<?php
	/*
	** File: LOGIN_USER
	** Description: verify user and create a session
	** Version: $Revision: 1.13 $
	** Created: 03/24/99
	** Author: Leon Atkinson
	** Email: leon@clearink.com
	** CVS Author: $Author: leon $
	** Last Revised: $Date: 1999/12/16 23:58:14 $
	**
	** Log : $Log: LOGIN_USER,v $
	** Log : Revision 1.13  1999/12/16 23:58:14  leon
	** Log : Created new function for checking for required global variables.  I've
	** Log : converted a few actions to use this new function.  At some point we should
	** Log : convert them all.
	** Log :
	** Log : Revision 1.12  1999/12/09 23:23:21  leon
	** Log : Changed ActionResults use so that it's an array instead of a
	** Log : continually-growing string.  Note the little function in standard_library
	** Log : for printing out all the action results.
	** Log :
	** Log : Revision 1.11  1999/11/13 01:20:42  leon
	** Log : More localization work.
	** Log :
	** Log : Revision 1.10  1999/11/04 21:35:29  leon
	** Log : Cleaned up the use of paths.  Paths are now all set in index.php3 as
	** Log : constants.  Example settings for Apache/Unix, Apache/Win32, and IIS.
	** Log :
	** Log : Revision 1.9  1999/10/04 22:09:50  leon
	** Log : Removed getInvoiceID.  The active invoice is now added to $UserInfo
	** Log : by the check sid functionality in init.
	** Log :
	** Log : Revision 1.8  1999/08/20 20:03:13  leon
	** Log : Added support to allow checking out if you aren't logged in.  To do this,
	** Log : I added a column to the session table to track the ID of current invoice
	** Log : for the session.  Before, we were getting the current invoice by looking
	** Log : in the invoice table for an inactive invoice for the same user.  This
	** Log : doesn't work for anonymous sessions because they all have user=0.
	** Log :
	** Log : Note that the invoice column is now set or unset by LOGIN_USER and
	** Log : LOGOUT_USER.  If a session creates an invoice, then logs into an
	** Log : account that has an inactive invoice, the invoice the session already
	** Log : has will be preserved.
	** Log :
	** Log : The purgeInvoice function was changed to set Invoice=0 for any session
	** Log : that is associated with the invoice to be purged.
	** Log :
	** Log : Revision 1.7  1999/08/18 22:31:49  leon
	** Log : Returning opening PHP tag to XML-friendly tag
	** Log :
	** Log : Revision 1.6  1999/08/10 23:20:32  leon
	** Log : Changed autologin to be off by default and to use MD5 to obfuscate the
	** Log : password.  Had to add third parameter to getUserID to support encoded
	** Log : passwords.  Put constant definitions inside if statements so they aren't
	** Log : set unless necessary.
	** Log :
	** Log : Revision 1.5  1999/08/10 20:33:19  leon
	** Log : Added support for auto-login powered by cookies.  This is turned on and off
	** Log : with a constant (USE_AUTOLOGIN).  A side-effect was putting the
	** Log : functionality for checking a user's password into a function (getUserID).
	** Log :
	** Log : Revision 1.4  1999/07/28 19:27:14  leon
	** Log : Mass update based on code donation from a live project
	** Log :
	**
	** Copyright (c) 1999 Working Dogs.  All rights reserved.
	*/

	//include module for getting a User ID based on login/password
	include(APPLICATION_ROOT . "/modules/include/getUserID");


	//filter input variables
	$inputLogin = substr(trim($inputLogin), 0, 255);
	$inputPassword = substr(trim($inputPassword), 0, 255);

	/* 
	** if we are submitting a username and password, make sid
	*/
	if(haveGlobals(array("inputLogin"=>"string", "inputPassword"=>"string")))
	{
		$user_ID = getUserID($inputLogin, $inputPassword);

		if($user_ID > 0)
		{
			if($UserInfo['Invoice'] == 0)
			{
				//no invoice on session
				//check if this user has an inactive invoice
				$Query = "SELECT ID ";
				$Query .= "FROM invoice ";
				$Query .= "WHERE User = '$user_ID' ";
				$Query .= "AND Active = 'N' ";
				$DatabaseResult = mysql_query($Query, $DatabaseLink);
				list($invoice) = mysql_fetch_row($DatabaseResult);
				$UserInfo['Invoice'] = intval($invoice);
			}			
		
			$Query = "UPDATE session ";
			$Query .= "SET User=$user_ID, "; 
			$Query .= "Invoice=" . $UserInfo['Invoice'] . " ";
			$Query .= "WHERE ID='$sid'";
			mysql_query($Query, $DatabaseLink);

			$UserInfo = GetUserInfo($user_ID);
			$ActionResults[] = L_LOGIN_SUCCESS;

			if(USE_AUTOLOGIN)
			{
				//set cookie for login/password
				setcookie("cookie_al", $inputLogin, time()+AUTOLOGIN_LIFETIME);
				setcookie("cookie_ap", md5($inputPassword), time()+AUTOLOGIN_LIFETIME);
			}

		}
		else
		{
			//login not recognized
			$ActionResults[] = L_LOGIN_FAILURE;
			$SCREEN = "login";
		}
		
	}
	else
	{
		//incomplete form
		$ActionResults[] = L_LOGIN_INCOMPLETE;
		$SCREEN = "login";
	}

?>
