<?php
/**
* 后台管理员类
* @author moufer<moufer@163.com>
* @copyright (C)2001-2007 Moufersoft(www.modoer.com)
* @version $Id admin.class.php 1 2008-01-31 11:00 $
*/

!defined('IN_MUDDER') && exit('Access Denied');

class Admin_class {

    var $id;
    var $adminname;
    var $email;
    var $password;
    var $admintype;
    var $hash;
    var $is_founder;
    var $isLogin;
    var $errmsg;

    var $access;

    function Admin_class() {
        global $db, $dbpre, $timestamp,$_config;

        $admin_id = $_SESSION['adminid'];
        $admin_name = $_SESSION['adminname'];
        $admin_hash = $_SESSION['hash'];

        if($admin_id && $admin_name && $admin_hash) {
            $row = $db->get_one("SELECT * FROM {$dbpre}admin WHERE id='$admin_id' AND adminname='$admin_name'");
            if($row) {
                $db_hash = substr(md5($row['id'].$row['adminname'].$row['password'].$_config['authkey']), 0, 16);
                if($admin_hash == $db_hash) {
                    $this->isLogin = true;
                    $this->id = $admin_id;
                    $this->adminname = $admin_name;
                    $this->email = $row['email'];
                    $this->password = $row['password'];
                    $this->admintype = $row['admintype'];
                    $this->hash = $db_hash;
                    $this->is_founder = $row['is_founder'] == "Y";
                    $this->errmsg = "";
                    $this->access = $this->getaccess();
                } else {
                    $this->clearvar();
                    $this->isLogin = false;
                    $this->errmsg = '登录验证失效。';
                }
            } else {
                $this->clearvar;
                $this->isLogin = false;
                $this->errmsg = '帐号不存在。';
            }
        } else {
            $this->clearvar();
            $this->isLogin = false;
            $this->errmsg = '登录失效。';
        }
    }

    function Login($username,$password) {
        global $db, $dbpre, $_config, $timestamp, $onlineip;
        if(!$username || !$password) {
            $this->errmsg = '未填写用户名或密码。';
            return false;
        }
        $admin_md5pwd = md5($password);
        $row = $db->get_one("SELECT * FROM {$dbpre}admin WHERE adminname='$username' AND password='$admin_md5pwd'");
        if($row) {
            $this->id = $_SESSION['adminid'] = $row['id'];
            $this->adminname = $_SESSION['adminname'] = $row['adminname'];
            $this->hash = $_SESSION['hash'] = substr(md5($row['id'].$row['adminname'].$row['password'].$_config['authkey']),0,16);
            $db->query("UPDATE {$dbpre}admin SET logintime='$timestamp',loginip='$onlineip',logincount=logincount+1 WHERE id='{$row['id']}'");
            $nowaccess = $this->getaccess();
            $nowaccess==1 && $db->query("UPDATE {$dbpre}adminsessions SET errorcount='-1' WHERE adminid='{$this->id}'");
            return true;
        } else {
            $this->clearvar();
            $this->errmsg = '登录失败。';
            return false;
        }
    }

    function Logout() {
        global $db, $dbpre;
        if(isset($_SESSION)) {
            $_SESSION['adminid'] = '';
            $_SESSION['adminname'] = '';
            $_SESSION['hash'] = '';
            unset($_SESSION);
            session_destroy();
        }
        $db->query("DELETE FROM {$dbpre}adminsessions WHERE adminid='{$admin->id}'");
        $this->isLogin && $this->clearvar();
    }

    function getaccess() {
        global $db, $dbpre, $admincp, $onlineip, $_config, $timestamp;
        //++IP检测
        if($_config['adminipaccess'] && !check_ipaccess($onlineip, explode("\r\n", $_config['adminipaccess']))) {
            return 2; //IP过滤
        } else {
            //验证IP
            $addonlineip = $admincp['checkip'] ? "AND ip='$onlineip'" : '';
            $session = $db->get_one("SELECT errorcount FROM {$dbpre}adminsessions WHERE adminid='{$this->id}' $addonlineip AND dateline+3600>'$timestamp'"); //无操作相应时间60分钟
            if($session) {
                if($session['errorcount'] == -1) {
                    $db->update("UPDATE {$dbpre}adminsessions SET dateline='$timestamp' WHERE adminid='{$this->id}'");
                    return 3; //OK
                } elseif($session['errorcount'] <= 3) {
                    return 1; //登录错误
                } else {
                    return 0;
                }
            } else {
                // 清除无效（超时等）
                $db->query("DELETE FROM {$dbpre}adminsessions WHERE adminid='{$this->id}' OR dateline+1800<'$timestamp'");
                $db->query("INSERT INTO {$dbpre}adminsessions (adminid,ip,dateline,errorcount) VALUES ('{$this->id}','$onlineip','$timestamp', '0')");
                return 1;
            }
        }
    }

    function clearvar() {
        $this->id = 0;
        $this->adminname = '';
        $this->email = '';
        $this->admintype = 0;
        $this->is_founder = false;
        $this->isLogin = false;
        $this->hash = '';
        $this->access = 0;
    }

}
?>
