<?
	session_start();
	include ('../init.php');
	include ('fn_common.php');
	include ('../tools/email.php');
	loadLanguage($gsValues['LANGUAGE']);
	
	if(@$_POST['cmd'] == 'session_check')
	{
		checkUserSession();
	
		if (checkUserSession2() == true)
		{
			echo 'true';
		}
		else
		{
			echo 'false';
		}
		die;
	}

	if(@$_POST['cmd'] == 'login')
	{
		$username = strtolower($_POST["username"]);
		$password = $_POST["password"];
		$remember_me = $_POST["remember_me"];
		$mobile = $_POST["mobile"];
		
		// check failed logins limit
		$q = "SELECT * FROM `gs_user_failed_logins` WHERE `ip`='".$_SERVER['REMOTE_ADDR']."' AND dt_login > DATE_SUB(UTC_TIMESTAMP(), INTERVAL 10 MINUTE)";
		$r = mysqli_query($ms, $q);
		$count = mysqli_num_rows($r);
		
		if ($count >= 10)
		{
			$result['cmd'] = 'msg';
			$result['msg'] = $la['TOO_MANY_FAILED_LOGIN_ATTEMPTS'];
			
			//write log
			writeLog('user_access', 'User login: too many failed login attempts. Username: "'.$username.'"');
		}
		else
		{
			$q = "SELECT * FROM `gs_users` WHERE `username`='".$username."' AND `password`='".md5($password)."' LIMIT 1";
			$r = mysqli_query($ms, $q);
			
			if ($row = mysqli_fetch_array($r))
			{
				if ($row['active'] == 'true')
				{
					if ($remember_me == 'true')
					{
						setUserSessionHash($row['id']);
					}
					
					// reset session array
					$_SESSION = array();

					setUserSession($row['id']);
					setUserSessionSettings($row['id']);
					setUserSessionCPanel($row['id']);
					
					if (($gsValues['PAGE_AFTER_LOGIN'] == 'cpanel') && ($_SESSION["cpanel_privileges"] != false))
					{
						$result['cmd'] = 'login_cpanel';	
					}
					else
					{
						$result['cmd'] = 'login_tracking';	
					}
					
					//write log
					writeLog('user_access', 'User login: successful');
					
					//update user usage
					updateUserUsage($row['id'], 1, false, false, false);
				}
				else
				{
					$result['cmd'] = 'msg';
					$result['msg'] = $la['THIS_ACCOUNT_IS_LOCKED'];
					
					//write log
					writeLog('user_access', 'User login: locked account. Username: "'.$username.'"');
				}
			}
			else
			{
				// insert failed login
				$q = "INSERT INTO `gs_user_failed_logins` (`ip`, `dt_login`) VALUES ('".$_SERVER['REMOTE_ADDR']."','".gmdate("Y-m-d H:i:s")."')";
				$r = mysqli_query($ms, $q);
				
				$result['cmd'] = 'msg';
				$result['msg'] = $la['USERNAME_OR_PASSWORD_INCORRECT'];
				
				//write log
				writeLog('user_access', 'User login: unsuccessful. Username: "'.$username.'"');
			}
		}

		
		header('Content-type: application/json');
		echo json_encode($result);
		
		die;	
	}
	
	if (@$_POST['cmd'] == 'logout')
	{
		//write log
		writeLog('user_access', 'User logout');
		
		if (isset($_SESSION["user_id"]))
		{
			deleteUserSessionHash($_SESSION["user_id"]);	
		}
		
		session_unset();
		session_destroy();
		
		echo $gsValues['URL_LOGIN'];
		
		die;
	}
	
	if (@$_POST['cmd'] == 'recover_url')
	{
		$email = $_POST['email'];
		$seccode = $_POST['seccode'];
		
		if ($email != "")
		{
			if ($seccode == $_SESSION["seccode"])
			{
				$email = strtolower($email);
				
				$q = "SELECT * FROM `gs_users` WHERE `email`='".$email."' AND `privileges` NOT LIKE ('%subuser%') LIMIT 1";
				$r = mysqli_query($ms, $q);
				$num = mysqli_num_rows($r);
				
				if ($num > 0)
				{
					$row = mysqli_fetch_array($r);
					
					$token = genAccountRecoverToken($email);
					
					$url_recover = $gsValues['URL_ROOT'].'/index.php?op=rec&token='.$token;
					
					$template = getDefaultTemplate('account_recover_url', $gsValues['LANGUAGE']);
					
					$subject = $template['subject'];
					$message = $template['message'];
					
					$subject = str_replace("%SERVER_NAME%", $gsValues['NAME'], $subject);
					$subject = str_replace("%URL_RECOVER%", $url_recover, $subject);
					
					$message = str_replace("%SERVER_NAME%", $gsValues['NAME'], $message);
					$message = str_replace("%URL_RECOVER%", $url_recover, $message);
					
					if (sendEmail($email, $subject, $message))
					{
						// inset token
						$q = "INSERT INTO `gs_user_account_recover` (`token`, `email`, `dt_recover`) VALUES ('".$token."','".$email."','".gmdate("Y-m-d H:i:s")."')";
						$r = mysqli_query($ms, $q);
				
						echo $la['RECOVERY_LINK_SENT'].' '.$la['PLEASE_CHECK_YOUR_EMAIL'];
						
