<?php
/*
Copyright (c) 2007-present InnAnTech Industries
Author: Dave Guindon
Web: www.VirtualSmartAgent.com
Support: www.DaveGuindonSupport.com

Please send bug reports, suggestions and/or feedback to the support
website given above.

Virtual Smart Agent is a commercial software. Any distribution is strictly prohibited
unless a resale rights license was delivered along with this software.
*/

session_start();
include('modfiles/db.php');
$dbtable = $settingsTable;
$tableuser = 'username';
$tablepass = 'password';
$loginpage = 'login.php';

$conn = mysql_connect("$dbhost", "$dblogin", "$dbpass") or die ('I cannot connect to the database.');
mysql_select_db($dbname, $conn) or die(mysql_error());

/**
 * Checks to see if the user has submitted his
 * username and password through the login form,
 * if so, checks authenticity in database and
 * creates session.
 */
if(isset($_POST['sublogin'])){

   /* Checks that username is in database and password is correct */
   $pass = $_POST['pass'];
   $result = confirmUser($_POST['user'], $pass);

   /* Check error codes */
   if($result == 1){
	  $login_message = "That username does not exist in our database.";
   }
   else if($result == 2){
	  $login_message = "Incorrect password, please try again.";
   }

   /* Username and password correct, register session variables */
   $_POST['user'] = stripslashes($_POST['user']);
   $_SESSION['user'] = $_POST['user'];
   $_SESSION['pass'] = $pass;
   
   /**
    * This is the cool part: the user has requested that we remember that
    * he's logged in, so we set two cookies. One to hold his username,
    * and one to hold his md5 encrypted password. We set them both to
    * expire in 100 days. Now, next time he comes to our site, we will
    * log him in automatically.
    */
   if(isset($_POST['remember'])){
      setcookie("cookname", $_SESSION['user'], time()+60*60*24*100, "/");
      setcookie("cookpass", $_SESSION['pass'], time()+60*60*24*100, "/");
   }

}else if (isset($_GET['user'])){
   /* Checks that username is in database and password is correct */
   $pass = $_GET['pass'];
   $result = confirmUser($_GET['user'], $pass);

   /* Check error codes */
   if($result == 1){
	  $login_message = "That username does not exist in our database.";
   }
   else if($result == 2){
	  $login_message = "Incorrect password, please try again.";
   }

   /* Username and password correct, register session variables */
   $_GET['user'] = stripslashes($_GET['user']);
   $_SESSION['user'] = $_GET['user'];
   $_SESSION['pass'] = $pass;

   /**
    * This is the cool part: the user has requested that we remember that
    * he's logged in, so we set two cookies. One to hold his username,
    * and one to hold his md5 encrypted password. We set them both to
    * expire in 100 days. Now, next time he comes to our site, we will
    * log him in automatically.
    */
   if(isset($_GET['remember'])){
      setcookie("cookname", $_SESSION['user'], time()+60*60*24*100, "/");
      setcookie("cookpass", $_SESSION['pass'], time()+60*60*24*100, "/");
   }

}

/* Check login */
$my_logged_in = checkLogin();
if($my_logged_in === false){
  if ($login_message) {
    $send_data = "?login_message=".$login_message;    
  }
  header("location: ".$loginpage.$send_data);
  return;
}

/*==========================================================================
* FUNCTIONS
* ==========================================================================
*/

/**
 * Checks whether or not the given username is in the
 * database, if so it checks if the given password is
 * the same password in the database for that user.
 * If the user doesn't exist or if the passwords don't
 * match up, it returns an error code (1 or 2). 
 * On success it returns 0.
 */
function confirmUser($username, $password){
   global $conn,$dbtable,$tableuser,$tablepass,$campaignTable,$settingsTable;
   /* Add slashes if necessary (for query) */
   if(!get_magic_quotes_gpc()) {
	$username = addslashes($username);
   }

   /* Verify that user is in database */
   $q = "select * from $dbtable where $tableuser = '$username'";

   $result = mysql_query($q,$conn);
   if(!$result || (mysql_numrows($result) < 1)){
      return 1; //Indicates username failure
   }

   /* Retrieve password from result, strip slashes */
   $dbarray = mysql_fetch_array($result);
   $dbarray[$tablepass]  = stripslashes($dbarray[$tablepass]);
   $password = stripslashes($password);   

   /* Validate that password is correct */
   if($password == $dbarray[$tablepass]){
   
     //grab more variables to save in the sessions vars here
     $_SESSION['fname'] = $dbarray['fname'];
	 $_SESSION['install'] = $dbarray['installsite'].$dbarray['installfolder']; 
	 
	 //get the campaign data here if its not set
	 //if ((!isset($_SESSION['cid']))||($_SESSION['cid']=='')){ 
	    $sql = "SELECT * FROM $settingsTable";
		$result = mysql_query($sql,$conn);mysql_error()?(print(mysql_error())):'';
		$data = mysql_fetch_assoc($result);
		$selectedcid = $data['selectedcid'];
	        
		$sql = "SELECT * FROM $campaignTable WHERE id='$selectedcid'";
        $result = mysql_query($sql,$conn);mysql_error()?(print(mysql_error())):'';
        $data = mysql_fetch_assoc($result);
		$_SESSION['campaignlabel'] = $data['label'];
		$_SESSION['cid'] = $data['id'];
		$_SESSION['testmode'] = $data['testmode'];
     //}    	  
	  
      return 0; //Success! Username and password confirmed	  	 
   }
   else{
      return 2; //Indicates password failure
   }
} 
 
/**
 * checkLogin - Checks if the user has already previously
 * logged in, and a session with the user has already been
 * established. Also checks to see if user has been remembered.
 * If so, the database is queried to make sure of the user's 
 * authenticity. Returns true if the user has logged in.
 */
function checkLogin(){
   /* Check if user has been remembered */
   if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookpass'])){
      $_SESSION['user'] = $_COOKIE['cookname'];
      $_SESSION['pass'] = $_COOKIE['cookpass'];
   }

   /* Username and password have been set */
   if(isset($_SESSION['user']) && isset($_SESSION['pass'])){
      /* Confirm that username and password are valid */
      if(confirmUser($_SESSION['user'], $_SESSION['pass']) != 0){
         /* Variables are incorrect, user not logged in */
         unset($_SESSION['user']);
         unset($_SESSION['pass']);
         return false;
      }
      return true;
   }
   /* User not logged in */
   else{
      return false;
   }
}
?>