<%data_path="../"%>
<!--#include file="../conn/conn.asp"-->
<!--#include file="../inc/md5.asp"-->
<!--#include file="../inc/safe.asp"-->
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<LINK href="css/style.css" rel=stylesheet type=text/css>
<title>后台登陆验证</title>
<%
if Not ChkPost then response.redirect (HOPE_InstallDir&"login/chklogin.asp?login=4")
Response.Expires = 0
Response.AddHeader "Pragma", "no-cache"
Response.AddHeader "cache-control", "no-store"
  
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
dim uid,upwd
uid=Replace_Text(Request.Form("userid"))
upwd=md5(Replace_Text(Request.Form("password")),16)
Verifycode=Replace_Text(request.Form("verifycode"))
 
'=================================IP验证 Begin==============================================
HOPE_Ip=Request.ServerVariables("REMOTE_ADDR")

Set rs=Server.Createobject("Adodb.recordset")
			Sql="Select * From yixiang_IPSet"
			rs.open sql,conn,1,3
if not rs.eof then 
	do while not rs.eof 
		if rs("HOPE_IP")=HOPE_Ip then 
			Call HOPE_err("登录失败","当前登录的IP地址已经锁定<br><br>请联系系统管理员!","返回上一页","javascript:history.go(-1);")
			Response.end
		end if
	rs.movenext
	if rs.eof then exit do
	loop
end if
	rs.close
	set rs=nothing
'=================================IP验证 End==============================================
 	
	if not isnumeric(Verifycode) then
		call Logerr()
		Call  ErroFy()
	end if
	if issession=0 then
	if Replace_Text(request.Cookies("safecode"))<>"" then
	 safecode=Replace_Text(request.Cookies("safecode"))
	end if
	else
	 safecode=Session("SafeCode")
	end if
 
if cstr(Verifycode)<>cstr(safecode) then
	call Logerr()
	Call  ErroFy()
	
	Sub ErroFy()
		response.write"<table cellpadding=2 cellspacing=1 border=0 width=100% class=tableBorder align=center>"
		response.write"<TR>"
		response.write"<TH class=tableHeaderText colSpan=2 height=25>出现错误提示</TH>"
		response.write"<TR><tr><td height=85 valign=top class=forumRow><div align=center><br><br>验证码错误！</div></td></tr>"
		response.write"<tr align=center><td height=30 class=forumRowHighlight><a href='login.asp'>&lt;&lt; 返回上一页</a></td>"
		response.write"</tr>"
		response.write"</table>"
		Response.End()
	End Sub
else
 
set rs=server.createobject("adodb.recordset")
sqltext="select * from Yixiang_worldec_master where Username='" & uid & "' and [PassWord]='" & upwd & "'"
rs.open sqltext,conn,1,1
If Rs.Eof And Rs.Bof Then
response.write"<table cellpadding=2 cellspacing=1 border=0 width=100% class=tableBorder align=center>"
response.write"<TR>"
response.write"<TH class=tableHeaderText colSpan=2 height=25>出现错误提示</TH>"
response.write"<TR><tr><td height=85 valign=top class=forumRow><div align=center><br><br>登陆名或密码不正确！</div></td></tr>"
response.write"<tr align=center><td height=30 class=forumRowHighlight><a href='login.asp'>&lt;&lt; 返回上一页</a></td>"
response.write"</tr>"
response.write"</table>" 
		call Logerr()
		
	 Sub Logerr()'登录错误
		'===========================================http://www.changehope.com =========================================
		If Database_type=1 Then
			Set rsLog=server.CreateObject("adodb.recordset")
			SqlLog="select ip,admin_username,dat1,dat,EndLogin,cs From  yixiang_web_manage_log "
			rsLog.open SqlLog,conn,1,3
			  rsLog.addnew()
				rsLog("ip")=Request.ServerVariables("REMOTE_ADDR")
				rsLog("admin_username")=uid
				rsLog("dat1")=now()
				rsLog("dat")=now()
				rsLog("Cs")=1
				rsLog("EndLogin")=0
			  rsLog.update()
				rsLog.close
				Set rsLog=nothing
		'===========================================http://www.changehope.com =========================================
		
		else
		'===========================================http://www.changehope.com =========================================
			Set rsLog=server.CreateObject("adodb.recordset")
			SqlLog="select ip,admin_username,dat1,dat,EndLogin,cs From  yixiang_web_manage_log "
			rsLog.open SqlLog,conn,1,3
			  rsLog.addnew()
				rsLog("ip")=Request.ServerVariables("REMOTE_ADDR")
				rsLog("admin_username")=uid
				rsLog("dat1")=now()
				rsLog("dat")=now()
				rsLog("Cs")=1
				rsLog("EndLogin")=0
			  rsLog.update()
				rsLog.close
				Set rsLog=nothing
		
