<?php
/*----------------------------------------
| CLASS FOR CRYPT AND ENCRYPT
----------------------------------------*/
// Check for Security
if ( !defined('HCR') )
{
	print "<h1>Incorrect Access</h1>";
	exit();
}

class crypter
{
	private $secu_code_arr = array(
										"start" => "a",
										"end" => "z",
									);
	private $pass_min_length = 6;				
	private $key_length = 32;
	private $encode_key = "e9c495f4b4271113dc1e546cbf04224b";	//Not change
	private $encode_arr = array(								//Not change
							" ", "0", "1", "2", "3",
							"4", "5", "6", "7", "8",
							"9", "a", "b", "c", "d",
							"e", "f", "g", "h", "i",
							"j", "k", "l", "m", "n",
							"o", "p", "q", "r", "s",
							"t", "u", "v", "w", "x",
							"y", "z", "A", "B", "C",
							"D", "E", "F", "G", "H",
							"I", "J", "K", "L", "M",
							"N", "O", "P", "Q", "R",
							"S", "T", "U", "V", "W",
							"X", "Y", "Z", "@",
						);
						
	/*-----------------------------------------------------
	| CREATE RANDOM KEY
	+ ---------------------------------------------------*/
	function random_key($number)
	{
		$arr_sum = array();
		$arr_num = array();
		$arr_char = array();
		
		$arr_num = range("0", "9");
		$arr_char = range($this->secu_code_arr['start'], $this->secu_code_arr['end']);
		
		$arr_sum = array_merge($arr_num, $arr_char);

		$rand = '';
		for($i = 0; $i < $number; $i++)
		{
			$key = array_rand($arr_sum);
			$rand .= $arr_sum[$key];
		}
		
		return $rand;
	}
	
	/*-----------------------------------------------------
	| CREATE A SECURITY CODE
	+ ---------------------------------------------------*/
	function security_code($number)
	{
		// Lay ngau nhien tu 0-9, A-Z
		$this->secu_code_arr['start'] = "A";
		$this->secu_code_arr['end'] = "Z";
		
		return $this->random_key($number);
	}
	
	/*-----------------------------------------------------
	| COMPILE A SECURITY CODE TO PRINT IN SCREEN
	+ ---------------------------------------------------*/
	function print_screen($code)
	{
		$str_print = "";
		for($i = 0; $i < strlen($code); $i++)
		{
			$str = substr($code, $i,1);
			$str_print .= $str.'';
		}
		
		return $str_print;
	}
	
	/*-----------------------------------------------------
	| CREATE KEY FOR CRYPT A PASSWORD
	+ ---------------------------------------------------*/
	function set_key()
	{
		// Lay ngau nhien tu 0-9, a-z
		$this->secu_code_arr['start'] = "a";
		$this->secu_code_arr['end'] = "z";
		
		return $this->random_key($this->key_length);
	}
	
	/*-----------------------------------------------------
	| FILL IN MISSING CHAR BY RANDOM CHAR
	|
	| This help Vernam encrypt be true
	+ ---------------------------------------------------*/
	function get_true_vernam($text)
	{
		// Just encrypt chars in encode_arr
		$text_arr = str_split($text);
		$text = "";
		foreach ($text_arr as $k => $v)
		{
			$yes = false;
			foreach ($this->encode_arr as $value)
			{
				if ($v == $ $value)
				{
					$yes = true;
					break;
				}
			}
			
			if ($yes) $text .= $text_arr[$k];
		}
		
		// strlen($key) = strlen($password) = key_length
		if ( strlen($text) < $this->key_length)
		{
			$text .= "@";
			
			while ( strlen($text) < $this->key_length) $text .= $this->random_key(1);
			
			if ( strlen($text) > $this->key_length) $text = substr($text,0,$this->key_length);
		}
		
		return $text;
	}
	
	/*-----------------------------------------------------
	| ENCODE TEXT USING VERNAM ALGORITHM
	+ ---------------------------------------------------*/
	function vernam($text, $key)
	{
		// Be sure $text and $key are valid
		$text = $this->get_true_vernam($text);
		$key = $this->get_true_vernam($key);
		
		$text_arr = str_split($text);
		$key_arr = str_split($key);
		
