<?

/*
FlexCMS (http://www.flexcms.com)
Flexible, Powerful, Affordable.

Contents of this file are protected by the copyright
notice found at http://www.flexcms.com/flex/pages/copyright.html,
and its usage is subject to the terms of the licensing agreement 
available at http://www.flexcms.com/flex/pages/license.html
*/



// external check for user authentication and permission level

// function CheckUserAuth() returns: LoggedIn(y/n), UserLevel(0-100), CookieUsername, UserNumber, Permissions(array)
	
function CheckUserAuth() {
	
	if ($DBConnected != 'y') {
	
		include_once('./settings.php');
	
       		mysql_connect($DBServer, $DBUser, $DBPass) or die ("Could not connect to database");
	
        	mysql_select_db($DBDatabase) or die ("Could not select database");
		
		$DBConnected = 'y';
		
		
		$Settings['DBPrefix'] = $DBPrefix;
		
	}
	
	
	$query = "select * from `".$Settings['DBPrefix']."core-Settings`";
	$result = mysql_query($query) or die (mysql_error());
	while ($row = mysql_fetch_array($result)) {
		$Settings[$row['Name']] = $row['Value'];
	}
	
	
	
	$CookieName = $Settings['CookieName'];
	
	
	
	$CookieData = $_COOKIE[$CookieName];

	
	
	$LoggedIn = 'n';
	$UserLevel = 0;

	// if the cookie exists and isn't empty
	if ($CookieData != '' && $CookieData != 'not_logged_in') {

		// split the username and password out
		list ($CookieUsername, $CookiePassword) = split('==', $CookieData, 2);
	
		// if username and password are both not empty
		if ($CookieUsername != '' && $CookiePassword != '') {

			//query the database and validate the input from the login page
			//assign $result to do a lookup up in the database flexcms users table
			//where the username is equal to the database field username, validates password
			$query = "select RecordNumber,Level,Password,DisplayName,SessionLength from `".$Settings['DBPrefix']."core-Users` where Username='$CookieUsername' LIMIT 1";
			$result = mysql_query($query) or die (mysql_error());
		
			// if any rows are returned, the username exists
			if (mysql_num_rows($result) != 0) {
				
				$row = mysql_fetch_array($result);
				// check the password returned from the database against the one in the cookie
				if ($row['Password'] == $CookiePassword ) {
					// passwords match
					$LoggedIn = 'y';
					
					$UserLevel = $row['Level'];
					$UserNumber = $row['RecordNumber'];
					
	
					
					$query = "select Permissions from `".$Settings['DBPrefix']."core-Permissions` where Level=".$UserLevel." LIMIT 1";
    					$result = mysql_query($query) or die (mysql_error());
	
					$row = mysql_fetch_array($result);
	
					if ($row['Permissions'] == 'a') {
						for ($i = 1; $i <= 1000; $i++) {
							$Permissions[$i] = 'y';
						}
					}
					else {
						$PA = split('-',$row['Permissions']);
		
						for ($i = 0; $i < count($PA); $i++) {
							if ($PA[$i] > 0) {
								$Permissions[$PA[$i]] = 'y';
				
								if ($PA[$i] == 3) {
									$Permissions[18] = 'y';
									$Permissions[19] = 'y';
									$Permissions[20] = 'y';
								}
							}
						}
					}
					
									
				}
				else{
					// passwords don't match
				 	$LoggedIn = 'n';
				}
			}
			// no rows returned, username doesn't exist
			else {
				$LoggedIn = 'n';
			}
		}
	}
	
	
	
	if ($LoggedIn == 'y') {
		return array('y',$UserLevel,$CookieUsername,$UserNumber,$Permissions)	;
	}
	else {
		return array('n',0,'','','');
	}
	
}

?>