<?
/* 
   This file is part of the 'Science Fair In A Box' project
   SFIAB Website: http://www.sfiab.ca

   Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
   Copyright (C) 2005 James Grant <james@lightbox.org>
   Copyright (C) 2007 David Grant <dave@lightbox.org>

   This program is free software; you can redistribute it and/or
   modify it under the terms of the GNU General Public
   License as published by the Free Software Foundation, version 2.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program; see the file COPYING.  If not, write to
   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
   Boston, MA 02111-1307, USA.
*/
?>
<?
require_once('common.inc.php');
require_once('account.inc.php');
require_once('user.inc.php');

function try_login($user, $pass) 
{
	/* Ensure sanity of inputs */
	/* User could be a username, or could be an email, check */
	if(!account_valid_user($user) && !account_valid_email($user)) {
		return false;
	}

	/* Don't check for a valid password, administrators can set any password they'd like, but
	 * there has to be a password */
	if(!strlen($pass)) {
		return false;
	}

	$user = mysql_real_escape_string($user);
	$q = mysql_query("SELECT id,password,deleted FROM accounts WHERE username='$user'");
	echo mysql_error();
	/*
	$q = mysql_query("SELECT id,username,password,year,deleted
				FROM users 
				WHERE username='$user'
				AND deleted='no'
				ORDER BY year DESC LIMIT 1");
	*/
	if(mysql_num_rows($q) < 1) return false;

	$r = mysql_fetch_assoc($q);

	/* See if the user account has been deleted */
	if($r['deleted'] == 'yes') return false;

	/* See if the password matches */
	if($r['password'] != $pass) return false;

	/* Login successful */
	return $r['id'];
}

/* Don't do any login stuff if they're already logged in */
if(isset($_SESSION['accounts_id'])) {
	/* They're already logged in, if they're not trying to logout, don't 
	 * let them see the login page */
	if($_GET['action'] != 'logout') {
		message_push(error(i18n('You are already logged in, please use the [Logout] link in the upper right to logout before logging in as different user')));
		header("location: user_main.php");
		exit;
	}
} 
 
 $notice=$_GET['notice'];

 $redirect = $_GET['redirect'];
 $redirect_data = $_GET['redirectdata'];

 switch($redirect) {
 case 'roleadd':
	$redirect_url = "&redirect=$redirect&redirectdata=$redirectdata";
	break;
 case 'roleattached':
 	$redirect_url = "&redirect=$redirect";
	break;
 default:
 	$redirect_url = '';
	break;
 }

/*
 switch($role) {
 case 'volunteer':
	// returns "notopenyet", "closed", or "open"
	$reg_open = user_volunteer_registration_status(); 
 	break;
 case 'committee':
	$reg_open = 'notpermitted';
	break;
 case 'judge':
	$reg_open = user_judge_registration_status();
	break;
 case 'fair':
 	$reg_open = 'notpermitted';
	break;
 case 'sponsor':
 	$reg_open = 'notpermitted';
	break;
 case 'parent': case 'alumni': case 'principal': case 'mentor':
 	/* Always open, because they could have been auto-created 
 	$reg_open = 'open';
	break;
 case 'student':
 default:
	 if($_GET['action']!="logout")
		exit;
	$reg_open = 'closed';
	break;
 }
*/

 if($_POST['action']== 'login' ) {

	$user = $_POST['username'];
	$pass = $_POST['password'];

	$accounts_id = try_login($user, $pass);
	if($accounts_id == false) {
		message_push(error(i18n("Invalid Email/Password")));
		header("location: user_login.php");
		exit;
	} 

	$a = account_load($accounts_id);

	/* Use the active conference to find the user id to load */
	/* FIXME: Need to be able to handle the case where there is no
	 * active conference, but one step at a time */
	$q = mysql_query("SELECT id FROM users WHERE accounts_id=$accounts_id AND conferences_id={$_SESSION['conferenceid']}");
	if(mysql_num_rows($q) == 0) {
		/* FIXME: this should probably just return false, but for now, see if there's an error */
		echo "No user for that conference";
		exit;
	} 
	if(mysql_num_rows($q) > 1) {
		echo "DATABASE ERROR: More than one user for account $accounts_id  conference {$_SESSION['conferenceid']}";
		exit;
	}
	$uid = mysql_fetch_assoc($q);
	$id = $uid['id'];

