<?php
///////////////////////////////////////////////////////////////////////////////////////////////////////
// BotBanish 9.0.02
// Randem Systems: https://randemsystems.support
// BotBanish Client Site Access Protection Script
// Date: 07/18/2026
//
// Function: To monitor and control access to the system
//
// Usage: BotBanishClient($ForceLockout = false, $username = '', $email = '', $lock_remove = false, $lock_ip = '', $lock_add = false)
//
// $ForceLockout	- true / false - Force $username or $email to be locked out in BotBanish
// $username		- Users name to lock out
// $email			- Email to lock out
// $lock_remove		- To remove current ip from local databases (remote & local)
// $lock_ip 		- IP to place in or remove from .htaccess file
// $lock_add 		- true = Add IP / false = Remove IP
///////////////////////////////////////////////////////////////////////////////////////////////////////

	// determine if we were called via a POST / GET REQUEST_METHOD

	$method = (isset($_POST) && !empty($_POST)) ? $_POST : '';
	$method = (isset($_GET) && !empty($_GET)) ? $_GET : '';

	if (!empty($method) && isset($method['botbanish_dir'])) {

		$ForceLockout = false;
		$username = '';
		$email = '';
		$lock_remove = false;
		$lock_ip = '';
		$lock_add = false;

		foreach ($method as $key => $value)
			$$key = $value;

		BotBanishClient($ForceLockout, $username, $email, $lock_remove, $lock_ip, $lock_add);
		BotBanishExit(false);
	}

function BotBanishClient($ForceLockout = false, $username = '', $email = '', $lock_remove = false, $lock_ip = '', $lock_add = false) {

	// Prevent BotBanishClient from running if BotBanishClient is loading BotBanish_Pre_Includes.php

	if (isset($_SESSION['BotBanishClient']))
		return;

	global $BotBanishSettings, $boarddir;

	BotBanishDebugOn();

	if (!defined('BOTBANISH_CLIENT_DEBUG'))
		define('BOTBANISH_CLIENT_DEBUG', true);

	if (!function_exists('BotBanishSetSettings')) {

		$_SESSION['BotBanishClient'] = true;
		$path = dirname($_SERVER['SCRIPT_FILENAME']);
		$filename = realpath($path . '../Include/BotBanish_PreIncludes.php');
		require_once $filename;
/*		
		$self = basename($_SERVER['PHP_SELF']);
		$filename = realpath(str_ireplace($self, '../Include/BotBanish_PreIncludes.php', $_SERVER['SCRIPT_FILENAME']));
		require_once $filename;
*/
		unset($_SESSION['BotBanishClient']);
	}

	if (!BotBanishIsActive()) BotBanishExit(false);;

	$ip = empty($lock_ip) ? BotBanishGetIP() : $lock_ip;

	if (!BotBanishCheckIfValidIP($ip))
		BotBanishRedirectExit($BotBanishSettings['BOTBANISH_IP_LOCKOUT'], $ip);

	if (BotBanishCheckForBadIP($ip))
		BotBanishExit(false);

	if (BotBanishCheckForIPBlock($ip))
		BotBanishRedirectExit($BotBanishSettings['BOTBANISH_IP_LOCKOUT'], $ip);

	BotBanishCleanUpClientTable(); // Cleanup IP information

	// Remove excess log files

	BotBanishMaintainLogs();
	BotBanish_HTMLHoneyPotCreate();	// Create our HoneyPot html file (if it does not exist)

	// Check if we are processing an Error Document Redirect

	$_SERVER['DOCERROR'] = isset($_SERVER['REDIRECT_STATUS']) ? $_SERVER['REDIRECT_STATUS'] : 0;

	if (!empty($_SERVER['DOCERROR'])) {

		$_SERVER['DOCERROR_CAUSE'] = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
		$_SERVER['DOCERROR_CAUSE'] = empty($_SERVER['DOCERROR_CAUSE']) && isset($_SERVER['REDIRECT_QUERY_STRING']) ? $_SERVER['REDIRECT_QUERY_STRING']  : $_SERVER['DOCERROR_CAUSE'];
	}
	
	// If we are checking registrations, we are getting the first and last name and need to separate them
	
	if (stripos($username,',') !== false) {
		
		$name = explode(',', $username);
		$args = array();
		$args['first'] = $name[0];
		$args['last'] = $name[1];
		$args['ip'] = $ip;
		$username = '';
	}

	$row = BotBanishRetrieveSessionInfo($ip);
	$row['bot_ip'] = $ip;
	$row['username'] = $username;
	$row['email'] = $email;
	$row['lock_remove'] = $lock_remove;
	$row['forcelockout'] = !empty($ForceLockout) ? $ForceLockout : 0;
	BotBanishSetupRow($row);

	// If a lockout condition already exists, DO NOT OVERRIDE!!!

