<?php
/*******************************************************************\
 * http://www.takmizban.com
  * Copyright (c) MihanPay.info . All rights reserved.
\*******************************************************************/

	session_start();
	require_once("inc/iflogged.inc.php");
	require_once("inc/config.inc.php");
	$nowdate = date('Y-m-d H:i:s') ;
	unset($errs);
		$errs = array();
$banned_ip = array(
'185.50.37.42',//VIDA
'87.236.211.163',//FATA
'185.187.51.207',//FATA
'103.215.222.182',//FATA
'136.243.204.150',//FATA
'185.186.242.158',
'151.245.116.184',
'199.48.178.190',//SPEEDEX
'45.132.169.136',
'45.156.185.253',
'45.86.196.12',
'5.114.101.3',
'5.124.171.139',
'87.236.211.163 ',
'185.213.164.172',
       // '5.78.127.169',//SPEEDEX
       
    );



/*
function ip_in_range($ip, $range) {
    if (strpos($range, '/') == false)
        $range .= '/32';

    // $range is in IP/CIDR format eg 127.0.0.1/24
    list($range, $netmask) = explode('/', $range, 2);
    $range_decimal = ip2long($range);
    $ip_decimal = ip2long($ip);
    $wildcard_decimal = pow(2, (32 - $netmask)) - 1;
    $netmask_decimal = ~ $wildcard_decimal;
    return (($ip_decimal & $netmask_decimal) == ($range_decimal & $netmask_decimal));
}


function _cloudflare_CheckIP($ip) {
    $cf_ips = array(
        '199.27.128.0/21',
        '173.245.48.0/20',
        '103.21.244.0/22',
        '103.22.200.0/22',
        '103.31.4.0/22',
        '141.101.64.0/18',
        '108.162.192.0/18',
        '190.93.240.0/20',
        '188.114.96.0/20',
        '197.234.240.0/22',
        '198.41.128.0/17',
        '162.158.0.0/15',
        '104.16.0.0/12',
    );
    $is_cf_ip = false;
    foreach ($cf_ips as $cf_ip) {
        if (ip_in_range($ip, $cf_ip)) {
            $is_cf_ip = true;
            break;
        }
    } return $is_cf_ip;
}

function _cloudflare_Requests_Check() {
    $flag = true;

    if(!isset($_SERVER['HTTP_CF_CONNECTING_IP']))   $flag = false;
    if(!isset($_SERVER['HTTP_CF_IPCOUNTRY']))       $flag = false;
    if(!isset($_SERVER['HTTP_CF_RAY']))             $flag = false;
    if(!isset($_SERVER['HTTP_CF_VISITOR']))         $flag = false;
    return $flag;
}

function isCloudflare() {
    $ipCheck        = _cloudflare_CheckIP($_SERVER['REMOTE_ADDR']);
    $requestCheck   = _cloudflare_Requests_Check();
    return ($ipCheck && $requestCheck);
}

// Use when handling ip's
function getRequestIP() {
    $check = isCloudflare();

    if($check) {
        return $_SERVER['HTTP_CF_CONNECTING_IP'];
    } else {
        return $_SERVER['REMOTE_ADDR'];
    }
}
$myip =  getRequestIP();
$cf = isCloudflare();



$myip = get_client_ip() ; // getRequestIP();
$cf = isCloudflare();
*/
//echo $myip ;
//$ip = ip2long($myip) ;



$myip  = get_client_ip() ;

$ip_tolong = ip2long($myip) ;
//echo country_ip('192.15.187.141', 0) ;
if ( in_array( $myip , $banned_ip ) ) {
	redirect(SITE_URL.'ip.php') ;
	exit() ;
}

if (  country_ip($myip, 0) != 'ir'  ) {
			$ip_sql = "SELECT * FROM exchangerix_myip WHERE (('$ip_tolong' BETWEEN  ip_from AND  ip_to )  OR  ip = '$ip_tolong') AND state = 1";
			$ip_result = smart_mysql_query($ip_sql);
			$ip_total  =  mysqli_num_rows($ip_result) ;
			//echo $ip_total ;
			if ( ($ip_total == 0) ){
			$from = 'From: MihanPay IP <ip@mihanpay.ir>';
			$EmailTo = "mazandnews@gmail.com";
			$Subject = "IP PROBLEM";
			$Body .= "IP ".$myip."\n";
			// prepare email body text
			$Body .= "http://whois.mihanpay.ir/index.php?domain=".$myip."\n";
						// send email
			$sendmail = mail($EmailTo, $Subject, $Body, $from);
				
