<?php
//Load required scripts
require('../../../inc/connect.php');
require('../../../inc/crypt.php');

//Get username and password
$username  = $_POST['username'];
$password = $_POST['password'];
$remember = isset($_POST['remember']) ? $_POST['remember'] : 0;

//Check if user exists
$sql = "SELECT `id`, `password`, `verified` FROM `user` WHERE `username`='" . $username . "'";
$query = ExecQuery($mysqli, $sql);

if($query->num_rows < 1){
	logout("Username or password incorrect");
}
else
{
	//Check if password is correct
	$result = $query->fetch_assoc();
	$verified = $result['verified'];
	$password_hash = $result['password'];

	if(!password_verify($password, $password_hash)){
		logout("Username or password incorrect");
	}
	else if($verified == 0)
	{
		logout('Your email has not yet been verified');
	}
	else
	{
		//Get user ID, IP
		$id = $result['id'];
		$ip = $_SERVER['REMOTE_ADDR'];

		//Set default device
		$sql = "SELECT `id` FROM `device` WHERE `user`=$id LIMIT 0,1";
		$query = ExecQuery($mysqli, $sql);

		if($query->num_rows < 1)
		{
			$deviceid = 0;
		}
		else
		{
			$result = $query->fetch_assoc();
			$deviceid = $result['id'];
		}

		$sessionid = RandomString(60);

		//Update Session ID, Last Login, IP in database
		$sql = "INSERT INTO session (`user`, `session`, `time`, `remember`, `ip`, `dev_id`, `dev_type`) VALUES ($id, '$sessionid', NOW(), $remember, '$ip', $deviceid, 'Browser')";
		ExecQuery($mysqli, $sql);

		//Set Session ID
		setSession($sessionid);

		//Reroute user to dashboard
		success("devices", "You have succesfully logged in.");
	}
}


?>