#!/usr/bin/perl
#
# Note:  The first line may have to be adjusted to point to the location 
#        of the Perl interpreter.
#
# Program name:  forms.cgi
# Author: Jerry Hermel, Agent Solutions
# E-mail: jerryxh@earthlink.net
# Creation date:  11/6/05
# Last modified:  
$prog = "forms.cgi";
$prog_version = 1.0;

#
# Copyright 2005 Agent Solutions. All rights reserved.
#

########################################################################
#              Do not change anything after this point!!!              #  
########################################################################

require 5.004;
push(@INC, '/var/www/vhosts/calinspect.com/httpdocs/cgi-local/');

# Configuration file
require "../adm/forms.cfg.txt";

# Include libraries
use DBI;
use XBase;
use MIME::Entity; 
use URI::Escape;
use Email::Valid;
use Time::Local;
use Date::Format;
use Time::Zone;
use POSIX;

# Define databases
$database1 = "$html_root/adm/$database1";

### Main program ###

# tokens to put in HTML documents to be replaced with responses

@token = ('<!--Message-->', '*Username*', '*Remember_Username*', '*Customer*', '*Cookie_Test*', '*Date*', '*DateOrd*', '*Insured*', '*Address*', '*Address1*', '*Address2*', '*Address3*', '*Address4*', '*Address5*', '*City*', '*City1*', '*City2*', '*City3*', '*City4*', '*City5*', '*Zip*', '*Zip1*', '*Zip2*', '*Zip3*', '*Zip4*', '*Zip5*', '*Contact*', '*ContactP*', '*Type*', '*Agency*', '*Agent*', '*AgentPh*', '*Company*', '*Policy*', '*Special*', '*Class1*', '*Class2*', '*Class3*', '*Class4*');
@message = ();

$error = "";
$error_msg = "<IMG SRC=\"../images/asterisk.gif\" BORDER=\"0\" ALIGN=\"baseline\" WIDTH=\"13\" HEIGHT=\"13\"><FONT SIZE=\"4\"> There was an ERROR in your submission! <IMG SRC=\"../images/asterisk.gif\" BORDER=\"0\" ALIGN=\"baseline\" WIDTH=\"13\" HEIGHT=\"13\"><BR>";

%IN = ();

%user_info = ();

%cookies_in = ();
%cookies_out = ();
%cookie_test = ();

# split the POST data into the IN array

if ($ENV{'REQUEST_METHOD'} eq 'POST') {
  &split_post_data;
}
else {
  $split_value = $ENV{'QUERY_STRING'};
  &split;
}
$page_path = $html_root . "/$IN{page}.html";

# Shut-down system if requested to by administrator

$lock_file = "$html_root/adm/lock_file";
if ($IN{on} eq "" && $IN{off} eq "") {

  open(INFILE, $lock_file) or &sys_error("$prog: Cannot open lock_file: $!");
  flock (INFILE, 1);
  $lock = <INFILE>;
  flock (INFILE, 8);
  close (INFILE);

  if($lock eq "Off") {
    if ($IN{logout} eq "") { print "Location: http://www.calinspect.com/down4maintenance.html\n\n"; }   
  }
}

# get cookies
%cookies_in = get_cookies();

if ($IN{logout} ne "") {
  if($cookies_in{sid} ne "") {
    ($sid, $sid_time) = split /\|/, $cookies_in{sid};
    $cookies_out{sid} = encode($sid) . "%7C" . ($sid_time - 3600);
    set_cookies(0, %cookies_out);  
  }  
  if($IN{logout} == 1) {
    print "Location: http://www.calinspect.com/index1.html\n\n";   
  }
  else {
    $msg = "";
    if ($IN{msg} ne "") { $msg = $IN{msg}; }
    print "Location: $cgi/forms.cgi?msg=$msg\n\n";
  }
}

