<?php
/**
 * Diagnostic file - DELETE after debugging!
 */

// Show all errors
error_reporting(E_ALL);
ini_set('display_errors', 1);

// ============ QUICK FIX ACTIONS ============
$fixResults = array();

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['fix_action'])) {
    $action = $_POST['fix_action'];

    switch ($action) {
        case 'create_htaccess':
            $htaccessContent = '# VH Posting System - Apache Configuration (reg.ru compatible)

# Prevent directory listing
Options -Indexes

# Deny access to sensitive files
<FilesMatch "(config\.php|auth_config\.php|\.example\.php)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Block direct access to class files
RewriteEngine On
RewriteRule ^classes/ - [F,L]

# Security headers (if mod_headers available)
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
</IfModule>';

            if (file_put_contents(__DIR__ . '/.htaccess', $htaccessContent)) {
                $fixResults[] = array('success', 'Created .htaccess file');
            } else {
                $fixResults[] = array('error', 'Failed to create .htaccess');
            }
            break;

        case 'create_config':
            if (file_exists(__DIR__ . '/config.example.php')) {
                if (copy(__DIR__ . '/config.example.php', __DIR__ . '/config.php')) {
                    @chmod(__DIR__ . '/config.php', 0644);
                    $fixResults[] = array('success', 'Created config.php from example');
                } else {
                    $fixResults[] = array('error', 'Failed to copy config.example.php');
                }
            } else {
                $configContent = '<?php
return [
    \'flickr\' => [
        \'api_key\' => \'\',
        \'api_secret\' => \'\',
    ],
    \'flickr_user_id\' => \'\',
    \'telegram\' => [
        \'bot_token\' => \'\',
        \'channels\' => [],
    ],
    \'default_size\' => \'Large\',
    \'custom_formats\' => [],
];';
                if (file_put_contents(__DIR__ . '/config.php', $configContent)) {
                    @chmod(__DIR__ . '/config.php', 0644);
                    $fixResults[] = array('success', 'Created config.php');
                } else {
                    $fixResults[] = array('error', 'Failed to create config.php');
                }
            }
            break;

        case 'fix_permissions':
            $files = array(
                'config.php' => 0644,
                'auth_config.php' => 0600,
                '.htaccess' => 0644,
            );
            foreach ($files as $file => $perm) {
                $path = __DIR__ . '/' . $file;
                if (file_exists($path)) {
                    if (@chmod($path, $perm)) {
                        $fixResults[] = array('success', "Fixed permissions for {$file}");
                    } else {
                        $fixResults[] = array('error', "Failed to fix permissions for {$file}");
                    }
                }
            }
            break;

        case 'fix_auth_config_perms':
            $path = __DIR__ . '/auth_config.php';
            if (file_exists($path)) {
                if (@chmod($path, 0600)) {
                    $fixResults[] = array('success', 'Fixed auth_config.php permissions to 0600');
                } else {
                    $fixResults[] = array('error', 'Failed to fix auth_config.php permissions');
                }
            } else {
                $fixResults[] = array('info', 'auth_config.php does not exist yet');
            }
            break;

        case 'delete_debug':
            // Self-delete
            if (@unlink(__FILE__)) {
                header('Location: index.php');
                exit;
            } else {
                $fixResults[] = array('error', 'Failed to delete debug.php - delete manually!');
            }
            break;

        case 'reset_user':
            $path = __DIR__ . '/auth_config.php';
            if (file_exists($path)) {
                if (@unlink($path)) {
                    $fixResults[] = array('success', 'Deleted auth_config.php - go to setup.php to create new user');
                } else {
                    $fixResults[] = array('error', 'Failed to delete auth_config.php');
                }
            } else {
                $fixResults[] = array('info', 'auth_config.php does not exist');
            }
            break;
    }
}

