<?php
	/*
	** File: getUserID
	** Description: Get ID of user based on login/password
	** If the passwords don't match, then zero is returned
	** Version: $Revision: 1.4 $
	** Created: 08/10/99
	** Author: Leon Atkinson
	** Email: leon@clearink.com
	** CVS Author: $Author: leon $
	** Last Revised: $Date: 1999/10/11 23:04:03 $
	**
	** Log : $Log: getUserID,v $
	** Log : Revision 1.4  1999/10/11 23:04:03  leon
	** Log : Removed all require()'s, added block to stop double include()'s
	** Log :
	** Log : Require wasn't giving any performance advantage because it was always
	** Log : being called with a variable.  Futhermore, using return inside a
	** Log : require()'d file does not work in PHP4.
	** Log :
	** Log : Revision 1.3  1999/08/18 22:32:05  leon
	** Log : Returning opening PHP tag to XML-friendly tag
	** Log :
	** Log : Revision 1.2  1999/08/10 23:20:33  leon
	** Log : Changed autologin to be off by default and to use MD5 to obfuscate the
	** Log : password.  Had to add third parameter to getUserID to support encoded
	** Log : passwords.  Put constant definitions inside if statements so they aren't
	** Log : set unless necessary.
	** Log :
	** Log : Revision 1.1  1999/08/10 20:33:19  leon
	** Log : Added support for auto-login powered by cookies.  This is turned on and off
	** Log : with a constant (USE_AUTOLOGIN).  A side-effect was putting the
	** Log : functionality for checking a user's password into a function (getUserID).
	** Log :
	**
	** Copyright (c) 1999 Working Dogs.  All rights reserved.
	*/

	/*
	** Ensure that module isn't included twice
	*/

	$included_flag = 'INCLUDE_' . basename(__FILE__);
	
	if(defined($included_flag))
		//if this module has been included already, then the
		//constant will be defined.  Note the unusual use of
		//the return statement here.  Control will return to
		//the file that included it.
		return;
	
	define($included_flag, TRUE);	



	function getUserID($login, $password, $UseMD5=FALSE)
	{
		global $DatabaseLink;

		$Query = "select ID, Password ";
		$Query .= "FROM user ";
		$Query .= "where Login='$login'";
		$DatabaseResult = mysql_query($Query, $DatabaseLink);
		if(mysql_numrows($DatabaseResult) > 0)
		{
			list($tUser, $tPassword)  = mysql_fetch_row($DatabaseResult);

			if($UseMD5)
			{
				$tPassword = md5($tPassword);
			}

			//compare supplied password and password from database
			if($tPassword == $password)
			{
				/*
				** Make sure user is allowed to login
				*/
				$Query = "SELECT count(*) ";
				$Query .= "FROM user_permission up, permission p ";
				$Query .= "WHERE up.User=$tUser ";
				$Query .= "AND up.Permission = p.ID ";
				$Query .= "AND p.Name = 'Login' ";
	
				$DatabaseResult = mysql_query($Query, $DatabaseLink);
				list($has_permission) = mysql_fetch_row($DatabaseResult);

				if($has_permission > 0)
				{
					$oUser = $tUser;
				}
				else
				{
					//user doesn't have permission to login
					$oUser = 0;
				}

			}
			else
			{
				//passwords don't match
				$oUser = 0;
			}
		}

		return(intval($oUser));
	}

?>