<?php
//require_once __DIR__.'/inc/Db.php';
//require_once 'function_login_block.php';

	defined('HTML_EOL') or define('HTML_EOL', '<br />');

	/*
	 * Usage:
	*
	* -authentication
	* Sys_user::auth($userid, $pwd, $return_user);
	* return true or false
	*
	* -change password
	* Sys_user::changePassword($id, $orginal_password, $new_password, $confirm_password=null);
	* return true or false
	*
	* -check the (SESSION) user is valid
	* Sys_user::checkLogin();
	* return true or false
	*/

	class Sys_user {

		/*
		 * Database USER Table defination
		 */
		const TBL_NAME 			= "sys_cms_login";
		const FLD_ID			= "cmsloginid";
		const FLD_USER			= "cmsusername";
		const FLD_LOGINNAME		= "cmsloginname";
		const FLD_PASSWORD		= "cmsloginpw";
		const FLD_ROLE			= "cmsrole";
		const FLD_CREATEDATE	= "createdate";
		const FLD_MODIFYDATE	= "lastupdate";
		const FLD_STATUS		= "cmsstatus";
		const FLD_PWEXPIRYDATE  = "password_expirydate";
		const FLD_SUPPLIER_ID  = "supplier_id";
		const STATUS_ALLOW		= "1"; // allow status=1 to login

		//settings
		static $SHOW_WARNING 	= false;
		static $ENABLE_CALLBACK	= true;
		static $ENABLE_PWEXPIRYDATE = true;

		/*
		 * To be called if authorization is OK
		 */
		protected static function authSuccessCallback($row){
			//put some variables into SESSION
			//var_dump($row);
			global $session;
			$session->regenerateId();
			$session->getCsrfToken()->regenerateValue();

			$_SESSION['loginname']	= aes_crypt($row{self::FLD_LOGINNAME},2);
			$_SESSION['cmsloginname']	= aes_crypt($row{self::FLD_LOGINNAME},2);
			$_SESSION['cmsusername']	= aes_crypt($row{self::FLD_LOGINNAME},2);
			$_SESSION['cmsloginid']	= $row{self::FLD_ID};
			$_SESSION['loginid']	= $row{self::FLD_ID};
			$_SESSION['cmsrole']	= $row{self::FLD_ROLE};
			$_SESSION['role']	= $row{self::FLD_ROLE};
			$_SESSION['is_tutor']	= $row{"is_tutor"};
			$_SESSION['is_student']	= $row{"is_student"};
			$_SESSION['login_user_name'] = "";
			

			if($row{self::FLD_ROLE} == "super_admin" || $row{self::FLD_ROLE} == "admin"){
				//$_SESSION['login_user_name'] = $row{self::FLD_USER};
			}else{
				if($row{"is_tutor"} == 1){
					$sql = "select * from tutor_main where cmsloginid = ?";
					$parameters = array($row{self::FLD_ID});
					$result = bind_pdo($sql, $parameters, "selectone");

					$_SESSION['member_login'] = $result['id'];
					$_SESSION['login_user_name'] = $result["nickname"];

				}else if ($row{"is_student"} == 1){
					$sql = "select * from student_main where cmsloginid = ?";
					$parameters = array($row{self::FLD_ID});
					$result = bind_pdo($sql, $parameters, "selectone");

					$_SESSION['student_login'] = $result['id'];
					$_SESSION['login_user_name'] = $result["contactname"];
				}
			}

			$_SESSION['KCFINDER'] = array();
			$_SESSION['KCFINDER']['disabled'] = false;
			$_SESSION['KCFINDER']['uploadURL'] = "upload/";
			//$_SESSION['KCFINDER']['uploadURL'] = "upload/user/".$row{self::FLD_ID};
			$_SESSION['KCFINDER']['uploadDir'] = "";

