<?php

  /*
   *  Secure Login Plugin
   *  By Graham Norbury <gnorbury@bondcar.com>
   *  Changes by Paul Lesneiwski <pdontthink@angrynerds.com>
   *  v1.2 (c) 2002 (GNU GPL - see ../../COPYING)
   *
   *  This is a very simple plugin which enforces use of SSL security for logins.
   *
   *  If you need help with this, or see improvements that can be made, please
   *  email one or both of us directly at the addresses above.
   *
   */


   // include compatibility plugin
   //
   if (defined('SM_PATH'))
      include_once(SM_PATH . 'plugins/compatibility/functions.php');
   else if (file_exists('../plugins/compatibility/functions.php'))
      include_once('../plugins/compatibility/functions.php');
   else if (file_exists('./plugins/compatibility/functions.php'))
      include_once('./plugins/compatibility/functions.php');


   function secure_login_check_do()
   {

      global $secure_login_count, $plugin_secure_login_cameInUsingHttps,
             $allVirtualDomainsUnderOneSSLHost, $securePort;
      
      compatibility_sqextractGlobalVar('secure_login_count');
      if (!isset($secure_login_count))
      {
         $secure_login_count = 0;
         $secure_logoff_count = 0;
         compatibility_sqsession_register($secure_login_count, 'secure_login_count');
         compatibility_sqsession_register($secure_logoff_count, 'secure_logoff_count');
         compatibility_sqsession_unregister('plugin_secure_login_cameInUnencrypted');
      }

      // get global variables for versions of PHP < 4.1
      // 
      if (!compatibility_check_php_version(4, 1)) {
         global $HTTP_SERVER_VARS, $HTTP_GET_VARS;
         $_SERVER = $HTTP_SERVER_VARS;
         $_GET = $HTTP_GET_VARS;
      }

      if (compatibility_check_sm_version(1, 3))
         include_once (SM_PATH . 'plugins/secure_login/config.php');
      else
         include_once ('../plugins/secure_login/config.php');


      // debug functionality
      // 
$debug = 0;      
      if ($debug == 1)
      {  
         echo "<hr>";
         print_r($_SERVER);
         echo "<hr>";
         exit;
      }


      
      // grab port the user came in on
      //
      if (isset($_SERVER['SERVER_PORT']))
         $serverPort = $_SERVER['SERVER_PORT'];
      else
         $serverPort = 0;



      // figure out what port we should be comparing
      //
      if (isset($securePort))
         $targetHttpsPort = $securePort;
      else
         $targetHttpsPort = '443';



      // Redirect browser to use https:// if the initial request was insecure
      //
// old way:
//      if ( ! isset($_SERVER['HTTPS']) &&
//           $secure_login_count == 0)
      if ( $serverPort != $targetHttpsPort &&
           $secure_login_count == 0)
      {  

         $secure_login_count++;
         compatibility_sqsession_register($secure_login_count, 'secure_login_count');
         
         $requestHost = $_SERVER['HTTP_HOST'];
         
         if (isset($securePort))
         {
            if (!empty($securePort))
               $securePort = ':' . $securePort;
            
            list($host, $port) = preg_split('/:/', $requestHost);
            $newRequestHost = $host . $securePort;
         }
         else
            $newRequestHost = $requestHost;
          
            
         $pathURI = $_SERVER['REQUEST_URI'];
         $paramsURI = '';
         if (preg_match('/(.*)\?(.*)/', $_SERVER['REQUEST_URI'], $matches))
         {
            if (isset($matches[1])) $pathURI = $matches[1];
            if (isset($matches[2])) $paramsURI = $matches[2];
         }


         $location = 'https://' 
                   . $newRequestHost . $pathURI . '?secure_login=yes';
         
         if (!empty($allVirtualDomainsUnderOneSSLHost))
            $location = 'https://' . $allVirtualDomainsUnderOneSSLHost  
                      . $newRequestHost . $pathURI . '?secure_login=yes';
         
         if (!empty($paramsURI))
            $location = $location . '&' . $paramsURI;

         header("Location: $location");
         exit();

