<?php

	if ($xfdc == "" && $nfid == "") {	$xfdc 	= $_GET['xfdc']; }
	if ($xfdc == "" && $nfid == "1") {	$xfdc 	= $_COOKIE["unidx"]; }

	// SESSION CHECK
	// echo "COOKIE : ".$_COOKIE["unidx"];
	// echo "<br>";
	// echo "GET : ".$xfdc;
	// echo "<br>";
	// if ($xfdc == $_COOKIE["unidx"]) { echo "EQUAL...!!!!"; }
	if ($xuid != 'covid19') {
	if ($xfdc != $_COOKIE["unidx"] || $xfdc == "") { // echo "NOT EQUAL"; 


?>
	<br><br><br><br><br>
	<div style="text-align:center;font-size: 25px;font-family:Tahoma;background-color: yellow;">
	<br><br><br><br><br>
	Security Alert
	<br><br>
	<img src='lock.png' border=0 />
	<br><br>
	<a href="./" class="alert-link">Login</a>
	<br><br><br><br><br>
	</div>

<?php
	exit(); } 	}
	
?>

<?php

include('config.php');

// USERS FILE

// Users have a user id (xuid) which is used on urls.
// each user has name, password and a role.
// Roles are described on file user_roles.php which contains form data handling rules.

// ADMIN

if ($xuid == "") {
	echo "USER FAIL";
	exit;
}	

	/* GET MAIN USER DATA */
	include('r_dbc.php');
	$sql = "select username,
					user_description,
					demo_user,
					lang,
					admins
				from members_det
				where username = '".$xuid."'";
	$result = mysqli_query($conn, $sql);
		if (mysqli_num_rows($result) > 0) {
		  while($row = mysqli_fetch_assoc($result)) {
			$usname 			= $row["username"];
			$user_description	= $row["user_description"];						
			$demo_user 			= $row["demo_user"];			
			$ulang 				= $row["lang"];			
			$admins_check		= $row["admins"];			
				}
			}
			mysqli_close($conn);


	$usprojects = "";
		/* GET USER PROJECTS */
		include('r_dbc.php');
		$sql = "select pids
					from members_projects
					where username = '".$xuid."'";
		$result = mysqli_query($conn, $sql);
			if (mysqli_num_rows($result) > 0) {
			  while($row = mysqli_fetch_assoc($result)) {
				$pidu 		= $row["pids"];
				$usprojects = $usprojects.",".$pidu;
					}
				}
				mysqli_close($conn);
				
	$usprojects = substr($usprojects,1);
	
		/* GET USER ROLE FROM MEMBERS_PROJECTS */
		include('r_dbc.php');
		$sql = "select m.user_role, r.role_description
					from members_projects m, members_roles r
					where m.user_role = r.user_role
					and m.pids = '".$pid."'
					and m.username = '".$xuid."'";
		$result = mysqli_query($conn, $sql);
			if (mysqli_num_rows($result) > 0) {
			  while($row = mysqli_fetch_assoc($result)) {
				$usrole				= $row["user_role"];
				$role_description	= $row["role_description"];						
					}
				}
				mysqli_close($conn);	

	
	/* GET MAIN USER CENTERS ACCESS */
	$user_cc = "";
	include('r_dbc.php');
	$sql = "select code_center
				from members_centers
				where username = '".$xuid."'
				and pid = '".$pid."'";
	$result = mysqli_query($conn, $sql);
		if (mysqli_num_rows($result) > 0) {
		  while($row = mysqli_fetch_assoc($result)) {
			$code_center 		= $row["code_center"];
			$user_cc	= $code_center."','".$user_cc;
				}
			}
			mysqli_close($conn);			

			if (strlen($code_center) > 0) {
			$user_cc	= substr("'".$user_cc,0,-2);
			$user_cc1 = "and c.code_center in (".$user_cc.")";
			$user_cc2 = "and g.code_center in (".$user_cc.")";
			$user_cc3 = "and r.code_center in (".$user_cc.")";
			$user_cc = "and code_center in (".$user_cc.")";	
			}
			// echo $user_cc;
			

	/* GET MAIN USER CATEGORIES ACCESS */
	$user_ct = "";
	include('r_dbc.php');
	$sql = "select code_categ
				from members_categs
				where username = '".$xuid."'
				and pid = '".$pid."'";
	$result = mysqli_query($conn, $sql);
		if (mysqli_num_rows($result) > 0) {
		  while($row = mysqli_fetch_assoc($result)) {
			$code_categ = $row["code_categ"];
			$user_ct	= $code_categ."','".$user_ct;
				}
			}
			mysqli_close($conn);			
			
			if (strlen($code_categ) > 0) {			
			$user_ct	= substr("'".$user_ct,0,-2);
			$user_ct1 = "and c.code_categ in (".$user_ct.")";	
			$user_ct2 = "and k.code_categ in (".$user_ct.")";	
			$user_ct3 = "and r.code_categ in (".$user_ct.")";	
			$user_ct = "and code_categ in (".$user_ct.")";	
			}
			// echo $user_ct;


$cookie_name = "xuid_ck";
$cookie_value = $xuid;
setcookie($cookie_name, $cookie_value, time() + (86400 * 30), "/"); // 86400 = 1 day

include('user_roles.php');
include('views.php');

?>