<?php

header("X-Content-Type-Options: nosniff");
header("X-XSS-Protection: 1; mode=block");
header("X-Frame-Options: DENY");
header('Expires: Sun, 01 Jan 2000 00:00:00 GMT');
header('Cache-Control: no-store, no-cache, must-revalidate');
header('Cache-Control: post-check=0, pre-check=0', FALSE);
header('Pragma: no-cache');

ini_set('session.cookie_httponly', 'on');
ini_set('session.cookie_secure', 'on');

session_name("SIGNADMAUTH");
session_start();

include "common/config/config.php";
include "common/config/dbconfig.php";
include "common/functions/funcconnect.php";
include "common/functions/funcvalidateinput.php";
openDB();

$nama=isset($_POST['nama']) ? cleanval($_POST['nama']) : NULL;
$passcode=isset($_POST['katasandi']) ? cleanval($_POST['katasandi']) : NULL;
$ver_code=isset($_POST['ver_code']) ? cleanval($_POST['ver_code']) : NULL;
$thestring=isset($_SESSION['the_string']) ? cleanval($_SESSION['the_string']) : NULL;

if (empty($nama))
{ $msg="Masukan username untuk login<br><br>".$linkback;
		}
else if (empty($passcode))
{ $msg="Masukan password untuk login<br><br>".$linkback;
		}
else	if ($_SESSION['LOGINFAIL']>2 && empty($ver_code))
{ $msg="Masukan kode pengaman yang diberikan untuk login<br><br>".$linkback;
		}
else if ($_SESSION['LOGINFAIL']>2 && strtolower($_SESSION['new_string'])!=strtolower($ver_code))
{ $msg="Kode pengaman yang dimasukan salah<br><br>".$linkback;
		}
/*
else if (!userpresence($nama))
{ $msg="Username ini sedang digunakan di tempat lain<br><br>".$linkback;
		}
*/
else
{ include "common/functions/funcpass.php";
		$katasandi=saltpassword($passcode);
		if (!isset($_SESSION['LOGINFAIL']))
		{ $currentfail=0;
				}
		else
		{ $currentfail=$_SESSION['LOGINFAIL'];
				}		
		if ($_SESSION['LOGINFAIL']>2)
		{ $ver_code=$_POST['ver_code'];
				}
		
		$qusr="SELECT * 
									FROM $db_appusers
									WHERE username='".$nama."'
									";
		$rusr=mysqli_query($dbConnection, $qusr);
		if (mysqli_num_rows($rusr)>0)
		{ $dusr=mysqli_fetch_array($rusr);
				if ($dusr['wrongpassword']<=5)
				{ if ($katasandi==$dusr['userpass'])
						{ $_SESSION['SES_USERID']=$dusr['userid'];
								$_SESSION['SES_FULLNAME']=$dusr['fullname'];
								$_SESSION['SES_USERNAME']=$dusr['username'];
								$_SESSION['SES_USERPASS']=$dusr['userpass'];
								$_SESSION['SES_USEREMAIL']=$dusr['useremail'];
								$_SESSION['SES_GROUPID']=$dusr['usergroupid'];
								$_SESSION['SES_IDKPO']=1;
								$_SESSION['new_string']="";
								$_SESSION['the_string']="";
								// update waktu login
								$uas="UPDATE $db_appusers
														SET wrongpassword='0', 
																		lastlogin='".$wktsekarangdb."', 
																		logintime='".$wktsekarangdb."'
														WHERE userid='".$_SESSION['SES_USERID']."' 
																				AND username='".$_SESSION['SES_USERNAME']."'
														";
								$ras=mysqli_query($dbConnection, $uas);
								header ("location: index.php");
								}
						else
						{ $msg="Username atau password yang dimasukan salah.<br><br>".$linkback;
								$_SESSION['LOGINFAIL']=$currentfail+1;
								$uas="UPDATE $db_appuser 
														SET wrongpassword='".$_SESSION['LOGINFAIL']."' 
														WHERE username='".$nama."'
														";
								$ras=mysqli_query($dbConnection, $uas);
								}
						}
				else
				{ $msg="Username atau password yang dimasukan salah<br><br>".$linkback;
						}
				}
		else
		{ $msg="Username atau password yang dimasukan salah<br><br>".$linkback;
				$_SESSION['LOGINFAIL']=$currentfail+1;
				}
		if ($thestring!="")
		{ unlink("ver_code/verify".$thestring.".png");
				}
		}

if (!empty($msg))
{ $content="<table border='0' cellpadding='6px' cellspacing='1px' width='100%'>
													<tr>
														<td align='center' valign='middle' colspan='3'>
															<b>LOGIN USER</b><br><br><br>
														</td>
													</tr>
													<tr>
														<td align='center' valign='top' width='100%'>
															".$msg."
														</td>
													</tr>	
												</table>
												";

		include "common/include/template.php";
		$temp=new template;
		$temp->define_theme("themes/theme_notlogin.html");
		$temp->define_tag("{PAGETITLE}", $namaaplikasi);
		$temp->define_tag("{APPCONTENT}", $content);
		$temp->parse();
		$temp->printproses();
		}
		
closeDB();

?>