// ============ HTML OUTPUT ============
?>
<!DOCTYPE html>
<html>
<head>
    <title>VH Posting System - Diagnostics</title>
    <style>
        body { font-family: Arial, sans-serif; max-width: 900px; margin: 20px auto; padding: 0 20px; }
        h1 { color: #333; border-bottom: 2px solid #2196F3; padding-bottom: 10px; }
        h2 { color: #555; margin-top: 30px; }
        h3 { color: #666; margin-top: 20px; }
        code { background: #f5f5f5; padding: 2px 6px; border-radius: 3px; }
        pre { background: #f5f5f5; padding: 10px; overflow-x: auto; }
        .fix-box { background: #e3f2fd; border: 1px solid #2196F3; border-radius: 8px; padding: 20px; margin: 20px 0; }
        .fix-box h2 { margin-top: 0; color: #1976D2; }
        .btn { display: inline-block; padding: 10px 20px; margin: 5px; border: none; border-radius: 5px; cursor: pointer; font-size: 14px; }
        .btn-primary { background: #2196F3; color: white; }
        .btn-warning { background: #FF9800; color: white; }
        .btn-danger { background: #f44336; color: white; }
        .btn-success { background: #4CAF50; color: white; }
        .btn:hover { opacity: 0.9; }
        .result { padding: 10px 15px; margin: 5px 0; border-radius: 5px; }
        .result-success { background: #e8f5e9; color: #2e7d32; border: 1px solid #4CAF50; }
        .result-error { background: #ffebee; color: #c62828; border: 1px solid #f44336; }
        .result-info { background: #fff3e0; color: #e65100; border: 1px solid #FF9800; }
    </style>
</head>
<body>

<h1>VH Posting System - Diagnostics</h1>

<?php
// Show fix results
if (!empty($fixResults)) {
    echo '<div class="fix-box">';
    echo '<h2>Fix Results</h2>';
    foreach ($fixResults as $result) {
        echo '<div class="result result-' . $result[0] . '">' . htmlspecialchars($result[1]) . '</div>';
    }
    echo '</div>';
}
?>

<!-- Quick Fix Panel -->
<div class="fix-box">
    <h2>Quick Fix Panel</h2>
    <p>Click buttons to automatically fix common issues:</p>

    <form method="POST" style="display: inline;">
        <input type="hidden" name="fix_action" value="create_htaccess">
        <button type="submit" class="btn btn-primary" onclick="return confirm('Create/overwrite .htaccess?')">Create .htaccess</button>
    </form>

    <form method="POST" style="display: inline;">
        <input type="hidden" name="fix_action" value="create_config">
        <button type="submit" class="btn btn-primary" onclick="return confirm('Create config.php from example?')">Create config.php</button>
    </form>

    <form method="POST" style="display: inline;">
        <input type="hidden" name="fix_action" value="fix_permissions">
        <button type="submit" class="btn btn-warning">Fix All Permissions</button>
    </form>

    <form method="POST" style="display: inline;">
        <input type="hidden" name="fix_action" value="fix_auth_config_perms">
        <button type="submit" class="btn btn-warning">Secure auth_config.php</button>
    </form>

    <br><br>

    <form method="POST" style="display: inline;">
        <input type="hidden" name="fix_action" value="reset_user">
        <button type="submit" class="btn btn-danger" onclick="return confirm('DELETE all users and start fresh?')">Reset Users</button>
    </form>

    <form method="POST" style="display: inline;">
        <input type="hidden" name="fix_action" value="delete_debug">
        <button type="submit" class="btn btn-success" onclick="return confirm('Delete debug.php and go to main site?')">Delete debug.php & Go to Site</button>
    </form>
</div>

<?php
// PHP Version
echo "<h2>1. PHP Version</h2>";
echo "<p>PHP Version: <strong>" . phpversion() . "</strong></p>";

if (version_compare(PHP_VERSION, '7.2.0', '<')) {
    echo "<p style='color:red'>WARNING: PHP 7.2+ required!</p>";
} else {
    echo "<p style='color:green'>OK: PHP version is compatible</p>";
}

// Required extensions
echo "<h2>2. Required Extensions</h2>";
$extensions = array('curl', 'json', 'mbstring', 'session');
foreach ($extensions as $ext) {
    if (extension_loaded($ext)) {
        echo "<p style='color:green'>OK: {$ext}</p>";
    } else {
        echo "<p style='color:red'>MISSING: {$ext}</p>";
    }
}

// BCMath (for base58 decoding)
echo "<p>";
if (function_exists('bcmul')) {
    echo "<span style='color:green'>OK: bcmath</span>";
} else {
    echo "<span style='color:orange'>WARNING: bcmath not available (short URLs won't work)</span>";
}
echo "</p>";

// Password algorithms
echo "<h2>3. Password Hashing</h2>";
if (defined('PASSWORD_ARGON2ID')) {
    echo "<p style='color:green'>OK: Argon2ID available</p>";
} else {
    echo "<p style='color:orange'>INFO: Argon2ID not available, using bcrypt (OK)</p>";
}

