<?php

// Configuration goes here
$mysql_user = 'mydns';
$mysql_pass = 'EDIT THIS';
$mysql_srv  = 'localhost';
$mysql_db   = 'mydns';
$realm      = 'dyn.example.com;

// Assume that the user is unauthenticated
$auth = false;

// Quote variable to make safe
function quote_smart($value)
{
   // Stripslashes
   if (get_magic_quotes_gpc()) {
       $value = stripslashes($value);
   }
   // Quote if not integer
   if (!is_numeric($value)) {
       $value = "'" . mysql_real_escape_string($value) . "'";
   }
   return $value;
}

// Output will be plain text
header('Content-type: text/plain');

// Connect to the database
$db = mysql_connect($mysql_srv, $mysql_user, $mysql_pass)
      or die('Could not connect: ' . mysql_error());
mysql_select_db($mysql_db,$db)
      or die("Could not select database $mysql_db: " . mysql_error());

// Has the user supplied credentials?
if (isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW']))
{
  // Store these in shorter variables
  $user = quote_smart($_SERVER['PHP_AUTH_USER']);
  $pass = quote_smart($_SERVER['PHP_AUTH_PW']);

  // Look up the user's credentials
  $result = mysql_query("SELECT user FROM users WHERE " .
                        "user=$user AND " .
                        "pass=PASSWORD($pass);",$db);

  // If the user supplied valid credentials, then the
  // MySQL query should have returned one row
  if (mysql_numrows($result) == 1)
  {
    $auth = true;
  }
}

// If the user isn't authenticated, request credentials
if ($auth == false)
{
  header('WWW-Authenticate: Basic realm="' . $realm . '"');
  header($_SERVER['SERVER_PROTOCOL'] . ' 401 Unauthorized');
  echo 'badauth';
  exit;
}

// Check that the user passed a hostname
if (!isset($_REQUEST['hostname']))
{
  // User didn't pass a hostname
  echo 'notfqdn';
  exit;
} else {
  if ($_REQUEST['system'] != 'dyndns')
  {
    echo 'badsys';
    exit;
  }
  $host = quote_smart($_REQUEST['hostname'] . '.');
  // User supplied a hostname, so look it up in the database
  $result = mysql_query("SELECT user FROM owner WHERE " .
                        "name=$host;",$db);
  // Check database results
  if (mysql_numrows($result) == 0)
  {
    // We've never heard of that host
    echo 'nohost';
    exit;
  } elseif (mysql_numrows($result) == 1) {
    // Parse results
    $row = mysql_fetch_array($result);
    // Make sure that the user owns that host
    if (quote_smart($row['user']) == $user)
    {
      // See if user explicitly specified the IP address to set
      $num = "([0-9]|1?\d\d|2[0-4]\d|25[0-5])";
      if (isset($_REQUEST['myip']) && preg_match("/^$num\.$num\.$num\.$num$/",$_REQUEST['myip']))
      {
        // User specified thier IP address
	$ip = quote_smart($_REQUEST['myip']);
      } else {
        // User didn't specify thier IP address, so snag it from server variables
	$ip = quote_smart($_SERVER['REMOTE_ADDR']);
      }
      // Update the database with the IP
      mysql_query("UPDATE rr SET data=$ip WHERE " .
                  "name=$host AND " .
                  "type='A';",$db);
      if (mysql_affected_rows($db) > 0)
      {
        echo "good $ip";
	exit;
      } else {
        echo "nochg $ip";
	exit;
      }
    } else {
      // The user doesn't own the host they're trying to update
      echo '!yours';
      exit;
    }
  }
}

?>