<?php
include_once '..' . DIRECTORY_SEPARATOR . '..' . DIRECTORY_SEPARATOR . 'classes' . DIRECTORY_SEPARATOR . 'constants.php';
header('Content-Type: text/html; charset=' . \CodingOperations::getInternalEncoding());
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Verzeichnisschutz</title>
</head>
<body>
<?php
/**
 * @copyright (c) Kufer Software GmbH, Loisachstrasse 4, D-84453 Mühldorf
 */



 error_reporting(E_ALL ^ E_NOTICE ^ E_WARNING);

  $path = GetAbsolutePath();

  if (PostOperations::getVarValue('username') == '' && PostOperations::getVarValue('userinput', false) == true) {
    echo "<p style='color: red'>Bitte einen Login-Namen angeben. Es wurde keine .htaccess-Datei angelegt.</p>";
  }

  if (PostOperations::getVarValue('username') != '') {
    $falscheZeichen = !preg_match('#^[a-zA-Z0-9]+$#', PostOperations::getVarValue('username'));
  }
  if (PostOperations::getVarValue('userinput', false) == 'true'
     && !$falscheZeichen
     && PostOperations::getVarValue('username') != '') {
    $password = $_POST['password'];
    if ($password != '') {
      if (WriteAccessFile(PostOperations::getVarValue('server'), $path, PostOperations::getVarValue('username'), $password)) {
        echo '<p><b>Login:</b> ' . CleanOperations::cleanStringForHtml(PostOperations::getVarValue('username')) . '</p>';
        echo '<p><b>Passwort:</b> ' . CleanOperations::cleanStringForHtml($password) . '</p>';
        echo '<p>Einstellungen gespeichert!</p>';
        if (PostOperations::getVarValue('logcopy', '') == '1') {
          if (copyToLog()) {
            echo '<p>.htaccess Datei ins Log-Verzeichnis kopiert!</p>';
          } else {
            echo "<p style='color: red'>.htaccess Datei konnte nicht kopiert werden!<br />"
                . 'Wahrscheinlich fehlen Ihnen Schreibrechte in das log-Verzeichnis!</p>';
          }
        }
        echo '<p><a href="webeinstell.php" title="Zurück">Zurück</a></p>';
      }
    } else {
      echo "<p style='color: red'>Einstellungen konnten nicht gespeichert werden!<br />"
          . 'Wahrscheinlich fehlen Ihnen Schreibrechte in das config-Verzeichnis!</p>';
    }
  } else {
    ?>
      <div>
        <form action="" method="post">
          <?php if ($falscheZeichen) {
      echo "<p style='color: red'>Bitte nur korrekte Zeichen beim Login eingeben. Es wurde keine .htaccess-Datei angelegt.</p>";
    } ?>
          <label style="width: 10em; float: left;">Servertyp:</label>
          <input type="radio" name="server" value="unix" checked="checked" />UNIX (und Derivate)
          <input type="radio" name="server" value="win" />Windows (nur Apache Web-Server, 
          bei IIS bitte über die Konfigurationsoberfläche 
          <a href="http://support.microsoft.com/?kbid=324064" title="IIS .htaccess Alternative">absichern</a>)
          <br /><br />
          <label style="width: 10em; float: left;">Absoluter Serverpfad:</label>
          <?php echo CleanOperations::cleanStringForHtml($path) ?>
          <br /><br />
          <label style="width: 10em; float: left;">Login (frei wählbar mit a-z, A-Z und 0-9):</label>
          <input type='text' name='username' size='20' />
          <br /><br /> <br \>       
          <label style="width: 10em; float: left;">Passwort:</label>
          <?php  
          $passwort = generierePasswort();
    echo "<input type='hidden' name='password' size='20' value='" . CleanOperations::cleanStringForHtml($passwort) . "'/>";

    echo CleanOperations::cleanStringForHtml($passwort);
    echo '<br><a href="">anderes Passwort generieren</a>'; ?>
          <br /><br />
          <label style="width: 10em; float: left;">.htaccess Datei auch ins Log-Verzeichnis kopieren:</label>
          <input type='checkbox' name='logcopy' value='1' checked='checked' />
          <br /><br />
          <br /><br />
          <input type="submit" value="Speichern" />
          <input type='hidden' value='true' name='userinput' />
        </form>
      </div>
      <p>
      <a href="../wizards/checksecurity/index.php">Schutz testen</a>
      </p>
    <?php
  }

  function generierePasswort()
  {
    $passwort = '';
    $pool = 'qwertzupasdfghkyxcvbnm23456789';
    $pool .= '23456789';
    $pool .= 'WERTZUPLKJHGFDSAYXCVBNM';
    srand((double)microtime() * 1000000);
    for ($n = 0; $n < 8; $n++) { 
      $passwort .= StringOperations::substr($pool, (rand() % (StringOperations::strlen($pool))), 1);
    }

    return $passwort;
  }

  function GetAbsolutePath()
  {
    return dirname(__FILE__);
  }

  function WriteAccessFile($ptyp, $ppath, $puser, $ppassword)
  {
    $file = @fopen('.htaccess', 'w');
    if (!$file) {
      return false;
    }

    fwrite($file, 'AuthType Basic' . \StringOperations::chr_windows1252(13) . \StringOperations::chr_windows1252(10));
    fwrite($file, 'AuthName "Administration"' . \StringOperations::chr_windows1252(13) . \StringOperations::chr_windows1252(10));
    if (StringOperations::substr($ppath, -1) != DIRECTORY_SEPARATOR) {
      $ppath = $ppath . DIRECTORY_SEPARATOR;
    }

    fwrite($file, 'AuthUserFile ' . $ppath . '.htpasswd' . \StringOperations::chr_windows1252(13) . \StringOperations::chr_windows1252(10));
    fwrite($file, 'require user ' . $puser . \StringOperations::chr_windows1252(13) . \StringOperations::chr_windows1252(10));
    fclose($file);

    $file = fopen('.htpasswd', 'w');

    switch ($ptyp) {
      case 'win': $pwd = $ppassword; break;
      case 'unix': $pwd = crypt($ppassword, StringOperations::substr($ppassword, 0, 2)); break;
    }

    fwrite($file, $puser . ':' . $pwd);
    fclose($file);

    return true;
  }

  function copyToLog()
  {
    return copy('.htaccess', '..' . DIRECTORY_SEPARATOR . '..'
        . DIRECTORY_SEPARATOR . 'log' . DIRECTORY_SEPARATOR . '.htaccess');
  }
?>
</body>
</html>