<?php
//require_once __DIR__.'/inc/Db.php';
//require_once 'function_login_block.php';

	defined('HTML_EOL') or define('HTML_EOL', '<br />');

	/*
	 * Usage:
	*
	* -authentication
	* Sys_user::auth($userid, $pwd, $return_user);
	* return true or false
	*
	* -change password
	* Sys_user::changePassword($id, $orginal_password, $new_password, $confirm_password=null);
	* return true or false
	*
	* -check the (SESSION) user is valid
	* Sys_user::checkLogin();
	* return true or false
	*/

	class Sys_user {

		/*
		 * Database USER Table defination
		 */
		const TBL_NAME 			= "sys_cms_login";
		const FLD_ID			= "cmsloginid";
		const FLD_USER			= "cmsusername";
		const FLD_LOGINNAME		= "cmsloginname";
		const FLD_PASSWORD		= "cmsloginpw";
		const FLD_ROLE			= "cmsrole";
		const FLD_CREATEDATE	= "createdate";
		const FLD_MODIFYDATE	= "lastupdate";
		const FLD_STATUS		= "cmsstatus";
		const FLD_PWEXPIRYDATE  = "password_expirydate";
		const STATUS_ALLOW		= "1"; // allow status=1 to login

		//settings
		static $SHOW_WARNING 	= false;
		static $ENABLE_CALLBACK	= true;
		static $ENABLE_PWEXPIRYDATE = true;

		/*
		 * To be called if authorization is OK
		 */
		protected static function authSuccessCallback($row){
			//put some variables into SESSION
			var_dump($row);
			$_SESSION['loginname']	= $row{self::FLD_LOGINNAME};
			$_SESSION['cmsloginid']	= $row{self::FLD_ID};
			$_SESSION['loginid']	= $row{self::FLD_ID};
			$_SESSION['cmsrole']	= $row{self::FLD_ROLE};
			$_SESSION['role']	= $row{self::FLD_ROLE};

			$_SESSION['KCFINDER'] = array();
			$_SESSION['KCFINDER']['disabled'] = false;
			$_SESSION['KCFINDER']['uploadURL'] = "upload/";
			//$_SESSION['KCFINDER']['uploadURL'] = "upload/user/".$row{self::FLD_ID};
			$_SESSION['KCFINDER']['uploadDir'] = "";

			/*if($_POST['autologin'] == 1)
			{
				//disabled cookie

				//$password_hash = md5($row{'cmsloginpw'}); // will result in a 32 characters hash
				//setcookie ($cookie_name, 'usr='.$row{'cmsloginname'}.'&hash='.$password_hash, time() + $cookie_time);
				//insert_login_log($usrid, true);
			}
			*/
			insert_login_log($row{self::FLD_LOGINNAME}, true);

			if ( self::$ENABLE_PWEXPIRYDATE && (strtotime($row{self::FLD_PWEXPIRYDATE}) < time() - 24 * 60 * 60) ){ //expired
				header( "Location: sys_cms_user_modifypwform.php" );
				exit;
			}

			header("Location: index.php");
			exit;
		}

		/*
		 * To be called if authorization is Failed
		 */
		protected static function authFailCallback($username){
			//put a log into System_log table
			global $login_error;
			$login_error = true;
			insert_login_log($username, false);
			die_if_login_block();
		}

		/*
		 * Customize procedure to check during authorization
		 * return ture to allow this authorization
		 */
		protected static function whenAuth(){
			//you can add some checking
			//return false to reject the authorization
			return true;
		}

		// --------------  DO NOT MODIFY BELOW --------------------------------------------

		/*
		 * check the loginid has a valid status (usually run in every script)
		 * $loginid - login ID to be checked ($_SESSION['loginname'] if empty)
		 */
		static function checkLogin($loginid=null){

			global $loggin;
			global $dbh;

			if(!isset($loginid) && empty($loginid) && !empty($_SESSION['loginname'])){
				$loginid = $_SESSION['loginname'];
			}else{
				$loginid = "";
			}

			$sql = "SELECT * FROM ".self::TBL_NAME
				." WHERE ".self::FLD_LOGINNAME . " = :loginname "
				." AND ". self::FLD_STATUS." = :status ";

