<?php include('_mod_security.php'); ?>
<?php
	if (isset($_SESSION['user_id'])) :
		//if (isset($_REQUEST['id'])) :
			//$action = "Edit";
		//else :
			$action = "Add New";
		//endif;
	else :
		exit();
	endif;
	//var_dump($_POST);
	//var_dump($_GET);
	$signed_up = 0;
	if ($_POST['ajax_event_submitted'] == '1') :
		/* ------------------ Apply valid promotion code ---------------*/
		$net_price = floatval($app_authorize_net_amt_additional_event);
		$promo_code = '';
		if (!empty($_POST['promo_code'])) :
			$code = mysqli_real_escape_string($GLOBALS['con'], $_POST['promo_code']);
			$sku = mysqli_real_escape_string($GLOBALS['con'], $_GET['IX']);
			$sql_promo = "SELECT * FROM promo_codes WHERE code = '".$code."' AND expires >= CURDATE() AND sku = '".$sku."' ";
			$result_promo = mysqli_query($GLOBALS['con'], $sql_promo);
			//echo '==='.$sql.'===';
			//var_dump($_SERVER);
			if (mysqli_num_rows($result_promo) > 0) :
				$promo_code = $code;
				$row_promo = mysqli_fetch_object($result_promo);
				if ($row_promo->limited_use == 0 || ($row_promo->limited_use == 1 && $row_promo->uses_left > 0)) :
					switch ($row_promo->type) :
						case 'pct_off' :
							$net_price = round($row_promo->reg_price * (1 - ($row_promo->value / 100)),2);
							break;
						case 'amt_off' :
							$net_price = round($row_promo->reg_price - $row_promo->value,2);
							break;
						case 'amt_sale' :
							$net_price = round($row_promo->value,2);
							break;
					endswitch;
				endif;
			endif;
		endif;
		$net_amt = strval($net_price);
		/* -----------------------------------------------------------*/
		$ar_err = array();
		if (empty($_POST['pwd'])) :
			$ar_err['pwd'] = 'Password required!';
			$err_flag = true;
		else :
			$sql_pwd = "SELECT * FROM users WHERE id = ".$_SESSION['user_id'];
			$result_pwd = mysqli_query($GLOBALS['con'], $sql_pwd) or die('Database Error!');
			if (mysqli_num_rows($result_pwd) > 0) :
				$row_pwd = mysqli_fetch_object($result_pwd);
				//if ($row_pwd->password != mysqli_real_escape_string($GLOBALS['con'], trim($_POST['pwd']))) :
				if ($row_pwd->password2 != mysqli_real_escape_string($GLOBALS['con'], trim($_POST['pwd']))) :
					$ar_err['pwd'] = 'Password invalid!';
					$err_flag = true;
				endif;
			else :
				$ar_err['pwd'] = 'Password not found!';
				$err_flag = true;
			endif;
		endif;
		$ar_search = array(' ', '-', '.');
		$_POST['cc_number'] = str_replace($ar_search, '', $_POST['cc_number']);
		if (empty($_POST['cc_number']) && $net_price > 0.00) :
			$ar_err['cc_number'] = 'Credit card required!';
			$err_flag = true;
		endif;
		if ((empty($_POST['cc_exp_month']) || empty($_POST['cc_exp_year'])) && $net_price > 0.00) :
			$ar_err['cc_exp_date'] = 'Credit card required!';
			$err_flag = true;
		endif;
		if (empty($_POST['cc_name']) && $net_price > 0.00) :
			$ar_err['cc_name'] = 'Credit card holder required!';
			$err_flag = true;
		endif;
		if (empty($_POST['agree_terms']) || $_POST['agree_terms'] != '1') :
			$ar_err['agree_terms'] = 'You must agree to terms of use!';
			$err_flag = true;
		endif;
		if (!$err_flag) :
			if ($net_price > 0.00) :
				/* ----------------- Authorize.net processing ------------------*/
				require_once 'anet_php_sdk/AuthorizeNet.php'; // Make sure this path is correct.
