<?php

/*

	Name: 		Volo Engine - Index File
	Authors:	Emil Bronikowski, Andr� Siegel
	Version: 	1.5
	License:	Proprietary (Genesi Shared License)
	
	Description: 	This file contains the lowest layer of the Volo Engine. It loads the basic
					configuration, theme files and any class files that are necessary to provide 
					the core functionality of the system. It also ensures that only authenticated
					users can enter protected system areas.  


*/

global $gt;


ini_set('display_errors',1);
error_reporting(E_ERROR); //


session_start();


// ENFORCIONG SECURE CONNECTION - The following code enforces that the visitor is using a secure connection

//if ($_SERVER['HTTPS'] != "on") {
//    $url = "https://". $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
//    header("Location: $url");
//    exit;
//}  


// MANDATORY CLASSES Level 1 - The following classes must be included for the base system to function.

include "classes/class_db.php";
include "classes/class_dbHandler.php";

// BASE CONFIGURATION FILE

if(!file_exists('configuration/'.$_SERVER['HTTP_HOST'].'.php')){
		header("HTTP/1.0 404 Not Found");
}

require_once 'configuration/'.$_SERVER['HTTP_HOST'].'.php';

# The loaded configuration file includes the name of the user interface theme.
# The system now checks if the defined theme exists and loads the base theme settings.

if(!file_exists('themes/'.$theme_name.'/theme.php')){
	die("The user interface could not be loaded.");
}

require_once 'themes/'.$theme_name.'/theme.php';


// DATA RETRIEVAL LAYER 1 - Access to Unprotected Resources Stored on the File System Level

# Note: Data Retrieval Layer 2 can be found in /modules/data.php. It limits access to logged in 
# users and provides access to resources stored inside a database.

switch($_GET['load']){

	case "image":			
					# Check and load the image file.
					
					header ("Content-Disposition: inline; filename=".basename($_GET['img']));
					$exp = explode(".",$_GET['img']);
					switch(strtolower($exp[count($exp)-1])){
					case "jpg":
					case "jpeg":
						$type = 'image/jpeg';
						break;
					case "gif":
						$type = 'image/gif';
						break;
					case "png":
						$type = 'image/png';
						break;
					default:
						die("This is not an image");
						break;
						}
					header("Content-type: ".$type);
					
					# Output the HTTP header.
					header('Expires: '.gmdate('D, d M Y H:i:s \G\M\T', time() + 2592000)); 

					die(@file_get_contents($image_directory.$_GET['img']));
					break;
	
	case "css": 	# This action is only used for themes used by the back-end user interface.
					# Front end website styles are stored inside the database instead.
									
					header ("Content-Disposition: attachment; filename=".basename($_GET['style']));
					$exp = explode(".",$_GET['style']);
					switch(strtolower($exp[count($exp)-1])){
						case "css":
							$type = 'text/css';
							break;
							default:
							die("The file you requested is not a cascading style sheet.");
							break;
					}
					header("Content-Type: ".$type.", true");
					
					# Output the HTTP header.
					header('Expires: '.gmdate('D, d M Y H:i:s \G\M\T', time() + 3600 * 24 * 30)); 

					die(@file_get_contents($css_directory.$_GET['style']));
					break;
					
	case "template":	# This action is only used for themes used by the back-end user interface.
						# Front end website styles are stored inside the database instead.
									
					header ("Content-Disposition: attachment; filename=".basename($_GET['templ']));
					$exp = explode(".",$_GET['templ']);
					switch(strtolower($exp[count($exp)-1])){
						case "html":
							$type = 'text/html';
							break;
							default:
							die("The file you requested is not a valid template file.");
							break;
					}
					header("Content-Type: ".$type);
					
					# Output the HTTP header.
					header('Expires: '.gmdate('D, d M Y H:i:s \G\M\T', time() + 3600 * 24 * 30)); 
					
					die(@file_get_contents($template_directory.$_GET['templ']));
					break;
					
					
	case "javascript":	# This action is only used for themes used by the back-end user interface.
						# Front end website styles are stored inside the database instead.
									
					header ("Content-Disposition: inline; filename=".basename($_GET['script']));
					$exp = explode(".",$_GET['script']);
					switch(strtolower($exp[count($exp)-1])){
						case "js":
							$type = 'text/javascript';
							break;
							default:
							die("The file you requested is not a valid Javascript file.");
							break;
					}
					header("Content-Type: ".$type);
					
					# Output the HTTP header.
					header('Expires: '.gmdate('D, d M Y H:i:s \G\M\T', time() + 3600 * 24 * 30)); 
					
					die(@file_get_contents($javascript_directory.$_GET['script']));
					break;
	}
	
	
// MANDATORY CLASSES Level 2 - The following classes must be included for the base system to function.

