<?php
/********************************************************
* user login 
********************************************************/
session_start();
include_once("config.php");
include_once("mysql_interface.php");
include_once("func_core.php");


if(isset($_GET['chg-rsp']))
{

	if(!isset($_GET['RecordID']))
	{

		die;
	}
	$uni_rand = rand(1000,100000);
	
	$UniMate_db = new mydb();//create database object
	if(!($UniMate_db->connect($_config['host'], $_config['dbuser'], $_config['passwd'], $_config['port'], $_config['dbname'])))//check database connection
	{
		$uni_rand = -1;
	}
	else
	{
		$sql = "update UniMateToken_UserInfo set rand=".$uni_rand." where RecordID='".$_GET['RecordID']."'";

		if(!$UniMate_db->query($sql))
		{
			$uni_rand = -1;
		}
	}

	header("Content-Length:");
	header("UniMate_Rand:".$uni_rand);
	echo "\r\nUniMate_Rand:".$uni_rand."\r\n";
	die;
}
//added to deal with challenge-response 
else 
if(!isset($_GET['RecordID']) 
	 || !isset($_GET['AuthPass']))
{
?>
	<html>
		<head>
			<title>Online Authentication Demo</title>
			<style>
				body{
				background:#eeffaa;
				}
				#UniMate_auth{
				margin-left:50px;
				}
				#UniMate_auth h1{
				color:#446644;
				}
				#UniMate_auth hr{
				margin-top:-20px;
				}
			</style>
		</head>
		<body>
			<div id="UniMate_Authtication">
					<h1>Online Authentication Demo<h1>
					<hr>
					<div style="margin-top:-10px;width:80%;">
							<form name="auth_test" action=<?php echo $_SERVER['PHP_SELF'];?> method="get">
								<table>
									<tr>
										<td colspan="3" style="">Login here</td>
									</tr>
									<tr>
										<td>RecordID</td><td colspan="2"><input type="text" name="RecordID" /></td>
									</tr><tr>
										<td>Rand</td><td colspan="1"><input type="text" name="UniMate_rand" /></td><td><?php echo rand(1000, 9999);?><td>
									</tr><tr>
										<td>AuthPass</td><td colspan="2"><input type="text" name="AuthPass"/></td>	
									</tr>
									<tr>
										<td><input type="submit" name="UniMate_sub" value="Submit" onClick="urlencode()"></td><td><input type="reset" value="Reset"></td>
									</tr>
								</table>
							</form>
					</div>
		</div>
	</body>
	</html>
<?php
}
else if(isset($_GET['logoff']))
{
		$uni_id = $_GET['RecordID'];
		$doneinfo = "Information:UniMate Token removed succeed";
		$doneinfo = "Operation:".$uni_id."  time:".date("Y-m-d H:i:s")."<br>".$doneinfo;
		$title = "UniMate Token Removed";
		
		if(isset($_SESSION[$uni_id]))//deal with authroized token
		{
			unset($_SESSION[$uni_id]);//destroy session
			$doneinfo .= "<br>Info:<br> Session for user: ".$uni_id." destroy."	;
		}
		else//deal with invalid token
		{
			$doneinfo .= "<br>Info:<br> User: ".$uni_id." not authorized";
		}
		//print_r($_SESSION);//added for test
		show_done($doneinfo, $title);
		exit;			
}
else
{
	try{
					//Get user info (RecordID\rand\Authentication Password) here
					$uni_id = $_GET['RecordID'];

					$uni_authpass = $_GET['AuthPass'];
					
					if("" == $_GET['RecordID'] //invalid userinfo
						 || "" == $_GET['AuthPass'])
					{
						throw new Exception(-1);
						exit;
					}
					
					
					$UniMate_db = new mydb();//create database object
					if(!($UniMate_db->connect($_config['host'], $_config['dbuser'], $_config['passwd'], $_config['port'], $_config['dbname'])))//check database connection
					{
						throw new Exception(-2);
					}
					$sql = "select credential, active, rand from UniMateToken_UserInfo where RecordID = '".$uni_id."'";
				
					if(!($result = $UniMate_db->query($sql)))//execute sql statement
					{
						throw new Exception(-3);
					}
					if(!($re = $UniMate_db->fetch_row($result)))//ftech result
					{
						throw new Exception(-4);
					}
					if(0 == $re[1])
					{
					  throw new Exception(-5);
					}

					if("" == $re[2])
					{
						throw new Exception(-6);
					}
					else 
					{
						$uni_rand = $re[2];
					}

					$uni_type = 3;//UniMate type
					
					$ret = UniMate_Authentiation($uni_authpass, $uni_type, $uni_rand, $re[0], $uni_id, $UniMate_db);
					if(1 == $ret)
					{
						throw new Exception(1);
					}
					else
					{
					  throw new Exception(0);//header("Location:")
					  exit;	
					}
		}
		catch(Exception $e)//exception deal
		{
			switch($e->GetMessage())
			{
			case 0:
				$errinfo = "Error information:password error";
				$title = "Authenticate failed";
				break;
			case -1:
				$errinfo = "Error information:Not all in params given";
				$title = "Authenticate failed";
				break;
			case -2:
				$errinfo = "Error information:Connect database failed";
				$title = "Authenticate failed";
				break;
			case -3:
				$errinfo = "Error information:Invalid SQL statement";
				$title = "Authenticate failed";
				break;
			case -4:
				$errinfo = "Error information:Invalid user";
				$title = "Authenticate failed";
				break;
			case -5:
				$errinfo = "Error information:User is not active";
				$title = "Authenticate failed";
				break;
			case -6:
				$errinfo = "Error information:Server get rand failed";
				$title = "Authenticate failed";
				break;
			case 1:
				$doneinfo = "Information:Authenticate succeed";
				$doneinfo = "Operation:".$uni_id."  time:".date("Y-m-d H:i:s")."<br>".$doneinfo;
				
				$title = "Authenticate succeed";
				//$_SESSION[$uni_id] = 1;//add session for user identified by a usable UniMate
				
				show_done($doneinfo, $title);
				exit;			
			}
			$errinfo = "Operation:".$uni_id."  time:".date("Y-m-d H:i:s")."<br>".$errinfo;
			show_error($errinfo, $title);
			exit;
	}
}

?>
