<?php
/*----------------------------------------
| CLASS FOR CRYPT AND ENCRYPT
----------------------------------------*/
// Check for Security
if ( !defined('HCR') )
{
print "<h1>Incorrect Access</h1>";
exit();
}
class crypter
{
private $secu_code_arr = array(
"start" => "a",
"end" => "z",
);
private $pass_min_length = 6;
private $key_length = 32;
private $encode_key = "e9c495f4b4271113dc1e546cbf04224b"; //Not change
private $encode_arr = array( //Not change
" ", "0", "1", "2", "3",
"4", "5", "6", "7", "8",
"9", "a", "b", "c", "d",
"e", "f", "g", "h", "i",
"j", "k", "l", "m", "n",
"o", "p", "q", "r", "s",
"t", "u", "v", "w", "x",
"y", "z", "A", "B", "C",
"D", "E", "F", "G", "H",
"I", "J", "K", "L", "M",
"N", "O", "P", "Q", "R",
"S", "T", "U", "V", "W",
"X", "Y", "Z", "@",
);
/*-----------------------------------------------------
| CREATE RANDOM KEY
+ ---------------------------------------------------*/
function random_key($number)
{
$arr_sum = array();
$arr_num = array();
$arr_char = array();
$arr_num = range("0", "9");
$arr_char = range($this->secu_code_arr['start'], $this->secu_code_arr['end']);
$arr_sum = array_merge($arr_num, $arr_char);
$rand = '';
for($i = 0; $i < $number; $i++)
{
$key = array_rand($arr_sum);
$rand .= $arr_sum[$key];
}
return $rand;
}
/*-----------------------------------------------------
| CREATE A SECURITY CODE
+ ---------------------------------------------------*/
function security_code($number)
{
// Lay ngau nhien tu 0-9, A-Z
$this->secu_code_arr['start'] = "A";
$this->secu_code_arr['end'] = "Z";
return $this->random_key($number);
}
/*-----------------------------------------------------
| COMPILE A SECURITY CODE TO PRINT IN SCREEN
+ ---------------------------------------------------*/
function print_screen($code)
{
$str_print = "";
for($i = 0; $i < strlen($code); $i++)
{
$str = substr($code, $i,1);
$str_print .= $str.'';
}
return $str_print;
}
/*-----------------------------------------------------
| CREATE KEY FOR CRYPT A PASSWORD
+ ---------------------------------------------------*/
function set_key()
{
// Lay ngau nhien tu 0-9, a-z
$this->secu_code_arr['start'] = "a";
$this->secu_code_arr['end'] = "z";
return $this->random_key($this->key_length);
}
/*-----------------------------------------------------
| FILL IN MISSING CHAR BY RANDOM CHAR
|
| This help Vernam encrypt be true
+ ---------------------------------------------------*/
function get_true_vernam($text)
{
// Just encrypt chars in encode_arr
$text_arr = str_split($text);
$text = "";
foreach ($text_arr as $k => $v)
{
$yes = false;
foreach ($this->encode_arr as $value)
{
if ($v == $ $value)
{
$yes = true;
break;
}
}
if ($yes) $text .= $text_arr[$k];
}
// strlen($key) = strlen($password) = key_length
if ( strlen($text) < $this->key_length)
{
$text .= "@";
while ( strlen($text) < $this->key_length) $text .= $this->random_key(1);
if ( strlen($text) > $this->key_length) $text = substr($text,0,$this->key_length);
}
return $text;
}
/*-----------------------------------------------------
| ENCODE TEXT USING VERNAM ALGORITHM
+ ---------------------------------------------------*/
function vernam($text, $key)
{
// Be sure $text and $key are valid
$text = $this->get_true_vernam($text);
$key = $this->get_true_vernam($key);
$text_arr = str_split($text);
$key_arr = str_split($key);
$code_text = "";
for ($i = 0; $i < $this->key_length; $i++)
{
$text_int = 0;