#include "classes/class_logs.php";
include "classes/class_templates.php";
include "classes/class_themes.php";
include "classes/class_users.php";


$db = new db;

$layout = new gtemplates;
$layout->template_dir($template_directory);
$layout->load("index.html");

$gt = new gtemplates;
$gt->template_dir($template_directory);

$auth = new auth($db);
#$logs = new logs($db);
$ses = new sessions($db);


//if($_GET['module'] == 'anmelden'){
//	$ses->store(
//	array(
//			'session_id' => session_id(),
//			'ip' => $_SERVER['REMOTE_ADDR']
//		)
//	);
//	$_SESSION['sesId'] = $db->last_id();
//	
//	$_SESSION['Email'] = $_POST['email'];
//	$_SESSION['Password'] = $_POST['passwd'];
//	if($userData = $auth->login($_POST['email'],$_POST['passwd'])){
//
//		if (password_verify($_POST['passwd'],$userData['passwd']) == 1)
//		{
//			$_SESSION['user'] = $userData;			
//			$logs->setUserId($_SESSION['user']['id']);
//			$logs->log("Logged in.");
//
//			$vUser = new vUsers($db);
//			$_SESSION['user']['last_login'] = 'NOW';										
//			$vUser->store($_SESSION['user'],$_SESSION['user']['id']);
//			
//			header("Location: /");
//		}	
//		else if($userData['passwd'] == md5($_POST['passwd']))
//		{
//			$_SESSION['user'] = $userData;						
//			$logs->setUserId($_SESSION['user']['id']);
//			$logs->log("Logged in.");
//
//			$vUser = new vUsers($db);
//			$_SESSION['user']['last_login'] = 'NOW';										
//									
//			header("Location: /");
//			die();
//		}
//	}
//}

//if($_SESSION['sesId']){
//	$current = $ses->get($_SESSION['sesId']);
//	if($current[0]['forced_logout']){
//		if (isset($_COOKIE[session_name()])) {
//			setcookie(session_name(), '', time()-1500000, '/');
//		}
//		session_destroy();
//		die('Your session was closed by a system administrator or you did it from another computer. <a href="/logout/">You can login again.</a>');
//	}
//	$ses->store(
//		array(
//			'ip' => $_SERVER['REMOTE_ADDR']
//		),
//		$_SESSION['sesId']
//	);
//}

//if($_GET['module'] == 'logout' && $_SESSION['user']['id']){
//	$logs->setUserId($_SESSION['user']['id']);
//	$logs->log("Logged out.");	
//	$ses->store(
//		array(
//			'logout' => 'NOW'
//		),
//		$_SESSION['sesId']
//	);
//	if (isset($_COOKIE[session_name()])) {
//		setcookie(session_name(), '', time()-150000, '/');
//	}
//	session_destroy();
//	header("Location: /");
//	die();	
//}

//if(!$_SESSION['user']['id'] && $_GET['module'] != 'docs'){
//	if ($_SERVER['HTTP_HOST'] == "vcp.strengthasone.com"){
//		$gt->load('index_soa.html');
//	} else {
//		$gt->load('index_public.html');	
//	}
//	if($_POST['email']){
//		$gt->attach("note","You entered a wrong email address or password. Please try again.");
//	}else{
//		$gt->attach("note","Sign In");
//	}
//	die($gt->commit());
//}


if($_GET['module'] == 'anmelden'){	
	$gt->load("home_list.html");

	if ($_POST['type'] == 'login'){

		$_SESSION['Email'] = $_POST['email'];
		$_SESSION['Password'] = $_POST['passwd'];
		if($userData = $auth->login($_POST['email'],$_POST['passwd'])){

			if (password_verify($_POST['passwd'],$userData['passwd']) == 1)
			{
				$_SESSION['user'] = $userData;			
				$logs->setUserId($_SESSION['user']['id']);
				$logs->log("Logged in.");

				$vUser = new vUsers($db);
				$_SESSION['user']['last_login'] = 'NOW';										
				$vUser->store($_SESSION['user'],$_SESSION['user']['id']);

				header("Location: /");
			}	
			else if($userData['passwd'] == md5($_POST['passwd']))
			{
				$_SESSION['user'] = $userData;						
				$_SESSION['user']['last_login'] = 'NOW';

				header("Location: /");
				die();
			}
		}		
		
	} else if ($_POST['type'] == 'failure'){
		
	} else if ($_POST['newpassword'] == 'passreset'){
		
	} else {
		$content = '<form id="signin" action="/anmelden/" method="post">';
		$content .= '<input tabindex="1" type="hidden" name="type" value="login" /><br>';		
		$content .= '<input class="inputLogin" tabindex="1" type="text" placeholder="Email" name="email" style="" /><br>';
		$content .= '<input class="inputLogin" tabindex="2" type="password" placeholder="Password" name="passwd" style="" /><br>';
		$content .= '<input type="submit" hidefocus="true" tabindex="3" value="Anmelden" />';
		$content .= '</form>';		
	}

	$gt->attach("content",$content);
	$layout->attach("content",$gt->commit());
}
else if(file_exists('modules/'.$_GET['module'].'.php') && $_GET['module'] != ''){
	require_once 'modules/'.$_GET['module'].'.php';
}else{
	if(file_exists($module_directory . $_GET['module'].'.php') && $_GET['module'] != ''){
		require_once $module_directory . $_GET['module'].'.php';
	}else{
		require_once 'modules/home.php';
	}
}


if(!$_SESSION['user']['id']){
	$user_block = '<div id="signin">Anmelden</div>';	
} else {
	$user_block = '<div id="signin">Abmelden</div>';
	
	$layout->attach("user",'<strong>'.$_SESSION['user']['name'].'</strong>');
	$layout->attach("timestamp",time());
	$layout->attach("root_path",$root_path);
}

$layout->attach("user_block",$user_block);
$layout->attach("app_name",APPNAME);	
$layout->attach("user",'');

die($layout->commit());

?>