<?php

include('init.php');
include('libs/functions.php');

if (isset($_REQUEST['target'])) {
	$target = scrub_white_list(trim($_REQUEST['target']), 'INTERNALLINK');
	if(!is_readable($target)) {
		$target = "apps/index.php";
	}
//$target = scrub(trim($_REQUEST['target']));
}
else {
	$target = "apps/index.php";
}

if ($userID > 0) {
	//header("Location: $target");
}

$loggedin = 0;
$message = "";
$debug = "";

if (isset($_POST['user']) && isset($_POST['password'])) {

	$user = scrub_white_list($_POST['user'], 'USER');
	$password = $_POST['password'];

	$encpassword = md5("gingerbreadcookies".$password);

	//select statment
	$sql = "SELECT failed_login_attempt FROM tb_user WHERE username='$user' AND password='$encpassword'";
	$rs = $db->Execute($sql);
	//get counter
	$counter = $rs->fields('failed_login_attempt');


//if counter < 5 then do everything below
if ($counter < 5) {

		$sql = "SELECT value FROM APP_Config WHERE name = 'user_login_switch'";
		$rs = $db->Execute($sql);
		$switch = $rs->fields('value');
		$sql_admin_only = '';

	if ('off' == $switch) {
		$sql_admin_only = ' AND u.status = \'2\' ';	
	}

	$status = 0;

	$sql = "SELECT u.user_id, u.status, u.cs_id, c.temp_pass_exp, DATEDIFF ( DAY , c.last_password_change, GETDATE() ) AS d FROM tb_user u, tb_password_update c WHERE u.user_id=c.user_id $sql_admin_only AND u.username='$user' AND u.password='$encpassword' ;";
	$debug = $sql;
	$rs = $db->Execute($sql);


	$record_count = $rs->RecordCount();

	if ($record_count == 1) {
	$user_id = $rs->fields('user_id');
	$cs_id = $rs->fields('cs_id');
	$status = $rs->fields('status');
	$is_temp_exp = $rs->fields('temp_pass_exp');
	$days = $rs->fields('d');

	if ($days > 90) {
	$sql = "UPDATE tb_user SET status=7 WHERE user_id=$user_id";
	$rs = $db->Execute($sql);
	$status=7;
	}

	// normal active user
	if ($status == 1) {
		$_SESSION['userID'] = $user_id;
		$_SESSION['cs_id'] = $cs_id;
		$userID = $user_id;
		$_SESSION['username'] = $user;
		$_SESSION['status'] = $status;
		$loggedin = 1;
		$sql = "INSERT INTO tb_audit (user_id, event, event_date) VALUES ($user_id, 'User successfully logged in', getdate())";
		$rs = $db->Execute($sql);

		$sql = "UPDATE tb_user SET failed_login_attempt=0 WHERE user_id=$user_id";
		$rs = $db->Execute($sql);

		$sql = "UPDATE tb_user SET login_number  = login_number + 1 WHERE user_id=$user_id";
		$rs = $db->Execute($sql);
		
		$target = "apps/index.php";
		header("Location: $target"); 
		//echo $target;
	}

	else if ($status == 0) {
		$message = "<script>alert('You must confirm your email address before logging in')</script>";
	}
	else if ($status == 9) {
		$message = "<script>alert('Your account is under review. You will not be able to log in until your account is approved.')</script>";
	}

	// password expired & not temp expired
	else if ($is_temp_exp == 0 && $status == 7) {
		$_SESSION['userID'] = $user_id;
		$_SESSION['cs_id'] = $cs_id;
		$userID = $user_id;
		$_SESSION['username'] = $user;
		$_SESSION['status'] = $status;
		$loggedin = 1;
		$sql = "INSERT INTO tb_audit (user_id, event, event_date) VALUES ($user_id, 'User password expired', getdate())";
		$rs = $db->Execute($sql);
		
		$target = "change_password.php";
		header("Location: $target"); 
		
		//header("Location: change_password.php");
		//$target = "login.php";
	}
	// password expired  & temp expired
	else if ($is_temp_exp == 1 && $status == 7) {
		$_SESSION['userID'] = $user_id;
		$_SESSION['cs_id'] = $cs_id;
		$userID = $user_id;
		$_SESSION['username'] = $user;
		$_SESSION['status'] = $status;

