<?php

require_once 'browser_common.php';
require_once 'browser_manage_common.php';

//print_r($_POST);

$err_msg = null;
// load session
$dispparam = $_SESSION['browser']['dispparam'];
$s = $dispparam['species'];
$r = $dispparam['revision'];
$tracks    = $_SESSION['browser']['tracks'][$s][$r];

// load GET
$auth_mode = $_GET['auth_mode'];
if (isset($_GET['tracknum'])) {
	$tracknum  = $_GET['tracknum'];
	if ( isset($tracks[$tracknum]) ) {
		$track = $tracks[$tracknum];
		$trackname = $track['name'];
	}
}

$val1 = null;
if(isset($_GET['val1'])){
$val1 = $_GET['val1'];
}
$val2 = null;
if(isset($_GET['val2'])){
$val2 = $_GET['val2'];
}

// load POST
$input_user = null;
if(isset($_POST['user'])){
$input_user = $_POST['user'];
}
$input_pass = null;
if(isset($_POST['password'])){
$input_pass = md5($_POST['password']);
}
$input_e_mail = null;
if(isset($_POST['e_mail'])){
$input_e_mail = $_POST['e_mail'];
}
$input_user = htmlspecialchars($input_user);
$input_e_mail = htmlspecialchars($input_e_mail);

// create SID
$htmlSID = htmlspecialchars(SID);

// DB connect
$hDB_trackinformation = pg_connect($trackinformation_connection_string);
assert($hDB_trackinformation);

// create param
$param = array();
$param = $_GET;
if ( !isset($param['user_name']) ) {
  if(isset($_SESSION['login']['user_name'])){
    $param['user_name'] = $_SESSION['login']['user_name'];
  }
}
if ( !isset($param['user_id']) ) {
  if(isset($_SESSION['login']['user_id'])){
	$param['user_id'] = $_SESSION['login']['user_id'];
  }
}

//**************************************************************************************
//							   execute login logout
//**************************************************************************************
if (isset($_GET['cmd']) &&  $_GET['cmd'] == "execute" ) {
	exec_login_logout($auth_mode,$s,$r,$param);
	$f_window_close = 1;
}

//**************************************************************************************
//							   alreay login
//**************************************************************************************
if ( !empty($_SESSION['login']) ) {
	exec_login_logout($auth_mode,$s,$r,$param);
	$f_window_close = 1;
}

//**************************************************************************************
//							   login
//**************************************************************************************
else if (isset($_POST['login'])) {

	if ( $_POST['user'] == "" || $_POST['password'] == ""  ) {
		$err_msg = "'User Name' or 'Password' are not input. Please reinput.";
	}
	else {
		$sql = "SELECT * FROM users WHERE name='$input_user';";
		$res_check = pg_query($hDB_trackinformation, $sql);

		if (pg_num_rows($res_check) == 0) {
			$err_msg = "User name '$input_user' is not registered.";
		} else if (pg_num_rows($res_check) == 1) {
			$corect_password = pg_fetch_result($res_check, 0, 'password');
			
			if ($input_pass == $corect_password) {
				$htmlSID = htmlspecialchars(SID);
				$spl = "SELECT UID FROM USERS WHERE NAME='$input_user'";
				$res = pg_query( $hDB_trackinformation,$sql );
				$user_id = pg_fetch_result($res,0,'uid');
				header("Location: ".$_SERVER['PHP_SELF']."?".$htmlSID."&auth_mode=$auth_mode&user_name=$input_user&user_id=$user_id&tracknum=$tracknum&val1=$val1&val2=$val2&cmd=execute");
			}
			else {
				$err_msg = "'Password' is incorrect.";
			}
		}
	}
}
	
//**************************************************************************************
//							   new user
//**************************************************************************************
else if (isset($_POST['new_user'])) {

	if ( $_POST['user'] == "" || $_POST['password'] == "" || $_POST['e_mail'] == "" ) {
		$err_msg = "'User Name' or 'Password' or 'Mail Address' is not input. Please reinput.";
	}
	else {
		if ( isset($input_e_mail) ) {
			// mail address format check
			$sql = "SELECT * FROM users WHERE name='$input_user';";
			$res_check = pg_query($hDB_trackinformation, $sql);
			if (pg_num_rows($res_check) == 0) {
				if ( preg_match ("/^[a-z0-9\._-]+@+[a-z0-9\._-]+\.+[a-z]{2,3}$/", $input_e_mail, $match ) ) {
					$sql = "INSERT INTO users (name, password, e_mail,authority) VALUES ('$input_user', '$input_pass', '$input_e_mail','user');";
					$res_add = pg_query($hDB_trackinformation, $sql);
					if (pg_result_status($res_add) == PGSQL_COMMAND_OK) {
						$htmlSID = htmlspecialchars(SID);
						$sql = "SELECT UID FROM USERS WHERE NAME='$input_user'";
						$res = pg_query( $hDB_trackinformation,$sql );
						if ( pg_num_rows($res) == 1 ) {
							$user_id = pg_fetch_result($res,0,'uid');
							header("Location: ".$_SERVER['PHP_SELF']."?".$htmlSID."&auth_mode=$auth_mode&user_name=$input_user&user_id=$user_id&tracknum=$tracknum&val1=$val1&val2=$val2&cmd=execute");
						}
					}
					else {
						$err_msg = "Could't add user.";
					}
				}
				else {
					$err_msg = "'Mail Address' is incorrect. Please reinput.";
				}
			}
			else {
				$err_msg = "User name '$input_user' is already exists.";
			}
		}
		else {
			$err_msg = "Please input 'Mail Address.'";
		}
	}
}


