<?php

session_start();
// error_reporting(0);
include("postget.php");

require("common.php");

if (($_POST['action'] == "" . _LOGIN . ""
        AND $_POST['pass'])
        AND ($_POST['login']
        OR $_POST['ClientEmail']
        OR $_POST['ClientPersonalized'])) {

    checklevel(1, $_REQUEST['clientid']);

    session_start();

    $login = $_POST['login'];

    ////////////////////////////////////////////////////////////////////////////////////////////////////////////
    if (!isset($_SESSION['hd_intentos'])) {
        // inicializar en cero
        $_SESSION['hd_intentos'] = 0;
    }
    if ($_SESSION['hd_intentos'] == 0) {
        $_SESSION['hd_bloqueadohasta'] = 0;
    }
    if ($_SESSION['hd_intentos'] > $config[105][1]) {
        $_SESSION['hd_intentos'] = $config[105][1];
    }
    /////////////////////////////////////////////////////////////////////////////////////////////////////////////

    if ($config[84][1] == 1) {
        $serverurlSSL = str_replace('http://', 'https://', $config[1][1]);
    } else {
        $serverurlSSL = $config[1][1];
    }


    if (intval($login) != 0) {
        $query = "SELECT password, clientid FROM hd_clients WHERE clientid='$login' AND password='" . encrypt($pass) . "'";
        $result = mysql_query($query, $db_link);
        $row = mysql_fetch_row($result);
        if ($_POST['pass'] == decrypt($row[0])) {
            $_SESSION['hd_accesslvl'] = 1;
            $_SESSION['hd_idc'] = $row[1];
            $_SESSION['hd_intentos'] = 0;
            logevent("_CLIENT_LOGGED", $_SESSION['hd_idc'], $_SESSION['hd_idc'], 'C');
            if ($_REQUEST[pagefrom]) {
                go2($_REQUEST[pagefrom]);
            } else {
                go2($serverurlSSL . '/index.php');
            }
        } else {
            logevent(lang('_FAILED_LOGIN_ATTEMPT') . " (" . $login . " / " . $_POST['pass'] . ")", 0, $_SESSION['hd_idc'], 'F');
            $_SESSION['hd_intentos'] = $_SESSION['hd_intentos'] + 1;
            go2('login.php');
        }
    } elseif ($ClientAlias != "") {


        $query = "SELECT password, clientid FROM hd_clients WHERE clientalias='$ClientAlias' AND password='" . encrypt($pass) . "'";
        $result = mysql_query($query, $db_link);
        $row = mysql_fetch_row($result);
        if ($_POST['pass'] == decrypt($row[0])) {
            $_SESSION['hd_accesslvl'] = 1;
            $_SESSION['hd_idc'] = $row[1];
            $_SESSION['hd_intentos'] = 0;
            logevent("_CLIENT_LOGGED", $_SESSION['hd_idc'], $$_SESSION['hd_idc'], 'C');
            if ($_REQUEST[pagefrom]) {
                go2($_REQUEST[pagefrom]);
            } else {
                go2($serverurlSSL . '/index.php');
            }
        } else {
            logevent(lang('_FAILED_LOGIN_ATTEMPT') . " (" . $login . " / " . $_POST['pass'] . ")", 0, $_SESSION['hd_idc'], 'F');
            $_SESSION['hd_intentos'] = $_SESSION['hd_intentos'] + 1;
            go2('login.php');
        }
    } elseif ($ClientEmail != "") {


        $query = "SELECT password, clientid FROM hd_clients WHERE email='$ClientEmail' AND password='" . encrypt($pass) . "'";
        $result = mysql_query($query, $db_link);
        $row = mysql_fetch_row($result);
        if ($_POST['pass'] == decrypt($row[0])) {
            $_SESSION['hd_accesslvl'] = 1;
            $_SESSION['hd_idc'] = $row[1];
            $_SESSION['hd_intentos'] = 0;
            logevent("_CLIENT_LOGGED", $_SESSION['hd_idc'], $_SESSION['hd_idc'], 'C');
            if ($_REQUEST[pagefrom]) {
                go2($_REQUEST[pagefrom]);
            } else {
                go2($serverurlSSL . '/index.php');
            }
        } else {
            logevent(lang('_FAILED_LOGIN_ATTEMPT') . " (" . $login . " / " . $_POST['pass'] . ")", 0, $_SESSION['hd_idc'], 'F');
            $_SESSION['hd_intentos'] = $_SESSION['hd_intentos'] + 1;
            go2('login.php');
        }
    } elseif ($ClientPersonalized != "") {


