<?php # Script 16.8 - login.php
// This is the login page for the site.

require_once ('includes/config.inc.php'); 
include('../cmsAdmin/includes/settings.php');
$page_title = 'Login';
include ('includes/header.html');
$page = $_SESSION['lastvisitpage'];

if (isset($_POST['submitted'])) 
{
	require_once (MYSQL);
	// Validate the email address:
	if (!empty($_POST['username'])) 
	{
		$e = mysqli_real_escape_string ($dbc, $_POST['username']);
		// echo "$e";
	}
	else 
	{
		$e = FALSE;
		$strValidation .= 'You forgot to enter your username!<br />';
	}
	
	// Validate the password:
	if (!empty($_POST['password'])) 
	{
		$p = mysqli_real_escape_string ($dbc, $_POST['password']);

		// echo "$p";
		$p = sha1($p);
		// echo "$p";
	}
	else 
	{
		$p = FALSE;
		$strValidation .= 'You forgot to enter your password!<br />';
	}
	// echo sha1($p);
	if ($e && $p) 
	{ // If everything's OK.
		// Query the database:
		$q = "SELECT intUserID, strFirstName, intSecurityLevel FROM tblUsers WHERE strUsername='$e' AND strPassword='$p'";	
		// echo $q;

		$r = mysqli_query ($dbc, $q) or trigger_error("Query: $q\n<br />MySQL Error: " . mysqli_error($dbc));
		
		if (@mysqli_num_rows($r) == 1) 
		{ // A match was made.
			//update last login date
			$w = "UPDATE tblUsers set dateLastLogin = now() WHERE (strUsername='$e' AND strPassword='$p')";	

			// echo $w;
			$u = mysqli_query ($dbc, $w) or trigger_error("Query: $w\n<br />MySQL Error: " . mysqli_error($dbc));

			// Register the values & redirect:
			$_SESSION = mysqli_fetch_array ($r, MYSQLI_ASSOC); 
			$_SESSION['timeout'] = time();
			
			mysqli_free_result($r);
			mysqli_close($dbc);

			if ($page != "")
			{
				$url = BASE_URL . '..'.$page; // Define the URL:
			}	
			if ($page == "")
			{
				$url = BASE_URL . '../cmsAdmin/index.php'; // Define the URL:	
			}

			ob_end_clean(); // Delete the buffer.
			header("Location: $url");
			exit(); // Quit the script.
				
		}
		if (@mysqli_num_rows($r) > 1) 
		{ // No match was made.
			$strValidation .= 'More than one<br />';
		}
		if (@mysqli_num_rows($r) == 0) 
		{
			$strValidation .= 'Either the email address and password entered do not match those on file.<br />';	
		}
		
	}
	else 
	{ // If everything wasn't OK.
		$strValidation .= 'Please try again.<br />';
	}
	
	mysqli_close($dbc);

} // End of SUBMIT conditional.
?>
<div id="listing">
	<h1>Login</h1>
	<p>Your browser must allow cookies in order to log in.</p>

	<form action="login.php" method="post" id="postForm" class="padForm col-5">
	<?php
		if ($strValidation != "")
		{
			echo '<div class="error">'.$strValidation.'</div>';			
		}
	?>
		<label for="username">User Name (not email address):</label>
		<input type="text" name="username" id="username" title="Enter your username not your email address" />
		<label for="password">Password:</label>
		<input type="password" name="password" id="password" title="Enter your password." />

		<input type="submit" name="submit" value="Login" class="buttonsLINK" title="Click here to login." />
		 <a class="buttonsLINK" href="../" title="Click here to cancel logging in.">Cancel </a>
		<input type="hidden" name="submitted" value="TRUE" />
	
	</form>
</div>
<?php // Include the HTML footer.
include ('includes/footer.html');
?>
