<?php include('_mod_security.php'); ?>
<!--<script language="javascript" type="text/javascript" src="js/md5.js"></script>-->
<script type="text/javascript" src="js/cryptojs/rollups/sha512.js?ver=<?php echo filemtime(__DIR__.'/js/cryptojs/rollups/sha512.js') ?>"></script>
<script language="javascript" type="text/javascript">

trim = function(stringToTrim) 
{
	return stringToTrim.replace(/^\s+|\s+$/g,"");
}

validateForm = function()
{
	if (trim(document.getElementById("UserID").value) == "")
	{
		alert("User ID cannot be blank!");
		return false;
	}
	if (trim(document.getElementById("PWD").value) == "")
	{
		alert("Password cannot be blank!");
		return false;
	}
	$.ajax({
		url: "ajax.php?call=login_tokens&email=" + document.getElementById("UserID").value,
		cache: false,
		dataType: "json",
		async: false,
		success: function(json) {
				if (json.admin_salt > ' ')
				{
					document.getElementById("PWD").value = json.admin_token1 + CryptoJS.SHA512(json.admin_salt + document.getElementById("PWD").value) + json.admin_token2;
				}
				else
				{
					alert('Invalid login credentials!');
				}
		}
		 ,error: function (request, status, error) { /* alert(status + ", " + error); */ }
	})
	
	document.getElementById("PWD").value = CryptoJS.SHA512(document.getElementById("PWD").value);
}

check_enter = function(e)
{
	var keynum = 0;
	if(window.event) // IE
		keynum = e.keyCode;
	else if(e.which) // Netscape/Firefox/Opera
		keynum = e.which;
	//if (keynum == 13)
		//login();
}

init_login = function()
{
	document.getElementById("js_warning").style.display="none";
}

</script>

<?php
	$form_error = '';
	$form_user_id_error = '';
	if ($_POST['Submitted'] == '1')
	{
		$form_user_id = mysqli_real_escape_string($GLOBALS['con'], trim($_POST['UserID']));
		$form_val1 = mysqli_real_escape_string($GLOBALS['con'], trim($_POST['Val1']));
		$form_val2 = mysqli_real_escape_string($GLOBALS['con'], trim($_POST['Val2']));
		$form_pwd = mysqli_real_escape_string($GLOBALS['con'], trim($_POST['PWD']));
		$form_remember_me = mysqli_real_escape_string($GLOBALS['con'], trim($_POST['remember_me']));
		if ($form_remember_me == '1')
			$remember_me = 'Checked';
		else
			$remember_me = '';
		$sql = "SELECT * FROM admin_users WHERE Email = '".$form_user_id."' AND Active = 1";
		$result = mysqli_query($GLOBALS['con'], $sql);
		if (mysqli_num_rows($result) > 0)
		{
			$row = mysqli_fetch_array($result);
			$pwd_hash = strtoupper(hash('sha512', $form_val1.$row['Pwd'].$form_val2));
			if (hash('sha512', $_SESSION['admin_login_token1'].$row['password'].$_SESSION['admin_login_token2']) == mysqli_real_escape_string($GLOBALS['con'], trim($_POST['PWD']))) 
			//if ($pwd_hash == strtoupper($form_pwd))
			{
				//echo 'Login Valid!';
				if ($form_remember_me == 1)
				{
					//echo 'Setting COOKIE!';
					echo "<SCRIPT>setCookie('HN_UserEmail','".$form_user_id."',180);</SCRIPT>";
					echo "<SCRIPT>setCookie('HN_UserID','".$row['UserID']."',180);</SCRIPT>";
					//setcookie("HN_Test", "ABCDEFG");
					//setcookie("HN_UserEmail", $form_user_id);
					//setcookie("HN_UserID", $row['UserID']);
					//echo setcookie("HN_UserEmail", $form_user_id, time()+60*60*24*180);
					//echo setcookie("HN_UserID", $row['UserID'], time()+60*60*24*180);
				}
				else
				{
					echo "<SCRIPT>setCookie('HN_UserEmail','".$form_user_id."',-180);</SCRIPT>";
					echo "<SCRIPT>setCookie('HN_UserID','".$row['UserID']."',-180);</SCRIPT>";
					//setcookie ("HN_UserEmail", "", time() - 3600);
					//setcookie ("HN_UserID", "", time() - 3600);
				}
				session_start();
				$_SESSION['admin_logged_in'] = 1;
				$_SESSION['admin_user_id'] = $row['UserID'];
				$_SESSION['admin_user_name'] = $row['UserName'];
				$_SESSION['admin_roles'] = $row['Roles'];
				$_SESSION['admin_rand_key'] = generate_random_string(32);
				$sql = "UPDATE admin_users SET LastLogin = '".date("Y-m-d H:i:s")."' WHERE UserID = ".$_SESSION['admin_user_id'];
				$result = mysqli_query($GLOBALS['con'], $sql);
				//die($sql);
				echo "<SCRIPT>";
				echo "window.location.href = 'index.php?IX=dashboard'";
				echo "</SCRIPT>";
			}
			else
			{
				$form_error = 'Login Invalid!';
				session_start();
				$_SESSION['admin_logged_in'] = 0;
			}
		}
		else
		{
			$form_error = 'Login Invalid!';
		}
	}
	else
	{
		$form_val1 = mt_rand(0,2147483647);
		$form_val2 = mt_rand(0,2147483647);
		//var_dump($_COOKIE);
		//echo 'Cookie: '.$_COOKIE['HN_UserEmail'];
		if ($_COOKIE['HN_UserEmail'] > '')
		{
			$remember_me = 'Checked';
			$form_user_id = $_COOKIE['HN_UserEmail'];
		}
		else
		{
			$remember_me = '';
			$form_user_id = '';
		}
	}
	
