<?php
/**
* FILE_NAME : user.php
*
* @copyright Copyright (c) www.shuangyulin.com
* @author 双鱼林设计
* @package 前台用户操作
* @subpackage
* @version QQ:287307421或254540457
*/

session_start();
require_once './include/common.inc.php';

/*--  对一些系统变量赋值  --*/
$template->assign("css_root",$css_root);
$template->assign("web_url",$web_url);
$template->assign("siteurl",$_CFG['siteurl']);
$template->assign("sitename",$_CFG['sitename']);

$act = isset($_REQUEST['act']) ? trim($_REQUEST['act']) : 'login';
/*--  判断来路  --*/
$fromurl = dreferer();

if ($act == 'login') {
	require_once 'header.php';
	$template->display("login.tpl");
	require_once 'footer.php';
}

if ($act == 'loginok') {
	$username = isset($_REQUEST['username']) ? $_REQUEST['username'] : '';
	$password = isset($_REQUEST['password']) ? $_REQUEST['password'] : '';
	$login_code = isset($_REQUEST['login_code']) ? $_REQUEST['login_code'] : '';
	$cooktime = isset($_REQUEST['cooktime']) ? $_REQUEST['cooktime'] : '';
	
	if (!empty($_SESSION['code_word'])) {
		include_once(WEB_ROOT . 'include/code.php');
	
		/* 检查验证码是否正确 */
		$validator = new captcha();
		if (!$validator->check_word($login_code)) {
			showmessage("验证码错误，请重新输入",'user.php?act=login');
		}
	
	}
	if ($username && $password) {
		
		$sql = "SELECT * FROM {$dbprefix}members WHERE username = '".$username."'";
		$member = $DB->fetch_one_array($sql);
		
		if ($member) {
			if ($member['password'] == md5($password)) {
				$sql = "UPDATE {$dbprefix}members SET lastlogin = '".$timestamp."' WHERE username = '".$username."'";
				$query = $DB->query($sql);
	
				if ($query) {
					/*--  设置 cookies 保存时间  --*/
					if ($cooktime == 0 || $cooktime == '') {
						setcookie("username",$username);
						setcookie("lastlogin",$member['lastlogin']);
						setcookie("userpsw",authcode($member['password'],'ENCODE'));
					} else {
						setcookie("username",$username,time()+$cooktime*24*3600);
						setcookie("lastlogin",$member['lastlogin'],time()+$cooktime*24*3600);
						setcookie("userpsw",authcode($member['password'],'ENCODE'),time()+$cooktime*24*3600);
					
					} 
					
					
					/*--  设置返回的数据  --*/
					if ($fromurl != $web_url."user.php?act=login") {
						showmessage("登录成功",$fromurl);

					} else {
						showmessage("登录成功","index.php");
					}
				} else {
					showmessage("登录失败","user.php?act=login");
				}
			} else {
				showmessage("密码错误","user.php?act=login");
			}
		} else {
			showmessage("不存在该用户","user.php?act=login");
		}
		
	}
}

if ($act == 'reg') {
	require_once 'header.php';
	$template->display("regist.tpl");
	require_once 'footer.php';
}

if ($act == 'regok') {
	$username = isset($_REQUEST['username']) ? $_REQUEST['username'] : '';
	$password = isset($_REQUEST['password']) ? $_REQUEST['password'] : '';
	$confirm_password = isset($_REQUEST['confirm_password']) ? $_REQUEST['confirm_password'] : '';
	$email = isset($_REQUEST['email']) ? $_REQUEST['email'] : '';
	
	if ($confirm_password != $password) {
		showmessage("两次密码不一致",$fromurl);
	} else {
	$sql = "INSERT INTO {$dbprefix}members (uid,username,password,regtime,lastlogin,email) VALUES ('','".$username."','".md5($password)."','".$timestamp."','$timestamp','".$email."')";
	$query = $DB->query($sql);
	
	if ($query) {
		showmessage("注册成功，将跳到登录页","user.php?act=login");
	} else {
		showmessage("很遗憾，注册失败，请重新注册","user.php?act=reg");
	}
	}
}

if ($act == 'update') {
	require_once 'header.php';
	$template->display("user_update.html");
	require_once 'footer.php';
}

if ($act == 'updateok') {
	$oldpassword = isset($_REQUEST['oldpassword']) ? $_REQUEST['oldpassword'] : '';
	$password = isset($_REQUEST['password']) ? $_REQUEST['password'] : '';
	$confirm_password = isset($_REQUEST['confirm_password']) ? $_REQUEST['confirm_password'] : '';
	$username = $_COOKIE['username'];
	
	if ($username) {
		$sql = "SELECT * FROM {$dbprefix}members WHERE username = '".$username."'";
		$old = $DB->fetch_one_array($sql);
		
		if ($confirm_password != $password) {
			showmessage("两次密码不一致",$fromurl);
		} else {
			if ($old['password'] == md5($oldpassword)) {
				$sql = "UPDATE {$dbprefix}members SET password = '".$password."' WHERE username = '".$username."'";
				$query = $DB->query($sql);
				
				if ($query) {
					showmessage("密码修改成功，请重新登录","user.php=login");
				} else {
					showmessage("密码修改失败",$fromurl);
				}
			} else {
				showmessage("旧密码输入错误",$fromurl);
			}
		}
	} else {
		showmessage("您还没有登录，请先登录","user.php?act=login");
	}
}

if ($act == 'logout') {
	setcookie("username",'');
	setcookie("userpsw",'');
	
	showmessage("退出成功","user.php?act=login");
}
?>