<?php
// Version
define('VERSION', '2.1.0.1');

// Configuration
if (is_file('config.php')) {
	require_once('config.php');
}

// IH: remove vqmod cache file on each load
file_put_contents(DIR_MSHOP . '/vqmod/checked.cache', '');
//file_put_contents(DIR_MSHOP . '/vqmod/mods.cache', '');

// Post Configuration - Assign default value if it is not defined in config.php
if (!defined('MONSTER_DB_ADMIN_ID')) {
	// The database ID for the Adminstrator (Monster App internal use only) - default value = 1
	define('MONSTER_DB_ADMIN_ID', '1');
}

if (!defined('MONSTER_PLAN_NAME_FREE_PLAN')) {
	// The name for Free Plan - default = 'free'
	define('MONSTER_PLAN_NAME_FREE_PLAN', 'free');
}

// Install
if (!defined('DIR_APPLICATION')) {
	header('Location: install/index.php');
	exit;
}

// VirtualQMOD
require_once(DIR_MSHOP . '/vqmod/vqmod.php');
VQMod::bootup();

// VQMODDED Startup
require_once(VQMod::modCheck(DIR_SYSTEM . 'startup.php'));

// Registry
$registry = new Registry();

// Loader
$loader = new Loader($registry);
$registry->set('load', $loader);

// Config
$config = new Config();
$registry->set('config', $config);

// Database
$db = new DB(DB_DRIVER, DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, DB_DATABASE, DB_PORT);
$registry->set('db', $db);

// Default DateTimeSet Hong Kong
date_default_timezone_set('Asia/Hong_Kong');

// Store
if (isset($_SERVER['HTTPS']) && (($_SERVER['HTTPS'] == 'on') || ($_SERVER['HTTPS'] == '1'))) {
	$store_query = $db->query("SELECT * FROM " . DB_PREFIX . "store WHERE REPLACE(`ssl`, 'www.', '') = '" . $db->escape('https://' . str_replace('www.', '', $_SERVER['HTTP_HOST']) . rtrim(dirname($_SERVER['PHP_SELF']), '/.\\') . '/') . "'");
} else {
	$store_query = $db->query("SELECT * FROM " . DB_PREFIX . "store WHERE REPLACE(`url`, 'www.', '') = '" . $db->escape('http://' . str_replace('www.', '', $_SERVER['HTTP_HOST']) . rtrim(dirname($_SERVER['PHP_SELF']), '/.\\') . '/') . "'");
}

if ($store_query->num_rows) {
	$config->set('config_store_id', $store_query->row['store_id']);
} else {
	$config->set('config_store_id', 0);
}

// Settings
$query = $db->query("SELECT `store_id`, `key`, `value`, `serialized` FROM `" . DB_PREFIX . "setting` WHERE store_id = '0'");

foreach ($query->rows as $result) {
	if (!$result['serialized']) {
		$config->set($result['key'], $result['value']);
	} else {
		$config->set($result['key'], json_decode($result['value'], true));
	}
}

if ((int)$config->get('config_store_id') != 0) {
	$query = $db->query("SELECT `store_id`, `key`, `value`, `serialized` FROM `" . DB_PREFIX . "setting` WHERE store_id = '" . (int)$config->get('config_store_id') . "'");

	foreach ($query->rows as $result) {
		if (!$result['serialized']) {
			$config->set($result['key'], $result['value']);
		} else {
			$config->set($result['key'], json_decode($result['value'], true));
		}
	}
}

if (!$store_query->num_rows) {
	$config->set('config_url', HTTP_SERVER);
	$config->set('config_ssl', HTTPS_SERVER);
}

//Unlimited colors theme
$theme = $config->get( $config->get( 'config_template') . '_skin'  );
$store = 'default';
if($config->get( 'config_store_id' ) == 0) { 
	$store = 'default';
} else {
	$store = $config->get( 'config_store_id' );
}

require_once(DIR_SYSTEM . 'library/themeoptions.php');
$theme_options = new ThemeOptions($config->get('config_template'), $store, $theme);
$registry->set('theme_options', $theme_options);


$url = new Url($config->get('config_url'), $config->get('config_secure') ? $config->get('config_ssl') : $config->get('config_url'));
$registry->set('url', $url);

