<?php
//Load time function (in footer)
$time = microtime(true);
$time = explode(' ', $time);
$time = $time[1] + $time[0];
$start = $time;
$accounttype = $_POST["accounttype"];
$accounttypenew = $_POST["accounttypenew"];
$hash = $_POST["hash"];
$hashnew = $_POST["hashnew"];
	if(isset($hashnew)) {
								?>
								<script language="JavaScript">
									location.replace("premium.Login.<?php echo $hashnew;?>");
								</script>
								<?php
	}
	if($accounttype == 'admin') {
		//ADMIN
		$adminhash1 = "SELECT `admin` FROM `Web_Premium_Login` WHERE `id` = '1'";
		$adminhash2 = mysql_query($adminhash1) or die($adminhash1."<br/><br/>".mysql_error());
		$adminhash3 = mysql_result($adminhash2, 0);
		if($hash != $adminhash3) {
			die('bad hash');
		}
	}elseif($accounttype == 'support') {
		//SUPPORT
		$supporthash1 = "SELECT `support` FROM `Web_Premium_Login` WHERE `id` = '1'";
		$supporthash2 = mysql_query($supporthash1) or die($supporthash1."<br/><br/>".mysql_error());
		$supporthash3 = mysql_result($supporthash2, 0);
		if($hash != $supporthash3) {
			die('bad hash');
		}
	}elseif($accounttype == 'payments') {
		//PAYMENTS
		$paymentshash1 = "SELECT `payments` FROM `Web_Premium_Login` WHERE `id` = '1'";
		$paymentshash2 = mysql_query($paymentshash1) or die($paymentshash1."<br/><br/>".mysql_error());
		$paymentshash3 = mysql_result($paymentshash2, 0);
		if($hash != $paymentshash3) {
			die('bad hash');
		}
	}

if ( isset( $_POST[ 'field' ] ) )
{
    try
    {
        // Run CSRF check, on POST data, in exception mode, for 10 minutes, in one-time mode.
        NoCSRF::check( 'csrf_token', $_POST, true, 60*10, false );
        // form parsing, DB inserts, etc.
        // ...
        $result = 'CSRF check passed. Form parsed.';
    }
    catch ( Exception $e )
    {
        // CSRF attack detected
        echo"<script type='text/javascript'>javascript: window.history.go(-1);</script>";
    }
}
else
{
    $result = 'No post data yet.';
}

if ( isset( $_POST[ 'submit' ] ) )
{
    try
    {
        // Run CSRF check, on POST data, in exception mode, for 10 minutes, in one-time mode.
        NoCSRF::check( 'csrf_token', $_POST, true, 60*10, false );
        // form parsing, DB inserts, etc.
        // ...
        $result = 'CSRF check passed. Form parsed.';
    }
    catch ( Exception $e )
    {
        // CSRF attack detected
        echo"<script type='text/javascript'>javascript: window.history.go(-1);</script>";
    }
}
else
{
    $result = 'No post data yet.';
}

if (isset($_POST['submit'])) {

$username = mysql_real_escape_string($_POST['username']);
$username = AntiXSS::setEncoding($username, "UTF-8");
$username = str_replace('"','',$username);
$username = str_replace("'","",$username);
$username = str_replace(">","",$username);
$username = str_replace("<","",$username);
$username = str_replace("</","",$username);
$username = str_replace("&%","",$username);
$username = str_replace("script","",$username);
$username = str_replace("(","",$username);
$username = str_replace(")","",$username);
$password = mysql_real_escape_string(md5($_POST['password']));
$password = AntiXSS::setEncoding($password, "UTF-8");
$password = str_replace('"','',$password);
$password = str_replace("'","",$password);
$password = str_replace(">","",$password);
$password = str_replace("<","",$password);
$password = str_replace("</","",$password);
$password = str_replace("&%","",$password);
$password = str_replace("script","",$password);
$password = str_replace("(","",$password);
$password = str_replace(")","",$password);
$username = AntiXSS::setEncoding($username, "UTF-8"); 
$password = AntiXSS::setEncoding($password, "UTF-8"); 
$pin = $_POST['pin1'].$_POST['pin2'].$_POST['pin3'].$_POST['pin4'];

