<?
########## Confixx(R) 3.0 Professional ############
####### Copyright SWsoft, Inc. 2004-2005 ##########
#### http://www.sw-soft.com - info@sw-soft.com ####


header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");    // Date in the past
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); // always modified
header("Cache-Control: no-store, no-cache, must-revalidate");  // HTTP/1.1
header("Pragma: no-cache");                          // HTTP/1.0

error_reporting(7);

if (!isset($umgesetzt)) {
	$umgesetzt = true;

	if (is_array($_GET)) {
		foreach($_GET as $key => $val) {
			if (!is_array($val)) {
				if (get_magic_quotes_gpc()) $val = StripSlashes($val);
				//$val = AddSlashes(StripSlashes($val));
			}
			$$key = $val;
		}
	} elseif (is_array($HTTP_GET_VARS)) {
		foreach($HTTP_GET_VARS as $key => $val) {
			if (!is_array($val)) {
				if (get_magic_quotes_gpc()) $val = StripSlashes($val);
				//$val = AddSlashes(StripSlashes($val));
			}
			$$key = $val;
		}
	}

	if (is_array($_POST)) {
		foreach($_POST as $key => $val) {
			if (!is_array($val)) {
				if (get_magic_quotes_gpc()) $val = StripSlashes($val);
				//$val = AddSlashes(StripSlashes($val));
			}
			$$key = $val;
		}
	} elseif (is_array($HTTP_POST_VARS)) {
		foreach($HTTP_POST_VARS as $key => $val) {
			if (!is_array($val)) {
				if (get_magic_quotes_gpc()) $val = StripSlashes($val);
				//$val = AddSlashes(StripSlashes($val));
			}
			$$key = $val;
		}
	}

	if (is_array($_SERVER)) {
		foreach($_SERVER as $key => $val) {
			$$key = $val;
		}
	} elseif (is_array($HTTP_SERVER_VARS)) {
		foreach($HTTP_SERVER_VARS as $key => $val) {
			$$key = $val;
		}
	}

	unset($key, $val);
}


$PHP_AUTH_USER = $PHP_AUTH_PW = '';

include("../settings.inc.php");
include("../functions.inc.php");
include('../sessions.inc.php');

db_connect($db_host, $db_user, $db_pass);

sessao_start();

//echo $_SERVER['REQUEST_URI'];


/*
if( $_POST['username'] && $_POST['password'] )
{
	if(!get_magic_quotes_gpc())
	{
		$_POST['username'] = addslashes($_POST['username']);
	}
	
	$id = db_query("select longpw, anbieter, gesperrt from kunden where kunde = '".$_POST['username']."'");
	//echo "select longpw, gesperrt from anbieter where anbieter = '".$_POST['username']."'";
	if (db_num_rows($id))
	{
		$werte = db_fetch_array($id);
		//print_r($werte);
		$pwd_cr = crypt($_POST['password'], $werte['longpw']);
		if($pwd_cr == $werte['longpw'] && !$werte['gesperrt']) 
		{
			session_register('_username', '_password', '_usertype');
			$_SESSION['_username'] = $_POST['username'];
			$_SESSION['_password'] = $_POST['password'];
			$_SESSION['_usertype'] = USERTYPE_USER;
		}
	}
}

if($_SESSION['_username'])
{
	$PHP_AUTH_USER = $_SESSION['_username'];
	$PHP_AUTH_PW = $_SESSION['_password'];
}

if(preg_match('/^\/user\/([^\/]+)\/.*$/',$_SERVER['REQUEST_URI'], $ma))
{
	$url_user = $ma[1];	
}

if($url_user && $_SESSION['_usertype'] == USERTYPE_RESELLER && $_SESSION['_username'])
{
	if($id = db_query('SELECT COUNT(*) AS cnt FROM kunden WHERE kunde=\'' . addslashes($url_user) . '\''))
	{
		$werte = db_fetch_array($id);
		if($werte['cnt'])
		{
			$PHP_AUTH_USER = $url_user;
		}
	}
}
*/

if(preg_match('/^\/user\/([^\/]+)\/.*$/',$_SERVER['REQUEST_URI'], $ma))
{
	//$url_user = $ma[1];	
	if(isSUserLogged($ma[1]))
	{
		$PHP_AUTH_USER = strtolower(trim($ma[1]));	
	}
}


if(!$PHP_AUTH_USER)
{
	db_close;
	include('../loginform.php');
	exit();
}

if(0)
{
if (isset($PHP_AUTH_USER)) $PHP_AUTH_USER = strtolower(trim($PHP_AUTH_USER));

if ((!isset($PHP_AUTH_USER)) || ($olduser == $PHP_AUTH_USER))
	{
	 header('WWW-Authenticate: Basic realm="User Login"');
	 header('HTTP/1.0 401 Unauthorized');
	 include("../settings.inc.php");
	 include("../noaccess.inc.php");
	 exit();
	} 
else
	{
	 include("../settings.inc.php");
	 include("../functions.inc.php");
	 db_connect($db_host, $db_user, $db_pass);