// Log
$log = new Log($config->get('config_error_filename'));
$registry->set('log', $log);

function error_handler($code, $message, $file, $line) {
	global $log, $config;

	// error suppressed with @
	if (error_reporting() === 0) {
		return false;
	}

	switch ($code) {
		case E_NOTICE:
		case E_USER_NOTICE:
			$error = 'Notice';
			break;
		case E_WARNING:
		case E_USER_WARNING:
			$error = 'Warning';
			break;
		case E_ERROR:
		case E_USER_ERROR:
			$error = 'Fatal Error';
			break;
		default:
			$error = 'Unknown';
			break;
	}

	if ($config->get('config_error_display')) {
		echo '<b>' . $error . '</b>: ' . $message . ' in <b>' . $file . '</b> on line <b>' . $line . '</b>';
	}

	if ($config->get('config_error_log')) {
		$log->write('PHP ' . $error . ':  ' . $message . ' in ' . $file . ' on line ' . $line);
	}

	return true;
}

// Error Handler
set_error_handler('error_handler');

// PHP Composer
require_once(DIR_SYSTEM . 'composer/vendor/autoload.php');

// Request
$request = new Request();
$registry->set('request', $request);

// Response
$response = new Response();
$response->addHeader('Content-Type: text/html; charset=utf-8');
$response->setCompression($config->get('config_compression'));
$registry->set('response', $response);

// Cache
$cache = new Cache('file');
$registry->set('cache', $cache);

// New Redis cache, for oversell
// $redis_cache = new RedisCache();
// $registry->set('redis_cache', $redis_cache);

// JWT
require DIR_SYSTEM . "library/php-jwt/vendor/autoload.php";

// Session
if (isset($request->get['route']) && substr($request->get['route'], 0, 9) == 'mshopapi/') {
	// Internal mshopAPI
	$db->query("DELETE FROM `" . DB_PREFIX . "api_session` WHERE TIMESTAMPADD(HOUR, 1, date_modified) < NOW()");
	
	// Authorization Header
	// Ref: https://stackoverflow.com/questions/40582161/how-to-properly-use-bearer-tokens
	$access_token = null;
	if (isset($request->get['token'])) {
		$access_token = $request->get['token'];
	} else {
		if (isset($request->server['Authorization'])) {
			$headers = trim($request->server['Authorization']);
		} else if (isset($request->server['HTTP_AUTHORIZATION'])) { // Nginx or fast CGI
			$headers = trim($request->server['HTTP_AUTHORIZATION']);
		} elseif (function_exists('apache_request_headers')) {
			$requestHeaders = apache_request_headers();
			// Server-side fix for bug in old Android versions (a nice side-effect of this fix means we don't care about capitalization for Authorization)
			$requestHeaders = array_combine(array_map('ucwords', array_keys($requestHeaders)), array_values($requestHeaders));
			if (isset($requestHeaders['Authorization'])) {
				$headers = trim($requestHeaders['Authorization']);
			}
		}
		if (!empty($headers)) {
			if (preg_match('/Bearer\s(\S+)/', $headers, $matches)) {
				$access_token = $matches[1];
			}
		}
	}
	
	
	$query = $db->query("SELECT DISTINCT * FROM `" . DB_PREFIX . "api` `a` LEFT JOIN `" . DB_PREFIX . "api_session` `as` ON (a.api_id = as.api_id) LEFT JOIN " . DB_PREFIX . "api_ip `ai` ON (as.api_id = ai.api_id) WHERE a.status = '1' AND as.token = '" . $db->escape($access_token) . "' AND ai.ip = '" . $db->escape($request->server['REMOTE_ADDR']) . "'");

	$api_id = 0;
	if ($query->num_rows) {
		$api_id = $query->row['api_id'];
		
		// Does not seem PHP is able to handle sessions as objects properly so so wrote my own class
		$session = new Session($query->row['session_id'], $query->row['session_name']);
		$registry->set('session', $session);

		// keep the session alive
		$db->query("UPDATE `" . DB_PREFIX . "api_session` SET date_modified = NOW() WHERE api_session_id = '" . $query->row['api_session_id'] . "'");
	} else {
		$session = new Session();
		$session->data['api_id'] = $api_id;
		$registry->set('session', $session);
	}
	
