<?php 
/**
* @version		$Id: alogin.php 2592 2025-03-09 19:06:10Z IOS $
* @package		Elxis
* @subpackage	Templates / System
* @copyright	Copyright (c) 2006-2025 Elxis CMS (https://www.elxis.org). All rights reserved.
* @license		Elxis Public License ( https://www.elxis.org/elxis-public-license.html )
* @author		Elxis Team ( https://www.elxis.org )
* @description 	Elxis CMS is free software. Read the license for copyright notices and details
*/

defined('_ELXIS_') or die ('Direct access to this location is not allowed');
defined('ELXIS_ADMIN') or die('You can not access this file from this location!');

$curl = 'http://';
if (isset($_SERVER['HTTPS'])) {
	if (($_SERVER['HTTPS'] == 'on') || ($_SERVER['HTTPS'] == 1)) { $curl = 'https://'; }
}
$curl .= $_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
$site_aurl = $elxis->makeAURL('', '', true);
if (strpos($curl, $site_aurl) !== 0) { $elxis->redirect($site_aurl); }//fix wrong login URL

$rtlsfx = ($eLang->getinfo('DIR') == 'rtl') ? '-rtl' : '';
if (preg_match('#(\.png)$#i', $page->favicon)) {
	$favrel = 'rel="icon" type="image/png"';
} else {
	$favrel = 'rel="shortcut icon"';
}

$nonce_str = ($page->nonce != '') ?	' nonce="'.$page->nonce.'"' : '';

$token = trim(eFactory::getSession()->get('token_loginform')); //check if another login module has already set the token
if ($token == '') {
	$token = md5(uniqid(rand(), true));
	eFactory::getSession()->set('token_loginform', $token);
}
$mts = filemtime(ELXIS_PATH.'/templates/system/css/standard'.$rtlsfx.'.css');
$mtx = filemtime(ELXIS_PATH.'/templates/system/css/exit'.$rtlsfx.'.css');
$mtj = filemtime(ELXIS_PATH.'/includes/js/elxis.js');
$site_inaurl = $elxis->makeAURL('', 'inner.php', true);
$twofa = ($elxis->getConfig('TWOFA') != '') ? 1 : 0;

$vtip_txt_generic = sprintf($eLang->get('VERIFY_CODE_TIP'), '@@@');

switch ($elxis->getConfig('TWOFA')) {
	case 'sms': $vtip_txt = sprintf($eLang->get('VERIFY_CODE_TIP'), 'SMS'); break;
	case 'email': $vtip_txt = sprintf($eLang->get('VERIFY_CODE_TIP'), 'e-mail'); break;
	default: $vtip_txt = sprintf($eLang->get('VERIFY_CODE_TIP'), 'message'); break;
}

echo $page->doctype."\n";
?>
<html<?php echo $page->htmlattributes; ?>>
<head>
	<base href="<?php echo $elxis->secureBase().'/'.ELXIS_ADIR; ?>/">
	<meta http-equiv="content-type" content="<?php echo $page->contenttype; ?>; charset=utf-8">
	<meta name="generator" content="Elxis - Open Source CMS">
	<meta name="distribution" content="global">
	<meta name="robots" content="noindex, nofollow">
	<title><?php echo $page->title.' - '.$elxis->getConfig('SITENAME'); ?></title>
	<meta name="description" content="<?php echo $page->msgtitle; ?>">
	<link <?php echo $favrel; ?> href="<?php echo $page->favicon; ?>">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<meta name="HandheldFriendly" content="true">
	<link rel="stylesheet" href="<?php echo $elxis->secureBase().'/templates/system/css/standard'.$rtlsfx.'.css?v=m'.$mts; ?>" type="text/css" media="all"<?php echo $nonce_str; ?>>
	<link rel="stylesheet" href="<?php echo $elxis->secureBase().'/templates/system/css/exit'.$rtlsfx.'.css?v=m'.$mtx; ?>" type="text/css" media="all"<?php echo $nonce_str; ?>>
	<script src="<?php echo $elxis->secureBase().'/includes/js/elxis.js?v=m'.$mtj; ?>"></script>
	<script<?php echo $nonce_str; ?>>
	function exit5SwitchLang() {
		if (!document.getElementById('exitlngfm')) { return; }
		var fmObj = document.getElementById('exitlngfm');
		var selObj = document.getElementById('exit5_select_lang');
		var admURL = selObj.options[selObj.selectedIndex].getAttribute('data-act');
		window.location.href = admURL;
	}
	var xloginwait = 0;
	function exit5ALogin(confirmform, has2fa, otplogin) {
		if (xloginwait == 1) { return false; } //prevent double click
		if (otplogin == 1) {
			var btnelem = 'otpbtn';
		} else {
			var btnelem = 'loginbtn';
		}
		document.getElementById('exit5_message_error').className = 'elx5_invisible';
		var rnd = Math.floor((Math.random()*100)+1);
		var edata = { 'rnd': rnd };
		edata.token = document.getElementById('token').value;
		var login_action = document.getElementById('fmelxisalogin').action;

