<?php
require( "const.inc" );

# validate email address
function check_email( $e ){
return(ereg("^[-!#$%&\'*+\\./0-9=?A-Z^_'a-z{|}~]+".'@'."[-!#$%&\'*+\\/0-9=?A-Z^_'a-z{|}~]+\."."[-!#$%&\'*+\\./0-9=?A-Z^_'a-z{|}~]+$",$e));
}

function lnkxid( $lnk, $xid ){
	if( !empty( $xid )){
		if( strpos( $lnk, '?' )) return( "$lnk&xid=$xid" );
		return( "$lnk?xid=$xid" );
	}
	return( $lnk );
}


# adds xid (session id) to all links in text
function add_xid( $txt, $xid ){
	global $fqdomain;
	if( empty( $xid )) return( $txt );
	$patt = "/<a\s*href\s*=\s*[\"']?([^>]+)[\"']?[^>]*>/i";
	if( $n = preg_match_all( $patt, $txt, $out, PREG_SET_ORDER )){
		for( $i = 0; $i < $n; $i++ ){
			$t1 = $out[$i][0];
			$t2 = $out[$i][1];
			$t2 = str_replace( '\"', '', $t2 );
			$t2 = str_replace( "\'", '', $t2 );
			$t2 = str_replace( '"', '', $t2 );
			$t2 = str_replace( "'", '', $t2 );
			$b1 = strpos( $t2, $fqdomain );		# has fqdomain
			$b2 = substr( $t2, 0, 1 ) == '/';	# starts with /
			$b3 = strpos( $t2, '.phtml' );		# has .phtml
			$b4 = strpos( $t2, 'ttp://' );		# has ttp://
			if( $b1 || $b2 || ( !$b4 && $b3 )) {
				$t3 = $t2;
				if( !$b3 && !strpos( $t3, '?' ) && substr( $t3, -1 ) != '/' ) $t3 .= '/';
				$t2 = str_replace( $t2, lnkxid( $t3, $xid ), $t1 );
				$txt = str_replace( $t1, $t2, $txt );
			}
		}
	}
	return( $txt );
}

function menu( $fn_memb, $is_maint ) {
	global $xid, $_fontmenu, $_lk1, $_lk2, $_ismemb, $_ismaint;
	echo "<font $_fontmenu><center>\n";
	while( list( $k, $t ) = each( $_lk1 )){
		echo add_xid( $t, $xid );
		echo "&nbsp;&nbsp;\n";
	}
	$t = 'Mitglieder';
	if( !empty( $fn_memb )) $t = "$fn_memb $_ismemb";
	echo "<a href='".lnkxid( '/member.phtml', $xid );
	echo "'>$t</a>&nbsp;&nbsp;\n";
	$t = 'Maintainer';
	if( $is_maint ) $t = "$fn_memb $_ismaint";
	echo "<a href='".lnkxid( '/maintainer.phtml', $xid );
	echo "'>$t</a>";
	while( list( $k, $t ) = each( $_lk2 )){
		echo "&nbsp;&nbsp;\n";
		echo add_xid( $t, $xid );
	}
	echo "</center></font>\n";
}

function elim_tags( $str ){
	$i = strpos( $str, "<" );
	if( is_string( $i )) return $str;	# $i is a string if not found
	$i += 1;
	$len = strlen( $str );
	while( ( $i > 0 ) && ( $i < $len )){
		if( $i = strpos( $str, ">", $i ) + 1 ){
			if( !$j = strpos( $str, "<", $i )) $j = $len;
			$t = $t.substr( $str, $i, $j-$i );
		}
		$i = strpos( $str, "<", $i );
	}
	return $t;
}

function htmlhead( $title, $keyw ){
	global $_text, $_page, $_link, $_vlink, $_alink, $_title;
	$title = elim_tags( $title );
	echo "<html>\n<head>\n<meta http-equiv='Content-Type' ";
	echo "content='text/html; charset=iso-8859-1'>\n";
	echo "<meta name='Author' content='Stefan Meretz'>\n";
	echo "<meta name='description' content='$_title: $title'>\n";
	if( !empty( $keyw )) echo "<meta name='keywords' content='$keyw'>\n";
	echo "<title>$_title: $title</title>\n";
	echo "</head>\n<body text='$_text' bgcolor='$_page' ";
	echo "link='$_link' vlink='$_vlink' alink='$_alink'>\n";
}

