<?Lassoscript
// Last modified 8/28/10 by ECL, Landmann InterActive

// FUNCTIONALITY
// Login page

// CHANGE NOTES
// 10/12/07
// Recoded for CMS v. 3.0
// 12/20/07
// Login system reworked to condense to one file. This file USED to be named loginresponse.lasso. Also got rid of logout.lasso.
// 4/24/08
// Added LI_CMSatend to do at-end functions
// 4/28/08
// Changed functionality slightly so that if error passed from the logout Javascript, this is used
// 4/30/08
// Added LI_CMSatend at bottom of page to set focus to login box
// 5/1/08
// Fixed error being incorrectly set if vAction = Logout
// Changed behavior of svUser_ID and svUserPrivs_Priv to be always added to session (See line 25)
// 5/12/08
// Ported changes from LBT
// 7/23/09
// Added Robot Check
// 10/06/09
// Added Example login query
// 8/28/10
// Added admin folder path to a few includes

Include:'/siteconfig.lasso';

// Robot check
Include:($svLibsPath)'robotcheck.inc';

// Start the session
Session_Start: -Name=$svSessionAdminName, -Expires=$svSessionTimeout;
// If: (Var_Defined:'svUser_ID')==False; Session_AddVariable: -Name=$svSessionAdminName, 'svUser_ID'; /If;
// If: (Var_Defined:'svUserPrivs_Priv')==False; Session_AddVariable: -Name=$svSessionAdminName, 'svUserPrivs_Priv'; /If;
Session_AddVariable: -Name=$svSessionAdminName, 'svUser_ID';
Session_AddVariable: -Name=$svSessionAdminName, 'svUserPrivs_Priv';
If: (Var_Defined:'svAdmin_FName')==False; Session_AddVariable: -Name=$svSessionAdminName, 'svAdmin_FName'; Var:'svAdmin_FName'=''; /If;
If: (Var_Defined:'svAdmin_LName')==False; Session_AddVariable: -Name=$svSessionAdminName, 'svAdmin_LName'; Var:'svAdmin_LName'=''; /If;

// Page head
Include:($svLibsPath)'page_header_admin.inc';

// Debugging
// Var:'svDebug' = 'Y';

// This hack saves the debug status, then we turn it off until restored
// Var:'DebugStatus' = $svDebug;
// Var:'svDebug' = 'N';

If: $svDebug == 'Y';
	'<p class="debug"><strong>/admin/login</strong></p>\n';
/If;

// Copying Action_Params to Variables
Var:'vAction' = (Action_Param:'Action');
Var:'vUser_LoginID' = (Action_Param:'User_LoginID');
// Old MD5 encryption, now broken so we are replacing it with 
Var:'vUser_LoginPW' = (Encrypt_MD5:Action_Param:'User_LoginPW');
// This is (and should) ONLY be used to write bad attempts to the logfile.
// Do NOT change this routine to save passwords in the clear! This is a huge security risk!
Var:'vUser_LoginPWClear' = (Action_Param:'User_LoginPW');
Var:'vError' = (Action_Param:'Error');
Var:'vOption' = (Action_Param:'Option');

// Logout
If: $vAction == 'Logout';
	// End the session
	Session_End: -Name=$svSessionAdminName;
	Var:'svUser_ID' = '';
	Var:'svUserLoginID' = '';
	Var:'svUserPrivs_Priv' = '';
	
	// Set error to 6005 "Logout Successful" ONLY if error not passed
	If: Var:'vError' == '';
		Var:'vError' = '6005';
	/If;

Else: $vAction == 'Login';

	// Initialize Log Files
	// Create log file uniquely named by date if it does not already exist
	Var:('svLogDate')=(Date_Format:(Date_GetCurrentDate),-DateFormat='%m%d%Y');
	Var:('svLogFile') = '/logs/accesslog' ($svLogDate) '.log';
	If: (!File_Exists($svLogFile));
		File_Create($svLogFile);
		File_Chmod:($svLogFile), -u='rwx', -g='rwx', -o='rx';
	/If;
	
	// If ID or PW missing, output error 1003 "Required Missing"
	If: ($vUser_LoginID == '') || ($vUser_LoginPW == '');
		Var:'vError' = '1003';
		Var:'vOption' = 'Login ID and Password';
		If: $svDebug == 'Y';
			'<p class="debug">\n';
			'72: vError = ' ($vError) '<br>\n';
			'</p>\n';
		/If;
	