// Config file
echo "<h2>4. Configuration</h2>";
if (file_exists(__DIR__ . '/config.php')) {
    echo "<p style='color:green'>OK: config.php exists</p>";

    try {
        $config = require __DIR__ . '/config.php';
        echo "<p style='color:green'>OK: config.php is valid PHP</p>";

        if (!empty($config['flickr']['api_key'])) {
            echo "<p style='color:green'>OK: Flickr API key set</p>";
        } else {
            echo "<p style='color:orange'>INFO: Flickr API key not set</p>";
        }

        if (!empty($config['telegram']['bot_token'])) {
            echo "<p style='color:green'>OK: Telegram bot token set</p>";
        } else {
            echo "<p style='color:orange'>INFO: Telegram bot token not set</p>";
        }
    } catch (Throwable $e) {
        echo "<p style='color:red'>ERROR in config.php: " . htmlspecialchars($e->getMessage()) . "</p>";
    }
} else {
    echo "<p style='color:red'>MISSING: config.php — <strong>use Quick Fix above!</strong></p>";
}

// Writable directories
echo "<h2>5. File Permissions</h2>";
if (is_writable(__DIR__)) {
    echo "<p style='color:green'>OK: Root directory is writable</p>";
} else {
    echo "<p style='color:red'>ERROR: Root directory is not writable (needed for auth_config.php)</p>";
}

// Test class loading
echo "<h2>6. Class Loading Test</h2>";

$classes = array('Auth', 'FlickrParser', 'FormatGenerator', 'FlickrAPI', 'TelegramBot');
foreach ($classes as $class) {
    $file = __DIR__ . '/classes/' . $class . '.php';
    if (file_exists($file)) {
        try {
            require_once $file;
            if (class_exists($class)) {
                echo "<p style='color:green'>OK: {$class}</p>";
            } else {
                echo "<p style='color:red'>ERROR: {$class} - file loaded but class not found</p>";
            }
        } catch (Throwable $e) {
            echo "<p style='color:red'>ERROR loading {$class}: " . htmlspecialchars($e->getMessage()) . "</p>";
            echo "<pre>" . htmlspecialchars($e->getTraceAsString()) . "</pre>";
        }
    } else {
        echo "<p style='color:red'>MISSING: {$file}</p>";
    }
}

// Test Auth instantiation
echo "<h2>7. Auth System Test</h2>";
try {
    $auth = new Auth();
    echo "<p style='color:green'>OK: Auth class instantiated</p>";

    if ($auth->hasUsers()) {
        echo "<p style='color:green'>OK: Users exist, login page should work</p>";
    } else {
        echo "<p style='color:orange'>INFO: No users yet, setup.php should appear</p>";
    }
} catch (Throwable $e) {
    echo "<p style='color:red'>ERROR: " . htmlspecialchars($e->getMessage()) . "</p>";
    echo "<pre>" . htmlspecialchars($e->getTraceAsString()) . "</pre>";
}

// Security checks
echo "<h2>8. Security Checks</h2>";

// HTTPS
$isHttps = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
           (!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') ||
           (!empty($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443);
if ($isHttps) {
    echo "<p style='color:green'>OK: HTTPS enabled</p>";
} else {
    echo "<p style='color:orange'>WARNING: HTTPS not detected (recommended for production)</p>";
}

// .htaccess exists
if (file_exists(__DIR__ . '/.htaccess')) {
    echo "<p style='color:green'>OK: .htaccess exists</p>";
} else {
    echo "<p style='color:red'>WARNING: .htaccess missing — <strong>use Quick Fix above!</strong></p>";
}

// ========== LEAK DETECTION ==========
echo "<h3>Leak Detection (API Keys & Credentials)</h3>";

// Check if sensitive files are accessible via web
$baseUrl = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http') .
           '://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['REQUEST_URI']);

$sensitiveFiles = array(
    'config.php' => 'API Keys (Flickr, Telegram)',
    'auth_config.php' => 'User passwords (hashed)',
    'config.example.php' => 'Config template',
    'classes/Auth.php' => 'Auth class source',
    'classes/FlickrAPI.php' => 'Flickr API class',
    'classes/TelegramBot.php' => 'Telegram Bot class',
    '.env' => 'Environment file',
    '.git/config' => 'Git config',
    'composer.json' => 'Dependencies',
    'error_log' => 'Error log',
    'debug.log' => 'Debug log',
);

