<!--#include file="../Inc/config.asp" -->
<!--#include file="../inc/conn.asp" -->
<!--#include file="../Inc/Md5.asp" -->
<!--#include file="../Inc/Enpas.asp" -->
<!--#include file="../Inc/version.asp" -->
<%
session.Timeout=20
Dim rs,sql,UserName,UserPass,VerifyCode,SystemVer,UserIP
if(isSelfRefer()=false) then
	response.Redirect("/error/404.html")
	response.End()
end if

UserName = Replace(Trim(Request.Form("username")),"'","''")
UserPass = Md5(Request.Form("Password"),16)
VerifyCode = Replace(Trim(Request("VerifyCode")),"'","")
UserIP = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
if UserIP = "" then 
	UserIP = Request.ServerVariables("REMOTE_ADDR")
end if
if len(UserName)<1 or  len(UserPass)<1 then
	Response.Write("<script>alert(""错误：\n请填写完整"&Tot_Cms_Title&""");location.href=""Login.asp"";</script>")
	Response.End
end if

if  VerifyCode <> CStr(Session("GetCode"))  then 
	Response.Write("<script>alert(""错误：\n验证码错误"&Tot_Cms_Title&""");location.href=""Login.asp"";</script>")
	Response.End
end if
if request("VerifyCode") = "" then
	Response.Write("<script>alert(""错误：\n请填写验证码"&Tot_Cms_Title&""");location.href=""Login.asp"";</script>")
	Response.End
elseif Session("GetCode") = "9999" then
	Session("GetCode")=""
elseif Session("GetCode") = "" then
	Response.Write("<script>alert(""错误：\n请不要重复提交，如需重新登录请返回登录页面。\n返回后请刷新登录页面后重新输入正确的信息"&Tot_Cms_Title&""");location.href=""Login.asp"";</script>")
	Response.End
elseif cstr(Session("GetCode"))<>cstr(Trim(Request("VerifyCode"))) then
	Response.Write("<script>alert(""错误：\n您输入的确认码和系统产生的不一致，请重新输入。\n返回后请刷新登录页面后重新输入正确的信息"&Tot_Cms_Title&""");location.href=""Login.asp"";</script>")
	Response.End
end if
Session("GetCode")=""
SystemVer = Request.ServerVariables("HTTP_USER_AGENT")
if Instr(SystemVer,"Windows NT 5.2") then
	SystemVer = "Win2003"
elseif Instr(SystemVer,"Windows NT 5.0") then
	SystemVer="Win2000"
elseif Instr(SystemVer,"Windows NT 5.1") then
	SystemVer = "WinXP"
elseif Instr(SystemVer,"Windows NT") then
	SystemVer = "WinNT"
elseif Instr(SystemVer,"Windows 9") then
	SystemVer = "Win9x"
elseif Instr(SystemVer,"unix") or instr(SystemVer,"linux") or instr(SystemVer,"SunOS") or instr(SystemVer,"BSD") then
	SystemVer = "类Unix"
elseif Instr(SystemVer,"Mac") then
	SystemVer = "Mac"
else
	SystemVer = "Other"
end if

Set rs = server.CreateObject ("ADODB.RecordSet")
sql = "select * from admin where UserName='"&UserName&"' and  password='"&UserPass&"'"
rs.Open sql,conn,3,1
if Not rs.EOF and not rs.bof then
	if cint(rs("Lock"))=1 then
		Response.Write("<script>alert(""错误:\n您已经被锁定,请与管理联系\n"&Tot_Cms_Title&""");window.close();</script>")
		Response.End
	end if
	Session("Name") = rs("UserName")
	Session("PassWord") = rs("PassWord")
	Session("AdminID") = rs("ID")
	Session("RoleId")=rs("RoleId")
	Session("eWebEditor_User")=rs("UserName")
	rs.close
	set rs=nothing
	'栏目权限
	if(Cint(Session("RoleId"))<>0) then
		Set rs = Server.Createobject("adodb.recordset")	
		rs.open "select classlimit,classids from role where id="&Session("RoleId"),conn,3,1
		if not rs.eof then
			Session("classlimit")=rs(0)
			Session("classids")=rs(1)
		end if
		rs.close
		set rs=nothing
	end if
	conn.execute("update admin set LoginNum=LoginNum+1 where UserName='"&UserName&"'")
	Set rs = Server.Createobject("adodb.recordset")	
	rs.open "Select * from t_log where 1=0",conn,3,3
	rs.addnew
	rs("LogUser")=UserName
	rs("LogIP")=UserIP
	rs("OS")=SystemVer
	rs("Result") = 1
	rs("LoginTime") = now()
	rs.update
	rs.close
	set rs = Nothing
	If Cint(Request.Form("AutoGet"))=1 and Request.Form("AutoGet")<>"" Then
        Response.Cookies("TOTCookie")("AdminName")=Session("Name")
        Response.Cookies("TOTCookie").Expires=Date()+365
    Else
        Response.Cookies("TOTCookie")("AdminName")=""
        Response.Cookies("TOTCookie").Expires=Date()-1
    End If
   	Response.Write("<script>parent.location.href=""index.asp"";</script>")
	Response.End
else
	rs.close
	set rs = Nothing
	set rs = Server.Createobject("adodb.recordset")	
	rs.open "Select * from t_log",conn,3,3
	rs.AddNew
	rs("LogUser")=UserName
	rs("LogIP")=UserIP
	rs("OS")=SystemVer
	rs("ErrorPas")=Request.Form("Password")
	rs("Result")=0
	rs("LoginTime")=Now()
	rs.update
	rs.close
	set rs = Nothing
	Response.Write("<script>alert(""错误:\n请检查用户名和密码的正确性\n"&Tot_Cms_Title&""");location.href=""Login.asp"";</script>")
	Response.End
end if

call connclose()
%>