# ==============================================
# $7 Secrets Scripts -- Main Script (index.php)
#   Copyright 2007-2008 by Don Morris
#   These scripts may not be distributed in any
#   form, except through the link in $7 Secrets
# ==============================================
# Script Version 2.8

$sys_version = "2.8";

include("settings.php");

function searchKeywords($url) {
	$parts = parse_url($url);
	$host = str_replace("www.", "", $parts["host"]);
	$keywords = "";
	parse_str($parts["query"], $vars);
	if (strpos(" $host", "google")) {
		$keywords = urldecode($vars["q"]);
	} elseif (strpos(" $host", "yahoo")) {
		$keywords = urldecode($vars["p"]);
	} elseif (strpos(" $host", "live")) {
		$keywords = urldecode($vars["q"]);
	} elseif ($vars["keywords"]) {
		$keywords = urldecode($vars["keywords"]);
	} elseif ($vars["query"]) {
		$keywords = urldecode($vars["query"]);
	} else {
		$keywords = urldecode($vars["q"]);
	}
	return $keywords;
}

function showTemplate($filename) {
	global $sys_template_folder;
	
	$filename = $sys_template_folder . $filename;
	include($filename);
	return;
}

function getIPSalesRecord($oto = false) {
	global $sys_template_folder, $sys_oto_number;

	$ip = $_SERVER["REMOTE_ADDR"];
	$sales = @file($sys_template_folder . "ipn.txt");
	$output = "";
	foreach ($sales as $sale) {
		$sale = explode("|", str_replace(array("\r", "\n"), "", $sale));
		if ($sale[14] == $ip) {
			$valid = true;
			if ($oto && $sale[2] != $sys_oto_number) {
				$output = "";
				$valid = false;
			}
			if ($valid) {
				# Make sure sale is within valid timeframe.
				if (time() < $sale[9]) {
					$output = $sale;
					break;
				} else {
					# Download has expired.
					$output = "";
				}
			}
		}
	}
	return $output;
}

function getOTOSalesRecord($affemail) {
	global $sys_template_folder, $sys_oto_number;

	$sales = @file($sys_template_folder . "ipn.txt");
	$output = "";
	foreach($sales as $sale) {
		$sale = explode("|", str_replace(array("\r", "\n"), "", $sale));
		if ($sale[4] == $affemail) {
			$valid = true;
			if ($sale[2] != $sys_oto_number) {
				$output = "";
				$valid = false;
			}
			if ($valid) {
				$output = $sale;
				break;
			}
		}
	}
	return $output;
}

function sys_download_url($oto){
  $md5 = uniqid("");
  return "index.php?action=dlid&oto=$oto&pid=$md5";
}

function getPaymentEmail($itemnumber, $percent) {
	global $sys_template_folder, $sys_default_email;

	if(!empty($_COOKIE["aff"])) {
		# Use sales data to figure out who should get next OTO sale.
		$sales = @file($sys_template_folder . "ipn.txt");
		$afftotal = 0;
		$affsales = 0;
		foreach ($sales as $sale) {
			$sale = explode("|", $sale);
			if($sale[2] == $itemnumber && strtolower($sale[13]) == strtolower(urldecode($_COOKIE["aff"]))){
				# Sale referred by affiliate.
				$afftotal++;
				if (strtolower($sale[3]) == strtolower(urldecode($_COOKIE["aff"]))) {
					# Affiliate got the sale.
					$affsales++;
				}
			}
		}
		if ($afftotal > 0) {
			$affper = ($affsales / $afftotal)*100;
		} else {
			$affper = 0;
		}
		if ($percent > 0 && $affper <= $percent) {
			# Give OTO to affiliate.
			$email = urldecode($_COOKIE["aff"]);
		} else {
			# Give OTO to vendor.
			$email = $sys_default_email;
		}

		return $email;
	} else {
		return $sys_default_email;
	}
}

function checkFile($filename) {
	global $sys_template_folder;

	if (!file_exists($sys_template_folder . $filename)) {
		$fh = fopen($sys_template_folder . $filename, "w+");
		fwrite($fh, "");
		fclose($fh);
	}
	return;
}

function mailer($filename,$to) {
	global $action, $item_name, $item_number, $payment_amount, $txn_id, $receiver_email, $payer_email, $payer_firstname, $payer_lastname, $payer_business, $sys_version, $sys_domain, $sys_script_folder, $sys_template_folder, $sys_support_address, $sys_item_name, $sys_expire_hours, $sendername, $senderpaypal;
	
	if ($action == "tellafriend") {
		$eaddress = $senderpaypal;
	} else {
		if (substr($sys_support_address, 0, 7) == "http://") {
			$eaddress = "noreply@$sys_domain";
		} else {
			$eaddress = $sys_support_address;
		}
		$sendername = $sys_item_name;
	}

	$headers = "From: \"$sendername\"<$eaddress>\r\n";
	$headers .= "X-Sender: \"$sendername\"<$eaddress>\r\n";
	$headers .= "X-Mailer: 7DS v$sys_version\r\n";
	$headers .= "X-Priority: 3\r\n";
	$headers .= "Return-Path: \"$sendername\"<$eaddress>\r\n";
	$headers .= "Reply-To: \"$sendername\"<$eaddress>";

