Enhanced PHP File Manager

⬆️ Go Up (..)

📊 Server Information

Server:

LiteSpeed

System:

Linux 5.14.0-503.34.1.el9_5.x86_64

PHP Version:

8.2.30

User:

u329947844

Directory:

/home/u329947844/domains/narumalaracademy.net/public_html

Free Space:

10.2 TB

🔧 Quick Actions

✏️ Editing: phonepe_pay.php

<?php
declare(strict_types=1);
if (session_status() === PHP_SESSION_NONE) { session_start(); }
require_once 'includes/config.php'; // db(), esc()
$conn = db();

/* ----------------------------- Small logger ----------------------------- */
function pplog(string $msg): void {
  $dir = __DIR__ . '/logs';
  if (!is_dir($dir)) @mkdir($dir, 0755, true);
  @file_put_contents($dir.'/phonepe.log', '['.date('Y-m-d H:i:s')."] ".$msg."\n", FILE_APPEND);
}

/* ----------------------- PhonePe PRODUCTION config ---------------------- */
const PP_TOKEN_URL   = 'https://api.phonepe.com/apis/identity-manager/v1/oauth/token';
const PP_PAY_URL     = 'https://api.phonepe.com/apis/pg/checkout/v2/pay';
const PP_STATUS_URL  = 'https://api.phonepe.com/apis/pg/checkout/v2/order/%s/status'; // %s = merchantOrderId

// === Your PRODUCTION credentials (as you provided) ===
const PP_CLIENT_ID      = 'SU2509121831234567979807';
const PP_CLIENT_VERSION = '1';
const PP_CLIENT_SECRET  = '774d3d99-08cb-4868-97df-0648060c4c36';

/* ----------------------------- HTTP helpers ----------------------------- */
function http_post_urlencoded(string $url, array $data): array {
  $ch = curl_init($url);
  curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/x-www-form-urlencoded'],
    CURLOPT_POSTFIELDS     => http_build_query($data),
    CURLOPT_TIMEOUT        => 45,
  ]);
  $res  = curl_exec($ch);
  $err  = curl_error($ch);
  $code = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
  curl_close($ch);
  return [$code, $res, $err];
}
function http_post_json(string $url, array $payload, array $headers): array {
  $ch = curl_init($url);
  curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => array_merge(['Content-Type: application/json'], $headers),
    CURLOPT_POSTFIELDS     => json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE),
    CURLOPT_TIMEOUT        => 45,
  ]);
  $res  = curl_exec($ch);
  $err  = curl_error($ch);
  $code = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
  curl_close($ch);
  return [$code, $res, $err];
}
function http_get_json(string $url, array $headers): array {
  $ch = curl_init($url);
  curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => array_merge(['Content-Type: application/json'], $headers),
    CURLOPT_TIMEOUT        => 45,
  ]);
  $res  = curl_exec($ch);
  $err  = curl_error($ch);
  $code = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
  curl_close($ch);
  return [$code, $res, $err];
}

/* ----------------------------- Helpers ----------------------------- */
function to_paisa_floor(float $inr, int $floorPaisa = 1000): int {
  $p = (int)round($inr * 100);
  return max($p, $floorPaisa); // enforce ₹10 default minimum in prod
}
function pp_make_order_id(string $orderCode): string {
  // Remove all non-alphanumeric characters except underscores
  $normalized = preg_replace('/[^A-Za-z0-9_]/', '_', $orderCode);
  
  // Ensure it's not empty and has a reasonable length
  if (empty($normalized)) {
    $normalized = 'order_' . time();
  }
  
  // PhonePe might have a maximum length requirement
  return substr($normalized, 0, 40);
}
function get_base_url(): string {
  $scheme = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http';
  $host = $_SERVER['HTTP_HOST'] ?? 'localhost';
  return $scheme . '://' . $host;
}

/* -------------------------- Inline API: verify -------------------------- */
/*  GET phonepe_pay.php?action=verify&order=ORD-...  
    -> calls PhonePe status with fresh token, finalizes order on COMPLETED, returns JSON with order+items
*/
if (($_GET['action'] ?? '') === 'verify') {
  header('Content-Type: application/json; charset=utf-8');

if (empty($_SESSION['user_id'])) { echo json_encode(['ok'=>false,'error'=>'AUTH']); exit; }
  $uid = (int)$_SESSION['user_id'];
  $orderCode = preg_replace('/[^A-Za-z0-9\-\_]/', '', (string)($_GET['order'] ?? ''));
  if ($orderCode === '') { echo json_encode(['ok'=>false,'error'=>'BAD_ORDER']); exit; }

