From 5dea9c4a5287f1840e807baa759c7c3a90795108 Mon Sep 17 00:00:00 2001
From: striker <striker@striker.su>
Date: Wed, 6 May 2026 01:20:10 +0300
Subject: [PATCH] =?UTF-8?q?remove=20unused=20tg-relay.php=20=E2=80=94=20du?=
 =?UTF-8?q?plicate=20of=20CF=20Worker,=20no=20callers=20in=2050=20days?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PHP relay was created 2026-03-15, exposed POST /api/tg-relay.php with
X-Relay-Secret auth, forwarding to api.telegram.org directly. Access logs
showed 4 hits total, all from 79.111.12.36 (developer test) on 2026-03-15
within ~40s, then never again.

All actual contact forms (vgrf.ru, moovg.ru, sag24.ru, hhivp.com) already
use the CF Worker tg-relay.it-resheniya-2018.workers.dev which is the
correct path through TSPU РКН blocks. PHP relay was redundant + leaked an
RU-IP egress to api.telegram.org.
---
 public/api/tg-relay.php | 46 -----------------------------------------
 1 file changed, 46 deletions(-)
 delete mode 100644 public/api/tg-relay.php

diff --git a/public/api/tg-relay.php b/public/api/tg-relay.php
deleted file mode 100644
index e74acdd..0000000
--- a/public/api/tg-relay.php
+++ /dev/null
@@ -1,46 +0,0 @@
-<?php
-header('Content-Type: application/json');
-
-// Secret token to prevent abuse
-$SECRET = 'HhivpTgRelay2026';
-$auth = $_SERVER['HTTP_X_RELAY_SECRET'] ?? '';
-if ($auth !== $SECRET) {
-    http_response_code(403);
-    echo json_encode(['error' => 'Forbidden']);
-    exit;
-}
-
-if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
-    http_response_code(405);
-    echo json_encode(['error' => 'Method not allowed']);
-    exit;
-}
-
-$data = json_decode(file_get_contents('php://input'), true);
-if (!$data || empty($data['bot_token']) || empty($data['chat_id']) || empty($data['text'])) {
-    http_response_code(400);
-    echo json_encode(['error' => 'Missing required fields']);
-    exit;
-}
-
-$bot_token  = $data['bot_token'];
-$payload    = json_encode([
-    'chat_id'    => $data['chat_id'],
-    'text'       => $data['text'],
-    'parse_mode' => $data['parse_mode'] ?? 'HTML',
-]);
-
-$ch = curl_init("https://api.telegram.org/bot{$bot_token}/sendMessage");
-curl_setopt_array($ch, [
-    CURLOPT_POST           => true,
-    CURLOPT_POSTFIELDS     => $payload,
-    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
-    CURLOPT_RETURNTRANSFER => true,
-    CURLOPT_TIMEOUT        => 10,
-]);
-$result   = curl_exec($ch);
-$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
-curl_close($ch);
-
-http_response_code($httpCode);
-echo $result;