<?php
/*
 ########################################################################
#                                                                        #
#           Version 4       /                        /   /               #
#          -----------__---/__---__------__----__---/---/-               #
#           | /| /  /___) /   ) (_ `   /   ) /___) /   /                 #
#          _|/_|/__(___ _(___/_(__)___/___/_(___ _/___/___               #
#                       Free Content / Management System                 #
#                                   /                                    #
#                                                                        #
#                                                                        #
#   Copyright 2005-2006 by webspell.org                                  #
#                                                                        #
#   visit webSPELL.org, webspell.info to get webSPELL for free           #
#   - Script runs under the GNU GENERAL PUBLIC LICENSE                   #
#   - It's NOT allowed to remove this copyright-tag                      #
#   -- http://www.fsf.org/licensing/licenses/gpl.html                    #
#                                                                        #
#   Code based on WebSPELL Clanpackage (Michael Gruber - webspell.at),   #
#   Far Development by Development Team - webspell.org                   #
#                                                                        #
#   visit webspell.org                                                   #
#                                                                        #
 ########################################################################
*/

//settings

$sleep = 1; //idle status for script if password is wrong?

//settings end

$ws_pwd=md5($_POST['pwd']);
include("_mysql.php");
include("_settings.php");

$ws_user = $_POST['ws_user'];

$check = safe_query("SELECT * FROM ".PREFIX."user WHERE username='$ws_user'");
$anz = mysql_num_rows($check);

if($anz) {

	$check = safe_query("SELECT * FROM ".PREFIX."user WHERE username='$ws_user' AND activated='1'");
	if(mysql_num_rows($check)) {

    $ds=mysql_fetch_array($check);
	
		// check password
		$login = 0;
		if($ws_pwd == $ds[password]) {

    	//session
    	session_name('ws_session');
    	session_start();
    	$_SESSION['ws_auth'] = $ds['userID'].":".$ws_pwd;
    	$_SESSION['ws_lastlogin'] = $ds[lastlogin];
    	$_SESSION['referer'] = $_SERVER['HTTP_REFERER'];
    	//cookie
			setcookie("ws_auth", $ds['userID'].":".$ws_pwd, time()+($sessionduration*60*60));
			$login = 1;
		}
		elseif(!($ws_pwd == $ds[password])) {
      if($sleep) sleep(5);
	   	 $error='You have entered an invalid password.<br><br><a href="javascript:history.back()">Go back and try it again!</a>';
		}
	}
	else $error='Your account is not activated.<br><br>
					  <a href="javascript:history.back()">Go back and try it again!</a>';

}
else $error='No user with username <b>'.htmlspecialchars($ws_user).'</b> available.<br><br>
					  <a href="javascript:history.back()">Go back and try it again!</a>';

?>
<html>
<head>
<title><? echo PAGETITLE; ?></title>
<link href="_stylesheet.css" rel="stylesheet" type="text/css">
<?php if($login) { echo '<meta http-equiv="refresh" content="1;URL=index.php?site=loginoverview">';$error = 'Login successful!'; } ?>
</head>
<body bgcolor="<?php echo PAGEBG; ?>">
<table width="100%" height="100%">
  <tr>
    <td align="center">
	  <table width="350" border="1" cellpadding="10" cellspacing="0" bordercolor="<?php echo BORDER; ?>" bgcolor="<?php echo BG_1; ?>">
	    <tr>
		  <td align="center"><? echo $error; ?></td>
		</tr>
	  </table>
    </td>
  </tr>
</table>
</body>
</html>
