<?php
//require_once __DIR__.'/inc/Db.php';
//require_once 'function_login_block.php';

	defined('HTML_EOL') or define('HTML_EOL', '<br />');

	/*
	 * Usage:
	*
	* -authentication
	* Sys_user::auth($userid, $pwd, $return_user);
	* return true or false
	*
	* -change password
	* Sys_user::changePassword($id, $orginal_password, $new_password, $confirm_password=null);
	* return true or false
	*
	* -check the (SESSION) user is valid
	* Sys_user::checkLogin();
	* return true or false
	*/

	class Sys_user
	{

		/*
		 * Database USER Table defination
		 */
		const TBL_NAME = "sys_cms_login";
		const FLD_ID = "cmsloginid";
		const FLD_USER = "cmsusername";
		const FLD_LOGINNAME = "cmsloginname";
		const FLD_PASSWORD = "cmsloginpw";
		const FLD_ROLE = "cmsrole";
		const FLD_CREATEDATE = "createdate";
		const FLD_MODIFYDATE = "lastupdate";
		const FLD_STATUS = "cmsstatus";
		const FLD_PWEXPIRYDATE = "password_expirydate";
		const FLD_SUPPLIER_ID = "supplier_id";
		const STATUS_ALLOW = "1"; // allow status=1 to login

		//settings
		static $SHOW_WARNING = false;
		static $ENABLE_CALLBACK = true;
		static $ENABLE_PWEXPIRYDATE = true;

		/*
		 * To be called if authorization is OK
		 */
		protected static function authSuccessCallback($row)
		{
			//put some variables into SESSION
			//var_dump($row);
			global $session;
			$session->regenerateId();
			$session->getCsrfToken()->regenerateValue();

			$_SESSION['loginname']       = aes_crypt($row{self::FLD_LOGINNAME}, 2);
			$_SESSION['cmsloginname']    = aes_crypt($row{self::FLD_LOGINNAME}, 2);
			$_SESSION['cmsusername']     = aes_crypt($row{self::FLD_LOGINNAME}, 2);
			$_SESSION['cmsloginid']      = $row{self::FLD_ID};
			$_SESSION['loginid']         = $row{self::FLD_ID};
			$_SESSION['cmsrole']         = $row{self::FLD_ROLE};
			$_SESSION['role']            = $row{self::FLD_ROLE};
			$_SESSION['login_user_name'] = $_SESSION['loginname'];


			$_SESSION['KCFINDER']              = array();
			$_SESSION['KCFINDER']['disabled']  = false;
			$_SESSION['KCFINDER']['uploadURL'] = "upload/";
			//$_SESSION['KCFINDER']['uploadURL'] = "upload/user/".$row{self::FLD_ID};
			$_SESSION['KCFINDER']['uploadDir'] = "";

			insert_login_log($_SESSION['cmsusername'] , true);

			if (self::$ENABLE_PWEXPIRYDATE && (strtotime($row{self::FLD_PWEXPIRYDATE}) < time() - 24 * 60 * 60)) { //expired
				header("Location: sys_cms_user_modifypwform.php");
				exit;
			}

			header("Location: index.php");
			exit;
		}

		/*
		 * To be called if authorization is Failed
		 */
		protected static function authFailCallback($username)
		{
			//put a log into System_log table
			global $login_error;
			$login_error = true;
			insert_login_log($username, false);
			die_if_login_block();
		}

		/*
		 * Customize procedure to check during authorization
		 * return ture to allow this authorization
		 */
		protected static function whenAuth()
		{
			//you can add some checking
			//return false to reject the authorization
			return true;
		}

		// --------------  DO NOT MODIFY BELOW --------------------------------------------

		/*
		 * check the loginid has a valid status (usually run in every script)
		 * $loginid - login ID to be checked ($_SESSION['loginname'] if empty)
		 */
		static function checkLogin($loginid = null)
		{

			global $loggin;
			global $dbh;

			if (!isset($loginid) && empty($loginid) && !empty($_SESSION['loginname'])) {
				$loginid = $_SESSION['loginname'];
			} else {
				$loginid = "";
			}

			$sql = "SELECT * FROM " . self::TBL_NAME
				. " WHERE " . self::FLD_LOGINNAME . " = :loginname "
				. " AND " . self::FLD_STATUS . " = :status ";

			$sql_param = array(
				':loginname' => aes_crypt($loginid, 1),
				':status'    => self::STATUS_ALLOW,
			);


