<?php
require_once(realpath(dirname(__FILE__) . '/open_db.lib.php'));

$is_admin = FALSE;

if (isset($_SERVER['HTTPS'])) {
  session_cache_limiter('private');
  session_set_cookie_params(strtotime('+1 year'), '/', '.xxx.org.za', TRUE, TRUE);
  session_start();

  if (isset($_SESSION['editor'])) {
    $is_admin = TRUE;
    $username = $_SESSION['editor'];
  } elseif (check_persistent_login()) {
    // Note that check_persistent_login() sets $_SESSION['editor']
    $is_admin = TRUE;
    $username = $_SESSION['editor'];
  } else {
    $is_admin = FALSE;
  }
  // Don't cache if $is_admin is set
  header( 'Cache-Control: no-store, no-cache, must-revalidate' );
  header( 'Cache-Control: post-check=0, pre-check=0', false );
  header( 'Pragma: no-cache' ); 
}

function check_persistent_login() {
  if (!array_key_exists('PersistentAuth', $_COOKIE)) {
    return false;
  }
  global $db, $is_admin;
  $table = "persistent_sessions";
  open_db('open');

  $cookie_data = $db->real_escape_string($_COOKIE['PersistentAuth']);
  list($username, $key) = explode("|", $cookie_data, 2) + array('', '');
  $username = $db->real_escape_string($username);
  $key = $db->real_escape_string($key);

  $query = "SELECT * FROM $table WHERE ".
           "username LIKE '".$username."' ".
           "LIMIT 1;";
  $getid = $db->query($query) or die("Query failed: ".$db->error);
  $row = $getid->fetch_assoc();
  open_db('close');

  if (isset($row)) {
    // Set up session, and delete old cookie, and create new persistent cookie
    $stored_session = $row['session'];
    if ($stored_session == $key) {
      // login
      $_SESSION['editor'] = $username; 
      // delete cookie
      delete_persistent_login();
      // create new cookie
      create_persistent_login($username);
      return true;
    }
    return false;
  }
  return false;
}

function create_persistent_login($username) {
  $validity = strtotime('+1 year'); // Time to keep the session valid
  global $db, $is_admin;
  $table = "persistent_sessions";
  open_db('open');

  $username = $db->real_escape_string($username);
  $key = bin2hex(random_bytes(100));

  // Add session key to database
  $query = "INSERT INTO $table " . "(username, session) VALUES ('" . $username."', '" . $key . "');";
  $db->query($query) or die("Query failed: ".$db->error);
  open_db('close');

  // Create cookie with key
  setcookie('PersistentAuth', "$username|$key", $validity, '/', '.xxx.org.za', TRUE, TRUE);

  return true;
}

function delete_persistent_login() {
  global $db, $is_admin;
  $table = "persistent_sessions";
  open_db('open');

  $cookie_data = $db->real_escape_string($_COOKIE['PersistentAuth'] ?? '');
  list($username, $key) = explode("|", $cookie_data, 2) + array('', '');
  $username = $db->real_escape_string($username);
  $key = $db->real_escape_string($key);

  // Add session key to database
  $query = "DELETE FROM $table " . 
           " WHERE username LIKE '" . $username . "'" . 
           " AND session LIKE '" . $key . "';";
  $db->query($query) or die("Query failed: ".$db->error);

  // Reap old sessions
  $query = "DELETE FROM $table " . 
           " WHERE created < DATE_SUB(now(), INTERVAL 1 YEAR);";
  $db->query($query) or die("Query failed: ".$db->error);

  open_db('close');

  // Delete cookie
  setcookie("PersistentAuth", false, strtotime('-1 year'),  '/', '.xxx.org.za', TRUE, TRUE);

  return true;
}