        $query = "SELECT password, clientid FROM hd_clients WHERE personalized_5='$ClientPersonalized' AND password='" . encrypt($pass) . "'";
        $result = mysql_query($query, $db_link);
        $row = mysql_fetch_row($result);
        if ($_POST['pass'] == decrypt($row[0])) {
            $_SESSION['hd_accesslvl'] = 1;
            $_SESSION['hd_idc'] = $row[1];
            $_SESSION['hd_intentos'] = 0;
            logevent("_CLIENT_LOGGED", $_SESSION['hd_idc'], $_SESSION['hd_idc'], 'C');
            if ($_REQUEST[pagefrom]) {
                go2($_REQUEST[pagefrom]);
            } else {
                go2($serverurlSSL . '/index.php');
            }
        } else {
            logevent(lang('_FAILED_LOGIN_ATTEMPT') . " (" . $login . " / " . $_POST['pass'] . ")", 0, $_SESSION['hd_idc'], 'F');
            $_SESSION['hd_intentos'] = $_SESSION['hd_intentos'] + 1;
            go2('login.php');
        }
    } else {


        $query = "SELECT password,access,depid FROM hd_users WHERE name='$login'";
        $result = mysql_query($query, $db_link);
        $row = mysql_fetch_row($result);
        if (md5($_POST['pass']) == $row[0]) {
            $_SESSION['hd_accesslvl'] = $row[1];
            $_SESSION['hd_userdept'] = $row[2];
            $_SESSION['hd_idc'] = $login;
            $_SESSION['hd_intentos'] = 0;
            logevent("_ADMIN_LOGGED", 0, $_SESSION['hd_idc'], 'A');
            go2($serverurlSSL . '/main.php');
        } else {
            logevent(lang('_FAILED_LOGIN_ATTEMPT') . " (" . $login . " / " . $_POST['pass'] . ")", 0, $_SESSION['hd_idc'], 'F');
            $_SESSION['hd_intentos'] = $_SESSION['hd_intentos'] + 1;
            go2('login.php');
        }
    }
} else {



    include("head_template_guest.php");


    if ($config[84][1] == 1) {
        $serverurlSSL = str_replace('http://', 'https://', $config[1][1]);
    } else {
        $serverurlSSL = $config[1][1];
    }


    echo '<div class="container">';
    echo '<div class="content">';

    echo '<div class="row">
  <div class="span2"></div>
  <div class="span8">';


    print("
<table class='table-condensed'>
	<tr>
		<td align='center'> ");
    if ($_SESSION['hd_intentos'] == $config[105][1]) {
        if ($_SESSION['hd_bloqueadohasta'] == 0) {
            $_SESSION['hd_bloqueadohasta'] = time() + $config[106][1];
        }
    }
    if ($_SESSION['hd_intentos'] == $config[105][1] + 1) {
        $_SESSION['hd_intentos'] = 0;
    }
    if (time() < $_SESSION['hd_bloqueadohasta']) {
        $estadodecampos = " readonly style='border: 1px solid gray; background: #CCCCCC;' ";
    } else {
        $estadodecampos = "";
    }

    if ($config[56][1] == 1) {
        $demo_user = "value = 'user@example.com'";
        $demo_admin = "value = 'admin'";
        $demo_pass = "value = 'pass'";
    } else {
        $demo_user = "";
        $demo_admin = "";
        $demo_pass = "";
    }
    if (!$accesslvl AND time() >= $_SESSION['hd_bloqueadohasta']) {
        if (!$forgot) {
            echo '
					<table class="table table-bordered">
                                        <tbody>';
            echo '
						<tr>
							<td align="right" nowrap valign="top">';
            $content = "<form name='option' action='/login.php?o=$o' method='post' style='margin-bottom:0;'>";
            $content .= "<select name='o' onChange='top.location.href=this.options[this.selectedIndex].value'
								class='span1'
								>";

            $content .= "<option value='login.php?o=email'";
            if ($o == 'email')
                $content .= " selected";
            $content .= " class='span1'>" . ucfirst(_EMAIL) . "</option>";