	$row['forcelockout'] = empty($row['forcelockout']) ? intval(BotBanishCheckForLockouts($row)) : $row['forcelockout'];

	// Check for spider lockout

	$row['forcelockout'] = empty($row['forcelockout']) ? intval(BotBanishCheckForSpiderOverride($ip, $row['user_agent'], $row['domain'])) : $row['forcelockout'];

	// Check for domain lockout

	$row['forcelockout'] = empty($row['forcelockout']) ? intval(BotBanishCheckForDomainOverride($row['domain'])) : $row['forcelockout'];

	// Check for email / user lockout
	
	$action = BotBanishEmailVerify($row['email'], $row['username'], array('terminate' => false, 'error' => '', 'args' => $row));
	$row['forcelockout']  = ($action['terminate'] === false) && !empty($email) ? $BotBanishSettings['BOTBANISH_EMAIL_USERNAME_LOCKOUT'] : $row['forcelockout'];

	// Check for user lockout (Registrations)

	if (isset($args) && isset($args['first']))
		$row['forcelockout'] = empty($row['forcelockout']) && !empty($username) ? intval(BotBanishUserVerify($args)) : $row['forcelockout'];
	
	// Process the client record information

	if (!empty($row['forcelockout']))
		BotBanishClientRecordInfo($row);

	BotBanishScheduledTasks();
	
	BotBanishDebugOff();
}

function BotBanishClientRecordInfo($row = array()) {

	if (!is_array($row) || empty($row))
		return;

	global $BotBanishSettings, $BotBanishText, $BotBanishSession;

	BotBanishTraceIt('BotBanishClientRecordInfo - Start', $row);
	$lockout = true;
	
	if (!isset($BotBanishSettings['BOTBANISH_REDIRECT_ONLY_ACTIVE']) || !$BotBanishSettings['BOTBANISH_REDIRECT_ONLY_ACTIVE'])
		$lockout = false;

	$type = 'ip';

	switch ($row['forcelockout']) {

		case $BotBanishSettings['BOTBANISH_BAD_BOT_LOCKOUT']:

			if (isset($BotBanishSettings['BOTBANISH_BAD_BOT_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_BAD_BOT_LOCKOUT_ACTIVE'])
				return 0;

			// Lockout due to a known bad bot

			$type = 'bot';

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_bot'], $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_bot'], $row['bot_ip'], $row['user_agent']);
			break;

		case $BotBanishSettings['BOTBANISH_HITCOUNT_LOCKOUT']:

			if (isset($BotBanishSettings['BOTBANISH_HITCOUNT_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_HITCOUNT_LOCKOUT_ACTIVE'])
				return 0;

			// Lockout due to excessive repetitive hits by user/bot
			// Don't block user agent if we did not replace it

			$type = 'bot';

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_res'], $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_res'], $row['bot_ip'], $row['user_agent']);
			break;


		case $BotBanishSettings['BOTBANISH_HIDDEN_LOCKOUT']:

			if (isset($BotBanishSettings['BOTBANISH_HIDDEN_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_HIDDEN_LOCKOUT_ACTIVE'])
				return 0;

			// Lockout due to a honeypot link trap

			$type = 'ip';

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_bot'], ' Honeypot Bot - ' . $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_bot'], $row['bot_ip'], $row['user_agent']);
			break;

		case $BotBanishSettings['BOTBANISH_EMAIL_USERNAME_LOCKOUT']:

			if (isset($BotBanishSettings['BOTBANISH_EMAIL_USERNAME_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_EMAIL_USERNAME_LOCKOUT_ACTIVE'])
				return 0;

			// Lockout due to a username & email combo or email or username

			$type = 'ip';
			$email = isset($row['email']) ? $row['email'] : '';
			$username = isset($row['username']) ? $row['username'] : '';

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_email'], 'Invalid Username / Email - ' . $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_email'], $row['bot_ip'], $row['user_agent'], $username, $email);
			break;

		case $BotBanishSettings['BOTBANISH_UNKNOWN_BOT_LOCKOUT']:

			if (isset($BotBanishSettings['BOTBANISH_UNKNOWN_BOT_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_UNKNOWN_BOT_LOCKOUT_ACTIVE'])
				return 0;