						//write log
						writeLog('user_access', 'User recover: URL sent. E-mail: '.$email);
					}
					else
					{
						echo $la['CANT_SEND_EMAIL'].' '.$la['CONTACT_ADMINISTRATOR'];
					}
				}
				else
				{
					echo $la['THIS_EMAIL_IS_NOT_REGISTERED'];
					
					//write log
					writeLog('user_access', 'User recover: no such e-mail. E-mail: '.$email);
				}
			}
			else
			{
				echo $la['SECURITY_CODE_IS_INCORRECT'];
			}
		}
		
		die;
	}
	
	if (@$_POST['cmd'] == 'recover')
	{
		$token = $_POST['token'];
		
		$q = "SELECT * FROM `gs_user_account_recover` WHERE `token`='".$token."' LIMIT 1";
		$r = mysqli_query($ms, $q);
		$num = mysqli_num_rows($r);
		
		if ($num > 0)
		{
			$row = mysqli_fetch_array($r);
			
			$email = $row['email'];
			
			$q = "SELECT * FROM `gs_users` WHERE `email`='".$email."' AND `privileges` NOT LIKE ('%subuser%') LIMIT 1";
			$r = mysqli_query($ms, $q);
			$num = mysqli_num_rows($r);
			
			if ($num > 0)
			{
				$row = mysqli_fetch_array($r);
				
				$new_password = genAccountPassword();
				
				$template = getDefaultTemplate('account_recover', $gsValues['LANGUAGE']);
				
				$subject = $template['subject'];
				$message = $template['message'];
				
				$subject = str_replace("%SERVER_NAME%", $gsValues['NAME'], $subject);
				$subject = str_replace("%URL_LOGIN%", $gsValues['URL_LOGIN'], $subject);
				$subject = str_replace("%EMAIL%", $email, $subject);
				$subject = str_replace("%USERNAME%", $row['username'], $subject);
				$subject = str_replace("%PASSWORD%", $new_password, $subject);
				
				$message = str_replace("%SERVER_NAME%", $gsValues['NAME'], $message);
				$message = str_replace("%URL_LOGIN%", $gsValues['URL_LOGIN'], $message);
				$message = str_replace("%EMAIL%", $email, $message);
				$message = str_replace("%USERNAME%", $row['username'], $message);
				$message = str_replace("%PASSWORD%", $new_password, $message);
				
				if (sendEmail($email, $subject, $message))
				{
					$q = "UPDATE gs_users SET password='".md5($new_password)."' WHERE email='".$email."'";
					$r = mysqli_query($ms, $q);
					
					$q = "DELETE FROM `gs_user_account_recover` WHERE `token`='".$token."'";
					$r = mysqli_query($ms, $q);
					
					echo $la['USERNAME_PASSWORD_SENT'].' '.$la['PLEASE_CHECK_YOUR_EMAIL'];
					
					//write log
					writeLog('user_access', 'User recover: successful. E-mail: '.$email);
				}
				else
				{
					echo $la['CANT_SEND_EMAIL'].' '.$la['CONTACT_ADMINISTRATOR'];
				}
			}
			else
			{
				echo $la['THIS_EMAIL_IS_NOT_REGISTERED'];
					
				//write log
				writeLog('user_access', 'User recover: no such e-mail. E-mail: '.$email);
			}
		}
		else
		{
			echo $la['RECOVERY_LINK_EXPIRED'];
		}
		
		die;
	}
	
	if ((@$_POST['cmd'] == 'register') && ($gsValues['ALLOW_REGISTRATION'] == "true"))
	{
		$email = $_POST['email'];
		$seccode = $_POST['seccode'];
		
		if ($email != '')
		{
			if ($seccode == @$_SESSION["seccode"])
			{
				$account_expire = $gsValues['ACCOUNT_EXPIRE'];
				$account_expire_dt = '';
				
				if ($account_expire == 'true')
				{
					$account_expire_dt = gmdate("Y-m-d", strtotime(gmdate("Y-m-d").' + '.$gsValues['ACCOUNT_EXPIRE_PERIOD'].' days'));
				}
				
				$privileges = array();
				$privileges['type'] = 'user';
				$privileges['history'] = stringToBool($gsValues['HISTORY']);
				$privileges['reports'] = stringToBool($gsValues['REPORTS']);
				$privileges['rilogbook'] = stringToBool($gsValues['RILOGBOOK']);
				$privileges['dtc'] = stringToBool($gsValues['DTC']);
				$privileges['object_control'] = stringToBool($gsValues['OBJECT_CONTROL']);
				$privileges['image_gallery'] = stringToBool($gsValues['IMAGE_GALLERY']);
				$privileges['chat'] = stringToBool($gsValues['CHAT']);
				$privileges = json_encode($privileges);
				
				$result = addUser('true', 'true', $account_expire, $account_expire_dt, $privileges, '', $email, '', $gsValues['OBJ_ADD'], $gsValues['OBJ_LIMIT'], $gsValues['OBJ_LIMIT_NUM'], $gsValues['OBJ_DAYS'], $gsValues['OBJ_DAYS_NUM'], $gsValues['OBJ_EDIT'], $gsValues['OBJ_HISTORY_CLEAR']);
				
				if ($result == 'OK')
				{
					$result = $la['REGISTRATION_SUCCESSFUL'].' '.$la['PLEASE_CHECK_YOUR_EMAIL'];
				}
				
				echo $result;
			}
			else
			{
				echo $la['SECURITY_CODE_IS_INCORRECT'];
			}
		}
		
		die;
	}
?>