<?php
//session_start();
session_start();
require_once("config/configDB.php");

require 'financial_year_calculation.php';



if(isset($_POST["submit"])){
    
    if(empty($_POST["username"]) || empty($_POST["password"]))  {
        
        $error = "Both fields are required.";
    }
    else {
        
        $username=$_POST['username'];
        $password=$_POST['password'];
        
        $username = stripslashes($username);
        $password = stripslashes($password);
        $username = mysqli_real_escape_string($conn, $username);
        $password = mysqli_real_escape_string($conn, $password);
        $password = ($password);
     
        $sql="SELECT * FROM user_login WHERE username='$username' and password='$password' and flag=1";
        $result=mysqli_query($conn,$sql);
        $row=mysqli_fetch_array($result,MYSQLI_ASSOC);
        
        if(mysqli_num_rows($result) == 1)
        {
            $login_user     =   $row['username'];
            $login_pk       =   $row['id'];    
            
            $_SESSION['username']      = $login_user;
            $_SESSION['user_id']       = $login_pk;
            $_SESSION['loggedin_time'] = time();
            

            if(isset($_SESSION["user_id"])) {
                if(!isLoginSessionExpired()) {

                    $rendsession               = rand(10000,100000);
                    $_SESSION['session_code']  = $rendsession;  
                    
                    $sql_update = "UPDATE user_login SET loginstatus=1, session_code='".$rendsession."' WHERE username='$username' and password='$password'";
                    
                    $_SESSION['login_status']   = "1";        
                    
                    mysqli_query($conn,$sql_update);

                    $ip  = mysqli_real_escape_string($conn, $_SERVER['REMOTE_ADDR']);
                    //$users = json_decode(file_get_contents("http://ipinfo.io/{$ip}/json"));$users->city;

                    $useragent  = mysqli_real_escape_string($conn,$_SERVER['HTTP_USER_AGENT']);
                
                    $ldstart    = date("Y-m-d H:i:s");

                    $userid     = $login_pk;
                
                    $sql_backend  = "INSERT INTO login_details(login_date_start, ip, useragent,userid,session_code) VALUES ('".$ldstart."','".$ip."','".$useragent."','".$userid."','".$rendsession."')";
                    mysqli_query($conn, $sql_backend);                    
                    header("location: welcome.php"); 
                    
                } 
                else {
                    header("Location:index.php?session_expired=1");
                }
            }
        }
        else {
            $error = "Incorrect username or password.";
            header("Location:index.php?session_expired=1");
        } 
    }
}

function isLoginSessionExpired() {
	$login_session_duration = 7200; 
	$current_time = time(); 
	if(isset($_SESSION['loggedin_time']) and isset($_SESSION["user_id"])){  
		if(((time() - $_SESSION['loggedin_time']) > $login_session_duration)){ 
			return true; 
		} 
	}
	return false;
}
 
?>