<?php

// +----------------------------------------------------------------------+
// | OpenConf                                                             |
// +----------------------------------------------------------------------+
// | Copyright (c) 2002-2020 Zakon Group LLC.  All Rights Reserved.       |
// +----------------------------------------------------------------------+
// | This source file is subject to the OpenConf License, available on    |
// | the OpenConf web site: www.OpenConf.com                              |
// +----------------------------------------------------------------------+

require_once "../include.php";

function oc_chairSignIn() {
	$_SESSION[OCC_SESSION_VAR_NAME]['chairlast'] = time(); 		// last time Chair accessed site
	$_SESSION[OCC_SESSION_VAR_NAME]['chairtoken'] = oc_idGen();	// Chair token for form submission verification
	$_SESSION[OCC_SESSION_VAR_NAME]['chairvars'] = array();		// temporary storage of Chair-related variables during session

	// Store latest software version number for update notification
	if (isset($GLOBALS['v']) && preg_match("/^\d+\.[\d\.]+$/", $GLOBALS['v']) && ($GLOBALS['v'] != $GLOBALS['OC_configAR']['OC_versionLatest'])) {
		updateConfigSetting('OC_versionLatest', $GLOBALS['v']);
	}
	
	// Reset failed sign in counter
	if ($GLOBALS['OC_configAR']['OC_chairFailedSignIn'] != 'skip') {
		updateConfigSetting('OC_chairFailedSignIn', '');
	}
	
	// log sign in
	oc_logit('signin', 'Chair sign in from ' . varValue('REMOTE_ADDR', $_SERVER));

	// re-route user
	session_write_close();
	header('Location: index.php?' . strip_tags(SID));
	exit;
}

if (oc_hookSet('chair-signin')) {
	   foreach ($GLOBALS['OC_hooksAR']['chair-signin'] as $hook) {
			   require_once $hook;
	   }
}

session_regenerate_id(); // prevent login session fixation

$errmsg = "";

// MFA?
if (isset($_POST['ocaction']) && ($_POST['ocaction'] == 'Enter') && !empty($OC_configAR['OC_chairMFA'])) {
	if (
		isset($_POST['code'])
		&& !empty($_POST['code'])
		&& isset($_POST['verifier'])
		&& !empty($_POST['verifier'])
		&& preg_match("/^(\d+)\|(.*)$/", $OC_configAR['OC_chairMFAcode'], $matches)		// MFA code set
		&& ((time() - $matches[1]) < (60 * 15)) 										// 15 minute from sign in
		&& (hash('sha256', (trim($_POST['code']) . $_POST['verifier'])) == $matches[2])	// code valid
	) {
		ocsql_query("UPDATE `" . OCC_TABLE_CONFIG . "` SET `value`='' WHERE `setting`='OC_chairMFAcode' AND `module`='OC' LIMIT 1");
		oc_chairSignIn();
	} else {
		warn('Invalid authentication', 'Sign In', 3);
	}
	exit;
}

