'         => 'https://form.codewithtanim.works/f/2cef8dd7a9c0099c'
];

function getClientIp() {
    $ip = $_SERVER['REMOTE_ADDR'] ?? '';
    if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
        $ip = trim($ips[0]);
    } elseif (!empty($_SERVER['HTTP_CLIENT_IP'])) {
        $ip = trim($_SERVER['HTTP_CLIENT_IP']);
    }
    return filter_var($ip, FILTER_VALIDATE_IP) ? $ip : ($_SERVER['REMOTE_ADDR'] ?? '127.0.0.1');
}

function getCountryByIp($ip) {
    if (empty($ip) || $ip === '127.0.0.1' || $ip === '::1') return 'Local';
    try {
        $ch = curl_init("https://api.country.is/" . urlencode($ip));
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_TIMEOUT, 3);
        $res = curl_exec($ch);
        curl_close($ch);
        if ($res) {
            $data = json_decode($res, true);
            if (!empty($data['country'])) return $data['country'];
        }
    } catch (Exception $e) {}
    return 'Unknown';
}

function isJsonRequest() {
    $accept = $_SERVER['HTTP_ACCEPT'] ?? '';
    $requestedWith = $_SERVER['HTTP_X_REQUESTED_WITH'] ?? '';
    return (strpos($accept, 'application/json') !== false || strtolower($requestedWith) === 'xmlhttprequest');
}

function sendResponse($success, $message, $remainingSec = 0, $redirectUrl = '') {
    if (isJsonRequest()) {
        header('Content-Type: application/json');
        echo json_encode([
            'success' => $success,
            'error' => $success ? null : $message,
            'remainingSec' => $remainingSec
        ]);
        exit;
    }

    if ($success && !empty($redirectUrl)) {
        header('Location: ' . $redirectUrl);
        exit;
    }

    // HTML Error Response
    header('HTTP/1.1 429 Too Many Requests');
    echo '<!DOCTYPE html><html><head><title>Form Submission Notice</title>';
    echo '<style>body{font-family:sans-serif;background:#0d1117;color:#fff;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;}';
    echo '.card{background:#161b22;border:1px solid #30363d;padding:30px;border-radius:12px;text-align:center;max-width:450px;}';
    echo 'h2{color:#f87171;} p{color:#8b949e;} a{color:#58a6ff;text-decoration:none;}</style></head><body>';
    echo '<div class="card"><h2>⚠️ Submission Notice</h2>';
    echo '<p>' . htmlspecialchars($message) . '</p>';
    echo '<p><a href="javascript:history.back()">← Go back and try again</a></p></div></body></html>';
    exit;
}

function sanitizeInput($data) {
    if (is_array($data)) {
        return array_map('sanitizeInput', $data);
    }
    if (is_string($data)) {
        return htmlspecialchars(strip_tags(trim($data)), ENT_QUOTES, 'UTF-8');
    }
    return $data;
}

// 1. Read & Sanitize Form Payload
$rawInput = file_get_contents('php://input');
$jsonPayload = json_decode($rawInput, true);
$rawPayload = is_array($jsonPayload) ? array_merge($_POST, $jsonPayload) : $_POST;
$payload = sanitizeInput($rawPayload);

$formId = strtolower(trim($payload['_form_id'] ?? $payload['form_id'] ?? 'connect'));
$email = strtolower(trim($payload['email'] ?? $payload['fi-sender-email'] ?? $payload['user_email'] ?? ''));
$redirectUrl = $payload['_redirect'] ?? '../Thank-You';
$clientIp = getClientIp();
$now = time();

// 2. Anti-Bot Filter (Honeypot & Spam Term "Robertkashy")
if (!empty($payload['_honeypot'])) {
    // Honeypot filled -> Fake success to fool bot
    sendResponse(true, 'Submitted successfully', 0, $redirectUrl);
}

$payloadDump = strtolower(json_encode($payload));
if (strpos($payloadDump, 'robertkashy') !== false) {
    // Spam bot term -> Fake success to fool bot
    sendResponse(true, 'Submitted successfully', 0, $redirectUrl);
}

// 3. Rate Limit Enforcement (5 minutes per IP or Email)
$fp = @fopen($CACHE_FILE, 'c+');
if ($fp) {
    flock($fp, LOCK_EX);
    $fileSize = filesize($CACHE_FILE);
    $content = $fileSize > 0 ? fread($fp, $fileSize) : '[]';
    $records = json_decode($content, true) ?: [];

    $validRecords = [];
    $matchedRecord = null;

    foreach ($records as $rec) {
        if (($now - $rec['timestamp']) < $RATE_LIMIT_SECONDS) {
            $validRecords[] = $rec;
            if (!$matchedRecord) {
                $ipMatch = (!empty($clientIp) && !empty($rec['ip']) && $rec['ip'] === $clientIp);
                $emailMatch = (!empty($email) && !empty($rec['email']) && $rec['email'] === $email);
                if ($ipMatch || $emailMatch) {
                    $matchedRecord = $rec;
                }
            }
        }
    }

    if ($matchedRecord) {
        $elapsed = $now - $matchedRecord['timestamp'];
        $remainingSec = max(1, $RATE_LIMIT_SECONDS - $elapsed);
        $mins = floor($remainingSec / 60);
        $secs = $remainingSec % 60;
        $timeStr = $mins > 0 ? "{$mins}m {$secs}s" : "{$secs}s";

        ftruncate($fp, 0);
        rewind($fp);
        fwrite($fp, json_encode($validRecords));
        fflush($fp);
        flock($fp, LOCK_UN);
        fclose($fp);

        sendResponse(false, "To prevent spam, form submissions are limited to once every 5 minutes. Please wait {$remainingSec} seconds before submitting again.", $remainingSec);
    }

    // Record Valid Submission
    $validRecords[] = [
        'ip' => $clientIp,
        'email' => $email,
        'timestamp' => $now
    ];

    ftruncate($fp, 0);
    rewind($fp);
    fwrite($fp, json_encode($validRecords));
    fflush($fp);
    flock($fp, LOCK_UN);
    fclose($fp);
}

// 4. Attach Geo Info (IP & Country)
$countryName = $payload['user_country'] ?? $payload['Country'] ?? '';
if (empty($countryName) || $countryName === 'Detecting...' || $countryName === 'Pending/Unavailable') {
    $countryName = getCountryByIp($clientIp);
}

$payload['User_ip'] = $clientIp;
$payload['User_country'] = $countryName;
$payload['IP Address'] = $clientIp;
$payload['Country'] = $countryName;

// 5. Determine Target FormFarm Endpoint
$targetUrl = $FORM_ENDPOINTS[$formId] ?? $FORM_ENDPOINTS['connect'];

// 6. Forward Request to FormFarm via cURL
$ch = curl_init($targetUrl);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

sendResponse(true, 'Submitted successfully', 0, $redirectUrl);