<?php

if (basename($_SERVER['PHP_SELF']) == basename(__FILE__)) {
    die('Error , cannot Access To this File .');
}

// get data from post method and sanitize

$ctsecretkey = md5($config['passphrase'].base64_decode($_GET['linkfile']).$_GET['downloadkey'].$_GET['dllimit'].$_GET['expires']);
$downloadkey = wpcar_sanitize_data($_GET['downloadkey']);
$expires     = wpcar_sanitize_data($_GET['expires']);
$usermail    = wpcar_sanitize_data($_GET['usermail']);
$dllimit     = wpcar_sanitize_data($_GET['dllimit']);
$linkfile    = wpcar_sanitize_data(base64_decode($_GET['linkfile']));
$file        = basename($linkfile);
$downloadid  = wpcar_sanitize_data($_GET['downloadid']);
$filenum     = wpcar_sanitize_data($_GET['filenum']);
$priceid     = wpcar_sanitize_data($_GET['priceid']);
$secretkey   = wpcar_sanitize_data($_GET['secretkey']);
$ip   = wpcar_sanitize_data($_GET['ip']);

// check secret key

if ($_GET['secretkey']!= $ctsecretkey ){
    echo '-102'; // yor password is wrong
    exit();
}




// check for all args has exist or not
if (
    isset($_GET['downloadid'])  &&     isset($_GET['filenum'])  &&
    isset($_GET['priceid'])   &&     isset($_GET['ip'])){

    // connect to database

	$con = mysqli_connect($config['mysqlserver'],$config['dbusername'],$config['dbpassword'],$config['dbname']) or die("-106");

    // select from table

    $strSQL = "SELECT * FROM ".$config['tablename']." WHERE (downloadkey = '".$downloadkey."') AND (downloadid='".$downloadid."') AND (priceid='".$priceid."') AND (filenum='".$filenum."') LIMIT 1";
    $query = mysqli_query($con, $strSQL) or   die('-105');
    $row   = $query->fetch_assoc();
    if ($row){
        //if exist  update table

        if (($row['expires'] != $expires) || ($row['dllimit'] != $dllimit) ||$row['lockip'] != $ip ){
         // dl limit or expires changed and must be update in table
            $strSQL ="UPDATE ".$config['tablename']." SET file='$file' , usermail='$usermail' , dllimit='$dllimit' , linkfile='$linkfile' ,lockip='$ip' WHERE downloadkey='$downloadkey' AND downloadid='$downloadid' AND filenum='$filenum'  AND  priceid='$priceid' ";
            mysqli_query($con,$strSQL)  or die('-109');


        }

        if (( $expires >= time()) || ( $expires == 0 )) {   // not expire link
            if (($dllimit == 0) || ($row['downloads']<= $dllimit)){
                // true state
                echo '1';
            }else{
                echo '-108';//"This file has already been downloaded.";
            }
        }else{
            echo '-107';//"This download has expired.";
        }

    }else {

        //if not exist insert to table
$expires= strtotime('+2 days', time());
        $strSQL = "INSERT INTO ".$config['tablename']." (downloadkey, file, expires,usermail,dllimit,linkfile,downloadid,filenum,priceid,lockip) VALUES ('$downloadkey', '$file', '$expires','$usermail','$dllimit','$linkfile','$downloadid','$filenum','$priceid','$ip')";
        $query = mysqli_query($con, $strSQL) or  die('-104');
        echo  '1'; // result = ok file add to database

    }


    // cose connecton

    mysqli_close($con);

    // export resutl

}else{
    echo '-103'; // your variable is wrong

}
