Added Tell-A-Friend
v2.2
-> Added version list.
-> Added ability to only allow purchasing customers to be affiliates.
-> Added giveaway product functionality.
-> Added affiliate emailing.
-> Added a few bug fixes.
v2.3
-> Added code for parsing PHP in templates.
-> Updated code that decides who gets OTO sale.
-> Major Security update tracks purchases by IP and only allows
Completed payments to be redirected to the download page.
-> Added ability to only allow OTO customers to get commissions on the OTO.
-> Added ability to disable download emails from automatically being sent.
-> Added support for all PayPal currencies.
-> BUG FIX: Corrected 48 hour extension of download link to add 48 hours to THIS moment.
-> Added script configure util (config.php)
v2.4
-> BUG FIX: When OTO commission is set to zero, affiliate always gets the commission.
-> BUG FIX: Affiliate cookie now cleared if only customers are allowed to be affiliates.
-> BUG FIX: Removed case-sensitive referrer domain comparison for TAF.
-> IPN script now prevents people from paying less than stated price for products.
-> IPN script now prevents people from purchasing using different emails from the same domains.
-> Added admin section for viewing fraudulent transactions.
-> Added version number to ipn.php, config.php and settings.php
-> Added back-end search features for sales records.
-> Added download security.
*/
$sys_version = 2.4;
include("settings.php");
function searchKeywords($url){
$parts = parse_url($url);
$host = str_replace("www.", "", $parts["host"]);
$keywords = "";
parse_str($parts["query"], $vars);
if(strpos(" $host", "google")){
$keywords = urldecode($vars["q"]);
}
elseif(strpos(" $host", "yahoo")){
$keywords = urldecode($vars["p"]);
}
elseif(strpos(" $host", "live")){
$keywords = urldecode($vars["q"]);
}
elseif($vars["keywords"]){
$keywords = urldecode($vars["keywords"]);
}
elseif($vars["query"]){
$keywords = urldecode($vars["query"]);
}
else{
$keywords = urldecode($vars["q"]);
}
return $keywords;
}
function evalPHP($template){
# Make all settings.php variables accessible to template PHP code.
global $sys_admin_username, $sys_admin_password, $sys_domain, $sys_support_address,
$sys_script_folder, $sys_template_folder, $sys_default_email, $sys_item_name,
$sys_item_number, $sys_item_cost, $sys_oto, $sys_oto_name, $sys_oto_number,
$sys_oto_cost, $sys_oto_percent, $sys_item_cancel_url, $sys_expire_hours,
$sys_blocked, $sys_secure_dl, $sys_tell_subject, $sys_tell_body,
$sys_purchasers_only, $sys_purchasers_override, $sys_giveaway_product,
$sys_oto_purchasers_only, $sys_oto_purchasers_override;
# Eval all php code in a template and plug result into output.
$output = "";
$last = 0;
$i = strpos($template, "", $i);
$phpcode = trim(str_replace(array(""), "", substr($template, $i, $i2 - $i)));
$val = eval($phpcode);
$output .= $val;
$last = $i2 + 3;
$i = strpos($template, "", $i);
$phpcode = trim(str_replace(array("=", "?>"), "", substr($output, $i, $i2 - $i)));
$val = eval("return $phpcode;");
$output2 .= $val;
$last = $i2 + 3;
$i = strpos($output, "=", $i2);
}
$output2 .= substr($output, $last, strlen($output) - $last);
return $output2;
}
function showTemplate($filename){
include($filename);
return;
$output = "";
$fh = @fopen($filename, "r");
while($s = fgets($fh)){
$output .= $s;
}
@fclose($fh);
echo evalPHP($output);
}
function getIPSalesRecord($oto = false){
global $sys_template_folder, $sys_oto_number;
$ip = $_SERVER["REMOTE_ADDR"];
$sales = @file($sys_template_folder . "ipn.txt");
$output = "";
foreach($sales as $sale){
$sale = explode("|", str_replace(array("\r", "\n"), "", $sale));
if($sale[14]==$ip){
$valid = true;
if($oto && $sale[2]!=$sys_oto_number){
$output = "";
$valid = false;
}
if($valid){
$output = $sale;
break;
}
}
}
return $output;
}
function getOTOSalesRecord($affemail){
global $sys_template_folder, $sys_oto_number;
$sales = @file($sys_template_folder . "ipn.txt");
$output = "";
foreach($sales as $sale){
$sale = explode("|", str_replace(array("\r", "\n"), "", $sale));
if($sale[4]==$affemail){
$valid = true;
if($sale[2]!=$sys_oto_number){
$output = "";
$valid = false;
}
if($valid){
$output = $sale;
break;
}
}
}
return $output;
}
function sys_download_url($oto){
$md5 = uniqid("");
return "index.php?action=dlid&oto=$oto&pid=$md5";
}
$action = $_REQUEST["action"];
if(substr($action, 0, 5)=="admin" && $action != "admin" && $action != "adminlogin" && !$_COOKIE["admin"]){
