#!/usr/bin/perl
use DBI;
use Time::Local;
require 'cookie.lib';

#######
#Login.pl
#April 10th, 2003
#Questions/comment: heyworth@qualityofexecution.com
#######

#globals
#database information
$database="tands";
$databaseaddress="67.88.42.203";

#host address
$address="workhorse.qualityofexecution.com";

#define the cookie domain
SetCookieDomain('.qualityofexecution.com');

#global colors
$headercolor="dadaff";
$tickcolor="#EFEEa9";
$evencolor="dfdfdf";
$oddcolor="ffffff";

#connect to database
$dsn = "DBI:mysql:$database:$databaseaddress";
$dbh = DBI->connect($dsn,'qoeremote','qoe');

if ( !defined $dbh ){
	print "Content-type:text/html\n\n";
	print "<meta http-equiv='refresh' content='5; URL=http://www.qualityofexecution.com'>";
      print "<h1>Couldn't connect to DB!</h1>";
      exit;
}

#grab form contents
if ($ENV{'REQUEST_METHOD'} eq 'POST'){
	GetPostData();
}else{
	GetFormData();
}

#if already logged in, ignore and go to main page...
#check for valid token and cookie
if (($cid=validtoken())){
	#go to login main page...
	print "Content-type:text/html\nLocation: http://$address/controlpanel.pl\n\n";
}else{
	$username=$Cookies{'username'};
#	$password=$Cookies{'password'};
	if ($username ne ""){
		$remember="checked";
	}
}

#handle the input
if ($ENV{'REQUEST_METHOD'} eq 'POST'){
	ProcessLoginScreen();
}else{
	if($FORM{'mailpassword'} ne ""){
		MailPassword();
		GenerateLoginScreen(2);#sending password
	}else{
		GenerateLoginScreen();#general loginscreen
	}	
	#release resources
	$dbh->disconnect();	
}


sub ProcessLoginScreen(){    
    #make sure we have some data
    if (($username=$FORM{'username'}) eq ""){
	$username="BLANK";
    }

    #do the check...
    $SQL_QUERY="SELECT password,class,userid,clientid FROM user WHERE username='$username'";
	
    $cursor = $dbh->prepare( "$SQL_QUERY" );
    $cursor->execute;

    #grab information
	while (@row = $cursor->fetchrow){
          	$password=$row[0];	
	    	$class=$row[1];
		$userid=$row[2];
		$cid=$row[3];
	}

	$cursor->finish;

	#checkpassword...
	if ($password eq $FORM{'password'}){     		
		print "Content-type:text/html\n";
		$faketoken=int("$cid"."$userid".time%50000)+int(rand(10000));#generate real token here
		#token is good for the day...
		$expirationdate=time+43200; #1/2 day token
		($thissec,$thismin,$thishour,$thismday,$thismon,$thisyear,$thiswday,$thisyday,$thisisdst) = localtime($expirationdate);
		$thisyear+=1900;
		@day=("Sun","Mon","Tue","Wed","Thu","Fri","Sat");
		@mon=("Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec");
		$cookiedate=sprintf("%s, %02d-%s-%d %02d:%02d:%02d GMT",$day[$thiswday],$thismday,$mon[$thismon],$thisyear,$thishour,$thismin,$thissec);
		
		#print "\n$cookiedate";exit;

		SetCookieExpDate($cookiedate);
		SetCookies('token',"$faketoken",'userid',"$userid");

		if ($FORM{'remember'} == 1){#remember for the year
			&SetCookieExpDate('Wed, 31-Dec-$thisyear 00:00:00 GMT');
		}else{ #otherwise, erase...
			&SetCookieExpDate('Wed, 09-Apr-2003 00:00:01 GMT');				
		}

		SetCookies('username',"$username");#,'password',"$password");
		UpdateLogin($faketoken,$userid,$cid);
		GetCookies();
		
		$redirect=$FORM{'redirect'};

		if ($redirect ne ""){
			$redirect =~ s/%3F/?/g;
			$redirect =~ s/%3D/=/g;
			$redirect =~ s/%26/&/g;
			print "Location: $redirect\n\n";
		}else{
			#should actually link to the client's control panel page
			print "Location: http://$address/controlpanel.pl\n\n";
		}
		exit;
		#print "\n\n($clientid $userid $FORM{'remember'})<br> t:$Cookies{'token'}<br> u:$Cookies{'userid'}<br> p:$Cookies{'password'}<br> b:$Cookies{'username'}<br>";
    	}else{
		#print "Content-type:text/html\n\n";
		#print "$SQL_QUERY:<br>$username $FORM{'password'} $clientid $userid $class $password\n";	
		#exit;