				redirect(SITE_URL.'ip.php') ;
				exit() ;
			}
}


	if (isset($_POST['action']) && $_POST['action'] == "login")
	{
		$username	= mysqli_real_escape_string($conn, getPostParameter('username'));
		$pwd		= mysqli_real_escape_string($conn, getPostParameter('password'));
		$remember	= (int)getPostParameter('rememberme');
		//$ip			= mysqli_real_escape_string($conn, getenv("REMOTE_ADDR"));
		$ip			=  get_client_ip()  ;
		$captcha	= mysqli_real_escape_string($conn, getPostParameter('captcha'));

		if (!($username && $pwd))
		{
			$errormsg = CBE1_LOGIN_ERR;
		}elseif (!( $captcha)) {
		$errormsg = "کد امنیتی را  بنویسید" ;
		}elseif ((empty($_SESSION['captcha']) || strcasecmp($_SESSION['captcha'], $captcha) != 0)) {
			$errormsg = "کد امنیتی را صحیح بنویسید" ;
		}else
		{
			 //$sql = "SELECT * FROM exchangerix_users WHERE username='$username' AND password='".PasswordEncryption($pwd)."' LIMIT 1";
			$sql = "SELECT * FROM exchangerix_users WHERE username='$username'  LIMIT 1";
			$result = smart_mysql_query($sql);
			
			if ( (mysqli_num_rows($result) != 0) )
			{
				
			    $row = mysqli_fetch_array($result);
				$parts   = explode( ':', $row['password'] );
				$crypt   = $parts[0];
			//print_r($row['password']  ) ;exit();
				$salt   = $parts[1];
				
			//s	echo md5($pwd.$salt) .''. $crypt ;
				if ( (md5($pwd.$salt) == $crypt )){


					if ($row['status'] == 'inactive')
					{
						header("Location: login.php?msg=2");
						exit();
					}
					
					if (LOGIN_ATTEMPTS_LIMIT == 1)
					{
						unset($_SESSION['attems_'.$username."_".$ip], $_SESSION['attems_left']);
					}

					//if ($remember == 1)
				//	{
						$cookie_hash = md5(sha1($username.$ip));
						setcookie("usname", $cookie_hash, time()+1500, '/');
						$login_sql = "login_session = '$cookie_hash', ";
					//}

					smart_mysql_query("UPDATE exchangerix_users SET ".$login_sql." last_ip='$ip', login_count=login_count+1, last_login='$nowdate'  WHERE user_id='".(int)$row['user_id']."' LIMIT 1"
					);
					
					if (!session_id()) session_start();
					$ip = get_client_ip() ;
					//$bip = $_SERVER['HTTP_X_FORWARDED_FOR'];
					$agent = $_SERVER['HTTP_USER_AGENT'];
					
					
					$_SESSION['userid']		= $row['user_id'];
					$_SESSION['bit_uid']		= $row['user_id'];
					$_SESSION['FirstName']	= $row['fname'];
					$_SESSION['email']		= $row['email'];
					//$_SESSION['LastName']		= $row['lname'];
					$_SESSION['discount']		= $row['discount'];
					$_SESSION['Phone']		= $row['phone'];
					$_SESSION['iphash']		=  md5($_SESSION['userid'].$ip.$agent);
					$_SESSION['saghf']		= $row['saghf'];
					//$_SESSION['pin']		= $row['pin'];
					$_SESSION['changedate']		= $row['changedate'];
					//$_SESSION['verification_progress']		= $row['verification_progress'];
					$_SESSION['loggedin_time'] = time();  
					
					$logtext = 'ورود به حساب کاربری' ; 
					SaveUserLog($logtext) ;

					
					
					if ( VerifyStatus($row['user_id']) == 100 ) {
						
						$redirect_url = "security.php";
									
					}else {
						
						$redirect_url = "dashboard.php?msg=verify";
						$_SESSION[security] = 0 ;
						
					}			
					header("Location: ".$redirect_url);
					exit();
	