		if (confirmform == 1) {
			edata.pword2 = document.getElementById('pword').value.trim();
			edata.xaction = 'aconfirm';
			if (edata.pword2 == '') {
				document.getElementById('pword').focus();
				return false;
			}
		} else {
			edata.uname = document.getElementById('uname').value.trim();
			edata.pword = document.getElementById('pword').value.trim();
			edata.xaction = 'alogin';
			if (edata.uname == '') {
				document.getElementById('uname').focus();
				return false;
			}
			if (edata.pword == '') {
				document.getElementById('pword').focus();
				return false;
			}

			if (has2fa == 1) {
				if (otplogin == 1) {
					edata.otp = document.getElementById('vcode').value.trim();
					if (edata.otp == '') {
						document.getElementById('vcode').focus();
						return false;
					}
					if (isNaN(edata.otp)) {
						document.getElementById('vcode').focus();
						return false;
					}
					edata.xaction = 'alogin';
				} else {
					edata.xaction = 'makeaotp';
				}
			}
		}

		var successfunc = function(xreply) {
			xloginwait = 0;
			document.getElementById(btnelem).innerHTML = document.getElementById(btnelem).getAttribute('data-loginlng');
			try {
				var jsonObj = JSON.parse(xreply);
			} catch(e) {
				return false;
			}
			if (parseInt(jsonObj.success, 10) < 1) {
				if (jsonObj.message != '') {
					var msg = jsonObj.message;
				} else {
					var msg = 'Action failed!';
				}
				document.getElementById('exit5_message_error').innerHTML = msg;
				document.getElementById('exit5_message_error').className = 'exit5_message_error';
				setTimeout(function() { document.getElementById('exit5_message_error').className = 'elx5_invisible'; }, 3000);
				return false;
			} else {
				if (confirmform == 1) {
					window.location.href = '<?php echo $site_aurl; ?>?rnd='+rnd;
				} else if (has2fa == 1) {
					if (otplogin == 1) {
						window.location.href = '<?php echo $site_aurl; ?>?rnd='+rnd;
					} else {
						//send method might change from sms to email if sms fail
						var tiptxt = document.getElementById('vcode_tip').getAttribute('data-genlng');
						if (jsonObj.method == 'sms') {
							document.getElementById('vcode_tip').innerHTML = tiptxt.replace('@@@', 'SMS');
						} else {
							document.getElementById('vcode_tip').innerHTML = tiptxt.replace('@@@', 'e-mail');
						}
						document.getElementById('fmelxisloginwrap').className = 'elx5_invisible';
						document.getElementById('fmelxis2faloginwrap').className = 'elx5_zero';
					}
				} else {
					window.location.href = '<?php echo $site_aurl; ?>?rnd='+rnd;
				}
			}
		};
		var errorfunc = function (XMLHttpRequest, textStatus, errorThrown) {
			xloginwait = 0;
			document.getElementById(btnelem).innerHTML = document.getElementById(btnelem).getAttribute('data-loginlng');
			document.getElementById('exit5_message_error').innerHTML = 'Login failed with error message '+errorThrown;
			document.getElementById('exit5_message_error').className = 'exit5_message_error';
			setTimeout(function() { document.getElementById('exit5_message_error').className = 'elx5_invisible'; }, 3000);
		};
		xloginwait = 1;
		document.getElementById(btnelem).innerHTML = document.getElementById(btnelem).getAttribute('data-waitlng');
		elxAjax('POST', login_action, edata, null, null, successfunc, errorfunc);
	}
	if (document.readyState != 'loading') {
		document.getElementById('fmelxisalogin').addEventListener('submit', function(event){ event.preventDefault(); exit5ALogin(<?php echo $page->confirmform; ?>, <?php echo $twofa; ?>, 0); return false; }, false);
		document.getElementById('fmelxis2falogin').addEventListener('submit', function(event){ event.preventDefault(); exit5ALogin(<?php echo $page->confirmform; ?>, 1, 1); return false; }, false);
		document.getElementById('exit5_select_lang').addEventListener('change', function(){ exit5SwitchLang(); }, false);
	} else if (document.addEventListener) {
