Your IP : 216.73.217.79

Current Path : /var/www/cesa.co.za/members/inc/
Upload File :
Current File : /var/www/cesa.co.za/members/inc/auth.inc

<?php

// server should keep session data for AT LEAST 1 hour
ini_set('session.gc_maxlifetime', 3600);

// each client should remember their session id for EXACTLY 1 hour
session_set_cookie_params(3600);

session_start();

$authorized = 1;
$auth = "valid";

include_once($_SERVER['DOCUMENT_ROOT'] . "/php/inc_php7.php");

/*
  if (isset($_REQUEST["PHPSESSID"])) {
  $sessid = $_REQUEST["PHPSESSID"];
  echo $sessid;
  $_COOKIE["PHPSESSID"] = $sessid;
  echo $_COOKIE["PHPSESSID"];
  session_id($sessid);
  }
 */
//	echo $_COOKIE["PHPSESSID"];

include_once($_SERVER['DOCUMENT_ROOT'] . '/cfg/config.php');
include_once($_SERVER['DOCUMENT_ROOT'] . '/echasl23/ewcfg7.php');

$server = EW_CONN_HOST;
$user = EW_CONN_USER;
$pass = EW_CONN_PASS;
$db = EW_CONN_DB;

$conxan = mysql_connect($server, $user, $pass);
mysql_select_db($db, $conxan);

extract($_REQUEST);

$bAuthed = false;
if (!empty($_GET["u"])) {
    $query = "SELECT DISTINCT user_login.contact_id, tblMemberFirms.FirmID, user_login.username
	FROM user_login, OfficeContacts, tblMemberFirmOffices, tblMemberFirms
	WHERE user_login.contact_id=OfficeContacts.ContactsID
        AND OfficeContacts.OfficeID=tblMemberFirmOffices.OfficeID
        AND tblMemberFirmOffices.FirmID=tblMemberFirms.FirmID
        AND MD5(user_login.username) = '" . $_GET["u"] . "'";
    //echo 'Please ignore debug info: ' . $query . '<br />';
    // exit;
    $result = mysql_query($query) or die($query);
    if ($row = mysql_fetch_array($result)) {
        $CID = $row['contact_id'];
        $MemberFirmID = $row["FirmID"];
        $_SESSION["CID"] = $CID;
        $_SESSION["username"] = $row['username'];
        $bAuthed = true;
    } else {
        $bAuthed = false;
    }
} elseif (!empty($_GET["appid"])) {
    $query = "SELECT ApplicationID, Prev_FirmID FROM Applications WHERE MD5(ApplicationID)= '" . $_GET["appid"] . "'";
    // echo 'Please ignore debug info: ' . $query . '<br />';
    // exit;
    $result = mysql_query($query) or die($query);
    if ($row = mysql_fetch_array($result)) {
        $AppID = $row['ApplicationID'];
        $MemberFirmID = $row["FirmID"];
        $_SESSION["AppID"] = $AppID;
        $bAuthed = true;
    } else {
        $bAuthed = false;
    }
} elseif (isset($_SESSION["CID"]) && !empty($_SESSION["CID"])) {
    $bAuthed = true;
    $query = "SELECT DISTINCT user_login.contact_id, tblMemberFirms.FirmID, user_login.username
	FROM user_login, OfficeContacts, tblMemberFirmOffices, tblMemberFirms
	WHERE user_login.contact_id=OfficeContacts.ContactsID
        AND OfficeContacts.OfficeID=tblMemberFirmOffices.OfficeID
        AND tblMemberFirmOffices.FirmID=tblMemberFirms.FirmID
        AND user_login.contact_id = '" . $_SESSION["CID"] . "'";
    // echo 'Please ignore debug info: ' . $query . '<br />';
    // exit;
    $result = mysql_query($query) or die($query);
    if ($row = mysql_fetch_array($result)) {
        $CID = $row['contact_id'];
        $MemberFirmID = $row["FirmID"];
        $_SESSION["CID"] = $CID;
        $_SESSION["username"] = $row['username'];
        $bAuthed = true;
    }
} elseif (isset($_SESSION["username"]) && !empty($_SESSION["username"])) {
    $bAuthed = true;
} elseif (defined("EW_SESSION_USER_NAME") && isset($_SESSION[EW_SESSION_USER_NAME]) && strlen($_SESSION[EW_SESSION_USER_NAME]) > 0) {
    $bAuthed = true;
}

if (!$bAuthed) {
    die("Not authorised");
}

function GetCID() {
    return $_SESSION["CID"];
}

function GetAppID() {
    return $_SESSION["AppID"];
}