<?

/*
FlexCMS (http://www.flexcms.com)
Flexible, Powerful, Affordable.

Contents of this file are protected by the copyright
notice found at http://www.flexcms.com/flex/pages/copyright.html,
and its usage is subject to the terms of the licensing agreement 
available at http://www.flexcms.com/flex/pages/license.html
*/



	// ========================================================================================
	// process login form
	// ========================================================================================

	$PageTitle = $MsgText[0][192];
	$BrowserTitle = $MsgText[0][192];
	$LocationBar = '<a href="'.$IndexURL.'">'.$MsgText[0][1].'</a> > '.$MsgText[0][192];
	
	
	//ReadFormArguments();
	//Global $FormArguments;
	
	$FormArguments['Username'] = str_replace('+++','/',$Arguments2);
	$FormArguments['Password'] = str_replace('+++','/',$Arguments3);
	$FormArguments['ReturnTo'] = $Arguments4;
	

	if ($FormArguments['Username'] != '' && $FormArguments['Password'] != '') {
	
		//$FormArguments['Username'] = strtolower($FormArguments['Username']);

		DBConnect();
	
		//query the database and validate the input from the login page
		//assign $result to do a lookup up in the database flexcms users table
		//where the username is equal to the database field username, validates password
		$query = "select * from `".$Settings['DBPrefix']."core-Users` where Username='".$FormArguments['Username']."' LIMIT 1";
		$result = mysql_query($query) or die (mysql_error());
		$row = mysql_fetch_array($result);
		
		// if any rows are returned, the username exists
		if (mysql_num_rows($result) != 0 && $FormArguments['Username'] == $row['Username']) {
			
			// encrypt the password
			//$FormArguments['password'] = crypt($FormArguments['password'],substr($FormArguments['password'],0,2));
			
			//$row = mysql_fetch_array($result);
			if ($row['Password'] == $FormArguments['Password'] && ($row['Verified'] == 'y' || $Settings['VerifyEmails'] != 'y')) {
			
					if ($row['LastFailedLogin']+10 > GetTimestamp()) {
						sleep($row['LastFailedLogin'] + 10 - GetTimestamp());
					}
				
					$query = "update `".$Settings['DBPrefix']."core-Users` set SessionLength='10', LastFailedLogin='0', ResetCode='', ShoppingCartContents='".$HTTP_COOKIE_VARS[$CookieName.'Cart']."' where Username='".$FormArguments['Username']."' LIMIT 1";
					$result = mysql_query($query) or die (mysql_error());
					
					$IPAddress = $HTTP_SERVER_VARS["REMOTE_ADDR"];
					
					$query = "delete from `".$Settings['DBPrefix']."core-RecentActivity` where User='".$FormArguments['Username']."'";
					$result = mysql_query($query) or die (mysql_error());
					
					$query = "update `".$Settings['DBPrefix']."core-RecentActivity` set User='".$row['Username']."', Name='".addslashes($row['DisplayName'])."', LastLocation='/login-submit-nf', UserOrGuest='u' where User='".$IPAddress."' LIMIT 1";
					$result = mysql_query($query) or die (mysql_error());
					
					
					ob_start();
				
						$CookieData = $FormArguments['Username'] . '==' . $FormArguments['Password'];
						
						setcookie ($CookieName, $CookieData, 0, '/');
						
						
						setcookie($CookieName.'Cart',false, 0, '/');
						
						
						if ($FormArguments['ReturnTo'] == '') {
							if ($Settings['DestAfterLogin'] != '') {
								header('Location: ' . $MainURL . '/' . $Settings['DestAfterLogin']);
							}
							else {
								header('Location: ' . $IndexURL);
							}
						}
						else {
							header('Location: ' . $MainURL . '/' . str_replace('+++','/',$FormArguments['ReturnTo']) . '.html');
						}
						
					ob_end_flush();
				
			}
			else if ($row['Password'] == $FormArguments['Password']) {
				// password correct but not yet verified
				
				$PageTitle = $MsgText[0][501];
				$PageContents = $MsgText[0][660];
				
				$Message = $MsgText[0][143]."\n\n".$MsgText[0][656]."\n\n".$MainURL."/register-verify/".$row['Email']."/".$row['ConfirmationCode']."\n\n\n\n".$MsgText[0][142].','."\n".$Settings['SiteName']."\n".$IndexURL;
				mail($row['Email'], $MsgText[0][143], $Message, 'From: "'.$Settings['SiteName'].'" <'.$Settings['ContactEmail'].'>','-f'.$Settings['ContactEmail']);
				
			}
			else{
				$query = "update `".$Settings['DBPrefix']."core-Users` set LastFailedLogin='".GetTimestamp()."' where Username='".$FormArguments['Username']."' LIMIT 1";
				$result = mysql_query($query) or die (mysql_error());
				
				if ($row['LastFailedLogin']+10 > GetTimestamp()) {
					sleep($row['LastFailedLogin'] + 10 - GetTimestamp());
				}
			
			 	$PageTitle = $MsgText[0][501];
				$PageContents = $MsgText[0][502].'<br><br><a href="'.$MainURL.'/login/'.$FormArguments['ReturnTo'].'">'.$MsgText[0][503].'</a><br><br><a href="'.$MainURL.'/lost_password.html">'.$MsgText[0][500].'</a>';
				
			}
		}
		// no rows returned, username doesn't exist
		else {
			sleep(5);
			
			$PageTitle = $MsgText[0][501];
			$PageContents = $MsgText[0][504].'<br><br><a href="'.$MainURL.'/login/'.$FormArguments['ReturnTo'].'">'.$MsgText[0][503].'</a><br><br><a href="'.$MainURL.'/lost_password.html">'.$MsgText[0][500].'</a>';
		}
	}
	// username and/or password empty
	else {
		sleep(5);
		
		$PageTitle = $MsgText[0][501];
		$PageContents = $MsgText[0][505].'<br><br><a href="'.$MainURL.'/login/'.$FormArguments['ReturnTo'].'">'.$MsgText[0][503].'</a><br><br><a href="'.$MainURL.'/lost_password.html">'.$MsgText[0][500].'</a>';	
	}
	

	// ========================================================================================




?>
