<?php
/****************************************************************************************
SMI (Services Maintenance Interventions) est une gestion libre de maintenance et de SAV

Version 0.9.6
Copyright (C) 2006  Sylvain FATOME

This program is free software; you can redistribute it and/or modify it under the terms
of the GNU General Public License as published by the Free Software Foundation; 
either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; 
without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program
(in the directory docs); 
if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, 
Boston, MA  02110-1301, USA.

Contact : galawa@free.fr
****************************************************************************************/

session_start(); 
?>
<?php include_once ("inc/config.inc.php") ?>
<?php
	$log_ip = $_SERVER['REMOTE_ADDR']; // Récupération adresse IP

	// Vérifie si l'administrateur a été créé (si non, il est créé)

	$conn = mysql_connect(DBHOST, DBUSER, DBPASS);
	mysql_select_db(DBNAME);
	$rech = "SELECT * FROM `" .TBPW. "` WHERE `pw_code` = '" .$admin_code. "'";
	$rs = mysql_query($rech) or die(mysql_error());
	if (mysql_num_rows($rs) == 0)
	{
		$pass = md5($admin_mdp); // Cryptage du mot de pass administrateur
		
		$rech2 = "INSERT INTO " .TBPW;
		$rech2 .= " (pw_code,pw_pass,pw_level,pw_lastsuccess,pw_lastip,pw_actif) VALUES";
		$rech2 .= " ('$admin_code','$pass','9','$dateheurea','$log_ip','1')";
		$rs2 = mysql_query($rech2) or die(mysql_error());
	}
	mysql_free_result($rs);
	mysql_close($conn);

	$validpwd = False;
	$Desactive = False;

	if (@$_POST["submit"] <> "")
	{	
		// Récupération Variables Formulaire

		$con_code = strip_tags(trim(@$_POST["con_code"]));
		$con_pass = md5(strip_tags(trim(@$_POST["con_pass"])));
		
		if (!$validpwd) 
		{	
			// Contrôle du mot de passe
	
			$conn = mysql_connect(DBHOST, DBUSER, DBPASS);
			mysql_select_db(DBNAME);
			$rech = "SELECT * FROM `" .TBPW. "` WHERE `pw_code` = '" .$con_code. "'";
			$rs = mysql_query($rech) or die(mysql_error());
			if (mysql_num_rows($rs) == 1) // Il ne peut y avoir qu'un seul résultat
			{
				if ($row = mysql_fetch_array($rs))
				{
					extract ($row);
					
					if ($con_code == $pw_code) // Le code entré doit correspondre exactement au code stocké (majuscules/minuscules)
					{
						if ($pw_pass == $con_pass) // Le mot de passe doit correspondre exactement
						{
							if ($pw_actif == 1) // Le compte doit être actif
							{
								$HTTP_SESSION_VARS["etat_log"] = "connecte";
								$HTTP_SESSION_VARS["niv_log"] = $pw_level;
								$HTTP_SESSION_VARS["code_log"] = $con_code;
								if ($pw_level == 4)								// Code agence
									$HTTP_SESSION_VARS["code_age"] = $con_code;
								if ($pw_level == 3)
								{
									$rech2 = "SELECT * FROM `" .TBTEC. "` WHERE `tec_code` = '".$con_code."'";
									$rs2 = mysql_query($rech2) or die(mysql_error());
									if ($row2 = mysql_fetch_array($rs2))
									{
										extract ($row2);
										$HTTP_SESSION_VARS["code_age"] = $tec_codeage;
									}
								}
								$rech2 = "UPDATE `" .TBPW. "` SET `pw_lastsuccess`='" .$dateheurea.  "', `pw_lastip`='" .$log_ip. "' WHERE `pw_id`='" .$pw_id. "'";
								$rs2 = mysql_query($rech2) or die(mysql_error());
								$validpwd = True;
							}
						}
					}
				}
			}
			mysql_free_result($rs);
			mysql_close($conn);
		}
	
		// Archivage du log	
			
		$code_session = @$HTTP_SESSION_VARS["code_log"];
		if ($code_session == "") // Test si pas encore connecté
			$code_session = "?";
		$datecourante = date("Y-m-d");
		$heurecourante = date("H:i:s");
		$urlpr = $_SERVER['HTTP_REFERER'];
		$racinesrv = $racine_web;
		$urlprecedent = ereg_replace($racinesrv,"",$urlpr); // "Nettoyage" si on était en domaine principal
		$urlcourant = $_SERVER['REQUEST_URI'];
	
