<?PHP 
include ('config.php');

if ($enablessl==1 and $_SERVER[HTTPS] != "on") {
	header ('Location: https://'.$_SERVER[SERVER_NAME].$_SERVER[REQUEST_URI]);	
	die ("Non SSL mode is not supported");	
};


// Add slashes to the username, and make a md5 checksum of the password. 
$_POST['user'] = mysql_escape_string($_POST['user']); 
$_POST['pass'] = md5($_POST['pass']); 

$today=date("Ymd");

$query = "SELECT count(*) FROM users WHERE pn_pass='$_POST[pass]' AND pn_uname='$_POST[user]' and locked <5 and expire='' or pn_pass='$_POST[pass]' AND pn_uname='$_POST[user]' and locked <5 and  expire > '$today'";
$result=$dbconn->Execute($query) or die("Incorrect username or password."); 
list($num) = $result->fields; 

if (!$num) { 


	if ($_POST[user]<>"") {
        $query="update users set locked=locked+1 where pn_uname='$_POST[user]'";
        $result=$dbconn->execute($query);

	$log="insert into log (ip, username, action) values('$_SERVER[REMOTE_ADDR]','".mysql_escape_string($_POST[user])."','Failed login')";
	$result=$dbconn->execute($query_log);
                                                                                                                            
        $query="select locked, pn_email from users where pn_uname='$_POST[user]'";
        $result=$dbconn->execute($query);
        list ($locked, $lemail)=$result->fields;
                                                                                                                            
        if ($locked>=5) {
                                                                                                                            
        $msg="Inprotect account has been locked due to a number of bad login attempts, please urgently contact your system or security administrator.";
                        $subject="ATTENTION: Inprotect account locked";
                        mail($lemail, $subject, $msg);
                                                                                                                            
        $query = "select pn_email from users where admin='Y'";
        $result= $dbconn->execute($query);
        
$msg="Inprotect account for $_POST[user] ($lemail) has been locked due to a number of bad login attempts, it may indicate possible hack attempt.
                                                                                                                            
As an administrator you can unlock the account using Inprotect User Management page. You may also unlock the user account with the direct access to the Inprotect database.";
                        $subject="ATTENTION: Inprotect account locked";
                                                                                                                    
        while(!$result->EOF) {
        list($admemail)=$result->fields;
                                                                                                                            
                        mail($admemail, $subject, $msg);
                                                                                                                            
        $result->MoveNext();
	}
}
}



// When the query didn't return anything, 
// display the login form. 

echo "

<html>
<head>
<TITLE>Login Page</Title>
<style type=\"text/css\">
<!--
body         { font-family: Verdana; color: #666666; font-size: 10pt }
input       { color: #666666; font-family: Verdana; font-size: 10pt; font-weight: bold }


-->
</style>
</head>
<body bgcolor=\"#FFFFFF\">
<center>
<img src=\"images/logo-blue.png\" alt=\"Logo\">
<form action='$_SERVER[PHP_SELF]' method='post'>
<table summary=\"Enter login details\" border=\"0\" cellpadding=\"2\" cellspacing=\"2\" style=\"border-collapse: collapse; border: 1px solid #6797BF; padding: 0\">
<tr><td>
Username:
</td>
<td><input type=\"text\" name=\"user\"></td>
</tr>
<tr>
<td>Password:</td>
<td><input type=\"password\" name=\"pass\"></td>
</tr>
</table><br>
<input type='submit' value='User Login'>
</form>
<br>
</center>
</body>
</html>
";
} else { 

// Start the login session 
session_start(); 

// We've already added slashes and MD5'd the password 
$_SESSION['user'] = $_POST['user']; 
$_SESSION['pass'] = $_POST['pass']; 

$log="insert into log (ip, username, action) values('$_SERVER[REMOTE_ADDR]','".mysql_escape_string($_POST[user])."','Successfull login')";
$result_log=$dbconn->execute($query_log);

$query_log="update users set lastaccessed=now() where pn_uname='$_POST[user]'";
$result_log=$dbconn->execute($query_log);


// All output text below this line will be displayed 
// to the users that are authenticated. Since no text 
// has been output yet, you could also use redirect 
// the user to the next page using the header() function. 
// header('Location: page2.php'); 

//echo "<h1>Congratulations</h1>"; 
//echo "You're now logged in. Try visiting <a href='page2.php'>Page 2</a>."; 
header('Location: index.php'); 

} 

?>
