tracking.php

<?php
/**
 * DeepSID / Tracking
 *
 * Tracks visitors in near real time using a persistent browser ID stored
 * in localStorage. Called initially by 'index.php' and then periodically
 * by 'main.js'.
 *
 * CSV format in visitors.txt:
 *   visitor_id, ip_address, user_agent, user_name,
 *   time_created, time_updated
 * 
 * @uses        $_POST['visitor_id']
 *
 * @used-by index.php
 * @used-by main.js
 */

require_once("php/class.account.php"); // Includes setup

const TRACKFILE = 'visitors.txt';
const ACTIVE_WINDOW_MINUTES = 20; // How long (in minutes) a visitor is considered "active"

try {

	// Normalized "now", matching the existing DeepSID scripts
	$now = strtotime(date('Y-m-d H:i:s', strtotime(TIME_ADJUST)));

	$user_name  = $account->checkLogin() ? $account->userName() : '';
	$visitor_id = trim($_POST['visitor_id'] ?? '');
	$ip         = $_SERVER['REMOTE_ADDR'] ?? '';
	$user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';

	/*
	 * The visitor ID should be a UUID generated by crypto.randomUUID().
	 *
	 * Example:
	 * 24b0c950-f6a2-4206-aaf4-4ea74287cf97
	 */
	if (
		$visitor_id === '' ||
		!preg_match(
			'/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i',
			$visitor_id
		)
	) {
		return;
	}

	// A user agent is still useful for the activity-log display
	if ($user_agent === '') {
		return;
	}

	/*
	 * Skip external hits from Facebook but use strict comparison to avoid the
     * strpos() position-zero problem.
	 */
	if (strpos($user_agent, 'www.facebook.com') !== false) {
		return;
	}

	/*
	 * Open the tracking file before reading it and keep it locked
	 * throughout the complete read-modify-write operation.
	 *
	 * This prevents two simultaneous requests from overwriting each
	 * other's changes.
	 */
	$handle = fopen(TRACKFILE, 'c+');

	if ($handle === false) {
		throw new Exception('Unable to open tracking file.');
	}

	if (!flock($handle, LOCK_EX)) {
		fclose($handle);
		throw new Exception('Unable to lock tracking file.');
	}

	$visitors = array();

	rewind($handle);

	while (($line = fgetcsv($handle)) !== false) {

		/*
		 * Expected columns:
		 *
		 * 0: visitor_id
		 * 1: ip_address
		 * 2: user_agent
		 * 3: user_name
		 * 4: time_created
		 * 5: time_updated
		 */
		if (count($line) < 6) {
			// Ignore malformed rows and rows from the old five-column format
			continue;
		}

		$line_visitor_id = trim($line[0]);
		$line_ip         = $line[1];
		$line_ua         = $line[2];
		$line_user       = $line[3];
		$time_created    = (int)$line[4];
		$time_updated    = (int)$line[5];

		// Ignore invalid visitor IDs
		if (
			!preg_match(
				'/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i',
				$line_visitor_id
			)
		) {
			continue;
		}

		// Drop visitors that are no longer considered active
		$seconds_since_update = $now - $time_updated;

		if ($seconds_since_update > ACTIVE_WINDOW_MINUTES * 60) {
			continue;
		}

		$visitors[] = array(
			'visitor_id'  => $line_visitor_id,
			'ip_address'  => $line_ip,
			'user_agent'  => $line_ua,
			'user_name'   => $line_user,
			'time_created' => $time_created,
			'time_updated' => $time_updated,
		);
	}

	/*
	 * Find the current browser by its localStorage visitor ID.
	 *
	 * IP address and user agent are no longer used for recognition.
	 */
	$existing_index = null;

	foreach ($visitors as $index => $visitor) {
		if ($visitor['visitor_id'] === $visitor_id) {
			$existing_index = $index;
			break;
		}
	}

	if ($existing_index !== null) {

		// Refresh the existing visitor
		$visitors[$existing_index]['time_updated'] = $now;

		/*
		 * Store the latest IP address and user agent.
		 *
		 * This means switching between IPv4 and IPv6, changing networks,
		 * or updating the browser will not create another visitor row.
		 */
		$visitors[$existing_index]['ip_address'] = $ip;
		$visitors[$existing_index]['user_agent'] = $user_agent;

		/*
		 * Update the username when the visitor logs in.
		 *
		 * Retain the existing username when the current request is
		 * anonymous. This avoids losing the name after logout.
		 */
		if (
			$user_name !== '' &&
			$visitors[$existing_index]['user_name'] !== $user_name
		) {
			$visitors[$existing_index]['user_name'] = $user_name;
		}

	} else {

		// Add a new browser visitor
		$visitors[] = array(
			'visitor_id'  => $visitor_id,
			'ip_address'  => $ip,
			'user_agent'  => $user_agent,
			'user_name'   => $user_name,
			'time_created' => $now,
			'time_updated' => $now,
		);
	}

	// Truncate and rewrite the complete active visitor list
	ftruncate($handle, 0);
	rewind($handle);

	foreach ($visitors as $visitor) {
		fputcsv($handle, array(
			$visitor['visitor_id'],
			$visitor['ip_address'],
			$visitor['user_agent'],
			$visitor['user_name'],
			$visitor['time_created'],
			$visitor['time_updated'],
		));
	}

	fflush($handle);
	flock($handle, LOCK_UN);
	fclose($handle);

} catch (Throwable $e) {

	/*
	 * Ensure an open handle is unlocked and closed if an exception
	 * happened during file processing.
	 */
	if (isset($handle) && is_resource($handle)) {
		@flock($handle, LOCK_UN);
		@fclose($handle);
	}

	if (isset($account)) {
		$account->logActivityError(
			basename(__FILE__),
			$e->getMessage()
		);
	}

	/*
	 * Preserve the behavior of the original script.
	 *
	 * The placeholder will be ignored as a malformed CSV row during
	 * the next successful request.
	 */
	@unlink(TRACKFILE);
	@file_put_contents(TRACKFILE, '0');
}
?>