<?php

// Supress error displaying (error reports are in HTML format, which messes up JSON formatting)
$void = ini_set('display_errors', 0);
$void = ini_set('display_startup_errors', 0);

// Check success and error displaying status
if ($void === false && (ini_get('display_errors') === '1' || ini_get('display_startup_errors') === '1')) {
    http_response_code(500);
    echo json_encode([
        'success' => false,
        'error' => 'Internal Server Error',
        'message' => 'Failed to supress error displaying.',
        'code' => 500
    ]);
    error_log('Failed to supress error displaying.');
    exit;
}

// Start session => Should make session variables accessible
session_start();

// Set content type to JSON
header('Content-Type: application/json');

// Determine language
$lang = isset($_POST['lang']) ? preg_replace('/[^a-zA-Z0-9\-]/', '', $_POST['lang']) : 'en-US';
if (!in_array($lang, ['en-US', 'cs-CZ'])) {
    $lang = 'en-US';
}

// Include ajax response templates
$ajax_templates = json_decode(file_get_contents(__DIR__ . "/../.incl/translations/$lang/ajax/responses.json"));

// Get session token and given token
$session_token = isset($_SESSION['token']) ? $_SESSION['token'] : null;
$given_token = isset($_POST['token']) ? $_POST['token'] : null;

// Check that referer is local server
if (!isset($_SERVER['HTTP_REFERER']) || (parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST) != $_SERVER['SERVER_NAME'])) {
    http_response_code(403);
    echo json_encode([
        'success' => false,
        'error' => $ajax_templates->invalid_referer->heading ?? 'Invalid referer',
        'message' => $ajax_templates->invalid_referer->message ?? 'Direct access not permitted.',
        'code' => 403
    ]);
    error_log('Invalid referer: ' . ($_SERVER['HTTP_REFERER'] ?? '(none)'));
    exit;
}

// Check that this is a valid POST request
if ($_SERVER['REQUEST_METHOD'] != 'POST' || empty($_POST)) {
    http_response_code(400);
    echo json_encode([
        'success' => false,
        'error' => $ajax_templates->invalid_request->heading ?? 'Invalid request',
        'message' => $ajax_templates->invalid_request->message ?? 'This endpoint expects a POST request with valid parameters.',
        'code' => 400
    ]);
    error_log('Invalid request method: ' . ($_SERVER['REQUEST_METHOD'] ?? '(none)'));
    exit;
}

// Check session token
if (is_null($session_token) || is_null($given_token) || $session_token !== $given_token) {
    http_response_code(401);
    echo json_encode([
        'success' => false,
        'error' => $ajax_templates->invalid_session_token->heading ?? 'Invalid session token',
        'message' => $ajax_templates->invalid_session_token->message
            ?? 'Session token is invalid. Please reload the page and try again.',
        'code' => 401
    ]);
    error_log('Invalid session token.\n  Given: ' . ($given_token ?? '(none)')
        . '\n  Expected: ' . ($session_token ?? '(session token not initiated)'));
    exit;
}

// Include Cloudflare Turnstile validation
require_once(__DIR__ . '/../.incl/functions/cf_validate.php');

// Prepare email data
//----------------------------------------------------------------

// Host information
$host = $_SERVER['HTTP_HOST'];

// Contact info
$to = 'kontakt@czghost.cz';                 // Recipient email address
$sender = 'REDACTED_FOR_PRIVACY';             // Sender/return path address to avoid SPF errors

// Email details
$email = isset($_POST['from']) ? filter_var($_POST['from'], FILTER_SANITIZE_EMAIL) : null;
$name = isset($_POST['name']) ? (trim($_POST['name']) ?? 'Anonymous') : 'Anonymous';
$subject = isset($_POST['subject']) ? trim($_POST['subject']) : null;
$message = isset($_POST['message']) ? (trim($_POST['message']) ?? 'Message not provided') : 'Message not provided';

// Email headers
$headers = [
    "From"          => "\"$name\" <$email>",            // Sender's name and email address
    "Reply-To"      =>  $email,                         // Reply-To email address
    'Sender'        =>  $sender,                        // Technical sender address to avoid SPF errors
    'Return-Path'   =>  $sender,                        // Return-Path address to avoid SPF errors
    'MIME-Version'  => '1.0',                           // MIME protocol version
    'Content-Type'  => 'text/plain; charset=UTF-8',     // MIME Content-Type header
    'X-Mailer'      => "Contact form at $host"          // Mailer application
];

// Prepare MIME headers and set up valid format
$mime_headers = [];
foreach ($headers as $key => $value) {
    $mime_headers[] = "$key: $value";
}
$mail_headers = join("\n", $mime_headers);

// Validate form fields
//----------------------------------------------------------------

// Check for empty email field
if (is_null($email) || empty($email)) {
    http_response_code(400);
    echo json_encode([
        'success' => false,
        'error' => $ajax_templates->email_is_required->heading ?? 'Email is required',
        'message' => $ajax_templates->email_is_required->message ?? 'Please provide your email address.',
        'code' => 400
    ]);
    error_log('Missing sender email address');
    exit;
}

// Check for valid email format
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    http_response_code(400);
    echo json_encode([
        'success' => false,
        'error' => $ajax_templates->invalid_email_address->heading ?? 'Invalid email address',
        'message' => $ajax_templates->invalid_email_address->message ?? 'Please provide a valid email address.',
        'code' => 400
    ]);
    error_log('Invalid sender email address: ' . $email);
    exit;
}

