assign('mesajSucces',"Datele au fost actualizate

"); if ($_POST['adresaCorespondenta']!='') $db->simpleQuery("UPDATE users set adresaCorespondenta='".$db->cleanVar($_POST['adresaCorespondenta'])."' where id='".$_SESSION['userId']."' LIMIT 1"); else $errors['adresaCorespondenta']='Nu ati completat adresa'; if ($_POST['judet']>0) $db->simpleQuery("UPDATE users set judet='".$db->cleanVar($_POST['judet'])."' where id='".$_SESSION['userId']."' LIMIT 1"); if ($_POST['localitate']>0) $db->simpleQuery("UPDATE users set localitate='".$db->cleanVar($_POST['localitate'])."' where id='".$_SESSION['userId']."' LIMIT 1"); } if ($_POST['step']=='updateDatePersonale' and $tip==1) { $telefonInvalid=0; if (strlen($_POST['phone'])!=10) { $errors['telefon']='Telefon invalid'; $error=1;$telefonInvalid=1; } else { $telefon=$_POST['phone']; for ($i=0; $i<=9; $i++) { if (!is_numeric($telefon[$i])) { $errors['telefon']='Telefon invalid'; $error=1;$telefonInvalid=1; break;} } } if ($telefonInvalid!=1) $db->simpleQuery("UPDATE users set phone='".$db->cleanVar($_POST['phone'])."' where id='".$_SESSION['userId']."' LIMIT 1"); if (strlen($_POST['lastName'])<3) { $errors['nume']='Numele este obligatoriu'; $error=1; } else $db->simpleQuery("UPDATE users set lastName='".$db->cleanVar($_POST['lastName'])."' where id='".$_SESSION['userId']."' LIMIT 1"); if (strlen($_POST['prenume'])<3) { $errors['prenume']='Prenumele este obligatoriu'; $error=1; } else $db->simpleQuery("UPDATE users set firstName='".$db->cleanVar($_POST['prenume'])."' where id='".$_SESSION['userId']."' LIMIT 1"); } if ($_POST['step']=='updateDateProfesionale' and $tip==2) { $smarty->assign('mesajSucces',"Datele au fost actualizate

"); if ($_POST['ocupatia']>0) { $db->simpleQuery("UPDATE users set ocupatia='".$db->cleanVar($_POST['ocupatia'])."' where id='".$_SESSION['userId']."' LIMIT 1"); if ($_POST['specializare']>0) $db->simpleQuery("UPDATE users set specializarea='".$db->cleanVar($_POST['specializare'])."' where id='".$_SESSION['userId']."' LIMIT 1"); } $db->simpleQuery("UPDATE users set specializarea2='".$db->cleanVar($_POST['specializare2'])."' where id='".$_SESSION['userId']."' LIMIT 1"); $db->simpleQuery("UPDATE users set nrMinori='".$db->cleanVar($_POST['nrMinori'])."' where id='".$_SESSION['userId']."' LIMIT 1"); if ($_POST['titluUniversitar']>0) $db->simpleQuery("UPDATE users set titluUniversitar='".$db->cleanVar($_POST['titluUniversitar'])."' where id='".$_SESSION['userId']."' LIMIT 1"); $db->simpleQuery("UPDATE users set codParafa='".$db->cleanVar($_POST['codParafa'])."' where id='".$_SESSION['userId']."' LIMIT 1"); $cuimInvalid=0; if ($_POST['ocupatia']==1 or $_POST['ocupatia']==6) if (strlen($_POST['cuim'])!=10) { $errors['cuim']='CUIM invalid'; $error=1; $cuimInvalid=1;} else { $telefon=$_POST['cuim']; for ($i=0; $i<=9; $i++) { if (!is_numeric($telefon[$i])) { $errors['cuim']='CUIM invalid'; $error=1; $cuimInvalid=1; break;} } } if ($cuimInvalid!=1) $db->simpleQuery("UPDATE users set cuim='".$db->cleanVar($_POST['cuim'])."' where id='".$_SESSION['userId']."' LIMIT 1"); if (strlen($_POST['denumireaInstitutiei'])>5) $db->simpleQuery("UPDATE users set denumireaInstitutiei='".$db->cleanVar($_POST['denumireaInstitutiei'])."' where id='".$_SESSION['userId']."' LIMIT 1"); else { $errors['denumireaInstitutiei']='Denumire Invalida'; $error=1;} if (strlen($_POST['adresaInstitutiei'])>5) $db->simpleQuery("UPDATE users set adresaInstitutiei='".$db->cleanVar($_POST['adresaInstitutiei'])."' where id='".$_SESSION['userId']."' LIMIT 1"); else { $errors['adresaInstitutiei']='Adresa Invalida'; $error=1;} if ($_POST['judetInstitutie']>0) { $db->simpleQuery("UPDATE users set judetInstitutie='".$db->cleanVar($_POST['judetInstitutie'])."' where id='".$_SESSION['userId']."' LIMIT 1"); if ($_POST['localitateInstitutie']>0) $db->simpleQuery("UPDATE users set localitateInstitutie='".$db->cleanVar($_POST['localitateInstitutie'])."' where id='".$_SESSION['userId']."' LIMIT 1"); } } $smarty->assign('errors',$errors); if ($tip==0) { if ($_POST['step']=='updatePassAndMarketing') { $error=0; $db->simpleQuery("UPDATE users set acordSms='".$db->cleanVar($_POST['acordSms'])."', acordPosta='".$db->cleanVar($_POST['acordPosta'])."', acordEmail='".$db->cleanVar($_POST['acordEmail'])."' where id='".$_SESSION['userId']."' LIMIT 1"); if (strlen($_POST['myPass'])<6) {$errors['parola']='Parola noua, minim 6 caractere'; $error=1; } if ($_POST['myPass']!=$_POST['myConfirm']) {$errors['confirmare']='Parolele nu corespund'; $error=1; } if (strlen($_POST['currentPass'])<6) {$errors['parolaCurenta']='Parola veche nu corespunde'; $error=1; } else { if ($error==0) { $rUsers=$db->returnArray("SELECT * from users where id='".$_SESSION['userId']."' LIMIT 1"); foreach ($rUsers as $key=>$user) { if (password_verify($db->cleanVar($_POST['currentPass']),$user['password'])) { $db->simpleQuery("UPDATE users set password='".password_hash($db->cleanVar($_POST['myPass']),PASSWORD_DEFAULT)."' where id='".$_SESSION['userId']."' LIMIT 1"); $mesajSucces='
Datele au fost actualizate