	// Check Login
	Else;
// EXAMPLE QUERY
/* SQLUserLogin - User Login */
/* SELECT User_ID,User_LoginID,User_LoginPW, User_FName,User_LName,UserPrivs_PrivID
FROM itpage_cms.cms_users
WHERE User_LoginID="admin"
AND User_Active = "Y" LIMIT 1; */
		Var:'SQLUserLogin'='/* SQLUserLogin - User Login */
SELECT User_ID,User_LoginID,User_LoginPW, User_FName,User_LName,UserPrivs_PrivID
FROM ' $svSiteDatabase '.' $svUsersTable '
WHERE User_LoginID="' $vUser_LoginID '"
AND User_Active = "Y" LIMIT 1';
	
		Inline: $IV_Users,-SQL=$SQLUserLogin;
			
			If: $svDebug == 'Y';
				'<p class="debug">\n';
				'85: Found_Count = ' (Found_Count) '<br>\n';
				'85: Error_CurrentError = ' (Error_CurrentError) '<br>\n';
				'</p>\n';
			/If;
	
			// If user found, copy variables and get Privs
			If: (Found_Count) > 0;
			// Setting variables for Login display in header
				Var:'svUser_ID'=			(Field:'User_ID');
				Var:'svUser_LoginID'=		(Field:'User_LoginID');
				Var:'svUser_LoginPW'=		(Field:'User_LoginPW');
				Var:'svAdmin_FName'=		(Field:'User_FName');
				Var:'svAdmin_LName'=		(Field:'User_LName');
				Var:'vUserPrivs_PrivID'=	(Field:'UserPrivs_PrivID');
	
				If: $svDebug == 'Y';
					'<p class="debug">\n';
					'104: svUser_ID = ' ($svUser_ID) '<br>\n';
					'104: vUser_LoginID = ' ($vUser_LoginID) '<br>\n';
					'104: svUser_LoginID = ' ($svUser_LoginID) '<br>\n';
					'104: vUser_LoginPW = ' ($vUser_LoginPW) '<br>\n';
					'104: svUser_LoginPW = ' ($svUser_LoginPW) '<br>\n';
					'104: vUser_LoginPWClear = ' ($vUser_LoginPWClear) '<br>\n';
					'104: svAdmin_FName = ' ($svAdmin_FName) '<br>\n';
					'104: svAdmin_LName = ' ($svAdmin_LName) '<br>\n';
					'104: vUserPrivs_PrivID = ' ($vUserPrivs_PrivID) '</p>\n';
				/If;
	
				// If login successful, set error to 6001 "Login Successful"
				If: (Var:'vUser_LoginID') == (Var:'svUser_LoginID') && (Var:'vUser_LoginPW') == (Var:'svUser_LoginPW');
					Var:'vError' = '6001';
	
					// Get Privs	
					Var:'SQLGetPrivs'='SELECT Userprivs_PrivID,Userprivs_Priv
						FROM ' $svSiteDatabase '.' $svUserPrivsTable ' WHERE
						Userprivs_PrivID="' (Var:'vUserPrivs_PrivID') '" LIMIT 1';
						Inline: $IV_UserPrivs, -SQL=$SQLGetPrivs;
							Var:'svUserPrivs_Priv'= (Field:'UserPrivs_Priv');
						/Inline;
					If: $svDebug == 'Y';
						'<p class="debug">\n';
						'107: vError = ' ($vError) '<br>\n';
						'107: SQLGetPrivs = ' ($SQLGetPrivs) '<br>\n';
						'107: svUserPrivs_Priv = ' ($svUserPrivs_Priv) '</p>\n';
					/If;
		
					// Update Last_Access
					Var:'SQLUpdateUser' = 'UPDATE ' $svUsersTable ' SET
						User_LastAccess = "'(Date_Format:(Date_GetCurrentDate),-DateFormat='%Q') '"
						WHERE User_ID = "' $svUser_ID '"';
					Inline: $IV_Users,-SQL=$SQLUpdateUser; /Inline;
	
	
					/* ----------------------------------------------------- */
					/* ------------ DEFINE SESSION VARIABLES --------------- */
					/* ----------------------------------------------------- */
					// Search Params
					If: (Var_Defined:'svSearch_Params')==False; Session_AddVariable: -Name=$svSessionAdminName, 'svSearch_Params';
						Var:'svSearch_Params'='';
					/If;
					If: (Var_Defined:'svSearch_ParamsURL')==False; Session_AddVariable: -Name=$svSessionAdminName, 'svSearch_ParamsURL';
						Var:'svSearch_ParamsURL'='';
					/If;
					
					/* ----------------------------------------------------- */
					/* ------------ END DEFINE SESSION VARIABLES ----------- */
					/* ----------------------------------------------------- */
	
