<?php
/* -----------------------------------------------------------------------------------------
   $Id: login.php,v 1.1 2010/09/08 11:00:22 akausch Exp $   

   XT-Commerce - community made shopping
   http://www.xt-commerce.com

   Copyright (c) 2003 XT-Commerce
   -----------------------------------------------------------------------------------------
   based on: 
   (c) 2000-2001 The Exchange Project  (earlier name of osCommerce)
   (c) 2002-2003 osCommerce(login.php,v 1.79 2003/05/19); www.oscommerce.com 
   (c) 2003      nextcommerce (login.php,v 1.13 2003/08/17); www.nextcommerce.org

   Released under the GNU General Public License 
   -----------------------------------------------------------------------------------------
   Third Party contribution:

   guest account idea by Ingo T. <xIngox@web.de>
   ---------------------------------------------------------------------------------------*/

include ('includes/application_top.php');

if(isset($_SESSION['customer_id']) && ($_SESSION['cart']->count_contents() > 0)) {
	xtc_redirect(xtc_href_link(FILENAME_SHOPPING_CART, '', 'SSL'));
} elseif(isset($_SESSION['customer_id'])) {
	xtc_redirect(xtc_href_link(FILENAME_ACCOUNT, '', 'SSL'));
}
// create smarty elements
$smarty = new Smarty;
// include boxes

if ($mobile_template == 'False') {
	require (DIR_FS_CATALOG.'templates/'.CURRENT_TEMPLATE.'/source/boxes.php');
} else {
	require (DIR_FS_CATALOG.'templates/'.CURRENT_MOBILE_TEMPLATE.'/source/boxes.php');
}
// include needed functions
require_once (DIR_FS_INC.'xtc_validate_password.inc.php');
require_once (DIR_FS_INC.'xtc_array_to_string.inc.php');
require_once (DIR_FS_INC.'xtc_write_user_info.inc.php');
include ('display_vvcodes.php');

// redirect the customer to a friendly cookie-must-be-enabled page if cookies are disabled (or the session has not started)
if ($session_started == false) {
	xtc_redirect(xtc_href_link(FILENAME_COOKIE_USAGE));
}
#Ohne Login Schutz
if (LOGIN_SAFE == 'false')
{
	if (isset ($_GET['action']) && ($_GET['action'] == 'process')) {
		$email_address = xtc_db_prepare_input($_POST['email_address']);
		$password = xtc_db_prepare_input($_POST['password']);