            $content .= "<option value='login.php?o=userid'";
            if ($o == 'userid')
                $content .= " selected";
            $content .= " class='span1'>" . ucfirst(_USER) . "</option>";

            if ($config[45][1]) {
                $content .= "<option value='login.php?o=personalized'";
                if ($o == 'personalized')
                    $content .= " selected";
                $content .= " class='span1'>" . ucfirst($config[45][1]) . "</option>";
            }

            $content .= "</select></form>";

            echo "<br>" . $content;

            echo '
							</td>
							
							<td>';

            if ($o == 'userid') {
                echo "<form class='well form-inline' action='login.php?o=$o' method='post' name='login' style='margin-bottom:0;'>
			<input type=text name=login $demo_admin $estadodecampos placeholder='" . lang('_USERNAME') . "'>";
            } elseif ($o == 'personalized') {
                echo "<form class='well form-inline' action='login.php?o=$o' method='post' name='login' style='margin-bottom:0;'>
			<input type=text name=ClientPersonalized $estadodecampos>";
            } else {
                echo "<form class='well form-inline' action='login.php?o=$o' method='post' name='login' style='margin-bottom:0;'>
			<input type=text name=ClientEmail $demo_user $estadodecampos placeholder='" . lang('_EMAIL') . "'>";
            }
            echo "
                                        <input type='hidden' name=pagefrom value='" . $pagefrom . "'>
                                        <input type=password name=pass $demo_pass $estadodecampos placeholder='" . lang('_PASSWORD') . "'>
                                        <input type=submit name=action value='" . _LOGIN . "'>
                                </td>
                        </tr>
                        </tbody>
                </table>
                </form>  ";

            if ($config[84][1] == 1 AND !substr_count('/login.php', $_SERVER['PHP_SELF'])) {
                print("
						<table class='table table striped'>
							<tr>
								<td>");
                print("<img class='sprites secure' src='images/transparent.gif' title='' border='0' valign='center'>");
                print("
								</td>
								<td>");
                print("
									<a href='" . str_replace('http://', 'https://', $config[1][1]) . "/login.php' class='header'>
									" . ucfirst(_SECURE_LOGIN) . "</a>");
                print("
								</td>
							</tr>
						</table>");
            }
        }

        if ($config[84][1] == 1) {
            $serverurlSSL = str_replace('http://', 'https://', $config[1][1]);
        } else {
            $serverurlSSL = $config[1][1];
        }

        if ($forgot == 1) {
            echo "
            <table class='table table-bordered'>
                    <tr>
                            <td align='left'>
                                    <form class='well form-inline' method='post' name='sendpass' action='" . $serverurlSSL . "/sendpassword.php' style='margin-top:4; margin-bottom:4;'>
                                     " . ucfirst(_SEND_USER_AND_PASSWORD_TO) . ": 
                                    <input type='text' name='email' placeholder='" . lang('_EMAIL') . "'>
                                    <input type=submit name='sendpassword' value='" . _SEND . "'>
                                    &nbsp;&nbsp;
                                    </form> 
                            </td>
                    </tr>
            </table>
             ";
        } else {
            ///////////////////// signup
            print("<br>
            <table class='table table-bordered table-striped'>
		<tr>
		<td align='center' nowrap>");
            if ($config[74][1] AND !isset($_COOKIE['hd_status'])) {
                print("<a href='" . $serverurlSSL . "/signup.php'>" . ucfirst(_SIGNUP) . "</a> ");
            }
            print("&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;");
            print("<a href='" . $serverurlSSL . "/login.php?forgot=1'>" . ucfirst(_FORGOT_PASSWORD) . "?</a>");
            print("
		</td>
		</tr>
            </table>");
        }
    } else {
        if (time() < $_SESSION['hd_bloqueadohasta']) {
            $falta = TimeAgo(time(), $_SESSION['hd_bloqueadohasta'], 1);
            print(messagetopinthispage(ucfirst(_ATTEMPTS_OF_LOGIN_EXCEEDED) . ". " . ucfirst(_WAIT) . " " . $falta, '', 2));
            print("<a href='" . $serverurl . "/login.php' class='btn'><b>" . ucfirst(_REFRESH) . "</b></a>");
        }
    }
    print("
		</td>
	</tr>
</table>");

    echo '</div>';

    echo '</div>
      <div class="span2"></div>
      </div>';

    echo "</div></div>";
}

include("foot_template.php");
?>
