Runix for server owners

Runix calls your URL with GET and appends parameters such as slug, voted, secret, and when available u / userid and ip / userip. Replace SECRET with the secret from your dashboard. Optional IP allowlisting can fail if Runix's outbound IP does not match www.runixrs.com — verifying secret is enough for most setups.

<?php

// --- Configuration ---
define("DEBUG", 0); // 0 = off, 1 = log, 2 = log + display
define("LOG_FILE", "_postback.log");
define("SECRET", "your-secret");
// Set true only if you know Runix's callback IP and want an extra check (secret is usually enough).
define("VERIFY_RUNIX_IP", false);
define("RUNIXRS_SOURCE_HOST", "www.runixrs.com");

/**
 * Helper to handle logging based on DEBUG level
 */
function logger(string $message, int $level = 1): void
{
    if (DEBUG >= $level) {
        $timestamp = date("[Y-m-d H:i:s]");
        error_log("$timestamp $message\n", 3, LOG_FILE);
        if (DEBUG === 2) {
            echo htmlspecialchars($message, ENT_QUOTES, "UTF-8") . "<br>";
        }
    }
}

// 1. Verify Request Method (Runix uses GET)
if ($_SERVER["REQUEST_METHOD"] !== "GET") {
    http_response_code(405); // Method Not Allowed
    exit("Invalid Request Method");
}

// 2. Optional: restrict by caller IP (off by default — Runix outbound IP may differ from the public site IP)
$ip_request = $_SERVER["HTTP_CF_CONNECTING_IP"] ?? $_SERVER["REMOTE_ADDR"] ?? "";
if (VERIFY_RUNIX_IP) {
    $authorized_ip = gethostbyname(RUNIXRS_SOURCE_HOST);
    if ($authorized_ip !== RUNIXRS_SOURCE_HOST && $ip_request !== $authorized_ip) {
        logger("Unauthorized IP Attempt: $ip_request");
        http_response_code(403);
        exit;
    }
}

// 3. Validate required query parameters
$required = ["secret", "voted", "slug"];
foreach ($required as $field) {
    if (!isset($_GET[$field]) || $_GET[$field] === "") {
        logger("Missing parameter ($field) from IP: $ip_request");
        http_response_code(400);
        exit;
    }
}

// 4. Verify Secret
if ($_GET["secret"] !== SECRET) {
    logger("Invalid secret received from IP: $ip_request");
    http_response_code(401);
    exit;
}

// 5. Sanitize inputs (u / ip may be absent if no name was sent or IP was unreliable)
$username = preg_replace("/[^A-Za-z0-9\_\-]+/", "", (string)($_GET["u"] ?? ""));
$voter_ip = filter_var($_GET["ip"] ?? "", FILTER_VALIDATE_IP) ?: "0.0.0.0";
$voted = (int) $_GET["voted"];

// 6. Only allow positive vote counts
if ($voted < 1) {
    logger("Invalid vote count ($voted) from IP: $ip_request");
    http_response_code(400);
    exit;
}

logger("Processing vote: slug=" . $_GET["slug"] . ", User: $username, Voter IP: $voter_ip, Voted: $voted", 1);

// 7. Process the vote
try {
    // Your database logic here — e.g. reward when $username is non-empty
    // $db->query("UPDATE users SET points = points + 1 WHERE username = ?", [$username]);

    http_response_code(200);
    logger("Vote successful for " . ($_GET["slug"] ?? "") . " user=$username", 1);
} catch (Exception $e) {
    logger("Database Error: " . $e->getMessage());
    http_response_code(500);
}

exit;