	
					// Log SUCCESSFUL login
					Log: ($svLogFile);
						'LOGIN (SUCCESSFUL): ' (Server_Date: -Extended) +
						' ' 
						(Server_Time: -Extended) 
						'  [' 
						(Client_IP) +
						']  ' 
						'[LOGIN USED -- ID: ' (Var:'vUser_LoginID')  +
						']  ' 
						(Client_Type) +
						' ' 
						'http://'+(Var:'svDomain')+'/'+(Response_FilePath) +
						' ' 
						(Error_CurrentError: -ErrorCode) '\n';
					/Log;
	
	
				// Username and Password don't match database, kick out 6002 "Login Error"
				// Set $svUser_ID to nothing
				Else;
					Var:'vError' = '6002';
					Var:'svUser_ID' = '';
					Var:'svUserPrivs_Priv'= '';
					If: $svDebug == 'Y';
						'<p class="debug">\n';
						'186: vError = ' ($vError) '<br>\n';
						'186: vOption = ' ($vOption) '</p>\n';
					/If;
	
				// Log FAILED login attempt
				Log: ($svLogFile);
					'LOGIN (FAILED): ' (Server_Date: -Extended) +
					' ' 
					(Server_Time: -Extended) 
					'  [' 
					(Client_IP) +
					']  ' 
					'[LOGIN USED -- ID: ' (Var:'vUser_LoginID') '  PW: ' (Var:'vUser_LoginPWClear') +
					']  ' 
					(Client_Type) +
					' ' 
					'http://'+(Var:'svDomain')+'/'+(Response_FilePath) +
					' ' 
					(Error_CurrentError: -ErrorCode) '\n';
				/Log;
		
				/If;
	
			// User not found, kick out 6002 "Login Error"
			// Set $svUser_ID to nothing
			Else;
				Var:'vError' = '6002';
				Var:'svUser_ID' = '';
				Var:'svUserPrivs_Priv'= '';
				If: $svDebug == 'Y';
					'<p class="debug">\n';
					'214: vError = ' ($vError) '<br>\n';
					'214: vOption = ' ($vOption) '</p>\n';
				/If;
	
				// Log FAILED login attempt
				Log: ($svLogFile);
					'LOGIN (FAILED): ' (Server_Date: -Extended) +
					' ' 
					(Server_Time: -Extended) 
					'  [' 
					(Client_IP) +
					']  ' 
					'[LOGIN USED -- ID: ' (Var:'vUser_LoginID') '  PW: ' (Var:'vUser_LoginPWClear') +
					']  ' 
					(Client_Type) +
					' ' 
					'http://'+(Var:'svDomain')+'/'+(Response_FilePath) +
					' ' 
					(Error_CurrentError: -ErrorCode) '\n';
				/Log;
	
			/If;
		
			If: $svDebug == 'Y';
				'<p class="debug">\n';
				'221: SQLUserLogin = ' (Var:'SQLUserLogin') '<br>\n';
				'221: SQLUpdateUser = ' (Var:'SQLUpdateUser') '<br>\n';
				'221: svUser_ID = ' (Var:'svUser_ID') '<br>\n';
				'221: svUserPrivs_Priv = ' (Var:'svUserPrivs_Priv') '<br>\n';
				'221: Error_CurrentError = ' (Error_CurrentError) '<br>\n';
				'221: vError = ' $vError '</p>\n';
			/If;
	
		/Inline;

	/If;

// No action supplied, link was probably clicked from the navbar. Don't output an error.
// End the session, wipe out the vars, output error 1003 "Required Missing"
Else;
	// End the session
	Session_End: -Name=$svSessionAdminName;
	Var:'svUser_ID' = '';
	Var:'svUserLoginID' = '';
	Var:'svUserPrivs_Priv' = '';
/If;
?>
<table width="780">
	<tr>
		<td width="170">
			[Include:($svLibsPath)'navbar_main.inc']
		</td>
		<td>
			<div class="contentcontainerwhite">
<?Lassoscript
// Standard Error Table
If: (Var:'vError') != '';
	LI_ShowError3: -ErrNum=(Var:'vError'), -Option=(Var:'vOption');
/If;
// If login is OK, display the index page
If: (Var:'vError') == '6001';
	Include('/admin/index.inc');
	// Reset vError so it isn't picked up in login
	$vError = '';
Else;
	// Includes frm_login.lasso if user or pass did not match
	Include('/admin/frm_login.inc');
/If;
?>
			</div>
		</td>
	</tr>
</table>
[Output_None]<!-- [Var:'svDebug' = Var:'DebugStatus'] -->[/Output_None]
[Include:($svIncludesPath)'build_footer.inc']
[OutputFooter]
</body>
[LI_CMSatend]
</html>
