<?php
class protect{

var $errorMsg="";
var $showPage=false;

/*
**** @function: protect; Class Constructor
**** @include: the class configuration file: adminpro_config.php
**** @include: the class to access MySQL: mysql_dialog.php
**** if some var is passed, it will be an administrator page
**** makes the configuration vars public, starts a session and goes to checkSession()
*/
function protect(){
include("adminmotormarket/include/config.php");
include("adminmotormarket/include/db.class.php");
$this->accNoCookies=$globalConfig['acceptNoCookies'];
$this->dbhost=$globalConfig['dbhost'];
$this->dbuser=$globalConfig['dbuser'];
$this->dbpass=$globalConfig['dbpass'];
$this->dbase=$globalConfig['dbase'];
$this->tbl=$globalConfig['tbl'];
$this->tblID=$globalConfig['tblID'];
$this->tblUserName=$globalConfig['tblUserName'];
$this->tblUserPass=$globalConfig['tblUserPass'];
$this->tblIsAdmin=$globalConfig['tblIsAdmin'];
$this->tblUserGroup=$globalConfig['tblUserGroup'];
$this->tblAdminSessionID=$globalConfig['tblAdminSessionID'];
$this->tblLastLog=$globalConfig['tblLastLog'];
$this->tblemail=$globalConfig['tblemail'];
$this->inactiveMin=$globalConfig['inactiveMin'];
$this->loginUrl=$globalConfig['loginUrl'];
$this->logoutUrl=$globalConfig['logoutUrl'];
$this->enblRemember=$globalConfig['enblRemember'];
$this->cookieRemName=$globalConfig['cookieRemName'];
$this->cookieRemPass=$globalConfig['cookieRemPass'];
$this->cookieExpDays=$globalConfig['cookieExpDays'];
$this->isMd5=$globalConfig['isMd5'];
$this->errorPageTitle=$globalConfig['errorPageTitle'];
$this->errorPageH1=$globalConfig['errorPageH1'];
$this->errorPageLink=$globalConfig['errorPageLink'];
$this->errorNoCookies=$globalConfig['errorNoCookies'];
$this->errorNoLogin=$globalConfig['errorNoLogin'];
$this->errorInvalid=$globalConfig['errorInvalid'];
$this->errorDelay=$globalConfig['errorDelay'];
$this->errorNoAdmin=$globalConfig['errorNoAdmin'];
$this->errorNoGroup=$globalConfig['errorNoGroup'];
$this->errorCssUrl=$globalConfig['errorCssUrl'];
$this->errorCharset=$globalConfig['errorCharset'];
session_start();
$this->checkSession();
}
/*
**** @function: checkSession(called by class constructor or by checkLogin)
**** calls hasCookie() and checks if the $globalConfig['acceptNoCookies'] is true;
**** if no cookie was set and we do not accept that -> makes an error message; else:
**** checks if a session is active: if not -> checkPost() (checks if some post was sent);
**** if session exists, it checks if some $_POST['action']==logout -> makeLogout();
**** if not -> checkTime();
*/
function checkSession(){
if (!$this->hasCookie() && $this->accNoCookies && (@$_POST['action']!="login" || @$_GET)){
$this->errorMsg=1;
$this->makeErrorHtml();
