<?php
	if ($_POST['login_submitted'] == '1') :
		if (empty($_POST['user_id'])) :
			$err_login = 'Invalid login credentials!';
			$err_flag = true;
		endif;
		if (empty($_POST['login_pwd'])) :
			$err_login = 'Invalid login credentials!';
			$err_flag = true;
		endif;
		if (!$err_flag) :
			$sql = "SELECT * FROM sys_users WHERE user_name = ".$db->quote(trim($_POST['user_id']))." AND active = 1";
			//echo $sql.'<br />';
			$result = $db->query($sql) or die('Database Error!');
			//echo $sql.' result: '.$result->rowCount().' === '.md5($_POST['login_pwd']);
			if ($result->rowCount() > 0) :
				$row = $result->fetch(PDO::FETCH_OBJ);
				$bln_password_match = false;
				if (password_verify($_POST['login_pwd'], $row->password)) :
					$bln_password_match = true;
				elseif (strtoupper(md5($_POST['login_pwd'])) == strtoupper($row->password)) :
					$sql = "UPDATE sys_users set ".
						"password = ".$db->quote(trim(password_hash($_POST['login_pwd'], PASSWORD_BCRYPT)))." ".
						"WHERE user_id = '".$row->user_id."'";
					$db->query($sql) or die('Database Error!');
					$bln_password_match = true;
				else :
					$err_login = 'Invalid login credentials!';
					$err_flag = true;
				endif;
				if ($bln_password_match) :
					$_SESSION['user_id'] = $row->user_id;
					$_SESSION['user_name'] = $row->user_name;
					$_SESSION['logged_in'] = true;
					$_SESSION['user_full_name'] = $row->full_name;
					$_SESSION['user_email'] = $row->email;
					$_SESSION['user_admin'] = $row->admin;
					$_SESSION['password_expired'] = $row->password_expired;
					$_SESSION['roles'] = '';
					/*
					if ($row->admin == 1) :
						$_SESSION['roles'] .= 'admin';
					endif;
					*/
					$_SESSION['rand_key'] = generate_random_string(32);
					write_log('I', $_SESSION['user_id'], 'User '.$_SESSION['user_full_name'].' logged on');
					if ($_POST['remember_me'] == 1) :
						echo "<SCRIPT>setCookie('HotelDB_UserID','".$_SESSION['user_name']."',180);</SCRIPT>";
					else :
						echo "<SCRIPT>setCookie('HotelDB_UserID','".$_SESSION['user_name']."',-180);</SCRIPT>";
					endif;
					if ($row->password_expired == 1) :
						$_SESSION['password_expired'] = true;
						$next_page = 'password_form';
					else :
						$ar_roles = explode(',', get_roles());
						if (!empty($ar_default_start[$ar_roles[0]])) :
							$next_page = $ar_default_start[$ar_roles[0]];
						else :
							$next_page = 'hotels';
						endif;
					endif;
					echo "<SCRIPT>";
					echo "window.location.href = 'index.php?IX=".$next_page."'";
					echo "</SCRIPT>";
				else :
					$err_login = 'Invalid login credentials!';
					$err_flag = true;
				endif;
			else :
				$err_login = 'Invalid login credentials!';
				$err_flag = true;
			endif;
		endif;
	else:
		if (!empty($_COOKIE['HotelDB_UserID'])) :
			$remember_me = 'checked="checked"';
			$form_user_id = $_COOKIE['HotelDB_UserID'];
		else :
			$remember_me = '';
		endif;
	endif;

?>

<script>
	$(document).ready(function()	
	{
		$('.home_cell_background').mouseover(function() {
				$(this).parent('div').find('.home_cell_text').show();
			});
		$('.home_cell_text').mouseout(function() {
				$(this).hide();
			});
	});
</script>
<div class="home_login">
	<form style="" name="frm_login" id="frm_login" method="post" action="">
		<input name="login_submitted" type="hidden" value="1" />
		<input name="salt2" id="salt2" type="hidden" value="" />
		<input name="pwd_new_sha" id="pwd_new_sha" type="hidden" value="" />
		<div class="input_field">
			<label for="user_id">User ID</label>
			<input class="login_text" name="user_id" id="user_id" type="text" maxlength="40" value="<?php echo $form_user_id ?? NULL; ?>" />
		</div>
		<div class="input_field">
			<label for="login_pwd">Password</label>
			<input class="login_text" name="login_pwd" id="login_pwd" type="password" maxlength="150" value="" />
		</div>
		<div class="input_field">
			<input name="remember_me" type="checkbox" value="1" <?php echo $remember_me ?? NULL; ?> style="" /> Remember me
		</div>
		<div class="button_block center">
			<input type="submit" value="Login" />
		</div>
		<div class="input_field center">
			<?php show_form_error($err_login ?? NULL) ?>
		</div>
		<div class="center">
			<a href="passwordreset">Forgot password?</a>
		</div>
	</form>
</div>