<?php
////////////////////////////////////////////////////////////////////////
// Breeze Website Builder
// Copyright Silver Dolphin Solutions, LLC, Edward Lemmers, P.E.
// For licensing, see license.txt.
// Created: 6/18/2009	ELL
// Revised: 2/8/2012	ELL
// Added table prefix handling.
	
	
	include ("check_session.php");
		
	$password = $_REQUEST['password'];
	
?>
<!DOCTYPE html>
<html>
<head>
<title>Run SQL | Breeze Website Builder</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<link rel="shortcut icon" href="images/favicon.ico" type="image/x-icon">

<link rel="stylesheet" href="theme/<?php echo $theme; ?>/manager.css" type="text/css">

<style type="text/css">
#table_structure_upgrade_login_btn	{
	width:100px;
	position:inherit;
}
#upgrade_table_structures_heading	{	width:240px;	}
#help_button	{	left:200px;	}
</style>

<script language="javascript" src="js/hash.js" type="text/javascript"> </script>

<script language="javascript" type="text/javascript">
	window.parent.document.title = document.title;
	
	function OpenHelpWindow()
	{
		window.open("http://breezewebsitebuilder.com/docs/cms/help.html#upgrade_db", "Help", "scrollbars=1,resizable=1,status=0,toolbar=0,menubar=0,location=0,height=700,width=800");
		document.getElementById("help").style.visibility="hidden";
		document.getElementById("help").style.display="none";
	}

	function SubmitLogin()
	{
		var password = document.getElementById("password_input").value;
		var hash = Sha256.hash(password);
		document.getElementById("password").value = hash;
		document.getElementById("password_input").value = '';
		document.forms["formLogin"].submit();
	}

function checkForEnter(e) {
	if (e.keyCode == 13) {
		SubmitLogin();	
	}
}
</script>

</head>

<body <?php if (!$password) { ?>onLoad="document.getElementById('password_input').focus();"<?php } ?>>
<?php
	if (!$password)
	{
?>
        <form action="input_sql.php" method="post" enctype="multipart/form-data" name="formLogin" id="formLogin">
        <p class="title" align="center"><?php echo INSTALL_PLUGIN_PLEASE_ENTER_PASSWORD_FOR_ADMIN; ?>:</p>
        <p align="center"><input name="password_input" id="password_input" type="password" onKeyDown="checkForEnter(event);" /></p>
        <input type="hidden" name="password" id="password" />
        <p align="center">
        <table align="center" border="0"><tr><td>
        <div class='button_console' id="table_structure_upgrade_login_btn" onClick="SubmitLogin();"><span class='button_console_text'><?php echo LOGIN_LOGIN_BTN; ?></span></div>
        </td></tr></table>
        </p>
        </form>
<?php
	}
	else
	{
		$query = "SELECT * FROM " . BWB_TABLE_PREFIX . "users WHERE `UserID` = 'admin'";
		$result = $bwb_dbh->query($query);
		$row = $result->fetch(PDO::FETCH_ASSOC);
		
		/////////////////////////////////////////////
		//Decrypt password for comparison:
		$enc_text = stripslashes($row["password"]);
		$key = stripslashes($row["UserID"]);
		
		//Convert key to codes and pad as necessary.
		for( $i = 0; $i < (strlen($enc_text))/2; $i++)
		{
			if ($i < strlen($key))
			{
				$c = $key{$i};
				$k[$i] = ord($c);
			}
			else
				$k[$i] = 65 + $i;
		}
		
		//Convert encrypted string to array of HEX uni-character codes.
		$j = 0;
		$q = 0;
		for( $i = 0; $i < strlen($enc_text); $i++)
		{
			if ($j == 0) {
				$c = $enc_text{$i};
				$j++;
			}
			else {
				$c = $c.$enc_text{$i};
				$e[$q] = hexdec($c);
				$q++;
				$j = 0;
			}
			
		}
		
		//Decrypt encrypted string with key to get original data.
		$decrypt_text = "";
		for( $i = 0; $i < (strlen($enc_text))/2; $i++)
		{
			$a[$i] = $e[$i] ^ $k[$i];
			$decrypt_text = $decrypt_text. chr($a[$i]);
		}
		////////////////////////////////////////////////////
		
		$decrypt_text = str_replace(BWB_SALT, '', $decrypt_text);
		$password_lookup = hash('sha256', $decrypt_text);
		if ($password_lookup == $password)
		{
?>
    
    <table align="center" border="0"><tr><td>
    <div class="button_heading_sub_level_1" id="upgrade_table_structures_heading">
      <div class="button_heading_text_sub_level_1"><?php echo RUN_SQL_HEADING; ?></div><div class="button_heading_help" id="help_button" onClick="OpenHelpWindow();">&nbsp;</div></div>
    </td></tr></table>
    <form name="frmUdateSQL" id="frmUdateSQL" method="post" action="run_sql_shell.php">
     <table align="center" width="80%">
     <tr>
        <td align="center">
      <label>
        <textarea name="sql_string" id="sql_string" cols="100" rows="20"></textarea>
      </label>
        </td>
      </tr>
      <tr>
        <td align="center">
        <div class='button_console' id="table_structure_upgrade_login_btn" onClick="document.getElementById('frmUdateSQL').submit();"><span class='button_console_text'><?php echo SUBMIT_WORD; ?></span></div>
        </td>
      </tr>
     </table>
    </form>
    <table width="80%" border="0" cellspacing="5" cellpadding="5" align="center">
      <tr>
        <td class="small_message" align="center"><?php echo RUN_SQL_PASTE_SQL_MSG; ?><br>
        <?php echo RUN_SQL_SQL_COMMAND_DELIMITERS_NOTE; ?></td>
      </tr>
    </table>
    
<?php
		}
		else
			echo LOGIN_PASSWORD_NOT_CONFIRMED_1_MSG . " " . CLICK_WORD . " <a href='input_sql.php'> " . HERE_WORD . " </a> " . LOGIN_PASSWORD_NOT_CONFIRMED_2_MSG;
	}
?>

</body>
</html>