		$conn2 = mysql_connect(DBHOST, DBUSER, DBPASS);
		mysql_select_db(DBNAME);
		$rechlog  = "INSERT INTO " .TBLOG;
		$rechlog .= " (log_code,log_date,log_heure,log_urlprec,log_url,log_ip) VALUES";
		$rechlog .= " ('$code_session','$datecourante','$heurecourante','$urlprecedent','$urlcourant','$log_ip')";
		$rslog = mysql_query($rechlog) or die(mysql_error());
		// mysql_free_result($rslog);
		mysql_close($conn2);
	} 

	if ($validpwd) 
	{
		if (@$HTTP_SESSION_VARS["etat_log"] == "connecte")
		{
			switch (@$HTTP_SESSION_VARS["niv_log"])
			{
				case 1 : header("Location: ".$rep_appli."/cli/index.php");
						 break;
				case 2 : header("Location: ".$rep_appli."/ope/index.php");
						 break;
				case 3 : header("Location: ".$rep_appli."/age/index.php");
						 break;
				case 4 : header("Location: ".$rep_appli."/age/index.php");
						 break;
				case 5 : header("Location: ".$rep_appli."/admin/index.php");
						 break;
				case 9 : header("Location: ".$rep_appli."/admin/index.php");
						 break;
						 
				default : break;
			}
		}
	}
?>



<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>SMI : Espace Priv&eacute;</title>

<!-- Feuille de style pour les affichages '" -->
<link href="css/smi.css" rel="stylesheet" type="text/css">

</head>

<body onLoad="document.con.con_code.focus();">


<table width="100%" height="300" border="0" cellspacing="0" cellpadding="0">
<tr>
	<td width="150" valign="top">&nbsp;
	</td>
	<td width="10">&nbsp;</td>
	<td valign="top">
		<form name="con" action="index.php" method="post" >
			<div align="center">
			<p><img src="img/logo.gif" alt="logo" width="195" height="36"></p>
			<p><img src="img/login.gif" width="64" height="64"></p>
			<p class="annot_std_it">Toutes les connexions sont archiv&eacute;es</p>
		  </div>
			<table width="366" border="0" align="center">
			<tr bgcolor="#FF0000">
				<td colspan="2"><div align="center" class="titre_std_gras_jaune_frouge"><strong>Connexion Espace Priv&eacute;</strong></div></td>
			</tr>
			<tr>
				<td>&nbsp;</td>
				<td>&nbsp;</td>
			</tr>
			<tr>
				<td width="50%"><div align="right" class="rubfrm">Code Utilisateur </div></td>
				<td>
				<input name="con_code" type="text" id="con_code" size="26" maxlength="20">
				</td>
			</tr>
			<tr>
				<td><div align="right" class="rubfrm">Mot de passe </div></td>
				<td>
				<input name="con_pass" type="password" id="con_pass" size="26" maxlength="20">
				</td>
			</tr>
			<tr>
				<td>&nbsp;</td>
				<td>&nbsp;</td>
			</tr>
			</table>
			<p align="center">
			<input name="RAZ" type="reset" id="RAZ" value="R&eacute;initialiser">
			<input type="submit" name="submit" value="Connexion">
			</p>
			<p align="center"><a href="pass.php">Mot de passe perdu ?</a> </p>
		</form>
		<?php if ($validpwd == 0) 
			{
				if ($Desactive == FALSE)
				{
					if (@$_POST["submit"] <> "") 
					{
		?>
		
					<p align="center"><font color="#FF0000"><font size="-1"><strong>Mauvais codes de connexion </strong></font></font></p>
		
		<?php
					} 
				}
				else
				{
		?>
				<p align="center"><font color="#FF0000"><font size="-1"><strong>Compte d&eacute;sactiv&eacute; </strong></font></font></p>
				<?php
				}
				
			} 
		?>
	<td width="10">&nbsp;</td>
    <td width="250" valign="top">&nbsp;
	
	</td>
</tr>
</table>
