rate-check.php

<?php
/**
 * ExploitInject Server-Side Rate Check API
 * Enforces 1 submission per 5 minutes per IP and Email address across all browsers/devices.
 * Read-only check to prevent pre-recording before submit.php processes the form.
 */

header('Content-Type: application/json');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}

$RATE_LIMIT_SECONDS = 300; // 5 minutes
$CACHE_FILE = __DIR__ . '/.rate_limit_cache.json';

function getClientIp() {
    $ip = $_SERVER['REMOTE_ADDR'] ?? '';
    if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
        $ip = trim($ips[0]);
    } elseif (!empty($_SERVER['HTTP_CLIENT_IP'])) {
        $ip = trim($_SERVER['HTTP_CLIENT_IP']);
    }
    return filter_var($ip, FILTER_VALIDATE_IP) ? $ip : ($_SERVER['REMOTE_ADDR'] ?? '');
}

// Get Input Data
$rawInput = file_get_contents('php://input');
$data = json_decode($rawInput, true) ?? $_POST;

$email = isset($data['email']) ? strtolower(trim($data['email'])) : '';
$clientIp = getClientIp();
$now = time();

// Lock and Read Cache File (Read-Only Check)
if (file_exists($CACHE_FILE)) {
    $fp = @fopen($CACHE_FILE, 'r');
    if ($fp) {
        flock($fp, LOCK_SH);
        $fileSize = filesize($CACHE_FILE);
        $content = $fileSize > 0 ? fread($fp, $fileSize) : '[]';
        flock($fp, LOCK_UN);
        fclose($fp);

        $records = json_decode($content, true) ?: [];

        foreach ($records as $rec) {
            if (($now - $rec['timestamp']) < $RATE_LIMIT_SECONDS) {
                $ipMatch = (!empty($clientIp) && !empty($rec['ip']) && $rec['ip'] === $clientIp);
                $emailMatch = (!empty($email) && !empty($rec['email']) && $rec['email'] === $email);
                if ($ipMatch || $emailMatch) {
                    $elapsed = $now - $rec['timestamp'];
                    $remainingSec = max(1, $RATE_LIMIT_SECONDS - $elapsed);
                    echo json_encode([
                        'allowed' => false,
                        'remainingSec' => $remainingSec,
                        'clientIp' => $clientIp
                    ]);
                    exit;
                }
            }
        }
    }
}

echo json_encode([
    'allowed' => true,
    'clientIp' => $clientIp
]);
exit;