			/*if($_POST['autologin'] == 1)
			{
				//disabled cookie

				//$password_hash = md5($row{'cmsloginpw'}); // will result in a 32 characters hash
				//setcookie ($cookie_name, 'usr='.$row{'cmsloginname'}.'&hash='.$password_hash, time() + $cookie_time);
				//insert_login_log($usrid, true);
			}
			*/
			insert_login_log($row{self::FLD_LOGINNAME}, true);

			if ( self::$ENABLE_PWEXPIRYDATE && (strtotime($row{self::FLD_PWEXPIRYDATE}) < time() - 24 * 60 * 60) ){ //expired
				header( "Location: sys_cms_user_modifypwform.php" );
				exit;
			}

			header("Location: index.php");
			exit;
		}

		/*
		 * To be called if authorization is Failed
		 */
		protected static function authFailCallback($username){
			//put a log into System_log table
			global $login_error;
			$login_error = true;
			insert_login_log($username, false);
			die_if_login_block();
		}

		/*
		 * Customize procedure to check during authorization
		 * return ture to allow this authorization
		 */
		protected static function whenAuth(){
			//you can add some checking
			//return false to reject the authorization
			return true;
		}

		// --------------  DO NOT MODIFY BELOW --------------------------------------------

		/*
		 * check the loginid has a valid status (usually run in every script)
		 * $loginid - login ID to be checked ($_SESSION['loginname'] if empty)
		 */
		static function checkLogin($loginid=null){

			global $loggin;
			global $dbh;

			if(!isset($loginid) && empty($loginid) && !empty($_SESSION['loginname'])){
				$loginid = $_SESSION['loginname'];
			}else{
				$loginid = "";
			}

			$sql = "SELECT * FROM ".self::TBL_NAME
				." WHERE ".self::FLD_LOGINNAME . " = :loginname "
				." AND ". self::FLD_STATUS." = :status ";

			$sql_param = array( 
				':loginname' => aes_crypt($loginid,1),
				':status' => self::STATUS_ALLOW,
			);


			$sth = $dbh->prepare($sql);
			//var_dump($sth);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			if($row = $sth->fetch()){
				$loggin = 1;
				return true;
			}
			$loggin = false;
			return false;
		}

		//user authenication
		static function auth($userid, $pwd, &$return_user=null){

			global $dbh;
			$sql = "SELECT * FROM ".self::TBL_NAME."
					WHERE ".self::FLD_LOGINNAME." = :loginname
					AND ".self::FLD_PASSWORD." = :password
					AND ".self::FLD_STATUS." = :status ";
			$sql_param = array(
				':loginname' => aes_crypt($userid,1),
				':password' => Password::hash($pwd),
				':status' => self::STATUS_ALLOW,
			);

			$sth = $dbh->prepare($sql);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			$result=$sth->fetch();
			
			$check = false;
			if($result['cmsrole'] == 'user'){
				if($result['is_tutor'] == 1){
					$sql = "select id,status from tutor_main 
							where `cmsloginid` = ? and `isemailverified` = 1 and `isphoneverified` = 1 LIMIT 1";
					$parameters = array($result['cmsloginid']);
					$row = bind_pdo($sql, $parameters, "selectone");
				}else if($result['is_student'] == 1){
					$sql = "select id,status from student_main 
							where `cmsloginid` = ? and `isemailverified` = 1 and `isphoneverified` = 1 LIMIT 1";
					$parameters = array($result['cmsloginid']);
					$row = bind_pdo($sql, $parameters, "selectone");
				}
				if($row['id'] && $row['status']==4){
					$check = true;
				}
			}else{
				$check = true;
			}
			if($check == true){
				if( $result && $result[self::FLD_PASSWORD]==Password::hash($pwd) ){
					//var_dump($result[self::FLD_PASSWORD], Password::hash($pwd), $result[self::FLD_PASSWORD]==Password::hash($pwd) ); exit;
					$authenticated =  true;
				}else{
					if(self::$SHOW_WARNING) { print _lang("Login Failed")." <br/>";	}
					$authenticated =  false;
				}
	