//**************************************************************************************
//							   modify password
//**************************************************************************************
else if (isset($_POST['modify_password'])) {

	if ( $_POST['user'] == "" || $_POST['password'] == ""  ) {
		$err_msg = "'User Name' or 'Password' are not input. Please reinput.";
	}
	else {
		$sql = "SELECT * FROM users WHERE name='$input_user';";
		$res_check = pg_query($hDB_trackinformation, $sql);

		if (pg_num_rows($res_check) == 0) {
			$err_msg = "User name '$input_user' is not registered.";
		} else if (pg_num_rows($res_check) == 1) {
			$corect_password = pg_fetch_result($res_check, 0, 'password');
			
			if ($input_pass == $corect_password) {
				$htmlSID = htmlspecialchars(SID);
				$spl = "SELECT UID FROM USERS WHERE NAME='$input_user'";
				$res = pg_query( $hDB_trackinformation,$sql );
				$modify_password_uid = pg_fetch_result($res,0,'uid');
			}
			else {
				$err_msg = "Password is not correct.";
			}
		}
	}
}

//**************************************************************************************
//							   modify password
//**************************************************************************************
else if (isset($_POST['modify_password_uid'])) {

	$modify_password_uid = $_POST['modify_password_uid'];
	$input_new_password = md5($_POST['new_password']);

	if ( empty( $_POST['new_password']) ) {
		$err_msg = "New password is empty. Please reinput new password.";
	}
	else {
		$sql = "UPDATE USERS SET PASSWORD='$input_new_password' WHERE UID=".$modify_password_uid;
		pg_query( $hDB_trackinformation, $sql );
		unset($modify_password_uid);
	}
}

//////////////////////////////////////////////////////////////////////////////////////////////
?>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML>
<HEAD>
<META http-equiv="Content-Type" content="text/html; charset=US-ASCII">
<META http-equiv="Content-Script-Type" content="text/javascript">
<META http-equiv="Content-Style-Type" content="text/css">
<TITLE>User Authentication</TITLE>
<SCRIPT language="JavaScript" src="browser_common.js"></SCRIPT>
<?php
	if ( isset($f_window_close) ) {
    print "<SCRIPT type=\"text/javascript\"> close_and_parent_reload(); </SCRIPT>";
	}
?>
<LINK rel="stylesheet" href="style/style.css" type="text/css">
</HEAD>
<BODY>

<H3>User Authentication</H3>
<?php
show_error_message($err_msg);
?>
<FORM METHOD="post">
<BR>
<TABLE>
<TR>
<?php
	/////// Modify Password //////////////////////////////////////////////////
	if ( isset($modify_password_uid)) { 
?>
<TR>
<TH>New Password</TH>
<TD><INPUT SIZE="16" TYPE="password" NAME="new_password" MAXLENGTH="16"></TD>
</TR>
</TABLE>
<BR>
<INPUT TYPE="hidden" NAME="modify_password_uid" VALUE="<?php print $modify_password_uid; ?>">
<INPUT TYPE="submit" NAME="execute_modify_password" VALUE="Modify" ALIGN="right">

<?php
	///////////////////////////////////////////////////////////////////////
	}
	else {
?>
<TH>User Name</TH>
<TD><INPUT SIZE="32" TYPE="text" NAME="user" MAXLENGTH="32" VALUE="<?php if ( isset($input_user) ) print $input_user; ?>"></TD>
</TR>

<TR>
<TH>Password</TH>
<TD><INPUT SIZE="16" TYPE="password" NAME="password" MAXLENGTH="16"></TD>
</TR>
<TH>Mail Address</TH>
<TD><INPUT SIZE="32" TYPE="text" NAME="e_mail" VALUE="<?php if (isset($input_pass)) print $input_e_mail ?>"></TD>
</TABLE>
<BR>
<INPUT TYPE="submit" NAME="login" VALUE="Login" ALIGN="right">
<INPUT TYPE="submit" NAME="new_user" VALUE="New User">
<INPUT TYPE="submit" NAME="modify_password" VALUE="Modify Password">
<?php
	}
?>
</FORM>
</BODY>
</HTML>