}
else{
if (!@$_SESSION['adminID'] || !@$_SESSION['AdminSessionID']) {
$this->checkRemember();
}
elseif (@$_SESSION['adminID'] && @$_SESSION['AdminSessionID']) {
if (@$_POST['action']=="logout") {
$this->makeLogout();
}
else{
$this->checkTime();
}
}
}
}
/*
**** @function: hasCookie(called by checkSession())
**** checks if the client's browser has accepted the cookie of the active session;
**** if yes, it returns true;
**** if not -> it returns false;
*/
function hasCookie(){
if ( isset($_COOKIE[session_name()])) {
return true;
}
else {
return false;
}
}
/*
**** @function: makeLogout(called by checkSession())
**** sets MySQL Time Field=0 and AdminSessionID Field='';
**** closes the session and goes to logout page, if some $_POST['action']="logout" was sent;
*/
function makeLogout(){
$db=new DB( $this->dbase, $this->dbhost, $this->dbuser, $this->dbpass);
$SQL="UPDATE ".$this->tbl." SET ";
$SQL.=$this->tblLastLog."= 0, ";
$SQL.=$this->tblAdminSessionID."='' ";
$SQL.="WHERE ".$this->tblID."='".$_SESSION['adminID']."'";
$query = $db->query($SQL);
if ($this->enblRemember && isset($_COOKIE[$this->cookieRemName]) && isset($_COOKIE[$this->cookieRemPass])){
setcookie($this->cookieRemName,$_COOKIE[$this->cookieRemName],time());
setcookie($this->cookieRemPass,$_COOKIE[$this->cookieRemPass],time());
}
session_destroy();
header ("Location: ".$this->logoutUrl);
}
/*
**** @function: checkTime(called by checkSession())
**** gets the time of the last page access from the database;
**** compares this time with the time now. If the elapsed minutes>inactiveMin (configuration);
**** or the session ID has changed (by some second login) -> it creates an error page
**** if not -> sets the time now in the MySQL Time Field and goes to checkAdmin();
*/
function checkTime(){
$db=new DB( $this->dbase, $this->dbhost, $this->dbuser, $this->dbpass);
$SQL="SELECT UNIX_TIMESTAMP(".$this->tblLastLog.") as lastLog FROM ".$this->tbl;
$SQL.=" WHERE ".$this->tblID."=".$_SESSION['adminID']." AND ".$this->tblAdminSessionID."='".$_SESSION['AdminSessionID']."'";
$query = $db->query($SQL);
$data=$db->fetchNextArray($query);
$nowtime=time();
$inactiveSec=$nowtime-$data['lastLog'];
if ($inactiveSec/60>$this->inactiveMin) {
$this->errorMsg=2;
$this->makeErrorHtml();
}
else {
$SQ="UPDATE ".$this->tbl." SET ";
$SQ.=$this->tblLastLog."= now() ";
$SQ.="WHERE ".$this->tblID."='".$_SESSION['adminID']."'";
$db->query($SQ);
$this->checkAdmin();
}
}
/*
**** @function: checkAdmin (called by checkTime())
**** checks if the page is an administrator page. If not -> checkGroup();
**** if yes -> gets the value from the MySQL Admin Field (1=admin,-1=normal user);
**** if the value==1 -> showPage() else -> it creates an error page;
*/