	$u = user_load($id);

	$_SESSION['name']="{$u['firstname']} {$u['lastname']}";
	$_SESSION['username']=$u['username'];
	$_SESSION['email']=$u['email'];
	$_SESSION['users_id']=$u['id'];
	$_SESSION['accounts_id']=$u['accounts_id'];
	$_SESSION['roles']=array_keys($u['roles']);
	$_SESSION['superuser'] = ($a['superuser'] == 'yes') ? 'yes' : 'no';

	/* Load the password expiry for each user role, and
	 * find the longest expiry, which is the one we'll use
	 * for this user to determine if the passwd has
	 * expired. */
	$longest_expiry = 0;
	foreach(array_keys($u['roles']) as $r) {
		$e = $config["{$r}_password_expiry_days"];
		if($e == 0) {
			/* Catch a never expire case. */
			$longest_expiry = 0;
			break;
		} else if($e > $longest_expiry) {
			$longest_expiry = $e;
		}
	}

	if($u['passwordset'] == '0000-00-00') {
		/* Force the password to expire */
		$_SESSION['password_expired'] = true;
	} else if($longest_expiry == 0) {
		/* Never expires */
		unset($_SESSION['password_expired']);
	} else {
		/* Check expiry */
		$expires = date('Y-m-d', strtotime("{$u['passwordset']} +$longest_expiry days"));
		$now = date('Y-m-d');
		if($now > $expires) {
			$_SESSION['password_expired'] = true;
		} else {
				unset($_SESSION['password_expired']);
		}
	}
	/* If password_expired == true, the main page (or any
	 * other user page) will catch this and require
	 * them to set a password */

	/* Call login functions for each role */
	foreach(array_keys($u['roles']) as $r) {
		if(is_callable("user_{$r}_login")) {
			call_user_func_array("user_{$r}_login", array($u));
		}
	}

//	mysql_query("UPDATE accounts SET lastlogin=NOW() 
//			WHERE id={$u['id']}");

		/* Setup multirole so a multirole user can switch if they want to
		 * without logging in/out */
/*		if(count($u['roes']) > 1) {
			$_SESSION['multirole'] = true;
		} else  {
			$_SESSION['multirole'] = false;
		}
*/
		/* See if there is a redirect, and do that instead of
		 * taking them to their main page */
/*		if($redirect != '') {
			switch($redirect) {
			case 'roleadd':
				if(!user_valid_role($multirole_data)) 
					$multirole_data = '';

				header("location: user_multirole.php?action=add&role=$multirole_data");
				exit;
			case 'roleattached':
				message_push(happy(i18n('The %1 role has been attached to your account', array($roles[$role]['name']))));
				message_push(notice(i18n('Use the [Switch Roles] link in the upper right to change roles while you are logged in')));
				header("location: {$role}_main.php");
				exit;
				
			}
		}
*/
	/* Is there a saved requesT_uri from a failed login attempt?, if so 
	 * take them there */
	if(array_key_exists('request_uri', $_SESSION)) {
		header("location: {$_SESSION['request_uri']}");
		unset($_SESSION['request_uri']);
		exit;
	}
	header("location: user_main.php");
	exit;

 } else if($_GET['action']=='logout') {
 	/* Session keys to skip on logout */
 	$skip = array('debug', 'lang', 'messages');

 	/* Do these explicitly because i'm paranoid */
	unset($_SESSION['name']);
	unset($_SESSION['username']);
	unset($_SESSION['email']);
	unset($_SESSION['users_id']);
	unset($_SESSION['accounts_id']);
	unset($_SESSION['roles']);
	unset($_SESSION['superuser']);

	/* Take care of anything else */
 	$keys = array_diff(array_keys($_SESSION), $skip);
	foreach($keys as $k) unset($_SESSION[$k]);

	message_push(notice(i18n("You have been successfully logged out")));
	header("Location: user_login.php{$redirect_url}");
	exit;

 } else if($_GET['action']=='recover') {
	send_header("Password Recovery",
			array("Login" => "user_login.php?role=$role"));

	$recover_link = "user_login.php?role=$role&action=recover";