if ($IN{sign_in} ne "" || $IN{signin} ne "" || $IN{remindme} ne "" || $IN{msg} ne "" || $IN{cookies} ne "" || $IN{enable} ne "") {
  &signin;    
}
elsif ($IN{order_inspection} ne "" || $IN{order_another} ne "" || $IN{order_reset} ne "" || $IN{welcome} ne "") {
  require "order_inspections.pl";
  &order_inspections;
}
elsif ($IN{order_audit} ne "" || $IN{order_another2} ne "" || $IN{order_reset2} ne "") {
  require "order_audits.pl";
  &order_audits;
}
elsif ($IN{view_orders} ne "" || $IN{kw_search} ne "" || $IN{dr_search} ne "" || $IN{show_order} ne "") {
  if ($IN{show_order} ne "") {
    require "show_order.pl";
    &show_order;
  }
  else {
    require "view.pl";
    &view_orders;
    exit;
  }
}
elsif ($IN{view_orders2} ne "" || $IN{kw_search2} ne "" || $IN{dr_search2} ne "" || $IN{show_order2} ne "") {
  if ($IN{show_order2} ne "") {
    require "show_order2.pl";
    &show_order2;
  }
  else {
    require "view2.pl";
    &view_orders2;
    exit;
  }
}
elsif ($IN{on} ne "" || $IN{off} ne "") {
  open (OUT, ">$lock_file") || &sys_error("$prog: Cannot open lock_file: $!");
  flock (OUT, 2);
  if ($IN{on} ne "") { 
    print OUT "On";
    $message[0] = "On"; 
  }
  else {
    print OUT "Off";
    $message[0] = "Off";
  }
  flock (OUT, 8);
  close (OUT);
  @file_list = ("$lock_file");
  chmod (0644, @file_list);
}
else {
  $IN{sign_in} = 1;
  &signin;
}

# just the content type because the HTML is all done in the HTML page parsed

&html_header;

# parse the HTML page and replace the tokens

&parse_html;

exit 0;


# split the POST data into the IN array

sub split_post_data {
  read(STDIN, $buffer, $ENV{CONTENT_LENGTH});

  #  Split the name/value pairs on '&'

  @pairs = split(/&/, $buffer);

  #  Determine the name and value for each form variable

  foreach $pair (@pairs) {  
    ($name, $value) = split(/=/, $pair);  # split on equals
    $value =~ tr/+/ /;  # turn pluses into spaces

    # convert hex values

    $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
 
    if ($IN{$name} ne "") { $IN{$name} .= "\0$value"; }
    else { $IN{$name} = "$value"; }
    $IN{$name} =~ s/<!--#[^>]+>//g;  # remove SSIs
    $IN{$name} =~ s/^\s+//;
    $IN{$name} =~ s/\s+$//;
  }
}


# split the query string or GET data into the IN array

sub split {
  @pairs = split /&/, $split_value;   
  foreach $pair (@pairs) {
    ($name, $value) = split /=/, $pair;

    if ($IN{$name} ne "") { $IN{$name} .= "\0$value"; }
    else { $IN{$name} = "$value"; }
    $IN{$name} =~ s/<!--#[^>]+>//g;  # remove SSIs
    $IN{$name} =~ s/^\s+//;
    $IN{$name} =~ s/\s+$//;
  }
}


# Verify login information and monitor user activity -- logout user after 30 minutes of inactivity

sub check_cookies {
  my $username = shift;
  my $customer = shift;
  my %cookies =();

  if($cookies_in{sid}) {
    ($sid, $sid_time) = split /\|/, $cookies_in{sid};

    %user_info = read_file($database1);

    if (exists($user_info{$username})) { 
      @user_data = split /\|/, $user_info{$username};   
    }