while ( ($text_arr[$i] != $this->encode_arr[$text_int]) && ($text_int < count($this->encode_arr)) ) $text_int++;
$key_int = 0;
while ( ($key_arr[$i] != $this->encode_arr[$key_int]) && ($key_int < count($this->encode_arr)) ) $key_int++;
$code_int = $text_int + $key_int;
if ( $code_int > count($this->encode_arr) ) $code_int -= count($this->encode_arr);
$code_text .= $this->encode_arr[$code_int];
}
return $code_text;
}
/*-----------------------------------------------------
| DECODE TEXT HAD BEEN ENCODE WITH VERNAM ALGORITHM
+ ---------------------------------------------------*/
function devernam($text, $key)
{
$text = $this->get_true_vernam($text);
$key = $this->get_true_vernam($key);
$text_arr = str_split($text);
$key_arr = str_split($key);
$code_text = "";
for ($i = 0; $i < $this->key_length; $i++)
{
$text_int = 0;
while ( ($text_arr[$i] != $this->encode_arr[$text_int]) && ($text_int < count($this->encode_arr)) ) $text_int++;
$key_int = 0;
while ( ($key_arr[$i] != $this->encode_arr[$key_int]) && ($key_int < count($this->encode_arr)) ) $key_int++;
$code_int = $text_int - $key_int;
if ( $code_int < 0 ) $code_int += count($this->encode_arr);
$code_text .= $this->encode_arr[$code_int];
}
return $code_text;
}
/*-----------------------------------------------------
| ENCODE PASSWORD BY VERNAM ALGORITHM
+ ---------------------------------------------------*/
function crypt_password($password, $key)
{
// Encode keyword
$key = $this->vernam($key, $this->encode_key);
// Encode password
return $this->vernam($password, $key);
}
/*-----------------------------------------------------
| DECODE PASSWORD HAD BEEN ENCODE BY VERNAM
+ ---------------------------------------------------*/
function decrypt_password($password, $key)
{
$key = $this->vernam($key, $this->encode_key);
$text = $this->devernam($password, $key);
$password_arr = explode("@", $text);
return $password_arr[0];
}
}
?>

<?php
/*------------------------------------
| LOGIN TO ADMIN PANEL
------------------------------------*/
// Check for Security
if ( !defined('HCR') )
{
print "<h1>Incorrect Access</h1>";
exit();
}
$cnt = new content;
class content
{
public $text = "";
public $title = "WEBSITE CONTROL PANEL";
private $process = "";
private $frmValue = array(
'password' => '',
'username' => '',
);
private $error = array(
'username' => 0,
'password' => 0,
);
private $warning = "";
function __construct()
{
global $str, $sess, $lang, $panel;
if ($sess->member_id) $sess->destroy();
$this->get_input();
$check_input = $this->check_input( $this->frmValue );
if ( $this->process == "login" )
{
if ($check_input)
{
if ($this->login($this->frmValue))
{
$str->goto_url('admp.php');
}
else
{
$this->warning = " <span class='span_err'>". $lang['login_notmatch'] ."</span><br/><br/>";
}
}
else
{
$this->warning = "<span class='span_err'>". $lang['login_error'] ."</span><br/><br/>";
}
}else
{
//Reset Error Array
$this->error['username'] = 0;
$this->error['password'] = 0;
}
$this->text = $this->warning ? "<div id='warning'><b><u>Lỗi nhập liệu</u></b> : " . $this->warning . "</div>" . $this->box_login() : $this->box_login();
}
/*---------------------------------------------
| GET INPUT DATA
+----------------------------------------------*/
function get_input()
{
global $str;
$this->process = isset($_POST['process']) ? $str->input($_POST['process']) : "";
$this->frmValue['username'] = isset($_POST['username']) ? $str->input($_POST['username']) : "";
$this->frmValue['password'] = isset($_POST['password']) ? $_POST['password'] : "";