	 ## login checken
	 $loUser = new SQLString($PHP_AUTH_USER);
	 $id = safe_query2( "SELECT kunde, longpw FROM ftp WHERE account = ? and gesperrt = 0", $loUser );
	 if (db_num_rows($id) > 0)
		{ # ist ftp login?
		 $werte = db_fetch_array($id);
		 $kunde = $werte["kunde"];
		 $ftppasswort = $werte["longpw"];
		 $cryptftppasswort = crypt($PHP_AUTH_PW, $ftppasswort);
		 if ($cryptftppasswort == $ftppasswort)
			{ # wenn passwörter korrekt
			 header("Location: /ftplogin/");
			 exit();
			}
		}

	 $id = safe_query2( "SELECT kunde, longpw FROM pop3 WHERE account = ? and gesperrt = 0", $loUser );
	if (db_num_rows($id) > 0)
		{ # ist pop3 login?
		 $werte = db_fetch_array($id);
		 $kunde = $werte["kunde"];
		 $poppasswort = $werte["longpw"];
		 $cryptpoppasswort = crypt($PHP_AUTH_PW, $poppasswort);
		 if ($cryptpoppasswort == $poppasswort)
			{ # wenn passwörter korrekt
			 header("Location: /poplogin/");
			 exit();
			}
		}
	## //

	## Kundenpasswort
	$id = safe_query2( "SELECT longpw, anbieter, gesperrt FROM kunden WHERE kunde = ?", $loUser );

	if (db_num_rows($id) < 1)
		{
		 header('WWW-Authenticate: Basic realm="User Login"');
		 header('HTTP/1.0 401 Unauthorized');
		 include("../noaccess.inc.php");
		 db_close();
		 exit();
		}

	$werte = db_fetch_array($id);
	$dbkundenpw = $werte["longpw"];
	$anbieter = $werte["anbieter"];
	$gesperrt = $werte["gesperrt"];
	$authkundenpw = crypt($PHP_AUTH_PW, $dbkundenpw);
	## /Kundenpasswort

	## anbieterpasswort
	$loRes = new SQLString($anbieter);
	$id = safe_query2( "SELECT longpw FROM anbieter WHERE anbieter = ? and gesperrt = 0", $loRes);
	$werte = db_fetch_array($id);
	$dbanbieterpw = $werte["longpw"];
	$authanbieterpw = crypt($PHP_AUTH_PW, $dbanbieterpw);
	## /anbieterpasswort

	## adminpasswort
	$id = db_query("select longpw from admin");
	$werte = db_fetch_array($id);
	$dbadminpw = $werte["longpw"];
	$authadminpw = crypt($PHP_AUTH_PW, $dbadminpw);
	## /adminpasswort

	if ((($dbkundenpw != $authkundenpw) || ($gesperrt > 0)) && ($dbanbieterpw != $authanbieterpw) && ($dbadminpw != $authadminpw))
		{
		 header('WWW-Authenticate: Basic realm="User Login"');
		 header('HTTP/1.0 401 Unauthorized');
		 include("../noaccess.inc.php");
		 db_close();
		 exit();
		}
	}

}

$loUser = new SQLString($PHP_AUTH_USER);
$id = safe_query2( "SELECT anbieter, language FROM kunden WHERE kunde=?", $loUser );
$werte = db_fetch_array($id);
$anbieter = $werte["anbieter"];
$shortlang = $werte["language"];
$loRes = new SQLString($anbieter);

$strSkinName="/skins/skin_1";
$confixx_interface_version = 'xp30';

## set language
if(session_is_registered('_del_settings') && array_key_exists($PHP_AUTH_USER, $_SESSION['_del_settings']))
{
	$shortlang = $_SESSION['_del_settings'][$PHP_AUTH_USER]['shortlang'];
	$strSkinName = $_SESSION['_del_settings'][$PHP_AUTH_USER]['strSkinName'];
	$confixx_interface_version = $_SESSION['_del_settings'][$PHP_AUTH_USER]['confixx_interface_version'];
}
else 
{
	$id = safe_query2( "SELECT custom_skins.path AS path, custom_skins.version AS version FROM skins ".
										 " INNER JOIN custom_skins ON (skins.skin_id = custom_skins.id) WHERE skins.cuser=?", $loRes );
	if(db_num_rows($id))
	{
		$werte = db_fetch_array($id);
		$confixx_interface_version = $werte['version'];
		$strSkinName = $werte['path'];
	}
}
$miscf = $shortlang."/misc.inc.php";
$langf = $shortlang."/user.inc.php";
include("../languages/$miscf");
include("../languages/$langf");


## //
if($confixx_interface_version != 'classic20')
{
	include_once('gui/module.GuiXP.php');
	$gui = new tGuiXP($strSkinName); // trailing slash !!!
}

db_close();
?>