	$full_url = (isset($request->server['HTTPS']) && $request->server['HTTPS'] === 'on' ? "https" : "http") . "://" . $request->server['HTTP_HOST'] . $request->server['REQUEST_URI'];
	$db->query("INSERT INTO " . DB_PREFIX . "api_log (api_id, http_method, api_endpoint, full_url, ip, date_added) VALUES (" . $api_id . ", '" . $db->escape($request->server['REQUEST_METHOD']) . "', '" . $db->escape($request->get['route']) . "', '". $db->escape(html_entity_decode($full_url)) . "', '" . $db->escape($request->server['REMOTE_ADDR']) . "', NOW())");
} else if (isset($request->get['token']) && isset($request->get['route']) && substr($request->get['route'], 0, 4) == 'api/') {
	$db->query("DELETE FROM `" . DB_PREFIX . "api_session` WHERE TIMESTAMPADD(HOUR, 1, date_modified) < NOW()");

	$query = $db->query("SELECT DISTINCT * FROM `" . DB_PREFIX . "api` `a` LEFT JOIN `" . DB_PREFIX . "api_session` `as` ON (a.api_id = as.api_id) LEFT JOIN " . DB_PREFIX . "api_ip `ai` ON (as.api_id = ai.api_id) WHERE a.status = '1' AND as.token = '" . $db->escape($request->get['token']) . "' AND ai.ip = '" . $db->escape($request->server['REMOTE_ADDR']) . "'");

	if ($query->num_rows) {
		// Does not seem PHP is able to handle sessions as objects properly so so wrote my own class
		$session = new Session($query->row['session_id'], $query->row['session_name']);
		$registry->set('session', $session);

		// keep the session alive
		$db->query("UPDATE `" . DB_PREFIX . "api_session` SET date_modified = NOW() WHERE api_session_id = '" . $query->row['api_session_id'] . "'");
	}
} else if (isset($request->get['route']) && substr($request->get['route'], 0, 4) == 'n8n/') {
	// Any security needed for n8n webhook / API
	// zeabur n8n ip: 54.168.113.197
	$n8n_whitelist_ip = ['54.168.113.197'];
	$n8n_response = ["status" => FALSE];
	
	if (in_array($request->server['REMOTE_ADDR'], $n8n_whitelist_ip)) {
		$session = new Session();
		$registry->set('session', $session);
	} else {
		$n8n_response['code'] = 403;
		$n8n_response['message'] = 'Forbidden: IP not allowed';
		$response->addHeader('HTTP/1.1 403 Forbidden');
		$response->addHeader('Content-Type: application/json');
		$response->setOutput(json_encode($n8n_response));
		$response->output();
		return;
	}
} else {
	$session = new Session();
	$registry->set('session', $session);
}

// Language Detection
$languages = array();

$query = $db->query("SELECT * FROM `" . DB_PREFIX . "language`");

foreach ($query->rows as $result) {
	if ($result['status'] == "1") {
		$languages[$result['code']] = $result;
	}
	$full_languages[$result['code']] = $result;
}

if ( ($request->server['REQUEST_METHOD'] === 'GET') && !empty($request->get['language']) && array_key_exists($request->get['language'], $languages) ) {
	// e.g. GET language=zh-TW
	$code = $request->get['language'];
	$session->data['language'] = $code;
	
/* if (isset($request->get['language']) && array_key_exists($request->get['language'], $languages)) {
	$code = $request->get['language'];
	// KP: Remove language get parameter to allow changing language at frontend
	$full_url = (isset($request->server['HTTPS']) ? "https" : "http") . "://" . $request->server['HTTP_HOST'] . $request->server['REQUEST_URI'];
	list($base_url, $url_query) = explode('?', $full_url, 2);
	parse_str(html_entity_decode($url_query), $url_query_array);
	unset($url_query_array['language']);
	