	$body = file($sys_template_folder . $filename);
	$subject = array_shift($body);
	$body = implode($body);

	if ($action == "tellafriend") {
		$subject = str_replace("[item name]",$sys_item_name,$subject);
		$body = str_replace("[item name]",$sys_item_name,$body);
	} else {
		$subject = str_replace("[item name]",$item_name,$subject);
		$body = str_replace("[item name]",$item_name,$body);
	}
	$subject = str_replace("[item number]",$item_number,$subject);
	$body = str_replace("[item number]",$item_number,$body);
	$body = str_replace("[payment]",$payment_amount,$body);
	$body = str_replace("[download link]","http://$sys_domain" . $sys_script_folder . "index.php?action=download&id=$txn_id",$body);
	$body = str_replace("[seller email]",$receiver_email,$body);
	$body = str_replace("[buyer email]",$payer_email,$body);
	$subject = str_replace("[first name]",$payer_firstname,$subject);
	$body = str_replace("[first name]",$payer_firstname,$body);
	$body = str_replace("[last name]",$payer_lastname,$body);
	$body = str_replace("[business]",$payer_business,$body);
	$body = str_replace("[expire hours]",$sys_expire_hours,$body);
	$body = str_replace("[support address]",$sys_support_address,$body);
	$subject = str_replace("[taf name]",$sendername,$subject);
	$body = str_replace("[taf name]",$sendername,$body);
	$body = str_replace("[taf email]",$senderpaypal,$body);
	$subject = str_replace("[site]",$sys_domain,$subject);
	$body = str_replace("[site]",$sys_domain,$body);

	@mail($to, $subject, $body, $headers);
	return;
}

checkFile("index.html");
checkFile("ipn.txt");
checkFile("fraud.txt");
checkFile("tellafriend.txt");
checkFile("unsubs.txt");

$action = $_REQUEST["action"];

# Set privacy policy for IE6/WinXP users.
# If you don't do this, a lot of IE browsers won't accept cookies.
header('P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"');

# Redirect in case PayPal goofs and fails to do so.
if (!isset($_COOKIE["giveaway"]) && !isset($_GET["fdl"]) && ($action == "squeeze" | $action == "downloadoto") && !isset($_GET["e"])) {
	# Check for customer IP address in IPN file.
	if ($action == "downloadoto") {
		$oto = true;
	} else {
		$oto = false;
	}
	$sale = getIPSalesRecord($oto);
	if (is_array($sale)) {
    	# Purchase record found.
		if ($action == "downloadoto") {
			$url = "index.php?action=download&id=$sale[0]&fdl=1";
		} elseif ($action == "squeeze" | $action == "download") {
			$url = "index.php?action=squeeze&id=$sale[0]&fdl=1";
		} else {
			# Not sure what's up.  Send to sales letter.
			$url = "index.php";
		}

		# Send to appropriate page.
		header("Location: $url");
		exit;
	} elseif ($_GET["tries"] < 12) {
		# Give one minute for PayPal to post IPN record before giving up and showing an error.
		if (!isset($_GET["tries"])) {
			$tries = 1;
		} else {
			$tries = $_GET["tries"] + 1;
		}
		$seconds = 65 - ($tries * 5);
		$timeleft = str_replace("%n",$seconds,$lang['from_paypal_time']);
		echo "<html>
	<head>
		<title>".$lang['from_paypal_title']."</title>
		<meta http-equiv=\"refresh\" content=\"5;index.php?action=$action&tries=$tries\">
		<script language=\"Javascript\"><!--
			function refresh () {
				setTimeout(\"window.location.replace('index.php?action=$action&tries=$tries')\",5000)
			}
		--></script>
	</head>
	<body onload=\"refresh()\";>
		<p align=\"center\">
		<table height=\"100%\">
			<tr>
				<td valign=\"middle\">
					<p align=\"center\">
					<table width=\"400px\" border=\"1\">
						<tr>
							<td>
								<font face=\"verdana\"><p align=\"center\"><b>".$lang['from_paypal_explain']."</b></p>
								<p align=\"center\"><i>".$timeleft."</i></p>
								<p align=\"center\">".$lang['from_paypal_explain2']."</p></font>
							</td></tr></table>
					</p>
				</td></tr></table>
		</p>
	</body>
</html>";
	} else {
		# IP not found in records. Show error message.
		if (substr($sys_support_address, 0, 7) == "http://") {
			$eaddress = $sys_support_address;
		} else {
			$eaddress = "mailto:$sys_support_address";
		}
		showTemplate("purchase_notfound.html");
	}
	return;
}

if (isset($_GET["e"])) {
	if ($_GET["e"] != "") {
		# Make sure this account hasn't been blocked.
		if (!strpos(" $sys_blocked", $_GET["e"])) {
			# Set cookie and redirect visitor if it's through an affiliate link.
			if ($sys_purchasers_only) {
				if (strpos(strtolower(" $sys_purchasers_override"), strtolower($_GET["e"]))) {
					# Affiliate is in override list. Let them sell.
					$sellit = true;
				} else {
					# Verify that this paypal email address is in our ipn.txt
					$sellit = false;
					$sales = @file($sys_template_folder . "ipn.txt");
					foreach ($sales as $sale) {
						$sale = explode("|", $sale);
						if (strtolower($sale[4]) == strtolower($_GET["e"])) {
							# They're a customer.
							$sellit = true;
							break;
						}
					}
				}
			} else {
				# Anybody can sell the product.
				$sellit = true;
			}

			if ($sellit) {
				setcookie("aff", $_GET["e"], time()+31536000, $sys_script_folder, "." . $sys_domain);
				if ($_GET["taf"]) {
					# This was a tell-a-friend referral.
					header("Location: index.php?taf=1");
				} else {
					header("Location: index.php");
				}
			} else {
				# Clear affiliate cookie.
				setcookie("aff", $sys_default_email, time()+31536000, $sys_script_folder, "." . $sys_domain);
				# Show a message indicating that only people who bought can sell.
				showTemplate("customersonly.html");
			}
			return;
		} else {
			# Clear affiliate cookie.
			setcookie("aff", $sys_default_email, time()+31536000, $sys_script_folder, "." . $sys_domain);
			# Inform visitor that this customers link has been blocked
			# for fradulent activity.
			showTemplate("fraud.html");
			return;
		}
	} else {
		# Clear affiliate cookie.
		setcookie("aff", "", time()-31536000, $sys_script_folder, "." . $sys_domain);
	}
}

