<?php
    /*
     * $Id: authcheck.php 1482 2010-04-28 20:29:13Z dmorton $
     *
     * MAIA MAILGUARD LICENSE v.1.0
     *
     * Copyright 2004 by Robert LeBlanc <rjl@renaissoft.com>
     *                   David Morton   <mortonda@dgrmm.net>
     * All rights reserved.
     *
     * PREAMBLE
     *
     * This License is designed for users of Maia Mailguard
     * ("the Software") who wish to support the Maia Mailguard project by
     * leaving "Maia Mailguard" branding information in the HTML output
     * of the pages generated by the Software, and providing links back
     * to the Maia Mailguard home page.  Users who wish to remove this
     * branding information should contact the copyright owner to obtain
     * a Rebranding License.
     *
     * DEFINITION OF TERMS
     *
     * The "Software" refers to Maia Mailguard, including all of the
     * associated PHP, Perl, and SQL scripts, documentation files, graphic
     * icons and logo images.
     *
     * GRANT OF LICENSE
     *
     * Redistribution and use in source and binary forms, with or without
     * modification, are permitted provided that the following conditions
     * are met:
     *
     * 1. Redistributions of source code must retain the above copyright
     *    notice, this list of conditions and the following disclaimer.
     *
     * 2. Redistributions in binary form must reproduce the above copyright
     *    notice, this list of conditions and the following disclaimer in the
     *    documentation and/or other materials provided with the distribution.
     *
     * 3. The end-user documentation included with the redistribution, if
     *    any, must include the following acknowledgment:
     *
     *    "This product includes software developed by Robert LeBlanc
     *    <rjl@renaissoft.com>."
     *
     *    Alternately, this acknowledgment may appear in the software itself,
     *    if and wherever such third-party acknowledgments normally appear.
     *
     * 4. At least one of the following branding conventions must be used:
     *
     *    a. The Maia Mailguard logo appears in the page-top banner of
     *       all HTML output pages in an unmodified form, and links
     *       directly to the Maia Mailguard home page; or
     *
     *    b. The "Powered by Maia Mailguard" graphic appears in the HTML
     *       output of all gateway pages that lead to this software,
     *       linking directly to the Maia Mailguard home page; or
     *
     *    c. A separate Rebranding License is obtained from the copyright
     *       owner, exempting the Licensee from 4(a) and 4(b), subject to
     *       the additional conditions laid out in that license document.
     *
     * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS
     * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
     * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
     * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
     * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
     * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
     * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
     * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
     * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
     * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     *
     */
if(session_id() == "")
{
   session_start();
}


   // If we don't have a current login session, jump to the login page
   if (!isset($_SESSION["uid"]) || !isset($_SESSION["euid"])) {
      header("Location: login.php");
      exit();
   }
   
   if (time() > $_SESSION["timeout"]) {
     
      session_unset();
      if (isset($_COOKIE[session_name()])) {
        setcookie(session_name(), '', time()-42000, '/');
      }
      session_destroy();
      
      header("Location: login.php");
      exit();
   
   } else {
      $_SESSION["timeout"] = time() + $default_session_timeout * 60;
      setcookie(session_name(), session_id(), 0,
                dirname($_SERVER['PHP_SELF']),
                strpos($_SERVER['SERVER_NAME'], '.') ? $_SERVER['SERVER_NAME'] : false,
                !empty($_SERVER['HTTPS']));
   }
   
   // Check all incoming POST requests for the ufid token to preven CSRF attack
   // Only exception would be the login form, but it doesn't use this file.
   if ($_SERVER['REQUEST_METHOD'] == 'POST') {
       if(!isset($_SESSION['ufid']) or !isset($_POST['ufid']) or $_SESSION['ufid'] != $_POST['ufid']) {
           session_unset();
           if (isset($_COOKIE[session_name()])) {
             setcookie(session_name(), '', time()-42000, '/');
           }
           session_destroy();

           header("Location: login.php");
           exit();
       }
   }

   // Register our session variables
   $uid = $_SESSION["uid"];
   $euid = $_SESSION["euid"];
   if (isset($_SESSION["cookies"])) {
      $cookies = $_SESSION["cookies"];
   } else {
      $cookies = 0;
   }

   // Handle both cookie-based sessions and cookieless sessions
   if ($cookies == 1) {
      $sid = "";
      $msid = "?";
   } else {
      $sid = "?" . session_name() . "=" . session_id();
      $msid = $sid . "&";
   }
?>