<?php
/************************************************************************
 * MXChange v0.2.1                                    Start: 06/10/2005 *
 * ===============                              Last change: 05/18/2008 *
 *                                                                      *
 * -------------------------------------------------------------------- *
 * File              : what-sponsor_login.php                           *
 * -------------------------------------------------------------------- *
 * Short description : Login form and password resending for sponsor    *
 * -------------------------------------------------------------------- *
 * Kurzbeschreibung  : Loginformular und Neues Passwort fuer Sponsor    *
 * -------------------------------------------------------------------- *
 *                                                                      *
 * -------------------------------------------------------------------- *
 * Copyright (c) 2003 - 2008 by Roland Haeder                           *
 * For more information visit: http://www.mxchange.org                  *
 *                                                                      *
 * This program is free software. You can redistribute it and/or modify *
 * it under the terms of the GNU General Public License as published by *
 * the Free Software Foundation; either version 2 of the License.       *
 *                                                                      *
 * This program is distributed in the hope that it will be useful,      *
 * but WITHOUT ANY WARRANTY; without even the implied warranty of       *
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        *
 * GNU General Public License for more details.                         *
 *                                                                      *
 * You should have received a copy of the GNU General Public License    *
 * along with this program; if not, write to the Free Software          *
 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,               *
 * MA  02110-1301  USA                                                  *
 ************************************************************************/

// Some security stuff...
if (ereg(basename(__FILE__), $_SERVER['PHP_SELF']))
{
	$INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4)."/security.php";
	require($INC);
}

// Add description as navigation point
ADD_DESCR("guest", basename(__FILE__));

$MODE = "";
if (!empty($_GET['mode']))
{
	// A "special" mode of the login system was requested
	switch ($_GET['mode'])
	{
		case "activate" : $MODE = "activate";  break; // Activation link requested
		case "lost_pass": $MODE = "lost_pass"; break; // Request new password
	}
}

// Check if hash for confirmation of email address is given...
if (!empty($_GET['hash']))
{
	// Lookup sponsor
	$result = SQL_QUERY_ESC("SELECT id, status, gender, surname, family,
company, position, tax_ident,
street_nr1, street_nr2, country, zip, city, email, phone, fax, cell,
points_amount AS points, last_pay AS pay, last_curr AS curr
FROM "._MYSQL_PREFIX."_sponsor_data
WHERE hash='%s' AND (status='UNCONFIRMED' OR status='EMAIL')
LIMIT 1", array($_GET['hash']), __FILE__, __LINE__);
	if (SQL_NUMROWS($result) == 1)
	{
		// Sponsor found, load his data...
		$SPONSOR = SQL_FETCHARRAY($result);

		// Translate gender and comma
		$SPONSOR['gender']  = TRANSLATE_GENDER($SPONSOR['gender']);
		$SPONSOR['points'] = TRANSLATE_COMMA($SPONSOR['points']);
		$SPONSOR['pay']    = TRANSLATE_COMMA($SPONSOR['pay']);

		// Unconfirmed account or changed email address?
		if ($SPONSOR['status'] == "UNCONFIRMED")
		{
			// Set account to pending
			$result_update = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_sponsor_data SET status='PENDING'
WHERE id='%s' AND hash='%s' AND status='UNCONFIRMED' LIMIT 1",
 array(bigintval($SPONSOR['id']), $_GET['hash']), __FILE__, __LINE__);

			// Check on success 
			if (SQL_AFFECTEDROWS() == 1)
			{
				// Prepare mail and send it to the sponsor
				$MSG = LOAD_EMAIL_TEMPLATE("sponsor_pending", $SPONSOR);
				SEND_EMAIL($SPONSOR['email'], SPONSOR_ACCOUNT_PENDING_SUBJ, $MSG);

				// Send email to admin
				SEND_ADMIN_NOTIFICATION(ADMIN_NEW_SPONSOR, "admin_sponsor_pending", $SPONSOR);

