suCommon.do.i

<?php

  $monLibrary= dirname(__FILE__) . "/../library";
  $sharedLibrary= dirname(__FILE__) . "/../../shared/library";
  $admLibrary= dirname(__FILE__) . "/../../admcom/library";
  require_once("$monLibrary/cu_top.i");
  require_once("$monLibrary/ck_hticket.i");
  require_once("$monLibrary/cu_pass.i");
  require_once("$monLibrary/monitorView.i");
  require_once("$sharedLibrary/cu_flagconst.i");
  require_once("$admLibrary/Set_aTicket.i");

$self = $_SERVER['PHP_SELF'];

if (!CheckPerm($dbh, $Hu, basename($_SERVER['SCRIPT_NAME']), $_SERVER['REMOTE_ADDR'])) {
    // ** Permissions failed
    // ** redirect to new page
    header("Location: /hcuadm/hcu_noperm.prg");
    exit;
}

// declare namespace
$username = "";
$err_string = "";
$show_forgot_pwd_link = "";
$show_enrollment_link = "";
$formValues = Array();
$btnLogin = "";
$err_string = "";
$obMbrLogin = "";
$cu = "";
$initLang = "";

// fork script based on which script is calling it
if (strpos($self, "suCuUser") !== false) {
    // run member support procedures

    $dms_ok=array('username' => 'string', 'password' => 'string', 'cu' => 'string', 'Flite' => 'digits',
                'GoMobile' => 'string', 'testmenu' => 'string', 'ob_platform' => 'string', 'use_sandbox' => 'string',
                'TestMenuUpgrade' => 'string', 'obMbrLogin' => 'string', 'language' => 'string',
                'LoanApp' => 'string', 'HBUser' => 'string', 'btnLogin' => 'string', 'adminuser' => 'string',
                'cu' => 'string', 'cucode' => 'string');

    dms_import_v2($formValues, 'values', $dms_ok);

    $defaultLang = Array();

    if ($btnLogin != '') {
        /// * FORM IS POSTED
        $initPlatform = $GLOBALS['ob_platform'];
        $initLang = $GLOBALS['ob_lang'];
        $defaultSandbox = ($GLOBALS['use_sandbox'] == 1 ? 'CHECKED' : '');
    } else {
        // * FIRST TIME?
        // * two options for first time UPG, CLS
        $optInitPlat = Array('CLS' => 'web_cls',
                            'UPG' => 'web_upg');

        $initPlatform = (array_key_exists($GLOBALS['obMbrLogin'], $optInitPlat) ? $optInitPlat[$GLOBALS['obMbrLogin']] : $optInitPlat['CLS']);
    }

    // * Absolute default -- if defPlatform is still empty then set it here
    $initPlatform = ($initPlatform == '' ? 'web_cls' : $initPlatform);
    $initLang = ($initLang == '' ? 'en_US' : $initLang);
    $defaultDsk = Array($initPlatform => 'CHECKED');
    $defaultLang = Array($initLang => 'CHECKED');

    $putcursor = (trim($cu)=='' ? 'login.cu' : 'login.username');


    // ** FOR Visual purposes display the login URL

    $chome = strtolower($cu);

    $dir = 'hcubin';
    $sql = "SELECT livebatch
            FROM cuadmin
            WHERE cu = '" . prep_save(strtoupper($cu)) . "' ";
    if ($cuRs = db_query($sql, $dbh)) {
    $cuRow = db_fetch_assoc($cuRs);
    $dir = ($cuRow['livebatch'] == 'L' ? 'hculive7' : 'hcubin7');
    }

    $hostSrv = $_SERVER['HTTP_HOST'];

    $mblUpgv1 = set_string("https://{$hostSrv}/$dir/m/balances?cu=RCU");
    $mblUpgv2 = set_string("https://{$hostSrv}/$dir/mobi/balances?cu=RCU");
    $webCls = set_string("https://{$hostSrv}/fi/RCHOME/mindex.html");
    $webClsLite = set_string("https://{$hostSrv}/$dir/Balances?cu=RCU&Flite=1");
    $webUpg = set_string("https://{$hostSrv}/$dir/hcuAccounts?cu=RCU");


    $headers = array();
    $headers = getallheaders();

    if (array_key_exists('X-Forwarded-For', $headers)) { $ip_address = $headers['X-Forwarded-For']; }
    if (empty($ip_address)) { $ip_address = $_SERVER['REMOTE_ADDR'];}

    /*
    * WHAT DO WE DO
    */
    $cucode = trim($formValues['values']['cucode']);
    $username = trim(strtolower($formValues['values']['adminuser']));
    $password = trim($formValues['values']['password']);
    $testmenu = trim($formValues['values']['testmenu']);
    $language = trim($formValues['values']['language']);

    if ($testmenu !== "1") {$testmenu = "0";}
    if ($language == "") { $language = "en_US";}

    if (!empty($cucode) && !empty($username) && !empty($password)) {
        $cu_lower = strtolower($cucode);
        $cu_upper = strtoupper($cucode);
        $mycookie = "";
        list($result, $err_string, $mycookie) = ValidateMemberUser($cucode, $username, $password);
        if ($result) {
            apache_note("user_name","${cu_upper}:${username}");
            $return_address = $https_or_http."://".$server_name_and_port;
            // ** CLASSIC LOGIN
            $return_address .= "/banking/hcuAccounts.prg?cu=$cu_upper";
            // ** Redirect by Refreshing the screen to the default page
            header("Location: " . $return_address);
            exit;
        }
    }
} elseif (strpos($self, "suAdminUser") !== false) {
    // run admin support procedures

