<?php

	// initialize and sanitize incoming variables
	$username_input = initialize("username_input", "post", "text");
	$password_input = initialize("password_input", "post", "text");
	$email_input = initialize("email_input", "post", "text");
	
	// set the URLs for redirect pages
	// $login_page is set in index.php // return to if the login fails
	$home_page_first_run = $editor_index."?page=users_edit&ID=1"; // proceed to if the login succeeds and the admin password is not yet set
	$home_page = $editor_index."?page=content_edit"; // proceed to if the login succeeds

	if ($email_input) { // not currently supported
	
		// find the forgotten password based on an email address
		if ($username_input) {
			$query = "SELECT name, email, password, name_first, name_last FROM user WHERE name='$username_input'";
		} else {
			$query = "SELECT name, email, password, name_first, name_last FROM user WHERE email='$email_input'";
		}
		$result = db_do_query($query);
		$userfound = db_num_rows($result);
		
		if ($userfound == 0) {
			$response = "forgot_no";
		} else if ($userfound > 1) {
			$response = "forgot_multiple";
		} else {
			$response = "forgot_yes";
			
			$row = db_get_row($result, 0);
			extract($row);
			
			//$password = unlock($resultArray["password"], 'ctwfeatures'); // enable this if using two-way encryption

			$email_to = $email;
			$email_to_name = "$name_first $name_last";
			
			$email_from = "info@clientsite.com";
			$email_bounce = "info@clientsite.com";
			
			$email_subject = "clientsite.com login info";
			$email_message = "<!--#embed forgot_email -->"; // this field can be HTML formatted and can contain "$username" and "$password" placeholders
			
			send_email($email_to, $email_to_name, $email_from, $email_from_name, $email_bounce, $email_subject, $email_message, 1);
		}
	
		//print "<script language=JavaScript> location='../contemplate/assembler.php?page=login_$response&email_to=$email_to' </script>";

	} else {
	
		// look up the correct password for this account
		$query = "
			SELECT
				user.ID,
				password,
				timezone.offset AS timezone,
				role,
				access,
				user.active
			FROM user
			LEFT JOIN timezone ON timezone.ID=user.timezone
			WHERE user.name='$username_input'
		";
		$result = db_do_query($query);
		$count = db_num_rows($result);
		
		// if the user is not found, return to the login page
		if (!$count) {
			set_feedback(0, "Could not find user \"$username_input\".");
			header("Location: $login_page");
			exit;
		}

		// if the user is found, grab the other account info
		$row = db_get_row($result, 0);
		extract($row);
		
		// if the password doesn't match, return to the login page
		if (md5($password_input) != $password) {
			set_feedback(0, "Incorrect password for user \"$username_input\".");
			header("Location: $login_page");
			exit;
		}

		// if the user is marked as inactive, return to the login page
		if (!$active) {
			set_feedback(0, "\"$username_input\" is not an active user.");
			header("Location: $login_page");
			exit;
		}
		
		// okay, let's set some session variables ... 
		$_SESSION["editor"]["user"] = $ID;
		$_SESSION["editor"]["username"] = $username_input;
		$_SESSION["editor"]["timezone"] = $timezone;
		$_SESSION["editor"]["role"] = $role;
		$_SESSION["editor"]["access"] = ($access) ? explode(",", $access) : array() ;

		// we can optionally track the user's last IP address, to validate an auto-login or provide other security measures
		//set_value("user", "last_IP", $_SERVER["REMOTE_ADDR"], "ID", $ID);
		
		// ... and proceed to the home page
		$home_page = ($password_input) ? $home_page : $home_page_first_run;
		redirect($home_page);

	}
		
?>
