<?php
if($_GET['panel']=="small" || $_SESSION['small_admin']==1){
	$_SESSION['small_admin']=1;
} elseif($_GET['panel']=="large") {
	$_SESSION['small_admin']=0;
}
if(stristr($_SERVER['HTTP_HOST'], "restaurant-online.biz")){
	$root_path = "http://www.restaurant-online.biz/".$_SESSION['root_folder'];
	$_SESSION['root_path'] = $root_path;
} elseif(stristr($_SERVER['HTTP_HOST'], "tastedisplay.com")){
	$root_path = "http://www.tastedisplay.com/".$_SESSION['root_folder'];
	$_SESSION['root_path'] = $root_path;
} else {
	$root_path="../";
	$_SESSION['root_path'] = $root_path;
}

include('menudatabase.php');

//echo "skey=" . $skey . "<br>";
if((!empty($_GET['x']))&&(!empty($_GET['y']))&&($_GET['skey'] =="p987gjkjtyedghnbdd3421scdzx")){
	$autologin=1;
	//echo "x=" . $_GET['x'];
	//echo "<br>y=" . $_GET['y'];
}

if ((isset($_POST['submit']))||($autologin==1)) {
	//get username and pwd posted to form
	if (empty($_POST['username'])) {
		$uu = FALSE;
		$message .= '<p>Please enter a User ID.</p>';
	} else {
		$uu = mysql_real_escape_string($_POST['username']);
	}
	
	if (empty($_POST['password'])) {
		$pp = FALSE;
		$message .= '<p>Please enter your password.</p>';
	} else {
		$pp = mysql_real_escape_string($_POST['password']);
	}
	//use name and pwd from autologin form if used
	if (!empty($_GET['x'])) {
		$uu = mysql_real_escape_string($_GET['x']);
	}
	
	if (!empty($_GET['y'])) {
		$pp = mysql_real_escape_string($_GET['y']);
	}

//echo "<br>uu=" . $uu;
	//echo "<br>pp=" . $pp;
	
	if ($uu && $pp) { //if ID and password are ok
		$query = "SELECT userID, firstName, isAdmin, recordKey, rolAdmin, masterAdmin FROM admin WHERE (UserID='$uu' or email='$uu') AND password=PASSWORD('$pp') AND active='1'";
	//echo $query;
		$result = @mysql_query ($query);
		$row = mysql_fetch_array ($result, MYSQL_NUM);
		if ($row) { //match was found
			// Start the session, register values & redirect
			//any action here happens upon login only
			$_SESSION['FirstName'] = $row[1];
			$_SESSION['UserID'] = $row[0];
			$_SESSION['admin'] =$row[2];
			$_SESSION['adminkey'] ="security";
			$_SESSION['recordKey'] =$row[3];
			$_SESSION['roladmin'] =$row[4];
			$_SESSION['masterAdmin'] =$row[5];
			
	
			//check site package options
			//force refresh after login
				if( isset($_POST['redirect_uri']) ){
					echo "<script>window.location='liveorders.php';</script>";
				}else{
					echo "<script>window.location='index.php';</script>";
				}
			} else {
				echo '<p>The user ID and password entered do not match those on file, or the user account is no longer active.</p>';
				$_SESSION['admin'] =0;
			}
		
		mysql_close(); //close db connection
		
	} else {	//if everything was not ok
		echo '<p>Please try again.</p>';
	}


}	//end of submit conditional
	if (isset($_SESSION['FirstName'])&&($_SESSION['adminkey']=="security"))  {
	//user is logged in
$full_width = 0;
	include ('includes/db1config.php'); //db connection config file
    include ('../includes/mysql_connect.php'); //connect using selected db config file
    
			if (isset($_REQUEST["return_to"])) {
				$my_returnto = $_REQUEST["return_to"];
				// make sure we return to a cmsadmin page that will not log you out.
				if (stripos($my_returnto, "logout") === false && stripos($my_returnto, "cmsadmin")) {
					// NOTE: install PECL HTTP extension to use the following
					// http_redirect($my_returnto);
					echo "<script>location.href=\"".$my_returnto."\";</script>";
				}
			}
		//include admin panels
		if($_SESSION['small_admin']==1){
			include("small_admin.php");
		} else {
			include("admin_panels.php");
	    }
	} else {
		echo '<body onload="setFocus()"><div align=center><form action="';

		echo $_SERVER['PHP_SELF']; 
		$uri = $_SERVER['REQUEST_URI'];

		echo '" method="post">';
		if (isset($_REQUEST["return_to"])) {
			$my_returnto = $_REQUEST["return_to"];
			// make sure we return to a cmsadmin page that will not log you out.
			if (stripos($my_returnto, "logout") === false && stripos($my_returnto, "cmsadmin")) {
				echo "<input type=hidden name=return_to value=\"".$my_returnto."\" />";
			}
		}

		if( $uri!='' && in_array('liveorders.php',explode('/',$uri))){
			echo"<input type='hidden' name='redirect_uri' value='' />"; 
		}

		echo '<div align="center">
		<div id="login-logo"><img src="'.$_SESSION['root_path'].'/custom/images/header-logo.png" /></div>
		<br />
		User ID:<br>
		<input type="text" name="username" id="username" size=40 maxlength=40 value="';

		

		if (isset($_POST['username'])) echo $POST['username']; 

		echo '" />
		<br /><br />
		Password:<br />
		<input type="password" name="password" size=40 maxlength=15 />
		<br><br>
		<input id="save-button" type="submit" name="submit" value="Login" /></div>
		</form>';

		echo '<br>
			<a href="/cmsadmin/reset_pwd.php">Reset Password</a>
		';
	}
	echo '</div>';

?>