# Keep paypal email on hand at all times.
if (isset($_COOKIE["aff"])) {
	$email = $_COOKIE["aff"];
} else {
	$email = $sys_default_email;
}

# =============================================================================
# NO ACTION = SHOW SALES LETTER
# =============================================================================
if ($action == "") {
	# Save referrer.
	if (isset($_GET["taf"])) {
		setcookie("ref", "TELL-A-FRIEND", time()+31536000, $sys_script_folder, "." . $sys_domain);
	} else {
		setcookie("ref", $_SERVER["HTTP_REFERER"], time()+31536000, $sys_script_folder, "." . $sys_domain);
	}

	# Get salesletters array.
	if (!is_array($sys_salesletters)) {
		$salesletters = array("salesletter.html");
	} else {
		$salesletters = $sys_salesletters;
	}
  
	if (isset($_COOKIE["sln"])) {
		# This visitor has already been shown a particular sales letter.
		# Keep the same one in front of them and don't log another visit.
		if (count($salesletters) >= $_COOKIE["sln"]) {
			$salesletter = $salesletters[$_COOKIE["sln"]];
		} else {
			$salesletter = $salesletters[0];
			setcookie("sln", 0, time()+31536000, $sys_script_folder, "." . $sys_domain);
		}
	} else {
		# Randomly select sales letter to display.
		srand();
		$r = rand(0, count($salesletters)-1);
		$salesletter = $salesletters[$r];
    
		# Update visitor data for this sales letter.
		if (file_exists($sys_template_folder . $salesletter . ".dat")) {
			$fh = @fopen($sys_template_folder . $salesletter . ".dat", "r");
			$count = str_replace("\n", "", fgets($fh));
			fclose($fh);
		} else {
			$count = 0;
		}
    
		$count++;

		$done = false;
		$fh = @fopen($sys_template_folder . $salesletter . ".dat", "w+");
		while (!$done) {
			$fl = @flock($fh, LOCK_EX);
			if ($fl) {
				@fwrite($fh, $count . "\n");
				$done = true;
				@flock($fh, LOCK_UN);
			}
		}
		@fclose($fh);

		setcookie("sln", $r, time()+31536000, $sys_script_folder, "." . $sys_domain);
	}

	# Show sales letter.
	showTemplate($salesletter);
	return;
}

# =============================================================================
# GIVEAWAY = HANDLE GIVE-AWAY PRODUCT
# =============================================================================
elseif ($action == "giveaway") {
	if ($sys_giveaway_product) {
		# Set giveaway cookie.
		setcookie("giveaway", true, time() + (3600 * $sys_expire_hours), $sys_script_folder, "." . $sys_domain);
		header("Location: index.php?action=squeeze&giveaway=1");
		exit;
	}
}

# =============================================================================
# ORDER = HANDLE ORDER VIA PAYPAL
# =============================================================================
elseif ($action == "order") {
	if (isset($sys_max_sales) && $sys_max_sales > 0) {
		# See if we're sold out.
		$orders = @file($sys_template_folder . "ipn.txt");
		$oc = 0;
		foreach ($orders as $order) {
			$order = explode("|", str_replace("\n", "", $order));
			if ($order[2]==$sys_item_number) {
				$oc++;
			}
		}
		if ($oc >= $sys_max_sales) {
			# Sold out
			showTemplate("soldout.html");
			return;
		}
	}

    if (!$sys_currency) {
		$sys_currency = "USD";
	}
	
	if (!$sys_locale) {
		$sys_locale = "US";
	}

    # Get conversion sales letter
	if (!is_array($sys_salesletters) | !isset($_COOKIE["sln"])) {
		$salesletter = "salesletter.html";
	} else {
		$salesletter = $sys_salesletters[$_COOKIE["sln"]];
	}

	# Send them through the order process
	if (isset($_GET["oto"])) {
		# Buying OTO product
		if (!isset($_COOKIE["aff"])) {
			# No affiliate. Use default email address.
			$email = $sys_default_email;
		} else {
			$checksale = true;
			if ($sys_oto_purchasers_only) {
				$checksale = false;
				# Restrict OTO commissions to OTO purchasers only.
				$sale = getOTOSalesRecord(urldecode($_COOKIE["aff"]));
				if (is_array($sale)) {
					# They are an OTO customer.
					$checksale = true;
				}
			}
			if ($checksale) {
				$email = getPaymentEmail($sys_oto_number, $sys_oto_percent);
			} else {
				# Send payment to vendor.
				$email = $sys_default_email;
			}
		}
		$item_name = $sys_oto_name;
		$item_number = $sys_oto_number;
		$item_cost = $sys_oto_cost;
		$item_download_url = "http://$sys_domain" . $sys_script_folder . "?action=downloadoto";
		$item_cancel_url = "http://$sys_domain" . $sys_script_folder . "?action=download";
		$item_ipn_url = "http://$sys_domain" . $sys_script_folder . "ipn.php";
	} else {
		# Buying front-end product
		if (!isset($sys_item_percent)) {
			# 100% commission is the default.
			$sys_item_percent = 100;
		}
		if ($sys_item_percent < 100) {
			$email = getPaymentEmail($sys_item_number, $sys_item_percent);
		}
		$item_name = $sys_item_name;
		$item_number = $sys_item_number;
		$item_cost = $sys_item_cost;
		$item_download_url = "http://$sys_domain" . $sys_script_folder . "?action=squeeze";
		$item_cancel_url = $sys_item_cancel_url;
		$item_ipn_url = "http://$sys_domain" . $sys_script_folder . "ipn.php";
	}

