Gecko [ v3.cesa.co.za ]

Name	Size	Permission	Date
_notes	[ DIR ]	drwxr-sr-x	2022-12-20 11:09
_vti_cnf	[ DIR ]	drwxr-sr-x	2022-12-20 11:09
certificate	[ DIR ]	drwxr-sr-x	2023-03-22 11:22
includes	[ DIR ]	drwxr-sr-x	2026-08-24 10:12
mail_interface	[ DIR ]	drwxr-sr-x	2025-06-14 09:47
security	[ DIR ]	drwxr-sr-x	2023-09-17 08:02
temp	[ DIR ]	drwxr-sr-x	2026-04-18 22:25
templates	[ DIR ]	drwxr-sr-x	2026-05-25 12:12
tests	[ DIR ]	drwxr-sr-x	2025-07-07 15:54
CaptchaSecurityImages.php	2.26 KB	-rw-r--r--	2022-12-20 11:09
Inc_calendarnew.php	8.59 KB	-rw-r--r--	2017-11-20 10:34
accredcourses.php	7.04 KB	-rw-r--r--	2023-08-22 10:55
adecquestionnaire.php	26.54 KB	-rw-r--r--	2025-08-01 10:38
advisory.php	7.21 KB	-rw-r--r--	2022-12-20 11:09
advisory_full.php	1.31 KB	-rw-r--r--	2022-12-20 11:09
annualdeclaration.php	15.28 KB	-rw-r--r--	2026-01-22 10:25
awardsentry.php	14.55 KB	-rw-r--r--	2025-08-01 10:38
awardsentry.php.bak	11.22 KB	-rw-r--r--	2016-04-13 12:45
bookdetail.php	954 B	-rw-r--r--	2022-12-20 11:09
books.php	4.4 KB	-rw-r--r--	2023-05-16 13:08
branchdocuments.php	1.14 KB	-rw-r--r--	2022-12-20 11:09
branches.php	2.82 KB	-rw-r--r--	2025-08-06 12:54
calendarpdf.php	1.75 KB	-rw-r--r--	2025-08-26 16:52
cceregister.php	55.59 KB	-rw-r--r--	2026-08-14 12:05
ccmregister.php	71.57 KB	-rw-r--r--	2022-12-20 11:09
class.phpmailer.php	44.39 KB	-rw-r--r--	2022-12-20 11:09
class.smtp.php	32.74 KB	-rw-r--r--	2022-12-20 11:09
committeedocs.php	932 B	-rw-r--r--	2022-12-20 11:09
committees.php	2.69 KB	-rw-r--r--	2025-08-06 12:58
cpdapply.php	5.73 KB	-rw-r--r--	2022-12-20 11:09
cpdapplyform.php	34.06 KB	-rw-r--r--	2025-08-01 10:38
cpdproviderapply.php	42.09 KB	-rw-r--r--	2026-02-10 10:10
cpdproviderportal.php	79.47 KB	-rw-r--r--	2025-09-08 07:23
cpdspverify.php	4.27 KB	-rw-r--r--	2025-10-10 10:45
cpdtmverify.php	4.45 KB	-rw-r--r--	2023-06-19 13:44
declineeventreg.php	3.73 KB	-rw-r--r--	2022-12-20 11:09
directorybooking.php	7.39 KB	-rw-r--r--	2022-12-20 11:09
downloadPN.php	385 B	-rw-r--r--	2025-06-26 13:02
downloadfile.php	280 B	-rw-r--r--	2025-08-01 10:38
enews.php	1.33 KB	-rw-r--r--	2022-12-20 11:09
enewsarchive.php	1.09 KB	-rw-r--r--	2022-12-20 11:09
event.php	12.39 KB	-rw-r--r--	2026-08-19 12:22
event_allvenues.php	18.93 KB	-rw-r--r--	2026-08-09 11:44
eventdecline_awards.php	11.79 KB	-rw-r--r--	2022-12-20 11:09
