<?php
//require_once __DIR__.'/inc/Db.php';
//require_once 'function_login_block.php';

	defined('HTML_EOL') or define('HTML_EOL', '<br />');

	/*
	 * Usage:
	*
	* -authentication
	* Sys_user::auth($userid, $pwd, $return_user);
	* return true or false
	*
	* -change password
	* Sys_user::changePassword($id, $orginal_password, $new_password, $confirm_password=null);
	* return true or false
	*
	* -check the (SESSION) user is valid
	* Sys_user::checkLogin();
	* return true or false
	*/

	class Sys_user
	{

		/*
		 * Database USER Table defination
		 */
		const TBL_NAME         = "sys_cms_login";
		const FLD_ID           = "cmsloginid";
		const FLD_USER         = "cmsusername";
		const FLD_LOGINNAME    = "cmsloginname";
		const FLD_PASSWORD     = "cmsloginpw";
		const FLD_ROLE         = "cmsrole";
		const FLD_CREATEDATE   = "createdate";
		const FLD_MODIFYDATE   = "lastupdate";
		const FLD_STATUS       = "cmsstatus";
		const FLD_PWEXPIRYDATE = "password_expirydate";
		const STATUS_ALLOW     = "1"; // allow status=1 to login

		//settings
		static $SHOW_WARNING = false;
		static $ENABLE_CALLBACK = true;
		static $ENABLE_PWEXPIRYDATE = true;

		/*
		 * To be called if authorization is OK
		 */

		static function checkLogin($loginid = null)
		{

			global $loggin;
			global $dbh;

			if (!isset($loginid) && empty($loginid) && !empty($_SESSION['loginname'])) {
				$loginid = $_SESSION['loginname'];
			} else {
				$loginid = "";
			}

			$sql = "SELECT * FROM " . self::TBL_NAME
				. " WHERE " . self::FLD_LOGINNAME . " = :loginname "
				. " AND " . self::FLD_STATUS . " = :status ";

			$sql_param = array(
				':loginname' => $loginid,
				':status'    => self::STATUS_ALLOW,
			);


			$sth = $dbh->prepare($sql);
			//var_dump($sth);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			if ($row = $sth->fetch()) {
				$loggin = 1;
				return true;
			}
			$loggin = false;
			return false;
		}

		/*
		 * To be called if authorization is Failed
		 */

		static function auth($userid, $pwd, &$return_user = null)
		{

			global $dbh;
			$sql = "SELECT * FROM " . self::TBL_NAME . "
				WHERE " . self::FLD_LOGINNAME . " = :loginname
						AND " . self::FLD_PASSWORD . " = :password
						AND " . self::FLD_STATUS . " = :status ";
			$sql_param = array(
				':loginname' => $userid,
				':password'  => Password::hash($pwd),
				':status'    => self::STATUS_ALLOW,
			);


			$sth = $dbh->prepare($sql);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			$result = $sth->fetch();

			if ($result && $result[self::FLD_PASSWORD] == Password::hash($pwd)) {
				//var_dump($result[self::FLD_PASSWORD], Password::hash($pwd), $result[self::FLD_PASSWORD]==Password::hash($pwd) ); exit;
				$authenticated = true;
			} else {
				if (self::$SHOW_WARNING) {
					print "Login Failed <br/>";
				}
				$authenticated = false;
			}

			if ($authenticated && !self::whenAuth()) {
				$authenticated = false;
			}

			if ($authenticated) {
				$return_user = $result;
				if (self::$ENABLE_CALLBACK) {
					self::authSuccessCallback($return_user);
				}
			} else {

				if (self::$SHOW_WARNING) {
					print "Login Failed <br/>";
				}
				if (self::$ENABLE_CALLBACK) {
					self::authFailCallback($userid);
				}
			}
			return $authenticated;
		}

		/*
		 * Customize procedure to check during authorization
		 * return ture to allow this authorization
		 */

		protected static function whenAuth()
		{
			//you can add some checking
			//return false to reject the authorization
			return true;
		}

		// --------------  DO NOT MODIFY BELOW --------------------------------------------

		/*
		 * check the loginid has a valid status (usually run in every script)
		 * $loginid - login ID to be checked ($_SESSION['loginname'] if empty)
		 */

		protected static function authSuccessCallback($row)
		{
			//put some variables into SESSION