# Not logged in. Redirect to login.
header("Location: $_SERVER[PHP_SELF]?action=admin");
exit;
}
# Redirectin case PayPal goofs and fails to do so.
if(isset($_COOKIE["first"]) && !isset($_COOKIE["giveaway"]) && ($action == "squeeze"| $action == "downloadoto" | ($action=="" && $_SERVER["QUERY_STRING"] != "")) && !isset($_GET["e"])){
# Check for customer IP address in IPN file.
if(isset($_COOKIE["oto"])){
$oto = true;
}
else{
$oto = false;
}
$sale = getIPSalesRecord($oto);
if(is_array($sale)){
# Purchase record found.
if(isset($_COOKIE["oto"])){
setcookie("otodl", time(), time()+(3600*$sys_expire_hours), "/", "." . $sys_domain);
$url = "index.php?action=downloadoto";
}
elseif(isset($_COOKIE["ordered"])){
$url = "index.php?action=squeeze";
}
else{
# ??? - No purchase or OTO cookie found. Assume non OTO purchase.
$url = "index.php?action=squeeze";
}
# Clear first cookie.
setcookie("first", 0, time()-3600, "/", "." . $sys_domain);
# Send to appropriate page.
echo "
";
}
elseif($_GET["tries"]<11){
# Give one minute for PayPal to post IPN record before giving up and showing an error.
if(!isset($_GET["tries"])){
$tries = 1;
}
else{
$tries = $_GET["tries"] + 1;
}
$seconds = 60 - ($tries * 5);
echo "
|
|
Waiting for PayPal confirmation of purchase, please wait...
$seconds seconds left...
(This page will refresh every 5 seconds until PayPal provides confirmation.)
|
|
";
}
else{
# IP not found in records. Show error message.
if(substr($sys_support_address, 0, 7)=="http://"){
$eaddress = $sys_support_address;
}
else{
$eaddress = "mailto:$sys_support_address";
}
echo "
Purchase record not found.
|
|
We apologize for the inconvenience, but there was a problem confirming your purchase. Please contact our technical
support staff for your download link at:
$eaddress
Please paste a copy of your PayPal receipt into your message for verification.
NOTICE: If you paid with an eCheck or bank draft, the download link will be emailed to you automatically
after the payment clears.
Click here to continue.
|
|
";
setcookie("first", 0, time()-3600, "/", "." . $sys_domain);
}
exit;
}
# Clear first cookie.
setcookie("first", 0, time()-3600, "/", "." . $sys_domain);
if(isset($_GET["e"])){
# Make sure this account hasn't been blocked.
if(!strpos(" $sys_blocked", $_GET["e"])){
# Set cookie and redirect visitor if it's through an affiliate link.
# Set privacy policy for IE6/WinXP users.
# If you don't do this, a lot of IE browsers wont accept the cookie.
header('P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"');
setcookie("aff", $_GET["e"], time()+31536000, "/", "." . $sys_domain);
if($sys_purchasers_only){
if(strpos(strtolower(" $sys_purchasers_override"), strtolower($_GET["e"]))){
# Affiliate is in over-ride list. Let them sell.
$sellit = true;
}
else{
# Verify that this paypal email address is in our ipn.txt
$sellit = false;
$sales = @file($sys_template_folder . "ipn.txt");
foreach($sales as $sale){
$sale = explode("|", $sale);
if(strtolower($sale[4])==strtolower($_GET["e"])){
# They're a customer.
$sellit = true;
break;
}
}
}
}
else{
# Let anybody sell the product.
$sellit = true;
}
if($sellit){
if($_GET["taf"]){
header("Location: $sys_script_folder?taf=1");
}
else{
header("Location: $sys_script_folder");
}
}
else{
# Clear affiliate cookie.
setcookie("aff", "", time() - 3600);
# Show a message indicating that only people who bought can sell.
showTemplate($sys_template_folder . "customersonly.html");
}
exit;
}
else{
# Inform visitor that this customers link has been blocked
# for fradulent activity.
$filename = $sys_template_folder . "fraud.html";
showTemplate($filename);
exit;
}
}
# Keep paypal email on hand at all times.
if(isset($_COOKIE["aff"])){
$email = $_COOKIE["aff"];
}
else{
$email = $sys_default_email;
}
if($action==""){
# Save referrer.
if(isset($_GET["taf"])){
setcookie("ref", "TELL-A-FRIEND", time()+31536000, "/", "." . $sys_domain);
}
else{
setcookie("ref", $_SERVER["HTTP_REFERER"], time()+31536000, "/", "." . $sys_domain);
}
# Show sales letter.
$filename = $sys_template_folder . "salesletter.html";