				$transaction = new AuthorizeNetAIM($app_authorize_net_login_id, $app_authorize_net_transaction_key);
				$transaction->VERIFY_PEER = false;
				//$transaction->test_request = $app_authorize_net_test_request;
				//$transaction->amount = $app_authorize_net_amt_additional_event;
				$transaction->amount = $net_amt;
				//$transaction->card_num = '4007000000027';
				$transaction->card_num = $_POST['cc_number'];
				$transaction->exp_date = $_POST['cc_exp_month'].'/'.$_POST['cc_exp_year'];
				$transaction->invoice_num = strval(next_id('payments'));
				$transaction->description = 'Additional Bar/Bat Mitzvah';
				$transaction->cust_id = $_SESSION['user_id'];
				$transaction->first_name = $row_pwd->first_name;
				$transaction->last_name = $row_pwd->last_name;
				$transaction->address = $row_pwd->street.' '.$row_pwd->street2;
				$transaction->city = $row_pwd->city;
				$transaction->state = $row_pwd->state;
				$transaction->zip = $row_pwd->zip;
				$transaction->phone = $row_pwd->phone;
				$transaction->email = $row_pwd->email;
				$transaction->customer_ip = get_client_ip();
				//var_dump($transaction);
				$response = $transaction->authorizeAndCapture();
				//var_dump($response);
				if ($response->approved) :
				else :
					//$ar_err['cc_number'] = 'Credit card transaction failed! <br />'.$response->error_message;
					$ar_err['cc_number'] = 'Credit card transaction failed!';
					write_log('E', $_SESSION['user_id'], 'Credit card transaction failed (upgrade) - '.$row_pwd->first_name.' '.$row_pwd->last_name.' '.substr($_POST['cc_number'], 0, 4).str_repeat('*', strlen($_POST['cc_number']) - 8).substr($_POST['cc_number'], -4).' - '.$response->error_message);
					$err_flag = true;
				endif;
				/* -------------------------------------------------------------*/
			else :
				$response = new stdClass();
				$response->authorization_code = 'N/A';
				$response->transaction_id = 'N/A';
			endif;
		endif;
		if (!$err_flag) :
			if ($action == 'Add New') :
				$sql = "INSERT INTO payments set ".
					"user_id = ".$_SESSION['user_id'].", ".
					"auth_code = '".$response->authorization_code."', ".
					"trans_id = '".$response->transaction_id."', ".
					"pmt_type = 'Additional Bar/Bat Mitzvah', ".
					"pmt_cred_deb = 1, ".
					"pmt_date = ".nzdate(date('m/d/Y')).", ".
					"pmt_cc = '".str_pad(substr(mysqli_real_escape_string($GLOBALS['con'], trim($_POST['cc_number'])), strlen(mysqli_real_escape_string($GLOBALS['con'], trim($_POST['cc_number']))) -4), 12, '*', STR_PAD_LEFT)."', ".
					"pmt_amt = ".$net_amt." ";
				mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
			endif;
			if ($row_promo->limited_use == 1) :
				$sql = "UPDATE promo_codes SET uses_left = uses_left - 1 WHERE id = ".$row_promo->id;
				mysqli_query($GLOBALS['con'], $sql) or die('Database error! Please contact the web site administrator.');
			endif;
			//***************** mail using PEAR *****************
			require_once "Mail.php";
			$mail_body = '<html>'.
						'<style>body {font-family:Arial, Helvetica, sans-serif; font-size:14px;} table {font-size:14px;}</style>'.
						'Dear '.$row_pwd->first_name.' '.$row_pwd->last_name.', <br><br>'. 
						'Thank you for your order with MitzvahOrganizer.com.  Following are the details of your transaction: <br><br>'.
						'<table>'.
						'<tr><td><b>Purchase Type:</b> </td><td>Additional Bar/Bat Mitzvah </td></tr>'.
						'<tr><td><b>Date:</b> </td><td>'.date('m/d/Y').'</td></tr>'.
						'<tr><td><b>Amount:</b> </td><td>'.$net_amt.'</td></tr>'.
						'<tr><td><b>Credit Card:</b> </td><td>'.str_pad(substr(mysqli_real_escape_string($GLOBALS['con'], trim($_POST['cc_number'])), strlen(mysqli_real_escape_string($GLOBALS['con'], trim($_POST['cc_number']))) -4), 12, '*', STR_PAD_LEFT).'</td></tr>'.
						'<tr><td><b>Authorization Code:</b> </td><td>'.$response->authorization_code.'</td></tr>'.
						'<tr><td><b>Transaction ID:</b> </td><td>'.$response->transaction_id.'</td></tr>'.
						'<tr><td><b>Promotion Code:</b> </td><td>'.$promo_code.'</td></tr>'.
						'<tr><td><b>Payment submitted from IP address:</b> </td><td>'.get_client_ip().'</td></tr>'.
						'</table><br>'.
						'We strive to ensure that your experience with MitzvahOrganizer.com will be exceptional.  Please don\'t hesitate to contact us if you have questions or encounter any issues. <br><br>'.
						'Thank You, <br>'.
						'The MitzvahOrganizer Team <br>'.
						'<a href="'.$app_base.'">'.$app_base.'</a> <br>'.
						'<a href="mailto:[email protected]">[email protected]</a> <br>'.