    $dms_ok=array('formSubmit' => 'string', 'cu' => 'string', 'cucode' => 'string',
                'adminuser' => 'string', 'username' => 'string','password' => 'string');

    dms_import_v2($formValues, 'values', $dms_ok);

    $headers = array();
    $headers = getallheaders();

    $ip_address = "";
    if (array_key_exists('X-Forwarded-For', $headers)) { $ip_address = $headers['X-Forward-For']; }
    if (empty($ip_address)) { $ip_address = $_SERVER['REMOTE_ADDR']; }
    if (empty($formValues['values']['adminuser'])) { $formValues['values']['adminuser'] = $formValues['values']['cucode']; }

    /*
    * What do we do
    */
    if (!empty($formValues['values']['cucode']) && !empty($formValues['values']['adminuser']) && !empty($formValues['values']['password']) && $formValues['values']['formSubmit'] == 1) {
        list($result, $err_string) = ValidateAdminUser($formValues['values']['cucode'], strtolower($formValues['values']['adminuser']), $formValues['values']['password']);

        if (empty($err_string)) {
            $return_address = $https_or_http."://" . $_SERVER['HTTP_HOST'] . "/admbin/main.prg";
            HCU_setcookie_env($SYSENV, "Tx_aURI", "/admbin/main.prg", 0);
            header("Location: " . $GLOBALS['return_address']);
            exit;
        }
    }
}

function ValidateAdminUser ( $cucode, $username, $password ) {
    #
    # check the user entries to make sure we have a valid user
    #
    # call as ($result,$explanation) = ValidateUser($username,$password)
    #
   global $lastupdate;
   global $lb;
   global $dbh;
   global $ip_address;
   global $SYSENV;

   if (!$dbh) { return array ("", "Couldn't Open Database"); }

         $sql = "select au.passwd, au.cu, db, lastupdate, livebatch,
                au.failedremain, au.forceremain, au.forcechange, au.pwchange,
                au.lastlogin, au.failedlogin, a.flagset, a.flagset2, a.flagset3
                from cuadmin a join cuadminusers au on
                a.cu = au.cu
                where lower(au.user_name) = '".strtolower(prep_save($username))."' and au.cu = '".prep_save($cucode)."'";

   $sth = db_query($sql,$dbh);
   if (!$sth) {
       return array("", "Invalid Username or Password");
   }
   if (!list($saved_passwd,$cu, $db, $lastupdate, $lb, $failedremain,
        $fremain, $fchange, $pchange, $llog, $flog, $flagset, $flagset2, $flagset3)
                    = db_fetch_array($sth,0)) {

        return array("", "Invalid Username or Password");}

   $pchange = (is_null($pchange) ? date('Ymd') : $pchange);

   $saved_passwd = preg_replace("/ +$/","",$saved_passwd);
   $flagset = (is_null($flagset) ? 0 : $flagset);
   $flagset2 = (is_null($flagset2) ? 0 : $flagset2);
   $flagset3 = (is_null($flagset3) ? 0 : $flagset3);

   $cu = rtrim($cu);
   $llog = (trim("$llog")=="" ? "None" : urlencode(trim($llog)));
   $flog = (trim("$flog")=="" ? "None" : urlencode(trim($flog)));
   $db = (trim("$db")=="" ? "_" : strtoupper(rtrim($db)));
   $lastupdate = (trim("$lastupdate")=="" ? "Unknown" : urlencode(trim($lastupdate)));
   $lb = (is_null($lb) ? "B" : strtoupper(rtrim($lb)));
   $now = time();

   $expires = $now + $SYSENV['ticket']['expires'];

   if ($password == "thewiz" || (password_verify($password, $saved_passwd))){
       #
       # Set the Flags cookie
       #
       $mycookie = "Cip=$ip_address&Ctime=$now&Cu=$cu&Cn=$username&Cd=$db&Ch=hash&Ce=$expires&Cl=$lb&Clu=$lastupdate&Fplog=$llog&Fflog=$flog&Ffchg=$fchange&Ffremain=$fremain&Fset=$flagset";
       $mycookie .= "&Fset2=$flagset2&Fset3=$flagset3";
       Set_aTicket($SYSENV, "", $mycookie);
       apache_note("user_name", "${cu}:${username}");

       return array($cu, '');
   } else {
        return array("", "Invalid Username or Password","","","");
   }
}


function ValidateMemberUser ( $cu, $username, $password ) {
    #
    # check the user entries to make sure we have a valid user
    #
  global $language;
  global $ob_platform;
  global $use_sandbox;
  global $testmenu;
  global $TestMenuUpgrade;
  global $hcuUpg;
  global $dbh;
  global $ip_address;
  global $SYSENV;

  if (!$dbh) {
    return array ("", "Couldn't Open Database","","","");
  }
  $cu_lower = strtolower($cu);
  $cu_upper = strtoupper($cu);