	# Get customer IP address.
	$ip = $_SERVER["REMOTE_ADDR"];

	# Set affiliate email for display.
	if (isset($_COOKIE["aff"])) {
		$affemail = $_COOKIE["aff"];
	} else {
		$affemail = "none";
	}

	# Use meta-refresh instead of header() redirect.
	# header() seems to cause session issues with PayPal.
	echo "<html>
	<head>
		<title>".$lang['goto_paypal_title']."</title>
	</head>
	<body>
		<p align=center>
		<table width=100% height=100%>
			<tr>
				<td align=center valign=center>
					<table width=420px cellpadding=5 style='border: 1px solid black; font-size: 12px;'>
						<tr>
							<td><font face=verdana><p>".$lang['goto_paypal_explain']."</p>
							<p>".$lang['goto_paypal_explain2']."</p></font></td>
						</tr>
					</table></td>
			</tr>
			<tr>
				<td align=center valign=top height=50px><p align=center><font style='font-size: 12px;'>[".$lang['goto_paypal_affiliate']." = $affemail]</font></p></td>
			</tr>
		</table></p>
		<form action=\"https://www.paypal.com/cgi-bin/webscr\" method=\"post\" id=paymentform>
		<input type=\"hidden\" name=\"cmd\" value=\"_xclick\">
		<input type=\"hidden\" name=\"business\" value=\"$email\">
		<input type=\"hidden\" name=\"item_name\" value=\"$item_name\">
		<input type=\"hidden\" name=\"item_number\" value=\"$item_number\">
		<input type=\"hidden\" name=\"amount\" value=\"$item_cost\">
		<input type=\"hidden\" name=\"no_shipping\" value=\"1\">
		<input type=\"hidden\" name=\"return\" value=\"$item_download_url\">
		<input type=\"hidden\" name=\"cancel_return\" value=\"$item_cancel_url\">
		<input type=\"hidden\" name=\"no_note\" value=\"1\">
		<input type=\"hidden\" name=\"shipping\" value=\"0.00\">
		<input type=\"hidden\" name=\"currency_code\" value=\"$sys_currency\">
		<input type=\"hidden\" name=\"lc\" value=\"$sys_locale\">
		<input type=\"hidden\" name=\"charset\" value=\"$sys_charset\">
		<input type=\"hidden\" name=\"bn\" value=\"PP-BuyNowBF\">
		<input type=\"hidden\" name=\"rm\" value=\"2\">
		<input type=\"hidden\" name=\"notify_url\" value=\"$item_ipn_url\">
		<input type=\"hidden\" name=\"cbt\" value=\"".$lang['return_button']."\">
		<input type=\"hidden\" name=\"custom\" value=\"$_COOKIE[ref]|$_COOKIE[aff]|$ip||||$salesletter\">
		</form>
		<script language=javascript><!--
setTimeout('redir()', 5000);

function redir() {
	document.getElementById('paymentform').submit();
	}
		--></script>
	</body>
</html>";
	exit;
}

# =============================================================================
# SQUEEZE/DOWNLOAD WITH ID = HANDLE SQUEEZE/DOWNLOAD PAGE
# =============================================================================
elseif (($action == "squeeze" | $action=="download") && isset($_REQUEST["id"])) {
	# Check that: 1) ID is valid and 2) download has not timed out.
	$id = $_REQUEST["id"];

	$fh = @fopen($sys_template_folder . "ipn.txt", "r");
	$invalid = true;
	while ($rec = @fgets($fh)) {
		$rec = str_replace("\n", "", $rec);
		if (trim($rec)) {
			$record = explode("|", $rec);
			if ($record[0] == $id) {
				$invalid = false;
				# Valid ID. Check timeout.
				if (time() <= $record[9]) {
					# Still active. Show download.
					if ($record[2] == $sys_oto_number) {
						# One-time offer download. Set cookie and show download.
						$filename = "downloadoto.html";
					} else {
						# Show appropriate page.
						if ($action == "squeeze") {
							$filename = "squeeze.html";
						} else {
							$filename = "download.html";
						}
					}
				} else {
					# Expired.
					$filename = "downloadexpired.html";
				}
			}
		}
	}
	if ($invalid) {
		# Invalid ID.
		$filename = "invalid.html";
	}
	showTemplate($filename);
	return;
}

