/home/u764571690/domains/savitrfoundation.com/public_html/F2
Edit: /home/u764571690/domains/savitrfoundation.com/public_html/F2/api_process.php (9720B)
'Unauthorized origin']);
exit;
}
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Allow-Headers: Content-Type, X-API-Token, X-Request-Signature');
header('Access-Control-Max-Age: 86400');
// Rate Limiting
session_start();
$client_ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
$rate_limit_key = 'api_rate_' . $client_ip;
if (!isset($_SESSION[$rate_limit_key])) {
$_SESSION[$rate_limit_key] = ['count' => 0, 'time' => time()];
}
$rate_data = $_SESSION[$rate_limit_key];
if (time() - $rate_data['time'] > 60) {
$_SESSION[$rate_limit_key] = ['count' => 0, 'time' => time()];
$rate_data = $_SESSION[$rate_limit_key];
}
if ($rate_data['count'] >= API_RATE_LIMIT) {
http_response_code(429);
echo json_encode(['error' => 'Rate limit exceeded. Please try again later.']);
exit;
}
$_SESSION[$rate_limit_key]['count']++;
// Only POST allowed
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
http_response_code(405);
echo json_encode(['error' => 'Method not allowed']);
exit;
}
// Get and validate input
$input = json_decode(file_get_contents('php://input'), true);
if (!$input || !isset($input['action'])) {
http_response_code(400);
echo json_encode(['error' => 'Invalid request']);
exit;
}
$action = $input['action'];
// HIGH SECURITY: Token Authentication + Request Signing
$provided_token = $input['token'] ?? $_SERVER['HTTP_X_API_TOKEN'] ?? '';
$session_id = $input['session_id'] ?? session_id();
$request_signature = $input['signature'] ?? $_SERVER['HTTP_X_REQUEST_SIGNATURE'] ?? '';
$timestamp = $input['timestamp'] ?? 0;
// Generate expected token same way as get_token.php
$secret = hash('sha256', API_SECRET_KEY);
$expected_token = hash('sha256', $secret . $session_id);
if (empty($provided_token) || !hash_equals($expected_token, $provided_token)) {
http_response_code(403);
echo json_encode(['error' => 'Unauthorized - Invalid security token']);
exit;
}
// Request Signature Validation (HMAC) - Prevent request tampering
// Note: Signature validation is optional for now (frontend may use Web Crypto or fallback)
// In production, always validate signatures
$validate_signature = false; // Set to true when frontend properly implements HMAC
if ($validate_signature && !empty($request_signature)) {
$request_data = json_encode($input);
$expected_signature = hash_hmac('sha256', $request_data . $timestamp . $session_id, API_SECRET_TOKEN);
// Compare first 64 chars (frontend may truncate)
$sig_match = hash_equals(
substr($expected_signature, 0, 64),
substr($request_signature, 0, 64)
);
if (!$sig_match) {
// Log suspicious activity but don't block (for now)
error_log("Invalid signature attempt from IP: " . ($_SERVER['REMOTE_ADDR'] ?? 'unknown'));
}
// Check timestamp (prevent replay attacks - 5 minute window)
if (!empty($timestamp)) {
$time_diff = abs(time() - (int)$timestamp);
if ($time_diff > 300) {
http_response_code(403);
echo json_encode(['error' => 'Request expired']);
exit;
}
}
}
// Validate session
if (!isset($_SESSION['api_authenticated']) || (time() - $_SESSION['api_authenticated']) > API_SESSION_TIMEOUT) {
$_SESSION['api_authenticated'] = time();
}
switch ($action) {
case 'getProcessingParams':
// Return processing parameters (protected logic)
echo json_encode([
'success' => true,
'params' => [
'maxSize' => 280,
'speedValues' => [
'fast' => 0.5,
'normal' => 1.0,
'slow' => 2.0
],
'defaultZoom' => 52,
'defaultContrast' => 109,
'defaultBrightness' => 100,
'defaultSharpness' => 500,
'defaultThermalIntensity' => 500,
'pixelShakePercent' => 3
]
]);
break;
case 'calculateThermalColor':
// Thermal color calculation (protected algorithm)
$intensity = isset($input['intensity']) ? (int)$input['intensity'] : 0;
$gray = isset($input['gray']) ? (int)$input['gray'] : 0;
$thermalIntensity = isset($input['thermalIntensity']) ? (int)$input['thermalIntensity'] : 500;
$thermalRatio = $thermalIntensity / 500;
$r = $g = $b = 0;
if ($thermalRatio >= 0.5) {
$t = ($thermalRatio - 0.5) / 0.5;
if ($t >= 0.5) {
$t2 = ($t - 0.5) / 0.5;
$r = 255;
$g = max(0, min(255, (1 - $t2) * 100));
$b = 0;
} else {
$t2 = $t / 0.5;
$r = 255;
$g = max(0, min(255, 100 + $t2 * 155));
$b = 0;
}
} else {
$t = $thermalRatio / 0.5;
if ($t >= 0.5) {
$t2 = ($t - 0.5) / 0.5;
$r = 255 - $t2 * 255;
$g = 255;
$b = $t2 * 255;
} else {
$t2 = $t / 0.5;
$r = 0;
$g = 255 - $t2 * 255;
$b = 255;
}
}
$intensityFactor = $gray / 255;
$r = max(0, min(255, $r * $intensityFactor));
$g = max(0, min(255, $g * $intensityFactor));
$b = max(0, min(255, $b * $intensityFactor));
echo json_encode([
'success' => true,
'color' => ['r' => (int)$r, 'g' => (int)$g, 'b' => (int)$b]
]);
break;
case 'calculateSharpness':
// Sharpness calculation (protected algorithm)
$sharpness = isset($input['sharpness']) ? (int)$input['sharpness'] : 100;
$sharpnessAmount = ($sharpness - 100) / 100;
if ($sharpnessAmount > 0) {
if ($sharpness > 200) {
$extraAmount = ($sharpness - 200) / 100;
$sharpnessAmount = 1.0 + ($extraAmount * 2.5);
}
} else {
$sharpnessAmount = max($sharpnessAmount, -0.5);
}
echo json_encode([
'success' => true,
'sharpnessAmount' => $sharpnessAmount
]);
break;
case 'validateData':
// Data validation
$serial = isset($input['serial']) ? trim($input['serial']) : '';
$aadhar = isset($input['aadhar']) ? trim($input['aadhar']) : '';
$errors = [];
if (empty($serial) || strlen($serial) > 20) {
$errors[] = 'Invalid Serial Number';
}
if (empty($aadhar) || strlen($aadhar) !== 12 || !ctype_digit($aadhar)) {
$errors[] = 'Invalid Aadhar Number';
}
echo json_encode([
'success' => empty($errors),
'errors' => $errors
]);
break;
default:
http_response_code(400);
echo json_encode(['error' => 'Unknown action']);
break;
}