if($accounttype == 'admin') {
	$selecttype = mysql_query("SELECT * FROM Accounts_Premium_Admin WHERE username='$username' AND pincode='$pin'");
	$pubrows = mysql_num_rows($selecttype);
	if($pubrows == '1') {
		$acctype = 'admin';
	}
	// IF USERNAME AND PASSWORD WERE ENTERED 
	if ($username&&$password)
	{
	
	if($acctype == '') {
	// ACCOUNT WITH THIS USERNAME NOT FOUND
	 							?>
								<script language="JavaScript">
									location.replace("premium.Login.<?php echo $hash;?>?adminnotfound");
								</script>
								<?php
	}
	}
}
if($accounttype == 'support') {
	$selecttypeadv = mysql_query("SELECT * FROM Accounts_Premium_Support WHERE username='$username' AND pincode='$pin' AND status='1'");
	$advrows = mysql_num_rows($selecttypeadv);
	if($advrows == '1') {
		$acctype = 'support';
	}
	// IF USERNAME AND PASSWORD WERE ENTERED 
	if ($username&&$password)
	{
	
	if($acctype == '') {
	// ACCOUNT WITH THIS USERNAME NOT FOUND
	 							?>
								<script language="JavaScript">
									location.replace("premium.Login.<?php echo $hash;?>?supportnotfound");
								</script>
								<?php
	}
	}
}

if($accounttype == 'payments') {
	$selecttypeadv = mysql_query("SELECT * FROM Accounts_Premium_Payments WHERE username='$username' AND pincode='$pin' AND status='1'");
	$advrows = mysql_num_rows($selecttypeadv);
	if($advrows == '1') {
		$acctype = 'payments';
	}
	// IF USERNAME AND PASSWORD WERE ENTERED 
	if ($username&&$password)
	{
	
	if($acctype == '') {
	// ACCOUNT WITH THIS USERNAME NOT FOUND
	 							?>
								<script language="JavaScript">
									location.replace("premium.Login.<?php echo $hash;?>?paymentsnotfound");
								</script>
								<?php
	}
	}
}

if($acctype == 'admin') {
		$username = AntiXSS::setEncoding($username, "UTF-8"); 
		$query = mysql_query("SELECT * FROM Accounts_Premium_Admin WHERE username='$username' AND pincode='$pin'");
		$numrows = mysql_num_rows($query);

			if ($numrows!=0)
			{
				 while ($row = mysql_fetch_assoc($query))
				  {
					     $dbusername = $row['username'];
					     $dbpassword = $row['password'];
				   }

					  // CHECK TO SEE IF THEY MATCH!
				  if ($username==$dbusername&&$password==$dbpassword)
				  {
									$_SESSION['username'] = $username;
                           $_SESSION['password'] = $password;
                           $_SESSION['acctype'] = 'admin';
                           $_SESSION['hash'] = $hash;
									?>
									<script language="JavaScript">
										location.replace("admin.Dashboard");
									</script>
									<?php
				  }
				  else  
				  // PASSWORD IS INCORECT
					  { 
					  			?>
								<script language="JavaScript">
									location.replace("premium.Login.<?php echo $hash;?>?usernamenotfound");
								</script>
								<?php
					  }
 
			}
			// USERNAME NOT FOUND
			else{
			  					?>
								<script language="JavaScript">
									location.replace("premium.Login.<?php echo $hash;?>?usernamenotfound");
								</script>
								<?php
			}

}
if($acctype == 'support') {
		$username = AntiXSS::setEncoding($username, "UTF-8"); 
		$query = mysql_query("SELECT * FROM Accounts_Premium_Support WHERE username='$username' AND pincode='$pin' AND status='1'");
		$numrows = mysql_num_rows($query);

			if ($numrows!=0)
			{
				 while ($row = mysql_fetch_assoc($query))
				  {
					     $dbusername = $row['username'];
					     $dbpassword = $row['password'];
				   }

					  // CHECK TO SEE IF THEY MATCH!
				  if ($username==$dbusername&&$password==$dbpassword)
				  {
									$_SESSION['username'] = $username;
                           $_SESSION['password'] = $password;
                           $_SESSION['acctype'] = 'support';
                           $_SESSION['hash'] = $hash;
									?>
									<script language="JavaScript">
										location.replace("support.Dashboard");
									</script>
									<?php
				  }
				  else  
				  // PASSWORD IS INCORECT
					  { 
					  			?>
								<script language="JavaScript">
									location.replace("premium.Login.<?php echo $hash;?>?usernamenotfound");
								</script>
								<?php
					  }
 
