<?php
// error_reporting(E_ALL);
// ini_set('display_errors', 1);
include "config/conn.php";
include 'lib/function.php';

 

// fungsi untuk menghindari injeksi dari user yang jahil
function anti_injection($data)
{
	$filter  = stripslashes(strip_tags(htmlspecialchars($data, ENT_QUOTES)));
	return $filter;
}

$username = anti_injection($_POST['username']);
$password = anti_injection(md5($_POST['password']));

// menghindari sql injection
$injeksi_username = mysqli_real_escape_string($conn, $username);
$injeksi_password = mysqli_real_escape_string($conn, $password);

// pastikan username dan password adalah berupa huruf atau angka.
if (!ctype_alnum($injeksi_username) or !ctype_alnum($injeksi_password)) {

	echo "<img src='tenor.gif' alt='hayoo'>";
	echo "<br>Hayooo, mau ngapain kesini";
} else {
	$login = mysqli_query($conn, "SELECT * FROM pegawai WHERE username='$username' AND password='$password'");
	if (mysqli_num_rows($login) == 0) {
	}

	$ketemu = mysqli_num_rows($login);
	$r      = mysqli_fetch_array($login);

	// Apabila username dan password ditemukan (benar)
	if ($ketemu > 0) {
	    	if ($r['sikeung'] != 'Y') {
      echo "<script>alert('TIDAK PUNYA AKSES !'); window.location = 'index.php'</script>";
		}else
	    {
	        
	        $accuser = mysqli_query($conn, "SELECT * FROM pengaturan LIMIT 1");
                          $au = mysqli_fetch_array($accuser);
	        
	        if($r['level']=='admin' OR $au['akses_pengguna']=='Y' ){
		session_start();

		$_SESSION['namauser']    = $r['username'];
		$_SESSION['passuser']    = $r['password'];
		$_SESSION['namalengkap'] = $r['nama'];
		$_SESSION['leveluser']   = $r['level'];
		$_SESSION['id']			=  $r['id_pegawai'];
		$_SESSION['id_divisi']			=  $r['id_divisi'];
		

		
		       $divisi=namadivisi($_SESSION['id_divisi']);
            		//notif TG
            		                                		// Fungsi untuk mendapatkan alamat IP pengguna
                            function get_user_ip() {
                                $ip = $_SERVER['REMOTE_ADDR'];
                                if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
                                    $ip = $_SERVER['HTTP_CLIENT_IP'];
                                } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
                                    $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
                                }
                                return $ip;
                            }
                            
                            // Mendapatkan informasi browser dan sistem operasi pengguna
                            $user_agent = $_SERVER['HTTP_USER_AGENT'];
                            $browser = "Unknown";
                            $os = "Unknown";
                            
                            // Daftar beberapa user agent string untuk mengidentifikasi browser dan sistem operasi
                            if (preg_match('/MSIE/i', $user_agent) && !preg_match('/Opera/i', $user_agent)) {
                                $browser = "Internet Explorer";
                            } elseif (preg_match('/Firefox/i', $user_agent)) {
                                $browser = "Mozilla Firefox";
                            } elseif (preg_match('/Chrome/i', $user_agent)) {
                                $browser = "Google Chrome";
                            } elseif (preg_match('/Safari/i', $user_agent)) {
                                $browser = "Safari";
                            } elseif (preg_match('/Opera/i', $user_agent)) {
                                $browser = "Opera";
                            }
                            
                            if (preg_match('/Windows/i', $user_agent)) {
                                $os = "Windows";
                            } elseif (preg_match('/Mac/i', $user_agent)) {
                                $os = "Mac OS";
                            } elseif (preg_match('/Linux/i', $user_agent)) {
                                $os = "Linux";
                            }
                            
                            // Menampilkan informasi perangkat ke layar
                            $ip = get_user_ip();
            		
            		
            		

							


		// masukkan ke log
		$waktu = date('Y-m-d H:i:s');
		$mac_id = mysqli_query($conn, "SELECT * FROM mac_akses WHERE mac='$_SESSION[mac]'");
		$id_mac = mysqli_fetch_array($mac_id);
		$log = mysqli_query($conn, "INSERT INTO log (id_pegawai,mac,waktu) VALUES ('$_SESSION[id]','$id_mac[id]','$waktu')");

		login_validate();

		// bikin id_session yang unik dan mengupdatenya agar slalu berubah 
		// agar user biasa sulit untuk mengganti password Administrator 
		$sid_lama = session_id();
		session_regenerate_id();
		$sid_baru = session_id();

		if ($r['level'] == 'nasabah') {

			mysqli_query($conn, "UPDATE nasabah SET id_session='$sid_baru' WHERE username='$username'");
		} else {
			mysqli_query($conn, "UPDATE pegawai SET id_session='$sid_baru' WHERE username='$username'");
		}
		
		


		header("location:index.php");
		
		
	}else{
	    
	    echo "<script> window.location = 'index.php?ntf=noaccess'</script>";
	}
	}
	    
	    
	    
	    
	} else {
		echo "<script> window.location = 'index.php?ntf=x'</script>";
	}
}