eventregister.php	26.85 KB	-rw-r--r--	2026-02-10 07:56
eventregister_awards.php	19.4 KB	-rw-r--r--	2025-06-20 06:38
eventregister_golf.php	28.83 KB	-rw-r--r--	2025-08-19 08:12
eventtables.php	24.13 KB	-rw-r--r--	2023-06-01 09:51
eventtables.php.bak	3.49 KB	-rw-r--r--	2022-12-20 11:09
fidicgama2018.php	1012 B	-rw-r--r--	2022-12-20 11:09
forum.php	3.25 KB	-rw-r--r--	2022-12-20 11:09
getoffices.php	799 B	-rw-r--r--	2022-12-20 11:09
hrforumsubscribe.php	2.62 KB	-rw-r--r--	2022-12-20 11:09
hrforumunsubscribe.php	1.32 KB	-rw-r--r--	2022-12-20 11:09
inc_calendarnew.php	10.56 KB	-rw-r--r--	2025-08-21 10:11
inc_captcha.php	337 B	-rw-r--r--	2022-12-20 11:09
inc_db.php	12.33 KB	-rw-r--r--	2025-06-18 12:05
inc_php7.php	6 KB	-rw-r--r--	2025-07-07 12:51
inc_practicenoteslist.php	4.1 KB	-rw-r--r--	2024-07-03 13:52
inc_scecalendar.php	8.55 KB	-rw-r--r--	2025-06-13 08:57
inc_scecalendar_backup.php	6.66 KB	-rw-r--r--	2022-12-20 11:09
inc_scecalendarnew.php	7.84 KB	-rw-r--r--	2026-05-09 09:39
jobshadowschools.php	7.26 KB	-rw-r--r--	2025-06-20 06:38
logout.php	593 B	-rw-r--r--	2025-02-25 08:19
marketingevent.php	122.75 KB	-rw-r--r--	2026-08-03 13:40
marketingeventdecline.php	15.21 KB	-rw-r--r--	2022-12-20 11:09
marketingsurvey.php	5.95 KB	-rw-r--r--	2022-12-20 11:09
matrixtemplate.htm	2.13 KB	-rw-r--r--	2022-12-20 11:09
member_portal_becs.php	2.14 KB	-rw-r--r--	2025-09-12 07:50
member_portal_transformation.php	10.45 KB	-rw-r--r--	2026-05-20 10:07
member_portal_transformation_proxy.php	538 B	-rw-r--r--	2026-05-20 09:08
memberauth.php	991 B	-rw-r--r--	2025-02-25 08:19
memberportal.php	11.79 KB	-rw-r--r--	2026-05-20 09:54
membersearch.php	22.72 KB	-rw-r--r--	2025-02-27 08:02
membersearch_smme.php	6.2 KB	-rw-r--r--	2024-11-27 11:41
memberverify.php	5.25 KB	-rw-r--r--	2022-12-20 11:09
mentors.php	21.68 KB	-rw-r--r--	2025-06-20 06:38
migratenode.php	1.26 KB	-rw-r--r--	2022-12-20 11:09
monofont.ttf	40.07 KB	-rw-r--r--	2022-12-20 11:09
nlc.php	855 B	-rw-r--r--	2022-12-20 11:09
nlcreports.php	2.51 KB	-rw-r--r--	2022-12-20 11:09
php_errors.log	1.06 KB	-rw-r--r--	2026-08-20 23:37
practicenotes.php	4.63 KB	-rw-r--r--	2022-12-20 11:09
practicenotes_full.php	1.33 KB	-rw-r--r--	2022-12-20 11:09
practicenotes_help.php	2.17 KB	-rw-r--r--	2022-12-20 11:09
practicenotes_list.php	2.03 KB	-rw-r--r--	2024-07-03 13:52