    $password = $user_data[0];
    $unencrypted = &unscramble($sid, $encrypt_key.$username);

    if($unencrypted ne $password || $customer ne $user_data[1]) {
      print "Location: $cgi/forms.cgi?msg=Your+authentication+data+is+incorrect.+Please+verify+the+information+and+try+again.\n\n"; 
    }
    elsif ((time()-$sid_time) > 0) {
      print "Location: $cgi/forms.cgi?msg=Your+session+has+timed+out+due+to+inactivity.+Please+log+in+again.\n\n";
    }
    $cookies{sid} = encode($sid) . "%7C" . (time()+1800);
    set_cookies(0, %cookies);  
    return;
  }
  else {
    print "Location: $cgi/forms.cgi?msg=Either+your+session+has+timed+out%2C+or+your+authentication+data+is+incorrect.+Please+verify+the+information+and+try+again.\n\n";
  }
}


# Login to order an inspection

sub signin {
  #  Do some checks on the input
 
  #  Test to see if cookies are enabled
  $cookie_test{ctest} = "t";
  if ($cookies_in{ctest} ne "t") {
    if ($IN{cookies} eq "") {
      set_cookies(0, %cookie_test);
      print "Location: $cgi/forms.cgi?cookies=1\n\n";    
    }
    elsif ($IN{msg} eq "") {
      $message[0] = 'The CAL Inspection Bureau login interface is designed to work with the cookie feature of a browser. The current settings of your browser do not allow it to accept cookies.<BR><BR>Please enable the cookie feature and then <A HREF="/cgi-local/forms.cgi?enable=1">click here</A>.'; 
      $page_path = $html_root . "/oops.html";
      return;
    }
  }
  else {
    $message[4] = "t"; 
  }

  $token[33] = "*Username1*";
  $message[33] = "";
  $token[34] = "*Remember_Username1*";
  $message[34] = "";

  if($cookies_in{un}) {
    $message[1] = $cookies_in{un};
    $message[2] = "CHECKED";
    $message[34] = "yes";
  }

  if ($IN{sign_in} ne "" || $IN{msg} ne "" || $IN{ctest} ne "t" || $IN{enable} ne "") {
    if ($IN{msg} ne "") { $message[0] = decode($IN{msg}) . "<BR><BR>"; }
    $page_path = $html_root . "/login.html";
    return;
  }

  %user_info = read_file($database1);

  $valid_un = 0;
  if ($IN{username} ne "" && $IN{username} ne '***') {
    if(exists($user_info{$IN{username}})) { 
      $value = $user_info{$IN{username}};
      @user_data = split /\|/, $value;   
      $message[1] = $IN{username};
      $password = $user_data[0];
      if ($IN{password} ne $password) { $error = 'You entered an invalid password. Please try again.'; }
      $valid_un = 1; 
    }
  } 

  if ($IN{password} !~ m/\S+/) { $error = 'Please enter your password.'; }
  if ($valid_un == 0) { $error = 'You entered an invalid username. Please try again.'; }
  if ($IN{username} !~ m/\S+/) { $error = 'Please enter your username.'; }

  if ($IN{remindme} ne "" && $error !~ m/username/) { $error = ""; }

  if ($error ne "") { 
    $page_path = $html_root . "/$IN{error}.html"; 
    $message[0] = $error_msg . $error . "</FONT><BR><BR>";
    if ($IN{remindme} ne "") { 
      $message[1] = $IN{username1};
      $message[33] = $IN{username}; 
    }
    else { $message[1] = $IN{username}; }
    $message[2] = "";
    $message[34] = "";
    if($IN{rememberun} eq "yes") { 
      $message[2] = "CHECKED"; 
      $message[34] = "yes";
    }
    return;
  }
  elsif ($IN{remindme} ne "") {
    chomp($user_data[4]);
    $emailc = $user_data[4];
    $emailc =~ s/\n|\r|\t//g; 