// Validate other fields as needed
if (is_null($subject) || empty($subject)) {
    http_response_code(400);
    echo json_encode([
        'success' => false,
        'error' => $ajax_templates->subject_is_required->heading ?? 'Subject is required',
        'message' => $ajax_templates->subject_is_required->message ?? 'Please provide a subject for your message.',
        'code' => 400
    ]);
    error_log('Missing subject in contact form');
    exit;
}

// Send email
if (mail($to, $subject, "New message from $name sent via contact form at $host:\n\n$message", $mail_headers, '-f' . $sender)) {
    // Email successfully sent
    http_response_code(200);
    echo json_encode([
        'success' => true,
        'title' => $ajax_templates->email_sent_successfully->heading ?? 'Email sent successfully',
        'message' => $ajax_templates->email_sent_successfully->message ?? 'Your message has been sent successfully.',
        'code' => 200
    ]);
} else {
    // Email failed to send
    http_response_code(500);
    echo json_encode([
        'success' => false,
        'error' => $ajax_templates->failed_to_send_email->heading ?? "Failed to send email",
        'message' => str_replace('${host}', $host, $ajax_templates->failed_to_send_email->message) ?? "Failed to send email, please try again later. If the problem persists, contact me at <a href=\"mailto:contact@$host\">contact@$host</a>.",
        'code' => 500
    ]);
    error_log('Failed to send email: ' . print_r(error_get_last(), true));
}

// Clear session data and destroy session
session_unset();
session_destroy();
exit;

?>

# No directory listing, no multi views
Options -Indexes

# Redirects and rewrites allowed
RewriteEngine on

# Redirect HTTP to HTTPS
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R,L]

# Redirect direct requests for "index.php?lang=xyz" to "/xyz/"
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{QUERY_STRING} lang=([a-z]{2,3})
RewriteRule ^(index\.php)?$ https://%{HTTP_HOST}/%1/? [R=301,L]

# Redirect direct requests for "root.php?lang=xyz" to "/xyz/root/"
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{QUERY_STRING} lang=([a-z]{2,3})
RewriteRule ^(root\.php)$ https://%{HTTP_HOST}/%1/root/? [R=301,L]

# Redirect direct requests for "root.php?lang=xyz&path=<anything>" to "/xyz/root/<anything>"
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{QUERY_STRING} lang=([a-z]{2,3})
RewriteCond %{QUERY_STRING} path=(.+)
RewriteRule ^(root\.php)$ https://%{HTTP_HOST}/%1/root/%{QUERY_STRING_UNESCAPED:path}? [R=301,L,NE]

# Redirect direct requests for "root.php?path=<anything>" to "/root/<anything>"
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{QUERY_STRING} path=(.+)
RewriteRule ^(root\.php)$ https://%{HTTP_HOST}/root/%{QUERY_STRING_UNESCAPED:path}? [R=301,L,NE]

# Redirect direct requests for "index.php" to "/"
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteRule ^index\.php$ https://%{HTTP_HOST}/? [R=301,L]

# Redirect direct requests for "root.php" to "/root/"
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteRule ^root\.php$ https://%{HTTP_HOST}/root/? [R=301,L]

# Redirect "/xyz/root" to "/xyz/root/" (with the slash at the end)
RewriteRule ^([a-z]{2,3})/root$ ./root/? [R=301,L]

# Internally rewrite "/xyz/root/" to "/root.php?lang=xyz"
RewriteRule ^([a-z]{2,3})/root/$ ./root.php?lang=$1 [L]

# Encode forward slashes in query string
#RewriteCond %{QUERY_STRING} ^(.*&|\?)path=([^&]*)(.*)$
#RewriteRule ^ - [E=PATH_ENCODED:${urlencoder:$2}]

# Internally rewrite "/xyz/root/<anything>" to "/root.php?lang=xyz&path=<anything>"
#RewriteRule ^([a-z]{2,3})/root/(.+)$ ./root.php?lang=$1&path=%{ENV:PATH_ENCODED}
RewriteRule ^([a-z]{2,3})/root/(.+)$ ./root.php?lang=$1&path=${urlencoder:$2} [B,L]

# Internally rewrite "/xyz/" or "/xyz/index/" to "/index.php?lang=xyz"
RewriteRule ^([a-z]{2,3})(/(index/?)?)?$ ./index.php?lang=$1 [L]

# Internally rewrite "/index/" to "/index.php"
RewriteRule ^index/?$ ./index.php [L]

# Internally rewrite "/root/" to "/root.php"
RewriteRule ^root/$ ./root.php [L]

# Encode forward slashes in query string
#RewriteCond %{QUERY_STRING} ^(.*&|\?)path=([^&]*)(.*)$
#RewriteRule ^ - [E=PATH_ENCODED:${urlencoder:$2}]

# Internally rewrite "/root/<anything>" to "/root.php?path=<anything>"
#RewriteRule ^root/(.+)$ ./root.php?path=%{ENV:PATH_ENCODED} [B,L]
RewriteRule ^root/(.+)$ ./root.php?path=${urlencoder:$2} [B,L]

<!DOCUMENT HTML>
<html>
    <head>
        <meta charset="utf-8" />
        <title>Hello World</title>
    </head>
    <body>
        <h1>Test: Hello World</h1>
        <ol>
            <li>Language selector: <?php echo $_GET['lang']; ?></li>
            <li>Path selector: <?php echo $_GET['path']; ?></li>
        </ol>
    </body>
</html>