function checkAdmin(){

	$db=new DB( $this->dbase, $this->dbhost, $this->dbuser, $this->dbpass);
	$SQL="SELECT ".$this->tblIsAdmin." as isAdmin FROM ".$this->tbl;
	$SQL.=" WHERE ".$this->tblID."=".$_SESSION['adminID']." AND ";
	$SQL.=$this->tblAdminSessionID."='".$_SESSION['AdminSessionID']."'";
	$query = $db->query($SQL);
	$data=$db->fetchNextArray($query);
	if ($data['isAdmin']==-1){
	$this->errorMsg=3;
	$this->makeErrorHtml();
	}
	elseif ($data['isAdmin']==1){
	$this->checkGroup();
	}

}
/*
**** @function: checkGroup (called by checkAdmin())
**** checks if the page is belongs only to some user group. If not -> showPage();
**** if yes -> gets the user's group number from the MySQL User Group Field;
**** if the group is the same-> showPage() else -> it creates an error page;
*/
function checkGroup(){

	$db=new DB( $this->dbase, $this->dbhost, $this->dbuser, $this->dbpass);
	$SQL="SELECT ".$this->tblUserGroup." as userGroup, ";
	$SQL.=$this->tblIsAdmin." as isAdmin";
	$SQL.=" FROM ".$this->tbl;
	$SQL.=" WHERE ".$this->tblID."=".$_SESSION['adminID']." AND ";
	$SQL.=$this->tblAdminSessionID."='".$_SESSION['AdminSessionID']."'";
	$query = $db->query($SQL);
	$data=$db->fetchNextArray($query);
	$G_array = explode("/", $_SERVER[SCRIPT_NAME]);
	$G_num = count($G_array);
	$access = $this->has_access_group($data['userGroup'], $G_array[$G_num-1]);
	if (!$access){
	$this->errorMsg=4;
	$this->makeErrorHtml();
	}
	else{
	$this->showPage();
	}

}




/*
**** @function: has_access_group (called by checkGroup())
*/

function has_access_group($groupID, $fileName){
	$db=new DB( $this->dbase, $this->dbhost, $this->dbuser, $this->dbpass);
	$sql = $db->query("SELECT id from u_admin_file_to_groups WHERE groupID = '".$groupID."' and fileName = '".$fileName."'");
	if($res = $db->numRows($sql)){
		return true;
	}else{
		return false;
	}
}

/*
**** @function: checkRemember (called by checkSession() if no session is active)
**** checks if some username + password cookies were set and if we have this function enabled;
**** If not -> checkPost()
**** if yes -> it updates the MySQL table, registers the Session vars -> checkSession()
*/
function checkRemember(){
if ($this->enblRemember && isset($_COOKIE[$this->cookieRemName]) && isset($_COOKIE[$this->cookieRemPass])){
$db=new DB( $this->dbase, $this->dbhost, $this->dbuser, $this->dbpass);
$SQL="SELECT ".$this->tblID." as ID, ";
$SQL.=$this->tblUserName." as userName, ";
$SQL.=$this->tblUserPass." as userPass ";
$SQL.="FROM ".$this->tbl;
$SQL.=" WHERE ".$this->tblUserName."='".$_COOKIE[$this->cookieRemName]."'";
$query = $db->query($SQL);
$data=$db->fetchNextArray($query);

if ($this->isMd5!="1" && $data['userPass']){
$data['userPass']=md5($data['userPass']);
}

if ($_COOKIE[$this->cookieRemName]==$data['userName'] && $_COOKIE[$this->cookieRemPass]==$data['userPass']){
$SQL="UPDATE ".$this->tbl." SET ";
$SQL.=$this->tblLastLog."= now(), ";
$SQL.=$this->tblAdminSessionID."='".session_id()."' ";
$SQL.="WHERE (".$this->tblID."='".$data['ID']."')";
$query = $db->query($SQL);
$_SESSION['AdminSessionID']=session_id();
$_SESSION['adminID']=$data['ID'];
setcookie($this->cookieRemName,$_COOKIE[$this->cookieRemName],time()+(60*60*24*$this->cookieExpDays));
setcookie($this->cookieRemPass,$_COOKIE[$this->cookieRemPass],time()+(60*60*24*$this->cookieExpDays));
$this->checkSession();
}