// Load order & ownership check
  $stmt = $conn->prepare("SELECT id, user_id, total, status, payment_method FROM orders WHERE order_code = ? LIMIT 1");
  $stmt->bind_param('s', $orderCode);
  $stmt->execute();
  $order = $stmt->get_result()->fetch_assoc();
  $stmt->close();
  if (!$order || (int)$order['user_id'] !== $uid) { echo json_encode(['ok'=>false,'error'=>'NOT_FOUND']); exit; }

// If already confirmed, just return data
  if ($order['status'] === 'completed') {
    // Return order+items+user
    $stmt = $conn->prepare("
      SELECT o.*, u.full_name, u.email, u.phone 
      FROM orders o JOIN users u ON o.user_id = u.id 
      WHERE o.order_code = ? LIMIT 1
    ");
    $stmt->bind_param('s', $orderCode);
    $stmt->execute();
    $od = $stmt->get_result()->fetch_assoc();
    $stmt->close();

$stmt = $conn->prepare("
      SELECT oi.*, b.slug, b.thumbnail_path 
      FROM order_items oi LEFT JOIN books b ON oi.book_id = b.id
      WHERE oi.order_id = ?
    ");
    $stmt->bind_param('i', $od['id']);
    $stmt->execute();
    $items = $stmt->get_result()->fetch_all(MYSQLI_ASSOC);
    $stmt->close();

echo json_encode(['ok'=>true,'state'=>'COMPLETED','order'=>$od,'items'=>$items]);
    exit;
  }

// 1) fresh token
  [$tc, $tr, $te] = http_post_urlencoded(PP_TOKEN_URL, [
    'client_id'      => PP_CLIENT_ID,
    'client_version' => PP_CLIENT_VERSION,
    'client_secret'  => PP_CLIENT_SECRET,
    'grant_type'     => 'client_credentials',
  ]);
  if ($tc < 200 || $tc >= 300) {
    pplog("VERIFY token http=$tc err=".($te ?: $tr));
    echo json_encode(['ok'=>false,'error'=>'TOKEN','raw'=>$tr]); exit;
  }
  $tokJson = json_decode((string)$tr, true);
  $accessToken = (string)($tokJson['access_token'] ?? '');
  if (!$accessToken) { echo json_encode(['ok'=>false,'error'=>'NO_TOKEN']); exit; }

// 2) status call with normalized merchantOrderId
  $ppMerchantOrderId = pp_make_order_id($orderCode);
  $statusUrl = sprintf(PP_STATUS_URL, rawurlencode($ppMerchantOrderId)) . '?details=false';

[$sc, $sr, $se] = http_get_json($statusUrl, ['Authorization: O-Bearer '.$accessToken]);
  if ($sc < 200 || $sc >= 300) {
    pplog("VERIFY status http=$sc body=".substr((string)$sr,0,800));
    echo json_encode(['ok'=>false,'error'=>'STATUS_HTTP','raw'=>$sr]); exit;
  }
  $st = json_decode((string)$sr, true);
  $state = (string)($st['state'] ?? 'PENDING');

// Replace the COMPLETED status update section in phonepe_pay.php
if ($state === 'COMPLETED') {
    // mark order confirmed + save payment method
    if ($stmt = $conn->prepare("UPDATE orders SET status='completed', payment_method='PHONEPE', updated_at=NOW() WHERE id=?")) {
        $stmt->bind_param('i', $order['id']);
        $stmt->execute(); 
        $stmt->close();
        
        // Also update any related order items or process the successful payment
        processSuccessfulPayment($order['id'], $conn);
    }
}

// Return order + items regardless so UI can update
  $stmt = $conn->prepare("
    SELECT o.*, u.full_name, u.email, u.phone 
    FROM orders o JOIN users u ON o.user_id = u.id 
    WHERE o.order_code = ? LIMIT 1
  ");
  $stmt->bind_param('s', $orderCode);
  $stmt->execute();
  $od = $stmt->get_result()->fetch_assoc();
  $stmt->close();

