<?php
// Reject array-valued form fields before the original string normalization.
foreach (['f_matricola','f_nome','f_cognome','f_mail','f_password','f_password1'] as $regField) {
    if (isset($_POST[$regField]) && !is_string($_POST[$regField])) {
        echo '<p>Invalid registration input.</p>';
        return;
    }
}
# The original registration logic follows.
# Optional debugging remains disabled.
#$_POST['f_matricola'] = "1234";
#print("CIAO1<BR>");
#$_POST['f_matricola'] = "1234";
#$_POST['f_nome']="marco";
#$_POST['f_cognome']="surna";
#$_POST['f_password']="123";
#$_POST['f_password1']="123";
##$_POST['f_mail']="marco.procaccini@me.com";
#$_POST['f_mail']="giorgi@acm.org";
#$_POST['MAX_MATRLEN']=30;
#$_POST['MAX_PASSLEN']=30;
#$_POST['MAX_NOMELEN']=30;
#$_POST['MAX_SURLEN']=30;
#$_POST['mailproto']="http";
#$_POST['mailsrv']="x.dii.unisi.it";
#$_POST['mailsrvport']=":8088";
#$_POST['mailuser']="giorgi";
#$_POST['coursedida']="didattica";
#$_POST['courseacro']="arcal1";
#$_POST['savemsg']="dai";


$locmatr=(isset($_POST['f_matricola'])?$_POST['f_matricola']:"");
$locnome=(isset($_POST['f_nome'])?$_POST['f_nome']:"");
$loccogn=(isset($_POST['f_cognome'])?$_POST['f_cognome']:"");
$locpass=(isset($_POST['f_password'])?$_POST['f_password']:"");
$locpas1=(isset($_POST['f_password1'])?$_POST['f_password1']:"");
$locmail=(isset($_POST['f_mail'])?$_POST['f_mail']:"");
$loclchk=(isset($_POST['f_mylcheck'])?$_POST['f_mylcheck']:"");
$locsvat=(isset($_POST['saveat'])?$_POST['saveat']:"");
$locsmsg=(isset($_POST['savemsg'])?$_POST['savemsg']:"");
$locserr=(isset($_POST['saveerr'])?$_POST['saveerr']:"");

$_POST['saveat'] = $locsvat;

#$a=$_POST['f_matricola'];
#$b=$_POST['f_password'];
#$c=$_POST['f_password1'];
#echo "$a $b $c";

#$_POST['f_mail'] = trim($_POST['f_mail']);
$_POST['f_mail'] = trim($locmail);
$_POST['f_mail'] = PREG_REPLACE("/ /", "//", $_POST['f_mail']);

#$loccogn = trim($_POST['f_cognome']);
$loccogn = trim($loccogn);
$loccogn = PREG_REPLACE("/ /", "/_/", $loccogn);
$loccogn = PREG_REPLACE("/[^0-9a-zA-Z_]/i", '', $loccogn);
$_POST['f_cognome'] = strtoupper(substr($loccogn,0,1)).strtolower(substr($loccogn,1));
$locnome = trim($locnome);
$locnome = PREG_REPLACE("/ /", "/_/", $locnome);
$locnome = PREG_REPLACE("/[^0-9a-zA-Z_ ]/", "", $locnome);

$_POST['f_nome'] = strtoupper(substr($locnome,0,1)).strtolower(substr($locnome,1));

#PRINTDEBUG
#
#print ("MATRICOLA =".$_POST['f_matricola']."<BR>");
#print ("NOME =".$_POST['f_nome']."<BR>");
#print ("COGNOME =".$_POST['f_cognome']."<BR>");
#print ("PASSWORD =".$_POST['f_password']."<BR>");
#print ("PASSWORD1 =".$_POST['f_password1']."<BR>");
#print ("EMAIL =".$_POST['f_mail']."<BR>");
#print ("MAX_MATRLEN =".$_POST['MAX_MATRLEN']."<BR>");
#print ("MAX_PASSLEN =".$_POST['MAX_PASSLEN']."<BR>");
#print ("MAX_NOMELEN =".$_POST['MAX_NOMELEN']."<BR>");
#print ("MAX_SURLEN =".$_POST['MAX_SURLEN']."<BR>");


$ptmp=PREG_REPLACE("/[<>\$\\\\ \+()#!;\r\n]/", "", $locpass);
$ptmp2=str_replace("\$", "", $ptmp);
#$ptmp=PREG_REPLACE("/ /", "//", $locpass);
#$ptmp2=PREG_REPLACE("/ /", "//", $locpass);