			}
			// USERNAME NOT FOUND
			else{
			  					?>
								<script language="JavaScript">
									location.replace("premium.Login.<?php echo $hash;?>?usernamenotfound");
								</script>
								<?php
			}

}
if($acctype == 'payments') {
		$username = AntiXSS::setEncoding($username, "UTF-8"); 
		$query = mysql_query("SELECT * FROM Accounts_Premium_Payments WHERE username='$username' AND pincode='$pin' AND status='1'");
		$numrows = mysql_num_rows($query);

			if ($numrows!=0)
			{
				 while ($row = mysql_fetch_assoc($query))
				  {
					     $dbusername = $row['username'];
					     $dbpassword = $row['password'];
				   }

					  // CHECK TO SEE IF THEY MATCH!
				  if ($username==$dbusername&&$password==$dbpassword)
				  {
									$_SESSION['username'] = $username;
                           $_SESSION['password'] = $password;
                           $_SESSION['acctype'] = 'payments';
                           $_SESSION['hash'] = $hash;
									?>
									<script language="JavaScript">
										location.replace("payments.Dashboard");
									</script>
									<?php
				  }
				  else  
				  // PASSWORD IS INCORECT
					  { 
					  			?>
								<script language="JavaScript">
									location.replace("premium.Login.<?php echo $hash;?>?usernamenotfound");
								</script>
								<?php
					  }
 
			}
			// USERNAME NOT FOUND
			else{
			  					?>
								<script language="JavaScript">
									location.replace("premium.Login.<?php echo $hash;?>?usernamenotfound");
								</script>
								<?php
			}

}else{
	 							?>
								9
								<?php
	 	}
}

?>
<!DOCTYPE html>
<html lang="en"><head>
  <meta charset="utf-8">
  <title><?php echo"$title"?></title>
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <meta name="title" content="<?php echo $sa['title']; ?>">
  <meta name="description" content="<?php echo $sa['description']; ?>">
  <meta name="author" content="Jozef Vojtáš" >
  <link rel="icon" type="image/png" href="<?php echo $iconurl; ?>">
  
  <!-- Google Web Font -->
  <link href="http://fonts.googleapis.com/css?family=Open+Sans:300,300italic,700&subset=latin,latin-ext" rel="stylesheet" type="text/css">
  
  <!-- Bootstrap 3 Plan styles -->
  <link id="plan-theme" href="data/templates/frontend/superhero/assets/css/bootstrap.css" rel="stylesheet">
  <link href="data/templates/frontend/superhero/assets/fonts/font-awesome.css" rel="stylesheet" type="text/css" />

  <!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries -->
  <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
    <script src="https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js"></script>
  <![endif]-->

  <!-- Docs Custom styles -->
  <style>

    body {
      padding: 120px 0 0 0; 
    }
    footer {
      background-color: white;
      border-top: 1px solid #ddd;
      padding: 30px;
      margin-top: 50px;
    }  
    .row > [class*="col-"] {
      margin-bottom: 30px;
    }
    .navbar-container {
      position: relative;
      min-height: 100px;
    }
    .navbar-container .navbar.navbar-fixed-top,
    .navbar-container .navbar.navbar-fixed-bottom {
      position: absolute;
      top: 50px;
      z-index: 0;
    }
    .navbar-container .navbar.navbar-fixed-top .container,
    .navbar-container .navbar.navbar-fixed-bottom .container {
      max-width: 90%;
    }
    .btn-group {
      margin-bottom: 10px
    }
    .form-inline select, 
    .form-inline input[type="text"], 
    .form-inline input[type="password"] {
      width: 180px;
    }
    .input-group {
      margin-bottom: 10px;
    }
    .pagination { margin-top :0;}
    .navbar-inverse {margin: 110px 0} 
    input[type=number]::-webkit-outer-spin-button,
	 input[type=number]::-webkit-inner-spin-button {
    	-webkit-appearance: none;
    	margin: 0;
	 }

