<?php
  if (!isset($_SERVER['HTTPS']))
  {
      $url = 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
      header("Location: $url");
      exit;
  }
  session_start();
  ini_set('magic_quotes_runtime','OFF');
  // Get remote ip
  (isset($_SERVER['HTTP_X_FORWARDED_FOR'])
   && ($forwards = explode(',',$_SERVER['HTTP_X_FORWARDED_FOR']))
   && $remoteip = trim(end($forwards))) || $remoteip = $_SERVER['REMOTE_ADDR'];

  // Get request vars and filter them
  if (get_magic_quotes_gpc() || get_magic_quotes_runtime()) {
      function strip_array($var) {
          return is_array($var)? array_map("strip_array", $var):stripslashes($var);
      }
      isset($_REQUEST) && ($_REQUEST = strip_array($_REQUEST));
      isset($_POST) && ($_POST = strip_array($_POST));
      isset($_GET) && ($_GET = strip_array($_GET));
      isset($_GET) && ($_GET = strip_array($_GET));
      isset($_POST) && ($_POST = strip_array($_POST));
      #isset($_SESSION) && ($_SESSION = strip_array($_SESSION));
  }

  # define HTTP request vars as globals
  foreach (array_keys($_GET) as $key) {
      if (!is_array($_GET[$key])) {
          $$key = html_entity_decode($_GET[$key]);
      } else {
          $$key = $_GET[$key];
      }
  }

  foreach (array_keys($_POST) as $key) {
      if (!is_array($_POST[$key])) {
          $$key = html_entity_decode($_POST[$key]);
      } else {
          $$key = $_POST[$key];
      }
  }


// U18/O18 variable to distinguish content snippets
  if (!isset($hmskin)) {
    $hmskin = '';
  }
  if ($hmskin=="U18") {
    $_SESSION['hmskin'] = "U18";
    setcookie("hmskin","U18",time()+60*60*24*30,"/");
  }
  if ($hmskin=="O18") {
    $_SESSION['hmskin'] = "O18";
    setcookie("hmskin","O18",time()+60*60*24*30,"/");
  }
  if (!isset($_SESSION['hmskin'])) {
    $_SESSION['hmskin'] = "O18";
  }
// U18/O18 END


  if (! isset($module)) $module = '';
  /* Handle Logout button */
  if ($module == 'logout') {
      if ($area == 'admin') {
          $loggedIn = $_SESSION['loggedIn'];
          if ($loggedIn) {
              $loggedIn->log('logout', $loggedIn->userId);
              $_SESSION['loggedIn'] = false;

              if (! $dev) {
                  header('WWW-Authenticate: Basic realm="My Realm"');
                  header('HTTP/1.0 401 Unauthorized');
                  echo 'Bitte rufen Sie die Seite erneut auf, um sich einzuloggen.';
                  exit;
              }
          }
      } else {
          $clientLoggedIn = $_SESSION['clientLoggedIn'];
          if ($clientLoggedIn) {
              $clientLoggedIn->log('logout', $clientLoggedIn->userId);
              $_SESSION['clientLoggedIn'] = false;
          }
      }
      $module = '';
  }

  /* Check for session hijacking */
  if (isset($_SESSION['loggedIn']) && $_SESSION['loggedIn'] != false) {
      $loggedIn = $_SESSION['loggedIn'];
      /* Test if session stored contains current request ip
         If not, the session has been created by a different client
         -> possible Hijack
         FIXME: a new IP address (DSL disconnect) will result in "Hijack" warning
       */
      if ($loggedIn->ip && $loggedIn->ip != $remoteip) {
          print "SESSION HIJACKED! <!-- OldIP: " . $loggedIn->ip ." New IP: " . $remoteip . " -->";
          $_SESSION['loggedIn'] = false;
          $loggedIn->log('Hijacked SessionId', $clientLoggedIn->userId);
      } else {
          //  print "IP: " . $_SESSION['ip'] . "<br/>\n";
      }

  } else {
      $loggedIn = '';
  }
  if (isset($_SESSION['clientLoggedIn'])) {
      $clientLoggedIn = $_SESSION['clientLoggedIn'];
    /* Test if session stored contains current request ip
       If not, the session has been created by a different client
       -> possible Hijack
       FIXME: a new IP address (DSL disconnect) will result in "Hijack" warning
     */

      if (isset($clientLoggedIn) && $clientLoggedIn !== false) {
          if ($clientLoggedIn->ip && $clientLoggedIn->ip != $remoteip) {
              $_SESSION['clientLoggedIn'] = false;
              $clientLoggedIn->log('Hijacked SessionId', $clientLoggedIn->userId);
              $module='';
          } else {
              //  print "IP: " . $_SESSION['ip'] . "<br/>\n";
          }
      }
  } else {
      $clientLoggedIn = '';
  }

  if ($area == 'admin') {
      if (! $dev) {
          if (isset($_SERVER['PHP_AUTH_USER'])) {
              $login = $_SERVER['PHP_AUTH_USER'];
              $password = $_SERVER['PHP_AUTH_PW'];
          }
      }
      if (!isset($loggedIn->userId)) {
          /* Check IP address of client trying to log in as admin */
          $ipcheck = false;
          foreach ($allowedIps as $allowedIp) {
              if ($allowedIp == $remoteip) {
                  $ipcheck = true;
                  break;
              }
          }
          if (!$ipcheck && ! $_REQUEST['a337337337']) {
              header('Location: https://www.healthmiles.de');
              exit;
          }

          // Ist ein Login eingegeben worden?
          if (isset($login) && isset($password)) {
              $loggedIn = login($login, $password, $area);
              if ($loggedIn != false) {
                  $_SESSION['loggedIn'] = $loggedIn;
              } else {
                  $module = 'login';
                  $action = '';
                  if (! $dev) {
                      header('WWW-Authenticate: Basic realm="My Realm"');
                      header('HTTP/1.0 401 Unauthorized');
                      echo 'Bitte rufen Sie die Seite erneut auf, um sich einzuloggen.';
                      exit;
                  }
              }
          } else {
              if (! $dev) {
                  header('WWW-Authenticate: Basic realm="Healthmiles Login"');
                  header('HTTP/1.0 401 Unauthorized');
                  echo 'Bitte rufen Sie die Seite erneut auf, um sich einzuloggen.';
                  exit;
              }


              // Keine Logindaten eingegeben: Loginseite zeigen
              if (! isset($login))
              {
                  $module = 'login';
                  $action = '';
              }
          }
      }
  } else {
      /* Teilnehmerlogin */
      if (isset($login) && isset($password))
      {
          $loginfailed = false;
          // print "Loggin in with $login, $password, $area<br/>\n";
          $clientLoggedIn = login($login, $password, $area);
          if ($clientLoggedIn) {
              $_SESSION['clientLoggedIn'] = $clientLoggedIn;
              // Hier Skin [U18|O18] setzen ja nach GebDat
              $alter = $clientLoggedIn->geburtsdatum;
              if (time()<strtotime($alter." +18 years")) {
                  $_SESSION['hmskin'] = "U18";
                  setcookie("hmskin","U18",time()+60*60*24*30,"/");
              } else {
                  $_SESSION['hmskin'] = "O18";
                  setcookie("hmskin","O18",time()+60*60*24*30,"/");
              }
          } else {
              $loginfailed = true;
          }
      }
  }