$leaksFound = 0;
foreach ($sensitiveFiles as $file => $desc) {
    $testUrl = rtrim($baseUrl, '/') . '/' . $file;

    $ch = curl_init();
    curl_setopt_array($ch, array(
        CURLOPT_URL => $testUrl,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 5,
        CURLOPT_FOLLOWLOCATION => false,
        CURLOPT_SSL_VERIFYPEER => false,
    ));
    $content = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($httpCode == 403 || $httpCode == 404 || $httpCode == 500) {
        echo "<p style='color:green'>OK: {$file} is protected (HTTP {$httpCode})</p>";
    } elseif ($httpCode == 200) {
        // Check if content contains sensitive data
        $hasSensitiveData = false;
        if (strpos($content, 'api_key') !== false ||
            strpos($content, 'api_secret') !== false ||
            strpos($content, 'bot_token') !== false ||
            strpos($content, 'password_hash') !== false ||
            strpos($content, 'password') !== false) {
            $hasSensitiveData = true;
        }

        if ($hasSensitiveData) {
            echo "<p style='color:red'><strong>CRITICAL LEAK:</strong> {$file} is ACCESSIBLE and contains sensitive data! ({$desc})</p>";
            $leaksFound++;
        } else {
            echo "<p style='color:orange'>WARNING: {$file} is accessible (HTTP 200) - {$desc}</p>";
        }
    } else {
        echo "<p style='color:orange'>INFO: {$file} returned HTTP {$httpCode}</p>";
    }
}

// Check for common info disclosure files
echo "<h3>Information Disclosure Check</h3>";
$infoFiles = array(
    'phpinfo.php' => 'PHP Info page',
    'info.php' => 'PHP Info page',
    'test.php' => 'Test file',
    'readme.md' => 'Readme file',
    'README.md' => 'Readme file',
    'CHANGELOG.md' => 'Changelog',
    '.htpasswd' => 'Password file',
    'backup.sql' => 'Database backup',
    'dump.sql' => 'Database dump',
);

foreach ($infoFiles as $file => $desc) {
    $path = __DIR__ . '/' . $file;
    if (file_exists($path)) {
        echo "<p style='color:orange'>WARNING: {$file} exists - consider removing ({$desc})</p>";
    }
}

// Check if secrets are exposed in JS files
echo "<h3>Secret Exposure in Public Files</h3>";
$publicFiles = array(
    'js/app.js',
    'css/style.css',
);

$secretPatterns = array(
    '/api[_-]?key\s*[:=]\s*[\'"][^\'"]+[\'"]/i' => 'API Key',
    '/bot[_-]?token\s*[:=]\s*[\'"][^\'"]+[\'"]/i' => 'Bot Token',
    '/password\s*[:=]\s*[\'"][^\'"]+[\'"]/i' => 'Password',
    '/secret\s*[:=]\s*[\'"][^\'"]+[\'"]/i' => 'Secret',
);

foreach ($publicFiles as $file) {
    $path = __DIR__ . '/' . $file;
    if (file_exists($path)) {
        $content = file_get_contents($path);
        $foundSecrets = array();

        foreach ($secretPatterns as $pattern => $type) {
            if (preg_match($pattern, $content)) {
                $foundSecrets[] = $type;
            }
        }

        if (!empty($foundSecrets)) {
            echo "<p style='color:red'><strong>DANGER:</strong> {$file} may contain: " . implode(', ', $foundSecrets) . "</p>";
            $leaksFound++;
        } else {
            echo "<p style='color:green'>OK: {$file} - no secrets found</p>";
        }
    }
}

// Check config.php for exposed secrets (verify it's not outputting)
if (file_exists(__DIR__ . '/config.php')) {
    $configContent = file_get_contents(__DIR__ . '/config.php');

    // Check if config has echo/print statements
    if (preg_match('/(echo|print|var_dump|print_r)\s*\(/i', $configContent)) {
        echo "<p style='color:red'><strong>DANGER:</strong> config.php contains output statements!</p>";
        $leaksFound++;
    } else {
        echo "<p style='color:green'>OK: config.php has no output statements</p>";
    }

    // Check if config returns array (proper format)
    if (strpos($configContent, 'return') !== false) {
        echo "<p style='color:green'>OK: config.php uses return statement (good)</p>";
    } else {
        echo "<p style='color:orange'>WARNING: config.php may not return array properly</p>";
    }
}

