function bitcoin_withdraw($uid, $amount, $curr_type, &$voucher_code, &$reqid)
{
$voucher = isset($_POST['voucher']);
if ($voucher) {
syslog(LOG_NOTICE, "address=voucher");
$query = "\n INSERT INTO requests (req_type, uid, amount, curr_type)\n VALUES ('WITHDR', '{$uid}', '{$amount}', '{$curr_type}');\n ";
} else {
$addy = post('address');
try {
$validaddy = bitcoin_validate_address($addy);
} catch (Exception $e) {
if ($e->getMessage() != 'Unable to connect.') {
throw $e;
}
throw new Problem(_("Sorry..."), _("We are currently experiencing trouble connecting to the Bitcoin network and so cannot verify that you entered a valid Bitcoin address.") . "</p><p>" . _("Your withdrawal request has been cancelled.") . "</p><p>" . _("Please try again in a few minutes."));
}
if (!$validaddy['isvalid']) {
throw new Problem(_('Bitcoin says no'), _('That address you supplied was invalid.'));
}
syslog(LOG_NOTICE, "address={$addy}");
$we_have = bitcoin_get_balance("*", 0);
if (gmp_cmp($we_have, $amount) <= 0) {
$message = sprintf(_("User %s is asking to withdraw %s BTC. We only have %s BTC."), $uid, internal_to_numstr($amount, BTC_PRECISION), internal_to_numstr($we_have, BTC_PRECISION));
email_tech(_("Exchange Wallet Balance is Too Low"), $message);
}
$query = "\n INSERT INTO requests (req_type, uid, amount, curr_type)\n VALUES ('WITHDR', '{$uid}', '{$amount}', '{$curr_type}');\n ";
}
endlog();
do_query($query);
$reqid = mysql_insert_id();
if ($voucher) {
$voucher_code = store_new_bitcoin_voucher_code($reqid);
} else {
$query = "\n INSERT INTO bitcoin_requests (reqid, addy)\n VALUES ('{$reqid}', '{$addy}');\n ";
do_query($query);
}
}
function bdk_prove_coin_ownership($bitcoin_address = '', $step = 1, $step_2_signature = '', $step_2_original_data = '', $message_to_sign = '')
{
global $bdk_integrity_check, $bdk_settings;
//Define local/private variables
$output["return_status"] = -1;
$output["bitcoin_address_authenticated"] = 0;
$output["string_to_sign"] = '';
/* Return status codes
-1 = Failure to collect information on the receipt
1 = Success
100 = Connection to Bitcoin failed
101 = Creation of random string failed.
102 = Inputted server checksum dosen't match the local server check sum. Tell user to try again we can't trust this information if the server checksum dosen't match the data.
103 = null
104 = Bitcoin address was not set, with out the address we can't retrieve any Bitcoin information
105 = (Same as 104 only different for debugging purposes) Bitcoin address was not set, with out the address we can't retrieve any Bitcoin information
106 = message did not validate, signature should not be trusted
*/
/** Filter - Sanatize **/
$step_2_signature = trim($step_2_signature);
$step_2_original_data = trim($step_2_original_data);
$message_to_sign = trim($message_to_sign);
if ($bitcoin_address != '') {
//Check if this Bitcoin address is valid before expending the resources to generate a random string/checking, etc
$bitcoin_validation_status = bitcoin_validate_address($bitcoin_address);
if ($bitcoin_validation_status["return_status"] == 1 && $bitcoin_validation_status["isvalid"] == 1) {
//This Bitcoin address is valid, what did we want to do now that we know this?
if ($step == 1) {
//Generate a random string for the non-authenticated user to sign and send back to us
$random_string_request = bdk_generate_random_string(256);
if ($random_string_request["return_status"] == 1) {
//Random string created!
$random_string = $random_string_request["random_string"];
//Sync time
$current_time_sync = time();
//We set in a variable so all time references are the same during code-execution.
//Server Checksum
$server_checksum = hash($bdk_settings["hash_type"], $current_time_sync . $random_string . $bdk_integrity_check . $bitcoin_address);
//String to sign
if ($message_to_sign == '') {
$string_to_sign = "This message is to prove ownership of the address of " . $bitcoin_address . " and in no way, shape or form is it a legal binding contract. |" . $current_time_sync . "|" . $server_checksum . "|" . $random_string . "|" . $bitcoin_address;
} else {
//Remove all | pipes from the string to prevent the message from breaking the ending signature thing.
$message_to_sign = str_replace("|", "", $message_to_sign);
$string_to_sign = $message_to_sign . "|" . $current_time_sync . "|" . $server_checksum . "|" . $random_string . "|" . $bitcoin_address;
}
//Return string to sign
$output["string_to_sign"] = $string_to_sign;
$output["return_status"] = 1;
} else {
//Creation of random string failed.
$output["return_status"] = 101;
}
} else {
if ($step == 2) {
//Validate information
//Split data so we can do some integrity checks
$step_2_decoded_data_split = explode("|", $step_2_original_data);
/*
step_2_decoded_data_split Table
[0] = original message
[1] = Time stamp
[2] = (Client provided) Server Checksum
[3] = Random String
[4] = Bitcoin Address attempting to authenticate
*/
//Create a serverside checksum based on the provided information
$server_checksum = hash($bdk_settings["hash_type"], $step_2_decoded_data_split[1] . $step_2_decoded_data_split[3] . $bdk_integrity_check . $step_2_decoded_data_split[4]);
//See if the server checksum matches with the client provided serverchecksum
if ($server_checksum == $step_2_decoded_data_split[2]) {
//So far soo good the data is intact, now we must verify that the Bitcoin signature is valid with the data
$tmp_hash_message = hash($bdk_settings["hash_type"], $step_2_original_data);
$valid_message_status = bitcoin_verify_message($bitcoin_address, $step_2_signature, $tmp_hash_message);
if ($valid_message_status["return_status"] == 1 && $valid_message_status["message_valid"] == 1) {
//A valid message! But is this token expired?
if (time() - $step_2_decoded_data_split[1] <= $bdk_settings["coin_authentication_timeout"]) {
//Consider the user authenticated!
$output["return_status"] = 1;
$output["bitcoin_address_authenticated"] = 1;
} else {
//Token has expired, the user must generate another one.
$output["return_status"] = 1;
$output["bitcoin_address_authenticated"] = 0;
}
} else {
//Not a valid message
$output["return_status"] = 106;
}
} else {
//The provided server checksum dosen't match the servers checksum
$output["return_status"] = 102;
}
}
}
} else {
//This Bitcoin address isn't valid
$output["return_status"] = 104;
}
} else {
$output["return_status"] = 105;
}
return $output;
}