		#password failure...
		GenerateLoginScreen(1);
    	}
}

sub GenerateLoginScreen(){
#$_[0] indicates error condition
#0 == no condition
#1 == Username/Password problem
#2 == mailing password

$redirect=$FORM{'redirect'};

#handle the login screen message
if ($_[0]==0){
	#no condition
	$ENV{'QUERY_STRING'}=~/redirect=(.*)/;
	$redirect=$1;
	#$message="<br>t:$Cookies{'token'}<br>id:$Cookies{'userid'}<br>u:$Cookies{'username'}<br>p:$Cookies{'password'}<br>a:$accesstime";
}elsif($_[0]==1){
	#login error
	$message="<font color=red><b>Login Error:</b></font><br>Problem with Username and/or Password</font>";
}elsif($_[0]==2){
	#mail password
	$message="<font color=red><b>Account Assistance:</b></font><br>We just mailed the password to your Administrator's email account.<br><br>If you have any further questions, please feel free to <a href='mailto:help\@qualityofexecution.com?subject=Password problems'>contact us</a>.</font>";
}

if ($redirect ne ""){
	$extratext="&redirect=$redirect";
}

#output the loginmethod
if ($FORM{'secure'} ne "yes"){
	$loginmethod="<b>Standard</b> | <a href='login.pl?secure=yes$extratext'>Secure</a>";
}else{
	$loginmethod="<a href='login.pl?secure=no$extratext'>Standard</a> | <b>Secure</b>";
}

print << "EOM";
Content-type:text/html

<HTML>
<HEAD>
<META HTTP-EQUIV="Expires" CONTENT="-1">
	<TITLE>Quality of Execution, LLC.</TITLE>
	<style type='text/css'> 
		TD,BODY,P {font-family: 'Arial,Helvetica'; font-size: 9pt}
		BODY {margin-top: 15pt;}
		.blacktbl { border : solid 1px #294994;}
		.footer {font-family: 'Arial,Helvetica'; font-size: 8pt}
	</style>
	<script language=javascript>
	function validate(entry){
		if (entry.username.value == ""){
			alert("Please enter your username!");
			entry.username.focus();
			return false;
		}else if (entry.password.value == ""){
			alert("Please enter your password!");
			entry.password.focus();	
			return false;
		}
		return true;
	}

	function mailpassword(){
		if (input.username.value == ""){
			alert("Please enter your username!");
			input.username.focus();
		}else{
			address="login.pl?mailpassword=" + input.username.value;
			window.location=address;
			}
		return false;
	}
	</script>
</HEAD>
<BODY background="http://www.qualityofexecution.com/bluebar-background.gif">

<!--header top-->
	<table cellpadding=0 cellspacing=1 border=0 width=790>
		<tr>
			<td valign=top height=52><a href="http://www.qualityofexecution.com"><IMG SRC="http://www.qualityofexecution.com/qoelogo.gif" BORDER="0" ALT="" WIDTH="148" HEIGHT="50"></a></td>
			<td width=10>&nbsp;</td>
			<td valign=bottom align=left>
				<table cellpadding=0 cellspacing=0 border=0>
					<tr><td colspan=4 valign=bottom>&nbsp;</td>
						<td valign=bottom><!--<a href="http://$address/login.pl">--><IMG SRC="http://www.qualityofexecution.com/login-nav.gif" ALT="If you are a client, click here to login." WIDTH="72" HEIGHT="8" border=0><!--</a>--></td>
						<td valign=bottom><a href="http://www.qualityofexecution.com/subscribe.html"><IMG SRC="http://www.qualityofexecution.com/subscribe-nav.gif" ALT="If you are interested in becoming a client, click here." WIDTH="132" HEIGHT="8" border=0></a></td>
						<td valign=bottom><a href="http://www.qualityofexecution.com/help.html"><IMG SRC="http://www.qualityofexecution.com/help-nav.gif" ALT="Need help?  Click here." WIDTH="82" HEIGHT="8" border=0></a></td>
					</tr>
					<tr>
						<td valign=bottom><a href="http://www.qualityofexecution.com/about.html"><IMG SRC="http://www.qualityofexecution.com/about-nav.gif" ALT="Learn more about Quality of Execution, LLC." WIDTH="78" HEIGHT="14" border=0></a></td>
						<td valign=bottom><a href="http://www.qualityofexecution.com/tradesentry.html"><IMG SRC="http://www.qualityofexecution.com/tradesentry-nav.gif" ALT="Learn more about our Trade Senty Product." WIDTH="99" HEIGHT="14" border=0></a></td>
						<td valign=bottom><a href="http://www.qualityofexecution.com/marketrank.html"><IMG SRC="http://www.qualityofexecution.com/marketrank-nav.gif" ALT="Learn more about our Market Rank Product." WIDTH="99" HEIGHT="14" border=0></a></td>
						<td valign=bottom><a href="http://www.qualityofexecution.com/samples.html"><IMG SRC="http://www.qualityofexecution.com/samples-nav.gif" ALT="Click here to view exception and data samples" WIDTH="66" HEIGHT="14" border=0></a></td>
						<td valign=bottom><a href="http://www.qualityofexecution.com/team.html"><IMG SRC="http://www.qualityofexecution.com/team-nav.gif" ALT="Click here to learn more about our management team" WIDTH="72" HEIGHT="14" border=0></a></td>
						<td valign=bottom><a href="http://www.qualityofexecution.com/multimedia.html"><IMG SRC="http://www.qualityofexecution.com/multimedia-nav.gif" ALT="Click here to view multimedia and press clippings" WIDTH="132" HEIGHT="14" border=0></a></td>
						<td valign=bottom><a href="http://www.qualityofexecution.com/contact.html"><IMG SRC="http://www.qualityofexecution.com/contact-nav.gif" ALT="Click here for contact information" WIDTH="82" HEIGHT="14" border=0></a></td>
				</table>
			</td>
		</tr>
		<tr>
		<td colspan=100%><IMG SRC="http://www.qualityofexecution.com/bluedot.gif" BORDER="0" WIDTH="790" HEIGHT="2"></td>
		</tr>
	</table>
<!--end header-->

