<%
response.buffer = true
IF request.servervariables("HTTPS") = "off" THEN response.redirect("/schools/?secure=1") END IF%>
<%
StrError = "None"
StrAction = "None"
str_u_token = sanitizeRequest("sut","cookie")
str_u_n = sanitizeRequest("sun","cookie")
IF str_u_token <> "" AND str_u_n <> "" THEN
'try token login
dcToken=CustDecodeAndDecrypt(str_u_token)
SET rsTL = dbCBK.Execute("SELECT `userID`,`schoolID`,`companyID`,`cust_token` FROM cbk_school_users WHERE `email`='"&str_u_n&"' AND `cust_token`='"&dcToken&"' limit 1")
IF rsTL.EOF THEN
'remove the cookies
response.cookies("sut")=""
response.cookies("sun")=""
END IF
DO WHILE NOT rsTL.EOF
str_login_user_id=CInt(rsTL("userID"))
str_u_id=CInt(rsTL("schoolID"))
str_company_id=CInt(rsTL("companyID"))
eToken=rsTL("cust_token")
rsTL.MoveNext
loop
rsTL.Close
SET rsTL = Nothing
IF str_u_id<>"" AND IsNumeric(str_u_id) THEN
'now redirect to management page
response.redirect("/schools/control-panel/")
END IF
ELSEIF REQUEST("process")="login" THEN
'run login
userPASS=sanitizeRequest("p","form")
IF userPASS <> "" THEN
IF len(userPASS) < 3 OR len(userPASS) > 30 THEN
StrError = "Your password is outside the allowed length"
ELSE
dcpass=CustEncryptAndEncode(userPASS)
END IF
ELSE
StrError = "Your password is required"
END IF
'username is email address
userNAME=sanitizeRequest("u","form")
IF userNAME <> "" THEN
'ok
IF len(userNAME) < 5 OR len(userNAME) > 200 THEN
StrError = "Your email address appears invalid"
END IF
ELSE
StrError = "Your email address is required"
END IF
'staff ID is school ID
schoolID=sanitizeRequest("cID","form")
IF schoolID <> "" THEN
schoolID=trim(schoolID)
IF IsNumeric(schoolID) THEN
'ok
ELSE
StrError = "Your staff ID is required"
END IF
ELSE
StrError = "Your staff ID is required"
END IF
IF StrError <> "None" THEN
'print the errors
ELSE
'run login
SET rsTL = dbCBK.Execute("SELECT `userID`,`schoolID`,`companyID`,`email`,`cust_token` FROM cbk_school_users WHERE `schoolID`='"&schoolID&"' AND `email`='"&userNAME&"' AND `acpwd`='"&dcpass&"' limit 1")
IF rsTL.EOF THEN
StrError = "No account found"
END IF
DO WHILE NOT rsTL.EOF
str_login_user_id=CInt(rsTL("userID"))
str_u_id=CInt(rsTL("schoolID"))
str_company_id=CInt(rsTL("companyID"))
str_u_name=rsTL("email")
exiToken=rsTL("cust_token")
rsTL.MoveNext
loop
rsTL.Close
SET rsTL = Nothing
IF str_u_id<>"" AND IsNumeric(str_u_id) THEN
IF exiToken <> "" AND NOT(IsNull(exiToken)) THEN
'login on new device, use existing token
response.cookies("sut")=CustEncryptAndEncode(exiToken)
response.cookies("sun")=str_u_name
IF request("sli")="yes" THEN
response.cookies("sut").Expires = dateAdd("m",3,now())
response.cookies("sun").Expires = dateAdd("m",3,now())
ELSE
response.cookies("sut").Expires = dateAdd("n",30,now())
response.cookies("sun").Expires = dateAdd("n",30,now())
END IF
ELSE
'new login, set new token
'create new token and replace token in db
nToken=generatePassword(15)
dbCBK.Execute("UPDATE cbk_school_users SET `cust_token`='"&nToken&"' WHERE `userID`='"&str_login_user_id&"' AND `schooolID`='"&str_u_id&"' limit 1")
'encrypt the token
neToken=CustEncryptAndEncode(nToken)
response.cookies("sut")=neToken
response.cookies("sun")=str_u_name
IF request("sli")="yes" THEN
response.cookies("sut").Expires = dateAdd("m",3,now())
response.cookies("sun").Expires = dateAdd("m",3,now())
ELSE
response.cookies("sut").Expires = dateAdd("n",30,now())
response.cookies("sun").Expires = dateAdd("n",30,now())
END IF
END IF
'now redirect to management page
response.redirect("/schools/control-panel/")
END IF
END IF
ELSE
'display the login form
END IF
%>
Zywpeit: School Portal