				}else
			{
				if (LOGIN_ATTEMPTS_LIMIT == 1)
				{
					$check_sql = "SELECT * FROM exchangerix_users WHERE username='$username' AND status!='inactive' AND block_reason!='login attempts limit' LIMIT 1";
					$check_result = smart_mysql_query($check_sql);

					if (mysqli_num_rows($check_result) != 0)
					{
						if (!session_id()) session_start();
						$_SESSION['attems_'.$username."_".$ip] += 1;
						$_SESSION['attems_left'] = LOGIN_ATTEMPTS - $_SESSION['attems_'.$username.'_'.$ip];

						if ($_SESSION['attems_left'] == 0)
						{ 
							// block user //
							smart_mysql_query("UPDATE exchangerix_users SET status='inactive', block_reason='login attempts limit' WHERE username='$username' LIMIT 1"); 
							unset($_SESSION['attems_'.$username."_".$ip], $_SESSION['attems_left']);
					
							header("Location: login.php?msg=6");
							exit();
						}
						else
						{
							header("Location: login.php?msg=5");
							exit();
						}
					}
				}

				header("Location: login.php?msg=1");
				exit();
			}
				
				
			}
			else
			{
				if (LOGIN_ATTEMPTS_LIMIT == 1)
				{
					$check_sql = "SELECT * FROM exchangerix_users WHERE username='$username' AND status!='inactive' AND block_reason!='login attempts limit' LIMIT 1";
					$check_result = smart_mysql_query($check_sql);

					if (mysqli_num_rows($check_result) != 0)
					{
						if (!session_id()) session_start();
						$_SESSION['attems_'.$username."_".$ip] += 1;
						$_SESSION['attems_left'] = LOGIN_ATTEMPTS - $_SESSION['attems_'.$username.'_'.$ip];

						if ($_SESSION['attems_left'] == 0)
						{ 
							// block user //
							smart_mysql_query("UPDATE exchangerix_users SET status='inactive', block_reason='login attempts limit' WHERE username='$username' LIMIT 1"); 
							unset($_SESSION['attems_'.$username."_".$ip], $_SESSION['attems_left']);
					
							header("Location: login.php?msg=6");
							exit();
						}
						else
						{
							header("Location: login.php?msg=5");
							exit();
						}
					}
				}

				header("Location: login.php?msg=1");
				exit();
			}
		}
	}



	///////////////  Page config  ///////////////
	$PAGE_TITLE = CBE1_LOGIN_TITLE;

	require_once ("templates/".SITE_TEMPLATE."/header.inc.php");
$content = GetContent('login');
?>

<?php


if($settings['LoginAlert'] == 1 ){ ?> 
<script>
    $.alert({
		//icon: 'fa fa-warning ',
		title: '<?php echo $settings['LoginAlert_Title']; ?>  ',
		content: '<?php echo $settings['LoginAlert_Text']; ?> ',
		rtl: true,
		closeIcon: false,
		type: 'red',
		columnClass: 'col-md-6 col-md-offset-3 col-xs-12',
		containerFluid: true, // this will add 'container-fluid' instead of 'container'
		typeAnimated: true,
		draggable: false,
		dragWindowGap: 0, // number of px of distance
		backgroundDismiss: false,
		backgroundDismissAnimation: 'glow',
		theme: 'modern' ,// 'material', 'bootstrap',
	    bootstrapClasses: {
        container: 'container',
        containerFluid: 'container-fluid',
        row: 'row',
    },
        buttons: {
            confirm: {
                text: '<strong>متوجه شدم</strong> ',
                btnClass: 'btn-blue  btn-block',
               // action: function () {
                //    $.alert('با تشکر از همراهی و همکاری شما ');
               // }
            },
        }
    });
</script>
<style>
.alert-trim {
  display: inline-block;
     width:100%;    
}

</style>

<?php } ?>
	<div class="row">
     
        <div class="col-md-6 ">
            <?php echo $content['text']; ?>
        </div>
        