				if( $authenticated && !self::whenAuth() ){
					$authenticated =  false;
				}
	
				if($authenticated){
					$return_user = $result;
					if(self::$ENABLE_CALLBACK) { self::authSuccessCallback($return_user); }
				}else{
	
					if(self::$SHOW_WARNING) { print _lang("Login Failed")." <br/>"; }
					if(self::$ENABLE_CALLBACK) { self::authFailCallback($userid);}
				}
			}else{
				if(self::$SHOW_WARNING) { print _lang("Login Failed")." <br/>"; }
				if(self::$ENABLE_CALLBACK) { self::authFailCallback($userid);}	
			}
			return $authenticated;
		}

		//change user password
		static function changePassword($id, $orginal_password, $new_password, $confirm_password=null){
			global $dbh;
			$sql = "SELECT * FROM ".self::TBL_NAME." WHERE ".self::FLD_ID." = :id ";

			$sql_param = array(
				':id' => $id
			);

			$sth = $dbh->prepare($sql);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			//$sth->execute( $sql_param );
			/*if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}*/
			if (!$sth->execute($sql_param))
				throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());

			if(!$result = $sth->fetch()){
				if(self::$SHOW_WARNING) {
					print _lang("User not found")."<br/>";

				}
				return false;
			}

			if($confirm_password && $new_password!=$confirm_password){
				if(self::$SHOW_WARNING) { print _lang("Confirm password is incorrect")." <br/>";  }
				return false;
			}
			if(Password::hash($orginal_password)!=$result[self::FLD_PASSWORD]){
				if(self::$SHOW_WARNING) { print _lang("Original password is incorrect")." <br/>";}
				return false;
			}

			if($result[self::FLD_ID]){

				$sql_param = array(
					':password' => Password::hash($new_password),
					':date' => date("Y-m-d H:i:s"),
					':id' => (int)$result[self::FLD_ID],
				);

				if ( self::$ENABLE_PWEXPIRYDATE ){
					$sql_updatefield = self::FLD_PWEXPIRYDATE." = :password_expirydate, ";
					$sql_param[':password_expirydate'] = date('Y-m-d H:i:s', strtotime("+1 year")); //extend 1 year
				}

				$sql = "UPDATE ".self::TBL_NAME
					." SET "
					.$sql_updatefield
					.self::FLD_PASSWORD." = :password, "
					.self::FLD_MODIFYDATE." = :date "
					." WHERE ".self::FLD_ID." = :id ";

				$sth = $dbh->prepare($sql);
				//echo $sth->getSQL( $sql_param ).HTML_EOL;
				//$sth->execute( $sql_param );
				/*if( $error = $sth->getError($sql_param) ){
					var_dump($error);
					return false;
				}*/
				if (!$sth->execute($sql_param)){
					throw new Exception('[' . $sth->errorCode() . ']: ' . $sth->errorInfo());
					return false;
				}


				return true;
			}
			return false;
		}
	}

	/*
	 * Usage:
	*
	* -hash
	* Password::hash($_POST["cmsloginpw"]);
	* return hashed password
	*
	* -strength test
	* Password::strength($_REQUEST[$fld_password], $_REQUEST['username'], $msg);
	* $msg: variable to store returned error messages
	* return true OR false
	*
	* -include javascript fragment for Jquery validation
	* Password::ajax_validate('cmsloginpw', 'ajax_passwordChecker.php', 'cmsloginname')
	* $password: password to be validated
	* $ajax_checker: validate script
	* $loginname: optional username to be compared with the password
	* return javascript string
	*/
	class Password{
		static $SALT1 			= "4dYjux5g";
		static $SALT2 			= "NysQrF5Y";
		static $SALT3 			= "xUv4kXKE";
		static $SALT4 			= "Qeh6h6Ly";

