Fallagassrini Bypass Shell

<?php
include("configuration.php");
include("includes/fonctions.php"); // ou le fichier où est verifierOuRecupererPhoto()

header('Content-Type: application/json; charset=utf-8');

global $db;

$table = $_GET['table'] ?? 'vis';
$token = $_GET['token'] ?? '';

$allowedTables = ['vis', 'heb', 'vis_proprio'];
if (!in_array($table, $allowedTables, true) || $token === '') {
  http_response_code(400);
  echo json_encode(['ok' => false, 'error' => 'bad_params']);
  exit;
}

$token_sql = $db->escape($token);

// IMPORTANT : adapte si tes champs n’existent pas dans toutes les tables
// Ici on part du principe que vis a: photo_locale, telechargementphoto_echecs
// et qu'on ajoute telechargementphoto_last_try (recommandé).
$row = $db->get_row("
  SELECT id, photo_locale, telechargementphoto_echecs, telechargementphoto_last_try
  FROM `$table`
  WHERE token = '$token_sql'
  LIMIT 1
");

if (!$row) {
  http_response_code(404);
  echo json_encode(['ok' => false, 'error' => 'not_found']);
  exit;
}

// 1) si déjà une photo, renvoyer direct
if (!empty($row->photo_locale)) {
  echo json_encode(['ok' => true, 'url' => $row->photo_locale, 'cached' => true]);
  exit;
}

// 2) throttling anti-bourrinage
$maxFails = 3;
$cooldownSeconds = 6 * 3600; // 6h (ajuste)
$fails = (int)($row->telechargementphoto_echecs ?? 0);

$lastTryTs = null;
if (!empty($row->telechargementphoto_last_try)) {
  $lastTryTs = strtotime($row->telechargementphoto_last_try);
}

if ($fails >= $maxFails) {
  echo json_encode(['ok' => false, 'skipped' => 'too_many_fails']);
  exit;
}

if ($lastTryTs && (time() - $lastTryTs) < $cooldownSeconds) {
  echo json_encode(['ok' => false, 'skipped' => 'cooldown']);
  exit;
}

// marquer une tentative
$db->query("UPDATE `$table` SET telechargementphoto_last_try = NOW() WHERE id = " . (int)$row->id);

// 3) tentative réelle (UNIQUEMENT car photo_locale vide)
$res = verifierOuRecupererPhoto($token, $table);

// relire photo_locale (car la fonction peut l’avoir mise à jour)
$row2 = $db->get_row("SELECT photo_locale FROM `$table` WHERE id = " . (int)$row->id);

if (!empty($row2->photo_locale)) {
  echo json_encode(['ok' => true, 'url' => $row2->photo_locale, 'cached' => false, 'statut' => $res['statut'] ?? null]);
  exit;
}

// si pas trouvé, incrémenter échecs
$db->query("UPDATE `$table` SET telechargementphoto_echecs = telechargementphoto_echecs + 1 WHERE id = " . (int)$row->id);

echo json_encode(['ok' => false, 'statut' => $res['statut'] ?? 'echec']);