<?php

include ('config.php');

$_POST[user]=mysql_escape_string($_POST[user]);

if ($enablessl==1 and $_SERVER[HTTPS] != "on") {
	header('Location: https://'.$_SERVER[SERVER_NAME].$_SERVER[REQUEST_URI]);
	die ("Could not use non SSL mode");

};

if ($_REQUEST['logout'] == true) {

session_start();
$query_log="insert into log (ip, username, action) values('$_SERVER[REMOTE_ADDR]','".mysql_escape_string($_SESSION['user'])."','Logout')";
$result_log=$dbconn->execute($query_log);

 
session_destroy(); 

header('Location: login.php');
die();

} 



// Start the login session 
session_start(); 

if (!$_SESSION['user'] || !$_SESSION['pass']) { 

// What to do if the user hasn't logged in 
// We'll just redirect them to the login page. 

header('Location: login.php'); 
die(); 

} else { 



// Check username and password agains the database. 
$today=date("Ymd");
                                                                                                                            
$query = "SELECT count(*) FROM users WHERE pn_pass='$_SESSION[pass]' AND pn_uname='".mysql_escape_string($_SESSION[user])."' and locked <5 and expire='' or pn_pass='$_SESSION[pass]' AND pn_uname='".mysql_escape_string($_SESSION[user])."' and locked <5 and  expire > '$today'";

$query_log="insert into log (ip, username, action) values('$_SERVER[REMOTE_ADDR]','".mysql_escape_string($_SESSION[user])."','Check user pass')";
$result_log=$dbconn->execute($query_log);

$result = $dbconn->Execute($query) or die("Wrong username or password");
list($num)= $result->fields;


if (!$num) { 
// If there were no matching users, show the login




if ($_POST[user]<>"") {
        $query="update users set locked=locked+1 where pn_uname='$_POST[user]'";
        $result=$dbconn->execute($query);
                                                                                                                            
        $query="select locked, pn_email from users where pn_uname='$_POST[user]'";
        $result=$dbconn->execute($query);
        list ($locked, $lemail)=$result->fields;
                                                                                                                            
        if ($locked>=5) {
                                                                                                                            
        $msg="Inprotect account has been locked due to a number of bad login attempts, please urgently contact your system or security administrator.";
                        $subject="ATTENTION: Inprotect account locked";
                        mail($lemail, $subject, $msg);
                                                                                                                            
        $query = "select pn_email from users where admin='Y'";
        $result= $dbconn->execute($query);
                                                                                                                            
        while(!$result->EOF) {
        list($admemail)=$result->fields;
                                                                                                                            
        $msg="Inprotect account for $_POST[user] ($lemail) has been locked due to a number of bad login attempts, it may indicate possible hack attempt.
                                                                                                                            
As an administrator you can unlock the account using Inprotect User Management page. You may also unlock the user account with the direct access to the Inprotect database.";
                        $subject="ATTENTION: Inprotect account locked";
                        mail($lemail, $subject, $msg);
                                                                                                                            
        $result->MoveNext();
	}
	}
	}


 
header ("Login: http://".$_SERVER[SERVER_NAME]."/demo/login.php"); 
die ("User name or password is incorrect");
} 
} 

// All code/html below will only be displayed to authenticated users. 
$username=$_SESSION[user];

$query = "update users set locked=0 where pn_uname='".mysql_escape_string($username)."'";
$result=$dbconn->execute($query);

if ($useremail=="") {

$query="SELECT pn_email from users where pn_uname='".mysql_escape_string($username)."'";
$result=$dbconn->Execute($query);

list($useremail)=$result->fields;

}


echo "<!DOCTYPE html PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\">
<head>
<TITLE>Inprotect - Nessus &amp; Nmap web interface</Title>
<style type=\"text/css\">
<!--
a:link       { font-family: Verdana; font-size: 10pt; color: #6797BF }
a:hover     { color: #6797BF; text-decoration: none; font-family: Verdana; font-size: 10pt }
a:visited    { color: #6797BF; font-family: Verdana; font-size: 10pt }
a:active     { color: #6797BF; font-family: Verdana; font-size: 10pt }
body         { font-family: Verdana; color: #666666; font-size: 10pt }
hr           { border: 1px solid #6797BF }
table        { font-family: Verdana; color: #666666; font-size: 10pt }
input       { color: #666666; font-family: Verdana; font-size: 10pt; font-weight: bold }
select       { color: #666666; font-family: Verdana; font-size: 10pt; font-weight: bold }


-->
</style>
<style type=\"text/css\">                                                                                                   
<!--    