<!--content-->
		<table cellpadding=0 cellspacing=0 border=0 WIDTH=790>
			<tr>
				<td valign=top colspan=3 height=10>&nbsp;</td>
			</tr>

			<tr>
			<td width=280 valign=top>
				<!--Login area-->
				<FORM ACTION="login.pl" METHOD='POST' name='input' onsubmit='return validate(this)'>
					<table cellpadding=3 cellspacing=0 class="blacktbl">
						<tr>
							<td height=15 width=280 colspan=2 bgcolor="#294994"><b><font color=white>Login</font></b></td>
						</tr>
						<tr>
							<td WIDTH=140>
								<font size=2 face=arial>Username</font><br>
								<input type=text size=15 name="username" value='$username'><br>
							</td>
							<td WIDTH=140>
								<font size=2 face=arial>Password</font><br>
								<input type=password size=15 name="password" value=''>
							</td>
						</tr>
						<tr>
							<td>
								<input type=checkbox name="remember" value=1 $remember><font size=1 face=arial>Remember Password?</font>
							</td>
							<td>
								<input type=submit value="Login"><input type=hidden name=redirect value="$redirect">
							</td>
						</tr>
						<tr>
							<td colspan=2>
								<hr color=294994>
								<font class=footer face=arial>
								Forget your password?<br>
								<a href="login.pl" onclick='return mailpassword();'>Click here and we'll mail you a new one</a><br>
								<br>
								Not a registered <b>Quality of Execution</b> user?<br>
								<a href="http://www.qualityofexecution.com/subscribe.html">Click here to learn how to become one</a>
								<br><br>
								Login Method:  $loginmethod</td>
								</font>
							</td>
						</tr>
					</table>
				</FORM>
				<br>
				$message
			</td>

			<td WIDTH=60 valign=center align=center><img SRC="http://www.qualityofexecution.com/bluedot.gif" height=400 width=1 border=0></td>

			<td WIDTH=450 valign=top>
				<p><b><font color=294994>Why do I need to login?</font></b><br>
				In order to take advantage of <b>Quality of Execution's</b> Internet-based queries, real-time analysis, and configuration screens, users need to authenticate themselves to us through the login procedure.

				<p><b><font color=294994>What if I forget my username and/or password?</font></b><br>
				If you forget your username and/or password, please <a href="mailto:help\@qualityofexecution.com?subject=Username/Password problem">contact us</a> and we will supply you with the information you need to get back online as quickly as possible.

				<p><b><font color=294994>What is the difference between the standard and secure login methods?</font></b><br>
				The standard login method transmits your password and username unencrypted over the Internet while secure mode encrypts it.  The authentication method you choose should conform with your company's data security policy.