		// Check if email exists
		$check_customer_query = xtc_db_query("SELECT customers_id, customers_vat_id, customers_firstname,customers_lastname, customers_gender, customers_password, customers_email_address, customers_default_address_id FROM ".TABLE_CUSTOMERS." WHERE customers_email_address = '".xtc_db_input($email_address)."' and account_type = '0'");
		if (!xtc_db_num_rows($check_customer_query)) {
			$_GET['login'] = 'fail';
			$info_message = TEXT_NO_EMAIL_ADDRESS_FOUND;
		} else {
			$check_customer = xtc_db_fetch_array($check_customer_query);
			// Check that password is good
			if (!xtc_validate_password($password, $check_customer['customers_password'])) {
				$_GET['login'] = 'fail';
				$info_message = TEXT_LOGIN_ERROR;
			} else {
				if (SESSION_RECREATE == 'True') {
					xtc_session_recreate();
				}
				$check_country_query = xtc_db_query("SELECT entry_country_id, entry_zone_id FROM ".TABLE_ADDRESS_BOOK." WHERE customers_id = '".(int) $check_customer['customers_id']."' and address_book_id = '".$check_customer['customers_default_address_id']."'");
				$check_country = xtc_db_fetch_array($check_country_query);
				$_SESSION['customer_gender'] = $check_customer['customers_gender'];
				$_SESSION['customer_first_name'] = $check_customer['customers_firstname'];
				$_SESSION['customer_last_name'] = $check_customer['customers_lastname'];
				$_SESSION['customer_id'] = $check_customer['customers_id'];
				$_SESSION['customer_vat_id'] = $check_customer['customers_vat_id'];
				$_SESSION['customer_default_address_id'] = $check_customer['customers_default_address_id'];
				$_SESSION['customer_country_id'] = $check_country['entry_country_id'];
				$_SESSION['customer_zone_id'] = $check_country['entry_zone_id'];
				$date_now = date('Ymd');
				xtc_db_query("UPDATE ".TABLE_CUSTOMERS_INFO." SET customers_info_date_of_last_logon = now(), customers_info_number_of_logons = customers_info_number_of_logons+1 WHERE customers_info_id = '".(int) $_SESSION['customer_id']."'");
				xtc_write_user_info((int) $_SESSION['customer_id']);
				// restore cart contents
				$_SESSION['cart']->restore_contents();
				$_SESSION['wishList']->restore_contents();
				if (is_object($econda)) $econda->_loginUser();
				if ($_SESSION['cart']->count_contents() > 0) {
					xtc_redirect(xtc_href_link(FILENAME_SHOPPING_CART, '', 'SSL'));
				} else {
					xtc_redirect($_SERVER['HTTP_REFERER']);
				}
			}
		}
	}
}
else 
{
	//echo "<script>alert('".LOGIN_SAFE.". ist an!');</script>";
	#Mit Login Schutz
	if (isset ($_GET['action']) && ($_GET['action'] == 'process'))
	{
		$email_address = xtc_db_prepare_input($_POST['email_address']);
		$password = xtc_db_prepare_input($_POST['password']);
		$check_customer_query = xtc_db_query("SELECT 
												 customers_id, 
												 customers_vat_id, 
												 customers_firstname,
												 customers_lastname, 
												 customers_gender, 
												 customers_password, 
												 customers_email_address, 
												 customers_default_address_id, 
												 login_tries,
												 login_time
											   FROM 
												customers 
											   WHERE 
												 customers_email_address = '".xtc_db_input($email_address)."' 
												 and account_type = '0'");
		if (!xtc_db_num_rows($check_customer_query)) {
			$_GET['login'] = 'fail';
			$info_message = TEXT_NO_EMAIL_ADDRESS_FOUND;
		} else {
			$check_customer = xtc_db_fetch_array($check_customer_query);
			   $login_success = true;
			$blocktime = LOGIN_TIME;
			$time = time();  
			$logintime = strtotime($check_customer['login_time']);  
			$difference = $time - $logintime;              
			$login_tries=$check_customer['login_tries'];

			//if ($_POST['vvcode'] != $_SESSION['vvcode'] && $_SESSION['vvcode'] !=''){
			if (!empty($_POST['stringCaptcha']))
			{
				include_once('captcha_math_check.php');
				if($resultCaptcha)
				{
					xtc_db_query("UPDATE ".TABLE_CUSTOMERS." SET login_tries = login_tries+1, login_time = now() WHERE customers_email_address = '".xtc_db_input($email_address)."'");		
					if($check_customer['customers_password'] != md5($_POST["password"]) || $check_customer['customers_email_address'] != $email_address)
					{
						$info_message = TEXT_LOGIN_ERROR;
						$login_success = false;
					}
				}
				else
				{	
					$info_message = TEXT_WRONG_CODE;
					$login_success = false;
					echo "<script>alert('FALSCHER CODE!');</script>";
				}
			}
			else if (!xtc_validate_password($password, $check_customer['customers_password']))
			{
				$_GET['login'] = 'fail';
				$info_message = TEXT_LOGIN_ERROR;
				xtc_db_query("UPDATE ".TABLE_CUSTOMERS." SET login_tries = login_tries+1, login_time = now() WHERE customers_email_address = '".xtc_db_input($email_address)."'");		
				$login_success=false;
			}
			if (($login_tries >= LOGIN_NUM && $difference < $blocktime) || ($_POST['vvcode'] != $_SESSION['vvcode']))
			{
				$vv_validation=true;
				