# =============================================================================
# DLID = SEND DOWNLOAD TO BROWSER
# =============================================================================
elseif ($action == "dlid") {
	# Send product download to browser.
	$parts = parse_url($_SERVER["HTTP_REFERER"]);
	$host = str_replace("www.", "", strtolower($parts["host"]));
	if ($host == strtolower($sys_domain)) {
		# It's cool.  They're downloading from our domain.
		header("Content-Type: application/octet-stream");
		header("Content-Transfer-Encoding: binary");
		header("Content-Description: File Transfer");
		if ($_GET["oto"]) {
			$fparts = explode("/", $sys_oto_location);
			$filename = $fparts[count($fparts)-1];
			header("Content-Disposition: attachment; filename=$filename");
			@readfile($sys_oto_location);
		} else {
			$fparts = explode("/", $sys_item_location);
			$filename = $fparts[count($fparts)-1];
			header("Content-Disposition: attachment; filename=$filename");
			@readfile($sys_item_location);
		}
		exit;
	} else {
		# Not downloading from our domain.
		echo "<html>
	<head>
		<title>".$lang['error_title']."</title>
	</head>
	<body>
		<p><font color=\"red\">".$lang['download_error']."</font></p>
	</body>
</html>";
		exit;
	}
}

# =============================================================================
# TELLAFRIEND = SEND TELL A FRIEND EMAIL
# =============================================================================
elseif ($action == "tellafriend") {
	# Send tell-a-friend message to people.
	$sendername = $_POST["sendername"];
	$senderpaypal = $_POST["senderpaypal"];
	$emails = $_POST["senderemail"];
	if (!empty($sendername) && !empty($senderpaypal) && is_array($emails)) {
		if (strpos(strtolower($_SERVER["HTTP_REFERER"]), strtolower($sys_domain)) > 0) {

			# Read number of tell-a-friend mails sent to date.
			$tafcount = @file_get_contents($sys_template_folder . "tellafriend.txt");
			if (!$tafcount) {
				$tafcount = 0;
			}

			# Send the message.
			foreach ($emails as $email) {
				if ($email) {
					mailer("email_taf.txt", $email);
					$tafcount++;
				}
			}

			# Write new count.
			$fh = @fopen($sys_template_folder . "tellafriend.txt", "w+");
			@fwrite($fh, $tafcount);
			@fclose($fh);

			# Thanks!
			echo "<html>
	<head>
		<title>".$lang['taf_title']."</title>
	</head>
	<body>
		<p><font color=\"blue\">".$lang['taf_thankyou']."</font></p>
	</body>
</html>";
			exit;
		} else {
			# Mail can only be sent from this domain.
			echo "<html>
	<head>
		<title>".$lang['error_title']."</title>
	</head>
	<body>
		<p><font color=\"red\">".$lang['taf_mail_error']."</font></p>
	</body>
</html>";
			exit;
		}
	} else {
		echo "<html>
	<head>
		<title>".$lang['error_title']."</title>
	</head>
	<body>
		<p><font color=\"red\">".$lang['taf_required']."</font></p>
	</body>
</html>";
		exit;
	}
}

# =============================================================================
# REMOVE = REMOVE AFFILIATE FROM EMAIL LIST
# =============================================================================
elseif ($action == "remove") {
	# Remove affiliate from email list.
	if ($_REQUEST["email"]) {
		$fh = @fopen($sys_template_folder . "unsubs.txt", "a+");
		@fwrite($fh, $_REQUEST["email"] . "\n");
		@fclose($fh);
		echo "<html>
	<head>
		<title>".$lang['unsub_title']."</title>
	</head>
	<body>
		<p><font color=\"blue\">".$lang['unsub_explain']."</font></p>
	</body>
</html>";
		exit;
	}
}

# =============================================================================
# ALL OTHER PURCHASE-REQUIRED ACTIONS
# =============================================================================
elseif (substr($action, 0, 5) != "admin") {
	# All other actions require a purchase (unless it was a giveaway).
	# First verify that person actually purchased.
	if ($action == "downloadoto") {
		$sale = getIPSalesRecord(true);
	} else {
		if ($sys_giveaway_product && isset($_COOKIE["giveaway"])) {
			$sale = array();
		} else {
			$sale = getIPSalesRecord(false);
		}
	}

	if (is_array($sale)) {
		if ($action=="oto") {
			# Show oto page.
			$filename = "oto.html";
		} elseif ($action=="squeeze") {
			# Show name squeeze page.
			$filename = "squeeze.html";
		} elseif ($action=="download") {
			if ($sys_oto && !isset($_GET["dl"])) {
				# Show OTO page.
				$filename = "oto.html";
			} else {
				# Show download page.
				$filename = "download.html";
			}
		} elseif ($action=="downloadoto") {
			# Show OTO download page.
			$filename = "downloadoto.html";
		} else {
			# Invalid action, show salesletter
			header("Location: index.php");
			exit;
		}
	} else {
		# No valid, unexpired sale found. Show expired page.
		$filename = "downloadexpired.html";
	}
	showTemplate($filename);
	return;
}

# =============================================================================
# ADMIN BACK-END FUNCTIONS
# =============================================================================
if (substr($action, 0, 5) == "admin" && $action != "admin" && $action != "adminlogin" && !$_COOKIE["7ds_admin"]) {
	# Not logged in.  Redirect to login.
	header("Location: index.php?action=admin");
	exit;
}