		$code_text = "";
		
		
		for ($i = 0; $i < $this->key_length; $i++)
		{
			$text_int = 0;
			while ( ($text_arr[$i] != $this->encode_arr[$text_int]) && ($text_int < count($this->encode_arr)) ) $text_int++;
			
			$key_int = 0;
			while ( ($key_arr[$i] != $this->encode_arr[$key_int]) && ($key_int < count($this->encode_arr)) ) $key_int++;
			
	
			$code_int =  $text_int + $key_int;
			
			if ( $code_int > count($this->encode_arr) ) $code_int -= count($this->encode_arr);
			
			$code_text .= $this->encode_arr[$code_int];
		}
		
		return $code_text;
	}
	
	/*-----------------------------------------------------
	| DECODE TEXT HAD BEEN ENCODE WITH VERNAM ALGORITHM
	+ ---------------------------------------------------*/
	function devernam($text, $key)
	{
		
		$text = $this->get_true_vernam($text);
		$key = $this->get_true_vernam($key);
		
		$text_arr = str_split($text);
		$key_arr = str_split($key);
		
		$code_text = "";
		
		
		for ($i = 0; $i < $this->key_length; $i++) 
		{			
			$text_int = 0;
			while ( ($text_arr[$i] != $this->encode_arr[$text_int]) && ($text_int < count($this->encode_arr)) ) $text_int++;
			
			
			$key_int = 0;
			while ( ($key_arr[$i] != $this->encode_arr[$key_int]) && ($key_int < count($this->encode_arr)) ) $key_int++;
			
			
			$code_int =  $text_int - $key_int;
			
			if ( $code_int < 0 ) $code_int += count($this->encode_arr);
			
			$code_text .= $this->encode_arr[$code_int];
		}
		
		return $code_text;
	}
	
	/*-----------------------------------------------------
	| ENCODE PASSWORD BY VERNAM ALGORITHM
	+ ---------------------------------------------------*/
	function crypt_password($password, $key)
	{
		// Encode keyword
		$key = $this->vernam($key, $this->encode_key);
		
		// Encode password
		return $this->vernam($password, $key);
	}
	
	/*-----------------------------------------------------
	| DECODE PASSWORD HAD BEEN ENCODE BY VERNAM
	+ ---------------------------------------------------*/
	function decrypt_password($password, $key)
	{
		$key = $this->vernam($key, $this->encode_key);		
		$text = $this->devernam($password, $key);		
		$password_arr = explode("@", $text);
		return $password_arr[0];
	}
}
?>

<?php
/*------------------------------------
| LOGIN TO ADMIN PANEL
 ------------------------------------*/
 
// Check for Security
if ( !defined('HCR') )
{
	print "<h1>Incorrect Access</h1>";
	exit();
}

$cnt = new content;

class content
{
	public $text = "";
	public $title = "WEBSITE CONTROL PANEL";	
	private $process = "";
	private $frmValue = array(
								'password' => '',
								'username' => '',
						  	 );
	private $error = array(
								'username' => 0,
								'password' => 0,
							);
	private $warning = "";
	
	
	function __construct()
	{
		global $str, $sess, $lang, $panel;		
		if ($sess->member_id) $sess->destroy();		
		$this->get_input();
		$check_input = $this->check_input( $this->frmValue );
		
		if ( $this->process == "login" )
		{
			if ($check_input)
			{
				 if ($this->login($this->frmValue))
				 {
				  	  $str->goto_url('admp.php');
				 }
				 else
				 {
					  $this->warning = " <span class='span_err'>". $lang['login_notmatch'] ."</span><br/><br/>";
				 }
			}
			else
			{
				$this->warning = "<span class='span_err'>". $lang['login_error'] ."</span><br/><br/>";
			}
		}else
		{
			//Reset Error Array
			$this->error['username'] = 0;
			$this->error['password'] = 0;
		}
		
		$this->text = $this->warning ? "<div id='warning'><b><u>Lỗi nhập liệu</u></b> : " . $this->warning . "</div>" . $this->box_login() : $this->box_login();
	}
	
	
	/*---------------------------------------------
	 | GET INPUT DATA	
	+----------------------------------------------*/
	function get_input()
	{
		global $str;		
		$this->process = isset($_POST['process']) ? $str->input($_POST['process']) : "";		
		$this->frmValue['username'] = isset($_POST['username']) ? $str->input($_POST['username']) : "";
		$this->frmValue['password'] = isset($_POST['password']) ? $_POST['password'] : "";
	 }
	
