<?php

class realmd{

    var $db;
    var $id;

    FUNCTION __construct($db, $link) {

        $this->db = $db;
        $this->id = $link;

    }

    FUNCTION membership() {

        IF(isset($_POST['login_username']) && isset($_POST['login_password']) && !isset($_SESSION['username'])) { $this->login($_POST['login_username'], $_POST['login_password']); }

        IF(!isset($_SESSION['username'])) {

            $output = '<form method="post" action="?p=home" style="text-align:center;">
                  <input name="login_username" type="text" value="Username" onFocus="this.value=\'\'"/>
                <br />
                <input name="login_password" type="password" value="Password" onFocus="this.value=\'\'"/>
                <br />
                  <input type="submit" value="Login" />
              </form><br />
              <center>No account? <a href="?p=register">Create one here!</a></center>';

        } ELSE {

            $info = mysql_query("SELECT * FROM ".$this->db.".account WHERE username = '".$_SESSION['username']."'", $this->id);
            $info_row = mysql_fetch_assoc($info);

            $_SESSION['shoutboxnick'] = $info_row['nickname'];

            $exp[0] = "None";
            $exp[1] = "TBC";
            $exp[2] = "WoTLK";

            $ingame[0] = "<span style='color:red;'>No</span>";
            $ingame[1] = "<span style='color:green;'>Yes</span>";

            $rank[0] = "Player";
            $rank[1] = "GM Helper";
            $rank[2] = "GameMaster";
            $rank[3] = "Admin";
            $rank[4] = "Owner";

            IF($_SESSION['rank'] >= 3) {
                $acp = '<tr>
                <td>&bull; <a href="?p=admin">Admin panel</a></td>
                </tr>';
            } ELSE { $acp = ""; }

            $output = '<center>Welcome <b>'.$_SESSION['username'].'</b>! [<a href="?p=logout">Logout</a>]<br /><br />
            <table>
                <tr>
                    <td><b>Flags: </b></td>
                    <td>'.$exp[$info_row['expansion']].'</td>
                </tr>
                <tr>
                    <td><b>Email: </b></td>
                    <td>'.$info_row['email'].'</td>
                </tr>
                <tr>
                    <td><b>Last IP: </b></td>
                    <td>'.$info_row['last_ip'].'</td>
                </tr>
                <tr>
                    <td><b>Current IP: </b></td>
                    <td>'.$_SERVER['REMOTE_ADDR'].'</td>
                </tr>
                <tr>
                    <td><b>Online: </b></td>
                    <td>'.$ingame[$info_row['online']].'</td>
                </tr>
                    <tr>
                    <td><b>Rank: </b></td>
                    <td>'.$rank[$_SESSION['rank']].'</td>
                </tr>

                <tr>
                    <td><b>Vp: </b></td>
                    <td>'.$info_row['vp'].'</td>
                </tr>

                <tr>
                    <td><b>Dp: </b></td>
                    <td>'.$info_row['dp'].'</td>
                </tr>

                <tr>
                    <td><b>Sb Nick: </b></td>
                    <td>'.$_SESSION['shoutboxnick'].'</td>
                </tr>


            </table><br />

            <table width="90%">
                <tr>
                <td><b>Account tools</b></td>
                </tr>
                <tr>
                <td>&bull; <a href="?p=changepw">Change password</a></td>
                </tr>

                <tr>
                <td>&bull; <a href="?p=changeexp">Change expansions</a></td>
                </tr>

                <tr>
                <td>&bull; <a href="?p=unstuck">Unstuck character</a></td>
                </tr>

                <tr>
                <td>&bull; <a href="?p=changenick">Change Shoutbox Nickname</a></td>
                </tr>

                <tr>
                <td>&bull; <a href="?p=vote">Vote</a></td>
                </tr>

                <tr>
                <td>&bull; <a href="?p=donate">Donate</a></td>
                </tr>

                <tr>
                <td>&bull; <a href="?p=shop">Item shop</a></td>
                </tr>

                '.$acp.'