if ($action == "admin") {
	# Get username/password for admin area.
	echo "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\"
   \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">
<html>
	<head>
		<title>$7 Secrets - Admin Login</title>
		<style type=\"text/css\"><!--
body, p, td {font-size: 12px; font-family: Verdana,Arial;}
		--></style>
	</head>
	<body>
		<img src='images/adminlogo.png' alt=\"\" border=0 />
		<p><b>Admin Login</b></p>
		<form action='index.php' method=post>
		<table>
			<tr><td>username</td><td><input type=text name=username size=20 /></td></tr>
			<tr><td>password</td><td><input type=password name=password size=20 /></td></tr>
		</table>
		<input type=submit value='Login' />
		<input type=hidden name=action value=adminlogin />
		</form>
	</body>
</html>";
	exit;
} elseif ($action == "adminlogin") {
	# Verify admin username/password.
	if ($_POST["username"] == $sys_admin_username && $_POST["password"] == $sys_admin_password) {
		# Valid.  Cookie and redirect.
		$uniq = uniqid("");
		setcookie("7ds_admin", true);
		setcookie("7ds_uniq", $uniq);
		$fh = fopen($sys_template_folder . "uniq.txt", "w+");
		fwrite($fh, $uniq);
		fclose($fh);
		header("Location: index.php?action=adminmenu");
		exit;
	} else {
		echo "<html>
	<head>
		<title>Error</title>
	</head>
	<body>
		<p><font color=\"red\"><b>Invalid username or password.</b></font></p>
	</body>
</html>";
		exit;
	}
}

if ($_COOKIE["7ds_admin"]) {
	$uniq = file_get_contents($sys_template_folder . "uniq.txt");
	if ($_COOKIE["7ds_uniq"] != $uniq) {
		# Somebody's trying to hack.
		setcookie("7ds_admin", "", time() - 3600);
		header("Location: index.php?action=admin");
		exit;
	}
  
	$adminheader = "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\"
   \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">
<html>
	<head>
		<title>Admin Panel</title>
		<style type=\"text/css\"><!--
body {font-family: arial; font-size: 11pt;}
a:link, a:visited, a:hover {color:blue}
table {border-style: solid; border-width: 0 0 1px 0; border-color: #aaaaaa;}
td {border-width: 1px 1px 0 1px; border-style: solid; border-color: #aaaaaa; padding: 2px; font-family: Verdana,Arial; font-size: 8pt;}
		--></style>
	</head>
	<body>
		<a href=\"index.php?action=adminmenu\"><img src=\"adminlogo.png\" alt=\"$7 Secrets\" border=0 /></a>
		<p><i>$7 Secrets Scripts v$sys_version</i></p>
";
	$adminfooter = "
	</body>
</html>";
	# Admin functions.
	if ($action == "adminmenu") {
		# Get tell-a-friend count.
		$taf = @file_get_contents($sys_template_folder . "tellafriend.txt");
		if (!$taf) {
			$taf = 0;
		}
    