#   E-mail Password Reminder                   
    $info_buffer = '';
    $header_buffer = '';
	$mail = "$mail_location -oi -t -f emil\@calinspect.com";
    open(MAIL, "| $mail") || &sys_error("$prog: Can't open pipe to sendmail: $!");
    if (Email::Valid->address(-address => $emailc, -mxcheck => 1)) {
      $header_buffer .= "To: $user_data[2] <$emailc>\n";
      $invalid_em = "";
    }
    else {
      $header_buffer .= "To: dead.letter\@calinspect.com\n";
      $invalid_em = " ($emailc)";
    }
    $header_buffer .= "X-Mailer: Agent Solutions - $prog_version\n";
    $header_buffer .= "Mime-Version: 1.0\n";
    $header_buffer .= "Content-Type: text/plain; charset=\"us-ascii\"\n";
    $header_buffer .= "From: CAL Inspection Bureau <orders\@calinspect.com>\n";
    $header_buffer .= "Reply-to: orders\@calinspect.com\n";
    $header_buffer .= "Subject: Your CIB Password".$invalid_em."\n\n";
    $info_buffer .= "Dear $user_data[2],\n\n";
    $info_buffer .= "Your CAL Inspection Bureau password is \"$user_data[0]\".\n\n";
    $info_buffer .= "If you have any questions or comments, please e-mail us at orders\@calinspect.com or call us at (818) 346-2422.\n\n";
    $info_buffer .= "Best regards,\n";
    $info_buffer .= "The CAL Inspection Bureau Team\n\n";
    $info_buffer .= "http://www.calinspect.com\n";
    $info_buffer .= "\n";
    print MAIL "$header_buffer";
    print MAIL "$info_buffer";
    close (MAIL) || &sys_error("$prog: Error closing pipe to sendmail: $!");

    $page_path = $html_root . "/$IN{page}.html"; 
    $message[0] = "Your password has been sent to your e-mail address.<BR><BR>";
    $message[1] = $IN{username1};
    $message[2] = "";
    $message[34] = "";
    if($IN{rememberun} eq "yes") { 
      $message[2] = "CHECKED"; 
      $message[34] = "yes";
    }
    return;
  }
  else { 
    chomp($user_data[3]);
    $error = "Hi+" . encode($user_data[2]) . "+%40+" . encode($user_data[3]) . "%21";
    $customer = encode($user_data[1]);
 
    # Save/delete cookies
    $cookies_out{un} = encode($IN{username});
    if($IN{rememberun} eq "yes") { set_cookies(2*365, %cookies_out); }
    elsif($cookies_in{un} ne "") { set_cookies(-1, %cookies_out); }
    delete($cookies_out{un});
    $encrypted = &scramble($IN{password}, $encrypt_key.$IN{username});
    $cookies_out{user} = $IN{username};
    $cookies_out{sid} = encode($encrypted) . "%7C" . (time()+1800);
    set_cookies(0, %cookies_out);  
  }
  if($IN{username} eq "usli") {
	print "Location: /dashboard/download_forms.php\n\n";
  }
  else {
  	print "Location: $cgi/forms.cgi?welcome=$error&username=$IN{username}&customer=$customer&page=order\n\n";    
  }
}


# just the content type because the HTML is all done in the HTML page # parsed

sub html_header {
  print "Content-type: text/html\n\n";
  $html_header = 1;
}


# parse the HTML page provided and replace the tokens

sub parse_html { 
  open(HTML, "$page_path") || &sys_error("$prog: Error opening HTML file: $page_path\n");
  while (!(eof(HTML))) {   
    $line = <HTML>;
    for ($i = 0; $i <= $#token; $i += 1) {
      $x = index($line, "$token[$i]");
      if ($x != -1) {
        $bline = substr($line, 0, $x);
        $eline = substr($line, $x + (length($token[$i])));
        $line = "$bline$message[$i]$eline";
      }
    }  
    print("$line");
  } 
  close (HTML);
} 


# Read in a database file

sub read_file {

  my $the_file = shift;
  my %hash = @_;

  open(INFILE, $the_file) or &sys_error("$prog: Cannot open customer database: $!");
  while(!eof(INFILE)) {
    $line = <INFILE>;
    if ($line ne "") {
      $pos = index($line, "|");
      $key = substr($line, 0, $pos);
      $hash{$key} = substr($line, $pos+1);
    }
  }
  close (INFILE);
  return %hash;
}