#print("CIAO2 ptmp2=".$ptmp2."<BR>");
#if (strpos($_POST['f_mail'], '@')>0) {
#print("CIAO3 ".$_POST['f_mail']."<BR>");
if (ctype_digit((string)$locmatr) && filter_var($_POST['f_mail'], FILTER_VALIDATE_EMAIL)) {
#print("CIAO4<BR>");
  if ($ptmp2<>"") {
#print("CIAO5<BR>");

    if ($locpass==$ptmp2) {
#print("CIAO6<BR>");
      $_POST['f_password'] = $locpass;
      $_POST['f_password1'] = $locpas1;
      $_POST['f_mylcheck'] = $loclchk;

      if ($_POST['f_matricola']<>"" and $_POST['f_cognome']<>"" and $_POST['f_nome']<>"" and $_POST['f_mail']<>"" and $_POST['f_password']<>"" and $_POST['f_password1']<>"" ) {
#print("CIAO7<BR>");
        if (strlen($_POST['f_matricola']) < $_POST['MAX_MATRLEN'] and strlen($_POST['f_password']) < $_POST['MAX_PASSLEN'] and strlen($_POST['f_nome']) < $_POST['MAX_NOMELEN'] and strlen($_POST['f_cognome']) < $_POST['MAX_SURLEN']) {
#print("CIAO8<BR>");
          if ($_POST['f_password']==$_POST['f_password1']) {
#print("CIAO9<BR>");

#------------------------------------------ MAIL MANAGEMENT START

        // Course identity is carried by the registration form.
        //
        // registrazione.htm is generated on the full course server, where the
        // course configuration is available.  Its hidden fields therefore
        // contain the already-resolved course values.  When that page is
        // mirrored to www3 those values become ordinary static HTML.
        //
        // prova1.txt consequently has no dependency on header.php,
        // param_corso.php, or any locally loaded course PHP variables.
        $regPostString = static function ($name) {
            return (isset($_POST[$name]) && is_string($_POST[$name]))
                ? trim($_POST[$name])
                : '';
        };

        $regCorsoAcronimo = $regPostString('corso_acronimo');
        $regCorsoDir1     = $regPostString('corso_dir1');
        $regAnnoAccad     = $regPostString('annoaccad');
        $regNomeCorso     = $regPostString('nome_corso');
        $regAcys          = $regPostString('acys');
        $regCourseYear    = $regPostString('courseyear');
        $regCourseAcrSh   = $regPostString('courseacrsh');

        $regConfigOk =
            $regCorsoAcronimo !== ''
            && preg_match('/\A[A-Za-z0-9_-]+\z/D', $regCorsoAcronimo) === 1
            && $regCorsoDir1 !== ''
            && preg_match('/\A[0-9]{4}-[0-9]{4}\z/D', $regAnnoAccad) === 1
            && $regNomeCorso !== ''
            && $regAcys !== '';

        if (!$regConfigOk) {
            echo '<p>Registration course configuration is incomplete or inconsistent.</p>';
            return;
        }

        $maildata = [
            'f_matricola'    => $_POST['f_matricola'],
            'f_nome'         => $_POST['f_nome'],
            'f_cognome'      => $_POST['f_cognome'],
            'f_mail'         => $_POST['f_mail'],
            'f_password'     => $_POST['f_password'],
            'corso_acronimo' => $regCorsoAcronimo,
            'corso_dir1'     => $regCorsoDir1,
            'annoaccad'      => $regAnnoAccad,
            'nome_corso'     => $regNomeCorso,
            'acys'           => $regAcys,
        ];
        if ($regCourseYear !== '') {
            $maildata['courseyear'] = $regCourseYear;
        }


        // Keep the original mail-server endpoint and configuration fields.
        $regMailFields = ['mailproto','mailsrv','mailsrvport','mailuser',
                          'coursedida','courseacro','courseacrsh'];
        foreach ($regMailFields as $regName) {
            if (!isset($_POST[$regName]) || !is_string($_POST[$regName])) {
                echo '<p>Registration mail-server configuration is incomplete.</p>';
                return;
            }
        }

	if (!empty($_POST['mailuser'])) {
	    $myurl = $_POST['mailsrv'].$_POST['mailsrvport']
		   ."/~".$_POST['mailuser']
		   ."/".$_POST['coursedida']
		   ."/".$_POST['courseacro'];
	} else {
	    $myurl = $_POST['courseacrsh']."."
		   .$_POST['mailsrv']
		   .$_POST['mailsrvport'];
	}

	/*
	 * The mail/API server is also the trusted server that hosts conferma.htm.
	 * Therefore both URLs have the same parametrically constructed base.
	 */
	$trustedBase = $_POST['mailproto']."://".$myurl."/";

	$pathemail = $trustedBase."email.php";
	$maildata['approval_path'] = $trustedBase;


echo "mailsrv=$myurl<BR>";
echo "pathemail=$pathemail<BR>";
echo "anno_accad=$regAnnoAccad<BR>";
echo "nome_corso=$regNomeCorso<BR>";
echo "corso_acronimo=$regCorsoAcronimo<BR>";
echo "courseacrsh=$regCourseAcrSh<BR>";
echo "approval_path="
   . htmlspecialchars(
       $maildata['approval_path'],
       ENT_QUOTES | ENT_SUBSTITUTE,
       'UTF-8'
     )
   . "<BR>";