		document.addEventListener('DOMContentLoaded', function(){ 
			document.getElementById('fmelxisalogin').addEventListener('submit', function(event){ event.preventDefault(); exit5ALogin(<?php echo $page->confirmform; ?>, <?php echo $twofa; ?>, 0); return false; }, false);
			document.getElementById('fmelxis2falogin').addEventListener('submit', function(event){ event.preventDefault(); exit5ALogin(<?php echo $page->confirmform; ?>, 1, 1); return false; }, false);
			document.getElementById('exit5_select_lang').addEventListener('change', function(){ exit5SwitchLang(); }, false);
		});
	} else {
		document.attachEvent('onreadystatechange', function() { 
			if (document.readyState == 'complete') {
				document.getElementById('fmelxisalogin').addEventListener('submit', function(event){ event.preventDefault(); exit5ALogin(<?php echo $page->confirmform; ?>, <?php echo $twofa; ?>, 0); return false; }, false);
				document.getElementById('fmelxis2falogin').addEventListener('submit', function(event){ event.preventDefault(); exit5ALogin(<?php echo $page->confirmform; ?>, 1, 1); return false; }, false);
				document.getElementById('exit5_select_lang').addEventListener('change', function(){ exit5SwitchLang(); }, false);
  			} 
		});
	}
	</script>
</head>
<body>
	<div class="exit5_pgwrapin">
		<div class="exit5_titlebox">
			<h1><?php echo $page->title; ?></h1>
			<div class="exit5_title_desc"><?php echo $page->msgtitle; ?></div>
		</div>
<?php 
		if ($page->loginerror != '') {
			echo '<div id="exit5_message_error" class="exit5_message_error">'.$page->loginerror."</div>\n";
		} else if (($page->message != '') && ($page->confirmform == 1)) {
			echo '<div class="exit5_message">'.$page->message."</div>\n";
			echo '<div id="exit5_message_error" class="elx5_invisible"></div>'."\n";
		} else {
			echo '<div class="elx5_invisible"></div>'."\n";
			echo '<div id="exit5_message_error" class="elx5_invisible"></div>'."\n";
		}
?>
		<div id="fmelxisloginwrap" class="elx5_zero">
		<form name="fmelxisalogin" id="fmelxisalogin" method="post" action="<?php echo $site_inaurl; ?>" class="elx5_form" autocomplete="off">
<?php 
		if ($page->confirmform == 0) {
			echo '<div class="elx5_dspace">'."\n";
			echo '<label for="uname" class="exit5_label">'.$eLang->get('USERNAME').' / '.$eLang->get('EMAIL')."</label>\n";
			echo '<input type="text" name="uname" id="uname" value="" dir="ltr" class="exit5_smpgtext" placeholder="'.$eLang->get('USERNAME').' / '.$eLang->get('EMAIL').'" required="required" autocomplete="off">'."\n";
			echo "</div>\n";
			echo '<div class="elx5_dspace">'."\n";
			echo '<label for="pword" class="exit5_label">'.$eLang->get('PASSWORD')."</label>\n";
			echo '<input type="password" name="pword" id="pword" value="" dir="ltr" class="exit5_smpgtext" placeholder="'.$eLang->get('PASSWORD').'" required="required" autocomplete="off">'."\n";
			echo "</div>\n";
		} else {
			echo '<div class="elx5_dspace">'."\n";
			echo '<label for="pword" class="exit5_label">'.$eLang->get('PASSWORD')."</label>\n";
			echo '<input type="password" name="pword2" id="pword" value="" dir="ltr" class="exit5_smpgtext" placeholder="'.$eLang->get('PASSWORD').'" required="required" autocomplete="off">'."\n";
			echo "</div>\n";
		}
?>
			<input type="hidden" name="remember" id="exit5_remember" dir="ltr" value="0">
			<input type="hidden" name="auth_method" id="exit5_auth_method" dir="ltr" value="elxis">
			<input type="hidden" name="return" id="exit5_return" dir="ltr" value="<?php echo $page->return; ?>">
			<input type="hidden" name="token" id="token" dir="ltr" value="<?php echo $token; ?>">
			<div class="elx5_dspace">
				<button type="submit" name="loginbtn" id="loginbtn" class="exit5_btn" data-waitlng="<?php echo $eLang->get('PLEASE_WAIT'); ?>" data-loginlng="<?php echo $page->buttontext; ?>"><?php echo $page->buttontext; ?></button>
			</div>
		</form>
		</div>