			$sql_param = array(
				':loginname' => $loginid,
				':status' => self::STATUS_ALLOW,
			);


			$sth = $dbh->prepare($sql);
			//var_dump($sth);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			if($row = $sth->fetch()){
				$loggin = 1;
				return true;
			}
			$loggin = false;
			return false;
		}

		//user authenication
		static function auth($userid, $pwd, &$return_user=null){

			global $dbh;
			$sql = "SELECT * FROM ".self::TBL_NAME."
				WHERE ".self::FLD_LOGINNAME." = :loginname
						AND ".self::FLD_PASSWORD." = :password
						AND ".self::FLD_STATUS." = :status ";

			$sql_param = array(
				':loginname' => $userid,
				':password' => Password::hash($pwd),
				':status' => self::STATUS_ALLOW,
			);


			$sth = $dbh->prepare($sql);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			$result=$sth->fetch();

			if( $result && $result[self::FLD_PASSWORD]==Password::hash($pwd) ){
				//var_dump($result[self::FLD_PASSWORD], Password::hash($pwd), $result[self::FLD_PASSWORD]==Password::hash($pwd) ); exit;
				$authenticated =  true;
			}else{
				if(self::$SHOW_WARNING) { print "Login Failed <br/>";	}
				$authenticated =  false;
			}

			if( $authenticated && !self::whenAuth() ){
				$authenticated =  false;
			}

			if($authenticated){
				$return_user = $result;
				if(self::$ENABLE_CALLBACK) { self::authSuccessCallback($return_user); }
			}else{

				if(self::$SHOW_WARNING) { print "Login Failed <br/>"; }
				if(self::$ENABLE_CALLBACK) { self::authFailCallback($userid);}
			}
			return $authenticated;
		}

		//change user password
		static function changePassword($id, $orginal_password, $new_password, $confirm_password=null){
			global $dbh;
			$sql = "SELECT * FROM ".self::TBL_NAME." WHERE ".self::FLD_ID." = :id ";

			$sql_param = array(
				':id' => $id
			);

			$sth = $dbh->prepare($sql);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			if(!$result = $sth->fetch()){
				if(self::$SHOW_WARNING) {
					print "User not found <br/>";

				}
				return false;
			}

			if($confirm_password && $new_password!=$confirm_password){
				if(self::$SHOW_WARNING) { print "Confirm password is incorrect <br/>";  }
				return false;
			}
			if(Password::hash($orginal_password)!=$result[self::FLD_PASSWORD]){
				if(self::$SHOW_WARNING) { print "Original password is incorrect <br/>";}
				return false;
			}

			if($result[self::FLD_ID]){

				$sql_param = array(
					':password' => Password::hash($new_password),
					':date' => date("Y-m-d H:i:s"),
					':id' => (int)$result[self::FLD_ID],
				);

				if ( self::$ENABLE_PWEXPIRYDATE ){
					$sql_updatefield = self::FLD_PWEXPIRYDATE." = :password_expirydate, ";
					$sql_param[':password_expirydate'] = date('Y-m-d H:i:s', strtotime("+1 year")); //extend 1 year
				}

				$sql = "UPDATE ".self::TBL_NAME
					." SET "
					.$sql_updatefield
					.self::FLD_PASSWORD." = :password, "
					.self::FLD_MODIFYDATE." = :date "
					." WHERE ".self::FLD_ID." = :id ";

				$sth = $dbh->prepare($sql);
				//echo $sth->getSQL( $sql_param ).HTML_EOL;
				//$sth->execute( $sql_param );
				/*if( $error = $sth->getError($sql_param) ){
					var_dump($error);
					return false;
				}*/
				if (!$sth->execute($sql_param)){
					throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());
					return false;
				}


