#=====================================================================
# LedgerSMB 
# Small Medium Business Accounting software
# http://www.ledgersmb.org/
# 
#
# Copyright (C) 2006
# This work contains copyrighted information from a number of sources all used
# with permission.  It is released under the GNU General Public License 
# Version 2 or, at your option, any later version.  See COPYRIGHT file for 
# details.
#
#
#======================================================================
#
# This file has undergone whitespace cleanup.
#
#======================================================================
# This package contains session related functions:
#
# check - checks validity of session based on the user's cookie and login
#
# create - creates a new session, writes cookie upon success
#
# destroy - destroys session
#
# password_check - compares the password with the stored cryted password 
#                  (ver. < 1.2) and the md5 one (ver. >= 1.2)
#====================================================================
package Session;

sub session_check {

    use Time::HiRes qw(gettimeofday);

    my ($cookie, $form) = @_;
    my ($sessionID, $transactionID, $token) = split /:/, $cookie;

    # use the central database handle
    my $dbh = ${LedgerSMB::Sysconfig::GLOBALDBH}; 

    my $checkQuery = $dbh->prepare("SELECT u.username, s.transaction_id 
                                      FROM session as s, users as u 
                                     WHERE s.session_id = ? 
                                       AND s.token = ?
                                       AND s.users_id = u.id
                                       AND s.last_used > now() - ?::interval");

    my $updateAge = $dbh->prepare("UPDATE session 
                                      SET last_used = now(),
                                          transaction_id = ?
                                    WHERE session_id = ?;");

    #must be an integer
    $sessionID =~ s/[^0-9]//g;
    $sessionID = int $sessionID;

    $transactionID =~ s/[^0-9]//g;
    $transactionID = int $transactionID;

    #must be 32 chars long and contain hex chars
    $token =~ s/[^0-9a-f]//g;
    $token = substr($token, 0, 32);

    if (!$myconfig{timeout}){
        $timeout = "1 day";
    } else {
        $timeout = "$myconfig{timeout} seconds";
    }

    $checkQuery->execute($sessionID, $token, $timeout) 
        || $form->dberror(__FILE__.':'.__LINE__.': Looking for session: ');
    my $sessionValid = $checkQuery->rows;

    if($sessionValid){

        #user has a valid session cookie, now check the user
        my ($sessionLogin, $sessionTransaction) = $checkQuery->fetchrow_array;

        my $login = $form->{login};
        $login =~ s/[^a-zA-Z0-9._+@'-]//g;

        if(($sessionLogin eq $login) and ($sessionTransaction eq $transactionID)){

            #microseconds are more than random enough for transaction_id
            my ($ignore, $newTransactionID) = gettimeofday();

            $newTransactionID = int $newTransactionID;
    
            $updateAge->execute($newTransactionID, $sessionID) 
                || $form->dberror(__FILE__.':'.__LINE__.': Updating session age: ');

            $newCookieValue = $sessionID . ':'.$newTransactionID.':' . $token;

            #now update the cookie in the browser
            print qq|Set-Cookie: LedgerSMB=$newCookieValue; path=/;\n|;
            return 1;

        } else {
            #something's wrong, they have the cookie, but wrong user or the wrong transaction id. Hijack attempt?
            #destroy the session
            my $sessionDestroy = $dbh->prepare("");

            #delete the cookie in the browser
            print qq|Set-Cookie: LedgerSMB=; path=/;\n|;
            return 0;
        }
    
    } else {
        #cookie is not valid
        #delete the cookie in the browser
        print qq|Set-Cookie: LedgerSMB=; path=/;\n|;
        return 0;
    }
}

sub session_create {

    use Time::HiRes qw(gettimeofday);

    #microseconds are more than random enough for transaction_id