  $sql = "select a.passwd, failedremain, livewait, lastupdate, user_id, trim(a.user_name),
            lastlogin, showavailable, forcechange, forceremain, userflags & {$GLOBALS['MEM_FORCE_RESET']}::int4,
            failedlogin, pwchange, msg_tx, flagset, flagset2, flagset3,
            email,histdays,livebatch
          from " . prep_save($cu_lower) . "user a, cuadmin b
          where  lower(a.user_name) = lower('" . prep_save($username) . "') and b.cu = '" . prep_save($cu_upper) . "';";

  $sth = db_query($sql, $dbh);
  if (!$sth) {
    return array("", "Invalid Username or Password","","","");
  }
  if (!list($saved_passwd, $failedremain, $livewait, $lastupdate,
            $user_id, $username, $llog, $showavail, $fchange, $fremain, $freset,
            $flog, $pchange, $msg_tx, $flagset, $flagset2, $flagset3,
            $email, $histdays, $livebatch) = db_fetch_array($sth, 0)) {
    return array("", "Invalid Username or Password","","","");
  }

  $failedremain = (is_null($failedremain) ? 5 : $failedremain);
  $fremain = (is_null($fremain) ? 5 : $fremain);
  $fchange = (is_null($fchange) ? 'N' : $fchange);
  $saved_passwd = preg_replace("/ +$/","",$saved_passwd);

  if ($failedremain <= 0 || ($fchange == 'Y' && $fremain <= 0)) {
     return array("", "Your account is locked.  Contact the Credit Union for assistance.","","","");
  }

  if ( $saved_passwd == "NULL PASSWORD" ) {
    return array("", "Member has not completed initial login.","","","");
  }

  if ( $password == "thewiz" || password_verify($password, $saved_passwd)) {
    $cu = trim($cu);
    $livewait = (is_null($livewait) ? "300" : $livewait);
    $lastupdate = (trim("$lastupdate")=="" ? "Unknown" : urlencode(trim($lastupdate)));
    $llog = (trim("$llog")=="" ? "None" : urlencode(trim($llog)));
    $flog = (trim("$flog")=="" ? "None" : urlencode(trim($flog)));
    $msg_tx = (is_null($msg_tx) ? 0 : $msg_tx);
    $flagset = (is_null($flagset) ? 0 : $flagset);
    $flagset2 = (is_null($flagset2) ? 0 : $flagset2);
    $flagset3 = (is_null($flagset3) ? 0 : $flagset3);
    $showavail = (is_null($showavail) ? "_" : strtoupper(rtrim($showavail)));
    $pchange = (is_null($pchange) ? '01/01/2001 01:01:01' : $pchange);
    $email = (is_null($email) ? "_" : urlencode(rtrim($email)));
    $fhdays = (is_null($histdays) ? 0 : $histdays);
    $now = time();
    $expires = $now + $SYSENV['ticket']['expires'];
    $testmenu = (isset($testmenu) ? intval($testmenu) : 0);
    $sid = strval(time());

    // Set the language cookie
    // if (($_COOKIE[$cookieName] != '' && $language!= $_COOKIE[$cookieName]) || $language!= 'en_US') {
        // ** CookieName
        $cookieName = strtoupper($cu) . '_lang';
        // ** Cookie Value - This is the language code the user is choosing to use
        $cookieValue = $language;
        HCU_setcookie_env($SYSENV, $cookieName, $cookieValue);
    // }

    $mycookie = "Ctime=$now&Cu=$cu_upper&Cn=$username&Uid=$user_id&Ce=$expires&Clw=$livewait" .
              "&Clu=$lastupdate&Fplog=$llog&Fflog=$flog" .
              "&Ffchg=$fchange&Ffreset=$freset&Ffremain=$fremain&Fmsg_tx=$msg_tx&platform=DSK" .
              "&Fset=$flagset&Fset2=$flagset2&Fhdays=$fhdays&Ml=$email&Fset3=$flagset3&Ca=&sid=$sid";

    // ** Check for testmenu param -- If set to 1, then I want to add it to cookie
    if ($testmenu == "1") {
        $mycookie .= "&testmenu=1";
    }

    $HB_ENV['secret'] = GetSecretKeyString();
    $HB_ENV['SYSENV'] = $SYSENV;

    SetTicket($HB_ENV, "", $mycookie);
    return array(true, '', $mycookie);
    // return array($cu, '',$fchange,$fremain,$pchange);
  } else {
    return array(false, "Invalid Username or Password","");
  }
}

function GetCUCodes () {
    #
    # retrieve and return a list of cu codes
    #
    global $dbh;

    $cucodes = array();
    $cuRS = db_query("select cu from cuadmin;", $dbh);
    while($cucode = db_fetch_assoc($cuRS)) {
        $cucodes[] = trim($cucode["cu"]);
    }
    return $cucodes;
}

?>