<?php
/**
 * 登录
**/
$verifycode = 1;

if(!function_exists("imagecreate") || !file_exists('code.php'))$verifycode=0;
define('IN_ADMIN', true);
include("../includes/common.php");
include_once(ROOT."security_password.php");
if(isset($_POST['user']) && isset($_POST['pass'])){
	if(!isset($_SESSION['pass_error']))$_SESSION['pass_error']=0;
	$user=daddslashes($_POST['user']);
	$pass=daddslashes($_POST['pass']);
	$code=isset($_POST['code'])?daddslashes($_POST['code']):'';
	if ($verifycode==1 && (!$code || strtolower($code) != $_SESSION['vc_code'])) {
		unset($_SESSION['vc_code']);
		@header('Content-Type: text/html; charset=UTF-8');
		exit("<script language='javascript'>alert('验证码错误！');history.go(-1);</script>");
	}elseif($_SESSION['pass_error']>5) {
		@header('Content-Type: text/html; charset=UTF-8');
		exit("<script language='javascript'>alert('用户名或密码不正确！');history.go(-1);</script>");
	}elseif($user==$conf['admin_user']) {
		$stored_password = $conf['admin_pwd'];
		$password_valid = false;
		if (is_password_hash($stored_password)) {
			$password_valid = password_verify_bcrypt($pass, $stored_password);
		} else {
			$password_valid = ($pass === $stored_password);
			if ($password_valid) {
				$new_hash = password_hash_bcrypt($pass);
				$DB->exec("UPDATE pre_config SET v='$new_hash' WHERE k='admin_pwd'");
				$stored_password = $new_hash;
			}
		}
		}
		if ($password_valid) {
			$admin_pwd_for_session = $stored_password;
			$session=md5($user.$admin_pwd_for_session.$password_hash);
			$expiretime=time()+2592000;
			$token=authcode("{$user}\t{$session}\t{$expiretime}", 'ENCODE', SYS_KEY);
			ob_clean();
			setcookie("admin_token", $token, time() + 2592000);
			@header('Content-Type: text/html; charset=UTF-8');
			exit("<script language='javascript'>alert('登陆管理中心成功！');window.location.href='./';</script>");
		} else {
			$_SESSION['pass_error']++;
			@header('Content-Type: text/html; charset=UTF-8');
			exit("<script language='javascript'>alert('用户名或密码不正确！');history.go(-1);</script>");
		}
	}elseif(isset($_GET['logout'])){
	setcookie("admin_token", "", time() - 2592000);
	@header('Content-Type: text/html; charset=UTF-8');
	exit("<script language='javascript'>alert('您已成功注销本次登陆！');window.location.href='./login.php';</script>");
}elseif($islogin==1){
	exit("<script language='javascript'>alert('您已登陆！');window.location.href='./';</script>");
}
$title='用户登录';
?>
<!DOCTYPE html>
<html lang="zh" class="login-page">
<head>
	<meta charset="UTF-8">
	<meta name="renderer" content="webkit">
	<meta name="viewport" content="width=device-width,height=device-height,inital-scale=1.0,maximum-scale=1.0,user-scalable=no;">
	<title>管理员登录 - <?php echo $conf['site_name'];?></title>
	<link href="https://s4.zstatic.net/ajax/libs/twitter-bootstrap/3.4.1/css/bootstrap.min.css" rel="stylesheet"/>
	<link href="https://s4.zstatic.net/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet"/>
	<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700&display=swap" rel="stylesheet">
	<link href="../assets/css/admin-pages.css" rel="stylesheet"/>
</head>
<body>
	<div class="particles">
		<div class="particle"></div>
		<div class="particle"></div>
		<div class="particle"></div>
		<div class="particle"></div>
		<div class="particle"></div>
		<div class="particle"></div>
		<div class="particle"></div>
		<div class="particle"></div>
		<div class="particle"></div>
		<div class="particle"></div>
	</div>
	<div class="login-wrapper">
		<div class="login-card">
			<div class="login-header">
				<div class="icon-wrapper">
					<i class="fa fa-shield"></i>
				</div>
				<h2>管理员登录</h2>
				<p>欢迎回来，请登录您的账户</p>
			</div>
			<div class="login-body">
				<form method="post" autocomplete="off">
					<div class="form-group">
						<input type="text" name="user" class="form-control" placeholder="请输入用户名" required autofocus>
						<i class="fa fa-user input-icon"></i>
					</div>
					<div class="form-group">
						<input type="password" name="pass" class="form-control" placeholder="请输入密码" required>
						<i class="fa fa-lock input-icon"></i>
					</div>
					<?php if($verifycode==1){ ?>
					<div class="form-group code-group">
						<input type="text" name="code" class="form-control" placeholder="验证码" required>
						<img src="code.php?r=<?php echo time();?>" alt="验证码" class="code-img" onclick="this.src='code.php?r='+Math.random();">
					</div>
					<?php } ?>
					<div class="form-group">
						<button type="submit" class="btn-login">
							<i class="fa fa-sign-in"></i>&nbsp;&nbsp;登 录
						</button>
					</div>
				</form>
			</div>
			<div class="login-footer">
				<a href="../"><i class="fa fa-home"></i>&nbsp;返回首页</a>
			</div>
		</div>
	</div>
</body>
</html>