				<p><b><font color=294994>How secure is our communication?</font></b><br>
				Once you have been authenticated in secure mode, all subsequent communication with <b>Quality of Execution</b> is protected by 128bit SSL encryption.<br>
				<br>A secure link is indicated by a padlock in the lower right hand corner of your browser window.<br>
				<br>If you don't see the lock upon logging in or have any further security questions, please feel free to <a href="mailto:help\@qualityofexecution.com?subject=Browser security">contact us</a>.
			</td>
		</tr>
	</table>

<!--content end-->

<!--footer-->
		<br>
		<table cellpadding=0 cellspacing=1 border=0 width=790>
		<tr>
			<td colspan=100%><IMG border=0 SRC="http://www.qualityofexecution.com/bluedot.gif" BORDER="0" ALT="" WIDTH="790" HEIGHT="2"></td>
		</tr>
		<tr>
			<td nowrap colspan=100% align=center><font class=footer><a href='mailto:info\@qualityofexecution.com?subject=Information'>  info\@qualityofexecution.com</a> | 212.757.6824 or 800.686.1608 | <a href="http://www.qualityofexecution.com/legal.html" target='_blank'>&copy; 2002 QualityofExecution, LLC.</a></font></td>
		</tr>
	</table>
<!--footer-->
	
	</BODY>
</HTML>
EOM

}

#######################
##                   ##
##                   ##
##                   ##
##                   ##
#######################

sub GetPostData(){
    if ($ENV{'REQUEST_METHOD'} eq 'POST') {

        read (STDIN,$buffer,$ENV{'CONTENT_LENGTH'});

	# split the name value pairs on '&'
        @pairs = split (/&/, $buffer);

	# go thru each pair and determine the name & value for
	# each form variable

        foreach $pair (@pairs) {
            ($name, $value) = split (/=/, $pair);
            $value =~ tr/+/ /;
            $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;

	    # check for evil characters
	    # if ($FORM(thing) !~ /^[a-zA-Z0-9_-+ \t\/@%]+$/) is
	    # true, then there are illegal characters...
	    if ($name =~ /email/){
		$value =~ s/[^a-zA-Z0-9\!\$\%\(\)\+\-\.\/\:\=\@\[\]\^\_]+//g ;
	    }

            $FORM{$name} = $value;
        }
        return (1);

    # now, all the form variables are in the @FORM
    # associative array.

    } else {
	return (0); # no post data...
	}
}

sub validtoken{
	if (GetCookies()) {
    		$SQL_QUERY="SELECT modifytime,clientid FROM token WHERE token=$Cookies{'token'}";
  	  	$cursor = $dbh->prepare( "$SQL_QUERY" );
    		$cursor->execute;

    		#grab information
		while (@row = $cursor->fetchrow){
          		$accesstime=$row[0];
			$client=$row[1];	
		}

		$cursor->finish;
		return $client;
	}
	return 0;
}

sub GetFormData(){
	#break the input string down
	@pairs =split(/&/,$ENV{'QUERY_STRING'});
	foreach $pair (@pairs){
		($name, $value) = split (/=/, $pair);
		$value =~ tr/+/ /;
        	$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
		$FORM{$name}=$value;
	}
}

sub UpdateLogin(){
    #update token
    $time=time;
    $addy="$ENV{'REMOTE_ADDR'}";
    $SQL_QUERY="INSERT INTO token VALUES(NULL,$_[0],\"$addy\",$_[1],$time,$time,$_[2])";
    $cursor = $dbh->do( "$SQL_QUERY" );

    #update user stats
    $SQL_QUERY="UPDATE user SET lastlogin=$time WHERE userid= $_[1]";
    $cursor = $dbh->do( "$SQL_QUERY" );
}

sub MailPassword(){
    #grab password
    $SQL_QUERY="SELECT password,clientid FROM user WHERE username='$FORM{'mailpassword'}'";
    
    $cursor = $dbh->prepare( "$SQL_QUERY" );
    $cursor->execute;

    #grab information
	while (@row = $cursor->fetchrow){
          	$p=$row[0];
		$c=$row[1];
	}

	$cursor->finish;

	#make sure that we are using a valid username
	if ($p eq ""){
		close(MP);
		return;
	}

	#grab recipients
    $SQL_QUERY="SELECT toadmin,ccadmin FROM recipient WHERE clientid=$c";
	
    $cursor = $dbh->prepare( "$SQL_QUERY" );
    $cursor->execute;

    #grab information
	while (@row = $cursor->fetchrow){
          	$toadmin=$row[0];
		$ccdamin=$row[1];
	}

	$cursor->finish;

#make sure that we are using a valid username
	if ($toadmin eq ""){
		close(MP);
		return;
	}

$u=$FORM{'mailpassword'};
$path="$u-password.mail";

open(MP,"> $path");

print MP << "EOM";
Sorry you were having difficulty with your username and password.

Username:	$FORM{'mailpassword'}
Password:	$p	

If you have any further questions, please feel free to contact us at: 
help\@qualityofexecution.com.

EOM

close(MP);

#needs the q to supress output...
system("blat $path -s \"Requested Information\" -t \"$toadmin\" -noh2 -q");
}