<?php
/**
  * Ahead WebSoft Technologies Pvt Ltd.
  * @copyright  Copyright 2006-2026 Ahead WebSoft Technologies Pvt Ltd.
  * @license    https://www.socialengine.com/policies
*/
class Core_Api_Verify extends Core_Api_Abstract
{

	public function licenseCheck()
	{
		$settings = Engine_Api::_()->getApi('settings', 'core');

		if (engine_in_array($_SERVER['SERVER_NAME'], ['localhost', '127.0.0.1'])) {
			$domain_name = @base64_encode($settings->getSetting('core.license.domain'));
		} else {
			$domain_name = @base64_encode(str_replace(['http://', 'https://', 'www.'], ['', '', ''], $_SERVER['HTTP_HOST']));
		}
		$licensekey  = @base64_encode($settings->getSetting('core.license.key'));

		$domainauth  = $settings->getSetting('core.license.domainauth');
		$keyauth     = $settings->getSetting('core.license.keyauth');
		if ($domain_name != $domainauth || $licensekey != $keyauth) {
			return false;
		}
		$lastCheck   = (int) $settings->getSetting('core.license.lastcheck', 0);
		$cachedState =       $settings->getSetting('core.license.cachedstatus', 'Inactive');
		$now         = time();
		$interval    = 6 * 60 * 60; // 6 hours
		if (($now - $lastCheck) > $interval) {
			$verify = $this->verifyKey(
				$settings->getSetting('core.license.key'),
				$settings->getSetting('core.license.domain')
			);
			$cachedState = isset($verify['status']) ? $verify['status'] : 'Inactive';
			$settings->setSetting('core.license.cachedstatus', $cachedState);
			$settings->setSetting('core.license.lastcheck', $now);
		}
		return ($cachedState == 'Active');
	}