// Summary
if ($leaksFound > 0) {
    echo "<div style='background:#ffebee;border:2px solid #f44336;padding:15px;margin:15px 0;border-radius:5px;'>";
    echo "<strong style='color:#c62828;'>SECURITY ALERT: {$leaksFound} potential leak(s) detected!</strong>";
    echo "<p>Use Quick Fix buttons above or manually fix the issues.</p>";
    echo "</div>";
} else {
    echo "<p style='color:green'><strong>No critical leaks detected.</strong></p>";
}

// File permissions
echo "<h3>File Permissions</h3>";
$checkPerms = array(
    'config.php' => '0600 or 0644',
    'auth_config.php' => '0600',
    '.htaccess' => '0644',
);

foreach ($checkPerms as $file => $recommended) {
    $path = __DIR__ . '/' . $file;
    if (file_exists($path)) {
        $perms = substr(sprintf('%o', fileperms($path)), -4);
        $worldReadable = (fileperms($path) & 0x0004);

        if ($file === 'auth_config.php' && $worldReadable) {
            echo "<p style='color:orange'>WARNING: {$file} is world-readable ({$perms}), recommended: {$recommended}</p>";
        } else {
            echo "<p style='color:green'>OK: {$file} permissions: {$perms}</p>";
        }
    }
}

// PHP security settings
echo "<h3>PHP Security Settings</h3>";
echo "<p style='color:#666'><em>These are hosting settings - may not be changeable on shared hosting</em></p>";

$securitySettings = array(
    'expose_php' => array('recommended' => '0', 'desc' => 'Hide PHP version'),
    'display_errors' => array('recommended' => '0', 'desc' => 'Hide errors in production'),
    'allow_url_include' => array('recommended' => '0', 'desc' => 'Prevent remote file inclusion'),
    'session.cookie_httponly' => array('recommended' => '1', 'desc' => 'Protect session cookie'),
    'session.cookie_secure' => array('recommended' => '1', 'desc' => 'HTTPS-only cookies'),
    'session.use_strict_mode' => array('recommended' => '1', 'desc' => 'Strict session mode'),
);

foreach ($securitySettings as $setting => $info) {
    $value = ini_get($setting);
    $valueStr = ($value === '' || $value === '0' || $value === false) ? '0' : '1';

    if ($valueStr === $info['recommended']) {
        echo "<p style='color:green'>OK: {$setting} = {$valueStr} ({$info['desc']})</p>";
    } else {
        echo "<p style='color:orange'>INFO: {$setting} = {$valueStr}, recommended: {$info['recommended']} ({$info['desc']})</p>";
    }
}

// Cryptographic Functions
echo "<h3>Cryptographic Functions</h3>";
if (function_exists('random_bytes')) {
    try {
        $test = random_bytes(32);
        echo "<p style='color:green'>OK: random_bytes() works</p>";
    } catch (Exception $e) {
        echo "<p style='color:red'>ERROR: random_bytes() failed</p>";
    }
} else {
    echo "<p style='color:orange'>WARNING: random_bytes() not available</p>";
}

if (function_exists('openssl_random_pseudo_bytes')) {
    echo "<p style='color:green'>OK: openssl_random_pseudo_bytes() available</p>";
} else {
    echo "<p style='color:orange'>WARNING: openssl_random_pseudo_bytes() not available</p>";
}

if (function_exists('password_hash')) {
    echo "<p style='color:green'>OK: password_hash() available</p>";
} else {
    echo "<p style='color:red'>ERROR: password_hash() not available!</p>";
}

// Server info (be careful not to expose too much)
echo "<h2>9. Server Info</h2>";
echo "<p>Server software: <code>" . htmlspecialchars(isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : 'Unknown') . "</code></p>";
echo "<p>Document root: <code>" . htmlspecialchars(isset($_SERVER['DOCUMENT_ROOT']) ? $_SERVER['DOCUMENT_ROOT'] : 'Unknown') . "</code></p>";
echo "<p>Script path: <code>" . htmlspecialchars(__DIR__) . "</code></p>";

echo "<hr>";
echo "<p><strong>If all green:</strong> Use <strong>'Delete debug.php & Go to Site'</strong> button above</p>";
echo "<p><strong>If errors:</strong> Use Quick Fix buttons, then refresh this page</p>";
echo "<p style='color:red'><strong>IMPORTANT: Delete this file after debugging!</strong></p>";
?>

</body>
</html>
