<?php 
/*
+--------------------------------------------------------------------------
|   CubeCart 4
|   ========================================
|	CubeCart is a registered trade mark of Devellion Limited
|   Copyright Devellion Limited 2006. All rights reserved.
|   Devellion Limited,
|   5 Bridge Street,
|   Bishops Stortford,
|   HERTFORDSHIRE.
|   CM23 2JU
|   UNITED KINGDOM
|   http://www.devellion.com
|	UK Private Limited Company No. 5323904
|   ========================================
|   Web: http://www.cubecart.com
|   Email: info (at) cubecart (dot) com
|	License Type: CubeCart is NOT Open Source Software and Limitations Apply 
|   Licence Info: http://www.cubecart.com/site/faq/license.php
+--------------------------------------------------------------------------
|	cc_admin_session.php
|   ========================================
|	Admin Authentication and Permissions
+--------------------------------------------------------------------------
*/

class admin_session {
	
	var $config;
	var $db;
	var $glob;
	var $ini;
	
	function admin_session() {
		$this->__construct();
	}
	
	function __construct() {
		global $config, $db, $glob, $ini;
		
		$this->config	= $config;
		$this->db		= &$db;
		$this->glob		= $glob;
		$this->ini		= $ini;
	}
	
	function get_session_data() {
		if (!isset($GLOBALS[CC_ADMIN_SESSION_NAME])) {
			## If no session redirect to login screen
			httpredir($GLOBALS['rootRel'].$this->glob['adminFile']."?_g=login&goto=".urlencode(currentPage()));
		} else {
			## Get session information as array
			$query = sprintf("SELECT * FROM ".$this->glob['dbprefix']."CubeCart_admin_users WHERE sessId = %s", $this->db->mySQLSafe($GLOBALS[CC_ADMIN_SESSION_NAME]));
			$ccAdminData = $this->db->select($query);
			
			## Security checks
			//$client_ip = (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];
			$client_ip = get_ip_address();
			
			if ($ccAdminData[0]['sessIp'] !== $client_ip || $ccAdminData[0]['browser'] !== $_SERVER['HTTP_USER_AGENT']) {
				$this->logout();
			}
			
			## Find permissions for those who are not super users
			if (!$ccAdminData[0]['isSuper']) {
				$query = sprintf("SELECT %1\$sCubeCart_admin_sections.sectId, name, `read`, `write`, `edit`, `delete` FROM %1\$sCubeCart_admin_sections LEFT JOIN %1\$sCubeCart_admin_permissions ON %1\$sCubeCart_admin_sections.sectId = %1\$sCubeCart_admin_permissions.sectId WHERE adminId = %2\$s", $this->glob['dbprefix'], $this->db->mySQLSafe($ccAdminData[0]['adminId']));
				$permissionArray = $this->db->select($query);
				
				#print_r($permissionArray);
				#die;
				
				if (is_array($permissionArray)) {
					for ($i=0; $i<count($permissionArray); $i++) {
						foreach ($permissionArray[$i] as $key => $value) {
							$masterKey = $permissionArray[$i]['name'];
							$ccAdminData[0][$masterKey][$key] = $value;
						}
					}
				}
			}
			return $ccAdminData[0];
		}
	}
	
	function makeSessId() {
		session_start();
		session_regenerate_id(true);
		return session_id();
	}
	
	function logout() {
		## reset session data
		$record['sessId'] = "''";
		$record['sessIp'] = "''";
		$record['browser'] = "''";
		
		$this->db->update($this->glob['dbprefix']."CubeCart_admin_users", $record,"sessId = ".$this->db->MySQLSafe($GLOBALS[CC_ADMIN_SESSION_NAME]));
		
		$this->set_cc_admin_cookie(CC_ADMIN_SESSION_NAME, '');
		httpredir($GLOBALS['rootRel'].$this->glob['adminFile']."?_g=login");
	}
	
	function login($username, $password) {
		$query = sprintf("SELECT adminId FROM %sCubeCart_admin_users WHERE username = %s AND password = %s AND failLevel < %s AND blockTime < %s", $this->glob['dbprefix'], $this->db->mySQLSafe($username), $this->db->mySQLSafe(md5($password)), $this->ini['bfattempts'], time());
		$result = $this->db->select($query);
		return $result;
	}
	
	function createSession($admin_id) {
		$sessionId = $this->makeSessId();
		$this->set_cc_admin_cookie(CC_ADMIN_SESSION_NAME, $sessionId);
		
		## set session global var because cookie won't show until next page load
		$GLOBALS[CC_ADMIN_SESSION_NAME] = $sessionId;
		
		$record['sessId'] = "'".$sessionId."'";
		## log browser & ip for security purposes no session hijacking here :)
		$record['sessIp'] = $this->db->MySQLSafe(get_ip_address());
		$record['browser'] = $this->db->MySQLSafe($_SERVER['HTTP_USER_AGENT']);
		$this->db->update($this->glob['dbprefix']."CubeCart_admin_users", $record, "adminId = ".$admin_id);
	}
	
	function get_cookie_domain($domain) {
		$cookie_domain = str_replace(array('http://', 'https://', 'www.'), '', strtolower($domain));
		$cookie_domain = explode("/",$cookie_domain);
		$cookie_domain = explode(":", $cookie_domain[0]);
		return '.'.$cookie_domain[0];
	}
	
	function set_cc_admin_cookie($name, $value) {
		$expires = 0; ## remember session until browser is closed
		@setcookie($name, $value, $expires, $GLOBALS['rootRel']);
	}
}
?>