practicenotes_search.php	9.43 KB	-rw-r--r--	2022-12-20 11:09
querynlcmatrix.php	15 KB	-rw-r--r--	2022-12-20 11:09
querynlcmatrix.php4	15.38 KB	-rw-r--r--	2012-03-05 08:01
register.php	58.18 KB	-rw-r--r--	2026-05-26 14:55
relay.php	20.33 KB	-rw-r--r--	2025-06-20 06:38
relayteams.php	12.53 KB	-rw-r--r--	2022-12-20 11:09
resendcpdform.php	7.28 KB	-rw-r--r--	2025-08-01 10:38
retiredeng.php	13.45 KB	-rw-r--r--	2025-06-20 06:38
retiredeng_members.php	1.81 KB	-rw-r--r--	2022-12-20 11:09
sanitize.php	10 B	-rw-r--r--	2022-12-20 11:09
sce_survey2015.php	25.85 KB	-rw-r--r--	2022-12-20 11:09
sceallevents.php	8.13 KB	-rw-r--r--	2026-01-20 08:45
scecalendar.php	4.86 KB	-rw-r--r--	2025-06-18 11:18
scecalendar_backup.php	3.17 KB	-rw-r--r--	2025-06-18 11:18
scecalendarnew.php	5.98 KB	-rw-r--r--	2025-08-28 11:14
scecalendarnewtest.php	5.7 KB	-rw-r--r--	2022-03-04 12:37
scecalendartest.php	3.57 KB	-rw-r--r--	2022-03-04 12:38
scecategories.php	914 B	-rw-r--r--	2022-12-20 11:09
scecourses.php	7.18 KB	-rw-r--r--	2026-08-19 12:15
scelist.php	7.72 KB	-rw-r--r--	2025-08-29 07:18
scesubscribe.php	2.06 KB	-rw-r--r--	2022-12-20 11:09
sceupdate.php	1.67 KB	-rw-r--r--	2025-06-18 11:18
scevenuehire.php	6.15 KB	-rw-r--r--	2026-01-23 13:12
sendeventreg.php	19.5 KB	-rw-r--r--	2026-08-14 12:05
sendeventreg2.php	2.83 KB	-rw-r--r--	2026-07-17 14:57
sendeventreg_golf.php	20.23 KB	-rw-r--r--	2026-08-14 12:05
sendeventreg_golf.php.bak	11.69 KB	-rw-r--r--	2016-09-07 09:48
sendreg.php	35.15 KB	-rw-r--r--	2026-08-14 12:05
smsunsub.php	1.89 KB	-rw-r--r--	2025-06-18 11:18
template.php	54.36 KB	-rw-r--r--	2022-12-20 11:09
tenders.php	1.34 KB	-rw-r--r--	2022-12-20 11:09
trainerportal.php	50.27 KB	-rw-r--r--	2025-08-01 11:06
trainerportal.php.bak	2.57 KB	-rw-r--r--	2022-12-20 11:09
unempgrad_members.php	2.38 KB	-rw-r--r--	2025-06-18 11:18
unemployed.php	14.13 KB	-rw-r--r--	2025-06-20 06:38
unemployedreg.php	23.38 KB	-rw-r--r--	2025-06-20 06:38
unempreg_members.php	2.36 KB	-rw-r--r--	2025-06-18 11:18
ypfbranchcommittee.php	1.63 KB	-rw-r--r--	2022-12-20 11:09
ypfcommittees.php	1.57 KB	-rw-r--r--	2022-12-20 11:09
ypfjoin.php	30.29 KB	-rw-r--r--	2025-07-07 15:53
ypfjoin2.php	28.13 KB	-rw-r--r--	2025-06-18 11:18
ypfjoinmatches.php	9.46 KB	-rw-r--r--	2025-06-18 11:18
ypfmentees.php	20.81 KB	-rw-r--r--	2026-08-24 11:52
ypfmentees_members.php	2.42 KB	-rw-r--r--	2025-06-18 11:18

