<?php
// Call in the XComponents engine and options file
define('MOD_PHP', substr(PHP_SAPI, 0, 3) != 'cgi'); // Are we running as mod_php?
define('DOCROOT', 
	MOD_PHP && isset($_SERVER['DOCUMENT_ROOT']) ? 
		$_SERVER['DOCUMENT_ROOT'] : 
		(
			MOD_PHP && isset($_SERVER['SCRIPT_FILENAME']) ? 
				substr($_SERVER['SCRIPT_FILENAME'], 0, 0-strlen($_SERVER['PHP_SELF'])) : 
				(
					substr(str_repeat('../', count(explode('/', preg_replace('_/+_', '/', $_SERVER['PHP_SELF'])))-2), 0, -1) != '' ?
						substr(str_repeat('../', count(explode('/', preg_replace('_/+_', '/', $_SERVER['PHP_SELF'])))-2), 0, -1) :
						'.'
				)
		)
	);
include(DOCROOT . '/dmx/dmx_options.php');
include(DOCROOT . '/dmx/core/php/dmx_shop_handler.php');
include(DOCROOT . '/dmx/core/php/dmx_shop_components.php');

// Abs code starts here
$abs_root = '';
@include(DOCROOT . '/abs_version_control.php');
$abs_auth_page = 'set_pw';
include(DOCROOT . $abs_root . '/common/authenticate.php');
include(DOCROOT . $abs_root . '/common/header.php');
?>

<!-- MAIN CONTENT AREA -->
<div id="main_area" onmouseover="sub_menu_hide();">
	<div id="main_area_content">
		
		<div class="main_column">
		<!-- ----------------- -->
		<!-- BEGIN MAIN COLUMN -->
		<!-- ----------------- -->
			
<?php if ($screen == 'set') : ?>		

	<h1>Set your username and password</h1>
	
	<p>
	You will need this to access the control area in future.
	</p>
	
<?php elseif ($screen == 'reset') : ?>

	<h1>Reset your username and password</h1>

<?php elseif ($screen == 'set_done') : ?>

	<h1>Password set</h1>
	
	<p>
	Go to the main <a href="<?=$abs_root;?>/admin/index.php">control page</a>.
	</p>

<?php elseif ($screen == 'wrong_permissions') : ?>

	<h1>Your webserver cannot write the password file</h1>
	
	<p>
	<b>Saving the password failed.</b><br>
	Attempted write path: <?=DOCROOT;?><?=$abs_root;?><?=ABS_PASSWORD_FILE;?>
	</p>
	
	<p>
	To set the right permissions:<br>
	(1) Log onto the server using a secure shell client or FTP program capable of changing file permissions.<br>
	(2) <strong>chmod -R 777 <?=DOCROOT;?><?=$abs_root;?><?=ABS_PASSWORD_FILE;?></strong>
	</p>

<?php endif; ?>

<?php if ($screen == 'set' || $screen == 'reset') : // Display the set password form ?>

<!-- <script src="<?=$abs_root;?>/js/md5.js" language="javascript" type="text/javascript"></script> -->
<script src="<?=$abs_root;?>/js/sha1.js" language="javascript" type="text/javascript"></script>
<!-- <script src="<?=$abs_root;?>/js/sha1_alternative.js" language="javascript" type="text/javascript"></script> -->
<script language="javascript" type="text/javascript">
<!--

function abs_check_and_encrypt(e) {
	// Validate input and encrypt before transmission to server
	
	var err = new Object;
	err[1] = get_DOM_ref('err_msg1');
	err[2] = get_DOM_ref('err_msg2');
	err[3] = get_DOM_ref('err_msg3');
	err[1].innerHTML = err[2].innerHTML = err[3].innerHTML = '';
	err.flag = false;

	// Trim input
	un = abs_trim(document.setpw_form.username.value);
	pw1 = abs_trim(document.setpw_form.password_1.value);
	pw2 = abs_trim(document.setpw_form.password_2.value);
	
	// Check username exists
	if (un.length == 0) {
		err[1].innerHTML = '<strong>Please enter a username.<\/strong>';
		err.flag = true;
	}

	// Enforce minimum length restriction on passwords
	if (pw1.length < 5) {
		err[2].innerHTML = '<strong>Password too short.<\/strong> Use 5 characters or more.';
		err.flag = true;
	}

	// Check both passwords entered are identical
	if (pw1 != pw2) {
		// Passwords don't match, so display an error message
		err[3].innerHTML = '<strong>Both passwords must match<\/strong> - try again!';
		err.flag = true;
	}