		static function hash($str){
			$len = strlen($str);
			$len_a = (int)($len/3);
			$len_b = (int)($len/3);
			//$len_c = $len - $a - $b;
			$a = substr($str, 0, $len_a);
			$b = substr($str, $len_a, $len_b);
			$c = substr($str, $len_a+$len_b);
			//var_dump(self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
			return hash('sha256', self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
		}

		static function strength($password, $username='', &$msg=''){
			//ref: http://www.zorched.net/2009/05/08/password-strength-validation-with-regular-expressions/
			//$pattern = "/^(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])(?=.*[\d]).{8,15}$/";
			//$t1 = preg_match($pattern, $password, $matches);
			$result = true;

			$pattern = "/^.{8,15}$/";
			if(!preg_match($pattern, $password, $matches)){
				$msg .= '<li>'._lang("Must be 8-15 characters long").'</li>';
				$result = false;
			}
			$pattern = "/(?=.*[a-z])/";
			if(!preg_match($pattern, $password, $matches)){
				$msg .= '<li>'._lang("Include a lower case letter").'</li>';
				$result = false;
			}
			$pattern = "/(?=.*[A-Z])/";
			if(!preg_match($pattern, $password, $matches)){
				$msg .= '<li>'._lang("Include an upper case letter").'</li>';
				$result = false;
			}
			$pattern = "/(?=.*[\d])/";
			if(!preg_match($pattern, $password, $matches)){
				$msg .= '<li>'._lang("Include a number").'</li>';
				$result = false;
			}
			$pattern = "/(?=.*[\W_])/";
			if(!preg_match($pattern, $password, $matches)){
				$msg .= '<li>'._lang("Include a special character").'</li>';
				$result = false;
			}
			if(stripos($password, $username)!==false){
				$msg .= '<li>'._lang("Password cannot contain the username").'</li>';
				$result = false;
			}
			if($msg){
				$msg = '<ul class="validerr">'.$msg.'</ul>';
			}

			return $result;
		}



		static function ajax_validate($id, $ajaxChecker='ajax_passwordChecker.php', $usernameInput_id='', $required=false){
			$s ='
<script>
$(document).ready(function(e) {
	$( "#'.$id.'" ).rules( "add", {
		"required": '.($required?'true':'false').',
		"minlength": 8,
		"maxlength": 15,
			messages: {
				 remote: "'._lang("Invalid password format").'"
			},
		"remote": {
			url: "'.$ajaxChecker.'",
			type: "post",
			data:{
				allowEmpty: "'.($required?'false':'true').'",
				fld: "'.$id.'",
				username: function(){
					return $("#'.$usernameInput_id.'").val();
				}
			},
		},
		  messages: {
		  required: "'._lang("Cannot empty").'",
		  minlength: "'._lang("Please enter at least 8 characters.").'",
		  maxlength: "'._lang("Please enter no more than 15 characters.").'",
		  equalTo: "'._lang("Password is not matched.").'",
		  }
	});
});
</script>';

			return $s;
		}

		static function html_input($tag_attr, $id, $ajaxChecking=true, $ajaxChecker='ajax_passwordChecker.php', $usernameInput_id=''){
			if(empty($id)){
				$id=rand(1000,999999);
			}
			$s='<input type="text" '.$tag_attr.' id="'.$id.'" >';
			if($ajaxChecking){//change, blur, keyup
				if($usernameInput_id){
					$usernameInput = ", #".$usernameInput_id;
				}
				$s .='<script>
					$("#'.$id.$usernameInput.'").on("change, blur, keyup", function(e){
						$.getJSON( "'.$ajaxChecker.'", {
								password: $("#'.$id.'").val(),
								username: $("#'.$usernameInput_id.'").val(),
							},
							function(data) {
								if(data.strength){
									$("#'.$id.'").removeClass("bad").addClass("ok");
								}else{
									$("#'.$id.'").removeClass("ok").addClass("bad");
								}
						});
					});
				 </script>';
			}
			return $s;
		}


	}