<?
/**
* Auth class. Used for all login/logout stuff.
*/

require_once("{$_SERVER["DOCUMENT_ROOT"]}/inc/common.php");

/*
if (! function_exists('escapestr'))
{
	function escapeStr($str)
	{
		return trim(mysql_real_escape_string($str));
	}
}
*/
Class AuthLCAPI
{
	var $table, $userNameField, $passField, $miscField,$lastLoggedInField;
	var $loggedIn;
	var $useMd5, $homePageUrl, $loginPageUrl, $membersAreaUrl;
	var $Db;
	
	function AuthLCAPI()
	{
		$this->table='lc_reseller';
		$this->userNameField='user';
		$this->passField='password';
		//$this->lvlField='';
		$this->miscFields='id,first,last,rights,num_logins';
		// If there is a no lastLoggedIn field in the table which is updated to the current
		// DATETIME whenever the user logs in, set the next variable to blank to disable
		// this feature.
		$this->lastLoggedInField='';
		
		$this->useMd5=FALSE;
		$this->homePageUrl='https://www.usafundingapplications.org/';
		$this->loginPageUrl='https://www.usafundingapplications.org/login.php';
		$this->membersAreaUrl='https://www.usafundingapplications.org/membersonly/index.php';
		
		$this->timedout = false;
				
	}
	
	function checkLogin($user, $pass, $passEncrypted=0)
	{
		if (strcmp($user,"")==0)
		{
			return false;
		}
		#getPage($url,$method,$post,$referer,$cookie_jar,$proxy){
		$ip = $_SERVER['REMOTE_ADDR'];
		$url = "http://surfcrm.com/lcapi/verifylogin.php?aff_id=usafa&username=$user&password=$pass&ip=$ip";
		$response = getPage($url,"GET","","http://www.usafundingapplications.org","","");
		
		/*if ($passEncrypted !=0)
		{
			$sql="SELECT $this->passField FROM $this->table WHERE $this->userNameField='$user' LIMIT 1";
			$result=$this->Db->query($sql);
			$dbPass=$this->Db->getSingle($this->passField);
			return (md5($dbPass)==$pass);
		}
		
		if ($this->useMd5)
			$pass=md5($pass);
		$sql="SELECT $this->miscFields FROM $this->table WHERE $this->userNameField='$user' AND $this->passField='$pass'";
		$this->Db->query($sql);
		return ($this->Db->num_rows() ===1);
		*/
		if (strcmp(trim($response),"Success") == 0) { return true; }
		else if (strcmp($response,"")==0) { 
			$message = "User: $user\nPass: $pass\nResponse: $response"; 
			$message .= "<pre>".print_r($this, true)."</pre>"; 
		
			mail("usafa-errorlog@synergytpsreports.com","USAFA Login Error verifylogin.php ".date('Y-m-d H:i:s'),$message ,"From: support@usafundingapplications.org\r\nBcc: usafa-errorlog@usafundingapplications.org");
			$this->timedout = true; 
			return false; 		
		}
		else { 
			return false; 
		}
		
		return false;
	}
	
	function retrieve_password($email)
	{
		#$url = "http://www.surfcrm.com/lcapi/retrievepassword.php?aff_id=usaga&email=$email";
		$url = "http://surfcrm.com/lcapi/usafaretrievepassword.php?aff_id=usafa&email=$email";
		$response = getPage($url,"get","","http://www.usafundingapplications.org","","");
		
		if(strpos($response, "cess:") === false)
		{
			return "";
		}
		else
		{
			list($success,$password) = explode(":",$response);
			return $password;
		}
	}
	function isSessLoggedIn()
	{
		if ($this->loggedIn==='yes')
			return true;
		$user=$_SESSION['auth_user'];
		$pass=$_SESSION['auth_pass'];
		
		if ($this->checkLogin($user,$pass,1))
		{
			$this->loggedIn='yes';
			return true;
		} 
		else
		{
			$this->loggedIn=FALSE;
			return false;
		}
	}
	
