<?php

include ('config.php');

if ($enablessl==1 and $_SERVER[HTTPS] != "on") {
	header('Location: https://'.$_SERVER[SERVER_NAME].$_SERVER[REQUEST_URI]);
	die ("Could not use non SSL mode");

};

if ($_REQUEST['logout'] == true) { 
	session_start(); 
	session_destroy(); 

	echo "<html>
<head>
<title>Thanks for using Inprotect software</title>
</head>
<body bgcolor=\"#FFFFFF\">
Thanks for using the Inprotect web interface.
<br>
<br>
Please visit <a href=\"http://www.inprotect.com\">Inprotect.com</a> for software updates.
</body>
</html>
";
	die(); 
} 


// Start the login session 
session_cache_limiter('none'); 
session_start(); 

if (!$_SESSION['user'] || !$_SESSION['pass']) { 

	// What to do if the user hasn't logged in 
	// We'll just redirect them to the login page. 
	header('Location: login.php'); 
	die(); 
} else { 
	// Check username and password agains the database. 
	$query = "SELECT count(*) as usercount FROM users WHERE pn_pass='$_SESSION[pass]' AND pn_uname='".mysql_escape_string($_SESSION[user])."'";
	$result = $dbconn->Execute($query) or die("Wrong username or password");
	list($num)= $result->fields;
	if (!$num) { 
		// If there were no matching users, show the login 

		header ("Login: http://".$_SERVER[SERVER_NAME]."/pn/Nessus/login.php"); 
		die ("User name or password is incorrect");
	}
} 
// All code/html below will only be displayed to authenticated users. 

$username=$_SESSION[user];

if ($useremail=="") {
	$query="SELECT pn_email from users where pn_uname='".mysql_escape_string($username)."'";
	$result=$dbconn->Execute($query);

	list($useremail)=$result->fields;
}

?>