	// Check username and password for illegal characters ( : )
	var illegal = ':^\'';
	un_test = pw_test = false;
	for (i=0; i<illegal.length; i++) {
		if ( un.indexOf(illegal[i]) != -1) un_test = true;
		if (pw1.indexOf(illegal[i]) != -1) pw_test = true;
		if (un_test || pw_test) break;
	}
	if (un_test) {
		err[1].innerHTML = '<strong>Illegal characters detected in username<\/strong>';
		err[2].innerHTML = 'Usernames must not contain ' + illegal[i];
		err.flag = true;
	} else if (pw_test) {
		err[2].innerHTML = '<strong>Illegal characters detected in password<\/strong>';
		err[3].innerHTML = 'Passwords must not contain ' + illegal[i];
		err.flag = true;
	}
	
	if (err.flag) {
		// Cancel event propagation to prevent TST amending and submitting the form
		if (!e) var e = window.event;
		e.cancelBubble = true;
		if (e.stopPropagation) e.stopPropagation();
		return;
	}
	
	// Encrypt password using SHA1 before transmission to server
	document.setpw_form.un.value = un;
	document.setpw_form.pw.value = hex_sha1(pw1);
	document.setpw_form.username.value = document.setpw_form.password_1.value = document.setpw_form.password_2.value = '';
	document.setpw_form.submit();
}

// -----------------------------------------------------------------------------

function abs_trim(str) {
	// Trim a string
	if (str.charAt(0) == ' ') {
		str = aba_trim(str.substring(1));
  	}
  	if (str.charAt(str.length-1) == ' ') {
		str = abs_trim(str.substring(0, str.length-1));
	}
	return str;
}

// -->
</script>

<form name="setpw_form" method="post" action="<?=$_SERVER['PHP_SELF'];?>">
<input type="hidden" name="abs_action" value="setpw">
<input type="hidden" name="destination" value="index.php">
<input type="hidden" name="encrypted" value="1">
<input type="hidden" name="key" value="<?=$_SESSION['ABS_AUTH']['key'];?>">
<input type="hidden" name="un" value="">
<input type="hidden" name="pw" value="">
<div style="width: 100%; margin: 5px 0px; clear: both;">
	<div style="width: 20%; text-align: right; float: left; margin: 3px 0px; padding: 4px 10px 0px 0px;">Username</div>
	<div style="margin: 3px 0px; float: left;"><input type="text" name="username" size="20"></div>
	<div style="margin: 3px 10px; float: left;" id="err_msg1"></div>
</div>
<div style="width: 100%; margin: 5px 0px; clear: both;">
	<div style="width: 20%; text-align: right; float: left; margin: 3px 0px; padding: 4px 10px 0px 0px;">Password</div>
	<div style="margin: 3px 0px; float: left;"><input type="password" name="password_1" size="20"></div>
	<div style="margin: 3px 10px; float: left;" id="err_msg2"></div>
</div>
<div style="width: 100%; margin: 5px 0px; clear: both;">
	<div style="width: 20%; text-align: right; float: left; margin: 3px 0px; padding: 4px 10px 0px 0px;">Repeat Password</div>
	<div style="margin: 3px 0px; float: left;"><input type="password" name="password_2" size="20"></div>
	<div style="margin: 3px 10px; float: left;" id="err_msg3"></div>
</div>
<div style="width: 100%; margin: 5px 0px; clear: both;">
	<div style="width: 20%; text-align: right; float: left; margin: 3px 0px; padding: 4px 10px 0px 0px;"></div>
	<div style="margin: 3px 0px;"><input type="submit" value="set" onclick="abs_check_and_encrypt(event); return false;"></div>
</div>
</form>

<br clear="all">
	
<?php endif; ?>
	
		<!-- --------------- -->
		<!-- END MAIN COLUMN -->
		<!-- --------------- -->
		</div>
		
		<div class="sidebar">
		<!-- ------- -->
		<!-- SIDEBAR -->
		<!-- ------- -->
					
<div class="sidebar_box_heading">
	<h2>Security info</h2>
</div>
<div class="sidebar_box_content">
	<div>
		
		<br>
		
		<p>
		<strong>Password encryption:</strong>
		Your username and password are encrypted before transmission to the server. Both are scrambled using a one-way hash algorithm, making it very difficult to convert them back to clear text.
		</p>
		<p>
		<strong>Access duration:</strong>
		Every time you login you have access to the content management controls for two hours, after which you will be asked for your username and password again. This prevents network snoopers from defacing you site by reactivating old sessions. 
		</p>
	</div>
</div>

		<!-- ----------- -->
		<!-- END SIDEBAR -->
		<!-- ----------- -->
		</div>
		
	</div>
</div>
<!-- END MAIN CONTENT AREA -->

<br style="clear: both;">
<br>

<?php include(DOCROOT . $abs_root . '/common/footer.php'); ?>
