<?php
//This code is copyright (c) ViciSoft SL, all rights reserved.
//The contents of this file are protected under law as the intellectual property 
//of ViciSoft SL. Any use, reproduction, disclosure or copying of any kind 
//without the express and written permission of ViciSoft SL is forbidden.
//Author: Vince Reid, vincereid@gmail.com
if(@$storesessionvalue=="") $storesessionvalue="virtualstore".time();
if(@$_SESSION['loggedon']!=$storesessionvalue||@$GLOBALS['disallowlogin']||!@$GLOBALS['incfunctionsdefined']) exit;
$success=TRUE;
$alreadygotadmin=getadminsettings();
if(getpost('posted')=="1"){
	foreach(@$_POST as $objItem => $objValue){
		if(substr($objItem,0,4)=="idxx"){
			$ip1 = ip2signedlong($objValue);
			if(trim(@$_POST[str_replace("xx","yy",$objItem)])<>"")
				$ip2 = ip2signedlong(trim(@$_POST[str_replace("xx","yy",$objItem)]));
			else
				$ip2 = 0;
			if($ip1 != -1 && $ip2 != -1 && $ip1!=''){
				// Remove duplicates
				$sSQL = "SELECT dcid FROM ipblocking WHERE dcip1=" . $ip1 . " AND dcip2=" . $ip2 . " AND dcid<>" . substr($objItem,4);
				$result=ect_query($sSQL) or ect_error();
				if(ect_num_rows($result)>0)
					$sSQL = "DELETE FROM ipblocking WHERE dcid=" . substr($objItem,4);
				else
					$sSQL = "UPDATE ipblocking SET dcip1=" . $ip1 . ",dcip2=" . $ip2 . " WHERE dcid=" . substr($objItem,4);
				ect_query($sSQL) or ect_error();
			}
		}elseif(substr($objItem,0,7)=="newidxx" && $objValue!=''){
			$ip1 = ip2signedlong($objValue);
			if(trim(@$_POST[str_replace("xx","yy",$objItem)])!='')
				$ip2 = ip2signedlong(trim(@$_POST[str_replace("xx","yy",$objItem)]));
			else
				$ip2 = 0;
			if($ip1 != -1 && $ip2 != -1 && $ip1!=''){
				$sSQL = "INSERT INTO ipblocking (dcip1,dcip2) VALUES (" . $ip1 . "," . $ip2 . ")";
				ect_query($sSQL) or ect_error();
			}
		}elseif(substr($objItem,0,5)=="delip"){
			$sSQL = "DELETE FROM ipblocking WHERE dcid=" . substr($objItem,5);
			ect_query($sSQL) or ect_error();
		}elseif(substr($objItem,0,5)=="delss"){
			$sSQL = "DELETE FROM multibuyblock WHERE ssdenyid=" . substr($objItem,5);
			ect_query($sSQL) or ect_error();
		}
	}
	if($success)
		print '<meta http-equiv="refresh" content="1; url=adminipblock.php">';
}
if(getpost('posted')=="1" && $success){ ?>
      <table border="0" cellspacing="0" cellpadding="0" width="100%" align="center">
        <tr>
          <td width="100%">
			<table width="100%" border="0" cellspacing="0" cellpadding="3">
			  <tr> 
                <td width="100%" colspan="2" align="center"><br /><strong><?php print $yyUpdSuc?></strong><br /><br /><?php print $yyNowFrd?><br /><br />
                        <?php print $yyNoAuto?> <a href="adminipblock.php"><strong><?php print $yyClkHer?></strong></a>.<br />
                        <br /><br />&nbsp;
                </td>
			  </tr>
			</table></td>
        </tr>
	  </table>
<?php
}elseif(getpost('posted')=="1"){ ?>
      <table border="0" cellspacing="0" cellpadding="0" width="100%" align="center">
        <tr>
          <td width="100%">
			<table width="100%" border="0" cellspacing="0" cellpadding="3">
			  <tr> 
                <td width="100%" colspan="2" align="center"><br /><span style="color:#FF0000;font-weight:bold"><?php print $yyErrUpd?></span><br /><br /><?php print $errmsg?><br /><br />
				<a href="javascript:history.go(-1)"><strong><?php print $yyClkBac?></strong></a></td>
			  </tr>
			</table></td>
        </tr>
	  </table>
<?php
}else{ ?>
<script>
<!--
var currinputid=1;
function addnewinput(tid){
	if(tid==currinputid){
		currinputid++;
		var node = document.createElement("DIV");
		node.className='ecttablerow';
		node.innerHTML='<div><input type="text" size="15" name="newidxx' + currinputid + '" onfocus="addnewinput(' + currinputid + ')" /></div>' +
				'<div><input type="text" size="15" name="newidyy' + currinputid + '" onfocus="addnewinput(' + currinputid + ')" /></div>' +
				'<div>n/a</div>';
		document.getElementById("ipblocktable").appendChild(node);
	}
}
function updatemultiblock(tobj){
document.location='adminipblock.php?multiblock='+tobj[tobj.selectedIndex].value;
}
function updatecartblock(tobj){
document.location='adminipblock.php?cartblock='+tobj[tobj.selectedIndex].value;
}
function updatecontactemails(tobj){
document.location='adminipblock.php?contactblock='+tobj[tobj.selectedIndex].value;
}
//-->
</script>
<?php
	if(is_numeric(getget('multiblock'))){
		$sSQL="UPDATE admin SET blockMultiPurchase='" . escape_string(getget('multiblock')) . "' WHERE adminID=1";
		$GLOBALS['blockmultipurchase']=(int)getget('multiblock');
		ect_query($sSQL) or ect_error();
	}
	if(is_numeric(getget('cartblock'))){
		$sSQL="UPDATE admin SET blockMaxCartAdds='" . escape_string(getget('cartblock')) . "' WHERE adminID=1";
		$GLOBALS['blockmaxcartadds']=(int)getget('cartblock');
		ect_query($sSQL) or ect_error();
	}
	if(is_numeric(getget('contactblock'))){
		$sSQL="UPDATE admin SET blockContactEmails='" . escape_string(getget('contactblock')) . "' WHERE adminID=1";
		$GLOBALS['blockcontactemails']=(int)getget('contactblock');
		ect_query($sSQL) or ect_error();
	}
?>
	<h2><?php print $yyUsIPBl?></h2>
	