# Show the date and time for the Pacific Coast

sub pacific_time {
  @months = ("", 'January', 'February', 'March', 'April', 'May', 'June', 'July', 'August', 'September', 'October', 'November', 'December');
  ($tmp,$tmp,$tmp,$tmp,$tmp,$tmp,$tmp,$tmp,$dst) = localtime($time);
  ($tmp,$min,$hour,$day,$month,$year,$tmp,$tmp,$tmp) = gmtime($time-(8-$dst)*(3600));
  if ($dst) { $is_dst = " PDT"; }
  else { $is_dst = " PST"; }
  $month += 1;
  $year += 1900;
  $meridian = " am";
  if ($hour >= 12 && $hour < 24) { $meridian = " pm"; }
  if ($hour > 12)  { $hour -= 12; }
  if ($hour == 0)  { $hour = 12; }
  $date1 = "$months[$month] $day, $year ";
  $date1 .= sprintf('%02d:%02d', $hour, $min) . $meridian . $is_dst;
  $date2 = sprintf('%04d%02d%02d', $year, $month, $day);
  $date3 = substr($months[$month],0,3) . '|' . $day . '|' . $year;
  $date4 = $month . '|' . $day . '|' . $year;
  @date = ($date1, $date2, $date3, $date4);
}
  

# Check for valid U.S. zip code -- returns "1" if valid

sub valid_zip {
  my $zip = shift;
  if ($zip =~ m/^\d{5}$/) { return(1); }
  elsif ($zip =~ m/^\d{5}-{1}\d{4}$/) { return(1); }
  return(0);  
}


# Check for valid U.S. phone number -- returns "1" if valid

sub valid_phone {
  my $phone = shift;
  $phone =~ s/\s+//g;
  if ($phone =~ m/^\(\d{3}\)\d{3}-?\d{4}$/) { return(1); }
  elsif ($phone =~ m/^\d{3}-?\d{3}-?\d{4}$/) { return(1); }
  elsif ($phone =~ m/^\d{3}\.?\d{3}\.?\d{4}$/) { return(1); }
  return(0);  
}


# Check for valid date of the form mm/dd/yyyy -- returns "0" if invalid
#       and actual time if valid

sub valid_date {
  my $date = shift;
  my $month = substr($date,0,2);
  my $day = substr($date,3,2);
  my $year = substr($date,6);
  unless ($date =~ m/^\d{2}\/\d{2}\/\d{4}$/) { return(0); }
  if ($month < 1 || $month > 12) { return(0); }
  if ($day < 1 || $day > 31) { return(0); }
  $time1 = timelocal(0,0,0,(localtime)[3,4,5]);
  $month -= 1;
  $year -= 1900;
  $time2 = timelocal(0,0,0,$day,$month,$year);
# if ($time2 < $time1) { return(0); } 
  return($time2);  
}


# Escape a string -- all non-alphanumeric characters are escaped
#       and spaces are converted to "+"s
 
sub encode {
  # Code taken from WWW::Search.pm

  my $string = join(' ', @_);

  $string ||= '';
  $string =~ s/([^ A-Za-z0-9])/$URI::Escape::escapes{$1}/g; 
  $string =~ s/ /+/g;
  return $string;
}


# Unescape a string
 
sub decode {
  # Code taken from URI::Escape.pm

  my @string = @_;
  for (@string) {
    s/\+/ /g;
    s/%([\dA-Fa-f]{2})/chr(hex($1))/eg;
  }
  return wantarray ? @string : $string[0];
}

# Send cookies to the browser -- $expire is in days

sub set_cookies {
  my $expire = shift;
  my %hash = @_;
  
  if($expire > 0) {
    $exp = POSIX::strftime("%a, %d-%b-%Y %H:%M:%S GMT", gmtime(time()+($expire*86400)));
  }
  elsif($expire < 0) {
#   $exp = "Thu, 01-Jan-1970 00:00:01 GMT";
    $exp = POSIX::strftime("%a, %d-%b-%Y %H:%M:%S GMT", gmtime(time()-3600));

