<?php
	/*
	** File: GENERATE_SID
	** Description: create an sid and create row in session table
	** Version: $Revision: 1.14 $
	** Created: 03/15/99
	** Author: Leon Atkinson
	** Email: leon@clearink.com
	** CVS Author: $Author: leon $
	** Last Revised: $Date: 1999/12/09 23:23:21 $
	**
	** Log : $Log: GENERATE_SID,v $
	** Log : Revision 1.14  1999/12/09 23:23:21  leon
	** Log : Changed ActionResults use so that it's an array instead of a
	** Log : continually-growing string.  Note the little function in standard_library
	** Log : for printing out all the action results.
	** Log :
	** Log : Revision 1.13  1999/11/13 01:20:42  leon
	** Log : More localization work.
	** Log :
	** Log : Revision 1.12  1999/11/04 21:35:29  leon
	** Log : Cleaned up the use of paths.  Paths are now all set in index.php3 as
	** Log : constants.  Example settings for Apache/Unix, Apache/Win32, and IIS.
	** Log :
	** Log : Revision 1.11  1999/10/05 23:39:38  leon
	** Log : Cleaned up loop that generates the sid, parameterized pool of characters
	** Log : and length of session ID.
	** Log :
	** Log : Revision 1.9  1999/10/05 18:31:57  leon
	** Log : Added locking to the seed table.  It's possible, however unlikely, that
	** Log : two processes could read the seed before either writes a new one, and
	** Log : then two people would have the same session ID.  It's unlikely because of
	** Log : the use of the digits off the microsecond clock, but just in case, I'm
	** Log : adding some locking.
	** Log :
	** Log : Revision 1.8  1999/08/20 20:03:12  leon
	** Log : Added support to allow checking out if you aren't logged in.  To do this,
	** Log : I added a column to the session table to track the ID of current invoice
	** Log : for the session.  Before, we were getting the current invoice by looking
	** Log : in the invoice table for an inactive invoice for the same user.  This
	** Log : doesn't work for anonymous sessions because they all have user=0.
	** Log :
	** Log : Note that the invoice column is now set or unset by LOGIN_USER and
	** Log : LOGOUT_USER.  If a session creates an invoice, then logs into an
	** Log : account that has an inactive invoice, the invoice the session already
	** Log : has will be preserved.
	** Log :
	** Log : The purgeInvoice function was changed to set Invoice=0 for any session
	** Log : that is associated with the invoice to be purged.
	** Log :
	** Log : Revision 1.7  1999/08/18 22:31:49  leon
	** Log : Returning opening PHP tag to XML-friendly tag
	** Log :
	** Log : Revision 1.6  1999/08/10 23:20:32  leon
	** Log : Changed autologin to be off by default and to use MD5 to obfuscate the
	** Log : password.  Had to add third parameter to getUserID to support encoded
	** Log : passwords.  Put constant definitions inside if statements so they aren't
	** Log : set unless necessary.
	** Log :
	** Log : Revision 1.5  1999/08/10 20:33:18  leon
	** Log : Added support for auto-login powered by cookies.  This is turned on and off
	** Log : with a constant (USE_AUTOLOGIN).  A side-effect was putting the
	** Log : functionality for checking a user's password into a function (getUserID).
	** Log :
	** Log : Revision 1.4  1999/07/28 19:27:13  leon
	** Log : Mass update based on code donation from a live project
	** Log :
	**
	** Copyright (c) 1999 Working Dogs.  All rights reserved.
	*/

	//include module for getting a User ID based on login/password
	include(APPLICATION_ROOT . "/modules/include/getUserID");

	/*
	** set seed from database because using a secret
	** seed is a little more secure than seconds on
	** the clock, which is very obvious
	*/
	
	//lock seed table
	$Query = "LOCK TABLES seed WRITE ";
	$DatabaseResult = mysql_query($Query, $DatabaseLink);

	$Query = "SELECT seed FROM seed";
	$DatabaseResult = mysql_query($Query, $DatabaseLink);
	list($seed)  = mysql_fetch_row($DatabaseResult);

	srand($seed);

	$seed = rand() + intval(substr(microtime(),2,4));

	$Query = "UPDATE seed SET seed = $seed";
	mysql_query($Query, $DatabaseLink);

	//unlock it so others can get the next seed
	$Query = "UNLOCK TABLES ";
	$DatabaseResult = mysql_query($Query, $DatabaseLink);


	//create the session identifier
	$sid = '';
	for($sid_n=0; $sid_n < SESSION_SIZE; $sid_n++)
	{
		$sid .= substr(SESSION_CHARACTERS, rand(0, SESSION_CHARACTERS_LEN-1), 1);
	}


	$tUserID = 0;

	//if using autologin, maybe we can log the user
	//in based on login/password stored in cookies
	if(USE_AUTOLOGIN)
	{
		//check for username/password from cookie
		$tUserID = getUserID($cookie_al, $cookie_ap, TRUE);

		if($tUserID > 0)
		{
			//get user info
			$UserInfo = GetUserInfo($tUserID);
			$ActionResults[] = "Welcome back, " . $UserInfo["FirstName"] . " " . $UserInfo["LastName"] . "!";
		
			//refresh cookies
			setcookie("cookie_al", $cookie_al, time()+AUTOLOGIN_LIFETIME);
			setcookie("cookie_ap", md5($cookie_ap), time()+AUTOLOGIN_LIFETIME);
		}
	}

	//create session in database
	$Query = "INSERT INTO session VALUES ('$sid', $tUserID, now(), NULL)";
	mysql_query($Query, $DatabaseLink);
	
	if(USE_COOKIES)
	{
		//set cookie
		setcookie("sid", $sid, time()+SESSION_LIFETIME);
	}

	if(DEBUG)
	{
		$ActionResults[] =  L_GENSID_SUCCESS . $sid;
	}
?>