                <tr>
                <td>Realmlist: <b>logon.unforgivenwow.com</b></td>
                </tr>
            </table>
            </center>';

        }

        echo $output;

    }

    FUNCTION login($user, $pass) {

        $userx = @mysql_query("SELECT username, sha_pass_hash, id FROM ".$this->db.".account WHERE username = '".$user."' LIMIT 1", $this->id);
        $user_row = @mysql_fetch_assoc($userx);

        $user_u = strtoupper($user);
        $pass_u = strtoupper($pass);
        $hashedpw = sha1($user_u.':'.$pass_u);

        $output = '<center>';

        IF(empty($user) || empty($pass)) {
            $output .= 'One or more fields wasn\'t filled!';
        }

        elseif(empty($user_row['username'])) {
            $output .= 'User doesn\'t exist!';
        }

        elseif($hashedpw != $user_row['sha_pass_hash']) {
            $output .= 'Wrong password!';
        }

        ELSE {

            $rank = @mysql_query("SELECT * FROM ".$this->db.".account_access WHERE id = '".$user_row['id']."' LIMIT 1", $this->id);
            $rank_row = @mysql_fetch_assoc($rank);

            $_SESSION['username'] = $user;

            IF(empty($rank_row['gmlevel'])) {
                $_SESSION['rank'] = 0;
            } ELSE {
                $_SESSION['rank'] = $rank_row['gmlevel'];
            }

            die("<script type='text/javascript'>window.location='?p=home'</script>You are being redirected, press <a href='?p=home'>here</a> if you don't wish to wait!");
        }

        $output .= '</center>';

        echo $output;
    }

    FUNCTION register() {
        global $realmlist;

        $one = rand(1, 15);
        $two = rand(1, 15);

        $output = '<div class="midbox"><div class="midbox_top">Account creation</div>
            <div class="midbox_content">
            <form action="?p=register" method="post">';

        IF(isset($_POST['reg_username'])) {
            $output .= realmd::reg_acc();
        }

        $output .= '<center>
                                <img src="images/ca.png" border="0">
                                <br />
                <input type="text" name="reg_username" value="Username" onFocus="this.value=\'\'"/><br />
                <input type="password" name="reg_password" value="Password" onFocus="this.value=\'\'"/><br />
                <input type="text" name="reg_email" value="yourname@server.com" onFocus="this.value=\'\'"/><br />
                <label for="reg_flags">Expansion:</label>
                <select name="reg_flags">
                <option value="2">WoTLK</option>
                <option value="1">TBC</option>
                <option value="0">None</option>
                </select><br /><br /><br />
                <input type="hidden" name="reg_ans" value="'.($one+$two).'" />
                <input type="text" name="reg_antibot" value="Anti-bot: What is '.$one.' + '.$two.'?" onFocus="this.value=\'\'"/><br />
                <br />
                <input type="submit" value="Create account!"/><br /><br />
                <b>set realmlist '.$realmlist.'</b>
            </center>
            </form>
            </div>
            </div>';

        echo $output;

    }

    FUNCTION reg_acc() {

        $userx = @mysql_query("SELECT username, id FROM ".$this->db.".account WHERE username = '".mysql_real_escape_string($_POST['reg_username'])."' LIMIT 1", $this->id);
        $user_row = @mysql_fetch_assoc($userx);

        $output = "<center>";

        IF(isset($_SESSION['username'])) {
            $output .= "You're already logged in!";
        }

        elseif(filter_var($_POST['reg_email'], FILTER_VALIDATE_EMAIL) == FALSE) {
            $output .= "Invalid email!";
        }

        elseif(isset($user_row['id'])) {
            $output .= "User already exists!";
        }

        elseif($_POST['reg_antibot'] != $_POST['reg_ans']) {
            $output .= "Wrong anti-bot answear!";
        }

        ELSE {
            $username = mysql_real_escape_string($_POST['reg_username']);
            $pass = mysql_real_escape_string($_POST['reg_password']);
            $email = mysql_real_escape_string($_POST['reg_email']);
            $flags = mysql_real_escape_string($_POST['reg_flags']);

