Fallagassrini Bypass Shell

<?php
header('Content-Type: application/json; charset=utf-8');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
  echo json_encode(['ok' => false, 'error' => 'Méthode invalide']);
  exit;
}



// ⚠️ ne pas commit ce fichier
define('SMTP_USER', 'contact@myreco.online');
define('SMTP_PASS', '4eDc8Sw76EjuD175'); // <-- mets ton mot de passe ici
define('ADMIN_EMAIL', 'philippe-jean@outlook.fr'); // destinataire (toi)



use PHPMailer\PHPMailer\Exception;
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;

require '../PHPMailer-6.9.1/src/Exception.php';
require '../PHPMailer-6.9.1/src/PHPMailer.php';
require '../PHPMailer-6.9.1/src/SMTP.php';




// Inputs
$token   = trim($_POST['token'] ?? '');
$prenom  = trim($_POST['prenom'] ?? '');
$nom     = trim($_POST['nom'] ?? '');
$email   = trim($_POST['email'] ?? '');
$message = trim($_POST['message'] ?? '');

// Validation
if ($prenom === '' || $nom === '' || $email === '' || $message === '') {
  echo json_encode(['ok' => false, 'error' => 'Champs manquants']);
  exit;
}
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
  echo json_encode(['ok' => false, 'error' => 'Email invalide']);
  exit;
}
if (mb_strlen($message) < 5) {
  echo json_encode(['ok' => false, 'error' => 'Message trop court']);
  exit;
}
if (mb_strlen($message) > 5000) {
  echo json_encode(['ok' => false, 'error' => 'Message trop long']);
  exit;
}

$fullName = trim($prenom . ' ' . $nom);

// Contexte
$subject = "📩 Contact MyReco — Token: " . ($token ?: 'n/a');

$htmlBody =
  "<h3>Nouveau message depuis find.myreco.online</h3>" .
  "<p><strong>Nom :</strong> " . htmlspecialchars($fullName, ENT_QUOTES, 'UTF-8') . "</p>" .
  "<p><strong>Email :</strong> " . htmlspecialchars($email, ENT_QUOTES, 'UTF-8') . "</p>" .
  ($token ? "<p><strong>Token hébergement :</strong> " . htmlspecialchars($token, ENT_QUOTES, 'UTF-8') . "</p>" : "") .
  "<hr>" .
  "<p style='white-space:pre-wrap'>" . htmlspecialchars($message, ENT_QUOTES, 'UTF-8') . "</p>";

$textBody =
  "Nouveau message depuis find.myreco.online\n\n" .
  "Nom: $fullName\n" .
  "Email: $email\n" .
  ($token ? "Token: $token\n" : "") .
  "-------------------------\n" .
  $message . "\n";

try {
  $mail = new PHPMailer(true);
  $mail->CharSet = 'UTF-8';

  // SMTP OVH MX Plan (EU): smtp.mail.ovh.net ou ssl0.ovh.net, port 465 SSL/TLS :contentReference[oaicite:0]{index=0}
  $mail->isSMTP();
  $mail->Host       = 'smtp.mail.ovh.net';
  $mail->SMTPAuth   = true;
  $mail->Username   = SMTP_USER;        // adresse complète :contentReference[oaicite:1]{index=1}
  $mail->Password   = SMTP_PASS;
  $mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS;
  $mail->Port       = 465;

  // From = contact@myreco.online (toi)
  $mail->setFrom(SMTP_USER, 'MyReco');
  // To = admin (toi)
  $mail->addAddress(ADMIN_EMAIL, 'Admin MyReco');

  // Reply-To = l'utilisateur (pour répondre facilement)
  $mail->addReplyTo($email, $fullName);

  $mail->Subject = $subject;
  $mail->Body    = $htmlBody;
  $mail->AltBody = $textBody;
  $mail->isHTML(true);

  $mail->send();

  echo json_encode(['ok' => true]);
  exit;

} catch (Exception $e) {
  // Ne pas exposer l’erreur SMTP exacte en prod
  echo json_encode(['ok' => false, 'error' => "Impossible d'envoyer le message."]);
  exit;
}