	<div style="padding:10px;border:1px solid lightgrey;margin-bottom:10px">
		<h3>Excessive Cart Additions</h3>
		<div style="padding:20px 0">
			<div style="float:left;padding-left:40px"><select size="1" name="multicartadd" onchange="updatecartblock(this)"><option value="0">Unlimited</option>
<?php
			$GLOBALS['hasdisplayed']=$GLOBALS['blockmaxcartadds']==0;
			function domcblockoption($tind){
				if($tind==$GLOBALS['blockmaxcartadds']) $GLOBALS['hasdisplayed']=TRUE;
				if($tind>$GLOBALS['blockmaxcartadds']&&!$GLOBALS['hasdisplayed'])
					domcblockoption($GLOBALS['blockmaxcartadds']);
				print '<option value="' . $tind . '"' . ($GLOBALS['blockmaxcartadds']==$tind?' selected="selected"':'') . '>' . $tind . '</option>';
			}
			for($index=70;$index<=250;$index+=10){
				domcblockoption($index);
			}
?>
			</select></div>
			<div style="float:left;padding:3px">You can limit the maximum items a customer can add to cart.</div>
		</div>
		<div style="clear:both;padding:40px">Hackers can use the trick of adding lots of different items to the cart to hog the server resources in what is called a Denial of Service (DOS) attack. You can set a limit to the items that can be added to the cart 
		before it starts to look like suspicious activity. You don't want to set this value too low however as you don't want to block your best customers. Blocked IP's will appear below.
		</div>
	</div>

<form name="mainform" method="post" action="adminipblock.php">
	<input type="hidden" name="posted" value="1" />
	<div style="padding:10px;border:1px solid lightgrey;margin-bottom:10px">
		<h3>IP Blocking</h3>
		<div id="ipblocktable" class="ecttable" style="max-width:600px;margin:20px auto">
			<div class="ecttablerow ecttablehead">
				<div><?php print $yySinIP?></div>
				<div><?php print $yyLasIP?></div>
				<div><?php print $yyDelete?></div>
			</div><?php
		$sSQL = "SELECT dcid,dcip1,dcip2 FROM ipblocking ORDER BY dcip1";
		$result=ect_query($sSQL) or ect_error();
		while($alldata=ect_fetch_assoc($result)){ ?>
			<div class="ecttablerow">
				<div><input type="text" size="15" name="idxx<?php print $alldata["dcid"]?>" value="<?php print long2ip($alldata["dcip1"])?>" /></div>
				<div><input type="text" size="15" name="idyy<?php print $alldata["dcid"]?>" value="<?php if($alldata["dcip2"] != 0) print long2ip($alldata["dcip2"])?>" /></div>
				<div><input type="checkbox" name="delip<?php print $alldata["dcid"]?>"></div>
			</div>
<?php	}
		ect_free_result($result); ?>
			<div class="ecttablerow">
				<div><input type="text" size="15" name="newidxx1" onfocus="addnewinput(1)" /></div>
				<div><input type="text" size="15" name="newidyy1" onfocus="addnewinput(1)" /></div>
				<div>n/a</div>
			</div>
		</div>
		<div style="padding:20px 0;text-align:center"><input type="submit" value="<?php print $yySubmit?>" />&nbsp;&nbsp;<input type="reset" value="<?php print $yyReset?>" /></div>
	</div>
</form>