			// Lockout due to a unknown bot check

			$type = 'ip';

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_unknown_bot'], $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_unknown_bot'], $row['bot_ip'], $row['user_agent']);
			break;

		case $BotBanishSettings['BOTBANISH_SPOOF_BOT_LOCKOUT']:

			if (isset($BotBanishSettings['BOTBANISH_SPOOF_BOT_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_SPOOF_BOT_LOCKOUT_ACTIVE'])
				return 0;

			// Lockout due to bot attempting to spoof being a known good bot

			$type = 'ip';

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_spoof'], $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_spoof'], $row['bot_ip'], $row['user_agent'], $row['domain']);
			break;

		case $BotBanishSettings['BOTBANISH_BAD_DOMAIN_LOCKOUT']:

			if (isset($BotBanishSettings['BOTBANISH_BAD_DOMAIN_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_BAD_DOMAIN_LOCKOUT_ACTIVE'])
				return 0;

			// Lockout due to ip coming from a known bad domain

			$type = 'ip';

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_domain'], $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_domain'], $row['bot_ip'], $row['user_agent'], $row['domain']);
			break;

		case $BotBanishSettings['BOTBANISH_COUNTRY_LOCKOUT']:

//			if (isset($BotBanishSettings['BOTBANISH_COUNTRY_LOCKOUT']) && !$BotBanishSettings['BOTBANISH_COUNTRY_LOCKOUT_ACTIVE'])
//				return 0;

			// We don't want to send an email on country code lockouts, too many!!!, Just lock them out.

			$type = 'ip';
//			$lockout = true;
			break;

			// Regular IP lockout

			$type = 'ip';

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_country'], $row['country'], $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_country'], $row['bot_ip'], $row['country']);
			break;

		case $BotBanishSettings['BOTBANISH_EMPTY_USERAGENT_LOCKOUT']:

			if (isset($BotBanishSettings['BOTBANISH_EMPTY_USERAGENT_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_EMPTY_USERAGENT_LOCKOUT_ACTIVE'])
				return 0;

			// Empty user-agent lockout

			$type = 'ip';

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_useragent'], 'Empty User-Agent - ' . $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_bot'], $row['bot_ip'], $row['user_agent']);
			break;

		case $BotBanishSettings['BOTBANISH_ABUSE_LOCKOUT']:

			if (isset($BotBanishSettings['BOTBANISH_ABUSE_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_ABUSE_LOCKOUT_ACTIVE'])
				return 0;

			// Lockout due to excessive repetitive hits by user/bot

			$type = 'ip';

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_res'], $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_res'], $row['bot_ip'], $row['user_agent']);
			break;

		case $BotBanishSettings['BOTBANISH_CONTACT_LOCKOUT']:

			$type = 'ip';

			$subject = sprintf($BotBanishText['BOTBANISH_CONTACT_FORBIDDEN'], $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_res'], $row['bot_ip'], $row['user_agent']);
			break;

		// When in doubt, LOCK IT OUT!!!
		// Client may not have caught up to the servers lockout codes.
		// So we lock it out by the ip and send the generic message

		case $BotBanishSettings['BOTBANISH_IP_LOCKOUT']:
		case $BotBanishSettings['BOTBANISH_INVALID_REQUEST_LOCKOUT']:
		case $BotBanishSettings['BOTBANISH_IP_RANGE_LOCKOUT']:
		case $BotBanishSettings['BOTBANISH_URL_LOCKOUT']:
		default:

			$type = 'ip';

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_bot'], ' Honeypot Bot - ' . $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_bot'], $row['bot_ip'], $row['user_agent']);

			if (isset($BotBanishSettings['BOTBANISH_REDIRECT_ONLY_ACTIVE']) && !$BotBanishSettings['BOTBANISH_REDIRECT_ONLY_ACTIVE'])
				return 0;

			if (isset($BotBanishSettings['BOTBANISH_INVALID_REQUEST_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_INVALID_REQUEST_LOCKOUT_ACTIVE'])
				return 0;

			if (isset($BotBanishSettings['BOTBANISH_IP_RANGE_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_IP_RANGE_LOCKOUT_ACTIVE'])
				return 0;

			if (isset($BotBanishSettings['BOTBANISH_URL_LOCKOUT_ACTIVE']) && !$BotBanishSettings['BOTBANISH_URL_LOCKOUT_ACTIVE'])
				return 0;