}
else {
$this->checkPost();
}
}

/*
**** @function: checkPost (called by checkRemember())
**** checks if some $_POST was sent. If not -> it creates an error page
**** if yes -> checkLogin()
*/
function checkPost(){
if (!$_POST) {
$this->errorMsg=5;
$this->makeErrorHtml();
}
else {
$this->checkLogin();
}
}
/*
**** @function: checkLogin (called by checkPost())
**** checks if some $_POST['userName'] and $_POST['userPass'] and $_POST['action']="login" was sent;
**** If not -> it creates an error page;
**** if yes -> it compares the $_POST with the username and password on database;
**** if all ok -> showPage() else -> it creates an error page;
*/
function checkLogin(){
$db=new DB( $this->dbase, $this->dbhost, $this->dbuser, $this->dbpass);
$action=@$_POST['action'];
$userName=@$_POST['userName'];
if ($this->isMd5=="1"){
$userPass=md5(@$_POST['userPass']);
}
else {
$userPass=@$_POST['userPass'];
}
$SQL="SELECT ".$this->tblID." as ID, ";
$SQL.=$this->tblUserName." as userName, ";
$SQL.=$this->tblUserPass." as userPass ";
$SQL.="FROM ".$this->tbl;
$SQL.=" WHERE ".$this->tblUserName."='".$userName."' ";
$SQL.="and ".$this->tblUserPass."='".$userPass."'";
$query = $db->query($SQL);
$data=$db->fetchNextArray($query);
if ($action=="login" && ($userName || $userPass)){
if ($userName==$data['userName'] && $userPass==$data['userPass']) {
$SQL="UPDATE ".$this->tbl." SET ";
$SQL.=$this->tblLastLog."= now(), ";
$SQL.=$this->tblAdminSessionID."='".session_id()."' ";
$SQL.="WHERE (".$this->tblID."='".$data['ID']."')";
$query = $db->query($SQL);
$_SESSION['AdminSessionID']=session_id();
$_SESSION['adminID']=$data['ID'];
if ($this->enblRemember && @$_POST['userRemember']=="yes"){
setcookie($this->cookieRemName,@$_POST['userName'],time()+(60*60*24*$this->cookieExpDays));
setcookie($this->cookieRemPass,md5(@$_POST['userPass']),time()+(60*60*24*$this->cookieExpDays));
}
$this->checkSession();
}
}
if ($action=="login"){
if ($userName!=$data['userName'] || $userPass!=$data['userPass'] || $userName=="" || $userPass=="") {
$this->errorMsg=6;
$this->makeErrorHtml();
}
}
if ($action!="login") {
$this->errorMsg=6;
$this->makeErrorHtml();
}
}
/*
**** @function: makeErrorHtml
**** creates the error html page, if something went wrong;
**** sets MySQL Time Field=0 and AdminSessionID Field='' and closes the session;
*/
function makeErrorHtml() {
if ($_SESSION){
$db=new DB( $this->dbase, $this->dbhost, $this->dbuser, $this->dbpass);
$SQL="UPDATE ".$this->tbl." SET ";
$SQL.=$this->tblLastLog."= 0, ";
$SQL.=$this->tblAdminSessionID."='' ";
$SQL.="WHERE ".$this->tblID."='".$_SESSION['adminID']."'";
$query = $db->query($SQL);
}
if ($this->enblRemember && isset($_COOKIE[$this->cookieRemName]) && isset($_COOKIE[$this->cookieRemPass])){
setcookie($this->cookieRemName,$_COOKIE[$this->cookieRemName],time());
setcookie($this->cookieRemPass,$_COOKIE[$this->cookieRemPass],time());
}
session_destroy();
$error = $this->errorMsg;
header("location: ".$this->loginUrl.'?error='.$error);
}
/*
**** @function: showPage
**** makes the public var $showPage true, if everything was ok;
*/
function showPage(){
$this->showPage=true;
}
/*
**** @function: getUser
**** call it in your protected page, if you would like to display the username;
*/
function getUser(){

if ($this->showPage){
$db=new DB( $this->dbase, $this->dbhost, $this->dbuser, $this->dbpass);
$SQL="SELECT ".$this->tblUserName." as userName";
$SQL.=" FROM ".$this->tbl;
$SQL.=" WHERE ".$this->tblID."='".$_SESSION['adminID']."'";
$query = $db->query($SQL);
$data=$db->fetchNextArray($query);
return $data['userName'];
}
else {return false;}
}


function get_user_group(){
	$db=new DB( $this->dbase, $this->dbhost, $this->dbuser, $this->dbpass);
	$sql = $db->query("SELECT userGroup from ".$this->tbl." WHERE ".$this->tblID."='".$_SESSION['adminID']."'");
	$res = $db->fetchNextArray($sql);
return $res['userGroup'];
}

}
?>