function foot() {
	global $fqdomain, $PHP_SELF, $maildom, $ot_maint, $_src, $_who, $_fontfoot, $xid;
	$link = 'http://'.$fqdomain.$PHP_SELF;
	$lastmod = getlastmod();
	$tag = date("j", $lastmod);
	if( strlen( $tag ) == 1 ) $tag = "0".$tag;
	$mon = date("M", $lastmod);
	$jahr = date("Y", $lastmod);
	$std = date("H", $lastmod);
	$min = date("i", $lastmod);
	switch ($mon) {
		case "Jan": $mon = "01"; break;
		case "Feb": $mon = "02"; break;
		case "Mar": $mon = "03"; break;
		case "Apr": $mon = "04"; break;
		case "May": $mon = "05"; break;
		case "Jun": $mon = "06"; break;
		case "Jul": $mon = "07"; break;
		case "Aug": $mon = "08"; break;
		case "Sep": $mon = "09"; break;
		case "Oct": $mon = "10"; break;
 		case "Nov": $mon = "11"; break;
		case "Dec": $mon = "12"; break;
		default: $mon = "??";
	}
	echo "<br>\n<font $_fontfoot>\n";
	echo "<hr size=1 noshade width=100%>\n<center>";
	echo "<br>$_src: <a href='".lnkxid( $link, $xid )."'>$link</a>";
	echo "<br>$_who: <a href=\"mailto:$ot_maint@$maildom\">$ot_maint@$maildom</a>\n";
	echo "<br><i>(Last Update: $tag.$mon.$jahr, $std:$min)</i></center></font>\n";
	echo "</body>\n</html>\n";
}

function new_user( $em, $wd, $page ){
	global $_fontbulk, $_fontinpt, $_fonthdln, $link_rules, $_bg5, $_x;
	htmlhead( 'New User', '' );
	menu( '', 0 );
	echo "<br><font $_fonthdln>\n";
	eval( "\$x = \"$_x[0]\";" );
	echo "<center><b>$x</b></center></font>\n<br><table width=100%>\n";
	echo "<tr><td bgcolor='$_bg5'><font $_fontbulk>";
	echo "<b>$_x[1]</b></font></td></tr>\n";
	echo "<tr><td><font $_fontbulk><img src='/images/more.gif'>\n";
	$email = urlencode( $em );
	eval( "\$x = \"$_x[2]\";" );
	echo "$x<br>&nbsp;</font></td><tr>\n";
	echo "<tr><td bgcolor='$_bg5'><font $_fontbulk>";
	echo "<b>$_x[3]</b></font></td></tr>\n";
	echo "<tr><td><font $_fontbulk><img src='/images/more.gif'>\n";
	eval( "\$x = \"$_x[4]\";" );
	echo "$x<br>&nbsp;</font></td></tr>\n";
	echo "<tr><td bgcolor='$_bg5'><font $_fontbulk>";
	echo "<b>$_x[5]</b></font></td></tr>\n";
	echo "<tr><td><font $_fontbulk><img src='/images/more.gif'>\n";
	echo "$_x[6]\n<center><form action='/member.phtml' method=post>\n";
	echo "<table><tr><td><font $_fontinpt>\n";
	echo "<input type='text' name='e_new' size=25 maxlength=80 value='$em'>";
	echo "</font></td></tr>\n<tr><td align=center><font $_fontbulk>\n";
	echo "<input type='hidden' name='action' value='new_pw'>\n";
	echo "<input type='hidden' name='xid' value=1>\n";
	echo "<input type='submit' value='$_x[7]'>";
	echo "</font></td></tr></table></form></center>\n</font></td></tr>\n";
	echo "<tr><td bgcolor='$_bg5'><font $_fontbulk>";
	echo "<b>$_x[8]</b></font></td></tr>\n";
	echo "<tr><td><font $_fontbulk><img src='/images/more.gif'>\n";
	echo "$_x[9]</font></td></tr>\n";
	echo "<tr><td align=center><font $_fontbulk>";
	echo "<form action='/member.phtml' method=post>\n";
	echo "<table><tr><td>\n";
	echo "<font $_fontbulk>\n$_x[10]:</font></td>\n";
	echo "<td><font $_fontinpt>\n";
	echo "<input type='text' name='fn_new' size=20 maxlength=30>";
	echo "</font></td>\n<td><font $_fontinpt>\n";
	echo "<input type='text' name='ln_new' size=20 maxlength=50>";
	echo "</font></td></tr>\n<tr><td>";
	echo "<font $_fontbulk>\n$_x[11]:</font></td>\n";
	echo "<td><font $_fontinpt>\n";
	echo "<input type='text' name='e_new' size=20 maxlength=80 value='$em'>";
	echo "</font></td>\n<td><font $_fontinpt>\n";
	echo "<input type='password' name='wd_new' size=20 maxlength=80 value='$wd'>";
	echo "</font></td></tr>\n<tr><td colspan=3 align=center>";
	echo "<font $_fontbulk>\n";
	echo "<input type='hidden' name='action' value='welcome'>\n";
	echo "<input type='hidden' name='xid' value=1>\n";
	echo "<input type='submit' value='$_x[12]'>";
	echo "</font></td></tr></table></form>\n";
	echo "</font></td></tr>\n<tr><td bgcolor='$_bg5'><font $_fontbulk>";
	echo "<b>$_x[13]</b></font></td></tr>\n";
	echo "<tr><td><font $_fontbulk><img src='/images/more.gif'>\n";
	eval( "\$x = \"$_x[14]\";" );
	echo "$x</font></td></tr>\n</table\n";
	foot();
}