		<div id="fmelxis2faloginwrap" class="elx5_invisible">
		<form name="fmelxis2falogin" id="fmelxis2falogin" method="post" action="<?php echo $site_inaurl; ?>" class="elx5_form" autocomplete="off">
			<div class="elx5_dspace">
				<label for="vcode" class="exit5_label"><?php echo $eLang->get('VERIFY_CODE'); ?></label>
				<input type="text" name="vcode" id="vcode" value="" dir="ltr" class="exit5_bigtext" inputmode="numeric" pattern="[0-9]+" autocomplete="one-time-code" maxlength="6" placeholder="<?php echo $eLang->get('VERIFY_CODE'); ?>" required="required">
				<div class="elx5_tip" id="vcode_tip" data-genlng="<?php echo addslashes($vtip_txt_generic); ?>"><?php echo $vtip_txt; ?></div>
			</div>
			<div class="elx5_dspace">
				<button type="submit" name="otpbtn" id="otpbtn" class="exit5_btn" data-waitlng="<?php echo $eLang->get('PLEASE_WAIT'); ?>" data-loginlng="<?php echo $eLang->get('CONTINUE'); ?>"><?php echo $eLang->get('CONTINUE'); ?></button>
			</div>
			<a href="<?php echo $site_aurl; ?>" title="<?php echo $eLang->get('START_OVER'); ?>" class="exit5_restart"><?php echo $eLang->get('START_OVER'); ?></a>
			<input type="hidden" name="token" id="otptoken" dir="ltr" value="<?php echo $token; ?>">
		</form>
		</div>

<?php 
		$flagsdir = $elxis->secureBase().'/includes/libraries/elxis/language/flags32/';
		$curlng = $eLang->currentLang();
		$admurl = $elxis->makeAURL();
		echo '<form name="exitlngfm" id="exitlngfm" method="get" action="'.$admurl.'" class="elx5_form">'."\n";
		echo '<div class="exit5_lang_wrap">'."\n";
		echo '<div class="exit5_downpick">'.$eLang->get('CHOOSE_LANG').'</div>';
		if (isset($page->infolangs[$curlng])) {
			echo '<img src="'.$flagsdir.$curlng.'.png" alt="'.$page->infolangs[$curlng]['NAME'].' - '.$page->infolangs[$curlng]['NAME_ENG'].'" title="'.$page->infolangs[$curlng]['NAME'].' - '.$page->infolangs[$curlng]['NAME_ENG'].'"> ';
			echo '<div class="exit5_lang_selwrap">'."\n";
		}
		echo '<select name="lang" class="exit5_select_lang" id="exit5_select_lang">'."\n";
		foreach ($page->infolangs as $lng => $info) {
			$selected = ($curlng == $lng) ? ' selected="selected"' : '';
			$link = $elxis->makeAURL($lng);
			echo '<option value="'.$lng.'"'.$selected.' data-act="'.$link.'">'.$info['NAME'].' - '.$info['NAME_ENG']."</option>\n";
		}
		echo "</select>\n";
		if (isset($page->infolangs[$curlng])) { echo "</div>\n"; }
		echo "</div>\n";
		echo '<input type="hidden" name="token" id="lngtoken" dir="ltr" value="<?php echo $token; ?>">'."\n";//does nothing
		echo "</form>\n";
?>
	</div><!-- exit5_pgwrapin -->
	<div class="exit5_pgfooter">
		<div class="exit5_pgfooter_copy"><a href="<?php echo $page->sitelink; ?>" title="<?php echo $elxis->getConfig('SITENAME'); ?>"><?php echo $elxis->getConfig('SITENAME'); ?></a> &copy; <?php echo date('Y'); ?></div>
		<a href="https://www.elxis.org" title="Elxis Open Source CMS" class="exit5_powerby">Powered by Elxis CMS &#169; 2006-<?php echo date('Y'); ?></a>
	</div>
</body>
</html>