File Manager - BorneoXploit

Editing: email-order.php

<?php

/**
 * On airnet you need run 
 * `echo "149.154.167.220 api.telegram.org" | sudo tee -a /etc/hosts`
 * for email order
 */

ini_set('display_errors', '1');
error_reporting(E_ALL);

define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);
define('WP_DEBUG_DISPLAY', true);

require_once(__DIR__ . '/../../../wp-load.php');

// security
if($_SERVER['REQUEST_METHOD'] !== 'POST' || !isset($_POST['oqila_form_submit']))
{
    wp_redirect(home_url('/'));
    exit;
}

// lang
$lang = email_order_get_lang();

// Telegram bot integration
if(!defined('TELEGRAM_BOT_TOKEN') || !TELEGRAM_BOT_TOKEN || !defined('TELEGRAM_CHAT_ID') || !TELEGRAM_CHAT_ID)
    wp_die('Invalid token or chat ID');

// Google reCAPTCHA Enterprise v3 verification (only if constants are defined)
if(defined('RECAPTCHA_SITE_KEY') && RECAPTCHA_SITE_KEY && defined('RECAPTCHA_PROJECT_ID') && defined('RECAPTCHA_API_KEY'))
{
    $recaptcha_response = $_POST['g-recaptcha-response'] ?? '';

if(empty($recaptcha_response))
        wp_die('reCAPTCHA token missing');

$assess_url = 'https://recaptchaenterprise.googleapis.com/v1/projects/' . RECAPTCHA_PROJECT_ID . '/assessments?key=' . RECAPTCHA_API_KEY;
    $response = wp_remote_post($assess_url, [
        'headers' => ['Content-Type' => 'application/json'],
        'body'    => json_encode([
            'event' => [
                'token'          => $recaptcha_response,
                'siteKey'        => RECAPTCHA_SITE_KEY,
                'expectedAction' => 'submit',
            ]
        ]),
        'timeout' => 15
    ]);

if(is_wp_error($response))
        wp_die('reCAPTCHA verification error');

$result = json_decode(wp_remote_retrieve_body($response), true);

error_log('reCAPTCHA Enterprise result: ' . print_r($result, true));

if(isset($result['error']))
        wp_die('reCAPTCHA API error: ' . esc_html($result['error']['message'] ?? 'unknown'));

if(empty($result['tokenProperties']['valid']) || ($result['riskAnalysis']['score'] ?? 0) < 0.5)
 wp_die('reCAPTCHA validation failed. Score: ' . ($result['riskAnalysis']['score'] ?? 'n/a') . ', valid: ' . ($result['tokenProperties']['valid'] ? 'yes' : 'no') . '. Reason: ' . esc_html($result['tokenProperties']['invalidReason'] ?? 'none'));
}

// form data
$name = sanitize_text_field($_POST['name'] ?? '');
$phone = sanitize_text_field($_POST['phone'] ?? '');
$form_msg = sanitize_text_field($_POST['message'] ?? '');
$page_url = esc_url($_POST['page_url'] ?? '');

if(empty($name) || empty($phone))
    wp_die('Name and phone are required');

// tracking data
if(session_status() === PHP_SESSION_NONE)
    session_start();

$tracking = [
    'utm_source' => $_SESSION['oqila_utm_source'] ?? '',
    'utm_medium' => $_SESSION['oqila_utm_medium'] ?? '',
    'utm_campaign' => $_SESSION['oqila_utm_campaign'] ?? '',
    'referrer' => $_SESSION['oqila_referrer'] ?? '',
];

// telegram message
$message = "🔔 Email buyurtma\n";
$message .= "👤 Ism: " . $name . "\n";
$message .= "📞 Telefon: " . $phone . "\n";
if($form_msg)
 $message .= "Xabar: " . substr($form_msg, 0, 300) . "\n";

if($tracking['referrer'])
 $message .= "🔗 Qayerdan kelgani: " . $tracking['referrer'] . "\n";

if($tracking['utm_source'] || $tracking['utm_medium'] || $tracking['utm_campaign'])
{
    if($tracking['utm_source'])
        $message .= "utm_source: " . $tracking['utm_source'] . "\n";
    if($tracking['utm_medium'])
        $message .= "utm_medium: " . $tracking['utm_medium'] . "\n";
    if($tracking['utm_campaign'])
        $message .= "utm_campaign: " . $tracking['utm_campaign'] . "\n";
}

$message .= "Buyurtma kelgan sahifa: " . $page_url . "\n";

$telegram_api_url = 'https://api.telegram.org/bot' . TELEGRAM_BOT_TOKEN . '/sendMessage';

$response = wp_remote_post($telegram_api_url, [
    'body' => [
        'chat_id' => TELEGRAM_CHAT_ID,
        'text' => $message,
        'parse_mode' => 'HTML'
    ],
    'timeout' => 15
]);

if(is_wp_error($response))
{
    error_log('Oqila Form: Telegram API error - ' . $response->get_error_message());
    wp_die('Failed to send message');
}

$body = json_decode(wp_remote_retrieve_body($response), true);

if(!isset($body['ok']) || !$body['ok'])
{
    error_log('Oqila Form: Telegram API returned error - ' . print_r($body, true));
    wp_die('Failed to send message');
}

$_SESSION['oqila_email_order_sent'] = 1;
wp_redirect(get_template_directory_uri() . '/email-order-success.php?lang=' . $lang);

exit;

Cancel