}
/*--------------------------------------------------
| CHECK INPUT DATA
+--------------------------------------------------*/
function check_input($frmValue)
{
global $frm, $main, $sess, $db, $str;
$no_error = true;
if ( !$frm->check_username($frmValue['username'], 3) )
{
$this->error['username'] = 1;
$no_error = false;
}
if ( !$frm->check_password($frmValue['password'], 6, 32) )
{
$this->error['password'] = 1;
$no_error = false;
}
return $no_error;
}
/*-------------------------------------------
| CHECK INFOS AND AUTHENTICATE FOR LOGIN
+--------------------------------------------*/
function login($frmValue)
{
global $str, $frm, $db, $sess, $lang, $crypt, $main;
if ( $sess->member_id ) $sess->destroy();
$tmp_username = stripslashes($frmValue['username']);
$tmp_password = stripslashes($frmValue['password']);
$query = $db->simple_select("username, password, login_key, id, groups", "adm_members", "username = '". mysql_real_escape_string($tmp_username) ."' AND active = 1");
$result = $db->query($query);
$row = $db->fetch_array($result);
if ( !$row['password'] ) return false;
$password = $crypt->decrypt_password($row['password'], $row['login_key'], 32);
if ($password != $tmp_password) return false;
if (strcmp($row['username'], $tmp_username) <> 0 ) return false;
// Update to session
$sess->member_id = $row['id'];
$sess->username = $frmValue['username'];
$sess->groups_id = $row['groups'];
$arr = array(
'username' => $sess->username,
'member_id' => $sess->member_id,
'groups_id' => $sess->groups_id,
);
$db->do_update("session", $arr, "id = '". $sess->sess_id ."'");
// Update last visit
$arr = array( 'last_visit' => $sess->now );
$db->do_update("adm_members", $arr, "id = ". $sess->member_id);
return true;
}
/*------------------------------------------------
| SHOW LOGIN BOX
--------------------------------------------------*/
function box_login()
{
global $lang, $frm, $dsp;
$text = $frm->draw_form("", "", 2, "POST");
$text .= $frm->draw_hidden("process", "login");
$text .= "<center><fieldset style='border:#0066FF solid 1px; width:300px;'>
<legend style='font-weight:bold; font-size:0.9em; color:#333333'><img src='". ADMIN_IMG ."lock.png' align='absmiddle' width='20' /> Đăng nhập hệ thống</legend>";
$text .= "<table border='0' width='300'>";
$text .= "<tr><td height='5' colspan='2'></td></tr>";
$text .= "<tr>";
$text .= "<td width='70'>" . $lang['login_user'] . "</td>";
$text .= "<td align='left'>" . $frm->draw_textfield("username", "", "field", "", "32") . "</td>";
$text .= "</tr>";
$text .= "<tr><td height='2' colspan='2'></td></tr>";
$text .= "<tr>";
$text .= "<td>" . $lang['login_pass'] . "</td>";
$text .= "<td align='left'>" . $frm->draw_password("password", "field", "", "32") . "</td>";
$text .= "</td></tr>";
$text .= "<tr><td height='5' colspan='2'></td></tr>";
$text .= "<tr><td colspan='2' align='center'>";
$text .= "<input type='submit' value='Đăng nhập' style='background-color:#0F4B5D; color:#FFFFFF; border:#CCC solid 1x;' />";
$text .= "</td></tr>";
$text .= "<tr><td height='5' colspan='2'></td></tr>";
$text .= "</table></fieldset></center>";
$text .= '</form>';
return $text;
}
}
?>

if ( !$row['password'] ) return false;
$password = $crypt->decrypt_password($row['password'], $row['login_key'], 32);
if ($password != $tmp_password) return false;
if (strcmp($row['username'], $tmp_username) <> 0 ) return false;

$password = $crypt->decrypt_password($row['password'], $row['login_key'], 32);