			// Regular IP lockout

			$subject = sprintf($BotBanishText['BotBanishClient_mail_subject_ip'], $_SERVER['SERVER_NAME']);
			$body = sprintf($BotBanishText['BotBanishClient_mail_body_ip'], $row['bot_ip'], $row['user_agent']);
			break;
	}

	$row['type'] = $type;

	// Notify the administrator that we gave them the bum's rush!!!

	if (isset($subject)) {

		$body .= '<br>' . $BotBanishText['Server'] . ': ' . $_SERVER['SERVER_NAME'] . '<br>' . $BotBanishText['offending_country'] . ': ' . $row['country'] . '<br><br>';
		BotBanishSendMail($subject, $body);
	}

	// Update local IP Database

	if ($lockout) {

		BotBanishInsertLocal($row);

		// Create entry in .htaccess file if we have not done so already
		// Add this guy to the firewall deny list...

		BotBanishHTACCESSUpdate($row, 'ip');

		$BotBanishSession->setSessionKey('locked', $row['forcelockout']);
	}

	BotBanishLogTraceResponse($row);

	BotBanishTraceIt('BotBanishClientRecordInfo - End - $row["forcelockout"] = ' . $row['forcelockout'], $row['forcelockout']);

	BotBanishRedirectExit($row['forcelockout'], $row['bot_ip']);
}

function BotBanishCheckForLockouts($row) {

	global $BotBanishSettings;

	$url = addslashes($_SERVER['REQUEST_URI']);
	BotBanishTraceIt('BotBanishCheckForLockouts - Start - $url', $url);

	BotBanishSaveOverrideState();

	if (!BotBanishCheckForGoodURL($url)) {

		if (empty($row['forcelockout']) && BotBanishCheckForBadURL($url))
			$row['forcelockout'] = $BotBanishSettings['BOTBANISH_URL_LOCKOUT'];
	}

	// Check for lockout condition that are forced

	if (empty($row['forcelockout'])) {

		$row['forcelockout'] = empty($row['forcelockout']) ? intval(BotBanishClientCheckUserRegistrationAttempt()) : $row['forcelockout'];

		if (empty($row['forcelockout'])) {

			if ($row['lock_remove']) {

				BotBanishDatabaseRemoveIP($row['bot_ip']);
				BotBanishHTACCESSRemoveEntry($row['bot_ip'], 'ip');

			} else {

				if (BotBanishCheckForBadIP($row['bot_ip'])) {

					$row['forcelockout'] = $BotBanishSettings['BOTBANISH_IP_LOCKOUT'];

				} else {

					if (BotBanishCountryCodeBlockGet($row['country_code']))
						$row['forcelockout'] = $BotBanishSettings['BOTBANISH_COUNTRY_LOCKOUT'];
				}
			}
		}
	}

	BotBanishTraceIt('BotBanishCheckForLockouts - End - $_GET / $_POST', $_GET);

	BotBanishRestoreOverrideState();

	return $row['forcelockout'];
}

function BotBanishCheckForRemoval($row) {

	if (!empty($row['bot_ip']) && $row['lock_remove']) {

		global $BotBanishSettings;

		BotBanishDatabaseRemoveIP($row['bot_ip']);
		BotBanishHTACCESSRemoveEntry($row['bot_ip'], 'ip');
		BotBanishExit(false);
	}
}

function BotBanishDatabaseRemoveIP($ip) {

		$sql = 'DELETE FROM `bbc_botbanishclient_ip_bad` WHERE `bot_ip` = "' . $ip . '"';
		BotBanishExecuteSQL($sql);
}

function BotBanishClientCheckUserRegistrationAttempt() {

	global $sourcedir;

	// Check if we are on the registration page and the user has clicked 'Submit'

	if (isset($sourcedir) && !empty($sourcedir)) {

		// NOTE: Should we check for redirects here?

		if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST'){

			if (isset($_POST['regSubmit']) && ($_POST['regSubmit'] === 'Register')){

				// This is our hidden field on the registration page that only bots can see and fill out

				if (isset($_POST['name'])){

					if (!empty($_POST['name'])) {

						global $BotBanishSettings;
						return $BotBanishSettings['BOTBANISH_HIDDEN_LOCKOUT'];	// We got a bot!!! Let's stop it!
					}
				}
			}
		}
	}

	return false;
}
?>