			$_SESSION['loginname']  = $row{self::FLD_LOGINNAME};
			$_SESSION['cmsloginid'] = $row{self::FLD_ID};
			$_SESSION['loginid']    = $row{self::FLD_ID};
			$_SESSION['cmsrole']    = $row{self::FLD_ROLE};
			$_SESSION['role']       = $row{self::FLD_ROLE};

			$_SESSION['KCFINDER']              = array();
			$_SESSION['KCFINDER']['disabled']  = false;
			$_SESSION['KCFINDER']['uploadURL'] = "upload";
			//$_SESSION['KCFINDER']['uploadURL'] = "upload/user/".$row{self::FLD_ID};
			$_SESSION['KCFINDER']['uploadDir'] = "";

			/*if($_POST['autologin'] == 1)
			{
				//disabled cookie

				//$password_hash = md5($row{'cmsloginpw'}); // will result in a 32 characters hash
				//setcookie ($cookie_name, 'usr='.$row{'cmsloginname'}.'&hash='.$password_hash, time() + $cookie_time);
				//insert_login_log($usrid, true);
			}
			*/
			insert_login_log($row{self::FLD_LOGINNAME}, true);
			/*
			if (self::$ENABLE_PWEXPIRYDATE && (strtotime($row{self::FLD_PWEXPIRYDATE}) < time() - 24 * 60 * 60)) { //expired
				header("Location: sys_cms_user_modifypwform.php");
				exit;
			}
			*/

			header("Location: index.php");
			exit;
		}

		//user authenication

		protected static function authFailCallback($username)
		{
			//put a log into System_log table
			global $login_error;
			$login_error = true;
			insert_login_log($username, false);
			die_if_login_block();
		}

		//change user password

		static function changePassword($id, $orginal_password, $new_password, $confirm_password = null)
		{
			global $dbh;
			$sql = "SELECT * FROM " . self::TBL_NAME . " WHERE " . self::FLD_ID . " = :id ";

			$sql_param = array(
				':id' => $id
			);

			$sth = $dbh->prepare($sql);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			if (!$result = $sth->fetch()) {
				if (self::$SHOW_WARNING) {
					print "User not found <br/>";

				}
				return false;
			}

			if ($confirm_password && $new_password != $confirm_password) {
				if (self::$SHOW_WARNING) {
					print "Confirm password is incorrect <br/>";
				}
				return false;
			}
			if (Password::hash($orginal_password) != $result[self::FLD_PASSWORD]) {
				if (self::$SHOW_WARNING) {
					print "Original password is incorrect <br/>";
				}
				return false;
			}

			if ($result[self::FLD_ID]) {

				$sql_param = array(
					':password' => Password::hash($new_password),
					':date'     => date("Y-m-d H:i:s"),
					':id'       => (int)$result[self::FLD_ID],
				);

				if (self::$ENABLE_PWEXPIRYDATE) {
					$sql_updatefield                   = self::FLD_PWEXPIRYDATE . " = :password_expirydate, ";
					$sql_param[':password_expirydate'] = date('Y-m-d H:i:s', strtotime("+1 year")); //extend 1 year
				}

				$sql = "UPDATE " . self::TBL_NAME
					. " SET "
					. $sql_updatefield
					. self::FLD_PASSWORD . " = :password, "
					. self::FLD_MODIFYDATE . " = :date "
					. " WHERE " . self::FLD_ID . " = :id ";

				$sth = $dbh->prepare($sql);
				//echo $sth->getSQL( $sql_param ).HTML_EOL;
				//$sth->execute( $sql_param );
				/*if( $error = $sth->getError($sql_param) ){
					var_dump($error);
					return false;
				}*/
				if (!$sth->execute($sql_param)) {
					throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());
					return false;
				}


				return true;
			}
			return false;
		}
	}

	/*
	 * Usage:
	*
	* -hash
	* Password::hash($_POST["cmsloginpw"]);
	* return hashed password
	*
	* -strength test
	* Password::strength($_REQUEST[$fld_password], $_REQUEST['username'], $msg);
	* $msg: variable to store returned error messages
	* return true OR false
	*
	* -include javascript fragment for Jquery validation
	* Password::ajax_validate('cmsloginpw', 'ajax_passwordChecker.php', 'cmsloginname')
	* $password: password to be validated
	* $ajax_checker: validate script
	* $loginname: optional username to be compared with the password
	* return javascript string
	*/