            $pw = sha1(strtoupper($username).':'.strtoupper($pass));

              mysql_query("INSERT INTO ".$this->db.".account(`username`, `sha_pass_hash`, `email`, `expansion`, `nickname` ) VALUES('".$username."', '".$pw."', '".$email."', '".$flags."','".$username."' )", $this->id) OR die(mysql_error());

            $_SESSION['shoutboxnick'] = $username;

            $output .= "<span style='color:green;'>Account was created successfully!</span>";
        }

        $output .= "</center>";

        RETURN $output;
    }

    FUNCTION xml_status() {

        $query = mysql_query("SELECT COUNT(*) AS total FROM ".$this->db.".account", $this->id);
        $row = mysql_fetch_assoc($query);
        $total = $row['total'];

        $xml = '

<accounts>'.$total.'</accounts>';


        RETURN $xml;

    }

    FUNCTION CHANGE($what) {

        $output = '<div class="midbox"><div class="midbox_top">Change '.$what.'</div>
            <div class="midbox_content"><center><br />';

        switch($what) {

        CASE "password":

            $output .= '<form action="?p=changepw" method="post">
            New password:<br />
                <input name="newpw" type="password" value="password" onFocus="this.value=\'\'"  /><br /><br />
                <input type="submit" value="Change it!" />
                </form>';

            IF(isset($_POST['newpw'])) {
                $acc = $_SESSION['username'];
                $pw = mysql_real_escape_string($_POST['newpw']);

                $pw = sha1(strtoupper($acc).':'.strtoupper($pw));

                mysql_query("UPDATE ".$this->db.".account SET sha_pass_hash='$pw' WHERE username='$acc'", $this->id) OR die(mysql_error());

                $output .= "<br /><center>Your password was successfully changed to <b>".$_POST['newpw']."</b>!</center>";
            }

        break;

        CASE "nickname":

            $output .= '<form action="?p=changenick" method="post">
            New NickName:<br />
                <input name="newnick" type="text" value="NickName" onFocus="this.value=\'\'"  /><br /><br />
                <input type="submit" value="Change it!" />
                </form>';

            IF(isset($_POST['newnick'])) {
                $acc = $_SESSION['username'];
                $chosennickname = mysql_real_escape_string($_POST['newnick']);
                //CHECK IF nickname already EXISTS
                $doublecheck = mysql_query("SELECT nickname from ".$this->db.".account");
                $doublecheck_a = mysql_fetch_assoc($doublecheck);

                IF ($chosennickname == $doublecheck_a) {
                    die("<script>alert(\"This Nickname already exists.\");</script>");
                }

                IF ( strlen($chosennickname) >=14) {
                    die("<script>alert(\"The nickname you chose is to long.\");</script>");

                }

                require_once("config.php");
                $filterlength = COUNT($filter);

                FOR ($i=1; $i<=$count; $i++)
                 {
                    $chosenickname == $filter[$i];
                    die();

                 }

                $_SESSION['shoutboxnick'] = $chosennickname;
                mysql_query("UPDATE ".$this->db.".account SET nickname='$chosennickname' WHERE username='$acc'", $this->id) OR die(mysql_error());

                $output .= "<br /><center>Your Nickname was successfully changed to <b>".$_POST['newnick']."</b>!</center>";
            }

        break;

        CASE "expansion":
            $output .= '<form action="?p=changeexp" method="post">
            New expansion:<br />
                <select name="newexp">
                <option value="2">WoTLK</option>
                <option value="1">TBC</option>
                <option value="0">None</option>
                </select>
                <br /><br />
                <input type="submit" value="Change it!" />
                </form>';

            IF(isset($_POST['newexp'])) {
                $acc = $_SESSION['username'];
                $exp = mysql_real_escape_string($_POST['newexp']);


                mysql_query("UPDATE ".$this->db.".account SET expansion='$exp' WHERE username='$acc'", $this->id) OR die(mysql_error());

                $output .= "<br /><center>Your expansion was successfully changed!</center>";
            }
        break;

        }

        $output .= "</center></div></div>";

        echo $output;

    }
}

?>