<?php
session_start();
include "conn.inc.php";
include "magickey.inc.php";

if (
	//IS THE SESSION IS VALID?
	(isset($_SESSION['user_logged']) && $_SESSION['user_logged'] != "") || 
    (isset($_SESSION['magickey']) &&  $_SESSION['magickey'] == $magickey)
	) 
{  // YES = Do Nothing!
// "have session-";
}
else 
{
	// "no session, looking for cookie-";
	//NO = look for cookie
	if (isset($_COOKIE['wishlogin']) && $_COOKIE['wishlogin'] != "")
	{
		// "have cookie, examining-";
		$cookiearr = explode("__", $_COOKIE['wishlogin']);
		// "cookie=[".$_COOKIE['wishlogin']."]";
		// "a0[".$cookiearr[0]."] a1[".$cookiearr[1]."]a2[".$cookiearr[2]."]" ;
		$s_username = addslashes($cookiearr[0]);
		$s_logintoken = addslashes($cookiearr[1]);
		$query = "SELECT * FROM users WHERE '". $s_username ."' = username AND '". $s_logintoken ."' = logintoken";
		$result = mysql_query($query) or die(mysql_error());
		
		if (mysql_num_rows($result) == 1 && $cookiearr[2] == $magickey)
		{
			// cookie is good
			//set session
			$_SESSION['user_logged'] = $cookiearr[0];
			$_SESSION['magickey'] = $magickey;
			
			//set up a new cookie
			$token = mt_rand();
			$s_username = addslashes($_POST['username']); // sanitise_done
			$tokenquery = "UPDATE users SET logintoken = '".$token."' WHERE username = '". $s_username ."' LIMIT 1;";
			$tokenresult = mysql_query($tokenquery) or die(mysql_error());
			setcookie("wishlogin", $_SESSION['user_logged']."__".$token."__".$magickey, time()+60*60*24*60 ); //60 days cookie
		}
		else
		{
			// "cookie doesn't match";
			$redirect = htmlentities($_SERVER['PHP_SELF']);
			header("Refresh: 5; URL=login.php?redirect=$redirect");
			echo "You are currently not logged in, we are redirecting you, " .
			   "be patient!<br />";
			echo "(If your browser doesn't support this, " .
			   "<a href=\"login.php?redirect=$redirect\">click here</a>)";
			die();
		}
	}
	else
	{
		// no session or cookie
		$redirect = htmlentities($_SERVER['PHP_SELF']);
		header("Refresh: 5; URL=login.php?redirect=$redirect");
		echo "You are currently not logged in, we are redirecting you, " .
		   "be patient!<br />";
		echo "(If your browser doesn't support this, " .
		   "<a href=\"login.php?redirect=$redirect\">click here</a>)";
		die();
	}
}
?>