						'</html>' ;
			$pmail_from = '[email protected]';
			$pmail_to["To"] = $row_pwd->email;
			$pmail_to["Bcc"] = $app_mail_bcc;
			$pmail_subject = 'MitzvahOrganizer.com Purchase Receipt / Order Confirmation';
			$pmail_body = $mail_body;
			$pmail_host = get_cfg_var('SMTP');
			$pmail_username = "";
			$pmail_password = "";
			$pmail_headers = array ('From' => $pmail_from,
			'To' => $pmail_to["To"],
			'Subject' => $pmail_subject,
			'MIME-Version' => '1.0',
			'Content-type' => 'text/html; charset=iso-8859-1');
			$smtp = Mail::factory('smtp',
			array ('host' => $pmail_host,
			 //'auth' => true,
			 'auth' => false,
			 'username' => $pmail_username,
			 'password' => $pmail_password
			 ));
			$pmail = $smtp->send($pmail_to, $pmail_headers, $pmail_body);
			/*
			if (PEAR::isError($pmail)) :
				echo("<h3>Message delivery failed...</h3>");
				echo $pmail->getMessage();
			else :
				echo '<h3>Thank you! Your message has been sent. We will respond soon.</h3>';
			endif;
			*/
			//**** ************************** *****
			$form_message = "Congratulations! Your payment has been processed.  Click continue to set up a new Bar/Bat Mitzvah.";
			unset($_POST['pwd']);
			$signed_up = 1;
		else :
			$form_message = "Errors found!";
			unset($_POST['pwd']);
		endif;
	else :
		//$_POST['email'] = $_SESSION['email'];
	endif;
	
?>

<script>
	var active_tab = '';
	promo_load = function()
	{
		$.ajax({
			url: "ajax.php?call=promo_load&code=" + $("#promo_code").val() + "&sku=<?php echo $_GET['IX']; ?>&price=<?php echo $app_authorize_net_amt_additional_event; ?>" ,
			//url: "ajax.php?call=promo_load&code=" + "test",
			cache: false,
			dataType: "json",
			success: function(json) {
					$('#net_price').text(json.new_price);
					if (json.new_price > 0)
					{
						$('#row_credit_1').show();
						$('#row_credit_2').show();
						$('#row_credit_3').show();
					}
					else
					{
						$('#row_credit_1').hide();
						$('#row_credit_2').hide();
						$('#row_credit_3').hide();
					}
					if ($("#promo_code").val() > ' ' && json.result == 'error')
					{
						alert('Promotion code is invalid for this purchase!');
					}
			}
			 ,error: function (request, status, error) 
			 	{ 
			 		$('#net_price').text('<?php echo $app_authorize_net_amt_additional_event; ?>'); 
					$("#promo_code").val('');
					alert('Promotion code is invalid for this purchase!');
					/* alert(status + ", " + error); */
				}
		})
	}
	
	
	encode_pwd_md5 = function()
	{
		if (document.getElementById('pwd').value)
		{
			document.getElementById('pwd').value = MD5(document.getElementById('pwd').value);
		}
		return true;
	}
	
	encode_pwd = function()
	{
		if (document.getElementById('pwd').value)
		{
			$.ajax({
				url: "ajax.php?call=login_tokens&email=" + encodeURIComponent(document.getElementById('user_id').value),
				cache: false,
				dataType: "json",
				async: false,
				success: function(json) {
						if (json.salt > ' ')
						{
							document.getElementById('pwd').value = CryptoJS.SHA512(json.salt + document.getElementById('pwd').value);
						}
				}
				 ,error: function (request, status, error) { /* alert(status + ", " + error); */ }
			})
		}
		return true;
	}
	$(document).ready(function()	
	{
		//switch_tab('<?php echo $active_tab; ?>');
		$("#tab_content_general").show();
		promo_load();
	}
	)
</script>

<h1>Additional Bar/Bat Mitzvah Purchase</h1>

<?php 
	if ($signed_up != 1) :
?>
		<form style="" name="frm_upgrade" id="frm_upgrade" method="post" action="" onsubmit="encode_pwd();">
			<input name="ajax_event_submitted" type="hidden" value="1" />
			<input name="active_tab" id="active_tab" type="hidden" value="general" />
			<input name="user_id" id="user_id" type="hidden" maxlength="40" value="<?php echo $_SESSION['username']; ?>"  />
			<div class="cleardiv">
				&nbsp;
			</div>
			<div class="tab_content" id="tab_content_general" style="position:relative;">
				<!-- (c) 2005, 2014. Authorize.Net is a registered trademark of CyberSource Corporation --> <div class="AuthorizeNetSeal"> <script type="text/javascript" language="javascript">var ANS_customer_id="b7ff26a6-e014-4b15-835b-2b6cab8b74d3";</script> <script type="text/javascript" language="javascript" src="//verify.authorize.net/anetseal/seal.js" ></script> <a href="http://www.authorize.net/" id="AuthorizeNetText" target="_blank">Online Payments</a> </div> 