function insert_session( $xid, &$xpar ){
	$qry = "select memb_id, first_n, last_n, email, subscr ";
	$qry .= "from member where x_id = $xid";
	if( !$id = mysql_query( $qry )){
		echo "Error 1011: ".mysql_errno().": ".mysql_error();
		exit;
	}
	if( $row = mysql_fetch_array( $id )){
		$mid = $row[ 'memb_id' ];
		$xem = $row[ 'email' ];
		$xfn = $row[ 'first_n' ];
		$xln = $row[ 'last_n' ];
		$xdt = $row[ 'subscr' ];
		$acc = date( 'Y-m-d G:i:s' );
		$xmt = 0;
		$qry = "select ismaint from projmemb where ismaint = 1 ";
		$qry .= "and memb_id = $mid";
		if( !$id = mysql_query( $qry )){
			echo "Error 1012: ".mysql_errno().": ".mysql_error();
			exit;
		}
		if( $row = mysql_fetch_array( $id )) $xmt = 1;
		$qry = "insert into session values( $xid, $mid, ";
		$qry .= "'$acc', '$xfn', '$xln', '$xem', $xmt, '$xdt' )";
		if( !mysql_query( $qry )){
			echo "Error 1013: ".mysql_errno().": ".mysql_error();
			exit;
		}
		$xpar[ 'acc' ] = $acc;
		$xpar[ 'mid' ] = $mid;
		$xpar[ 'xfn' ] = $xfn;
		$xpar[ 'xln' ] = $xln;
		$xpar[ 'xem' ] = $xem;
		$xpar[ 'xmt' ] = $xmt;
		$xpar[ 'xdt' ] = $xdt;
		return( TRUE );
	}
	return( FALSE );
}