	 input[type=number] {
    	-moz-appearance:textfield;
	 }
	 input[type="radio"].toggle {
    display: none;
}

input[type="radio"].toggle:checked + label {
    background-color: #3B4B5C;
    cursor: default;
    color: #E6E6E6;
    border-color: transparent;
    text-shadow: 0 1px 1px rgba(40, 40, 40, 0.75);
}

input[type="radio"].toggle + label {
    width: 20%;
}

input[type="radio"].toggle:checked + label.btn:hover {
    background-color: #445260;
    background-position: 0 0;
    -webkit-transition: none;
    -moz-trainsition: none;
    transition: none;
}

input[type="radio"].toggle-left + label {
    border-right: 0;
    -webkit-border-top-right-radius: 0;
    -webkit-border-bottom-right-radius: 0;
    -moz-border-top-right-radius: 0;
    -moz-border-bottom-right-radius: 0;
    border-top-right-radius: 0;
    border-bottom-right-radius: 0;
}

input[type="radio"].toggle-right + label {
    -webkit-border-top-left-radius: 0;
    -webkit-border-bottom-left-radius: 0;
    -moz-border-top-left-radius: 0;
    -moz-border-bottom-left-radius: 0;
    border-top-left-radius: 0;
    border-bottom-left-radius: 0;
}
  </style>
  
</head>

<body>

  <nav class="navbar navbar-inverse navbar-fixed-top" role="navigation" style="margin: 0"><!-- WHITE navbar-superhero -->
    <div class="container">
		<?php 
  		if($showicon == '1') { 
  		?>
			<a class="navbar-brand" href="f.home"><img style="margin-top: -6px; height: 35px;" src="<?php echo $iconurl; ?>"></a>
		<?php
		}
  		if($showtitle == '1') { 
  		?>
			<a class="navbar-brand" href="f.home"><?php echo"$title"?></a>
		<?php
		}
		?>
      <!-- Brand and toggle get grouped for better mobile display -->
      <div class="navbar-header navbar-right">
        <button type="button" class="navbar-toggle" data-toggle="collapse" data-target="#main-nav">
          <span class="sr-only">Toggle navigation</span>
          <span class="icon-bar"></span>
          <span class="icon-bar"></span>
          <span class="icon-bar"></span>
        </button>
      </div>

      <!-- Collect the nav links, forms, and other content for toggling -->
      <div class="collapse navbar-collapse" id="main-nav">
        <ul class="nav navbar-nav">
          <li>
            <a href="f.home">< Back to website</a>
          </li>
        </ul>
		<ul class="nav navbar-nav navbar-right">
			<li class="dropdown">
				<a href="#" class="dropdown-toggle" data-toggle="dropdown"><i class="fa fa-language"></i> <b class="caret"></b></a>
				<ul class="dropdown-menu">
					<li><a href="language.english">English</a></li>
					<li><a href="language.slovak">Slovak</a></li>
					<li><a href="language.german">German</a></li>
					<li><a href="language.chinese">Chinese</a></li>
					<li><a href="language.portuguese">Portuguese</a></li>
					<li><a href="language.russian">Russian</a></li>
					<li><a href="language.czech">Czech</a></li>
					<li><a href="language.spanish">Spanish</a></li>
					<li><a href="language.french">French</a></li>
					<li><a href="language.arabic">Arabic</a></li>
					<li><a href="language.croatian">Croatian</a></li>
					<li><a href="language.danish">Danish</a></li>
					<li><a href="language.hungarian">Hungarian</a></li>
					<li><a href="language.italian">Italian</a></li>
					<li><a href="language.japanese">Japanese</a></li>
					<li><a href="language.polish">Polish</a></li>
					<li><a href="language.slovenian">Slovenian</a></li>
					<li><a href="language.swedish">Swedish</a></li>
				</ul>
			</li> 
			<li>
				<a data-toggle="modal" href="#switch"> <i class="fa fa-sign-in"></i> Switch to: <?php
				if($accounttype != 'admin') {echo 'Admin or ';}
				if($accounttype != 'support') {echo 'Supporter or ';}
				if($accounttype != 'payments') {echo 'Payments Manager';}
				?></a>
			</li>
		</ul>
      </div><!-- /.navbar-collapse -->
    </div>
  </nav>