.Navlink {COLOR: #808080; TEXT-DECORATION: none; font-family: arial; font-size: 10pt; font-weight: bold;}
a:link.Navlink  {color : #808080;}
a:visited.Navlink  {color : #808080;}
a:active.Navlink  {text-decoration: none;}
a:hover.Navlink  {text-decoration: none;}

-->
</style>
</head>


<BODY bgcolor=\"#FFFFFF\">
<img alt=\"Logo\"src=\"images/logo-blue.png\"><BR>";
echo "<HR color=\"#6797BF\" size=\"1\"><table summary=\"Main Screen Body\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\"><tr><td width=\"130\" valign=\"top\">
<script type=\"text/javascript\">
<!--

function LmOver(elem, clr)
{elem.style.backgroundColor = clr;
elem.children.tags('A')[0].style.color = \"#FFFFFF\";
elem.style.cursor = 'hand'}

function LmOut(elem, clr)
{elem.style.backgroundColor = clr;
elem.children.tags('A')[0].style.color = \"#808080\";}

function LmDown(elem, clr)
{elem.style.backgroundColor = clr;
elem.children.tags('A')[0].style.color = \"#FFFFFF\";}

function LmUp(path)
{location.href = path;}

//-->
</script>

<table summary=\"Menu\" border=\"0\" width=\"120\" bgcolor=\"#6797BF\" cellspacing=\"0\" cellpadding=\"0\">
<tr><td width=\"100%\">

<table summary=\"Menu Entries\" border=\"0\" width=\"100%\" cellspacing=\"1\" cellpadding=\"1\">
<tr><td width=\"100%\" onMouseover=\"LmOver(this, '#6797BF')\" onMouseout=\"LmOut(this, '#FFFFFF')\" onMouseDown=\"LmDown(this, '#6797BF')\" 
onMouseUp=\"LmUp('index.php')\" bgcolor=\"#FFFFFF\"><A HREF=\"index.php\" Class=\"navlink\">&nbsp; Home</a></td></tr>
<tr><td width=\"100%\" onMouseover=\"LmOver(this, '#6797BF')\" onMouseout=\"LmOut(this, '#FFFFFF')\" onMouseDown=\"LmDown(this, '#6797BF')\" 
onMouseUp=\"LmUp('control.php')\" bgcolor=\"#FFFFFF\"><A HREF=\"control.php\" Class=\"navlink\">&nbsp; Settings</a></td></tr>
<tr><td width=\"100%\" onMouseover=\"LmOver(this, '#6797BF')\" onMouseout=\"LmOut(this, '#FFFFFF')\" onMouseDown=\"LmDown(this, '#6797BF')\" 
onMouseUp=\"LmUp('scan.php')\" bgcolor=\"#FFFFFF\"><A HREF=\"scan.php\" Class=\"navlink\">&nbsp; Security Scan</a></td></tr>
<tr><td width=\"100%\" onMouseover=\"LmOver(this, '#6797BF')\" onMouseout=\"LmOut(this, '#FFFFFF')\" onMouseDown=\"LmDown(this, '#6797BF')\" 
onMouseUp=\"LmUp('reports.php')\" bgcolor=\"#FFFFFF\"><A HREF=\"reports.php\" Class=\"navlink\">&nbsp; Reports</a></td></tr>
<tr><td width=\"100%\" onMouseover=\"LmOver(this, '#6797BF')\" onMouseout=\"LmOut(this, '#FFFFFF')\" onMouseDown=\"LmDown(this, '#6797BF')\"
onMouseUp=\"LmUp('updates.php')\" bgcolor=\"#FFFFFF\"><A HREF=\"updates.php\" Class=\"navlink\">&nbsp; Updates</a></td></tr>
<tr><td width=\"100%\" onMouseover=\"LmOver(this, '#6797BF')\" onMouseout=\"LmOut(this, '#FFFFFF')\" onMouseDown=\"LmDown(this, '#6797BF')\" 
onMouseUp=\"LmUp('help.php')\" bgcolor=\"#FFFFFF\"><A HREF=\"help.php\" Class=\"navlink\">&nbsp; Help</a></td></tr>
<tr><td width=\"100%\" onMouseover=\"LmOver(this, '#6797BF')\" onMouseout=\"LmOut(this, '#FFFFFF')\" onMouseDown=\"LmDown(this, '#6797BF')\" 
onMouseUp=\"LmUp('index.php?logout=true')\" bgcolor=\"#FFFFFF\"><A HREF=\"index.php?logout=true\" Class=\"navlink\">&nbsp; Logout</a></td></tr>
</table>

</td></tr>
</table>
</td><td width=\"5\"></td><td width=\"1\" bgcolor=\"#6797BF\" height=\"300\"></td>
<td width=\"5\"></td><td valign=\"top\">
";
?>