				$smarty->assign('VVIMG', '<img src="'.$vvimg.'" alt="Captcha" />'); 
				$smarty->assign('INPUT_CODE', xtc_draw_input_field('stringCaptcha', '', 'size="6" maxlength="6"', 'text', false));
				$smarty->assign('CodeCaptcha', xtc_draw_hidden_field('codeCaptcha', $_SESSION["vvcode"], ''));
			}
			if ( $login_success )
			{
				xtc_db_query("UPDATE ".TABLE_CUSTOMERS." SET login_tries = 0, login_time = now() WHERE customers_email_address = '".xtc_db_input($email_address)."'");	
				if (SESSION_RECREATE == 'True') {
					xtc_session_recreate();
				}
				$check_country_query = xtc_db_query("SELECT entry_country_id, entry_zone_id FROM ".TABLE_ADDRESS_BOOK." WHERE customers_id = '".(int) $check_customer['customers_id']."' and address_book_id = '".$check_customer['customers_default_address_id']."'");
				$check_country = xtc_db_fetch_array($check_country_query);
				$_SESSION['customer_gender'] = $check_customer['customers_gender'];
				$_SESSION['customer_first_name'] = $check_customer['customers_firstname'];
				$_SESSION['customer_last_name'] = $check_customer['customers_lastname'];
				$_SESSION['customer_id'] = $check_customer['customers_id'];
				$_SESSION['customer_vat_id'] = $check_customer['customers_vat_id'];
				$_SESSION['customer_default_address_id'] = $check_customer['customers_default_address_id'];
				$_SESSION['customer_country_id'] = $check_country['entry_country_id'];
				$_SESSION['customer_zone_id'] = $check_country['entry_zone_id'];
				$date_now = date('Ymd');
				xtc_db_query("UPDATE ".TABLE_CUSTOMERS_INFO." SET customers_info_date_of_last_logon = now(), customers_info_number_of_logons = customers_info_number_of_logons+1 WHERE customers_info_id = '".(int) $_SESSION['customer_id']."'");
				xtc_write_user_info((int)$_SESSION['customer_id']);
				$_SESSION['cart']->restore_contents();
				$_SESSION['wishList']->restore_contents();
				if(preg_match("/shopping_cart/i", $_SERVER['HTTP_REFERER']))
					xtc_redirect(FILENAME_SHOPPING_CART);
				else
					xtc_redirect($_SERVER['HTTP_REFERER']);
			}
		}
	}
}

$breadcrumb->add(NAVBAR_TITLE_LOGIN, xtc_href_link(FILENAME_LOGIN, '', 'SSL'));
require (DIR_WS_INCLUDES.'header.php');
if ($_GET['info_message']) 
	$info_message = $_GET['info_message'];

$smarty->assign('info_message', $info_message);
$smarty->assign('account_option', ACCOUNT_OPTIONS);
$smarty->assign('BUTTON_NEW_ACCOUNT', '<a href="'.xtc_href_link(FILENAME_CREATE_ACCOUNT, '', 'SSL').'">'.xtc_image_button('button_continue.gif', IMAGE_BUTTON_CONTINUE).'</a>');
$smarty->assign('BUTTON_LOGIN', xtc_image_submit('button_login.gif', IMAGE_BUTTON_LOGIN, 'id="login"'));
$smarty->assign('BUTTON_GUEST', '<a href="'.xtc_href_link(FILENAME_CREATE_GUEST_ACCOUNT, '', 'SSL').'">'.xtc_image_button('button_continue.gif', IMAGE_BUTTON_CONTINUE).'</a>');
$smarty->assign('FORM_ACTION', xtc_draw_form('login', xtc_href_link(FILENAME_LOGIN, 'action=process', 'SSL')));
$smarty->assign('INPUT_MAIL', xtc_draw_input_field('email_address'));
$smarty->assign('INPUT_PASSWORD', xtc_draw_password_field('password'));
$smarty->assign('LINK_LOST_PASSWORD', xtc_href_link(FILENAME_PASSWORD_DOUBLE_OPT, '', 'SSL'));
$smarty->assign('FORM_END', '</form>');

$smarty->assign('language', $_SESSION['language']);
$smarty->caching = 0;
if ($mobile_template == 'False') {
	$main_content = $smarty->fetch(CURRENT_TEMPLATE.'/module/login.html');
} else {
	$main_content = $smarty->fetch(CURRENT_MOBILE_TEMPLATE.'/module/login.html');
}

$smarty->assign('main_content', $main_content);

$smarty->assign('language', $_SESSION['language']);
$smarty->caching = 0;
if (!defined(RM))
	$smarty->load_filter('output', 'note');
if ($mobile_template == 'False') {
	$smarty->display(CURRENT_TEMPLATE.'/index.html');
} else {
	$smarty->display(CURRENT_MOBILE_TEMPLATE.'/index.html');
}	
include ('includes/application_bottom.php');

?>