<?php
	require_once('/var/www/portal/auth.php');

	if ($authenticated)
		header('Location: /portal/list.php?module=opp');

	$title = 'Customer Portal - Exacq Technologies';
	$headerImg = '<img src="images/portal_header.png" alt="Exacq Customer Portal" width="900" height="100" />';
	$links = '<link href="/portal/css/dtjq.css" rel="stylesheet" type="text/css">
	<link href="/portal/css/jquery-ui-1.8.14.custom.css" rel="stylesheet" type="text/css">';
	
	require_once('/var/www/PHPwebsite/olde_header.php'); 
	require_once('/var/www/PHPwebsite/ExacqLibrary/CountriesAndStatesArrays.php');
?>
	<h1><strong>Customer Portal</strong></h1>
	<br />
	<form method="POST" action="login.php">
		<div class="update"></div>
		<div id="login_container">
		<?php
			// Display brute-force protection message first (takes priority)
			if (isset($_SESSION['brute_force_error'])) {
				echo '<div class="login_warning" style="background-color: #d32f2f; color: white; padding: 10px; margin-bottom: 15px; border-radius: 4px;">'.$_SESSION['brute_force_error'].'</div>';
				unset($_SESSION['brute_force_error']);
			} else if (isset($_REQUEST['failed'])) {
				echo '<div class="login_warning">'.$warnings['invalid_login'].'</div>';
			} 

			// check to make sure username and password exist
			if (isset($_POST["login"], $_POST["password"])) {
				// TODO: no idea what this is; please advise
				// Make sure the token from the login form is the same as in the cookie
				if (isset($_POST["CSRFtoken"], $_COOKIE["CSRFtoken"])){
					if ($_POST["CSRFtoken"] == $_COOKIE["CSRFtoken"]){
						// code for checking the user and password
					}
				}
			} else {
				$token = bin2hex(openssl_random_pseudo_bytes(16));
				setcookie("CSRFtoken", $token, time() + 60 * 60 * 24);
				echo '
				<label class="loginform">Email Address:</label> <input class="login-input" type="text" name="login"  /><br /><br />
				<label class="loginform">Password:</label> <input class="login-input" type="password" name="password" /><br /><br />
				<input name="CSRFtoken" type="hidden" value="' . $token . '">
				<br />
				<a style="color: #007AC3;" href="/portal/wtfpass.php">Forgot Your Password?</a>
				<br /><br />
				<button id="login" type="submit">Log In</button>
				';
			}
			
			if (isset($_REQUEST['source'])) {
				$apos = strpos($_REQUEST['source'],"'");
				if ($apos)
					$_REQUEST['source'] = substr($_REQUEST['source'],0,$apos);
				echo '<input type="hidden" name="source" value="'.htmlentities(strip_tags($_REQUEST['source'])).'" />';
			}
			
			if (isset($_REQUEST['trackingcode'])) {
				echo '<input type="hidden" name="trackingcode" value="'.htmlentities($_REQUEST['trackingcode']).'" />';
			}
		?>
		</form>
	</div>
<?php
	include('/var/www/PHPwebsite/footer.php');
?>
<script type="text/javascript">
	$(document).ready(function() {
		$("#login").button();
	});
</script>