		$sql = "INSERT INTO tb_audit (user_id, event, event_date) VALUES ($user_id, 'User temporary password expired', getdate())";
		$rs = $db->Execute($sql);

		?>
			<script>
				if (confirm("Your previously sent temporary password has expired.\n\nPlease request a new one on the 'I forgot my username/password' page.")){
					window.location = "forgotpassword.php";
				}
				else {
					window.location = "login.php";
				}
			</script>
		<?
		$target = "forgotpassword.php";
		//header("Location: $target"); 
		
		//header("Location: change_password.php");
		//$target = "login.php";
	}
	else if ($status == 6) {
		$message = "<script>alert('Your account has been locked. Please contact the VRSS support team.');</script>";
	}

	}
		else {
			if ('off' == $switch) {
				$message = "<script>alert('The Veterans Re-Entry Search Service is currently closed.(If you are an admin, please use valid admin userid/password')</script>";	
			} else {
				$message = "<script>alert('You have entered an invalid Username or Password. ');</script>";
				//SQL update failed_login_attempt 
				$sql = "UPDATE tb_user SET failed_login_attempt  = failed_login_attempt + 1 WHERE username='$user'";
				$rs = $db->Execute($sql);
			}
		}
		
	} 
	else {
		$message = "<script>alert('Your account has been locked. Please contact the VRSS support team.');</script>";;	
		$sql = "UPDATE tb_user SET status  = 6 WHERE username='$user'";
		$rs = $db->Execute($sql);
	}
}



if ($loggedin <> 1) {
print_header('OnLoad="login_form.user.focus()"');

?>

<!--
<?echo $debug;?>
-->

<div id="login" align="center" style="border: thin solid; margin-left: auto; margin-right: auto; width: 500px; padding: 25px 25px 25px; ">

<?echo $message;?>

<h2 align="center">Please enter your username and password to login</h2>

<FORM NAME="login" id="login_form" ACTION="login.php" METHOD="POST">
<input type="hidden" name="target" value="<?echo $target;?>">
<table width="400" align="center" cellpadding="3" cellspacing="3">
<tr>
<td><b><label for="user">
Username</label>:</b>
</td>
<td>
<input type="text" name="user" id="user" size="16" maxlength="16" class="largetext" />
</td>
</tr>
<tr>
<td><b><label for="password">
Password</label>:
</b>
</td>
<td>
<input type="password" name="password" id="password" size="17" maxlength="16" class="largetext" />
</td>
</tr>
</table>

<BR>
<p align=center><input type="submit" value="Login"  /></p>
<div style="margin-left: auto; margin-right: auto; width: 400px; font-size: 12px;  text-align:center;">
<center>
<b><a href="account_option.php">Register a new account</a>&nbsp;|&nbsp;<a href="forgotpassword.php">I forgot my username/password</a>
<br><br><br>
<a href="https://test.vrss.domain/guides/VRSS_UserGuide_v1-4.pdf" target="_blank">User Guide: CF/CS Users</a><br>
<a href="https://test.vrss.domain/guides/VRSS_Overview_20150212.mp4" target="_blank">Webinar: Introduction to VRSS</a></b>
</center>
</div>

</div>
</FORM>


<td valign="top" align="left" width="320">
<table cellspacing="0" cellpadding="0" width="320" border="1">
<tbody>
<tr>
<td width="320"><table cellspacing="0" cellpadding="0" width="320" border="0">
<tbody>
<tr>
<td width="320"><br /><ul>
<TABLE>
<TR><TD>
 <B>Need Help?</B>
<BR><BR>
<A HREF=support.php>Click here for Support</A>
<BR><BR>

<b><u>VA Health Resource Center Help Desk</u></b>
<br><b>Phone:</b> 1-800-983-0935
<br><b>Hours:</b> 7 AM - 5 PM (CST), Monday - Friday

<BR>
<BR>
<table width="135" border="0" cellpadding="2" cellspacing="0" title="Click to Verify - This site chose VeriSign SSL for secure e-commerce and confidential communications.">
<tr>
<td align="center" valign="top"><img alt="Click to Verify - This site chose VeriSign SSL for secure e-commerce and confidential communications." src="vcs_ss_v.png">
</td>
</td>
</tr>
<tr>
</table>
</table>
</TABLE>
</TABLE>


<?php

print_footer();
}

?>