$stmt = $conn->prepare("
    SELECT oi.*, b.slug, b.thumbnail_path 
    FROM order_items oi LEFT JOIN books b ON oi.book_id = b.id
    WHERE oi.order_id = ?
  ");
  $stmt->bind_param('i', $od['id']);
  $stmt->execute();
  $items = $stmt->get_result()->fetch_all(MYSQLI_ASSOC);
  $stmt->close();

echo json_encode(['ok'=>true,'state'=>$state,'order'=>$od,'items'=>$items]);
  exit;
}

/* ------------------------ Normal page (create pay) ----------------------- */
if (empty($_SESSION['user_id'])) {
  http_response_code(401); echo "You must be logged in."; exit;
}
$uid = (int)$_SESSION['user_id'];
$orderCode = preg_replace('/[^A-Za-z0-9\-\_]/', '', (string)($_GET['order'] ?? ''));
if ($orderCode === '') { http_response_code(400); echo "Invalid or missing order code."; exit; }

// Load order
$stmt = $conn->prepare("SELECT id, user_id, total, status, gateway_order_id, gateway_state FROM orders WHERE order_code = ? LIMIT 1");
$stmt->bind_param('s', $orderCode);
$stmt->execute();
$order = $stmt->get_result()->fetch_assoc();
$stmt->close();

if (!$order) { http_response_code(404); echo "Order not found."; exit; }
if ((int)$order['user_id'] !== $uid) { http_response_code(403); echo "This order does not belong to you."; exit; }
if ($order['status'] === 'completed') {
  // Already paid → we'll show thank-you right on this page (no redirect)
  $alreadyPaid = true;
} else {
  $alreadyPaid = false;
}

$displayAmount = (float)$order['total'];
$minFloorPaisa = 1000; // ₹10 in production
$createError = '';
$tokenError  = '';
$redirectUrl = '';

// Check if this is a redirect back from PhonePe (mobile flow)
$returnedFromPayment = isset($_GET['returned']) && $_GET['returned'] === '1';

if (!$alreadyPaid) {
  // Enforce ₹10 minimum to avoid 417s
  if ($displayAmount < 10.0) {
    $createError = 'Amount below minimum (₹10) for production.';
  } else {
    // 1) token
    [$tc, $tr, $te] = http_post_urlencoded(PP_TOKEN_URL, [
      'client_id'      => PP_CLIENT_ID,
      'client_version' => PP_CLIENT_VERSION,
      'client_secret'  => PP_CLIENT_SECRET,
      'grant_type'     => 'client_credentials',
    ]);
    if ($tc >= 200 && $tc < 300) {
      $tokJson = json_decode((string)$tr, true);
      $accessToken = (string)($tokJson['access_token'] ?? '');
      if (!$accessToken) { $tokenError = 'Token missing access_token'; }
    } else {
      $tokenError = "Token HTTP $tc: " . ($te ?: $tr);
    }

// 2) create payment
    if (!$tokenError) {
      $ppMerchantOrderId = pp_make_order_id($orderCode);
      pplog("Creating payment for order: " . $orderCode . " → normalized: " . $ppMerchantOrderId);
      $redirectBack = get_base_url() . '/phonepe_pay.php?order=' . rawurlencode($orderCode) . '&returned=1';

$payload = [
        'merchantOrderId' => $ppMerchantOrderId,
        'amount'          => to_paisa_floor($displayAmount, $minFloorPaisa),
        'paymentFlow'     => [
          'type' => 'PG_CHECKOUT',
          'merchantUrls' => ['redirectUrl' => $redirectBack],
        ],
        'metaInfo' => [
          'udf1' => $orderCode, // keep original for mapping
          'udf2' => 'Narumalar-ebooks',
        ]
      ];

[$pc, $pr, $pe] = http_post_json(PP_PAY_URL, $payload, [
        'Authorization: O-Bearer ' . $accessToken
      ]);

if ($pc >= 200 && $pc < 300) {
        $jr = json_decode((string)$pr, true);
        $redirectUrl = (string)($jr['redirectUrl'] ?? '');
        $ppOrderId   = (string)($jr['orderId'] ?? '');
        $state       = (string)($jr['state'] ?? '');

// Save gateway info if columns exist
        if ($stmt = $conn->prepare("UPDATE orders SET gateway_order_id=?, gateway_state=? WHERE id=?")) {
          $stmt->bind_param('ssi', $ppOrderId, $state, $order['id']);
          $stmt->execute(); $stmt->close();
        }

if (!$redirectUrl) $createError = 'PhonePe did not return redirectUrl.';
      } else {
        $createError = "Create payment HTTP $pc: " . ($pe ?: $pr);
        pplog("Payment creation failed: " . $createError);
      }
    }
  }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>PhonePe Payment – Narumalar Academy</title>
  <meta name="viewport" content="width=device-width, initial-scale=1">
  
