<?php

/*
	[SupeSite/X-Space] (C)2001-2006 Comsenz Inc.
	用戶登錄/退出處理

	$RCSfile: batch.login.php,v $
	$Revision: 1.26 $
	$Date: 2006/10/27 01:24:52 $
*/

include_once('./include/main.inc.php');

$action = empty($_GET['action'])?'':$_GET['action'];
if(empty($action)) exit('Access Denied');

if(postget('refer')) {
	$refer = postget('refer');
} else {
	if(!empty($_SERVER['HTTP_REFERER'])) {
		$refer = $_SERVER['HTTP_REFERER'];
	} else {
		$refer = geturl('action/site/type/panel');
	}
}

switch ($action) {
	case 'login':
		include_once(S_ROOT.'./include/common.inc.php');
		$cookietime = 0;
		if(!empty($_POST['cookietime'])) $cookietime = intval($_POST['cookietime']);
		if (submitcheck('loginsubmit')) {
			$password = md5($_POST['password']);
			$username = $_POST['username'];
			$query = $_SGLOBAL['db']->query('SELECT * FROM '.tname('members', 1).' WHERE username=\''.$username.'\' AND password=\''.$password.'\'');
			if($member = $_SGLOBAL['db']->fetch_array($query)) {
				if($member['secques']) {
					$title = '安全提問';
					$guidearr = array();
					include template('site_secques');
					exit;
				} else {
					dologin($member, $cookietime);
					exit;
				}
			} else {
				messagebox('error', 'login_error', geturl('action/login'));
			}
		} elseif (submitcheck('loginsubmit_secques')) {
			$password = $_POST['password'];
			$uid = intval($_POST['uid']);
			$secques = quescrypt($_POST['questionid'], $_POST['answer']);
			$query = $_SGLOBAL['db']->query('SELECT * FROM '.tname('members', 1).' WHERE uid=\''.$uid.'\' AND password=\''.$password.'\' AND secques=\''.$secques.'\'');
			if($member = $_SGLOBAL['db']->fetch_array($query)) {
				dologin($member, $cookietime);
				exit;
			} else {
				messagebox('error', 'login_error', geturl('action/login'));
			}

		}
		break;
	case 'logout':
		obclean();
		sclearcookie();
		setcookie('_refer', '');
		messagebox('ok', 'logout_succeed', rawurldecode($refer));
		break;
	default:
		break;
}

setcookie('_refer', '');
messagebox('ok', 'login_succeed', rawurldecode($refer));

function dologin($member, $cookietime) {
	global $_SGLOBAL, $refer;

	$query = $_SGLOBAL['db']->query('SELECT COUNT(*) FROM '.tname('userspaces').' WHERE uid='.$member['uid']);
	$havespace = $_SGLOBAL['db']->result($query, 0);

	$insertsqlarr = array(
		'uid' => $member['uid'],
		'groupid' => $member['groupid'],
		'username' => addslashes($member['username']),
		'password' => addslashes($member['password']),
		'secques' => $member['secques'],
		'timeoffset' => $member['timeoffset'],
		'dateformat' => $member['dateformat'],
		'havespace' => $havespace,
		'newpm' => $member['newpm']
	);
	replacetable('members', $insertsqlarr);

	$uid = $member['uid'];
	$password = $member['password'];
	$secques = $member['secques'];

	ssetcookie('sid', '', $cookietime);
	ssetcookie('auth', authcode("$password\t$secques\t$uid", 'ENCODE'), $cookietime);
	setcookie('_refer', '');
	messagebox('ok', 'login_succeed', rawurldecode($refer));
}

function quescrypt($questionid, $answer) {
	return $questionid > 0 && $answer != '' ? substr(md5($answer.md5($questionid)), 16, 8) : '';
}

?>