				<div class="form_header">
					Bar/Bat Mitzvah Purchase Information
				</div>
				<table class="input_block">
					<tr>
						<td>
							Enter Password for Security
						</td>
						<td>
							<input name="pwd" id="pwd" type="password" maxlength="50" value="<?php echo $_POST['pwd']; ?>"  />
							<?php show_form_error($ar_err['pwd']); ?>
						</td>
					</tr>
					<tr>
						<td>
							Promotion Code
						</td>
						<td>
							<input name="promo_code" id="promo_code" type="text" maxlength="30" value="<?php echo $_POST['promo_code']; ?>" style="width:195px;" />
							<input type="button" name="btn_promo_code" value="Apply" onclick="promo_load();" />
							<?php show_form_error($ar_err['promo_code']); ?>
						</td>
					</tr>
					<tr>
						<td colspan="2">
							Your credit card will be charged&nbsp;&nbsp;&nbsp; <span style="font-size:16px; font-weight:bold;">$<span id="net_price"><?php echo $app_authorize_net_amt_additional_event; ?></span></span>
						</td>
					</tr>
					<tr id="row_credit_1">
						<td>
							Credit Card Number
						</td>
						<td>
							<input name="cc_number" id="cc_number" type="text" maxlength="30" value="<?php echo $_POST['cc_number']; ?>"  />
							<?php show_form_error($ar_err['cc_number']); ?>
						</td>
					</tr>
					<tr id="row_credit_2">
						<td>
							Expiration Date
						</td>
						<td>
							<select name="cc_exp_month" id="cc_exp_month" style="width:150px;">
								<option value="">Month</option>
								<?php
									for ($mo = 1; $mo <= 12; $mo++) :
										$selected = '';
										if ($_POST['cc_exp_month'] == $mo) :
											$selected = 'selected="selected"';
										endif;
										$time = mktime(0, 0, 0, $mo, 1);
										//$name = strftime("%b", $time);
										echo '<option value="'.str_pad($mo, 2, '0', STR_PAD_LEFT).'" '.$selected.'>'.strftime('%B', $time).'</option>';
									endfor;
								?>
							</select>
							<select name="cc_exp_year" id="cc_exp_year" style="width:150px;">
								<option value="">Year</option>
								<?php
									$curr_year = date('Y');
									for ($yr = $curr_year; $yr <= $curr_year + 10; $yr++) :
										$selected = '';
										if ($_POST['cc_exp_year'] == $yr) :
											$selected = 'selected="selected"';
										endif;
										echo '<option value="'.$yr.'" '.$selected.'>'.$yr.'</option>';
									endfor;
								?>
							</select>
							<?php show_form_error($ar_err['cc_exp_date']); ?>
						</td>
					</tr>
					<tr id="row_credit_3">
						<td>
							Name on Card
						</td>
						<td>
							<input name="cc_name" id="cc_name" type="text" maxlength="30" value="<?php echo $_POST['cc_name']; ?>"  />
							<?php show_form_error($ar_err['cc_name']); ?>
						</td>
					</tr>
					<tr>
						<td>&nbsp;
						</td>
						<td>
							<input name="agree_terms" id="agree_terms" type="checkbox" maxlength="30" value="1" <?php if ($_POST['agree_terms'] == '1') echo 'checked="checked"'; ?> />
							 I have read and agree with MitzvahOrganizer.com <a href="javascript:window_popup('terms_window','terms_of_use');">Terms of Use</a>.
							<?php show_form_error($ar_err['agree_terms']); ?>
						</td>
					</tr>
				</table>
			</div>
			<!-- -------------------------------------------------------------------------------------------------------------- -->
			<div class="form_strip">
				<span class="form_message">
					<?php echo $form_message; ?>
				</span>
				<input type="button" name="xsubmit" value="Submit" onclick="encode_pwd(); this.form.submit();" />
				&nbsp;&nbsp;
				<input type="button" value="Cancel" onclick="window.location.href = 'index.php?IX=events'" />
			</div>
		</form>
<?php
	else :
?>
		<div class="form_strip" style="border:none;">
			<?php echo form_message($form_message); ?>
			<form>
				<input type="button" value="Continue" onclick="window.location.href = 'index.php?IX=event_form'" />
			</form>
		</div>
<?php
	endif;
?>