  <script src="https://mercury.phonepe.com/web/bundle/checkout.js"></script>
  <style>
    body { font-family: system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial, "Apple Color Emoji","Segoe UI Emoji"; background:#f8fafc; margin:0; }
    .wrap { max-width: 820px; margin: 32px auto; background:#fff; border:1px solid #e5e7eb; border-radius:12px; padding:24px; }
    .title { font-weight: 800; font-size: 20px; margin:0 0 8px; }
    .muted { color:#6b7280; font-size:14px; margin:0 0 16px; }
    .banner { border:1px solid #cbd5e1; background:#f1f5f9; color:#0f172a; padding:12px 14px; border-radius:8px; margin:16px 0; font-size:14px; }
    .banner.err { background:#fef2f2; border-color:#fecaca; color:#991b1b; }
    .btn { display:inline-block; padding:12px 16px; background:#ea580c; color:#fff; font-weight:600; border-radius:10px; text-decoration:none; border:none; cursor:pointer; }
    .btn.secondary { background:#334155; }
    .thank { text-align:center; padding:16px; }
    .ok { font-size:52px; line-height:1; margin-bottom:6px; }
    .row { display:flex; gap:16px; flex-wrap:wrap; }
    .col { flex:1 1 320px; }
    .card { border:1px solid #e5e7eb; border-radius:10px; padding:14px; }
    .itm { display:flex; align-items:center; justify-content:space-between; gap:12px; border:1px solid #e5e7eb; border-radius:10px; padding:10px; margin:8px 0; }
    .itm img { width:56px; height:56px; object-fit:cover; border-radius:8px; }
  </style>
</head>
<body>
  <div class="wrap" id="payView" style="<?= $alreadyPaid || $returnedFromPayment ? 'display:none' : '' ?>">
    <h1 class="title">PhonePe Payment</h1>
    <p class="muted">Order <strong><?= esc($orderCode) ?></strong> • Amount <strong>₹<?= number_format($displayAmount, 0) ?></strong></p>

<?php if ($alreadyPaid): ?>
      <div class="banner">This order is already paid.</div>
    <?php elseif ($tokenError): ?>
      <div class="banner err">Token error: <?= esc($tokenError) ?></div>
    <?php elseif ($createError): ?>
      <div class="banner err">Create payment error: <?= esc($createError) ?></div>
      <a class="btn secondary" href="checkout.php">Back to Checkout</a>
    <?php else: ?>
      <div id="status" class="banner">Opening PhonePe PayPage…</div>
      <div id="frameWrap" style="display:none;"></div>
      <div style="margin-top:12px;">
        <button id="retry" class="btn" style="display:none;">Retry</button>
        <a class="btn secondary" href="checkout.php">Back to Checkout</a>
      </div>
    <?php endif; ?>
  </div>

<div class="wrap" id="thankView" style="<?= $alreadyPaid || $returnedFromPayment ? '' : 'display:none' ?>">
    <div class="thank">
      <div class="ok">✅</div>
      <h2 style="margin:0 0 6px; font-size:26px; font-weight:800;">Order Confirmed!</h2>
      <p style="color:#475569">Thank you for your purchase. Your order has been confirmed.</p>
      <p class="muted" id="tyOrderId"></p>
    </div>

<div style="text-align:center; margin-top:16px;">
      <a href="index.php" class="btn">Continue Shopping</a>
      <a href="profile.php" class="btn secondary">View My Orders</a>
    </div>
  </div>

<?php if ((!$alreadyPaid && !$tokenError && !$createError) || $returnedFromPayment): ?>
<script>
(function(){
  const orderCode = <?= json_encode($orderCode) ?>;
  const tokenUrl  = <?= json_encode($redirectUrl) ?>;
  const statusBox = document.getElementById('status');
  const retryBtn  = document.getElementById('retry');
  const params    = new URLSearchParams(location.search);
  const returned  = params.get('returned') === '1';

const payView   = document.getElementById('payView');
  const thankView = document.getElementById('thankView');

function setStatus(msg, type){
    if (!statusBox) return;
    statusBox.textContent = msg;
    statusBox.className = 'banner' + (type==='err' ? ' err' : '');
  }
  function formatINR(n){ return '₹' + (Math.round((n||0))).toLocaleString('en-IN'); }

