Your IP : 216.73.217.79
<?php
// ini_set('display_errors', 1);
// error_reporting(E_ALL);
if (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on') {
// Force HTTPS
$redirect = 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
header('HTTP/1.1 301 Moved Permanently');
header('Location: ' . $redirect);
exit();
}
$sessid = session_id();
if (empty($sessid)) {
session_start([
'cookie_lifetime' => 86400,
]);
$sessid = session_id();
}
$_COOKIE["PHPSESSID"] = $sessid;
include("inc_db.php");
include_once($_SERVER['DOCUMENT_ROOT'] . "/cesanet/inc_shared.php");
include_once($_SERVER['DOCUMENT_ROOT'] . '/php/includes/MemberPortalUrls.php');
if (!isset($_SESSION["CID"]) || empty($_SESSION["CID"])) {
$bShowLoginForm = true;
$bShowPinForm = false;
if (isset($_POST["username"])) {
if (empty($_POST["username"]) || empty($_POST["password"])) {
echo "<p><b>ERROR: Please provide both your username and password</b></p>";
} else {
$query = "SELECT id, contact_id, Contacts.ContactFirstName AS firstname,
Contacts.ContactSurname AS lastname,
Contacts.PreferredEmail AS email ,
Contacts.ContactsID AS CID,
Contacts.DocumentAccess AS docs,
tblMemberFirms.FirmID, tblMemberFirms.MemberStatus
FROM user_login join Contacts on (user_login.contact_id = Contacts.ContactsID)
left JOIN (OfficeContacts JOIN tblMemberFirmOffices USING (OfficeID)
JOIN tblMemberFirms USING (FirmID)) ON (Contacts.`ContactsID`=OfficeContacts.`ContactsID`)
WHERE user_login.username = '" . addslashes($_POST["username"]) . "'
AND user_login.password='" . addslashes($_POST["password"]) . "'";
$result = mysqli_query($conni, $query);
if ($row = mysqli_fetch_array($result)) {
if (empty($row["FirmID"]) || !in_array($row["MemberStatus"], ['Member', 'Testing', 'Retired'])) {
// echo '<p>Please ignore debug info: ' . $query . '</p>';
echo "<p><b>ERROR: Invalid username or password. The member firm is no longer a current
CESA member.</b></p>";
} else {
$iCID = $row['contact_id'];
$sfirstname = $row["firstname"];
$slastname = $row["lastname"];
$semail = $row["email"];
$sdocumentaccess = $row["docs"];
$iFirmID = $row["FirmID"];
$bShowLoginForm = false;
$bShowPinForm = true;
}
} else {
$db_drupal = mysqli_connect("sql10.cpt2.host-h.net", "saacea_5", "PC5QmRw8", "cesa_drupal");
$sql = "SELECT *
FROM users
WHERE name='" . addslashes($_POST["username"]) . "'
AND pass='" . md5($_POST["password"]) . "'";
// echo $sql;
$result = mysqli_query($db_drupal, $sql);
if ($row = mysqli_fetch_array($result)) {
$iCID = 999999;
$sfirstname = $row["name"];
$slastname = "";
$semail = $row["mail"];
$sdocumentaccess = "n";
$bShowLoginForm = false;
$bShowPinForm = true;
} else {
echo "<p><b>ERROR: Invalid username or password</b></p>";
}
}
mysqli_free_result($result);
if ($bShowPinForm && empty($semail)) {
echo "<p><b>ERROR: There is no email address for this login in the CESA member database. Please contact general@cesa.co.za to resolve this.</b></p>";
$bShowLoginForm = true;
$bShowPinForm = false;
}
if ($bShowPinForm) {
$iPin = 0;
if (isset($iFirmID) && !empty($iFirmID)) {
$sql = "SELECT PinCode FROM LoginPins JOIN OfficeContacts
ON (LoginPins.ContactID=OfficeContacts.ContactsID)
JOIN tblMemberFirmOffices USING (OfficeID)
JOIN tblMemberFirms USING (FirmID)
WHERE tblMemberFirms.FirmID=" . $iFirmID . "
AND tblMemberFirms.MemberStatus='Member'
AND DateSent>='" . date("Y-m-d", strtotime("-6 months")) . "'
ORDER BY DateSent desc";
$recPastPins = mysqli_query($conni, $sql);
if ($rowPastPins = mysqli_fetch_assoc($recPastPins)) {
$iPin = $rowPastPins["PinCode"];
}
}
if (empty($iPin)) {
$sql = "SELECT PinCode FROM LoginPins WHERE ContactID=" . $iCID . " AND DateSent>='" . date("Y-m-d", strtotime("-6 months")) . "' ORDER BY DateSent desc";
$recPastPins = mysqli_query($conni, $sql);
if ($rowPastPins = mysqli_fetch_assoc($recPastPins)) {
$iPin = $rowPastPins["PinCode"];
}
}
if (empty($iPin)) {
$iPin = rand(1000, 9999);
}
$sql = "INSERT INTO LoginPins (ContactID, EmailAddress, PinCode, FirstName, LastName, DocAccess)
VALUES (" . $iCID . ", '" . addslashes($semail) . "', " . $iPin . ", '" . addslashes($sfirstname) . "',
'" . addslashes($slastname) . "', '" . addslashes($sdocumentaccess) . "')";
mysqli_query($conni, $sql);
$pinMessage = "A login has been initiated on the CESA Member Portal
using your details.
Please enter the following PIN to login: " . $iPin . "
No access to the member portal is granted until the PIN above has been entered.
If you did not initiate this login, please contact CESA at general@cesa.co.za and request a new password.