        <div class="col-md-6 ">

			<div class="widget gray">
			
			<h1><?php echo CBE1_LOGIN_TITLE; ?></h1>

			<?php if (isset($errormsg) || isset($_GET['msg'])) { ?>
				<div class="alert alert-danger">
					<?php if (isset($errormsg) && $errormsg != "") { ?>
						<?php echo $errormsg; ?>
					<?php }else{ ?>
						<?php if ($_GET['msg'] == 1) { echo CBE1_LOGIN_ERR1; } ?>
						<?php if ($_GET['msg'] == 2) { echo CBE1_LOGIN_ERR2; } ?>
						<?php if ($_GET['msg'] == 3) { echo CBE1_LOGIN_ERR3; } ?>
						<?php if ($_GET['msg'] == 4) { echo CBE1_LOGIN_ERR4; } ?>
						<?php if ($_GET['msg'] == 5) { echo CBE1_LOGIN_ERR1." ".(int)$_SESSION['attems_left']." ".CBE1_LOGIN_ATTEMPTS; } ?>
						<?php if ($_GET['msg'] == 6) { echo CBE1_LOGIN_ERR6; } ?>
                        <?php if ($_GET['msg'] == 7) { echo "کد امنیتی را درست بنویسید"; } ?>
					<?php } ?>
				</div>
			<?php } ?>
			
			<form action="" method="post">	
               <div style="margin-bottom: 25px" class="input-group">
                  <span class="input-group-addon"><i class="glyphicon glyphicon-user"></i></span>
                  <input id="login-username" type="text" class="form-control input-lg" name="username" value="<?php echo getPostParameter('username'); ?>" placeholder="<?php echo CBE1_LOGIN_EMAIL; ?>" required="required">                                        
               </div>
               <div style="margin-bottom: 25px" class="input-group">
                  <span class="input-group-addon"><i class="glyphicon glyphicon-lock"></i></span>
                  <input id="login-password" type="password" class="form-control input-lg" name="password" value="" placeholder="<?php echo CBE1_LOGIN_PASSWORD; ?>">
               </div>			  
			  <div class="checkbox" style="display:none">
				<label><input type="checkbox" class="checkboxx" name="rememberme" id="rememberme" value="1" checked="checked" /> <?php echo CBE1_LOGIN_REMEMBER; ?></label>
			  </div>
                <?php //if (SIGNUP_CAPTCHA == 1) { ?>
          <div class="form-group">
            
            <div class="row">
             <div class="col-xs-2">
             <label><?php echo CBE1_SIGNUP_SCODE; ?></label>
             </div>
			   <div class="col-xs-6">
				<input type="text" id="captcha" class="form-control" name="captcha" value="" placeholder= "عدد مقابل را بنویسید">
			   </div>
			   <div class="col-xs-4">
				<img src="<?php echo SITE_URL; ?>captcha.php?rand=<?php echo rand(); ?>&bg=grey" id="captchaimg" align="absmiddle" /> <small><a href="javascript: refreshCaptcha();" title="<?php echo CBE1_SIGNUP_RIMG; ?>"><img src="<?php echo SITE_URL; ?>assets/images/icon_refresh.png" align="absmiddle" alt="<?php echo CBE1_SIGNUP_RIMG; ?>" /></a></small>
			   </div>
          </div>
          </div>
			<script language="javascript" type="text/javascript">
				function refreshCaptcha()
				{
					var img = document.images['captchaimg'];
					img.src = img.src.substring(0,img.src.lastIndexOf("?"))+"?rand="+Math.random()*1000;
				}
			</script>
		  <?php //} ?>
              
              
              
				<input type="hidden" name="action" value="login" />
				<button type="submit" class="btn btn-success btn-lg" name="login" id="login"><?php echo CBE1_LOGIN_BUTTON; ?></button>
				<br/><br/><p><a href="<?php echo SITE_URL; ?>forgot.php"><?php echo CBE1_LOGIN_FORGOT; ?></a></p>
				<?php if (ACCOUNT_ACTIVATION == 1) { ?>
					<p><a href="<?php echo SITE_URL; ?>activation_email.php"><?php echo CBE1_LOGIN_AEMAIL; ?></a></p>
				<?php } ?>
				<p><?php echo CBE1_LOGIN_NMEMBER; ?> <a href="<?php echo SITE_URL; ?>signup.php"><b><?php echo CBE_SIGNUP; ?></b></a></p>
		  	</form>
		  	</div>

	</div>
	</div>


<?php require_once ("templates/".SITE_TEMPLATE."/footer.inc.php"); ?>