<?php
    if (!defined('IN_BANDTOPIA'))
{
	header("Location: http://www.band-topia.com/api.php");
}

class loginObj {
	private $int_username;
	private $int_password;
	private $int_dateGen;
	private $int_key;
	private $loginSuccess;
	
	public function keyVerify($key)
	{
		$keyArray = $keyObj->decryptKey($key);
		
		$keyLoginType = $keyArray[0];
		
		switch ($keyLoginType) {
			case 'user':
				$this->int_username = $keyArray[1];
				$this->int_password = $cryptObj->EncryptPass($keyArray[2]);
				$this->int_dateGen = $keyArray[3];
				$this->loginSuccess = $this->userLogin();
				
				$dateDiff = date_diff(getdate(),$this->int_dateGen);
				if ($this->loginSuccess && $dateDiff->d < 60)
					return true;
				else
					return false;
				break;
			case 'portal':
				$keyPortalId = $keyArray[1];
				$keyPortalPass = $cryptObj->EncryptPass($keyArray[2]);
				$keyPortalDateGen = $keyArray[3];
				break;
		}
	}
	
	private function userLogin()
	{
		$query = <<<EOD
		SELECT 1 
		FROM userInfo
		WHERE userUsername = '{$this->int_username}'
			AND userPass = '{$this->int_password}'
EOD;
		$result = mysql_result($query, 0);
		
		$loginSuccess = (mysql_num_rows($result) > 0)?true:false;
		
		return $loginSuccess;
	}
}

/***********************************************************/
/* Login Process
/***********************************************************/
if ($action == 'logout') {
	session_destroy();
	header("Location: index.php?action=main");
}
elseif (isset($_SESSION['HTTP_USER_AGENT']) && isset($_SESSION['lskejd'])) 
{
	// 
	$string = $_SERVER['HTTP_USER_AGENT'];
	$string .= 'h8er89pkd3!';
    if ($_SESSION['HTTP_USER_AGENT'] != md5($_SERVER['HTTP_USER_AGENT']) || $_SESSION['lskejd'] != md5($string) || !$allowAccess)
    {
        header("Location: index.php?action=login&prev_action={$action}");
    }

	if($action == 'login') 
	{
		$action = $prev_action;
		header("Location: index.php?action={$action}&prev_action={$prev_action}");
	}
}
else
{
	if(isset($_POST['post_form']) && isset($_POST['username']) && $action == 'login')
	{
		/*******************************************************/
		/* Verify user login information
		/*******************************************************/
		$userObj = new UserObj();
		$userObj->set_username($_POST['username']);
		$userObj->getUser();
		if($userObj->get_user_table_id() == '' || $userObj->get_user_active() == 0)
		{
			$template -> assign_block_vars('page_error', array());
			$template -> assign_block_vars('page_error.error_msg', array(
				'ERROR_MSG' => 'The username you provided does not exist or has been deactivated. <br> Please try again.'));
		}
		else
		{
			if(DecryptPass($userObj->get_password()) != $_POST['password'])
			{
				$template -> assign_block_vars('page_error', array());
				$template -> assign_block_vars('page_error.error_msg', array(
					'ERROR_MSG' => 'The password you provided does not match our records. <br> Please try again.'));
			}
			else
			{
				/*******************************************************/
				/* Register User Session Information
				/*******************************************************/
	    		$_SESSION['HTTP_USER_AGENT'] = md5($_SERVER['HTTP_USER_AGENT']);
	
				$string = $_SERVER['HTTP_USER_AGENT'];
				$string .= 'h8er89pkd3!';
				$lskejd = md5($string);
	
				$_SESSION['lskejd'] = $lskejd;
			
				$_SESSION['username'] = $userObj->get_username();
				$_SESSION['user_fullname'] = $userObj->get_user_fullname();
				$_SESSION['user_table_id'] = $userObj->get_user_table_id();
				$_SESSION['user_type_id'] = $userObj->get_user_type_id();
				$_SESSION['user_info_id'] = $userObj->get_user_info_id();
				$_SESSION['user_type_title'] = $userObj->get_user_type_title();

				// User Security
				$query = <<<EOD
					SELECT
						us.secy_cmpt_id,
						sc.secy_cmpt_name
					FROM
						user_secy AS us
						LEFT JOIN secy_cmpt AS sc ON
							sc.secy_cmpt_id = us.secy_cmpt_id
					WHERE
						us.user_table_id = {$userObj->get_user_table_id()}
					ORDER BY
						us.secy_cmpt_id
EOD;
				$result = mysql_query($query, $mydb) or die(mysql_error()."<br>$query");
				while($row2 = mysql_fetch_assoc($result))
				{
					$_SESSION['secy_cmpt'][$row2['secy_cmpt_id']] = $row2['secy_cmpt_name'];
				}

				header("Location: index.php?action={$prev_action}");
			}
		}
	}
	elseif(!$allowAccess)
	{
		header("Location: index.php?action=login&prev_action={$action}");
	}
}
?>