<?php
	session_start();
	
	$error = "FAIL-Wrong Username or Password";
	
// Test for existing User Session	
	if(isset($_SESSION['userData']))
	{
// Check entered User against Stored-Session User
		$mUser = ($_POST['user']);
		if ($mUser == $_SESSION['userData']['user_id'])
		{
			$mPassword = strtolower(($_POST['password']));
			$mUserPassword = ($_SESSION['userData']['password']);
			if ($mPassword != $mUserPassword)
			{
				if (crypt($mPassword, $mUserPassword) != $mUserPassword)
				{
					$error = "FAIL-Wrong Username or Password";
				}
				else
					$error = "";
			}
			else
				$error = "";
// Input User matches Session User - Return Stored Allowed RDT Menu Codes		
			if ($error == "")
			{
				$_SESSION['userData']['timestamp'] = time();
				exit("OKUS-{user:".$_SESSION['userData']['user_id'].",allowedMenuCodes:".$_SESSION['userData']['allowed_menu_codes']."}");
			}
		}
	}	
// get default System Settings from xml file	
	$mSystem = "DEFAULT";
// Get System Definition XML from URL
	$mData = file_get_contents("trandef/systemsettings.xml");
// Parse XML to XML Object Array
	$xml = simplexml_load_string($mData, 'SimpleXMLElement', LIBXML_NOCDATA);
// Split-out System Definitions from XML 'fields' Nodes
	$i = 0;

	for ($i = 0; $i <= 150; $i++) 
	{			
		$mSystemId = "";
		$mPath = "";
		$mMqServer = "";
		$mCompany = "";
		if (("".$xml->systems->system[$i]->systemid."" == "") || ("".$xml->systems->system[$i]->systemid."" == false) || ("".$xml->systems->system[$i]->systemid."" == false))
			break;
		
		$mSystemId = "".$xml->systems->system[$i]->systemid."";
		if (($mSystemId == "") || ($mSystemId == false))
			break;
		
// Store System Settings from "trandef/systemsettings.xml"		
		if (strToUpper($mSystem) == strToUpper($mSystemId))
		{
			$mPath = "".$xml->systems->system[$i]->path."";
			$mDbHost = "".$xml->systems->system[$i]->dbhost."";
			$mDbUser = "".$xml->systems->system[$i]->dbuser."";
			$mDbPwd = "".$xml->systems->system[$i]->dbpwd."";
			$mDbase = "".$xml->systems->system[$i]->dbase."";
			break;
		}
		if (($mSystemId == "") || ($mSystemId == false))
			break;
	}

	$mConnection = mysqli_connect($mDbHost,$mDbUser,$mDbPwd,$mDbase)or die("FAIL-Failed to connect to Database: " . mysqli_connect_error()); 

// Get input User & Password	
	$mUser=$_POST['user']; 
	$mPassword=strtolower($_POST['password']); 

//Anti-Injection
//	$mUser = mysqli_real_escape_string($mUser);
//	$mPassword = mysqli_real_escape_string($mPassword);

// Release Session
	if(isset($_SESSION['userData']))
		unset($_SESSION['userData']);
	
// Get User Settings from Database
	$mResult="SELECT * FROM user WHERE user_id='".$mUser."' AND active=1 LIMIT 1";
	$mData = mysqli_query($mConnection,$mResult);
	$mUserPassword = "";
	$mAllowedMenuCodes = "";
	$i = 0;
	while($mRow = mysqli_fetch_assoc($mData)) 
	{
// Store User Settings in Session
		$_SESSION['userData'] = array_merge(array('timestamp'=>time()),$mRow);
		
		$mUserPassword = ($mRow['password']);
		$mAllowedMenuCodes = ($mRow['allowed_menu_codes']);
		$i++;
	}
	
	if ($i == 0)
	{
		$error = "FAIL-Wrong Username or Password";
	}
// Encrypt Input Password
	elseif ($mPassword != $mUserPassword)
	{
		if (crypt($mPassword, $mUserPassword) != $mUserPassword)
		{
			if(isset($_SESSION['userData']))
				unset($_SESSION['userData']);
			$error = "FAIL-Wrong Username or Password";
		}
		else
			$error = "";
	}
	else
		$error = "";
	
	mysqli_close($mConnection);
	
	if ($error == "")
	{
//		$_SESSION['userData']['timestamp'] = time(); //set new timestamp
		$mAllowedMenuCodes = str_replace(",",";",$mAllowedMenuCodes);
		exit("OKUS-{user:".$mUser.",allowedMenuCodes:".$mAllowedMenuCodes."}");
	}
	else
		exit($error);	
 ?>