Regards,
Consulting Engineers South Africa
www.cesa.co.za";
maill(
$semail,
"CESA Website Login PIN",
$pinMessage,
null,
[
'reply-to-address' => 'general@cesa.co.za',
'from-name' => 'CESA Member Portal'
]
);
}
}
} elseif (isset($_POST["PinCode"])) {
$bShowLoginForm = false;
$bShowPinForm = true;
$iCID = $_POST["CID"];
$sql = "SELECT * FROM LoginPins WHERE ContactID=" . intval($_POST["CID"]) . " ORDER BY DateSent DESC";
$result = mysqli_query($conni, $sql);
if ($row = mysqli_fetch_array($result)) {
if ($row["PinCode"] == intval($_POST["PinCode"])) {
$_SESSION["CID"] = $row['ContactID'];
$_SESSION["firstname"] = $row["FirstName"];
$_SESSION["lastname"] = $row["LastName"];
$_SESSION["email"] = $row["EmailAddress"];
$_SESSION["documentaccess"] = $row["DocAccess"];
$sql = "UPDATE user_login SET sessionid='" . $sessid . "', lastlogin='" . date("Y-m-d H:i:s") . "' WHERE contact_id=" . $row["ContactID"];
// echo 'Please ignore debug info: ' . $sql . '<br />';
mysqli_query($conni, $sql);
$bShowLoginForm = false;
$bShowPinForm = false;
} else {
echo "<p><b>ERROR: Invalid PIN</b></p>";
}
}
}
if ($bShowLoginForm) {
?>
<h1>Member Login</h1>
<form method="post" action="">Username:
<input type="text" placeholder="Required" required="required" name="username" />
Password:
<input type="password" required="required" name="password" />
<input type="submit" value="Login" />
</form>
<?php
}
if ($bShowPinForm) {
$sql = "SELECT PinCode, PinID FROM LoginPins WHERE ContactID=" . $iCID . " ORDER BY DateSent DESC";
$result = mysqli_query($conni, $sql);
if ($result && $row = mysqli_fetch_array($result)) {
$iPinID = $row["PinID"];
$iPinCode = $row["PinCode"];
?>
<h1>Member Login</h1>
<p><b>A 4-digit PIN has been emailed to: <?php echo $semail; ?>. Please enter the PIN below to login.</b></p>
<p>Note: only the most recent PIN sent will be accepted. To request a new PIN, please initiate a new <a href="/login/"><u>login</u></a></p>.
<form method="post" action="">
<input type="hidden" name="CID" value="<?php echo $iCID; ?>">
Your PIN:
<input type="text" placeholder="XXXX" required="required" name="PinCode" />
<input type="submit" value="Login" />
</form>
<?php
}
}
}
if (isset($_SESSION["CID"]) && !empty($_SESSION["CID"])) {
if (isset($_GET["page"]) && $_GET["page"] == "becs") {
include_once($_SERVER['DOCUMENT_ROOT'] . '/php/member_portal_becs.php');
} elseif (isset($_GET["page"]) && $_GET["page"] == "transformation") {
header('Location: ' . member_portal_transformation_page_path(), true, 302);
exit;
} else {
echo "<h2>Welcome " . $_SESSION["firstname"] . " " . $_SESSION["lastname"] . "</h2>";
?>
<h2>Member Menu:</h2>
<ul>
<li><a href="/ce-news">CE-news</a></li>
<li><a href="https://www.cesa.co.za/Directory2019/index.html" target="_blank">Directory of Firms</a></li>
<li><a href="/member-documents">Member Documents</a></li>
<li><a href="/the-cesa-scheme-for-new-members/" target="_blank">Member Benefits: Aon CESA Professional Indemnity product</a></li>
<?php
$pathOnly = strtok($_SERVER['REQUEST_URI'] ?? '/login/', '?');
if ($pathOnly === '' || $pathOnly === '/') {
$pathOnly = '/login/';
}
$mpTransHref = member_portal_transformation_page_path();
if ($env == 'dev') {
?>
<li><a href="/php/annualdeclaration.php">Annual Declaration</a></li>
<li><a href="<?php echo htmlspecialchars($mpTransHref); ?>">Transformation declaration (online)</a></li>
<li><a href="/presentations">Presentations</a></li>
<li><a href="/practice-notes">Practice Notes</a></li>
<li><a href="<?php echo htmlspecialchars($pathOnly . '?page=becs'); ?>">Latest Bi-Annual Economic and Capacity Report</a></li>
<?php
} elseif (true || $_SESSION["CID"] < 999999) {
?>
<li><a href="/cesa-annual-declaration">Annual Declaration</a></li>
<li><a href="<?php echo htmlspecialchars($mpTransHref); ?>">Transformation declaration (online)</a></li>
<li><a href="/presentations">Presentations</a></li>
<li><a href="/practice-notes">Practice Notes</a></li>
<li><a href="/members-becs-reports">Latest Bi-Annual Economic and Capacity Report</a></li>
<?php
}
?>
<!--<li><a href="/unemployed-graduates-list">Unemployed Graduates</a></li>-->
<li><a href="/smmesearch/">SMME Member Firm Search</a></li>
<li><a href="/unemployed-engineering-practitioners-2/">Unemployed Engineering Practitioners</a></li>
<li><a href="/retired-engineers-list">Retired Engineers</a></li>
<li><a href="/ypf-mentees-list">YPF Looking for Mentorship</a></li>
<li><a href="/logout">Logout</a></li>
</ul>
<?php
}
}
include_once($_SERVER['DOCUMENT_ROOT'] . '/php/templates/inc_footer.php');