Rename

<?php
// ini_set('display_errors', 1);
// error_reporting(E_ALL);

if (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on') {
    // Force HTTPS
    $redirect = 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
    header('HTTP/1.1 301 Moved Permanently');
    header('Location: ' . $redirect);
    exit();
}

$sessid = session_id();
if (empty($sessid)) {
    session_start([
        'cookie_lifetime' => 86400,
    ]);
    $sessid = session_id();
}
$_COOKIE["PHPSESSID"] = $sessid;
include("inc_db.php");
include_once($_SERVER['DOCUMENT_ROOT'] . "/cesanet/inc_shared.php");
include_once($_SERVER['DOCUMENT_ROOT'] . '/php/includes/MemberPortalUrls.php');

if (!isset($_SESSION["CID"]) || empty($_SESSION["CID"])) {
    $bShowLoginForm = true;
    $bShowPinForm = false;
    if (isset($_POST["username"])) {
        if (empty($_POST["username"]) || empty($_POST["password"])) {
            echo "<p><b>ERROR: Please provide both your username and password</b></p>";
        } else {

$query = "SELECT id, contact_id, Contacts.ContactFirstName AS firstname,
                Contacts.ContactSurname AS lastname,
                Contacts.PreferredEmail AS email ,
                Contacts.ContactsID AS CID,
                Contacts.DocumentAccess AS docs,
                tblMemberFirms.FirmID, tblMemberFirms.MemberStatus
			FROM user_login join Contacts on (user_login.contact_id = Contacts.ContactsID)
			left JOIN (OfficeContacts JOIN tblMemberFirmOffices USING (OfficeID)
			JOIN tblMemberFirms USING (FirmID)) ON (Contacts.`ContactsID`=OfficeContacts.`ContactsID`)
			WHERE user_login.username = '" . addslashes($_POST["username"]) . "'
			    AND user_login.password='" . addslashes($_POST["password"]) . "'";

$result = mysqli_query($conni, $query);
            if ($row = mysqli_fetch_array($result)) {
                if (empty($row["FirmID"]) || !in_array($row["MemberStatus"], ['Member', 'Testing', 'Retired'])) {

// echo '<p>Please ignore debug info: ' . $query . '</p>';

echo "<p><b>ERROR: Invalid username or password. The member firm is no longer a current 
                        CESA member.</b></p>";
                } else {
                    $iCID = $row['contact_id'];
                    $sfirstname = $row["firstname"];
                    $slastname = $row["lastname"];
                    $semail = $row["email"];
                    $sdocumentaccess = $row["docs"];
                    $iFirmID = $row["FirmID"];
                    $bShowLoginForm = false;
                    $bShowPinForm = true;
                }
            } else {
                $db_drupal = mysqli_connect("sql10.cpt2.host-h.net", "saacea_5", "PC5QmRw8", "cesa_drupal");

$sql = "SELECT * 
                    FROM users 
                    WHERE name='" . addslashes($_POST["username"]) . "' 
                        AND pass='" . md5($_POST["password"]) . "'";
                //                echo $sql;
                $result = mysqli_query($db_drupal, $sql);
                if ($row = mysqli_fetch_array($result)) {
                    $iCID = 999999;
                    $sfirstname = $row["name"];
                    $slastname = "";
                    $semail = $row["mail"];
                    $sdocumentaccess = "n";

$bShowLoginForm = false;
                    $bShowPinForm = true;
                } else {
                    echo "<p><b>ERROR: Invalid username or password</b></p>";
                }
            }
            mysqli_free_result($result);
            if ($bShowPinForm && empty($semail)) {
                echo "<p><b>ERROR: There is no email address for this login in the CESA member database. Please contact general@cesa.co.za to resolve this.</b></p>";
                $bShowLoginForm = true;
                $bShowPinForm = false;
            }

