<?
/*
Authentication Module File for MySQL.
Author : Cyrus_X
Date : 16th July 2001
Revision : 1.01

Amended : Yaw
Date : February 05, 2002
Reivision : 1.02
*/
include("config.php");
include("db.php");
include("function.php");
session_start();
session_register("Transmarco");

function newsession($login,$password) {
	GLOBAL $Transmarco;
	if ($login!="" && $password!="") {
		$todaydate = date("Y-m-d H:i:s");
		$sql = "select * from usersession where login='admin'";
		$result = db_query($sql);
		if (!$result) {
			echo "<center>Unable to establish database connection.\n</center>"; exit;
		}
		if (db_numrows($result) < 1) {
			$newid = find_new_id("userid","usersession");
			$sql = "insert into usersession values('$newid','admin','7f2ababa423061c509f4923dd04b6cf1','',";
			$sql.= "'$todaydate','$todaydate','$todaydate','999999')";
			$result = db_query($sql);
		}
		$sql = "select * from usersession where login='$login'";
		$result = db_query($sql);
		if (db_numrows($result) >= 1) {
			$row = db_fetch_array($result,0);
			$UID = $row["userid"];
			if (!active($UID)) return("User Deactivated");
			if (md5($password) == $row["password"]) {
				srand((double)microtime()*1000000);
				$SessID=session_id();
				$SessID=magiccode($SessID);
				$todaydate=magiccode($todaydate);
				$sql = "update usersession set sid='$SessID',lastlogin='$todaydate',lastlogout='$todaydate' where login='$login'";
				$result = db_query($sql);

				#########################################
				# Registering the important session IDs #
				#########################################
				$Transmarco["SessID"] = $SessID;
				$Transmarco["uid"] = getuid($Transmarco['SessID']);
				$Transmarco["username"] = getusername($Transmarco['SessID']);
				$Transmarco["accesslevel"] = authenticate(0);
				$cookie_life = time() + 86400;
				setcookie('accesslvl', $Transmarco["accesslevel"], $cookie_life);
			} else {
				$sql = "select * from userdetail where userid='$UID'";
				$detailresult = db_query($sql);
				if (db_numrows($detailresult)==0) {
					$newudid = find_new_id("userdetailid","userdetail");
					$sql = "insert into userdetail (userdetailid,userid,counter) values ('$newudid','$UID','1')";
					db_query($sql);
				}
				/*
				else {
					$detail = db_fetch_array($detailresult,0);
					$counter = $detail["counter"] + 1;
					$sql = "update userdetail set counter='$counter' where userid='$UID'";
					db_query($sql);
				}
				*/
				return("Password Incorrect");
			}
		} else return("Login name incorrect");
	}
}

function authenticate($minlevel) {
	GLOBAL $Transmarco;
	$SessID = $Transmarco["SessID"];
	if ($SessID) {
		$todaydate = date("Y-m-d H:i:s");
		$sql = "update usersession set lastlogout='$todaydate' where sid='$SessID'";
		$result = db_query($sql);
		$sql = "select * from usersession where sid='$SessID'";
		$result = db_query($sql);
		if (!$result = db_query($sql)) { echo "An error occured.\n"; exit;}
		if (db_numrows($result) >= 1) {
			$row=db_fetch_array($result,0);
			if ($row["accesslevel"] >= $minlevel) return($row["accesslevel"] + 0);
			else Header("Location:unpriv.php");
		}
		else return($guestUID);
	} else return($guestUID);
}

function getuid($sesid) {
	GLOBAL $Transmarco;
	if ($sesid) {
		$sql = "select * from usersession where sid='$sesid'";
		$result = db_query($sql);
		if (db_numrows($result) != 0) {
			$row=db_fetch_array($result,0);
			return $row["userid"];
		}
		else return($guestUID);
	} else return($guestUID);
}

function getusername($sesid) {
	GLOBAL $Transmarco;
	if ($sesid) {
		$sql = "select * from usersession where sid='$sesid'";
		$result = db_query($sql);
		if (db_numrows($result) != 0) {
			$row=db_fetch_array($result,0);
			return ($row["login"]);
		}
		else return($guestName);
	} else return($guestName);
}

function logoff() {
	GLOBAL $Transmarco;
	$SessID = $Transmarco["SessID"];
	if ($SessID) {
		$todaydate = date("Y-m-d H:i:s");
		$sql = "update usersession set sid='',lastlogin='$todaydate',";
		$sql.= "lastlogout='$todaydate' where sid='$SessID'";
		$result = db_query($sql);
		unset($Transmarco);
		setcookie('accesslvl', 0);
		session_destroy();
	}
}

function active($UID) {
	$sql = "select * from userdetail where userid='$UID'";
	$result = db_query($sql);
	$row = db_fetch_array($result,0);
	if ($row["counter"] >= 5) {
		$sql = "update userdetail set active='no',counter='0' where userid='$UID'";
		db_query($sql);
		return false;
	}
	if ($row["active"]=="no") return false;
	return true;
}

function authfail() {
	Header("Location:unpriv.php");
}
?>