function read_session( $xid, &$xpar ){
	global $xidval;
	if( empty( $xid )) $xid = $xidval;
	if( empty( $xid )) return( FALSE );
	$qry = "select x_id from member where x_id = $xid";
	if( !$id = mysql_query( $qry )){	# prevent cookie faking
		echo "Error 2001: ".mysql_errno().": ".mysql_error();
		exit;
	}
	if( !$row = mysql_fetch_array( $id )) return( FALSE );
	$qry = "select * from session where x_id = $xid";
	if( !$id = mysql_query( $qry )){
		echo "Error 2002: ".mysql_errno().": ".mysql_error();
		exit;
	}
	if( !$row = mysql_fetch_array( $id )){
		return( insert_session( $xid, $xpar ));
	} else {
		$xpar[ 'acc' ] = $row[ 'lacc' ];
		$xpar[ 'mid' ] = $row[ 'm_id' ];
		$xpar[ 'xfn' ] = $row[ 'xfn' ];
		$xpar[ 'xln' ] = $row[ 'xln' ];
		$xpar[ 'xem' ] = $row[ 'xem' ];
		$xpar[ 'xmt' ] = $row[ 'xmt' ];
		$xpar[ 'xdt' ] = $row[ 'xdt' ];
	}
	return( TRUE );
}

function head( $text, $keyw, &$xid, &$par ) {
	global $PHP_SELF, $_x, $_fontbulk, $_fontfoot, $_fonthdln, $_fg2, $_fg3, $_bg5, $xem, $xwd, $fqdomain, $xidval, $skip, $logout;
	$x = explode( '#', $_x[15] );
	$msg = '';
#	$msg = "xidval=$xidval, xid=$xid";
	if( empty( $skip )){
	# logout by button click
	if( $logout ){
		setcookie( 'xidval', '0', 0, '/' ); # delete cookie
		if( !empty( $xidval )){
			$qry = "delete from session where x_id = $xidval";
			if( !mysql_query( $qry )){
				echo "Error 1009: ".mysql_errno().": ".mysql_error();
				exit;
			}
		}
		$xid = '';
		$xidval = '';
	}

	# login by cookie
	if( empty( $xid ) && ( $xidval > 0 )){	# check cookie
		$xid = $xidval;
		$qry = "update session set lacc = now() where x_id = $xid";
		if( !mysql_query( $qry )){
			echo "Error 1010: ".mysql_errno().": ".mysql_error();
			exit;
		}
		if( mysql_affected_rows() < 1 ){
			insert_session( $xid, $par );
			$mid = $par[ 'mid' ];
			$xem = $par[ 'xem' ];
			$xfn = $par[ 'xfn' ];
			$xln = $par[ 'xln' ];
			$xdt = $par[ 'xdt' ];
			$xmt = $par[ 'xmt' ];
		}
		$msg = "<tr><td align=center colspan=2>\n";
		$msg .= "<font $_fontfoot color='$_fg3'>";
		$msg .= "* $x[5] *</font></td></tr>\n";
	}

