<?php
//error_reportin(1);
session_start();
$username = "";
if(isset($_SESSION['SESS_LOGGEDIN']) == TRUE) {
    header("Location: " . $config_basedir."trade.php");
}
require ("config.php");
require ("db.php");
?>
<?php
$error = "";
if(isset($_POST['submit'])){
    
    // reCAPTCHA verification
    $recaptcha_secret = "6LdF8xcrAAAAAMyXpYL67jvyb97Pv2VvKpKr1VlW";
    $recaptcha_response = $_POST['recaptcha-token'];

    $verify_response = file_get_contents(
        "https://www.google.com/recaptcha/api/siteverify?secret=" . $recaptcha_secret . "&response=" . $recaptcha_response
    );

    $response_data = json_decode($verify_response);
    if (!$response_data->success || !isset($response_data->score) || $response_data->score < 0.5) {
        exit("reCAPTCHA failed. Please try again.");
    }

    echo $username;
    // Captcha verification is Correct. Final Code Execute here!
    $username = mysqli_real_escape_string($db,$_POST['userBox']);
    $password = mysqli_real_escape_string($db,$_POST['passBox']);

    // fetch user by username
    $loginsql = "SELECT * FROM logins WHERE username = '$username'";
    $loginres = mysqli_query($db, $loginsql);
    $numrows = mysqli_num_rows($loginres);

    if($numrows == 1) {
        $loginrow = mysqli_fetch_assoc($loginres);
        $storedPassword = $loginrow['password'];

        if (password_verify($password, $storedPassword)) {
            // correct hashed password
        } elseif ($password === $storedPassword) {
            // old plaintext password, upgrade to hash
            $newHash = password_hash($password, PASSWORD_DEFAULT);
            mysqli_query($db, "UPDATE logins SET password = '$newHash' WHERE id = " . intval($loginrow['id']));
        } else {
            $error = "Incorrect username/password!";
            goto end;
        }

        $_SESSION['SESS_LOGGEDIN'] = 1;
        $_SESSION['SESS_USERNAME'] = $loginrow['username'];
        $_SESSION['firstname'] = $loginrow['firstname'];
        $_SESSION['profile'] = $loginrow['profile'];
        $_SESSION['lastname'] = $loginrow['lastname'];
        $_SESSION['walletid'] = $loginrow['walletid'];
        $_SESSION['member_no'] = $loginrow['member_no'];
        $_SESSION['profit'] = $loginrow['profit'];
        $_SESSION['interest_rate'] = $loginrow['interest_rate'];
        $_SESSION['max_period'] = $loginrow['max_period'];
        $_SESSION['max_invest'] = $loginrow['max_invest'];
        $_SESSION['invest_period'] = $loginrow['invest_period'];
        $_SESSION['invest_amt'] = $loginrow['invest_amt'];
        $_SESSION['investors_no'] = $loginrow['investors_no'];
        $_SESSION['cashout_no'] = $loginrow['cashout_no'];
        $_SESSION['active_no'] = $loginrow['active_no'];
        $_SESSION['id'] = $loginrow['id'];           //added
        $_SESSION['verifyuser'] = $loginrow['verifyuser'];
        $_SESSION['acc_verified'] = $loginrow['acc_verified'];
        $_SESSION['verified_badge'] = $loginrow['verified_badge'];
        $_SESSION['ver_badge'] = $loginrow['ver_badge'];
        $_SESSION['city'] = $loginrow['city'];
        $_SESSION['state'] = $loginrow['state'];
        $_SESSION['country'] = $loginrow['country'];
        $_SESSION['user_image'] = $loginrow['user_image'];

        $_SESSION['SESS_USERID'] = $loginrow['id'];
        header("Location: trade.php");
        exit();

    } else {
        $error= "Incorrect username/password!";
    }
}

end:
?>