        // One submission: automatic retries could generate duplicate emails
        // if the MTA accepted the first message but its HTTP reply was lost.
        $responseBody = false;
        $httpCode = 0;
        $curlErrNo = 0;
        if (function_exists('curl_init')) {
            $ch = curl_init();
            curl_setopt_array($ch, [
                CURLOPT_URL            => $pathemail,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_POST           => true,
                CURLOPT_FOLLOWLOCATION => false,
                CURLOPT_CONNECTTIMEOUT => 15,
                CURLOPT_TIMEOUT        => 30,
                CURLOPT_IPRESOLVE      => CURL_IPRESOLVE_V4,
                CURLOPT_FAILONERROR    => false,
                CURLOPT_POSTFIELDS     => http_build_query($maildata, '', '&', PHP_QUERY_RFC3986),
                CURLOPT_HTTPHEADER     => [
                    'Accept: application/json',
                    'Content-Type: application/x-www-form-urlencoded'
                ],
            ]);
            $responseBody = curl_exec($ch);
            $httpCode = (int)curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
            $curlErrNo = curl_errno($ch);
            curl_close($ch);
        } else {
            $curlErrNo = -1; // PHP cURL extension unavailable.
        }

        // A valid JSON acknowledgement is required; HTTP 2xx alone is not
        // evidence that the message was handed to the mail transport.
	$respbody = $responseBody !== false;
        $json = $respbody ? json_decode($responseBody, true) : null;
$jsonError = json_last_error_msg();

$trimmedResponse = is_string($responseBody)
    ? ltrim($responseBody)
    : '';

echo "responseLen=".strlen((string)$responseBody)."<BR>";
echo "jsonError=".htmlspecialchars(
    $jsonError,
    ENT_QUOTES | ENT_SUBSTITUTE,
    'UTF-8'
)."<BR>";

echo "firstNonSpaceHex=".
    bin2hex(substr($trimmedResponse, 0, 24)).
    "<BR>";

echo "jsonStart=";
$jp = strpos($trimmedResponse, '{');
echo ($jp === false ? 'NONE' : $jp)."<BR>";

        $isarr = is_array($json);
        $ok = $respbody
           && $httpCode >= 200 && $httpCode < 300
           && is_array($json)
           && !empty($json['ok']) && !empty($json['accepted']);
echo "respbody=$respbody<BR>";
echo "httpCode=$httpCode<BR>";
echo "isarr=$isarr<BR>";
echo "ok=$ok<BR>";
if (is_array($json)) {
    echo "details=".htmlspecialchars(
        (string)($json['details'] ?? ''),
        ENT_QUOTES | ENT_SUBSTITUTE,
        'UTF-8'
    )."<BR>";
}
        $userMsg = $ok ? $locsmsg : ($locserr ?: 'Registration mail-server error.');
        if (!$ok) {
            // Do not log student data, passwords, approval links or raw bodies.
            error_log('[REGMAIL] http='.$httpCode.' curl='.$curlErrNo
                .' response='.(is_array($json) ? 'json' : 'invalid'));
        }
        echo '<div style="margin:1em 0;padding:0.8em;border-radius:6px;'
           .($ok ? 'background:#e7f7ed;color:#126b36;' : 'background:#fdeaea;color:#8a1f11;').'">';
        echo htmlspecialchars($userMsg, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
        echo '</div>';

#------------------------------------------ MAIL MANAGEMENT END
                                
          } else {
             echo "<tr><br>".$_POST['savepw1']." </tr>";
          }
        #length field check
        } else {
          if(strlen($_POST['f_matricola']) >= $_POST['MAX_MATRLEN']){
             echo "<tr><br>".$_POST['checklenmatr']." </tr>";
          }
          if(strlen($_POST['f_password']) >= $_POST['MAX_PASSLEN']){
             echo "<tr><br>".$_POST['checklenpass']." </tr>";
          }
          if(strlen($_POST['f_nome']) >= $_POST['MAX_NOMELEN']){
             echo "<tr><br>".$_POST['checklennome']." </tr>";
          }
          if(strlen($_POST['f_cognome']) >= $_POST['MAX_SURLEN']){
             echo "<tr><br>".$_POST['checklensur']." </tr>";
          }
        }
      #empty field check
      } else {
           echo "<tr><br>".$_POST['saveall']." </tr>";
        if ($_POST['f_matricola']=="") {
           echo "<tr><br>".$_POST['savemat']." </tr>";
        }
        if ($_POST['f_cognome']=="") {
           echo "<tr><br>".$_POST['savesur']." </tr>";
        }
        if ($_POST['f_nome']=="") {
           echo "<tr><br>".$_POST['savenam']." </tr>";
        }
        if ($_POST['f_password']=="") {
           echo "<tr><br>".$_POST['savepas']." </tr>";
        }
        if ($_POST['f_password']<>$_POST['f_password1']) {
           echo "<tr><br>".$_POST['savepw2']." </tr>";
        }

      }

      } else {
             echo "<tr><br>".$_POST['savepw3']." </tr>";
      }
    } else {
             echo "<tr><br>".$_POST['savepas']." </tr>";
    }
  } else {
             echo "<tr><br>".$_POST['saveat']." </tr>";
  }

?>