<?php
////////////////////////////////////////////////////////////////////////
// Breeze Website Builder
// Copyright EB Dynamics, Inc., Edward Lemmers, P.E.
// For licensing, see license.txt.
// Revised: 4/26/2010	ELL
// Added dictionary attack protection.
// Revised: 10/15/2011	ELL
// Added ability to lockout file manager for restricted users.
// Revised: 2/8/2012	ELL
// Added table prefix handling.
//
	$userid = $_REQUEST['userid'];
	$password = $_REQUEST['password'];

	include ("../connect/db_connection.php");
	include ("../connect/config.php");
	
	// If dictionary attack detected, just dump 'em. 
	$attempt_limit = CheckAttempts($userid, $bwb_link);
	if ($attempt_limit > 10)
	{
		LogAttempt($userid, $bwb_link);
		echo "You have exceeded the maximum number of login attempts.  Please contact your system administrator.";
		exit;
	}
		
	$query = "SELECT * FROM " . BWB_TABLE_PREFIX . "users WHERE `UserID` = '$userid'";
	$result = mysql_query($query, $bwb_link);
	$row = mysql_fetch_array($result);
	$num_results = mysql_num_rows($result);
	
	if ($num_results < 1)
	{
		LogAttempt($userid, $bwb_link);
		echo "There is no user by that name.   Click <a href='index.php'> here </a> to re-enter your user ID and password.";
		exit;
	}
		
	$access_level = $row["AccessLevel"];
	
	/////////////////////////////////////////////
	//Decrypt password for comparison:
	$enc_text = stripslashes($row["password"]);
	$key = stripslashes($row["UserID"]);
	
	//Convert key to codes and pad as necessary.
	for( $i = 0; $i < (strlen($enc_text))/2; $i++)
	{
		if ($i < strlen($key))
		{
			$c = $key{$i};
			$k[$i] = ord($c);
		}
		else
			$k[$i] = 65 + $i;
	}
	
	//Convert encrypted string to array of HEX uni-character codes.
	$j = 0;
	$q = 0;
	for( $i = 0; $i < strlen($enc_text); $i++)
	{
		if ($j == 0) {
			$c = $enc_text{$i};
			$j++;
		}
		else {
			$c = $c.$enc_text{$i};
			$e[$q] = hexdec($c);
			$q++;
			$j = 0;
		}
		
	}
	
	//Decrypt encrypted string with key to get original data.
	$decrypt_text = "";
	for( $i = 0; $i < (strlen($enc_text))/2; $i++)
   	{
   		$a[$i] = $e[$i] ^ $k[$i];
		$decrypt_text = $decrypt_text. chr($a[$i]);
   	}
	////////////////////////////////////////////////////
	
	$password_lookup = $decrypt_text;
	if ($password_lookup == $password)
	{
		session_start();
		$_SESSION['userid'] = $userid;
		$session = md5(session_id());
		$ip = $_SERVER['REMOTE_ADDR'];
		$query = "UPDATE `" . BWB_TABLE_PREFIX . "users` SET `Session`='$session', `IP`='$ip' WHERE `UserID` = '$userid'";
		$result = mysql_query($query, $bwb_link);
		CleanAttemptLog($bwb_link);
		LogAttempt($userid, $bwb_link, 1);
		
		if ($access_level == "restricted")
		{
			$query = "SELECT `option_value` FROM `" . BWB_TABLE_PREFIX . "options_selected` WHERE `option_name`='EnableFileManager'";
			$result = mysql_query($query, $bwb_link);
			$row = mysql_fetch_array($result);
			$enable_file_manager = $row["option_value"];
		}
		
		if (($access_level != "restricted") || ($enable_file_manager == 1))
			$_SESSION['enable_file_manager'] = "100";
		else
			$_SESSION['enable_file_manager'] = "0";
			
		header("Location: main.php");
	}
	else
	{
		LogAttempt($userid, $bwb_link);
		echo "Your password has not been confirmed.   Click <a href='index.php'> here </a> to re-enter your password.";
	}
	exit;
	
	//////////////////////////////////////////////////
	function CheckAttempts($userid, $link)
	{
		$ip = $_SERVER['REMOTE_ADDR'];
		$current_ts = date('Y-m-d H:i:s', time());
		$query = "SELECT * FROM " . BWB_TABLE_PREFIX . "login_attempts WHERE (`IP` = '$ip') AND (TIMESTAMPDIFF(MINUTE, `AttemptTimeStamp`, '$current_ts') < 60)";
		$result = mysql_query($query, $link);
		return (mysql_num_rows($result));
	}
	
	function LogAttempt($userid, $link, $sucess = 0)
	{
		$ip = $_SERVER['REMOTE_ADDR'];
		$query = "INSERT INTO " . BWB_TABLE_PREFIX . "login_attempts (`UserID`, `IP`, `Success`) VALUES ('$userid', '$ip', $sucess)";
		$result = mysql_query($query, $link);
	}
	
	function CleanAttemptLog($link)
	{
		$current_ts = date('Y-m-d H:i:s', time());
		$query = "DELETE FROM " . BWB_TABLE_PREFIX . "login_attempts WHERE (TIMESTAMPDIFF(DAY, `AttemptTimeStamp`, '$current_ts') > 7)";
		$result = mysql_query($query, $link);
	}
	
?>