	
	//Not tested
	/*
	function isCookieLoggedIn()
	{
		if (! array_key_exists('user',$_COOKIE) || ! array_key_exists('pass',$_COOKIE))
			return false;
		$user=escapeStr($_COOKIE['user']);
		$pass=escapeStr($_COOKIE['pass']);
		if ($this->checkLogin($user,$pass,1))
			$loggedIn=TRUE;
		else
			$loggedIn=FALSE;
		if ($loggedIn && ! $this->isSessLoggedIn())
		{
			$sql="SELECT $this->passField FROM $this->table WHERE $this->userNameField='$user' LIMIT 1";
			$this->Db->query($sql);
			$pass=$this->Db->getSingle($this->passField);
			$this->login($user,$pass);
		}
		return $loggedIn;
	}
	*/
	function isLoggedIn()
	{
		//return ($this->isSessLoggedIn() || $this->isCookieLoggedIn());
		return ($this->isSessLoggedIn());
	}
			
	
			
	function login($user, $pass)
	{
		if (! $this->checkLogin($user,$pass))
			return false;
		if ($this->isSessLoggedIn())
			return false;
		
		$_SESSION['auth_user']=$user;
		$_SESSION['auth_pass']=md5($pass);
		
		
		/*$sql="SELECT $this->miscFields FROM $this->table WHERE $this->userNameField='$user' && $this->passField='$pass'";
		$this->Db->query($sql);
		$fields=explode(',',$this->miscFields);
		foreach ($fields as $k=>$v)
		{
			$fieldName='auth_'.$v;
			$fieldVal=$this->Db->getSingle($v);
			$_SESSION[$fieldName]=$fieldVal;
		}
		
		$sql="UPDATE $this->table SET num_logins=num_logins +1 WHERE $this->userNameField='$user' && $this->passField='$pass'";
		$this->Db->query($sql);
		return true;
		*/
	}
	
		
	function logout()
	{
		if (! $this->isLoggedIn())
			return false;
		
		foreach ($_SESSION as $k=>$v)
		{
			$_SESSION[$k]=false;
		}
		session_destroy();
		
		if ($this->isCookieLoggedIn())
		{
			setcookie('user','', time()-36000, '/');
			setcookie('pass','', time()-36000, '/');
		}
		
		header('location: '.$this->homePageUrl);
		die;
	}
	
	//Not tested
	function restrict($minLevel)
	{
		if (! is_numeric($minLevel))
			return false;
		if (! $this->isLoggedIn())
		{
			header('location: '.$this->loginPageUrl);
			die;
		}
		if ($this->Session->get('auth_level') < $minLevel)
		{
			header('location: '.$this->membersAreaUrl);
			die;
		}
		return true;
	}
	
	
	//Not tested
	/*
	function setCookies()
	{
		if (! $this->isSessLoggedIn())
		{
			return false;
		}
		$user=$this->Session->get('auth_user');
		$pass=$this->Session->get('auth_pass');
		setcookie('user',$user, time()+60*60*24*30, '/');
		setcookie('pass',$pass, time()+60*60*24*30, '/');
		return true;
	}
	*/
	
	function refreshInfo()
	{
		if (! $this->isLoggedIn())
			return false;
		$id=trim($_SESSION['auth_id']);
		$sql="SELECT $this->passField,$this->userNameField, $this->miscFields FROM $this->table WHERE id='$id' LIMIT 1";
		$this->Db->query($sql);
		$info['auth_pass']=md5($this->Db->getSingle($this->passField));
		$info['auth_user']=$this->Db->getSingle($this->userNameField);
		$fields=explode(',',$this->miscFields);
		foreach ($fields as $k=>$v)
		{
			$info['auth_'.$v]=$this->Db->getSingle($v);
		}
		
		//The following variables are used to determine wether or not to
		//set the cookies on the users computer. If $origUser matches the
		//cookie value 'user' it means the user had cookies stored on his 
		//browser, so the cookies would be re-written with the new value of the
		//username.
		$origUser=$_SESSION['auth_user'];
		$origPass=$_SESSION['auth_pass'];
		foreach ($info as $k=>$v)
		{
			$_SESSION[$k]=$v;
		}
		
		/*
		if (array_key_exists('user',$_COOKIE) && array_key_exists('pass',$_COOKIE))
		{
			if ($_COOKIE['user']==$origUser && $_COOKIE['pass']==$origPass)
				$this->setCookies();
		}*/
		return true;
	}
			
}
?>