'; } else {$errors['parolaCurenta']='Parola veche nu corespunde'; $error=1; } } } } if ($_POST['myPass']=='' and $_POST['myConfirm']=='' and $_POST['currentPass']=='') $error=0; if ($error==1) { $smarty->assign('errors',$errors); } $smarty->assign('mesajSucces',$mesajSucces); } $rUsers=$db->returnArray("SELECT * from users where id='".$_SESSION['userId']."' LIMIT 1"); foreach ($rUsers as $key=>$user) { if ($user['acordEmail']==1) $checked['email']='checked'; if ($user['acordSms']==1) $checked['sms']='checked'; if ($user['acordPosta']==1) $checked['posta']='checked'; $smarty->assign('checked',$checked); } } $rUsers=$db->returnArray("SELECT * from users where id='".$_SESSION['userId']."' LIMIT 1"); foreach ($rUsers as $key=>$user) { $smarty->assign('post',$user); $smarty->assign('user',$user); if ($tip==2 or $tip==1) { $judResult=$db->returnArray("SELECT * from judete order by denumire"); foreach ($judResult as $key=>$judet) { if ($judet['id']==$user['judet']) $judete.=''; else $judete.=''; if ($judet['id']==$user['judetInstitutie']) $judeteInstitutie.=''; else $judeteInstitutie.=''; } $smarty->assign('judete', $judete); $smarty->assign('judeteInstitutie', $judeteInstitutie); $ocupatiiResult=$db->returnArray("SELECT * from ocupatii where denumire!='' and status=1 order by pozitie"); foreach ($ocupatiiResult as $key=>$ocupatie) { if ($ocupatie['id']==$user['ocupatia']) $ocupatii.=''; else $ocupatii.=''; } $smarty->assign('ocupatii', $ocupatii); if ($user['judet']>0) { $locResult=$db->returnArray("SELECT * from localitati where idjudet='".$db->cleanVar($user['judet'])."' order by denumire"); foreach ($locResult as $key=>$localitate) { if ($localitate['id']==$user['localitate']) $localitati.=''; else $localitati.=''; } $smarty->assign('localitati', $localitati); } if ($user['judetInstitutie']>0) { $locResult=$db->returnArray("SELECT * from localitati where idjudet='".$db->cleanVar($user['judetInstitutie'])."' order by denumire"); foreach ($locResult as $key=>$localitate) { if ($localitate['id']==$user['localitateInstitutie']) $localitatiInstitutie.=''; else $localitatiInstitutie.=''; } $smarty->assign('localitatiInstitutie', $localitatiInstitutie); } $specResult=$db->returnArray("SELECT specializari.id,specializari.denumire from specializari INNER join ocupatii_specializari on specializari.id=ocupatii_specializari.idSpecializare Where ocupatii_specializari.idOcupatie='".$db->cleanVar($user['ocupatia'])."' order by denumire"); foreach ($specResult as $key=>$specializare) { if ($specializare['id']==$user['specializarea']) $specializari.=''; else $specializari.=''; if ($specializare['id']==$user['specializarea2']) $specializari2.=''; else $specializari2.=''; } $smarty->assign('specializari', $specializari); $smarty->assign('specializari2', $specializari2); } } } function tryCookieLogin() { $db=new bazaDate(); if ($_SESSION['userId']<1 and $_COOKIE['user']>0) { if ($_COOKIE['secret']==md5($_COOKIE['user'].'proiectMedichub2022')) { $userId=$db->cleanVar($_COOKIE['user']); $_SESSION['userName']=$db->getField("SELECT CONCAT (lastName,' ',firstName) as name from users where id=$userId and status=1 LIMIT 1",'name'); $_SESSION['firstName']=$db->getField("SELECT firstName as name from users where id=$userId and status=1 LIMIT 1",'name'); $_SESSION['userId']=$userId; } } } function chpass($userId) { $db=new bazaDate(); if (strlen($_POST['myPass'])<6) $error='Parola minim 6 caractere'; else if ($_POST['myPass']!=$_POST['confirm']) $error='Confirmarea parolei nu corespunde'; else { $db->simpleQuery("UPDATE usersCni set parola='".md5($_POST['myPass'])."' where id='$userId' LIMIT 1"); $db->simpleQuery("UPDATE usersLostPass set status=1 where status=0 and userId='$userId'"); // $_SESSION['userName']=$db->getField("SELECT CONCAT (lastName,' ',firstName) as name from usersCni where id=$userId and status=1 LIMIT 1",'name'); // $_SESSION['firstName']=$db->getField("SELECT firstName as name from usersCni where id=$userId and status=1 LIMIT 1",'name'); // $_SESSION['userId']=$userId; // header("Location: ".$GLOBALS['dir'].$_SESSION['lastVisited']); $error='

