<?php
/**
* Verify authorization zen-cart admin
*
* @package Admin
* @copyright Copyright 2005-2010 Andrew Berezin eCommerce-Service.com
* @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
* @version $Id: zencart.auth.php 1.6 20.02.2011 13:33:52 AndrewBerezin $
*/
$_SESSION['customers_status_id'] = 1;
if (isset($_GET['sid']) && isset($_GET['vam'])) {
$dir_ws_admin = preg_replace('/[^a-zA-Z0-9\-_]/', '', $_GET['vam']) . '/';
$dir_fs_admin = str_replace('\\', '/', __FILE__);
$dir_fs_admin = substr($dir_fs_admin, 0, strpos($dir_fs_admin, '/includes/javascript/tiny_mce/plugins/ajaxfilemanager/')) . '/';

$cwd = getcwd();
chdir($dir_fs_admin);

if (file_exists('includes/local/configure.php')) {
include('includes/local/configure.php');
}

if (file_exists('includes/configure.php')) {
include('includes/configure.php');
}
if (!defined('SESSION_WRITE_DIRECTORY')) define('SESSION_WRITE_DIRECTORY', session_save_path());
if (defined('DB_DATABASE')) {
if (($zen_mysqli_link = @mysqli_connect(DB_SERVER, DB_SERVER_USERNAME, DB_SERVER_PASSWORD, DB_DATABASE))) {
if (!defined('DB_PREFIX')) define('DB_PREFIX', '');
// Modified piece of code from whos_online.php
$info = $_GET['sid'];
$session_data = '';

if (STORE_SESSIONS == 'mysqli') {
$session_data_query = mysqli_query($zen_mysqli_link,"select value from " . DB_PREFIX . "sessions
WHERE sesskey = '" . $info . "'");

if ($session_data = mysqli_fetch_array($session_data_query, MYSQLI_ASSOC)) {
$session_data = trim($session_data['value']);
}
} else {
if (!defined('SESSION_WRITE_DIRECTORY')) {
$session_write_directory_query = mysqli_query($zen_mysqli_link,"SELECT * FROM " . DB_PREFIX .
"configuration WHERE configuration_key='SESSION_WRITE_DIRECTORY'", $zen_mysqli_link);
if (mysqli_num_rows($session_write_directory_query) > 0) {
$session_write_directory = mysqli_fetch_array($session_write_directory_query, MYSQLI_ASSOC);
$session_write_directory = $session_write_directory['configuration_value'];
}
} else {
//            $session_write_directory = SESSION_WRITE_DIRECTORY;
$session_write_directory = session_save_path();
}
$session_file = $session_write_directory . '/sess_' . $info;
if ( (file_exists($session_file)) && (filesize($session_file) > 0) ) {
$session_data = file($session_file);
$session_data = trim(implode('', $session_data));
}
}
$hardenedStatus = FALSE;
$marker='login_groups_id|';
if (strpos($session_data,$marker)!==false){
$suffix=substr($session_data,strpos($session_data,$marker)+(strlen($marker)),strlen($session_data));
if (preg_match('|s[\:\d]+"(\d+)";|',$suffix,$arr)){
if (($arr[1]==1)||($arr[1]==2)){
$_SESSION['customers_status_id'] = 0;
}
}
}


}
if (isset($zen_mysqli_link) && is_resource($zen_mysqli_link)) {
mysqli_close($zen_mysqli_link);
unset($zen_mysqli_link);
}
}

chdir($cwd);
}else{$_SESSION['customers_status_id'] = 1;}

if ($_SESSION['customers_status_id'] == 0) {
$_SESSION[$auth->__loginIndexInSession] = true;
} else {
header('HTTP/1.1 403 Forbidden');
echo 'Forbidden';
exit(0);
}