	class Password
	{
		static $SALT1 = "3ruthaQE";
		static $SALT2 = "kaheSt6H";
		static $SALT3 = "sA6wePej";
		static $SALT4 = "Tha7unaT";

		static function hash($str)
		{
			$len   = strlen($str);
			$len_a = (int)($len / 3);
			$len_b = (int)($len / 3);
			//$len_c = $len - $a - $b;
			$a = substr($str, 0, $len_a);
			$b = substr($str, $len_a, $len_b);
			$c = substr($str, $len_a + $len_b);
			//var_dump(self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
			return hash('sha256', self::$SALT1 . $c . self::$SALT2 . $b . self::$SALT3 . $a . self::$SALT4);
		}

		static function strength($password, $username = '', &$msg = '')
		{
			//ref: http://www.zorched.net/2009/05/08/password-strength-validation-with-regular-expressions/
			//$pattern = "/^(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])(?=.*[\d]).{8,15}$/";
			//$t1 = preg_match($pattern, $password, $matches);
			$result = true;

			$pattern = "/^.{8,15}$/";
			if (!preg_match($pattern, $password, $matches)) {
				$msg .= '<li>Must be 8-15 characters long</li>';
				$result = false;
			}
			$pattern = "/(?=.*[a-z])/";
			if (!preg_match($pattern, $password, $matches)) {
				$msg .= '<li>Include a lower case letter</li>';
				$result = false;
			}
			$pattern = "/(?=.*[A-Z])/";
			if (!preg_match($pattern, $password, $matches)) {
				$msg .= '<li>Include an upper case letter</li>';
				$result = false;
			}
			$pattern = "/(?=.*[\d])/";
			if (!preg_match($pattern, $password, $matches)) {
				$msg .= '<li>Include a number</li>';
				$result = false;
			}
			$pattern = "/(?=.*[\W_])/";
			if (!preg_match($pattern, $password, $matches)) {
				$msg .= '<li>Include a special character</li>';
				$result = false;
			}
			if (stripos($password, $username) !== false) {
				$msg .= '<li>Password cannot contain the username</li>';
				$result = false;
			}
			if ($msg) {
				$msg = '<ul class="validerr">' . $msg . '</ul>';
			}

			return $result;
		}

		static function ajax_validate($id, $ajaxChecker = 'ajax_passwordChecker.php', $usernameInput_id = '', $required = false)
		{
			$s = '
<script>
$(document).ready(function(e) {
	$( "#' . $id . '" ).rules( "add", {
		"required": ' . ($required ? 'true' : 'false') . ',
		"minlength": 8,
		"maxlength": 15,
			messages: {
				 remote: "Invalid password format"
			},
		"remote": { 
			url: "' . $ajaxChecker . '",
			type: "post",
			data:{
				allowEmpty: "' . ($required ? 'false' : 'true') . '",
				fld: "' . $id . '",
				username: function(){
					return $("#' . $usernameInput_id . '").val();
				}
			},
		}
	});
});
</script>';

			return $s;
		}

		static function html_input($tag_attr, $id, $ajaxChecking = true, $ajaxChecker = 'ajax_passwordChecker.php', $usernameInput_id = '')
		{
			if (empty($id)) {
				$id = rand(1000, 999999);
			}
			$s = '<input type="text" ' . $tag_attr . ' id="' . $id . '" >';
			if ($ajaxChecking) { //change, blur, keyup
				if ($usernameInput_id) {
					$usernameInput = ", #" . $usernameInput_id;
				}
				$s .= '<script>
					$("#' . $id . $usernameInput . '").on("change, blur, keyup", function(e){
						$.getJSON( "' . $ajaxChecker . '", {
								password: $("#' . $id . '").val(),
								username: $("#' . $usernameInput_id . '").val(),
							},
							function(data) {
								if(data.strength){
									$("#' . $id . '").removeClass("bad").addClass("ok");
								}else{
									$("#' . $id . '").removeClass("ok").addClass("bad");
								}
						});
					});
				 </script>';
			}
			return $s;
		}


	}