<?php
	include_once('_form_header.php');
	session_start();
	
	if ($_POST['ajax_login_submitted'] == '1') :
		if (empty($_POST['user_id']) || $_POST['user_id'] == 'Enter user ID (email)') :
			$err_login = 'Invalid login credentials!';
			$err_flag = true;
			$form_user_id = 'Enter user ID (email)';
		endif;
		if (empty($_POST['login_pwd'])) :
			$err_login = 'Invalid login credentials!';
			$err_flag = true;
			$form_user_id = 'Enter user ID (email)';
		endif;
		if (!$err_flag) :
			$sql = "SELECT * FROM users WHERE email = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['user_id']))."' AND active = 1";
			//echo $sql.'<br />';
			$result = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
			//echo $sql.' result: '.mysqli_num_rows($result);
			if (mysqli_num_rows($result) > 0) :
				$row = mysqli_fetch_object($result);
				//echo '<br/>DB password: '.$row->password.'<br/>Form password: '.mysqli_real_escape_string($GLOBALS['con'], trim($_POST['login_pwd']));
				if (empty($row->password2) && !empty($_POST['salt2'])  && !empty($_POST['pwd_new_sha'])) :
					if (md5($_SESSION['login_token1'].$row->password.$_SESSION['login_token2']) == mysqli_real_escape_string($GLOBALS['con'], trim($_POST['login_pwd']))) :
						$sql = "UPDATE users set ".
							"salt = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['salt2']))."', ".
							"password2 = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['pwd_new_sha']))."', ".
							"password = NULL ".
							"WHERE id = ".$row->id;
						mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
						$row->password2 = trim($_POST['pwd_new_sha']);
						$_POST['login_pwd'] = hash('sha512', $_SESSION['login_token1'].$row->password2.$_SESSION['login_token2']);
					endif;
				endif;
				if (hash('sha512', $_SESSION['login_token1'].$row->password2.$_SESSION['login_token2']) == mysqli_real_escape_string($GLOBALS['con'], trim($_POST['login_pwd']))) :
					$_SESSION['user_id'] = $row->id;
					$_SESSION['logged_in'] = true;
					$_SESSION['username'] = mysqli_real_escape_string($GLOBALS['con'], trim($_POST['user_id']));
					$_SESSION['user_first_name'] = $row->first_name;
					$_SESSION['user_last_name'] = $row->last_name;
					$_SESSION['active_event'] = $row->active_event;
					$_SESSION['rand_key'] = generate_random_string(32);
					$_SESSION['delegate'] = $row->delegate;
					write_log('I', $_SESSION['user_id'], 'User '.$_SESSION['user_first_name'].' '.$_SESSION['user_last_name'].' logged on');
					if ($_POST['remember_me'] == 1) :
						echo "<SCRIPT>setCookie('MitzvahPlanner_UserEmail','".$_SESSION['username']."',180);</SCRIPT>";
					else :
						echo "<SCRIPT>setCookie('MitzvahPlanner_UserEmail','".$_SESSION['username']."',-180);</SCRIPT>";
					endif;
					echo "<SCRIPT>";
					echo "setCookie('MitzvahPlanner_Customer','true',9999);";
					echo "window.location.href = 'index.php?IX=ez_guide'";
					echo "</SCRIPT>";
				else :
					$err_login = 'Invalid login credentials!';
					$err_flag = true;
					$form_user_id = 'Enter user ID (email)';
				endif;
			else :
				$err_login = 'Invalid login credentials!';
				$err_flag = true;
				$form_user_id = 'Enter user ID (email)';
			endif;
		endif;
	else:
		if ($_COOKIE['MitzvahPlanner_UserEmail'] > '') :
			$remember_me = 'checked="checked"';
			$form_user_id = $_COOKIE['MitzvahPlanner_UserEmail'];
		else :
			$remember_me = '';
			$form_user_id = 'Enter user ID (email)';
		endif;
	endif;

	function show_login_form_error($err_text)
	{
		if (!empty($err_text)) :
			echo '<br /><div class="login_form_error">'.$err_text.'</div>';
		endif;
	}
	
?>

<script>
	validate = function(jqForm, options)
	{
		var form = jqForm[0]; 
		if (form.login_pwd.value) 
		{
			$.ajax({
				url: "ajax.php?call=login_tokens&email=" + encodeURIComponent(form.user_id.value),
				cache: false,
				dataType: "json",
				async: false,
				success: function(json) {
						if (json.salt > ' ')
						{
							form.login_pwd.value = json.token1 + CryptoJS.SHA512(json.salt + form.login_pwd.value) + json.token2;
						}
						else
						{
							form.salt2.value = json.salt2;
							form.pwd_new_sha.value = CryptoJS.SHA512(json.salt2 + form.login_pwd.value);
							form.login_pwd.value = json.token1 + MD5(form.login_pwd.value) + json.token2;
						}
				}
				 ,error: function (request, status, error) { /* alert("Login form error!  Please contact technical support and provide them with the following information: Status: " + status + ", Error: " + error); */ }
			})
			if (form.salt2.value)
			{
				form.login_pwd.value = MD5(form.login_pwd.value);
			}
			else
			{
				form.login_pwd.value = CryptoJS.SHA512(form.login_pwd.value);
			}
		}
		return true;
	}
</script>

<form style="" name="frm_login" id="frm_login" method="post" action="mod/_pagetop_form_login.php">
	<div style="float:right; width:325px; margin-right:5px; background-color:#cbdfdc; border-radius:3px; padding:12px 16px;">
		<input name="ajax_login_submitted" type="hidden" value="1" />
		<input name="salt2" id="salt2" type="hidden" value="" />
		<input name="pwd_new_sha" id="pwd_new_sha" type="hidden" value="" />
		<input class="login_text" name="user_id" style="width:190px;" id="user_id" type="text" maxlength="40" value="<?php echo $form_user_id; ?>" onblur="if (this.value == '') {this.value = 'Enter user ID (email)';}"  onfocus="if (this.value == 'Enter user ID (email)') {this.value = '';}"  />
		<input class="login_text" name="login_pwd_mask" style="width:110px; float:right;" id="login_pwd_mask" type="text" maxlength="150" value="Enter password" onfocus="$(this).hide(); $('#login_pwd').show(); $('#login_pwd').focus();"  />
		<input class="login_text" name="login_pwd" id="login_pwd" type="password" style="display:none; width:110px; float:right;" maxlength="160" value="" onblur="if (this.value == '') {$(this).hide(); $('#login_pwd_mask').show();}"   />
		<br />
		<a href="index.php?IX=pwd_reset" class="small_text">Forgot password?</a>
		<input name="remember_me" type="checkbox" value="1" <?php echo $remember_me; ?> style="" />
		<span style="font-size:11px; ">Remember me</span>
		<input type="submit" class="button_login" style="float:right;" value="Login" />
		<?php show_login_form_error($err_login) ?>
	</div>
</form>

<script language="javascript" type="text/javascript">
	var options = { 
		target:     '#div_login_form' ,
		beforeSerialize: validate
		}; 
	$('#frm_login').ajaxForm(options); 
</script>