		echo "$adminheader
		<p><b>Admin Panel</b></p>
		<ol>
			<li><a href='index.php?action=adminbuys'>Show All Sales</a></li>
			<li><a href='index.php?action=adminbuys&amp;count=50'>Show Last 50 Sales</a></li>
			<li><a href='index.php?action=adminbuys&amp;count=100'>Show Last 100 Sales</a></li>
			<li><a href='index.php?action=adminmine'>Show My Sales</a></li>
			<li><a href='index.php?action=adminsearch'>Search Sales</a></li>
			<li><a href='index.php?action=adminconversion'>Conversion Report</a></li>
			<li><a href='index.php?action=adminrefs'>Referrer Report</a></li>
			<li><a href='index.php?action=adminrefdomains'>Referrer Domains Report</a></li>
			<li><a href='index.php?action=adminrefsmine'>My Sales Referrer Report</a></li>
			<li><a href='index.php?action=adminrefdomainsmine'>My Sales Referrer Domains Report</a></li>
			<li><a href='index.php?action=adminfraud'>Fraud Report</a></li>
			<li><a href='index.php?action=adminaffiliates'>Affiliates Report</a></li>
			<li><a href='index.php?action=adminemailaffiliates'>Email Affiliates</a></li>
			<li><a href='index.php?action=adminexport'>Export Purchases to CSV</a></li>
			<li><a href='index.php?action=adminlogout'>Logout</a></li>
		</ol>
		<p>$taf people have been emailed using the tell-a-friend feature.</p>
		$adminfooter";
		exit;
	} elseif ($action == "adminbuys" | $action == "adminmine") {
		# Show all customers.
		$records = @file($sys_template_folder . "ipn.txt");
		$count = 0;
		$count = $_REQUEST["count"];
		if ($records) {
			$rcount = count($records);
		} else {
			$rcount = 0;
			$records = array();
		}
		if ($count) {
			$showing = "last $count";
		} else {
			$showing = "all $rcount";
		}
		if ($action == "adminmine") {
			$showing = "only sales paid to you";
		}
		echo "$adminheader
		<a href='index.php?action=adminmenu'>Back to Menu</a>
		<p><i>Clicking the EXPIRES link will add another $sys_expire_hours hours to the customer's download link expiration.</i></p>
		<p>$rcount total records.  Showing $showing. Your sales are <span style='background-color: #ffffcc;'>highlighted</span>.</p>
			<table cellspacing=0 cellpadding=0>
				<tr>
					<td><b>PayPal Receipt ID</b></td>
					<td><b>Item Number</b></td>
					<td><b>Affiliate Email</b></td>
					<td><b>Customer Email</b></td>
					<td><b>First Name</b></td>
					<td><b>Last Name</b></td>
					<td><b>Payment</b></td>
					<td><b>Bought</b></td>
					<td><b>Expires</b></td>
				</tr>";
		$bgcolor = "#ffffff";
		$c = $rcount;
		foreach ($records as $rec) {
			$c--;
			if (!$count | $c <= $count) {
				$rec = str_replace("\n", "", $rec);
				if (trim($rec)) {
					$record = explode("|", $rec);
					$date = "";
					if ($record[11]) {
						$date = date("Y-m-d H:i:s", $record[11]);
					}
					$expires = date("Y-m-d H:i:s", $record[9]);
					if ($record[3] == $sys_default_email) {
						# Our sale. Yay! :)
						$bgcolor = "#ffffcc";
					}
					$show = true;
					if ($action == "adminmine") {
						if ($record[3] != $sys_default_email) {
							$show = false;
						}
					}
					if ($show) {
						echo "
				<tr>
					<td bgcolor=$bgcolor><a href='index.php?action=download&amp;id=$record[0]' target=_blank>$record[0]</a></td>
					<td bgcolor=$bgcolor>$record[2]</td>
					<td bgcolor=$bgcolor>$record[3]</td>
					<td bgcolor=$bgcolor>$record[4]</td>
					<td bgcolor=$bgcolor>$record[5]</td>
					<td bgcolor=$bgcolor>$record[6]</td>
					<td bgcolor=$bgcolor>$record[8]</td>
					<td bgcolor=$bgcolor>$date</td>
					<td bgcolor=$bgcolor><a href='index.php?action=adminextend&amp;id=$record[0]'>$expires</a></td>
				</tr>
			";
					}
					if ($bgcolor == "#ffffff") {
						$bgcolor = "#eeeeee";
					} else {
						$bgcolor = "#ffffff";
					}
				}
			}
		}
		echo "</table>$adminfooter";
		exit;
	} elseif ($action == "adminexport") {
		# Export purchase records to CSV.
		$first = true;
		header("Content-Type: application/octet-stream");
		header("Content-Disposition: attachment; filename=export.csv");
		header("Content-Transfer-Encoding: binary");
		$records = @file($sys_template_folder . "ipn.txt");
		if ($records) {
			foreach ($records as $rec) {
			$rec = str_replace("\n", "", $rec);
				if (trim($rec)) {
					if ($first) {
						# Output headers.
						echo '"PayPal Receipt ID","Item Name","Item Number","Affiliate Email","Customer Email","First Name","Last Name","Company","Payment","Bought","Expires","Referrer","Affiliate","IP","","","","Salesletter"' . "\r\n";
						$first = false;
					}
					$record = explode("|", $rec);
					$date = "";
					if ($record[11]) {
						$date = date("Y-m-d H:i:s", $record[11]);
					}
					$expires = date("Y-m-d H:i:s", $record[9]);
					echo "\"$record[0]\",\"$record[1]\",\"$record[2]\",\"$record[3]\",\"$record[4]\",\"$record[5]\",\"$record[6]\",\"$record[7]\",\"$record[8]\",\"$date\",\"$expires\",\"$record[12]\",\"$record[13]\",\"$record[14]\",\"$record[15]\",\"$record[16]\",\"$record[17]\",\"$record[18]\"\r\n";
				}
			}
		}
		exit;
	} elseif ($action == "adminrefs" | $action == "adminrefsmine") {
		# Show referrer report.
		$records = @file($sys_template_folder . "ipn.txt");
		$count = 0;
		$count = $_REQUEST["count"];
		if ($records) {
			$rcount = count($records);
		} else {
			$rcount = 0;
			$records = array();
		}
		if ($count) {
			$showing = "last $count";
		} else {
			$showing = "all $rcount";
		}
		if ($action == "adminrefsmine") {
			$showing = "only sales paid to you";
		}
		echo "$adminheader
		<a href='index.php?action=adminmenu'>Back to Menu</a>
		<p>$rcount total records.  Showing $showing. Your sales are <span style='background-color: #ffffcc;'>highlighted</span>.
		<table cellspacing=0 cellpadding=0>
			<tr>
				<td><b>Referrer</b></td>
				<td><b>Domain</b></td>
				<td><b>Keywords</b></td>
				<td align=right><b>Sales</b></td>
