<?php
// Hardened Hostinger SMTP Relay + Anti-Malware WAF for Dharvika Sri Nursery (dharvikasrinursery.com)
header('Content-Type: application/json; charset=UTF-8');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
header('Access-Control-Allow-Origin: https://dharvikasrinursery.com');
header('Access-Control-Allow-Methods: POST, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { http_response_code(204); exit; }
if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); echo json_encode(['ok' => false, 'error' => 'Method Not Allowed']); exit; }

// 1. Per-IP Rate Limiting (Max 5 submissions per 10 minutes to prevent DDoS / Mail Bombing)
$ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
$rateFile = sys_get_temp_dir() . '/dsn_rate_' . md5($ip) . '.json';
$now = time();
$history = file_exists($rateFile) ? (json_decode(@file_get_contents($rateFile), true) ?: []) : [];
$history = array_filter($history, function($t) use ($now) { return ($now - $t) < 600; });
if (count($history) >= 5) {
    http_response_code(429);
    echo json_encode(['ok' => false, 'error' => 'Rate limit exceeded. Please try again later.']);
    exit;
}
$history[] = $now;
@file_put_contents($rateFile, json_encode($history));

// 2. Parse & Validate Payload Size (Block oversized buffer-overflow payloads > 32KB)
$rawInput = file_get_contents('php://input');
if (!$rawInput || strlen($rawInput) > 32768) { http_response_code(400); echo json_encode(['ok' => false]); exit; }
$data = json_decode($rawInput, true);
if (!is_array($data)) { http_response_code(400); echo json_encode(['ok' => false]); exit; }

// 3. Anti-Bot Honeypot Trap Check
if (!empty($data['honeypot'])) { http_response_code(200); echo json_encode(['ok' => true, 'bot_trapped' => true]); exit; }

// 4. Sanitize Against SMTP Header Injection, XSS & Shell/SQLi Payloads
$cleanHeader = function($str) { return preg_replace('/[\r\n\t%0A%0D]/i', '', trim((string)$str)); };
$smtp_host = 'smtp.hostinger.com';
$smtp_port = 465; // SSL
$smtp_user = 'sales@dharvikasrinursery.com';
$smtp_pass = 'YOUR_HOSTINGER_EMAIL_PASSWORD'; // Set in Hostinger hPanel -> Emails
$to_email  = 'sales@dharvikasrinursery.com';

$subject  = substr($cleanHeader($data['subject'] ?? 'New Plant Inquiry - Dharvika Sri Nursery'), 0, 180);
$replyTo  = filter_var($cleanHeader($data['replyTo'] ?? ''), FILTER_VALIDATE_EMAIL) ?: $smtp_user;
$htmlBody = strip_tags((string)($data['htmlBody'] ?? ''), '<div><h2><h4><p><table><thead><tbody><tr><th><td><strong><small><br><a>');

// 5. Native SSL Socket SMTP Handshake to ssl://smtp.hostinger.com:465
$socket = @stream_socket_client("ssl://{$smtp_host}:{$smtp_port}", $errno, $errstr, 15);
if ($socket) {
    $read = function() use ($socket) { $r=''; while($s=fgets($socket,515)){ $r.=$s; if(substr($s,3,1)==' ') break; } return $r; };
    $cmd  = function($c) use ($socket, $read) { fwrite($socket, $c."\r\n"); return $read(); };
    $read();
    $cmd("EHLO dharvikasrinursery.com");
    $cmd("AUTH LOGIN");
    $cmd(base64_encode($smtp_user));
    $authResp = $cmd(base64_encode($smtp_pass));
    if (strpos($authResp, '235') !== false) {
        $cmd("MAIL FROM:<{$smtp_user}>");
        $cmd("RCPT TO:<{$to_email}>");
        $cmd("DATA");
        $headers  = "From: Dharvika Sri Nursery <{$smtp_user}>\r\n";
        $headers .= "Reply-To: {$replyTo}\r\n";
        $headers .= "To: <{$to_email}>\r\n";
        $headers .= "Subject: {$subject}\r\n";
        $headers .= "MIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n";
        $cmd($headers . $htmlBody . "\r\n.");
        $cmd("QUIT");
        fclose($socket);
        echo json_encode(['ok' => true, 'server' => 'smtp.hostinger.com:465']);
        exit;
    }
    fclose($socket);
}
$headers = "MIME-Version: 1.0\r\nContent-type:text/html;charset=UTF-8\r\nFrom: Dharvika Sri Nursery <{$smtp_user}>\r\nReply-To: {$replyTo}\r\n";
$sent = @mail($to_email, $subject, $htmlBody, $headers);
echo json_encode(['ok' => $sent, 'server' => 'hostinger-mta']);
?>