			$sth = $dbh->prepare($sql);
			//var_dump($sth);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			if ($row = $sth->fetch()) {
				$loggin = 1;
				return true;
			}
			$loggin = false;
			return false;
		}

		//user authenication
		static function auth($userid, $pwd, &$return_user = null)
		{

			global $dbh;
			$sql       = "SELECT * FROM " . self::TBL_NAME . "
					WHERE " . self::FLD_LOGINNAME . " = :loginname
					AND " . self::FLD_PASSWORD . " = :password
					AND " . self::FLD_STATUS . " = :status ";
			$sql_param = array(
				':loginname' => aes_crypt($userid, 1),
				':password'  => Password::hash($pwd),
				':status'    => self::STATUS_ALLOW,
			);

			/*var_dump($sql_param);
			exit;*/
			$sth = $dbh->prepare($sql);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			$result = $sth->fetch();


			if ($result && $result[self::FLD_PASSWORD] == Password::hash($pwd)) {
				//var_dump($result[self::FLD_PASSWORD], Password::hash($pwd), $result[self::FLD_PASSWORD]==Password::hash($pwd) ); exit;
				$authenticated = true;
			} else {
				if (self::$SHOW_WARNING) {
					print _lang("Login Failed") . " <br/>";
				}
				$authenticated = false;
			}

			if ($authenticated && !self::whenAuth()) {
				$authenticated = false;
			}

			if ($authenticated) {
				$return_user = $result;
				if (self::$ENABLE_CALLBACK) {
					self::authSuccessCallback($return_user);
				}
			} else {

				if (self::$SHOW_WARNING) {
					print _lang("Login Failed") . " <br/>";
				}
				if (self::$ENABLE_CALLBACK) {
					self::authFailCallback($userid);
				}
			}

			return $authenticated;
		}

		//change user password
		static function changePassword($id, $orginal_password, $new_password, $confirm_password = null)
		{
			global $dbh;
			$sql = "SELECT * FROM " . self::TBL_NAME . " WHERE " . self::FLD_ID . " = :id ";

			$sql_param = array(
				':id' => $id
			);

			$sth = $dbh->prepare($sql);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			if (!$result = $sth->fetch()) {
				if (self::$SHOW_WARNING) {
					print _lang("User not found") . "<br/>";

				}
				return false;
			}

			if ($confirm_password && $new_password != $confirm_password) {
				if (self::$SHOW_WARNING) {
					print _lang("Confirm password is incorrect") . " <br/>";
				}
				return false;
			}
			if (Password::hash($orginal_password) != $result[self::FLD_PASSWORD]) {
				if (self::$SHOW_WARNING) {
					print _lang("Original password is incorrect") . " <br/>";
				}
				return false;
			}

			if ($result[self::FLD_ID]) {

				$sql_param = array(
					':password' => Password::hash($new_password),
					':date'     => date("Y-m-d H:i:s"),
					':id'       => (int)$result[self::FLD_ID],
				);

				if (self::$ENABLE_PWEXPIRYDATE) {
					$sql_updatefield                   = self::FLD_PWEXPIRYDATE . " = :password_expirydate, ";
					$sql_param[':password_expirydate'] = date('Y-m-d H:i:s', strtotime("+1 year")); //extend 1 year
				}

				$sql = "UPDATE " . self::TBL_NAME
					. " SET "
					. $sql_updatefield
					. self::FLD_PASSWORD . " = :password, "
					. self::FLD_MODIFYDATE . " = :date "
					. " WHERE " . self::FLD_ID . " = :id ";

				$sth = $dbh->prepare($sql);
				//echo $sth->getSQL( $sql_param ).HTML_EOL;
				//$sth->execute( $sql_param );
				/*if( $error = $sth->getError($sql_param) ){
					var_dump($error);
					return false;
				}*/
				if (!$sth->execute($sql_param)) {
					throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());
					return false;
				}


				return true;
			}
			return false;
		}
	}

	/*
	 * Usage:
	*
	* -hash
	* Password::hash($_POST["cmsloginpw"]);
	* return hashed password
	*
	* -strength test
	* Password::strength($_REQUEST[$fld_password], $_REQUEST['username'], $msg);
	* $msg: variable to store returned error messages
	* return true OR false
	*
	* -include javascript fragment for Jquery validation
	* Password::ajax_validate('cmsloginpw', 'ajax_passwordChecker.php', 'cmsloginname')
	* $password: password to be validated
	* $ajax_checker: validate script
	* $loginname: optional username to be compared with the password
	* return javascript string
	*/