<form name="mainform" method="post" action="adminipblock.php">
	<input type="hidden" name="posted" value="1" />
	<div style="padding:10px;border:1px solid lightgrey;margin-bottom:10px">
		<h3>Multi Purchase Blocking</h3>
		<div style="padding:20px 0">
			<div style="float:left;padding-left:40px"><select size="1" name="multipurchase" onchange="updatemultiblock(this)"><option value="0">Unlimited</option>
<?php
			$GLOBALS['hasdisplayed']=$GLOBALS['blockmultipurchase']==0;
			function dompblockoption($tind){
				if($tind==$GLOBALS['blockmultipurchase']) $GLOBALS['hasdisplayed']=TRUE;
				if($tind>$GLOBALS['blockmultipurchase']&&!$GLOBALS['hasdisplayed'])
					dompblockoption($GLOBALS['blockmultipurchase']);
				print '<option value="' . $tind . '"' . ($GLOBALS['blockmultipurchase']==$tind?' selected="selected"':'') . '>' . $tind . '</option>';
			}
			for($index=10;$index<=50;$index+=5){
				dompblockoption($index);
			}
?>
			</select></div>
			<div style="float:left;padding:3px">You can limit the number of transactions a customer can make in a 24 hour period with this setting.</div>
		</div>
<?php		$sSQL = "SELECT ssdenyid,ssdenyip,sstimesaccess,lastaccess FROM multibuyblock WHERE sstimesaccess>=" . $blockmultipurchase . " ORDER BY ssdenyip";
			$result=ect_query($sSQL) or ect_error();
			if(ect_num_rows($result)==0){
				print '<div class="nosearchresults">' . $yyNoIPBl . '</div>';
			}else{ ?>
		<div class="ecttable" style="max-width:600px;margin:20px auto">
			<div class="ecttablerow ecttablehead">
				<div>IP Address</div>
				<div>Checkout Attempts</div>
				<div>Delete</div>
			</div>
<?php			while($alldata=ect_fetch_assoc($result)){ ?>
			<div class="ecttablerow">
				<div><?php print $alldata["ssdenyip"]?></div>
				<div><?php print ($alldata["sstimesaccess"]+1)?></div>
				<div><input type="checkbox" name="delss<?php print $alldata["ssdenyid"]?>"></div>
			</div>
<?php			} ?>
		</div>
		<div style="padding:20px 0;text-align:center"><input type="submit" value="<?php print $yySubmit?>" />&nbsp;&nbsp;<input type="reset" value="<?php print $yyReset?>" /></div>
<?php		} ?>
	</div>
</form>

	<div style="padding:10px;border:1px solid lightgrey;margin-bottom:10px">
		<h3>Excessive Contact Emails</h3>
		<div style="padding:20px 0">
			<div style="float:left;padding-left:40px"><select size="1" name="multicartadd" onchange="updatecontactemails(this)"><option value="0">Unlimited</option>
<?php
			$GLOBALS['hasdisplayed']=$GLOBALS['blockcontactemails']==0;
			function doceblockoption($tind){
				if($tind==$GLOBALS['blockcontactemails']) $GLOBALS['hasdisplayed']=TRUE;
				if($tind>$GLOBALS['blockcontactemails']&&!$GLOBALS['hasdisplayed'])
					doceblockoption($GLOBALS['blockcontactemails']);
				print '<option value="' . $tind . '"' . ($GLOBALS['blockcontactemails']==$tind?' selected':'') . '>' . $tind . '</option>';
			}
			for($index=10;$index<=250;$index+=10){
				doceblockoption($index);
			}
?>
			</select></div>
			<div style="float:left;padding:3px">You can limit the number of contact emails a customer can send.</div>
		</div>
		<div style="clear:both;padding:40px">Restrict the number of contact emails such as Contact Us or Email a Friend that a customer can send.</div>
	</div>
	
<div class="adminhome"><a href="admin.php"><?php print $yyAdmHom?></a></div>
<?php
}
?>