      }
// old way
//      else if (isset($_SERVER['HTTPS'])) 
      else if ( $serverPort == $targetHttpsPort )
      {

         if (isset($_GET['secure_login']))
         {
            $plugin_secure_login_cameInUnencrypted = 'yes';
            compatibility_sqsession_register($plugin_secure_login_cameInUnencrypted, 
                                             'plugin_secure_login_cameInUnencrypted');
         }
         elseif (!empty($allVirtualDomainsUnderOneSSLHost) && !$secure_login_count)
         {
            $secure_login_count++;
            compatibility_sqsession_register($secure_login_count, 'secure_login_count');

            $location = 'https://' . $allVirtualDomainsUnderOneSSLHost
                      . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];

            header("Location: $location");
            exit();

         }
      }
   }


   // after login, go back to http protocol
   //
   function secure_login_logout_do()
   {

      global $change_back_to_http_after_login, $securePort,
             $remain_in_https_if_logged_in_using_https,
             $plugin_secure_login_cameInUnencrypted;

      if (compatibility_check_sm_version(1, 3))
         include_once (SM_PATH . 'plugins/secure_login/config.php');
      else
         include_once ('../plugins/secure_login/config.php');


      if (!$change_back_to_http_after_login)
         return;


      if (!compatibility_sqsession_is_registered('plugin_secure_login_cameInUnencrypted')
          && $remain_in_https_if_logged_in_using_https) 
         return;


      // get global variables for versions of PHP < 4.1
      //
      if (!compatibility_check_php_version(4, 1)) {
         global $HTTP_SERVER_VARS;
         $_SERVER = $HTTP_SERVER_VARS;
      }


      global $secure_logoff_count;
      compatibility_sqextractGlobalVar('secure_logoff_count');
      if (!isset($secure_logoff_count))
      {
         $secure_logoff_count = 0;
         compatibility_sqsession_register($secure_logoff_count, 'secure_logoff_count');
      }


      // need to fix the sq_base_url session varible, since
      // it is put in the session in redirect.php with
      // the https protocol before we get here
      //
      global $sq_base_url, $nonStandardHttpPort;
      compatibility_sqextractGlobalVar('sq_base_url');
      $sq_base_url = str_replace('https://', 'http://', $sq_base_url);
      if (isset($nonStandardHttpPort) && !empty($nonStandardHttpPort))
         $sq_base_url = preg_replace('/:\d\//', ":$nonStandardHttpPort/", $sq_base_url);
      else
         $sq_base_url = preg_replace('/:\d\//', '', $sq_base_url);
      compatibility_sqsession_register($sq_base_url, 'sq_base_url');


      // grab port the user came in on
      //
      if (isset($_SERVER['SERVER_PORT']))
         $serverPort = $_SERVER['SERVER_PORT'];
      else
         $serverPort = 0;



      // figure out what port we should be comparing
      //
      if (isset($securePort))
         $targetHttpsPort = $securePort;
      else
         $targetHttpsPort = '443';



      if ( $serverPort == $targetHttpsPort && $secure_logoff_count == 0)
// old way...
//      if ( ! isset($_SERVER['HTTP']) && $secure_logoff_count == 0)
      { 

         $secure_logoff_count++; 
         compatibility_sqsession_register($secure_logoff_count, 'secure_logoff_count'); 
         $location = 'http://' . $_SERVER['HTTP_HOST'] 
            . $_SERVER['PHP_SELF']; 

         displayHtmlHeader('',
            "\n<META HTTP-EQUIV=\"REFRESH\" CONTENT=\"0;URL=$location\">\n");

         // note that this causes a pop-up in some browsers
         // that notifies you you are leaving a secure site
         //
         //header("Location: $location");

         exit(); 

      }

   }


?>
