<?php

include './core.php';

if( isset( $user ) ) access_error();

if( isset( $_POST['login_accountname'] ) && isset( $_POST['login_password'] ) && !is_empty( $_POST['login_accountname'] ) && !is_empty( $_POST['login_password'] ) && isset( $_POST['login'] ) )
{
    $login_account = new Account( $_POST['login_accountname'] );

	if( $login_account->ID > 0 )
	{
        if( !$login_account->check_access( md5( $_POST['login_password'] ) ) )
        {
        	if( md5( $_POST['login_password'] ) != $login_account->password )
            	error( "login_2" );
            else if( !$login_account->activation )
            	error( "login_3" );
            else
            	error( "login_4" );
        }
		else
		{
            $_SESSION['accountid'] = $login_account->ID;
			$_SESSION['password'] = $login_account->password;

            $login_account->last_activity = time();
            $login_account->last_ip = $_SERVER['REMOTE_ADDR'];
            $login_account->save( 'last_activity', 'last_ip' );

            if ( isset( $_POST['set_cookie'] ) && intval( $_POST['set_cookie'] ) == 1 )
            {
                setcookie( "accountid", $login_account->ID, time() + intval( $settings['cookie_lifetime'] ) );
                setcookie( "password", $login_account->password, time() + intval( $settings['cookie_lifetime'] ) );
            }

            $user = $login_account;

            set_location( "messages.php?".SID );
		}
	}
	else
		error( "login_1" );
}
elseif( isset( $_REQUEST['mode'] ) &&  $_REQUEST['mode'] == "lost_password" )
{
	flood_protect( 'lost_password' );

    if( isset( $_POST['send_password'] ) && isset( $_POST['email'] ) )
	{
        $account_result = $MySQL->query_first( sprintf("SELECT accountid FROM server.accounts WHERE email='%s'", me_escape( $_POST['email'] ) ));

        $res_account = new Account( (int) $account_result['accountid'] );

        if( $res_account->ID > 0 )
		{
			if( $res_account->block || !$res_account->activation )
			{
            	error( "lost_password_1" );
			}
			else
			{
				$new_password = gen_password();

                $mailenv = array();
                $mailenv['username'] = $res_account->name;
                $mailenv['new_password'] = $new_password;

                if( send_mail( $res_account->email, 'lost_password' ) )
                {
					$res_account->password = md5( $new_password );
                    $res_account->save( 'password' );

                    $exp_time = time() + intval( $settings['flood_protect_lost_password'] );
                    $MySQL->query( "INSERT INTO flood_protect (ip_address, performed_action, expire) VALUES ('".$_SERVER['REMOTE_ADDR']."','lost_password',".$exp_time.")" );

                    display_message( 'lost_password_success' );
				}
				else
					display_message( 'lost_password_failure' );
			}
		}
		else
        	error( "lost_password_2" );
	}
	else
	{
        $page['content'] = $Smarty->fetch( 'lost_password.tpl' );
        $Smarty->assign( 'page', $page );
        $Smarty->display( 'main.tpl' );
        die();
    }
}

$page['content'] = $Smarty->fetch( 'login.tpl' );

$Smarty->assign( 'page', $page );
$Smarty->display( 'main.tpl' );

?>