	?>
	 <br />
	 <?=i18n('Password recovery will reset your password to a new random password, and then email you that password.  Enter your name and email address below, then click on the \'Reset\' button.  The name and email must exactly match the ones you used to register.  Sometimes the email takes a few minutes to send so be patient.')?><br />
	 <br />
	 <form method="post" action="user_login.php?role=<?=$role?>">
	 <input type="hidden" name="action" value="recoverconfirm" />
	 <table>
	 <tr><td>
	 <?=i18n("First Name")?>:</td><td><input type="text" size="20" name="fn" />
	 </td></tr>
	 <tr><td>
	 <?=i18n("Last Name")?>:</td><td><input type="text" size="20" name="ln" />
	 </td></tr>
	 <tr><td>
	 <?=i18n("Email")?>:</td><td><input type="text" size="20" name="email" />
	 </td></tr>
	 <tr><td colspan="2">
	 <input type="submit" value="<?=i18n("Reset my password")?>" />
	 </td></tr></table>
	 <br />
	 </form>
	 <br />
	<div style="font-size: 0.75em;">
	<?=i18n('If you didn\'t register using an email address and you have lost your password, please contact the committee to have your password reset.')?></div><br />
  	<?	
 }
 else if($_POST['action'] == "recoverconfirm")
 {
 	/* Process a recover */
	$email = $_POST['email'];
	if(user_valid_email($email)) {
		/* valid email address */
		$e = mysql_escape_string($email);
		$q=mysql_query("SELECT * FROM users WHERE (username='$e' OR email='$e') ORDER BY year DESC LIMIT 1");
		$r=mysql_fetch_object($q);
		if($r) {
			$fn = trim($_POST['fn']);
			$ln = trim($_POST['ln']);

			/* Check name match */
			if(strcasecmp($r->firstname, $fn)!=0  ||  strcasecmp($r->lastname, $ln)!=0) {
				message_push(error(i18n("The name you entered does not match the one in your account")));
				header("Location: user_login.php?role=$role");
				exit;
			}

			/* Reset the password, and force it to expire */
			$password = user_set_password($r->id, NULL);

			/* volunteer_recover_password, judge_recover_password, student_recover_password,
				committee_recover_password */
			email_send("{$role}_recover_password",
					$email, 
					array("FAIRNAME"=>i18n($config['fairname'])),
					array(	"PASSWORD"=>$password,
						"EMAIL"=>$email)
				);

			message_push(notice(i18n("Your password has been sent to your email address")));
			header("Location: user_login.php?role=$role");
			exit;
		} else {
			message_push(error(i18n("Could not find your email address for recovery")));
			header("Location: user_login.php?role=$role");
			exit;
		}
	}
	message_push(error(i18n("Email address error")));
	header("Location: user_login.php?role=$role");
	exit;
 }
 else
 {
	send_header("Login", array());

	$recover_link = "user_login.php?role=$role&action=recover";
	$new_link = "user_new.php?role=$role";

	?>
	 <form method="post" action="user_login.php?role=<?="$role$redirect_url"?>">
	 <input type="hidden" name="action" value="login" />
	 <table><tr><td>
	 <?=i18n("Email")?>:</td><td><input type="text" size="20" name="username" />
	 </td></tr><tr><td>
	 <?=i18n("Password")?>:</td><td><input type="password" size="20" name="password" />
	 </td></tr>
	 <tr><td colspan=2>
	 <input type="submit" value=<?=i18n("Login")?> />
	 </td></tr>
	 </table>
	 </form>

	<br />
	<div style="font-size: 0.75em;">
	<?=i18n("If you have lost or forgotten your password, or have misplaced the email with your initial password, please <a href=\"$recover_link\">click here to recover it</a>")?>.</div><br />
	<br />
<?
	switch($reg_open) {
	case 'notopenyet':
	        echo i18n("Registration for the %1 %2 has not yet opened",
				array(	$config['FAIRYEAR'],
					$config['fairname']),
					array("Fair year","Fair name")
			);
		break;
	case 'open':
		echo i18n("If you would like to register as a new {$roles[$role]['name']}, <a href=\"$new_link\">click here</a>.<br />");
		break;

	case 'closed':
                echo i18n("Registration for the %1 %2 is now closed",
				array(	$config['FAIRYEAR'],
					$config['fairname']),
					array("Fair year","Fair name")
		);
		break;
	case 'notpermitted':
	default:
		break;
	}

 }

 send_footer();
?>