?>

<div align="center">
	<br />
    Enter your User ID and Password below.
	<br /><br /><span class="error-text" style="font-size:14pt; color:red;"><?php echo $form_error; ?></span><br />
</div>

<form name="frmLogin" id="frmLogin" method="post" action="index.php?IX=login" onsubmit="return validateForm();">
	<input type="hidden" id="Submitted" name="Submitted" value="1"  >
	<table width="350" border="0" align="center" cellpadding="0" cellspacing="10" style="border: 1px solid ##166E3E">
		<tr valign="top">
			<td width="125px" class="label">
				User ID:<br />
				<span style="color:darkblue; font-size:10px; ">(Email address)</span>
			</td>
			<td>
				<input type="text" id="UserID" name="UserID" message="Please Enter a User ID" tabindex="1" class="input-box" style="width:200px;" value="<?php echo $form_user_id; ?>" size="40" maxlength="30" onKeyPress="check_enter(event);" >
			</td>
		</tr>
		<tr valign="top">
			<td class="label">
				Password:<br />
				<a href="" style="font-size:10px; color:darkblue; text-decoration:none;">Forgot password?</a>
			</td>
			<td>
				<input type="password" id="PWD" name="PWD" message="Please Enter a Password" tabindex="2" class="input-box" style="width:200px;" size="150" maxlength="150" onKeyPress="check_enter(event);" >
				<input type="hidden" id="Val1" name="Val1" value="<?php echo $form_val1; ?>" />
				<input type="hidden" id="Val2" name="Val2" value="<?php echo $form_val2; ?>" />
			</td>
		</tr>
		<tr valign="top">
			<td colspan="2" class="label" valign="top">
				<cfset strRememberMe = "">
				<cfif (cookie.bondsforyou.email NEQ "")>
					<cfset strRememberMe = "checked">
				</cfif>
				Remember me? &nbsp;&nbsp;&nbsp;<input type="checkbox" id="remember_me" name="remember_me" tabindex="3" value="1" <?php echo $remember_me; ?> ><br />
				<span style="color:darkblue; font-size:10px;">Do not check if on a public computer!</span>
				<br /><br />
			</td>
		</tr>
		<tr valign="middle">
			<td colspan="2" align="center">
				<input type="submit" name="button" tabindex="4" value="Login" class="default-button" >
			</td>
		</tr>
	</table>

</form>

<div id="js_warning" align="center" style="font:Arial, Helvetica, sans-serif; font-size:14pt; color:#FF0000;">
	Warning:<br />
	JavaScript is disabled in your browser!<br />
	This application will not function.<br />
</div>
<script type="text/javascript" language="javascript">
	init_login();
</script>