<?php

$DB = DB::Open();

// process login/register/logout/activation forms if any
$approved = true;
if(!empty($_POST["login-submit"])){
	$username = ucfirst(strtolower($_POST["username"]));
	$username_search = str_replace("'","''",$username);
	$password = $_POST["password"];
	$password_search = md5($password);
	$DB->qry("SELECT username, password, blocked FROM users WHERE username='$username_search' AND password='$password_search' AND blocked=0;");
	if($DB->numrows()!=0){
		$_SESSION['user']=$username;	// log in user
		if($_POST["rememberme"]){	// store in cookies for 2 weeks
			setcookie("user", $username, time()+1209600);
			setcookie("password", md5($password), time()+1209600);
		}
	} else {
		$error = "<font color=\"#FF0000\">Incorrect login, or account not active</font>";
		$approved = false;
	}
} else if(!empty($_POST["register-submit"])){
	global $error;
	$error = "";
	
	// check username
	if (empty($_POST["username"])){
		$error = "<font color=\"#FF0000\">Enter username</font>";
	} else {
		$username = ucfirst(strtolower($_POST["username"]));
		if(preg_match("/^([a-z0-9]+)$/i", $username)){
			$DB->qry("SELECT username FROM users WHERE username='$username';");
			if($DB->numrows()!=0){
				$error = "<font color=\"#FF0000\">Username '$username' is already in use.</font>";
			}
		} else {
			$error = "<font color=\"#FF0000\">Usernames must contain letters and numbers only.</font>";
		}
	}
	
	// check passwords
	if ($_POST["password"]==$_POST["password2"])
		$password = $_POST["password"];
	else {
		$error = "<font color=\"#FF0000\">Passwords don't match</font>";
	}
	
	$email = str_replace("'","''",$_POST["email"]);
	$DB->qry("SELECT email FROM users WHERE email='{$email}';");
	if($DB->numrows()!==0){
		$error = "<font color=\"#FF0000\">This e-mail address is already in use.</font>";
	}
	
	include_once 'securimage/securimage.php';
	$securimage = new Securimage();
	if ($securimage->check($_POST['captcha_code']) == false) {
		// the code was incorrect
		// you should handle the error so that the form processor doesn't continue
		$error = "<font color=\"#FF0000\">Captcha entry was not accepted.</font>";
	}
	
	if ($error==""){
		$password_search = md5($password);
		$zip = intval($_POST["zip"]);
		$code = md5($username . $password);	// generate activation code
		
	//	send activation email
		$message = "Hello, {$username}\n\nYou have created an account at Big Night Out website.\nPlease follow the link below to activate your account:\n\n" . HOME . "index.php?activate={$code}\n\nBest regards,\nAdministrator";
		$headers = 'From: Big Night Out Admin' . "\r\n" . 'Reply-To: admin@paindealers.org';
		$sent = mail($_POST["email"], "Big Night Out - User Activation", $message,$headers);
		if ($sent) {
			$DB->qry("INSERT INTO users (`username`, `password`, `email`, `zip`, `code`, `blocked`,`registered`) VALUES ('$username','$password_search','$email',$zip,'$code',1," . time() . ");");
			$error = "<font color=\"#00FFFF\">User '$username' created. Check e-mail</font>";
		} else $error = "<font color=\"#FF0000\">Activation e-mail could not be sent. Try again later</font>";
	//	$_SESSION['user'] = $username;	// log in | activation required
	}
} else if(!empty($_POST["logout-submit"])){
	setcookie("user", "", time()-3600);
	setcookie("password", "", time()-3600);
	$_SESSION['user']="";
} else if(!empty($_GET["activate"])){
	$code = $_GET["activate"];
	$DB->qry("SELECT username, code FROM users WHERE code='{$code}';");
	if($DB->numrows()==0){
		$error = "<font color=\"#FF0000\">Invalid activation code</font>";
	} else {
		$DB->qry("UPDATE users SET blocked = 0, code='' WHERE code='{$code}';");
		$error = "<font color=\"#00FF00\">Account activated. You may log in now</font>";
	}
}


$user = null;
// check if user is logged in
if(!isset($_SESSION['user'])){	// not logged in
	if(isset($_COOKIE["user"]) && isset($_COOKIE["password"])){	// saved in cookies
		$username = str_replace("'","''",$_COOKIE["user"]);
		$password = str_replace("'","''",$_COOKIE["password"]);	// password is stored in md5
	
		$DB->qry("SELECT username, password FROM users WHERE username='$username' AND password='$password';");
		if($DB->numrows()!=0 && $approved){
			$_SESSION['user']=$username;	// set session logged on
		} else {	// bad cookies
			setcookie("user", "", time()-3600);
			setcookie("password", "", time()-3600);
		}
	} 
}

// get user info if logged in
if(isset($_SESSION['user']) && $_SESSION['user']!="" && $approved){	// logged in
	$user = get_user_by_name($_SESSION['user'],true);
	if($user===null)
		unset($_SESSION['user']); // bad session
	else
		$DB->qry("UPDATE users SET got_email=0 WHERE username='{$user["username"]}';");

} else {
	unset($_SESSION['user']);
	unset($user);
}


?>