<?php
error_reporting(E_ALL | E_STRICT);
ini_set("track_errors", "On");

$test_normal = TRUE;

$INC = dirname(__FILE__) . "/../inc";
require_once(dirname(__FILE__) . "/config.php");
require_once($INC . "/init.inc.php");
require_once($INC . "/util.inc.php");
require_once("http.inc.php");

rg_log_set_file("http_create_account.log");

require_once("common.php");

$_testns = 'http_create_account';

$info = array('id' => 'http_create_account');
prepare_http($info);

rg_log("Test create account");

// First we need to load the form so we can get the token
$r = do_req($info, $test_url . "/op/create_account", $data, $headers);
if ($r === FALSE) {
	rg_log("Cannot load create_account page!");
	exit(1);
}
$good_token = $r['tokens']['user_edit_hl'];
$gen = $r['inputs']['gen'];

$uniq = rg_id(16);

sleep(2); // bot protection
rg_log('Adding an account without accepting tos...');
$username = "http1-$uniq<xss>";
$info = array('id' => $username);
$data = array(
	"uid" => 0,
	"doit" => 1,
	"token" => $good_token,
	"username" => $username,
	"realname" => "http1-$uniq real name<xss>",
	"email" => "http_create_account_$uniq<xss>@embedromix.ro",
	"pass" => "cucurigu<xss>",
	"pass2" => "cucurigu<xss>",
	"plan_id" => 9,
	"session_time" => 60,
	'gen' => $gen
);
$headers = array();
$r = do_req($info, $test_url . "/op/create_account?t=create_account", $data, $headers);
if (!strstr($r['body'], "without accepting")) {
	rg_log("Seems we could create an account without accepting ToS. Bad!");
	exit(1);
}

rg_log('Adding an account accepting tos...');
$data['token'] = $r['tokens']['user_edit_hl'];
$data['tos'] = 1;
$headers = array();
$r = do_req($info, $test_url . "/op/create_account?t=create_account", $data, $headers);
if (!strstr($r['body'], "Your account has been successfully created")) {
	rg_log_ml('body: ' . print_r($r['body'], TRUE));
	rg_log("Cannot create account");
	exit(1);
}

$sql = "SELECT * FROM users WHERE username = '$username'";
$res = rg_sql_query($db, $sql);
if ($res === FALSE)
	exit(1);
$rows = rg_sql_num_rows($res);
if ($rows === 0) {
	rg_log("Seems the account is not created: rows == 0!");
	exit(1);
}
$row = rg_sql_fetch_array($res);
rg_sql_free_result($res);

$data['pass'] = rg_user_pass($row['salt'], $data['pass']);
$data['is_admin'] = 0; // to be sure we do not create admin accounts
foreach ($data as $k => $v) {
	if (!isset($row[$k]))
		continue;

	if (strcmp($k, "uid") == 0)
		continue;
	if (strcmp($k, "pass") == 0)
		continue;

	if (strcmp($row[$k], $v) != 0) {
		rg_log("Key $k does not match: row=" . $row[$k] . " data=" . $data[$k]);
		exit(1);
	}
}

rg_log("OK!");