<?php 
/*
+--------------------------------------------------------------------------
|   CubeCart v3.0.11
|   ========================================
|   by Alistair Brookbanks
|	CubeCart is a Trade Mark of Devellion Limited
|   Copyright Devellion Limited 2005 - 2006. All rights reserved.
|   Devellion Limited,
|   22 Thomas Heskin Court,
|   Station Road,
|   Bishops Stortford,
|   HERTFORDSHIRE.
|   CM23 3EE
|   UNITED KINGDOM
|   http://www.devellion.com
|	UK Private Limited Company No. 5323904
|   ========================================
|   Web: http://www.cubecart.com
|   Date: Thursday, 27th July 2006
|   Email: sales (at) cubecart (dot) com
|	License Type: CubeCart is NOT Open Source Software and Limitations Apply 
|   Licence Info: http://www.cubecart.com/site/faq/license.php
+--------------------------------------------------------------------------
|	login.php
|   ========================================
|	Admin Session Start	
+--------------------------------------------------------------------------
*/
include("../includes/ini.inc.php");
include("../includes/global.inc.php");
include_once("../classes/db.inc.php");
$db = new db();
include_once("../includes/functions.inc.php");
$config = fetchDbConfig("config");

include_once("../language/".$config['defaultLang']."/lang.inc.php");
$enableSSl = 1;
include_once("../includes/sslSwitch.inc.php");

$sessionDomain = substr($GLOBALS['rootRel'],0, strlen($GLOBALS['rootRel'])-1);
@ini_set("session.cookie_path",$sessionDomain);
if($glob['rootRel']=="/"){
    $sessionName = "ccSID";
} else {
    $sessionName = "ccSID-".md5($glob['rootRel']);
}

session_name($sessionName);
session_start();
$_SESSION['ccAdminPath'] = $GLOBALS['rootRel'];

if (isset($_POST['username']) && isset($_POST['password'])){

	$query = sprintf("SELECT adminId FROM ".$glob['dbprefix']."CubeCart_admin_users WHERE username = %s AND password = %s", $db->mySQLSafe($_POST['username']), $db->mySQLSafe(md5($_POST['password'])));
 
	$result = $db->select($query);
	
	// insert admin session log
	$data["username"] = $db->mySQLSafe($_POST['username']);
	$data["time"] = time();
	$data["ipAddress"] = $db->mySQLSafe($_SERVER['REMOTE_ADDR']);		
		if($result == TRUE) {
			$data["success"] = 1;
		} else {
			$data["success"] = 0;
		}	
	$insert = $db->insert($glob['dbprefix']."CubeCart_admin_sessions", $data);
	
	// if there is over max amount of login records delete last one
	// this prevents database attacks of bloating
	if($db->numrows("SELECT loginId FROM ".$glob['dbprefix']."CubeCart_admin_sessions")>250){
		$loginId = $db->select("SELECT min(loginId) as id FROM ".$glob['dbprefix']."CubeCart_admin_sessions");
		$db->delete($glob['dbprefix']."CubeCart_admin_sessions","loginId='".$loginId[0]['id']."'");
	}
	
	if($result == TRUE) {
		
		$_SESSION['ccAdmin'] = $result[0]['adminId'];
		
		// update no logins
		$increment['noLogins'] = "noLogins+1";
		$result = $db->update($glob['dbprefix']."CubeCart_admin_users", $increment, "adminId=".$result[0]['adminId'],$stripQuotes="");
		
		if(isset($_GET['goto']) && !empty($_GET['goto'])){
			header("Location: ".urldecode($_GET['goto']));
			exit;
		} else {
			header("Location: ".$GLOBALS['rootRel']."admin/index.php");
			exit;
		}
		
	} else {
		
		$msg = "<p class='warnText'>".$lang['admin']['other']['login_failed']."</p>";
	
	}
}
if(isset($_GET['email'])){
	$msg = "<p class='infoText'>".$lang['admin']['other']['new_pass_sent']." ".urldecode($_GET['email'])."</p>";
}
?>
<?php include("includes/header.inc.php"); ?>
<?php if(isset($msg)){ ?>
<?php echo stripslashes($msg); ?>
<?php
} elseif(!isset($_SESSION['ccAdmin']) && !isset($_POST['username']) && !isset($_POST['password'])){ ?>
<p class="infoText"><?php echo $lang['admin']['other']['no_admin_sess'];?></p>
<?php } elseif (isset($_POST['username']) && isset($_POST['password'])){ ?>
<p class="warnText"><?php echo $lang['admin']['other']['login_fail_2'];?></p>
<?php } ?>
<form action="<?php echo $GLOBALS['rootRel'];?>admin/login.php?goto=<?php echo $_GET['goto']; ?>" method="post" enctype="multipart/form-data" name="ccAdminLogin" target="_self">
<div style="margin: auto; width: 250px; padding-bottom: 10px;"><a href="index.php"><img src="<?php echo $GLOBALS['rootRel']; ?>admin/images/ccAdminLogo.gif" alt="" width="177" height="96" border="0" title="" /></a></div>
<table border="0" align="center" width="224" cellpadding="4" cellspacing="0" class="mainTable">
  <tr>
    <td colspan="2" class="tdTitle"><?php echo $lang['admin']['other']['login_below'];?></td>
    </tr>
  <tr>
    <td class="tdText"><?php echo $lang['admin']['other']['username'];?></td>
    <td><input name="username" type="text" id="username" class="textbox" value="<?php if(isset($_POST['username'])) echo $_POST['username']; ?>" /></td>
  </tr>
  <tr>
    <td class="tdText"><?php echo $lang['admin']['other']['password'];?></td>
    <td><input name="password" type="password" id="password" class="textbox" /></td>
  </tr>
  <tr>
    <td>&nbsp;</td>
    <td><a href="requestPass.php" class="txtLink"><?php echo $lang['admin']['other']['request_pass'];?></a> </td>
  </tr>
  <tr>
    <td>&nbsp;</td>
    <td>
	<input name="login" type="submit" id="login" value="<?php echo $lang['admin']['other']['login'];?>" class="submit" />
	</td>
  </tr>
</table>
</form>
<div style="margin: auto; width: 224px; padding-top: 10px; text-align: right;" class="copyText">Copyright <a href="http://www.devellion.com" target="_blank" class="txtLink">Devellion Limited</a> 2005.<br />All rights reserved.</div>
<?php include("includes/footer.inc.php"); ?>