<?php
/**
 * Proxy script to bypass X-Frame-Options and CORS restrictions
 * Use with caution - only for trusted sites
 */

// Get the target URL
$url = $_GET['url'] ?? '';

if (empty($url)) {
    die('No URL specified');
}

// Validate URL (basic check)
if (!filter_var($url, FILTER_VALIDATE_URL)) {
    die('Invalid URL');
}

// Only allow specific domains (security)
$allowed_domains = ['sinotrackpro.com', 'www.sinotrackpro.com'];
$host = parse_url($url, PHP_URL_HOST);

$allowed = false;
foreach ($allowed_domains as $domain) {
    if (strpos($host, $domain) !== false) {
        $allowed = true;
        break;
    }
}

if (!$allowed) {
    die('Domain not allowed');
}

// Initialize cURL
$ch = curl_init();

// Set cURL options
curl_setopt_array($ch, [
    CURLOPT_URL => $url,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false, // Use with caution in production
    CURLOPT_SSL_VERIFYHOST => false,
    CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
    CURLOPT_TIMEOUT => 30,
    CURLOPT_CONNECTTIMEOUT => 10,
    CURLOPT_HEADERFUNCTION => function($curl, $header_line) {
        // Don't pass through headers that might cause issues
        $blocked_headers = ['x-frame-options', 'content-security-policy', 'frame-ancestors'];
        $header_lower = strtolower($header_line);
        
        foreach ($blocked_headers as $blocked) {
            if (strpos($header_lower, $blocked) !== false) {
                return strlen($header_line);
            }
        }
        
        header($header_line);
        return strlen($header_line);
    }
]);

// Handle cookies
$cookie_file = sys_get_temp_dir() . '/sinotrack_cookies_' . md5($url) . '.txt';
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);

// Execute request
$response = curl_exec($ch);
$error = curl_error($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$contentType = curl_getinfo($ch, CURLINFO_CONTENT_TYPE);

curl_close($ch);

// Handle errors
if ($error) {
    http_response_code(500);
    echo '<html><body><h2>Proxy Error</h2><p>' . htmlspecialchars($error) . '</p></body></html>';
    exit;
}

// Set content type if we got one
if ($contentType) {
    header('Content-Type: ' . $contentType);
}

// Modify response to fix relative URLs (basic fix)
if (strpos($contentType, 'text/html') !== false) {
    // Add base tag to handle relative URLs
    $base_url = $url;
    $base_tag = '<base href="' . htmlspecialchars($base_url) . '">';
    $response = preg_replace('/<head[^>]*>/', '<head>' . $base_tag, $response, 1);
}

// Output response
echo $response;

// Clean up old cookie files (optional)
if (rand(1, 100) === 1) { // 1% chance to clean up
    $files = glob(sys_get_temp_dir() . '/sinotrack_cookies_*');
    foreach ($files as $file) {
        if (filemtime($file) < time() - 3600) { // Older than 1 hour
            @unlink($file);
        }
    }
}
?>