<?php
////////////////////////////////////////////////////////////////////////
// Breeze Website Builder
// Copyright EB Dynamics, Inc., Edward Lemmers, P.E.
// For licensing, see license.txt.
// Created: 6/18/2009	ELL
// Revised: 2/8/2012	ELL
// Added table prefix handling.
	
	
	include ("check_session.php");
		
	$selected_page_name = $_REQUEST['selected_page_name'];
	$password = $_REQUEST['password'];
	
?>
<html>
<head>
<title>Breeze Website Builder</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<link rel="shortcut icon" href="images/favicon.ico" type="image/x-icon">

<link rel="stylesheet" href="manager.css" type="text/css">

<script language="javascript" src="js/hash.js" type="text/javascript"> </script>

<script language="javascript" type="text/javascript">
	function OpenHelpWindow()
	{
		window.open("http://breezewebsitebuilder.com/docs/cms/help.html#upgrade_db", "Help", "scrollbars=1,resizable=1,status=0,toolbar=0,menubar=0,location=0,height=700,width=800");
		document.getElementById("help").style.visibility="hidden";
		document.getElementById("help").style.display="none";
	}

	function SubmitLogin()
	{
		var password = document.getElementById("password_input").value;
		var hash = Sha256.hash(password);
		document.getElementById("password").value = hash;
		document.getElementById("password_input").value = '';
		document.forms["formLogin"].submit();
	}

function checkForEnter(e) {
	if (e.keyCode == 13) {
		SubmitLogin();	
	}
}
</script>

</head>

<body onLoad="document.getElementById('password_input').focus();">
<?php
	if (!$password)
	{
?>
        <form action="input_sql.php" method="post" enctype="multipart/form-data" name="formLogin">
        <p class="title" align="center">Please enter the password for the "admin" user account:</p>
        <p align="center"><input name="password_input" id="password_input" type="password" onKeyDown="checkForEnter(event);" /></p>
        <input type="hidden" name="password" id="password" />
        <p align="center"><input name="submit" type="button" value="Submit" onClick="SubmitLogin();" /></p>
        </form>
<?php
	}
	else
	{
		$query = "SELECT * FROM " . BWB_TABLE_PREFIX . "users WHERE `UserID` = 'admin'";
		$result = mysql_query($query, $bwb_link);
		$row = mysql_fetch_array($result);
		
		/////////////////////////////////////////////
		//Decrypt password for comparison:
		$enc_text = stripslashes($row["password"]);
		$key = stripslashes($row["UserID"]);
		
		//Convert key to codes and pad as necessary.
		for( $i = 0; $i < (strlen($enc_text))/2; $i++)
		{
			if ($i < strlen($key))
			{
				$c = $key{$i};
				$k[$i] = ord($c);
			}
			else
				$k[$i] = 65 + $i;
		}
		
		//Convert encrypted string to array of HEX uni-character codes.
		$j = 0;
		$q = 0;
		for( $i = 0; $i < strlen($enc_text); $i++)
		{
			if ($j == 0) {
				$c = $enc_text{$i};
				$j++;
			}
			else {
				$c = $c.$enc_text{$i};
				$e[$q] = hexdec($c);
				$q++;
				$j = 0;
			}
			
		}
		
		//Decrypt encrypted string with key to get original data.
		$decrypt_text = "";
		for( $i = 0; $i < (strlen($enc_text))/2; $i++)
		{
			$a[$i] = $e[$i] ^ $k[$i];
			$decrypt_text = $decrypt_text. chr($a[$i]);
		}
		////////////////////////////////////////////////////
		
		$decrypt_text = str_replace(BWB_SALT, '', $decrypt_text);
		$password_lookup = hash('sha256', $decrypt_text);
		if ($password_lookup == $password)
		{
?>
    <p class="title" align="center">Ugrade Database Tables</p>
    <form name="frmUdateSQL" method="post" action="run_sql.php">
     <table align="center" width="80%">
     <tr>
        <td colspan="3" align="center">
      <label>
        <textarea name="sql_string" id="sql_string" cols="100" rows="20"></textarea>
      </label>
        </td>
      </tr>
      <tr>
        <td align="center">
      <input type="submit" name="button" id="button" value="Submit">
        </td>
        <td align="center">
      <input type="button" name="Back" value="Back to Main Menu" onClick="window.location.href='main.php?mode=admin';">
        </td>
        <td align="center">
        <div id="help_button_sm" onClick="OpenHelpWindow();">
	    &nbsp;
      	</div>
        </td>
      </tr>
     </table>
    </form>
    <table width="80%" border="0" cellspacing="5" cellpadding="5" align="center">
      <tr>
        <td class="small_message" align="center">Open the file named "upgrade.sql" in a text editor such as Notepad and
        copy and paste the text into the window above.  Then click &quot;Submit&quot;.<br>
        Note: Each SQL command must be terminated by a semicolon ( ; ). Lines beginning with ( -- ) or ( // ) will be treated as comments.</td>
      </tr>
    </table>
    
<?php
		}
		else
			echo "Your password has not been confirmed.   Click <a href='input_sql.php'> here </a> to re-enter your password.";
	}
?>

</body>
</html>