# Set test cookie to make sure this will work for user.
#setcookie("cookietest", true, time()+31536000, "/", "." . $sys_domain);
}
elseif($action=="giveaway"){
if($sys_giveaway_product){
# This is a giveaway product. Set cookies for squeeze page.
setcookie("first", time(), time()+600, "/", "." . $sys_domain);
setcookie("ordered", time(), time()+($sys_expire_hours * 3600), "/", "." . $sys_domain);
setcookie("giveaway", time(), time()+($sys_expire_hours * 3600), "/", "." . $sys_domain);
# Send them on.
header("Location: index.php?action=squeeze");
exit;
}
}
elseif($action=="order"){
# An order. Great! :)
if(!$sys_currency){
# Default to USD.
$sys_currency = "USD";
}
# First, make sure cookies work for this user (since they are required).
#if(isset($_COOKIE["cookietest"])){
if(1){
# Yup. Send them through the order process.
if(isset($_GET["oto"])){
# Buying OTO.
if(!isset($_COOKIE["aff"])){
# No affiliate. Use primary email address.
$email = $sys_default_email;
}
else{
$checksale = true;
if($sys_oto_purchasers_only){
$checksale = false;
# Restrict OTO commissions to OTO purchasers only.
$sale = getOTOSalesRecord($_COOKIE["aff"]);
if(is_array($sale)){
# They are an OTO customer.
$checksale = true;
}
}
if($checksale){
# Use sales data to figure out who should get next OTO sale.
$sales = @file($sys_template_folder . "ipn.txt");
$afftotal = 0;
$affsales = 0;
foreach($sales as $sale){
$sale = explode("|", $sale);
if($sale[2] == $sys_oto_number && strtolower($sale[13]) == strtolower($_COOKIE["aff"])){
# OTO sale referred by affiliate.
$afftotal++;
if(strtolower($sale[3]) == strtolower($_COOKIE["aff"])){
# Affiliate got the OTO sale.
$affsales++;
}
}
}
if($afftotal > 0){
$affper = $affsales / $afftotal;
}
else{
$affper = 0;
}
if($sys_oto_percent > 0 && $affper<=$sys_oto_percent){
# Give OTO to affiliate.
$email = $_COOKIE["aff"];
}
else{
# Give OTO to vendor.
$email = $sys_default_email;
}
}
else{
# Send payment to vendor.
$email = $sys_default_email;
}
/* Old selection code.
srand();
$r = rand(1, 100);
if($r<=$sys_oto_percent){
# Send OTO to affiliate.
$email = $_COOKIE["aff"];
}
else{
# Use primary.
$email = $sys_default_email;
}
*/
}
$item_name = $sys_oto_name;
$item_number = $sys_oto_number;
$item_cost = $sys_oto_cost;
$item_download_url = "http://$sys_domain" . $sys_script_folder . "?action=downloadoto";
#$item_download_url = "http://$sys_domain" . $sys_script_folder;
$item_cancel_url = $sys_item_cancel_url;
$item_ipn_url = "http://$sys_domain" . $sys_script_folder . "ipn.php";
setcookie("oto", time(), time()+($sys_expire_hours * 3600), "/", "." . $sys_domain);
}
else{
# Regular purchase.
$item_name = $sys_item_name;
$item_number = $sys_item_number;
$item_cost = $sys_item_cost;
$item_download_url = "http://$sys_domain" . $sys_script_folder . "?action=squeeze";
#$item_download_url = "http://$sys_domain" . $sys_script_folder;
$item_cancel_url = $sys_item_cancel_url;
$item_ipn_url = "http://$sys_domain" . $sys_script_folder . "ipn.php";
}
setcookie("first", time(), time()+600, "/", "." . $sys_domain);
# Set ordered cookie.
setcookie("ordered", time(), time()+($sys_expire_hours * 3600), "/", "." . $sys_domain);
# Get customer IP address.
$ip = $_SERVER["REMOTE_ADDR"];
# Use meta-refresh instead of header() redirect.
# header() seems to cause session issues with PayPal.
echo "
Please wait...
|
You will be redirected to the PayPal checkout in 5 seconds.