			</tr>";
		$bgcolor = "#ffffff";
		$c = $rcount;
		$refs = array();
		foreach ($records as $rec) {
			$c--;
			if (!$count | $c <= $count) {
				$rec = str_replace("\n", "", $rec);
				if (trim($rec)) {
					$record = explode("|", $rec);
					$date = "";
					if ($record[11]) {
						$date = date("Y-m-d H:i:s", $record[11]);
					}
					$expires = date("Y-m-d H:i:s", $record[9]);
					if ($record[3] == $sys_default_email) {
						# Our sale.  Yay! :)
						$bgcolor = "#ffffcc";
					}
					$show = true;
					if ($action == "adminrefsmine") {
						if ($record[3] != $sys_default_email) {
							$show = false;
						}
					}
					if ($show) {
						if (strlen($record[12]) > 100) {
							$ref = substr($record[12], 0, 98) . "..";
						} else {
							$ref = $record[12];
						}
						if (isset($refs[$record[12]])) {
							$refs[$record[12]]++;
						} else {
							$refs[$record[12]]=1;
						}
					}
				}
			}
		}
		arsort($refs);
		foreach ($refs as $ref => $sales) {
			$parts = parse_url($ref);
			$host = str_replace("www.", "", $parts["host"]);
			$keywords = searchKeywords($ref);
			if (strlen($ref) > 100) {
				$sref = substr($ref, 0, 97) . "...";
			} else {
				$sref = $ref;
			}
			echo "<tr>
			  <td bgcolor=$bgcolor><a href='$ref' target=_blank>$sref</a></td>
			  <td bgcolor=$bgcolor><a href='http://$host' target=_blank>$host</a></td>
			  <td bgcolor=$bgcolor>$keywords</td>
			  <td bgcolor=$bgcolor align=right>$sales</td>
			</tr>";
			if ($bgcolor=="#ffffff") {
				$bgcolor = "#eeeeee";
			} else {
				$bgcolor = "#ffffff";
			}
		}
		echo "</table>$adminfooter";
		exit;
	} elseif ($action == "adminrefdomains" | $action == "adminrefdomainsmine") {
		# Show referrer report.
		$records = @file($sys_template_folder . "ipn.txt");
		$count = 0;
		$count = $_REQUEST["count"];
		if ($records) {
			$rcount = count($records);
		} else {
			$rcount = 0;
			$records = array();
		}
		if ($count) {
			$showing = "last $count";
		} else {
			$showing = "all $rcount";
		}
		if ($action == "adminrefdomainsmine") {
			$showing = "only sales paid to you";
		}
		echo "$adminheader
			<a href='index.php?action=adminmenu'>Back to Menu</a>
			<p>$rcount total records.  Showing $showing. Your sales are <span style='background-color: #ffffcc;'>highlighted</span>.
			<table cellspacing=0 cellpadding=0>
				<tr>
					<td><b>Domain</b></td>
					<td align=right><b>Sales</b></td>
				</tr>
			";
		$bgcolor = "#ffffff";
		$c = $rcount;
		$refs = array();
		foreach ($records as $rec) {
			$c--;
			if (!$count | $c<=$count) {
				$rec = str_replace("\n", "", $rec);
				if (trim($rec)) {
					$record = explode("|", $rec);
					$date = "";
					if ($record[11]) {
						$date = date("Y-m-d H:i:s", $record[11]);
					}
					$expires = date("Y-m-d H:i:s", $record[9]);
					if ($record[3] == $sys_default_email) {
						# Our sale.  Yay! :)
						$bgcolor = "#ffffcc";
					}
					$show = true;
					if ($action == "adminrefdomainsmine") {
						if($record[3] != $sys_default_email) {
							$show = false;
						}
					}
					if ($show) {
						$parts = parse_url($record[12]);
						$host = str_replace("www.", "", $parts["host"]);
						if (isset($refs[$host])) {
							$refs[$host]++;
						} else {
							$refs[$host]=1;
						}
					}
				}
			}
		}
		arsort($refs);
		foreach ($refs as $ref => $sales){
			echo "
			<tr>
				<td bgcolor=$bgcolor><a href='http://$ref' target=_blank>$ref</a></td>
				<td bgcolor=$bgcolor align=right>$sales</td>
			</tr>
			";
			if ($bgcolor=="#ffffff") {
				$bgcolor = "#eeeeee";
			} else {
				$bgcolor = "#ffffff";
			}
		}
		echo "</table>$adminfooter";
		exit;
	} elseif ($action == "adminaffiliates") {
		# Show referrer report.
		$records = @file($sys_template_folder . "ipn.txt");
		$count = 0;
		$count = $_REQUEST["count"];
		if ($records) {
			$rcount = count($records);
		} else {
			$rcount = 0;
			$records = array();
		}
		if ($count) {
			$showing = "last $count";
		} else {
			$showing = "all $rcount";
		}
		echo "$adminheader
			<a href='index.php?action=adminmenu'>Back to Menu</a>
			<p>$rcount total records.  Showing $showing. Your sales are <span style='background-color: #ffffcc;'>highlighted</span>.
			<table cellspacing=0 cellpadding=0>
				<tr>
					<td><b>Affiliate</b></td>
					<td align=right><b>Sales</b></td>
				</tr>
			";
		$bgcolor = "#ffffff";
		$c = $rcount;
		$refs = array();
		foreach ($records as $rec) {
			$c--;
			if (!$count | $c<=$count) {
				$rec = str_replace("\n", "", $rec);
				if (trim($rec)) {
					$record = explode("|", $rec);
					$date = "";
					if ($record[11]) {
						$date = date("Y-m-d H:i:s", $record[11]);
					}
					$expires = date("Y-m-d H:i:s", $record[9]);
					if ($record[3] == $sys_default_email) {
						# Our sale.  Yay! :)
						$bgcolor = "#ffffcc";
					}
					if (isset($refs[$record[3]])) {
						$refs[$record[3]]++;
					} else {
						$refs[$record[3]]=1;
					}
				}
			}
		}
		arsort($refs);
		foreach ($refs as $ref => $sales) {
			echo "
				<tr>
					<td bgcolor=$bgcolor><a href='mailto:$ref'>$ref</a></td>
					<td bgcolor=$bgcolor>$sales</td>
				</tr>
			";
			if ($bgcolor=="#ffffff") {
				$bgcolor = "#eeeeee";
			} else {
				$bgcolor = "#ffffff";
			}
		}
		echo "</table>$adminfooter";
		exit;
	} elseif ($action == "adminextend") {
		# Extend duration of purchase download link.
		$id = $_REQUEST["id"];
		$records = @file($sys_template_folder . "ipn.txt");
		$recs = array();
		if ($records) {
			foreach ($records as $rec) {
				$rec = str_replace("\n", "", $rec);
				if (trim($rec)) {
					$record = explode("|", $rec);
					if ($record[0] == $id) {
						# Extend this record.
						$changes = true;
						$record[9] = time() + (3600 * $sys_expire_hours);
						$rec = "";
						for ($i=0;$i<count($record);$i++) {
							if ($i < c