if ($bShowPinForm) {
                $iPin = 0;
                if (isset($iFirmID) && !empty($iFirmID)) {
                    $sql = "SELECT PinCode FROM LoginPins JOIN OfficeContacts
					ON (LoginPins.ContactID=OfficeContacts.ContactsID)
					JOIN tblMemberFirmOffices USING (OfficeID)
					JOIN tblMemberFirms USING (FirmID)
					WHERE tblMemberFirms.FirmID=" . $iFirmID . "
					AND tblMemberFirms.MemberStatus='Member'
					AND DateSent>='" . date("Y-m-d", strtotime("-6 months")) . "'
					ORDER BY DateSent desc";
                    $recPastPins = mysqli_query($conni, $sql);
                    if ($rowPastPins = mysqli_fetch_assoc($recPastPins)) {
                        $iPin = $rowPastPins["PinCode"];
                    }
                }
                if (empty($iPin)) {
                    $sql = "SELECT PinCode FROM LoginPins WHERE ContactID=" . $iCID . " AND DateSent>='" . date("Y-m-d", strtotime("-6 months")) . "' ORDER BY DateSent desc";
                    $recPastPins = mysqli_query($conni, $sql);
                    if ($rowPastPins = mysqli_fetch_assoc($recPastPins)) {
                        $iPin = $rowPastPins["PinCode"];
                    }
                }
                if (empty($iPin)) {
                    $iPin = rand(1000, 9999);
                }
                $sql = "INSERT INTO LoginPins (ContactID, EmailAddress, PinCode, FirstName, LastName, DocAccess)
				VALUES (" . $iCID . ", '" . addslashes($semail) . "', " . $iPin . ", '" . addslashes($sfirstname) . "',
				'" . addslashes($slastname) . "', '" . addslashes($sdocumentaccess) . "')";
                mysqli_query($conni, $sql);

$pinMessage = "A login has been initiated on the CESA Member Portal 
                    using your details.

Please enter the following PIN to login: " . $iPin . "

No access to the member portal is granted until the PIN above has been entered.
If you did not initiate this login, please contact CESA at general@cesa.co.za and request a new password.

Regards,

Consulting Engineers South Africa
www.cesa.co.za";

maill(
                    $semail, 
                    "CESA Website Login PIN", 
                    $pinMessage, 
                    null, 
                    [
                        'reply-to-address' => 'general@cesa.co.za',
                        'from-name' => 'CESA Member Portal'
                    ]
                );
            }
        }
    } elseif (isset($_POST["PinCode"])) {
        $bShowLoginForm = false;
        $bShowPinForm = true;
        $iCID = $_POST["CID"];
        $sql = "SELECT * FROM LoginPins WHERE ContactID=" . intval($_POST["CID"]) . " ORDER BY DateSent DESC";
        $result = mysqli_query($conni, $sql);
        if ($row = mysqli_fetch_array($result)) {
            if ($row["PinCode"] == intval($_POST["PinCode"])) {
                $_SESSION["CID"] = $row['ContactID'];
                $_SESSION["firstname"] = $row["FirstName"];
                $_SESSION["lastname"] = $row["LastName"];
                $_SESSION["email"] = $row["EmailAddress"];
                $_SESSION["documentaccess"] = $row["DocAccess"];

$sql = "UPDATE user_login SET sessionid='" . $sessid . "', lastlogin='" . date("Y-m-d H:i:s") . "' WHERE contact_id=" . $row["ContactID"];

// echo 'Please ignore debug info: ' . $sql . '<br />';

mysqli_query($conni, $sql);
                $bShowLoginForm = false;
                $bShowPinForm = false;
            } else {
                echo "<p><b>ERROR: Invalid PIN</b></p>";
            }
        }
    }

if ($bShowLoginForm) {
?>
        <h1>Member Login</h1>
        <form method="post" action="">Username:
            <input type="text" placeholder="Required" required="required" name="username" />
            Password:
            <input type="password" required="required" name="password" />
            <input type="submit" value="Login" />
        </form>
        <?php
    }

