<?php
/*
* date last modified 21-05-2014
* Copyright 2014 LocalsGuide LLC
* HTML Files - login.html.php
* Mysql Tables - tbl_admin
*/

function generateRandomString($length = 5) {
    $characters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
    $charactersLength = strlen($characters);
    $randomString = '';
    for ($i = 0; $i < $length; $i++) {
        $randomString .= $characters[rand(0, $charactersLength - 1)];
    }
    return $randomString;
}


if(isset($_POST['submit'])) {
	
	$password = trim($_POST['password']);
	if(strlen($password)==0) { $error = 'Enter Username and Password'; }
	
	$username = trim($_POST['username']);
	if(strlen($username)==0) { $error = 'Enter Username and Password'; }
	
	if($username && $password) {
				
		$select = "SELECT * FROM tbl_admin WHERE ad_username = '".mysqli_real_escape_string($con, $username)."' AND ad_password = md5('".mysqli_real_escape_string($con, $password)."')";
		$checkAdmin = mysqli_query($con, $select);											 
		if(mysqli_num_rows($checkAdmin) >0) {								
			$resAdmin = mysqli_fetch_array($checkAdmin);						
			$adminId = $resAdmin['admin_id'];
			$adminStatus = $resAdmin['status'];
			if($adminStatus == 'Active'){
				if(isset($_SESSION['app_id'])) {
					unset($_SESSION['app_id']);
					unset($_SESSION['launch']);
					unset($_SESSION['show_menu']);
				}
				
				$loginTime = date('Y-m-d H:i:s');
				
				// update login
				$updateLogin = mysqli_query($con, 'UPDATE tbl_admin SET last_login="'.$loginTime.'" WHERE admin_id='.$adminId);
				$ip = $_SERVER['REMOTE_ADDR'];
				//log the details
				mysqli_query($con, "INSERT INTO tbl_log_login (admin_id, date, ip) VALUES ('".$adminId."', '".$loginTime."', '".$ip."')");
				
				$_SESSION['admin'] = "AccessOK";
				$_SESSION['adminId'] = $adminId;									
				
				$_SESSION['type'] = $resAdmin['role'];
							
				// check for apps
				$_SESSION['show_menu'] = false;
				$_SESSION['launch'] = false;
						
				$_SESSION['adminusername'] = $resAdmin['ad_username'];
							
				if(isset($_SESSION['target_page']) &&  (strlen($_SESSION['target_page'])>0)) {		
						$pageExplode = explode('page=', trim($_SESSION['target_page']));					
						if(count($pageExplode)>1) {
								header("Location: index.php?page=".$pageExplode[1]);	
								exit();
						} else {
								header("Location: index.php?page=home");	
								exit();
						}
				} else {
					header("Location: index.php?page=home");	
					exit();
				}
			} else {
				$error = 'Your account has been disabled';
			}
			
		} else {
			$error = "Username / Password incorrect";
		}
	}
}

if(isset($_POST['forgot'])) {	
	
	$forgotEmail = trim($_POST['forgot_email']);
	if(strlen($forgotEmail)==0) { $errorFor = 'Enter your email'; }
	
	if(empty($errorFor)) {
		$chkUserRs = mysqli_query($con, "SELECT admin_id FROM tbl_admin WHERE email = '".$forgotEmail."'");
		if(mysqli_num_rows($chkUserRs)>0){
			//generate new password
			$newPass = generateRandomString();
			$newPassDb = md5($newPass);
			$update = mysqli_query($con, "UPDATE tbl_admin SET ad_password = '".$newPassDb."' WHERE email = '".$forgotEmail."'");
			if($update){
				mail($forgotEmail, SITE_NAME.' - New Password', 'Your new password is - '.$newPass);
				$success = 'New password has been sent to your email address';
			}
		}
	
		
	}
}

?>