Remember to click RETURN TO MERCHANT after checkout or you will not receive your download.
|
|
";
exit;
}
}
elseif($action=="download" && isset($_REQUEST["id"])){
# Check that: 1) ID is valid and 2) download has not timed out.
$id = $_REQUEST["id"];
$fh = @fopen($sys_template_folder . "ipn.txt", "r");
$invalid = true;
$records = array();
$changes = false;
while($rec = @fgets($fh)){
$rec = str_replace("\n", "", $rec);
if(trim($rec)){
$record = explode("|", $rec);
if($record[0]==$id){
$invalid = false;
# Valid ID. Check timeout.
if(time()<=$record[9]){
# Still active. Set cookies and show download.
setcookie("ordered", time(), $record[9], "/", "." . $sys_domain);
if($record[2]==$sys_oto_number){
# One-time offer download. Set cookie and show download.
setcookie("oto", time(), $record[9], "/", "." . $sys_domain);
$filename = $sys_template_folder . "downloadoto.html";
}
else{
# Already squeezed, show download page.
$filename = $sys_template_folder . "download.html";
}
}
else{
# Expired.
$filename = $sys_template_folder . "downloadexpired.html";
}
$rec = "";
for($i=0;$i0){
# Replace message vars.
$subject = str_replace("[SENDER]", $sendername, $sys_tell_subject);
$subject = str_replace("[PAYPAL]", $senderpaypal, $subject);
$body = str_replace("[SENDER]", $sendername, $sys_tell_body);
$body = str_replace("[PAYPAL]", $senderpaypal, $body);
$headers = "From: $sendername<$senderpaypal>
X-Sender: $sendername<$senderpaypal>
X-Mailer: PHP " . phpversion() . "
X-Priority: 3
Return-Path: $sendername<$senderpaypal>
Reply-To: $sendername<$senderpaypal>";
# Read number of tell-a-friend mails sent to date.
$tafcount = @file_get_contents($sys_template_folder . "tellafriend.txt");
if(!$tafcount){
$tafcount = 0;
}
# Send the message.
foreach($emails as $email){
if($email){
@mail($email, $subject, $body, $headers);
$tafcount++;
}
}
# Write new count.
$fh = @fopen($sys_template_folder . "tellafriend.txt", "w+");
@fwrite($fh, $tafcount);
@fclose($fh);
# Thanks!
echo "Thanks! A message has been sent to the people you entered into the form.";
exit;
}
else{
# Mail can only be sent from this domain.
echo "Mail can only be sent from $sys_domain.";
exit;
}
}
else{
echo "Your name and PayPal email address are required.";
exit;
}
}
elseif($action=="remove"){
# Remove affiliate from email list.
if($_REQUEST["email"]){
$fh = @fopen($sys_template_folder . "unsubs.txt", "a+");
@fwrite($fh, $_REQUEST["email"] . "\n");
@fclose($fh);
echo "You will no longer receive email from $sys_item_name.
";
exit;
}
}
elseif($action=="downloadfile"){
#
}
# All other actions require that user has ordered and
# cookie is set. If it's not, then it's expired.
elseif(isset($_COOKIE["ordered"])){
# Kill "first" cookie
if($action=="oto"){
# Show oto page.
$filename = $sys_template_folder . "oto.html";
}
elseif($action=="squeeze"){
$sale = getIPSalesRecord();
if(is_array($sale)|isset($_COOKIE["giveaway"])){
# Show name squeeze page.
$filename = $sys_template_folder . "squeeze.html";
}
else{
# Not safe, show expired.
$filename = $sys_template_folder . "downloadexpired.html";
}
}
elseif($action=="download"){
$sale = getIPSalesRecord();
if(is_array($sale)|isset($_COOKIE["giveaway"])){
if($sys_oto && !isset($_GET["dl"])){
# Show OTO page.
$filename = $sys_template_folder . "oto.html";
}
else{
# Show download page.
$filename = $sys_template_folder . "download.html";
}
}
else{
# Not safe, show expired.
$filename = $sys_template_folder . "downloadexpired.html";
}
}
elseif($action=="downloadoto" && isset($_COOKIE["oto"])){
$sale = getIPSalesRecord(true);
if(is_array($sale)){
# Show OTO download page.
$filename = $sys_template_folder . "downloadoto.html";
}
else{
# Invalid IP.
$filename = $sys_template_folder . "downloadexpired.html";
}
}
elseif($action=="downloadoto"){
# Show expired since visitor doesn't have oto cookie.
$filename = $sys_template_folder . "downloadexpired.html";
}
else{
# Expired.
$filename = $sys_template_folder . "downloadexpired.html";
}
}
elseif($action=="order" && !isset($_COOKIE["cookietest"])){
# No cookies. Show error.
$filename = $sys_template_folder . "nocookies.html";
}
elseif($action){
# Cookie's gone. Download has expired.
$filename = $sys_template_folder . "downloadexpired.html";
}
if($action=="admin"){
# Get username/password for admin area.
echo "
";
exit;
}
elseif($action=="adminlogin"){
# Verify admin username/password.
if($_POST["username"] == $sys_admin_username && $_POST["password"] == $sys_admin_password){
# Valid. Cookie and redirect.
setcookie("admin", true);
header("Location: $_SERVER[PHP_SELF]?action=adminmenu");
exit;
}
else{
echo "Invalid username or password.";
exit;
}
}
if($_COOKIE["admin"]){
$adminheader = "Admin Panel
$7 Secrets Scripts v$sys_version
";
$adminfooter = "