if ($bShowPinForm) {
        $sql = "SELECT PinCode, PinID FROM LoginPins WHERE ContactID=" . $iCID . " ORDER BY DateSent DESC";
        $result = mysqli_query($conni, $sql);
        if ($result && $row = mysqli_fetch_array($result)) {
            $iPinID = $row["PinID"];
            $iPinCode = $row["PinCode"];
        ?>
            <h1>Member Login</h1>
            <p><b>A 4-digit PIN has been emailed to: <?php echo $semail; ?>. Please enter the PIN below to login.</b></p>
            <p>Note: only the most recent PIN sent will be accepted. To request a new PIN, please initiate a new <a href="/login/"><u>login</u></a></p>.
            <form method="post" action="">
                <input type="hidden" name="CID" value="<?php echo $iCID; ?>">
                Your PIN:
                <input type="text" placeholder="XXXX" required="required" name="PinCode" />
                <input type="submit" value="Login" />
            </form>
        <?php
        }
    }
}

if (isset($_SESSION["CID"]) && !empty($_SESSION["CID"])) {

if (isset($_GET["page"]) && $_GET["page"] == "becs") {
        include_once($_SERVER['DOCUMENT_ROOT'] . '/php/member_portal_becs.php');
    } elseif (isset($_GET["page"]) && $_GET["page"] == "transformation") {
        header('Location: ' . member_portal_transformation_page_path(), true, 302);
        exit;
    } else {

echo "<h2>Welcome " . $_SESSION["firstname"] . " " . $_SESSION["lastname"] . "</h2>";

?>
        <h2>Member Menu:</h2>
        <ul>
            <li><a href="/ce-news">CE-news</a></li>
            <li><a href="https://www.cesa.co.za/Directory2019/index.html" target="_blank">Directory of Firms</a></li>
            <li><a href="/member-documents">Member Documents</a></li>
            <li><a href="/the-cesa-scheme-for-new-members/" target="_blank">Member Benefits: Aon CESA Professional Indemnity product</a></li>
            <?php
            $pathOnly = strtok($_SERVER['REQUEST_URI'] ?? '/login/', '?');
            if ($pathOnly === '' || $pathOnly === '/') {
                $pathOnly = '/login/';
            }
            $mpTransHref = member_portal_transformation_page_path();
            if ($env == 'dev') {
            ?>
                <li><a href="/php/annualdeclaration.php">Annual Declaration</a></li>
                <li><a href="<?php echo htmlspecialchars($mpTransHref); ?>">Transformation declaration (online)</a></li>
                <li><a href="/presentations">Presentations</a></li>
                <li><a href="/practice-notes">Practice Notes</a></li>
                <li><a href="<?php echo htmlspecialchars($pathOnly . '?page=becs'); ?>">Latest Bi-Annual Economic and Capacity Report</a></li>
            <?php
            } elseif (true || $_SESSION["CID"] < 999999) {
            ?>
                <li><a href="/cesa-annual-declaration">Annual Declaration</a></li>
                <li><a href="<?php echo htmlspecialchars($mpTransHref); ?>">Transformation declaration (online)</a></li>
                <li><a href="/presentations">Presentations</a></li>
                <li><a href="/practice-notes">Practice Notes</a></li>
                <li><a href="/members-becs-reports">Latest Bi-Annual Economic and Capacity Report</a></li>
            <?php
            }
            ?>
            
            <li><a href="/smmesearch/">SMME Member Firm Search</a></li>
            <li><a href="/unemployed-engineering-practitioners-2/">Unemployed Engineering Practitioners</a></li>
            <li><a href="/retired-engineers-list">Retired Engineers</a></li>
            <li><a href="/ypf-mentees-list">YPF Looking for Mentorship</a></li>
            <li><a href="/logout">Logout</a></li>
        </ul>
<?php
    }
}

include_once($_SERVER['DOCUMENT_ROOT'] . '/php/templates/inc_footer.php');