if (isset($_POST['submit']) && ($_POST['submit'] == "Sign In") && isset($_POST['uname']) && !empty($_POST['uname']) && isset($_POST['upwd']) && !empty($_POST['upwd'])) {
	// Check for too many failed attempts
	$failedNum = 0;
	$failedTime = 0;
	if (!empty($OC_configAR['OC_chairFailedSignIn']) && ($OC_configAR['OC_chairFailedSignIn'] != 'skip')) {
		list($lastFailedNum, $lastFailedTime) = explode(':', $OC_configAR['OC_chairFailedSignIn']);
		if ((time() - $lastFailedTime) < (60 * 5)) { 	// is last failed attempt < 5 minutes ago
			$failedNum = $lastFailedNum;
			$failedTime = $lastFailedTime;
			if ($failedNum == 3) {
				warn('There have been too many failed attempts at signing in.  Please wait 5 minutes before trying again', 'Sign In', 3);
			}
		}
	}
	// Check for bad user/pwd
	$lowusername = oc_strtolower(trim($_POST['uname']));
	if ((oc_strtolower($OC_configAR['OC_chair_uname']) != $lowusername) || !oc_password_verify($_POST['upwd'], $OC_configAR['OC_chair_pwd'], 'chair')) {
		$errmsg =  '
<span class="err">Incorrect login.  Please try again below or contact your OpenConf administrator.</span>
<p>
		';
		$failedNum++;
		if ($OC_configAR['OC_chairFailedSignIn'] != 'skip') {
			updateConfigSetting('OC_chairFailedSignIn', $failedNum . ':' . time());	
		}
	}
	elseif (!empty($OC_configAR['OC_chairMFA'])) { // multi-factor enabled
		if (preg_match("/^\\\$(OC_pcemail|OC_confirmmail)\$/", $OC_configAR['OC_chairMFA'])) {
			$tovar = substr($OC_configAR['OC_chairMFA'], 1);
			$to = $OC_configAR[$tovar];
		} elseif (validEmail($OC_configAR['OC_chairMFA'])) {
			$to = $OC_configAR['OC_chairMFA'];
		} else {
			warn('Invalid multi-factor setup', 'Sign In', 3);
			exit;
		}
		$verifier = oc_idGen(32);
		if (function_exists('random_int')) {
			$code = random_int(100000, 999999);
		} else {
			$code = mt_rand(100000, 999999);
		}
		printHeader(OCC_WORD_CHAIR . ' Sign In', 3);
		ocsql_query("UPDATE `" . OCC_TABLE_CONFIG . "` SET `value`='" . safeSQLstr(time() . '|' . hash('sha256', $code . $verifier)) . "' WHERE `setting`='OC_chairMFAcode' AND `module`='OC' LIMIT 1") or err('Unable to setup authentication code');
		$subject = $OC_configAR['OC_confName'] . ' Sign In';
		$body = 'Hello,

The requested code is:

' . $code . '

Please enter it within 15 minutes of requesting the code.
';
		oc_mail($to, $subject, $body) or err('Unable to email authenticate code');
		print '
<form method="post" action="' . $_SERVER['PHP_SELF'] . '">
<input type="hidden" name="verifier" value="' . safeHTMLstr($verifier) . '" />
<div style="text-align: center;">
<p>Enter the code received via email and click the button within 15 minutes:</p>
<p><input name="code" id="code" placeholder="code" size="6" maxlength="6" style="font-size: 1.5em; text-align:center; " /></p>
<p><input type="submit" name="ocaction" class="submit" value="Enter" /></p>
</div>
</form>
<script language="javascript">
<!--
document.getElementById("code").focus();
// -->
</script>
';
		printFooter();
		exit;
	}
	else {  // We have a winner!
		oc_chairSignIn();
	}
}

printHeader(OCC_WORD_CHAIR . ' Sign In', 3);

if (!empty($errmsg)) { 
	print $errmsg;
}
elseif (isset($_GET['e']) && ($_GET['e'] == "exp")) { print '<span class="err">Your session has timed out or you did not sign in properly.  Please sign in again.</span><p>'; }

print '
<br>
<form method="post" action="' . $_SERVER['PHP_SELF'] . '">
<table border="0" style="margin: 0 auto">
<tr><td><strong><label for="uname">Username:</label></strong></td><td><input size=20 name="uname" id="uname" value="' . safeHTMLstr(varValue('uname', $_POST)) . '" tabindex="1" />';

if ($OC_configAR['OC_chairUsernameForgot']) {
	print ' (<a href="email_username.php" tabindex="4">forgot username?</a>)';
}

print '</td></tr>
<tr><td><strong><label for="upwd">Password:</label></strong></td><td><input type="password" size=20 name="upwd" id="upwd" tabindex="2" />';

if ($OC_configAR['OC_chairPasswordForgot']) {
	print ' (<a href="reset.php" tabindex="5">forgot password?</a>)';
}

print '</td></tr>
<tr><th align="center" colspan="3"><br><input type="submit" name="submit" class="submit" value="Sign In" tabindex="3" /></th></tr>
</table>
</form>
<br />
<script language="javascript">
<!--
document.getElementById("uname").focus();
// -->
</script>
';

if ($OC_configAR['OC_ChairTimeout'] > 0) {
    print '
<p style="text-align: center" class="note">Note: Session times out after ' . $OC_configAR['OC_ChairTimeout'] . ' minutes of inactivity</p>
';
}

printFooter();

?>
