<?php
require_once('../config.php');
require_once ('mencrypt.php');
session_name($CFG->sessionname);
session_start();
global $link;
dbConnect();

// Check connection
if (!$link) {
    die("Connection failed: " . mysqli_connect_error());
}

$numerodeempleado = isset($_POST['numempl']) ? trim($_POST['numempl']) : '';

// Límite de intentos por IP (mitiga enumeración / fuerza bruta)
function lms_rate_limit($key, $max = 60, $window = 600) {
    $file = sys_get_temp_dir() . '/lms_rl_' . md5($key);
    $now = time();
    $data = array();
    if (is_file($file)) {
        $tmp = json_decode(@file_get_contents($file), true);
        if (is_array($tmp)) { $data = $tmp; }
    }
    $data = array_values(array_filter($data, function ($t) use ($now, $window) {
        return $t > $now - $window;
    }));
    if (count($data) >= $max) { return false; }
    $data[] = $now;
    @file_put_contents($file, json_encode($data), LOCK_EX);
    return true;
}

$userip = getUserIP();
if (!lms_rate_limit('login_' . $userip)) {
    header("Location:".$CFG->wwwroot.'?errorcode=0');
    exit;
}

// Buscar usuario (consulta preparada)
$stmt = mysqli_prepare($link, "select * from user where numempl = ? and habilitado = 1 limit 1");
mysqli_stmt_bind_param($stmt, 's', $numerodeempleado);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
$user = $result ? mysqli_fetch_array($result) : null;
mysqli_stmt_close($stmt);

if (!$user) {
    header("Location:".$CFG->wwwroot.'?errorcode=0');
    exit;
}

// Actualizar último acceso (consulta preparada)
$stmt = mysqli_prepare($link, "update user set lastip = ?, lastlogin = NOW() where numempl = ?");
mysqli_stmt_bind_param($stmt, 'ss', $userip, $numerodeempleado);
mysqli_stmt_execute($stmt);
mysqli_stmt_close($stmt);

// Evitar fijación de sesión
session_regenerate_id(true);

$_SESSION['usersession'] = json_encode($user, JSON_UNESCAPED_UNICODE);
$_SESSION['numerodeempleado'] = $numerodeempleado;

$url_encriptado = $encriptar($numerodeempleado);
if ($user['idrol'] == 1) {
    $_SESSION['isadmin'] = false;
    $vars = "../dashboard.php?uniq=".urlencode($url_encriptado);
    header('Location: '.$vars);
    exit;
} else {
    $_SESSION['isadmin'] = true;
    header('Location: ../admin/');
    exit;
}

function getUserIP() {
    $ipaddress = '';
    if (isset($_SERVER['HTTP_CLIENT_IP']))
        $ipaddress = $_SERVER['HTTP_CLIENT_IP'];
    else if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
        $ipaddress = $_SERVER['HTTP_X_FORWARDED_FOR'];
    else if(isset($_SERVER['HTTP_X_FORWARDED']))
        $ipaddress = $_SERVER['HTTP_X_FORWARDED'];
    else if(isset($_SERVER['HTTP_X_CLUSTER_CLIENT_IP']))
        $ipaddress = $_SERVER['HTTP_X_CLUSTER_CLIENT_IP'];
    else if(isset($_SERVER['HTTP_FORWARDED_FOR']))
        $ipaddress = $_SERVER['HTTP_FORWARDED_FOR'];
    else if(isset($_SERVER['HTTP_FORWARDED']))
        $ipaddress = $_SERVER['HTTP_FORWARDED'];
    else if(isset($_SERVER['REMOTE_ADDR']))
        $ipaddress = $_SERVER['REMOTE_ADDR'];
    else
        $ipaddress = 'UNKNOWN';
    return substr($ipaddress, 0, 100);
}

?>