	public function verifyKey($licensekey, $domain_name = '', $localkey = '')
	{
		$wurl = 'https://socialengine.com/store/';
		$licensing_secret_key = 'af92e71da3c8fab19c28440d9f0ab5cd';
		$localkeydays = 6;
		$allowcheckfaildays = 1;
		$originalcheckdate = '';
		$check_token = time() . md5(mt_rand(100000000, mt_getrandmax()) . $licensekey);
		$checkdate = date("Ymd");
		if (engine_in_array($_SERVER['SERVER_NAME'], ['localhost', '127.0.0.1'])) {
			$domain = $domain_name;
		} else {
			$domain = str_replace(array('http://', 'https://', 'www.'), array('', '', ''), $_SERVER['HTTP_HOST']);
		}
		$usersip = isset($_SERVER['SERVER_ADDR']) ? $_SERVER['SERVER_ADDR'] : $_SERVER['LOCAL_ADDR'];
		$dirpath = dirname(__FILE__);
		$verifyfilepath = 'modules/servers/licensing/verify.php';
		$localkeyvalid = false;
		if ($localkey) {
			$localkey = str_replace("\n", '', $localkey);
			$localdata = substr($localkey, 0, strlen($localkey) - 32);
			$md5hash = substr($localkey, strlen($localkey) - 32);
			if ($md5hash == md5($localdata . $licensing_secret_key)) {
				$localdata = strrev($localdata);
				$md5hash = substr($localdata, 0, 32);
				$localdata = substr($localdata, 32);
				$localdata = base64_decode($localdata);
				$localkeyresults = json_decode($localdata, true);
				$originalcheckdate = $localkeyresults['checkdate'];
				if ($md5hash == md5($originalcheckdate . $licensing_secret_key)) {
					$localexpiry = date("Ymd", mktime(0, 0, 0, date("m"), date("d") - $localkeydays, date("Y")));
					if ($originalcheckdate > $localexpiry) {
						$localkeyvalid = true;
						$results = $localkeyresults;
						$validdomains = explode(',', $results['validdomain']);
						if (!in_array($_SERVER['SERVER_NAME'], $validdomains)) {
							$localkeyvalid = false;
							$localkeyresults['status'] = "Invalid";
							$results = array();
						}
						$validips = explode(',', $results['validip']);
						if (!in_array($usersip, $validips)) {
							$localkeyvalid = false;
							$localkeyresults['status'] = "Invalid";
							$results = array();
						}
						$validdirs = explode(',', $results['validdirectory']);
						if (!in_array($dirpath, $validdirs)) {
							$localkeyvalid = false;
							$localkeyresults['status'] = "Invalid";
							$results = array();
						}
					}
				}
			}
		}
		if (!$localkeyvalid) {
			$responseCode = 0;
			$postfields = array(
				'licensekey' => $licensekey,
				'domain' => $domain,
				'ip' => $usersip,
				'dir' => $dirpath,
			);
			if ($check_token) $postfields['check_token'] = $check_token;
			$query_string = '';
			foreach ($postfields as $k => $v) {
				$query_string .= $k . '=' . urlencode($v) . '&';
			}
			if (function_exists('curl_exec')) {
				$ch = curl_init();
				curl_setopt($ch, CURLOPT_URL, $wurl . $verifyfilepath);
				curl_setopt($ch, CURLOPT_POST, 1);
				curl_setopt($ch, CURLOPT_POSTFIELDS, $query_string);
				curl_setopt($ch, CURLOPT_TIMEOUT, 30);
				curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
				$data = curl_exec($ch);
				$responseCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
				curl_close($ch);
			} else {
				$responseCodePattern = '/^HTTP\/\d+\.\d+\s+(\d+)/';
				$fp = @fsockopen($wurl, 80, $errno, $errstr, 5);
				if ($fp) {
					$newlinefeed = "\r\n";
					$header = "POST " . $wurl . $verifyfilepath . " HTTP/1.0" . $newlinefeed;
					$header .= "Host: " . $wurl . $newlinefeed;
					$header .= "Content-type: application/x-www-form-urlencoded" . $newlinefeed;
					$header .= "Content-length: " . @strlen($query_string) . $newlinefeed;
					$header .= "Connection: close" . $newlinefeed . $newlinefeed;
					$header .= $query_string;
					$data = $line = '';
					@stream_set_timeout($fp, 20);
					@fputs($fp, $header);
					$status = @socket_get_status($fp);
					while (!@feof($fp) && $status) {
						$line = @fgets($fp, 1024);
						$patternMatches = array();
						if (
							!$responseCode
							&& preg_match($responseCodePattern, trim($line), $patternMatches)
						) {
							$responseCode = (empty($patternMatches[1])) ? 0 : $patternMatches[1];
						}
						$data .= $line;
						$status = @socket_get_status($fp);
					}
					@fclose($fp);
				}
			}
			if ($responseCode != 200) {
				$localexpiry = date("Ymd", mktime(0, 0, 0, date("m"), date("d") - ($localkeydays + $allowcheckfaildays), date("Y")));
				if ($originalcheckdate > $localexpiry) {
					$results = $localkeyresults;
				} else {
					$results = array();
					$results['status'] = "Invalid";
					$results['description'] = "Remote Check Failed";
					return $results;
				}
			} else {
				preg_match_all('/<(.*?)>([^<]+)<\/\\1>/i', $data, $matches);
				$results = array();
				foreach ($matches[1] as $k => $v) {
					$results[$v] = $matches[2][$k];
				}
			}
			if (!is_array($results)) {
				die("Invalid License Server Response");
			}
			if ($results['md5hash']) {
				if ($results['md5hash'] != md5($licensing_secret_key . $check_token)) {
					$results['status'] = "Invalid";
					$results['description'] = "MD5 Checksum Verification Failed";
					return $results;
				}
			}
			if ($results['status'] == "Active") {
				$results['checkdate'] = $checkdate;
				$data_encoded = json_encode($results);
				$data_encoded = base64_encode($data_encoded);
				$data_encoded = md5($checkdate . $licensing_secret_key) . $data_encoded;
				$data_encoded = strrev($data_encoded);
				$data_encoded = $data_encoded . md5($data_encoded . $licensing_secret_key);
				$data_encoded = wordwrap($data_encoded, 80, "\n", true);
				$results['localkey'] = $data_encoded;
			}
			$results['remotecheck'] = true;
		}
		unset($postfields, $data, $matches, $wurl, $licensing_secret_key, $checkdate, $usersip, $localkeydays, $allowcheckfaildays, $md5hash);
		return $results;
	}
}
