<?php 
session_start();
ob_start();
$_SESSION['invoicing']='2';
include('include/config.php');
$_SESSION['Yeear']='2023';

function createRandomPassword() {
	$chars = "003232303232023232023456789";
	srand((double)microtime()*1000000);
	$i = 0;
	$pass = '' ;
	while ($i <= 7) {

		$num = rand() % 33;
		$tmp = substr($chars, $num, 1);
		$pass = $pass . $tmp;
		$i++;
	}
	return $pass;
}
$code=createRandomPassword();
//date_default_timezone_set('Africa/Khartoum');// change according timezone'Asia/Kolkata'

$date = new DateTime("now", new DateTimeZone('Africa/Nairobi') );
$timenow=$date->format('Y-m-d H:i:s');
$timenow2=$date->format('Y-m-d');
$month=$date->format('M');

 if(!empty($_POST["user"]))
 {
 $user=addslashes($_POST["user"]);
 $pass=addslashes($_POST["pass"]);
 $pass=md5($pass);
 $id='';

$query=mysqli_query($con,"SELECT * FROM users WHERE Email='$user' AND Pass='$pass'");
$num=mysqli_fetch_array($query);
if($num>0)
{
$sql=mysqli_query($con,"SELECT * FROM users WHERE Email='$user' AND Pass='$pass' AND Aces='yes'");
$num=mysqli_fetch_array($sql);
if($num>0)
{

 $sqll=mysqli_query($con,"SELECT * FROM users WHERE Email='$user' AND Pass='$pass' AND Aces='Yes'");
 while($row=mysqli_fetch_array($sqll))
 {
  $id=$row["userid"];
 }

 $sql1=mysqli_query($con,"SELECT * FROM Staffs WHERE id='$id'");
 while($row=mysqli_fetch_array($sql1))
 {
  $name=$row["Name"];
  $st=$row["Status"];
  $poss=$row["Position"];
  $_SESSION['pos']=$poss;
  
if($st=='Active')
{
$sqlll=mysqli_query($con,"SELECT * FROM users WHERE Email='$user' AND Pass='$pass' AND Aces='Yes'");     
while($row=mysqli_fetch_array($sqlll))
{
$_SESSION['HU_mana']=$row["Manage"];
$_SESSION['HU_ac']=$row["Accounts"];
$_SESSION['HU_hr']=$row["Hr"];
$_SESSION['HU_le']=$row["Level"];
}
    
  $_SESSION['user_idd']=$id;
  $_SESSION['name'] = $name;
  $_SESSION['betapos']='HHD/CJ2588E';

  $_SESSION['sessioncode']=$row["Fname"].'_'.$code;
  $scod=$_SESSION['sessioncode'];

 $sql2=mysqli_query($con,"INSERT INTO logs(userid,Timein,sessionn)values('$id','$timenow','$scod')");
 if($sql2)
 { }

$sql3=mysqli_query($con,"INSERT INTO activity(user,Action,Tim,Dat,shortmsg,Month)values('$id','logged in','$timenow','$timenow2','login','$month')");
if($sql3)
{ }
 
       $sql5=mysqli_query($con,"SELECT * FROM users WHERE userid='$id'");
      while($row=mysqli_fetch_array($sql5))
      {
      $_SESSION['usertype']=$row["Level"];
      $_SESSION['makehuman']=$row["Hr"];
      // $_SESSION['makeapprove']=$row["Approverights"];
      // $_SESSION['makeaccount']=$row["Accounts"]; 
       }   
    
  //$name=$row["Fname"].' '.$row["Mname"];
 //$st=$row["Status"];
 
  
 echo 'granted';
  //header('location:data/index.php?page=dashboard');
  }else
  {
  echo 'acessno';
  }
 }

}else
{
	echo "acessno";
}

}else
{
echo "invalid";
}	
 }
?>