				// Sponsor account set to pending
				LOAD_TEMPLATE("admin_settings_saved", false, SPONSOR_ACCOUNT_IS_PENDING);
			}
			 else
			{
				// Could not unlock account!
				LOAD_TEMPLATE("admin_settings_saved", false, SPONSOR_ACCOUNT_PENDING_FAILED);
			}
		}
		 elseif ($SPONSOR['status'] == "EMAIL")
		{
			// Changed email adress need to be confirmed
			$result_update = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_sponsor_data SET status='CONFIRMED'
WHERE id='%s' AND hash='%s' AND status='EMAIL' LIMIT 1",
 array(bigintval($SPONSOR['id']), $_GET['hash']), __FILE__, __LINE__);

			// Check on success 
			if (SQL_AFFECTEDROWS() == 1)
			{
				// Sponsor account is unlocked again
				LOAD_TEMPLATE("admin_settings_saved", false, SPONSOR_ACCOUNT_IS_CONFIRMED_AGAIN);
			}
			 else
			{
				// Could not unlock account!
				LOAD_TEMPLATE("admin_settings_saved", false, SPONSOR_ACCOUNT_EMAIL_FAILED);
			}
		}
		 else
		{
			/// ??? Other status?
			LOAD_TEMPLATE("admin_settings_saved", false, SPONSOR_ACCOUNT_STATUS_FAILED);
		}
	}
	 else
	{
		// No sponsor found
		LOAD_TEMPLATE("admin_settings_saved", false, SPONSOR_ACCOUNT_404);
	}

	// Free memory
	SQL_FREERESULT($result);
}
 elseif ($MODE == "activate")
{
	// Send activation link again
	if (isset($_POST['ok']))
	{
		// Check submitted data
		if (empty($_POST['email'])) unset($_POST['ok']);
	}

	if (isset($_POST['ok']))
	{
		// Check email
		$result = SQL_QUERY_ESC("SELECT id, hash, status, remote_addr, gender, surname, family, sponsor_created
FROM "._MYSQL_PREFIX."_sponsor_data
WHERE email='%s' AND (status='UNCONFIRMED' OR status='EMAIL') LIMIT 1",
 array($_POST['email']), __FILE__, __LINE__);
		if (SQL_NUMROWS($result) == 1)
		{
			// Unconfirmed sponsor account found so let's load the requested data
			$SPONSOR = SQL_FETCHARRAY($result);

			// Translate some data
			$SPONSOR['gender']           = TRANSLATE_GENDER($SPONSOR['gender']);
			$SPONSOR['sponsor_created'] = MAKE_DATETIME($SPONSOR['sponsor_created']);

			// Prepare email and send it to the sponsor
			if ($SPONSOR['status'] == "UNCONFIRMED")
			{
				// Unconfirmed accounts
				$msg_sponsor = LOAD_EMAIL_TEMPLATE("sponsor_activate", $SPONSOR);
			}
			 else
			{
				// Confirmed email address
				$msg_sponsor = LOAD_EMAIL_TEMPLATE("sponsor_email", $SPONSOR);
			}
			SEND_EMAIL($_POST['email'], SPONSOR_ACTIVATION_LINK_SUBJ, $msg_sponsor);

			// Output message
			LOAD_TEMPLATE("admin_settings_saved", false, SPONSOR_ACTIVATION_LINK_SENT);
		}
		 else
		{
			// No account found or not UNCONFIRMED
			LOAD_TEMPLATE("admin_settings_saved", false, SPONSOR_ACTIVATION_LINK_404);
		}

		// Free memory
		SQL_FREERESULT($result);
	}
	 else
	{
		// Load form
		LOAD_TEMPLATE("guest_sponsor_activate");
	}
}
 elseif ($MODE == "lost_pass")
{
	// Send new password
	if (isset($_POST['ok']))
	{
		// Check submitted data
		if (empty($_POST['email'])) unset($_POST['ok']);
	}

	if (isset($_POST['ok']))
	{
		// Check email
		$result = SQL_QUERY_ESC("SELECT id, hash, remote_addr, gender, surname, family, sponsor_created
FROM "._MYSQL_PREFIX."_sponsor_data
WHERE email='%s' AND id='%s' AND status='CONFIRMED' LIMIT 1",
 array($_POST['email'], bigintval($_POST['id'])), __FILE__, __LINE__);
		if (SQL_NUMROWS($result) == 1)
		{
			// Unconfirmed sponsor account found so let's load the requested data
			$SPONSOR = SQL_FETCHARRAY($result);