				return true;
			}
			return false;
		}
	}

	/*
	 * Usage:
	*
	* -hash
	* Password::hash($_POST["cmsloginpw"]);
	* return hashed password
	*
	* -strength test
	* Password::strength($_REQUEST[$fld_password], $_REQUEST['username'], $msg);
	* $msg: variable to store returned error messages
	* return true OR false
	*
	* -include javascript fragment for Jquery validation
	* Password::ajax_validate('cmsloginpw', 'ajax_passwordChecker.php', 'cmsloginname')
	* $password: password to be validated
	* $ajax_checker: validate script
	* $loginname: optional username to be compared with the password
	* return javascript string
	*/
	class Password{
		static $SALT1 			= "3ruthaQE";
		static $SALT2 			= "kaheSt6H";
		static $SALT3 			= "sA6wePej";
		static $SALT4 			= "Tha7unaT";

		static function hash($str){
			$len = strlen($str);
			$len_a = (int)($len/3);
			$len_b = (int)($len/3);
			//$len_c = $len - $a - $b;
			$a = substr($str, 0, $len_a);
			$b = substr($str, $len_a, $len_b);
			$c = substr($str, $len_a+$len_b);
			//var_dump(self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
			return hash('sha256', self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
		}

		static function strength($password, $username='', &$msg=''){
			//ref: http://www.zorched.net/2009/05/08/password-strength-validation-with-regular-expressions/
			//$pattern = "/^(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])(?=.*[\d]).{8,15}$/";
			//$t1 = preg_match($pattern, $password, $matches);
			$result = true;

			$pattern = "/^.{8,15}$/";
			if(!preg_match($pattern, $password, $matches)){
				$msg .= '<li>Must be 8-15 characters long</li>';
				$result = false;
			}
			$pattern = "/(?=.*[a-z])/";
			if(!preg_match($pattern, $password, $matches)){
				$msg .= '<li>Include a lower case letter</li>';
				$result = false;
			}
			$pattern = "/(?=.*[A-Z])/";
			if(!preg_match($pattern, $password, $matches)){
				$msg .= '<li>Include an upper case letter</li>';
				$result = false;
			}
			$pattern = "/(?=.*[\d])/";
			if(!preg_match($pattern, $password, $matches)){
				$msg .= '<li>Include a number</li>';
				$result = false;
			}
			$pattern = "/(?=.*[\W_])/";
			if(!preg_match($pattern, $password, $matches)){
				$msg .= '<li>Include a special character</li>';
				$result = false;
			}
			if(stripos($password, $username)!==false){
				$msg .= '<li>Password cannot contain the username</li>';
				$result = false;
			}
			if($msg){
				$msg = '<ul class="validerr">'.$msg.'</ul>';
			}

			return $result;
		}



		static function ajax_validate($id, $ajaxChecker='ajax_passwordChecker.php', $usernameInput_id='', $required=false){
			$s ='
<script>
$(document).ready(function(e) {
	$( "#'.$id.'" ).rules( "add", {
		"required": '.($required?'true':'false').',
		"minlength": 8,
		"maxlength": 15,
			messages: {
				 remote: "Invalid password format"
			},
		"remote": { 
			url: "'.$ajaxChecker.'",
			type: "post",
			data:{
				allowEmpty: "'.($required?'false':'true').'",
				fld: "'.$id.'",
				username: function(){
					return $("#'.$usernameInput_id.'").val();
				}
			},
		}
	});
});
</script>';

			return $s;
		}

		static function html_input($tag_attr, $id, $ajaxChecking=true, $ajaxChecker='ajax_passwordChecker.php', $usernameInput_id=''){
			if(empty($id)){
				$id=rand(1000,999999);
			}
			$s='<input type="text" '.$tag_attr.' id="'.$id.'" >';
			if($ajaxChecking){//change, blur, keyup
				if($usernameInput_id){
					$usernameInput = ", #".$usernameInput_id;
				}
				$s .='<script>
					$("#'.$id.$usernameInput.'").on("change, blur, keyup", function(e){
						$.getJSON( "'.$ajaxChecker.'", {
								password: $("#'.$id.'").val(),
								username: $("#'.$usernameInput_id.'").val(),
							},
							function(data) {
								if(data.strength){
									$("#'.$id.'").removeClass("bad").addClass("ok");
								}else{
									$("#'.$id.'").removeClass("ok").addClass("bad");
								}
						});
					});
				 </script>';
			}
			return $s;
		}


	}