	class Password
	{
		static $SALT1 = "Wb4CSGBY";
		static $SALT2 = "wJy7LVFz";
		static $SALT3 = "EKFfL2dV";
		static $SALT4 = "nn43rSFN";

		static function hash($str)
		{
			$len   = strlen($str);
			$len_a = (int)($len / 3);
			$len_b = (int)($len / 3);
			//$len_c = $len - $a - $b;
			$a = substr($str, 0, $len_a);
			$b = substr($str, $len_a, $len_b);
			$c = substr($str, $len_a + $len_b);
			//var_dump(self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
			return hash('sha256', self::$SALT1 . $c . self::$SALT2 . $b . self::$SALT3 . $a . self::$SALT4);
		}

		static function strength($password, $username = '', &$msg = '')
		{
			//ref: http://www.zorched.net/2009/05/08/password-strength-validation-with-regular-expressions/
			//$pattern = "/^(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])(?=.*[\d]).{8,15}$/";
			//$t1 = preg_match($pattern, $password, $matches);
			$result = true;

			$pattern = "/^.{8,15}$/";
			if (!preg_match($pattern, $password, $matches)) {
				$msg .= '<li>' . _lang("Must be 8-15 characters long") . '</li>';
				$result = false;
			}
			$pattern = "/(?=.*[a-z])/";
			if (!preg_match($pattern, $password, $matches)) {
				$msg .= '<li>' . _lang("Include a lower case letter") . '</li>';
				$result = false;
			}
			$pattern = "/(?=.*[A-Z])/";
			if (!preg_match($pattern, $password, $matches)) {
				$msg .= '<li>' . _lang("Include an upper case letter") . '</li>';
				$result = false;
			}
			$pattern = "/(?=.*[\d])/";
			if (!preg_match($pattern, $password, $matches)) {
				$msg .= '<li>' . _lang("Include a number") . '</li>';
				$result = false;
			}
			$pattern = "/(?=.*[\W_])/";
			if (!preg_match($pattern, $password, $matches)) {
				$msg .= '<li>' . _lang("Include a special character") . '</li>';
				$result = false;
			}
			if (stripos($password, $username) !== false) {
				$msg .= '<li>' . _lang("Password cannot contain the username") . '</li>';
				$result = false;
			}
			if ($msg) {
				$msg = '<ul class="validerr">' . $msg . '</ul>';
			}

			return $result;
		}


		static function ajax_validate($id, $ajaxChecker = 'ajax_passwordChecker.php', $usernameInput_id = '', $required = false)
		{
			$s = '
<script>
$(document).ready(function(e) {
	$( "#' . $id . '" ).rules( "add", {
		"required": ' . ($required ? 'true' : 'false') . ',
		"minlength": 8,
		"maxlength": 15,
			messages: {
				 remote: "' . _lang("Invalid password format") . '"
			},
		"remote": {
			url: "' . $ajaxChecker . '",
			type: "post",
			data:{
				allowEmpty: "' . ($required ? 'false' : 'true') . '",
				fld: "' . $id . '",
				username: function(){
					return $("#' . $usernameInput_id . '").val();
				}
			},
		},
		  messages: {
		  required: "' . _lang("Cannot empty") . '",
		  minlength: "' . _lang("Please enter at least 8 characters.") . '",
		  maxlength: "' . _lang("Please enter no more than 15 characters.") . '",
		  equalTo: "' . _lang("Password is not matched.") . '",
		  }
	});
});
</script>';

			return $s;
		}

		static function html_input($tag_attr, $id, $ajaxChecking = true, $ajaxChecker = 'ajax_passwordChecker.php', $usernameInput_id = '')
		{
			if (empty($id)) {
				$id = rand(1000, 999999);
			}
			$s = '<input type="text" ' . $tag_attr . ' id="' . $id . '" >';
			if ($ajaxChecking) {//change, blur, keyup
				if ($usernameInput_id) {
					$usernameInput = ", #" . $usernameInput_id;
				}
				$s .= '<script>
					$("#' . $id . $usernameInput . '").on("change, blur, keyup", function(e){
						$.getJSON( "' . $ajaxChecker . '", {
								password: $("#' . $id . '").val(),
								username: $("#' . $usernameInput_id . '").val(),
							},
							function(data) {
								if(data.strength){
									$("#' . $id . '").removeClass("bad").addClass("ok");
								}else{
									$("#' . $id . '").removeClass("ok").addClass("bad");
								}
						});
					});
				 </script>';
			}
			return $s;
		}


	}