<?php
// $Id: index.php,v 1.46 2004/03/21 19:16:32 rcastley Exp $
/**
* Administrator index page
* @package Mambo Open Source
* @Copyright (C) 2000 - 2003 Miro International Pty Ltd
* @ All rights reserved
* @ Mambo Open Source is Free Software
* @ Released under GNU/GPL License: http://www.gnu.org/copyleft/gpl.html
* @version $Revision: 1.46 $
**/

define( "_VALID_MOS", 1 );

if (!file_exists( "../configuration.php" )) {
	header( "Location: ../installation/index.php" );
	exit();
}

require_once( "../configuration.php" );
require_once( "../classes/mambo.php" );
include_once ( $mosConfig_absolute_path."/language/".$mosConfig_lang.".php" );
$database = new database( $mosConfig_host, $mosConfig_user, $mosConfig_password, $mosConfig_db, $mosConfig_dbprefix );
$acl = new gacl_api();

if (isset( $_POST['submit'] )) {
	// escape and trim to minimise injection of malicious sql
	$usrname = $database->getEscaped( trim( mosGetParam( $_POST, 'usrname', '' ) ) );
	$pass = $database->getEscaped( trim( mosGetParam( $_POST, 'pass', '' ) ) );
	
	if (!$pass) {
		echo "<script>alert('Please enter a password'); document.location.href='index.php';</script>\n";
	} else {
		$pass = md5( $pass );
	}
	
	$database->setQuery( "SELECT COUNT(*)"
	. "\nFROM #__users"
	. "\nWHERE (usertype='administrator' OR usertype='superadministrator')"
	);
	$count = intval( $database->loadResult() );
	if ($count < 1) {
		echo "<script>alert(\""._LOGIN_NOADMINS."\"); window.history.go(-1); </script>\n";
		exit();
	}
	
	$database->setQuery( "SELECT * FROM #__users WHERE username='$usrname' AND block='0'" );
	$my = null;
	$database->loadObject( $my );
	
	// find the user group (or groups in the future)
	$grp = $acl->getAroGroup( $my->id );
	$my->gid = $grp->group_id;
	$my->usertype = $grp->name;
	
	if ($my->id) {
		if (strcmp( $my->password, $pass )
		|| !$acl->acl_check( 'administration', 'login', 'users', $my->usertype )) {
			echo "<script>alert('Incorrect Username, Password, or Access Level.  Please try again'); document.location.href='index.php';</script>\n";
			exit();
		}
		
		session_name( 'mosadmin' );
		session_start();
		
		$logintime = time();
		$session_id = md5( "$my->id$my->username$my->usertype$logintime" );
		$database->setQuery( "INSERT INTO #__session"
		. "\nSET time='$logintime', session_id='$session_id', "
		. "userid='$my->id', usertype='$my->usertype', username='$my->username'"
		);
		if (!$database->query()) {
			echo $database->stderr();
		}
		
		$_SESSION["session_id"] = $session_id;
		$_SESSION["session_user_id"] = $my->id;
		$_SESSION["session_username"] = $my->username;
		$_SESSION["session_usertype"] = $my->usertype;
		$_SESSION["session_gid"] = $my->gid;
		$_SESSION["session_logintime"] = $logintime;
		$_SESSION["session_userstate"] = array();
		
		session_write_close();
		// cannot using mosredirect as this stuffs up the cookie in IIS
		echo "<script>document.location.href='index2.php';</script>\n";
		exit();
	} else {
		echo "<script>alert('Incorrect Username and Password, please try again'); document.location.href='index.php';</script>\n";
		exit();
	}
} else {
?>
<?php echo "<?xml version=\"1.0\"?>\r\n"; ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title><?php echo $mosConfig_sitename; ?> :: Administration [Mambo Open Source]</title>
<meta http-equiv="Content-Type" content="text/html; <?php echo _ISO; ?>" />
<style type="text/css">
@import url(css/admin_login.css);
</style>
<script language="javascript" type="text/javascript">
	function setFocus() {
		document.loginForm.usrname.select();
		document.loginForm.usrname.focus();
	}
</script>
</head>
<body onload="setFocus();">
<div id="wrapper">
    <div id="header">
           <div id="mambo"><img src="images/mambo.gif" alt="MOS Logo" /></div>
    </div>
</div>
<div class="ctr">
	<div class="login">
    	<h1>Login</h1>
    	<div class="login-form">
        	<form action="index.php" method="post" name="loginForm" id="loginForm">
        	<div class="inputlabel">Username</div>
	    	<div><input name="usrname" type="text" class="inputbox" size="20" /></div>
        	<div class="inputlabel">Password</div>
	    	<div><input name="pass" type="password" class="inputbox" size="20" /></div>
        	<div align="left"><input type="submit" name="submit" class="button" value="Login" /></div>
        	</form>
    	</div>
    	<div class="login-text">
        	<p>Use the login and password fields opposite to gain access to the administration.</p>
        	<p>
        	If you did <u><strong>NOT</strong></u> install Mambo Open Source using the Web based
        	installer then please remember to change your 'admin' password and 'admin' e-mail address.
        	</p>
    	</div>
    	<div class="clr"></div>
        <div class="version"><?php echo "Version : "._RELEASE." "._DEV_STATUS." ("._DEV_LEVEL.")"; ?></div>
	</div>
</div>
<noscript>
!Warning! Javascript must be enabled for proper operation of the Administrator
</noscript>
</body>
</html>
<?php
}
?>