	
	/*--------------------------------------------------
	 | CHECK INPUT DATA
	+--------------------------------------------------*/
	function check_input($frmValue)
	{
		global $frm, $main, $sess, $db, $str;		
		$no_error = true;		
		if ( !$frm->check_username($frmValue['username'], 3) )
		{
			$this->error['username'] = 1;
			$no_error = false;
		}
		
		if ( !$frm->check_password($frmValue['password'], 6, 32) )
		{
			$this->error['password'] = 1;
			$no_error = false;
		}
		
		return $no_error;
	}
	
	
	/*-------------------------------------------
	  | CHECK INFOS AND AUTHENTICATE FOR LOGIN
	+--------------------------------------------*/
	function login($frmValue)
	{
		global $str, $frm, $db, $sess, $lang, $crypt, $main;
		
		if ( $sess->member_id ) $sess->destroy();
		
		$tmp_username = stripslashes($frmValue['username']);
		$tmp_password = stripslashes($frmValue['password']);
				
		
		$query = $db->simple_select("username, password, login_key, id, groups", "adm_members", "username = '". mysql_real_escape_string($tmp_username) ."' AND active = 1");
		$result = $db->query($query);
		$row = $db->fetch_array($result);
		
		if ( !$row['password'] ) return false;		
		$password = $crypt->decrypt_password($row['password'], $row['login_key'], 32);						
		if ($password != $tmp_password) return false;
		if (strcmp($row['username'], $tmp_username) <> 0 ) return false;
		
		// Update to session
		$sess->member_id = $row['id'];
		$sess->username = $frmValue['username'];
		$sess->groups_id = $row['groups'];
				
		$arr = array( 
						'username' => $sess->username,
						'member_id' => $sess->member_id,
						'groups_id' => $sess->groups_id,
					);
		$db->do_update("session", $arr, "id = '". $sess->sess_id ."'");
						
		// Update last visit
		$arr = array( 'last_visit'  => $sess->now );
		$db->do_update("adm_members", $arr, "id = ". $sess->member_id);
		
		return true;
	}
	
	/*------------------------------------------------
	 | SHOW LOGIN BOX
	--------------------------------------------------*/
	function box_login()
	{
		global $lang, $frm, $dsp;
		
		$text  = $frm->draw_form("", "", 2, "POST");
		$text .= $frm->draw_hidden("process", "login");
			$text .= "<center><fieldset style='border:#0066FF solid 1px; width:300px;'>
<legend style='font-weight:bold; font-size:0.9em; color:#333333'><img src='". ADMIN_IMG ."lock.png' align='absmiddle' width='20' /> Đăng nhập hệ thống</legend>";
			$text .= "<table border='0' width='300'>";
				$text .= "<tr><td height='5' colspan='2'></td></tr>";
				$text .= "<tr>";
					$text .= "<td width='70'>" . $lang['login_user'] . "</td>";
					$text .= "<td align='left'>" . $frm->draw_textfield("username", "", "field", "", "32") . "</td>";
				$text .= "</tr>";
				$text .= "<tr><td height='2' colspan='2'></td></tr>";
				$text .= "<tr>";
					$text .= "<td>" . $lang['login_pass'] . "</td>";
					$text .= "<td align='left'>" . $frm->draw_password("password", "field", "", "32") . "</td>";
				$text .= "</td></tr>";
				$text .= "<tr><td height='5' colspan='2'></td></tr>";
				$text .= "<tr><td colspan='2' align='center'>";
					$text .= "<input type='submit' value='Đăng nhập' style='background-color:#0F4B5D; color:#FFFFFF; border:#CCC solid 1x;' />";
				$text .= "</td></tr>";
				$text .= "<tr><td height='5' colspan='2'></td></tr>";
			$text .= "</table></fieldset></center>";
		$text .= '</form>';
		
		return $text;
	}
}

?>

if ( !$row['password'] ) return false;		
		$password = $crypt->decrypt_password($row['password'], $row['login_key'], 32);						
		if ($password != $tmp_password) return false;
		if (strcmp($row['username'], $tmp_username) <> 0 ) return false;

$password = $crypt->decrypt_password($row['password'], $row['login_key'], 32);