	$session->data['language'] = $code;
	if (empty($url_query_array)) {
		$response->redirect($base_url);
	} else {
		$response->redirect($base_url . '?' . urldecode(http_build_query($url_query_array)));
	}
*/
} elseif (isset($session->data['language']) && array_key_exists($session->data['language'], $languages)) {
	$code = $session->data['language'];
} elseif (isset($request->cookie['language']) && array_key_exists($request->cookie['language'], $languages)) {
	$code = $request->cookie['language'];
} else {
	$detect = '';

	if (isset($request->server['HTTP_ACCEPT_LANGUAGE']) && $request->server['HTTP_ACCEPT_LANGUAGE']) {
		$browser_languages = explode(',', $request->server['HTTP_ACCEPT_LANGUAGE']);

		foreach ($browser_languages as $browser_language) {
			foreach ($languages as $key => $value) {
				if ($value['status']) {
					$locale = explode(',', $value['locale']);

					if (in_array($browser_language, $locale)) {
						$detect = $key;
						break 2;
					}
				}
			}
		}
	}

	$code = $detect ? $detect : $config->get('config_language');
}

if (!isset($session->data['language']) || $session->data['language'] != $code) {
	$session->data['language'] = $code;
}

if (!isset($request->cookie['language']) || $request->cookie['language'] != $code) {
	$session->set_cookie('language', $code);
}

$config->set('config_language_id', $languages[$code]['language_id']);
$config->set('config_language', $languages[$code]['code']);
$config->set('admin_config_language_id', $full_languages[$config->get('config_admin_language')]['language_id']);

// Language
$language = new Language($registry, $languages[$code]['directory']);
$language->load($languages[$code]['directory']);
$registry->set('language', $language);

// Document
$registry->set('document', new Document($registry));

// Chinese Conversion Library
$chinese = new Chinese($registry);
$registry->set('chinese', $chinese);

// Customer
$customer = new Customer($registry);
$registry->set('customer', $customer);

// Customer Group
if ($customer->isLogged()) {
	$config->set('config_customer_group_id', $customer->getGroupId());
} elseif (isset($session->data['customer']) && isset($session->data['customer']['customer_group_id'])) {
	// For API calls
	$config->set('config_customer_group_id', $session->data['customer']['customer_group_id']);
} elseif (isset($session->data['guest']) && isset($session->data['guest']['customer_group_id'])) {
	$config->set('config_customer_group_id', $session->data['guest']['customer_group_id']);
}

// Tracking Code
if (isset($request->get['tracking'])) {
	$session->set_cookie('tracking', $request->get['tracking']);

	$db->query("UPDATE `" . DB_PREFIX . "marketing` SET clicks = (clicks + 1) WHERE code = '" . $db->escape($request->get['tracking']) . "'");
}

// Affiliate
$registry->set('affiliate', new Affiliate($registry));

// Currency
$registry->set('currency', new Currency($registry));

// Tax
$registry->set('tax', new Tax($registry));

// Weight
$registry->set('weight', new Weight($registry));

// Length
$registry->set('length', new Length($registry));

// Coupon Pro
$registry->set('couponPro', new CouponPro($registry));

// Cart
$registry->set('cart', new Cart($registry));

// Encryption
$registry->set('encryption', new Encryption($config->get('config_encryption')));

// Encryption Pro
$registry->set('encryption_pro', new Encryption_Pro($registry, DB_DATABASE));

// OpenBay Pro
$registry->set('openbay', new Openbay($registry));

// Shipping Data
$registry->set('shippingdata', new Shippingdata($registry));

// Google Content API
$registry->set('googleProduct', new GoogleProduct($registry));

// FTP
$registry->set('ftp', new Ftp($registry));

// TapPay
if ($config->get('tappay_status') === '1') {
	$registry->set('tappay', new Tappay($registry));
}

// Scheduling
$registry->set('schedule', new Schedule($registry));

// Account Charge
$registry->set('charge', new Charge($registry));

// Event
$event = new Event($registry);
$registry->set('event', $event);

$query = $db->query("SELECT * FROM " . DB_PREFIX . "event");

foreach ($query->rows as $result) {
	$event->register($result['trigger'], $result['action']);
}

// Front Controller
$controller = new Front($registry);

// Maintenance Mode
$controller->addPreAction(new Action('common/maintenance'));

// SEO URL's
$controller->addPreAction(new Action('common/seo_url'));

// Router
if (isset($request->get['route'])) {
	if (method_exists($session, "isAppkumaSession") && $session->isAppkumaSession()) {
		$action = new Action($request->get['route'] . '/appkuma');
	} else {
		$action = new Action($request->get['route']);
	}
} else {
	$action = new Action('common/home');
}

// Dispatch
$controller->dispatch($action, new Action('error/not_found'));

// Output
$response->output();