			// Translate some data
			$SPONSOR['gender']           = TRANSLATE_GENDER($SPONSOR['gender']);
			$SPONSOR['sponsor_created'] = MAKE_DATETIME($SPONSOR['sponsor_created']);

			// Generate password
			$SPONSOR['password']        = GEN_PASS();

			// Prepare email and send it to the sponsor
			$msg_sponsor = LOAD_EMAIL_TEMPLATE("sponsor_lost", $SPONSOR);
			SEND_EMAIL($_POST['email'], SPONSOR_LOST_PASSWORD_SUBJ, $msg_sponsor);

			// Update password
			$result_update = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_sponsor_data SET password='%s'
WHERE id='%s' LIMIT 1",
 array(md5($SPONSOR['password']), bigintval($SPONSOR['id'])), __FILE__, __LINE__);

			// Output message
			LOAD_TEMPLATE("admin_settings_saved", false, SPONSOR_LOST_PASSWORD_SENT);
		}
		 else
		{
			// No account found or not UNCONFIRMED
			LOAD_TEMPLATE("admin_settings_saved", false, SPONSOR_LOST_PASSWORD_404);
		}

		// Free memory
		SQL_FREERESULT($result);
	}
	 else
	{
		// Load form
		LOAD_TEMPLATE("guest_sponsor_lost");
	}
}
 elseif (isset($_POST['ok']))
{
	// Check status and login data ...
	$result = SQL_QUERY_ESC("SELECT status FROM "._MYSQL_PREFIX."_sponsor_data
WHERE id='%s' AND password='%s' LIMIT 1",
 array(bigintval($_POST['sponsorid']), md5($_POST['pass'])), __FILE__, __LINE__);
	if (SQL_NUMROWS($result) == 1)
	{
		// Okay, first login data check passed, now has he/she an approved (CONFIRMED) account?
		list($status) = SQL_FETCHROW($result);
		if ($status == "CONFIRMED")
		{
			// Calculate cookie lifetime, maybe we have to change this so the admin can setup a
			// seperate timeout for these two cookies?
			$life = (time() + $_CONFIG['online_timeout']);

			// Is confirmed so both is fine and we can continue with login procedure
			$login = ((setcookie("sponsorid"  , bigintval($_POST['sponsorid']), $life, COOKIE_PATH)) &&
			          (setcookie("sponsorpass", md5($_POST['pass'])           , $life, COOKIE_PATH)));

			if ($login)
			{
				// Cookie setup successfull so we can forward to sponsor area
				LOAD_URL(URL."/modules.php?module=sponsor");
			}
			 else
			{
				// Cookie setup failed!
				LOAD_TEMPLATE("admin_settings_saved", false, SPONSPOR_COOKIE_SETUP_FAILED);
				OUTPUT_HTML("<br />");

				// Login formular and other links
				LOAD_TEMPLATE("guest_sponsor_login");
			}
		}
		 else
		{
			// Status is not fine
			$eval = "\$content = SPONSOR_LOGIN_FAILED_".strtoupper($status).";";
			eval($eval);
			LOAD_TEMPLATE("admin_settings_saved", false, $content);
			OUTPUT_HTML("<br />");

			// Login formular and other links
			LOAD_TEMPLATE("guest_sponsor_login");
		}
	}
	 else
	{
		// Account missing or wrong pass! We shall not find this out for the "hacker folks"...
		LOAD_TEMPLATE("admin_settings_saved", false, SPONSOR_LOGIN_FAILED_404_WRONG_PASS);
		OUTPUT_HTML("<br />");

		// Login formular and other links
		LOAD_TEMPLATE("guest_sponsor_login");
	}

	// Free memory
	SQL_FREERESULT($result);
}
 else
{
	// Login formular and other links
	LOAD_TEMPLATE("guest_sponsor_login");
}

//
?>