async function verifyAndMaybeShowThanks() {
    const res = await fetch('phonepe_pay.php?action=verify&order='+encodeURIComponent(orderCode), {cache:'no-store'});
    if (!res.ok) throw new Error('HTTP '+res.status);
    const data = await res.json();
    if (!data.ok) throw new Error(data.error || 'VERIFY_FAILED');

if (data.state === 'COMPLETED') {
      // Fill Thank-You UI
      const o = data.order || {};
      const items = data.items || [];

document.getElementById('tyOrderId').textContent = 'Order ID: ' + (o.order_code || orderCode);

const od = document.getElementById('tyOrderDetails');
      od.innerHTML = `
        <div><strong>Order Date:</strong> ${o.created_at ? new Date(o.created_at.replace(' ','T')).toLocaleDateString() : ''}</div>
        <div><strong>Payment Method:</strong> ${o.payment_method || 'PHONEPE'}</div>
        <div><strong>Status:</strong> Confirmed</div>
      `;

const ci = document.getElementById('tyCustomer');
      ci.innerHTML = `
        <div><strong>Name:</strong> ${o.full_name || ''}</div>
        <div><strong>Email:</strong> ${o.email || 'N/A'}</div>
        <div><strong>Phone:</strong> ${o.phone || ''}</div>
      `;

document.getElementById('tySub').textContent   = formatINR(o.subtotal || 0);
      document.getElementById('tyDisc').textContent  = (o.discount && o.discount>0) ? ('- ' + formatINR(o.discount)) : '—';
      document.getElementById('tyTotal').textContent = formatINR(o.total || 0);

// Switch views
      payView.style.display   = 'none';
      thankView.style.display = '';
      return true;
    }
    return false;
  }

function openPayPage() {
    const isMobile = /Android|iPhone|iPad|iPod/i.test(navigator.userAgent);
    const mode = isMobile ? 'REDIRECT' : 'IFRAME';

if (!window.PhonePeCheckout || !window.PhonePeCheckout.transact) {
      // Fallback: direct redirect
      location.href = tokenUrl;
      return;
    }

retryBtn?.addEventListener('click', openPayPage);

if (returned) {
    // Came back from PhonePe on mobile; do not reopen — just verify and show thanks.
    setStatus('Finalizing your payment…');
    verifyAndMaybeShowThanks().then(ok=>{
      if (!ok) {
        // poll a few times for pending
        const tries = 8, delay = 2000;
        let i=0;
        const t = setInterval(async ()=>{
          i++;
          try {
            const done = await verifyAndMaybeShowThanks();
            if (done) { 
              clearInterval(t); 
              // Update URL to remove the returned parameter for cleaner sharing
              const cleanUrl = window.location.href.split('?')[0] + '?order=' + encodeURIComponent(orderCode);
              window.history.replaceState({}, document.title, cleanUrl);
            }
            else if (i>=tries) { 
              clearInterval(t); 
              setStatus('Payment is still pending. You can retry below.', 'err'); 
              retryBtn.style.display='inline-block'; 
            }
          } catch(e){ 
            clearInterval(t); 
            setStatus('Could not verify payment status. You can retry.', 'err'); 
            retryBtn.style.display='inline-block'; 
          }
        }, delay);
      } else {
        // Update URL to remove the returned parameter for cleaner sharing
        const cleanUrl = window.location.href.split('?')[0] + '?order=' + encodeURIComponent(orderCode);
        window.history.replaceState({}, document.title, cleanUrl);
      }
    }).catch(()=>{
      setStatus('Could not verify payment status. You can retry.', 'err');
      retryBtn.style.display='inline-block';
    });
  } else {
    // First visit → open checkout now
    setStatus('Opening PhonePe PayPage…');
    openPayPage();

// If tab regains focus (some mobile flows), try verifying again
    document.addEventListener('visibilitychange', function(){
      if (!document.hidden) verifyAndMaybeShowThanks().catch(()=>{});
    });
  }
})();
</script>
<?php endif; ?>
</body>
</html>

❌ Cancel

🗂️ Enhanced PHP File Manager

📊 Server Information

🔧 Quick Actions

✏️ Editing: phonepe_pay.php

📤 Upload File

📁 Create Folder

📄 Create File

✏️ Rename Item

🗑️ Delete Confirmation