<?php
session_start();
// We need to copy the old session data
$previousSession = $_SESSION;
 
// Then re-create a new session
session_destroy();
session_start();
 
// And finally, reassign the session data
$_SESSION = $previousSession;
?>

<?php
	/*
	 * Error Codes
	 * 0: Success
	 * 1: User does not exist in DB
	 * 2: User is already logged in
	 * 3: Hash in form is not equal to server side created hash
	 * 4: An error occured while creating the session in the DB
	*/
	session_start();
	srand(time());
 
	if(!isset($_SESSION['RND'])) {
		$_SESSION['RND'] = sha1(rand()%1000001);
	}
 
	if(!isset($_SESSION['authINF1'], $_SESSION['authINF2'], $_SESSION['authINF3'])) {
		$_SESSION['authINF1'] = sha1($_SERVER['HTTP_USER_AGENT']);
		$_SESSION['authINF2'] = sha1($_SERVER['HTTP_ACCEPT_LANGUAGE']);
		$_SESSION['authINF3'] = sha1($_SERVER['REMOTE_ADDR']);
	}
 
	function authenticate() {
		if(!isset($_SESSION['conSession'], $_SESSION['chSession'])) {
			// Get information from form
			$username = htmlentities($_POST['username'], ENT_QUOTES);
			$hash = htmlentities($_POST['hash'], ENT_QUOTES);
 
			// Create salt for hash
			$salt = htmlentities($_SESSION['RND'], ENT_QUOTES);
			$_SESSION['RND'] = sha1(rand()%1000001);
			$salt .= htmlentities($_SERVER['REMOTE_ADDR'], ENT_QUOTES);
			$salt .= htmlentities($_SERVER['HTTP_USER_AGENT'], ENT_QUOTES);
 
			$qGetUser = @mysql_query("SELECT * FROM users WHERE gebruikersnaam='".$username."'");
			if(@mysql_num_rows($qGetUser) == 1) {
 
				// The user exists in the DB
				$aGetUser = @mysql_fetch_assoc($qGetUser);
				$qGetSession = @mysql_query("SELECT * FROM sessions WHERE gebruikersnaam='".$username."'");
				if(@mysql_num_rows($qGetSession) == 0) {
 
					// The user is not logged in yet
					$serverSideHash = sha1($aGetUser['wachtwoord'].$salt);
					if($serverSideHash == $hash) {
 
						// The submitted hash and the server side created one are equal
						$chSession = sha1(rand()%1000001);
						if(@mysql_query("INSERT INTO sessions(gebruikersnaam, conSessie, chSessie, sessieTijd) VALUES('".$username."', '".$serverSideHash."', '".$chSession."', ".time().")")) {
 
							// The session has been created
							$_SESSION['conSession'] = $serverSideHash;
							$_SESSION['chSession'] = $chSession;
							$err = 0;
						}
						else {
							$err = 4;
						}
					}
					else {
						$err = 3;
					}
				}
				else {
					$err = 2;
				}
			}
			else {
				$err = 1;
			}
		}
		return $err;
	}
 
	function renew() {
		deleteOldSessions();
		session_regenerate_id(TRUE);
		$conSession = htmlentities($_SESSION['conSession'], ENT_QUOTES);
		$chSession = htmlentities($_SESSION['chSession'], ENT_QUOTES);
		$qGetSession = @mysql_query("SELECT * FROM sessions WHERE conSessie='".$conSession."' AND chSessie='".$chSession."'");
 
		if(@mysql_num_rows($qGetSession) == 1) {
			$aGetSession = @mysql_fetch_assoc($qGetSession);
			if($chSession == $aGetSession['chSessie']) {
				$chSession = sha1((rand()%1000001).$chSession);
				$_SESSION['chSession'] = htmlentities($chSession, ENT_QUOTES);
				@mysql_query("UPDATE sessions SET chSessie='".$chSession."', sessieTijd=".time()."");
			}
		}
	}
 
	function destroy() {
		$conSession = htmlentities($_SESSION['conSession'], ENT_QUOTES);
		$chSession = htmlentities($_SESSION['chSession'], ENT_QUOTES);
		$qGetSession = @mysql_query("DELETE FROM sessions WHERE conSessie='".$conSession."' AND chSessie='".$chSession."'");
		session_unset();
		session_destroy();
	}
 
