<?php

/*
	[SupeSite/X-Space] (C)2001-2006 Comsenz Inc.
	用户登录/退出处理

	$RCSfile: batch.login.php,v $
	$Revision: 1.40 $
	$Date: 2007/03/29 23:43:51 $
*/

include_once('./include/main.inc.php');
include_once(S_ROOT.'./language/batch.lang.php');

$action = empty($_GET['action'])?'':$_GET['action'];
if(empty($action)) exit('Access Denied');

if(postget('refer')) {
	$refer = postget('refer');
} else {
	if(!empty($_SERVER['HTTP_REFERER'])) {
		$refer = $_SERVER['HTTP_REFERER'];
	} else {
		$refer = geturl('action/site/type/panel');
	}
}

switch ($action) {
	case 'login':
		include_once(S_ROOT.'./include/common.inc.php');
		$cookietime = 0;
		if(!empty($_POST['cookietime'])) $cookietime = intval($_POST['cookietime']);
		if (submitcheck('loginsubmit')) {
			$password = md5($_POST['password']);
			$username = $_POST['username'];
			dbconnect(1);
			$query = $_SGLOBAL['db_bbs']->query('SELECT * FROM '.tname('members', 1).' WHERE username=\''.$username.'\' AND password=\''.$password.'\'');
			if($member = $_SGLOBAL['db_bbs']->fetch_array($query)) {
				if($member['secques']) {
					$title = $blang['safety_questions'];
					$guidearr = array();
					include template('site_secques');
					exit;
				} else {
					dologin($member, $cookietime);
					exit;
				}
			} else {
				messagebox('error', 'login_error', geturl('action/login'));
			}
		} elseif (submitcheck('loginsubmit_secques')) {
			$password = $_POST['password'];
			$uid = intval($_POST['uid']);
			$secques = quescrypt($_POST['questionid'], $_POST['answer']);
			
			dbconnect(1);
			$query = $_SGLOBAL['db_bbs']->query('SELECT * FROM '.tname('members', 1).' WHERE uid=\''.$uid.'\' AND password=\''.$password.'\' AND secques=\''.$secques.'\'');
			if($member = $_SGLOBAL['db_bbs']->fetch_array($query)) {
				dologin($member, $cookietime);
				exit;
			} else {
				messagebox('error', 'login_error', geturl('action/login'));
			}

		}
		break;
	case 'logout':
		obclean();
		sclearcookie();
		setcookie('_refer', '');
		messagebox('ok', 'logout_succeed', rawurldecode($refer));
		break;
	default:
		break;
}

setcookie('_refer', '');
messagebox('ok', 'login_succeed', rawurldecode($refer));

function dologin($member, $cookietime) {
	global $_SGLOBAL, $refer;

	$query = $_SGLOBAL['db']->query('SELECT COUNT(*) FROM '.tname('userspaces').' WHERE uid=\''.$member['uid'].'\'');
	$havespace = $_SGLOBAL['db']->result($query, 0);

	$insertsqlarr = array(
		'uid' => $member['uid'],
		'groupid' => $member['groupid'],
		'username' => addslashes($member['username']),
		'password' => addslashes($member['password']),
		'secques' => addslashes($member['secques']),
		'timeoffset' => addslashes($member['timeoffset']),
		'dateformat' => addslashes($member['dateformat']),
		'havespace' => $havespace,
		'newpm' => $member['newpm']
	);
	replacetable('members', $insertsqlarr);

	$uid = $member['uid'];
	$password = $member['password'];
	$secques = $member['secques'];
	
	//更新论坛member表
	dbconnect(1);
	$_SGLOBAL['db_bbs']->query("UPDATE ".tname('members', 1)." SET lastip='$_SGLOBAL[onlineip]', lastvisit='$_SGLOBAL[timestamp]', xspacestatus='$havespace' WHERE uid='$uid'");

	$cookievalue = authcode("$password\t$secques\t$uid", 'ENCODE');
	
	ssetcookie('sid', '', $cookietime);
	ssetcookie('auth', $cookievalue, $cookietime);
	setcookie('_refer', '');
	messagebox('ok', 'login_succeed', rawurldecode($refer));
}

function quescrypt($questionid, $answer) {
	return $questionid > 0 && $answer != '' ? substr(md5($answer.md5($questionid)), 16, 8) : '';
}

?>