		'===========================================http://www.changehope.com =========================================		
		end if
	End Sub
	
else
  
	if isSession=1 then
     session("globalecmaster")=rs("username")
     session("masterflag")=rs("flag")
     session("adminid")=rs("id")
     session.timeout=60
 	else
     Response.Cookies("username")=rs("username")
     Response.Cookies("usernames")=rs("id")
     Response.Cookies("userlist")=rs("PassWord")
	 Response.Cookies("userlists")=md5(rs("flag"),16)
	 Response.Cookies("usertime")=now()
 	 Response.Cookies("userip")=Request.ServerVariables("REMOTE_ADDR")
     Response.Cookies("username").Expires=dateadd("n",time_score,now())
     Response.Cookies("usernames").Expires=dateadd("n",time_score,now())
     Response.Cookies("userlist").Expires=dateadd("n",time_score,now())
     Response.Cookies("userlists").Expires=dateadd("n",time_score,now())
	 Response.Cookies("userip").Expires=dateadd("n",time_score,now())
     Response.Cookies("usertime").Expires=dateadd("n",time_score,now())
    end if
  
  if issession=0 then
    globalname=request.Cookies("username")
  else
    globalname=session("globalecmaster")
  end if
 If Database_type=1 Then
	conn.execute("update Yixiang_worldec_master set LastLogin=getdate(),LastLoginIP='"&getIP&"' where username='"&uid&"'")
	
	'===========================================http://www.changehope.com =========================================
	Set rsLog=server.CreateObject("adodb.recordset")
		SqlLog="select ip,admin_username,dat1,dat,EndLogin,cs From  yixiang_web_manage_log Where admin_username='"&globalname&"'"
		rsLog.open SqlLog,conn,1,3
		if not rsLog.eof then 
			rsLog("ip")=Request.ServerVariables("REMOTE_ADDR")
			rsLog("dat")=now()
 			rsLog("Cs")=Cint(rsLog("Cs"))+1
			rsLog("EndLogin")=1
			rsLog.update()
		else
			rsLog.addnew()
			rsLog("ip")=Request.ServerVariables("REMOTE_ADDR")
			rsLog("admin_username")=globalname
			rsLog("dat1")=now()
			rsLog("dat")=now()
			rsLog("Cs")=1
			rsLog("EndLogin")=1
			rsLog.update()
		end if
		rsLog.close
		Set rsLog=nothing
	'===========================================http://www.changehope.com =========================================
			
Else
	conn.execute("update Yixiang_worldec_master set LastLogin=date(),LastLoginIP='"&getIP&"' where username='"&uid&"'")
	
	'===========================================http://www.changehope.com =========================================
	Set rsLog=server.CreateObject("adodb.recordset")
		SqlLog="select ip,admin_username,dat1,dat,EndLogin,cs From  yixiang_web_manage_log Where admin_username='"&globalname&"'"
		rsLog.open SqlLog,conn,1,3
		
		if not rsLog.eof then 
			rsLog("ip")=Request.ServerVariables("REMOTE_ADDR")
			rsLog("dat")=now()
			rsLog("Cs")=Cint(rsLog("Cs"))+1
			rsLog("EndLogin")=1
			rsLog.update()
		else
			rsLog.addnew()
			rsLog("ip")=Request.ServerVariables("REMOTE_ADDR")
			rsLog("admin_username")=globalname
			rsLog("dat1")=now()
			rsLog("dat")=now()
			rsLog("Cs")=1
			rsLog("EndLogin")=1
			rsLog.update()
		end if
		rsLog.close
		Set rsLog=nothing
	'===========================================http://www.changehope.com =========================================
 	
End If

  if issession=0 then
 		 response.Cookies("safecode")=""
 		else
		 Session("SafeCode")=""
  end if
response.write"<table cellpadding=2 cellspacing=1 border=0 width=100% class=tableBorder align=center>"
response.write"<TR>"
response.write"<TH class=tableHeaderText colSpan=2 height=25>登陆成功提示</TH>"
response.write"<TR><tr><td height=85 valign=top class=forumRow><div align=center><br><br>成功通过网站后台管理员身份认证！<br><br>2秒后自动进入后台...</div></td></tr>"
response.write"<tr align=center><td height=30 class=forumRowHighlight><a href='index.asp'>进入后台管理</a></td>"
response.write"</tr>"
response.write"</table>"
%>
<meta HTTP-EQUIV=refresh Content='2;url=index.asp'>
<%
end if
rs.close
set rs=nothing
end if
%>
<br>
<script src="log/contpage.asp"></script>
 