	# login by form
	if( empty( $xid ) && !empty( $xem )) {
		if( empty( $xwd )){
			new_user( $xem, '', $PHP_SELF );
			return( FALSE );
		} elseif( !check_email( $xem )){
			$msg = "<tr><td align=center colspan=2>\n";
			$msg .= "<font $_fontfoot color='$_fg3'>";
			$msg .= "* $x[6] *</font></td></tr>\n";
		} else {
			$qry = "select memb_id, first_n, last_n, passwd, subscr ";
			$qry .=" from member where email = '$xem'";
			if( !$id = mysql_query( $qry )){
				echo "Error 1021: ".mysql_errno().": ".mysql_error();
				exit;
			}
			if( !$row = mysql_fetch_array( $id )){
					new_user( $xem, $xwd, $PHP_SELF );
					return( FALSE );
			} elseif( $row[ 'passwd' ] != $xwd ) {
				$msg = "<tr><td align=center colspan=2>\n";
				$msg .= "<font $_fontfoot color='$_fg3'>";
				$msg .= "* $x[7] *</font></td></tr>\n";
			} else {
				$mid = $row[ "memb_id" ];
				$xfn = $row[ 'first_n' ];
				$xln = $row[ 'last_n' ];
				$xdt = $row[ 'subscr' ];
				$xmt = 0;
				$qry = "select ismaint from projmemb where ismaint = 1 ";
				$qry .= "and memb_id = $mid";
				if( !$id = mysql_query( $qry )){
					echo "Error 1022: ".mysql_errno().": ".mysql_error();
					exit;
				}
				if( $row = mysql_fetch_array( $id )) $xmt = 1;
				srand((double)microtime()*1000000);
				$xid = rand();
				$qry = "insert into session values( $xid, $mid, ";
				$qry .= "now(), '$xfn', '$xln', '$xem', $xmt, '$xdt' )";
				if( !mysql_query( $qry )){
					echo "Error 1023: ".mysql_errno().": ".mysql_error();
					exit;
				}
				$qry = "update member set x_id = $xid where memb_id = $mid";
				if( !mysql_query( $qry )){
					echo "Error 1024: ".mysql_errno().": ".mysql_error();
					exit;
				}
				setcookie( 'xidval', $xid, time()+2419200, '/' ); # valid 4 weeks
			}
		}
	}
	# user has moved to another page
	if( !empty( $xid ) && empty( $xem )) {
		if( !read_session( $xid, $xpar )){
			$xid = '';
			$msg .= "<tr><td align=center colspan=2>\n";
			$msg .= "<font $_fontfoot color='$_fg3'>";
			$msg .= "* $x[8] *</font></td></tr>\n";
			setcookie( 'xidval', '0', 0, '/' ); # delete cookie
		} else {
			$mid = $xpar[ 'mid' ];
			$t = $xpar[ 'acc' ];
			$xfn = $xpar[ 'xfn' ];
			$xln = $xpar[ 'xln' ];
			$xem = $xpar[ 'xem' ];
			$xmt = $xpar[ 'xmt' ];
			$xdt = $xpar[ 'xdt' ];
			list( $yy, $mo, $dd ) = split( '-', substr( $t, 0, 10 ));
			list( $hh, $mm, $ss ) = split( ':', substr( $t, -8 ));
			$t = time() - mktime( $hh, $mm, $ss, $mo, $dd, $yy );
			if( $t > 3600 ) {	# update timestamp every hour
				$qry = "update session set lacc = now() ";
				$qry .= "where x_id = $xid";
				if( !mysql_query( $qry )){
					echo "Error 1032: ".mysql_errno().": ".mysql_error();
					exit;
				}
			}
		}
	}
	}
	$par[ 'mid' ] = $mid;
	$par[ 'xfn' ] = $xfn;
	$par[ 'xln' ] = $xln;
	$par[ 'xem' ] = $xem;
	$par[ 'xmt' ] = $xmt;
	$par[ 'xdt' ] = $xdt;
	$text = eregi_replace( '"', '\"', $text );
	eval( "\$text = \"$text\";" );
	htmlhead( $text, $keyw );
	echo "<table width=100%>\n";
	echo "<tr><td width=90%>\n";
	menu( $xfn, $xmt );
	if( isset( $text )) {
		echo "<br><font $_fonthdln>\n";
		echo "<center><b>$text</b></center></font>\n";
	}
	echo "</td><td width=10% bgcolor='$_bg5' align=center>\n";
	echo "<font $_fontfoot>\n";
	echo "<form action='$PHP_SELF' method=post>\n";
	echo "<table bgcolor='$_bg5'>\n";
	if( empty( $xid )) {
		echo "$msg<tr><td><font $_fontbulk>\n";
		echo "$x[0]:</font></td><td><font $_fontbulk>\n";
		echo "<input type='text' name='xem' size=10 maxlength=80 value='$xem'>";
		echo "</font></td></tr><tr><td><font $_fontbulk>\n";
		echo "$x[1]:</font></td><td><font $_fontbulk>\n";
		echo "<input type='password' name='xwd' size=10 maxlength=50>";
		echo "</font></td></tr></table>\n";
		echo "<input type=submit value='$x[2]'></form></font>";
	} else {
		echo "$msg<tr><td><font $_fontfoot>\n";
		echo "<font color='$_fg2'>$x[4]:</font>\n";
		echo "<br>$xfn $xln<br>$xem</font></td></tr></table>\n";
		echo "<input type='hidden' name='logout' value=1>";
		echo "<input type=submit value='$x[3]'></form></font>";
	}
	echo "</td></tr></table>\n";
	return( TRUE );
}

?>
