<?php
// +------------------------------------------------------------------------+
// | PHP Melody version 1.6.7 ( www.phpsugar.com )
// +------------------------------------------------------------------------+
// | PHP Melody IS NOT FREE SOFTWARE
// | If you have downloaded this software from a website other
// | than www.phpsugar.com or if you have received
// | this software from someone who is not a representative of
// | phpSugar, you are involved in an illegal activity.
// | ---
// | In such case, please contact: support@phpsugar.com.
// +------------------------------------------------------------------------+
// | Developed by: phpSugar (www.phpsugar.com) / support@phpsugar.com
// | Copyright: (c) 2004-2011 PhpSugar.com. All rights reserved.
// +------------------------------------------------------------------------+

session_start();
require_once('../config.php');
include_once('functions.php');
include_once( ABSPATH . 'include/user_functions.php');
include_once( ABSPATH . 'include/islogged.php');

if( is_user_logged_in() && (is_admin() || is_moderator())) {
	header("Location: index.php");
	exit();
}
logout();

if($_POST['Login'] == 'Login')
{
	$user = trim($_POST['ausername']);
	$pass = $_POST['apassword'];
	$clearpass = $pass;
	$pass = md5($pass);
	
	if($user != '' && (ctype_alnum($user) === TRUE) && $clearpass != '')
	{
		$user = secure_sql($user);
		
		$sql = "SELECT * FROM pm_users 
				WHERE username = '".$user."' 
				  AND password = '".$pass."' 
				  AND power IN ('". U_ADMIN ."', '". U_MODERATOR ."', '". U_EDITOR ."')";

		$query = @mysql_query($sql);
		$count = @mysql_num_rows($query);
		
		if($count == 0) 
		{
			$error = '<div class="info_msg_err">Your username and password don\'t match or you\'re not an admin.</div>';
			@log_error('Failed attempt to log in as admin. (Username used: <em>'.$user.'</em> / Password used: <em>'.htmlentities($clearpass, ENT_QUOTES).'</em> / IP: <em>'.$_SERVER['REMOTE_ADDR'].'</em>)', 'Admin login', 1);
		}
		elseif($count == 1) 
		{
			$error = '<div class="info_msg_ok">You\'re now logged in! <a href="index.php"><strong>Proceed</strong></a></div>';
			log_user_in($user, $clearpass, false, false);
			header('Location: index.php');
			exit();
		}
	}
	else
	{
		$error = '<div class="info_msg_err">Your username and password don\'t match or you\'re not an admin.</div>';
	}
}

?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Login</title>
<link href="admin_login.css" rel="stylesheet" type="text/css" />
</head>
<body>
<SCRIPT LANGUAGE="JavaScript">
function checkFields() {
missinginfo = "";
if (document.login.ausername.value == "") {
missinginfo += "\n     -  Username";
}
if (document.login.apassword.value == "") {
missinginfo += "\n     -  Password";
}
if (missinginfo != "") {
missinginfo = "These fields are empty:\n" +
missinginfo + "\n";
alert(missinginfo);
return false;
}
else return true;
}
</script>
<div id="menu_header">
<h1><?php echo _SITENAME; ?></h1>
</div>
<div id="content">
<?php echo $error; ?>
<div align="center">
<form action="login.php" method="post" name="login" onSubmit="return checkFields();">
<table width="188" border="0" align="center" cellpadding="3" cellspacing="1">
  <tr>
    <td align="left">Username</td>
  </tr>
  <tr>
    <td width="221"><input name="ausername" type="text" size="20" maxlength="50" value="" class="inputtext" /></td>
  </tr>
  <tr>
    <td align="left">Password</td>
  </tr>
  <tr>
    <td><input name="apassword" type="password" size="20" maxlength="50" class="inputtext" /></td>
  </tr>
  <tr>
    <td align="center">
	<br />
	<input type="submit" name="Login" value="Login" class="inputbutton" />
	</td>
  </tr>
  <tr>
  	<td align="center">
	  <small><a href="<?php echo _URL."/login."._FEXT."?do=forgot_pass";?>">Forgot your password?</a></small>
	</td>
  </tr>
</table>
</form>
</div>
</div>
<?php
include('footer.php');
?>