<?php
/*
  $Id: update.php,v 1.2 2004/04/11 02:37:08 andrewsimpson Exp $

  (c) 2003 - 2004 Andrew Simpson <andrew.simpson@paradise.net.nz>
  
  WebCollab
  ---------------------------------------
  This program is free software; you can redistribute it and/or modify it under the
  terms of the GNU General Public License as published by the Free Software Foundation;
  either version 2 of the License, or (at your option) any later version.

  This program is distributed in the hope that it will be useful, but WITHOUT ANY
  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
  PARTICULAR PURPOSE. See the GNU General Public License for more details.

  You should have received a copy of the GNU General Public License along with this
  program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave,
  Cambridge, MA 02139, USA.

   Function:
  ---------

  Secure the setup login

*/

//set initial safe values
DATABASE_NAME = "--";
$WEB_CONFIG = "N";

//read config files
require_once("config/config.php" );
include_once("setup/screen_setup.php" );


//
// ERROR FUNCTION
//

function secure_error($message ) {

  create_top_setup("Error" );
  new_box_setup("Error", "<div align=\"center\">".$message."</div>", "boxdata", "singlebox" );
  create_bottom_setup();
  die;

}

//
// LOGIN CHECK
//

//valid login attempt ?
if( (isset($_POST['username']) && isset($_POST['password']) ) ) {

  include_once("database/database.php" );
  include_once("includes/common.php" );
  
  $q = "";
  $alert = "";
  $username = safe_data($_POST['username']);
  //encrypt password
  $md5pass = md5($_POST['password'] );

  //no ip (possible?)
  if( ! ($ip = $_SERVER['REMOTE_ADDR'] ) ) {
    secure_error("Unable to determine ip address");
  }
  
  //count the number of recent login attempts
  $count_attempts = db_result(@db_query("SELECT COUNT(*) FROM ".PRE."login_attempt 
                                                WHERE name='".$username."' 
                                                AND last_attempt > (now()-INTERVAL ".$delim."10 MINUTE".$delim.") LIMIT 6" ), 0, 0 );
    
  //protect against password guessing attacks 
  if($count_attempts > 3 ) {
    secure_error("Exceeded allowable number of login attempts.<br /><br />Account locked for 10 minutes." );
  }                                                                              
    
  //record this login attempt
  db_query("INSERT INTO ".PRE."login_attempt(name, ip, last_attempt ) VALUES ('$username', '$ip', now() )" );
                                                                                     
  //do query and check database connection
  if( ! $q = db_query("SELECT id FROM ".PRE."users
                             WHERE deleted='f'
                             AND admin='t'
                             AND name='".$username."'
                             AND password='".$md5pass."'", 0 ) ){
    secure_error("Not a valid username, or password" );
  }

  //no such user-password combination
  if( @db_numrows($q) < 1 ) {
      sleep(2);
      secure_error("Not a valid username, or password" );
  }

  //no user-id
  if( ! ($user_id = @db_result($q, 0, 0) ) ) {
    secure_error("Unknown user id");
  }

  //user is okay!

  //remove the old login information
  @db_query("DELETE FROM ".PRE."login_attempt WHERE last_attempt < (now()-INTERVAL ".$delim."20 MINUTE".$delim.") OR name='".$username."'" );

  //include_once("includes/email.php"); 
  
  switch(substr(PHP_OS, 0, 3)){
    case "Lin":
      switch (DATABASE_TYPE ) {
        case "mysql":
        case "mysql_innodb":
          exec("mysqldump -u DATABASE_USER \"--password=DATABASE_PASSWORD\"  --opt DATABASE_NAME", $output, $exit_code );
          if($exit_code == 1 )
            error("Backup error", "Backup command failed.  Error message from system was:<br /><br />".$output[0] );
          break;
          
        case "postgresql":
        
        default:
          error("*", "Not implemented yet");
          break;
      }
     
    case "Dar":
    
    case "WIN":
  
    default:
    break;
  }
  
  $backup = "";
  while(list(,$line_out) = @each($output ) ) {
    $backup .= $line_out."<br />\r\n";
  }
  
  echo $backup;  
  /*
  for($i=0; $i<$max; $i++ ) {
    $backup .= $output[$i]."<br />\r\n";
  }
  */
  //email("asimpson@apollo.simpson.home", "Backup Testing", $backup );
  
  $content = "Backup was successful and has been sent to me :)";
  
  //display box calls
  create_top_setup("Info" );
  new_box_setup("Backup completed", $content, "boxdata", "singlebox" );
  create_bottom_setup();
  die;
}
       
//
// MAIN PROGRAM
//

//login box screen code 
create_top_setup("Login" );

$content = "<p>Admin login is required for backup operation:</p>\n".
           "<form name=\"inputform\" method=\"POST\" action=\"backup.php\">\n".
             "<p><table border=\"0\">\n".
               "<tr><td>Login: </td><td><input type=\"text\" name=\"username\" size=\"30\" /></td></tr>\n".
               "<tr><td>Password: </td><td><input type=\"password\" name=\"password\" value=\"\" size=\"30\" /></td></tr>\n".
             "</table></p>\n".
             "<div align=\"center\">\n".
             "<p><input type=\"submit\" value=\"Login\" /></p>\n".
             "</div></form>\n";

//set box options
new_box_setup("Login", $content, "boxdata", "singlebox" );

create_bottom_setup();

?>