  }

  while (($key, $val) = each %hash) {

    # Print out the cookie
    if($expire == 0) {
      print "Set-Cookie: $key=$val; path=/;\n"; 
    }
    else {
      print "Set-Cookie: $key=$val; path=/; expires=$exp;\n"; 
    }
  }
}


# Grab the cookies from the server and store them in %hash
 
sub get_cookies {
  my %hash = @_;
  
  if ($ENV{'HTTP_COOKIE'}) {
    # Grab the cookies handed to us by the browser
    foreach (split(/; /,$ENV{'HTTP_COOKIE'})) {
      local($key,$val) = split(/=/);

      $key = decode($key);
      $val = decode($val);

      $hash{$key} = $val;
    }
  }
  return %hash;
}


# Encrypt a string based on a key so that the encrypted    
#       string can only be unencrypted using the key 

sub scramble {
  local($text, $key) = @_;
  local($response) = '';
  local($i, $j, $num, $result);
    
  # Save the string lengths to speed things up slightly
    
  local($text_len) = length($text);
  local($key_len) = length($key);
    
  # Process each character in $string
    
  for ($i = 0; $i < $text_len; ++$i) {
    
    # Convert the character to ASCII, offset from space
        
    $num = ord(chop($text)) - 32;
        
    # If $key is longer than $string, stack characters
        
    for ($j = $i; $j < $key_len; $j += $text_len) {
            
      # Offset the original character by the key character and key length
            
      $num += ord(substr($key, $j, 1)) + $key_len;
    }
        
    # Bring it back into the printable ASCII range
        
    $num = $num % 95 + 32;
        
    # Convert '%' where appropriate (modified by J. Hermel)        
    if ($num == 37) { $num = 127 };

    # Convert '|' where appropriate (modified by J. Hermel)
        
    if ($num == 124) { $num = 128 };
        
    # Convert it to an ASCII character
        
    $result .= pack("c", $num);
  }
    
  # Add 5 random integers to end of string (added by J. Hermel)

  for ($i = 1; $i <= 5; $i += 1) { 
    srand();
    $result .= int(rand(10));   
  }

  # Return the result
    
  return($result);
}


# Unencrypt string 

sub unscramble {
  local($text, $key) = @_;
  local($response) = '';
  local($i, $j, $num, $result);
    
  # Save the string lengths to speed things up slightly
    
  local($text_len) = length($text) - 5;  # Modified by J. Hermel
  local($key_len) = length($key);

  # Remove 5 random integers from end of string (added by J. Hermel)

  $text = substr($text, 0, $text_len);
    
  # Process each character in $string
    
  for ($i = $text_len - 1; $i >= 0; --$i) {
    
    # Convert the character to ASCII
        
    $num = ord(chop($text));
        
    # Change back to '%' if appropriate (modified by J. Hermel)
        
    if ($num == 127) { $num = 37 }

    # Change back to '|' if appropriate (modified by J. Hermel)
        
    if ($num == 128) { $num = 124 }
        
    # Convert to 0-95 range
        
    $num -= 32;
        
    # If $key is longer than $string, stack characters
        
    for ($j = $i; $j < $key_len; $j += $text_len) {
            
      # Offset the original character by the key character and key length
            
      $num -= ord(substr($key, $j, 1)) + $key_len;
    }
        
    # Bring it back into the printable ASCII range
        
    $num = $num % 95 + 32;
        
    # Convert it to an ASCII character
        
    $result .= pack("c", $num);
  }
    
  # Return the result
    
  return($result);
}


# print error message and exit

sub sys_error {
  my ($msg) = shift;
  $message[0] = "Agent Solutions: Version $prog_version, $msg\n";
  $page_path = $html_root . "/difficulties.html";  
  if ($html_header != 1) { &html_header; }
  &parse_html;
  exit 1; 
}