<!--#INCLUDE VIRTUAL="/board/inc_sha256.asp"-->
<%
'###################
'# config
'###################

Response.Buffer = true

dim strDBType, strConnString, strTablePrefix, strMemberTablePrefix, strFilterTablePrefix '## Do Not Edit
Dim counter, ConnErrorNumber, ConnErrorDesc, blnSetup '## Do Not Edit

strDBType = "access"
strConnString = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=c:/inetpub/database/snitz_forums_2000.mdb" '## MS Access 2000

strTablePrefix = "FORUM_"
strMemberTablePrefix = "FORUM_"
strFilterTablePrefix = "FORUM_"  'used for BADWORDS and NAMEFILTER tables
Const intAdminMemberID = 1

strCookieURL = Left(Request.ServerVariables("Path_Info"), InstrRev(Request.ServerVariables("Path_Info"), "/"))
strUniqueID = "Snitz00"

strDBNTSQLName = "M_NAME"
strAutoLogon = "0"
strNTGroups = "0"

'###################
'# func_common
'###################

function chkString(pString,fField_Type)
	fString = trim(pString)
	if fString = "" or isNull(fString) then
		fString = " "
	end if
	Select Case fField_Type
		Case "SQLString"
			fString = Replace(fString, "'", "''")
			fString = HTMLEncode(fString)
			chkString = fString
			exit function
		Case "display"
			if strAllowHTML <> "1" then
				fString = HTMLEncode(fString)
			end if
	                if strBadWordFilter = "1" then
        	                fString = ChkBadWords(fString)
                	end if
			fString = replace(fString,"+","#043;")
			chkString = fString
			exit function
	End Select
	chkString = fString
end function

function HTMLEncode(pString)
	fString = trim(pString)
	if fString = "" or IsNull(fString) then
		fString = " "
	else
		fString = replace(fString, ">", ">")
		fString = replace(fString, "<", "<")
	end if
	HTMLEncode = fString
end function

function chkQuoteOk(fString)
	chkQuoteOk = not(InStr(1, fString, "'", 0) > 0)
end function

function chkUser(fName, fPassword, fAuthor)

	dim rsCheck
	dim strSql

	'## Forum_SQL
	strSql = "SELECT MEMBER_ID, M_LEVEL, M_NAME, M_PASSWORD "
	strSql = strSql & " FROM " & strMemberTablePrefix & "MEMBERS "
	strSql = strSql & " WHERE " & strDBNTSQLName & " = '" & ChkString(fName, "SQLString") & "' "
	strSql = strSql & " AND M_PASSWORD = '" & ChkString(fPassword, "SQLString") &"'"
	strSql = strSql & " AND M_STATUS = " & 1
	Set rsCheck = my_Conn.Execute(strSql)
	if rsCheck.BOF or rsCheck.EOF or not(ChkQuoteOk(fName)) or not(ChkQuoteOk(fPassword)) then
		MemberID = -1
		chkUser = 0 '##  Invalid Password
		if strDBNTUserName <> "" and chkCookie = 1 then
			Call ClearCookies()
			strDBNTUserName = ""
		end if		
	else
		MemberID = rsCheck("MEMBER_ID")
		if (rsCheck("MEMBER_ID") & "" = fAuthor & "") and (cLng(rsCheck("M_LEVEL")) <> 3) then 
			chkUser = 1 '## Author
		else
			select case cLng(rsCheck("M_LEVEL"))
				case 1
					chkUser = 2 '## Normal User
				case 2
					chkUser = 3 '## Moderator
				case 3
					chkUser = 4 '## Admin
				case else
					chkUser = cLng(rsCheck("M_LEVEL"))
			end select
		end if	
	end if

	rsCheck.close	
	set rsCheck = nothing

end function

sub doCookies(fSavePassWord)
	if strSetCookieToForum = 1 then
		Response.Cookies(strUniqueID & "User").Path = strCookieURL
	else
		Response.Cookies(strUniqueID & "User").Path = "/"
	end if
	Response.Cookies(strUniqueID & "User")("Name") = strDBNTFUserName
	Response.Cookies(strUniqueID & "User")("Pword") = strEncodedPassword
	'Response.Cookies(strUniqueID & "User")("Cookies") = Request.Form("Cookies")
	if fSavePassWord = "true" then
		Response.Cookies(strUniqueID & "User").Expires = dateAdd("d", 30, date & " " & time)
	end if
end sub


sub ClearCookies()
	if strSetCookieToForum = 1 then
		Response.Cookies(strUniqueID & "User").Path = strCookieURL
	else
		Response.Cookies(strUniqueID & "User").Path = "/"
	end if
	Response.Cookies(strUniqueID & "User") = ""
	Session(strCookieURL & "Approval") = ""
	Session.Abandon
end sub

'###################
'# header
'###################

set my_Conn = Server.CreateObject("ADODB.Connection")
my_Conn.Open strConnString

strDBNTUserName = Request.Cookies(strUniqueID & "User")("Name")
strDBNTFUserName = trim(chkString(Request.Form("Name"),"SQLString"))
if strDBNTFUserName = "" then strDBNTFUserName = trim(chkString(Request.Form("User"),"SQLString"))

select case Request.Form("Method_Type")
	case "login"
		strEncodedPassword = sha256("" & Request.Form("Password"))
		select case chkUser(strDBNTFUserName, strEncodedPassword,-1)
			case 1, 2, 3, 4
				Call DoCookies(Request.Form("SavePassword"))
				strLoginStatus = 1
			case else
				strLoginStatus = 0
			end select
	case "logout"
		Call ClearCookies()
end select

if trim(strDBNTUserName) <> "" and trim(Request.Cookies(strUniqueID & "User")("Pword")) <> "" then
	chkCookie = 1
	mLev = cLng(chkUser(strDBNTUserName, Request.Cookies(strUniqueID & "User")("Pword"),-1))
	chkCookie = 0
else
	MemberID = -1
	mLev = 0
end if

my_conn.close
set my_conn = nothing

%>

quote:

---

Originally posted by laser

japes, it DOES work but it also took me a lot of time to get it working (the code changes were a breeze, but the Snitz settings needed and testing were the hard bit). I'll go with @tomic's advice that the cookie be set to website, but I also had to reload the application variables. You also need to include inc_header, or make a new one so you can remove the unnecessary stuff from your new page.

Hang in there, but it's a good MOD

---