	function deleteOldSessions() {
		$inactivityTime = 60*5;
		$expirationTime = time() - $inactivityTime;
 
		if(isset($_SESSION['conSession']) && isset($_SESSION['chSession'])) {
			$conSession = htmlentities($_SESSION['conSession'], ENT_QUOTES);
			$chSession = htmlentities($_SESSION['chSession'], ENT_QUOTES);
			$qGetSession = @mysql_query("SELECT * FROM sessions WHERE conSessie='".$conSession."' AND chSessie='".$chSession."' AND sessieTijd<".$expirationTime."");
			$aGetSession = @mysql_fetch_assoc($qGetSession);
			if(@mysql_num_rows($qGetSession) == 1) {
				destroy();
			}
		}
		@mysql_query("DELETE FROM sessions WHERE sessieTijd<".$expirationTime."");
	}
?>

<?php
	include_once("login_BackEnd.php");
	include_once("connect.php");
	deleteOldSessions();
 
	if(isset($_POST['logIn'])) {
		$response = authenticate();
		switch($response) {
			case 0:
				$msg = "Succes";
				$type = "notification";
				break;
			default:
				$msg = $response;
				$type = "information";
				break;
		}
	}
 
	if(isset($_SESSION['conSession'], $_SESSION['chSession'])) {
		if((sha1($_SERVER['HTTP_USER_AGENT']) == $_SESSION['authINF1']) && (sha1($_SERVER['HTTP_ACCEPT_LANGUAGE']) == $_SESSION['authINF2']) && (sha1($_SERVER['REMOTE_ADDR']) == $_SESSION['authINF3'])) {
			$conSession = htmlentities($_SESSION['conSession'], ENT_QUOTES);
			$chSession = htmlentities($_SESSION['chSession'], ENT_QUOTES);
			$qGetSession = @mysql_query("SELECT * FROM sessions WHERE conSessie='".$conSession."' AND chSessie='".$chSession."'");
			$aGetSession = @mysql_fetch_assoc($qGetSession);
			if(@mysql_num_rows($qGetSession) == 1) {
				$msg = "U bent ingelogd als ".$aGetSession['gebruikersnaam'];
				$type = "notification";
				renew();
			}
		}
	}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
	<head>
		<meta http-equiv="Content-type" content="text/html;charset=UTF-8">
		<title>Vermeersch Constructie</title>
		<script type="text/javascript" src="MooTools_Functions.js"></script>
		<script type="text/javascript" src="MooTools_BackEnd.js"></script>
		<!--[if lt IE 7.]>
			<script defer type="text/javascript" src="pngfix.js"></script>
		<![endif]-->
		<link rel="stylesheet" href="style.css" type="text/css">
		<script type="text/javascript" src="sha1.js"></script>
		<script type="text/javascript">
			function hashIt() {
				var salt = "<?php echo htmlentities($_SESSION['RND'], ENT_QUOTES); ?>";
				salt += "<?php echo htmlentities($_SERVER['REMOTE_ADDR'], ENT_QUOTES); ?>";
				salt += "<?php echo htmlentities($_SERVER['HTTP_USER_AGENT'], ENT_QUOTES); ?>";
				pass = document.getElementById('password').value;
 
				document.getElementById('password').value = "";
				document.getElementById('hash').value = hex_sha1(hex_sha1(pass)+salt);
			}
		</script>
	</head>
 
	<body>
		<div class="header"></div>
		<div class="container">
			<?php
				if(!empty($msg)) {
					showMsg($msg, $type);
					$msg = null;
					$type = null;
				}
			?>
			<form method="post" action="" onSubmit="hashIt();">
				<table>
					<tr>
						<td>Gebruikersnaam:</td><td><input type="text" name="username"></td>
					</tr>
					<tr>
						<td>Wachtwoord:</td><td><input type="password" id="password"></td>
					</tr>
					<tr>
						<td>&nbsp;</td><td style="text-align: right;"><input type="submit" name="logIn" value="Aanmelden"></td>
					</tr>
				</table>
				<input type="hidden" name="hash" id="hash">
			</form>
		</div>
		<div class="footer"><div style="padding: 6px;">&copy; Debaere Brecht</div></div>
	</body>
</html>