<h3>Enter Login Information</h3>
% if ($err) {
<H4><%$err%></H4>
%}
<FORM ACTION="<%$r->uri%>" METHOD="POST" NAME="loginForm">
<INPUT TYPE="hidden" NAME="cmd" VALUE="login">
<INPUT TYPE="hidden" NAME="done" VALUE="<%$done|h%>">
<TABLE BORDER=0>
<TR>
    <TD>User Name</TD>
    <TD><INPUT TYPE="TEXT" NAME="user" VALUE="<%$user%>" size=15 MAXLENGTH=50></TD>
</TR>
<TR>
    <TD>Password</TD>
    <TD><INPUT TYPE="PASSWORD" NAME="pw" size=10 MAXLENGTH=30></TD>
</TR>
<TR>
    <TD COLSPAN=2><INPUT TYPE="submit" VALUE="Log On"></TD>
</TR>
</TABLE>
</FORM>
<h4>Note</h4>
<UL>
    <LI>Sessions Last for <%$session_time%> minutes.
    <LI>Administrator: If you are having login problems (Appears to accept password but still sends you back to the 
        login page) see the comments in <i>netdisco_apache.conf</i>.
</UL>
<!-- 
<% join("\n",join('=',each(%{$m->session}))) %>
<% $m->session->{logged_in} %>
<% $m->session->{user} %>
-->
<SCRIPT LANGUAGE="JavaScript"> 
<!--
    document.loginForm.user.focus();
//-->
</SCRIPT>
<%args>
$user => undef
$cmd  => undef
$pw   => undef
$done => undef
</%args>
<%shared>
my $userip    = $r->connection->remote_ip; 
</%shared>
<%init>

my $err = '';
my $secure = &is_secure;
my $session_time = $netdisco::CONFIG{websession} || 60;

# Force us to login via HTTPS if configured
if (!$secure){ 
    my $page   = $r->uri;
    my $args   = $r->args;
    my $url    = url_secure($page); 
    HTML::Mason::Escapes::url_escape(\$args) if $args;
    $url .= "?$args" if ($args);
    $m->redirect($url); 
}

if ($cmd eq 'login'){

    $user = lc($user);
    my $db_user = sql_hash('users',['*'],{'username' => $user});

    unless (defined $db_user->{username}){
        $err .= "User Not Found.\n";
    }

    my $md5_pw = Digest::MD5::md5_hex($pw);    
    
    unless ($err or $md5_pw eq $db_user->{password}){
        $err .= "Bad Login.\n";
    }

    if ($err) {
        $m->session->{_logged_in} = 0;

        # Log Failed Attempt
        insert_or_update('user_log',{},
                {'username'=>$user,'event'=>'login_failure',
                 'userip'=>$userip,'details'=>$err});

        delete $m->session->{user};
        delete $m->session->{user_port_ctl};
        delete $m->session->{user_admin};
        delete $m->session->{start};
    } else {
        $m->session->{_logged_in} = 1;
        $m->session->{user} = $db_user->{username};
        $m->session->{user_port_ctl} = $db_user->{port_control};
        $m->session->{user_admin}    = $db_user->{admin};
        $m->session->{start} = time;
        $r->connection->user($db_user->{username});

        # Update record
        insert_or_update('users',{'username' => $m->session->{user}},
                         {'last_on' => scalar(localtime)}
                        );

        # Log Login
        insert_or_update('user_log',{},
                {'username'=>$m->session->{user},'event'=>'login',
                 'userip'=>$userip,'details'=>$done});

        # Redirect
        if (defined $done and length($done)) {
            $m->redirect("$done");
        } else {
            $m->redirect('.'); 
        }   
    }
    
}
</%init>
<%method title>
- Login \
</%method>
%# $Id: login.html,v 1.10 2004/09/26 19:40:41 maxbaker Exp $
%# vim:syntax=mason