Parola a fost schimbata

'; } return $error; } function verifyChange($act) { $db=new bazaDate(); if (strlen($act)>7) { $act=$db->cleanVar($act); $userId=$db->getField("SELECT userId from usersLostPass where status=0 and act='$act' LIMIT 1",'userId'); } return $userId; } function recoverPass() { $db=new bazaDate(); $smarty=$GLOBALS['smarty']; $err = 0; $erori = ''; // Verificare CSRF doar dacă se trimite formularul if (isset($_POST['step']) && $_POST['step'] == 'recoverPass') { $csrftok = isset($_POST['csrf_token']) ? $_POST['csrf_token'] : ''; $sessionToken = isset($_SESSION['csrf_token']) ? $_SESSION['csrf_token'] : ''; if (!hash_equals($sessionToken, $csrftok)) { $err = 1; $erori = 'Sesiunea a expirat sau cererea nu este valida. Reincarca pagina si incearca din nou.
'; } else if (strlen($_POST['email'])>5) { $userId=$db->getField("SELECT id from usersCni where status=1 and lower(email)='".strtolower($db->cleanVar($_POST['email']))."' LIMIT 1",'id'); if ($userId>0) { $db->simpleQuery("UPDATE usersLostPass set status=2 where userId='$userId'"); $act=md5($userId.'nmf-=a'.date("Y-m-d H:i:s").'---'.strtolower($db->cleanVar($_POST['email'])).'88'.rand(0,11111)); $myarr=array('userId'=>$userId,'act'=>$act); $db->insert('usersLostPass',$myarr); $linkActivare=$GLOBALS['dir'].'users/passwordchange/'.$act; $mesaj='Buna ziua,

Pentru schimbarea parolei este nevoie sa accesati link-ul de mai jos:
{linkChangePass}

Compania Nationala de Investitii'; $mesaj=str_replace('{linkChangePass}',$linkActivare,$mesaj); mail_new(trim($db->cleanVar($_POST['email'])),'Recuperare parola cont achizitii.cni.ro',$mesaj); } $continut='

Un e-mail pentru recuperarea parolei a fost trimis la '.$_POST['email'].'

'; $smarty->assign('continut2',$continut); return; } } // Afișare formular (fie la prima încărcare, fie dacă sunt erori) $continut='

Recuperare Parola

'.$erori.'
'; $smarty->assign('continut2',$continut); } function activateUser($act) { $db=new bazaDate(); $act=$db->cleanVar($act); $userId=$db->getField("SELECT id from usersCni where act='$act' and status=0 and emailValidat=0 LIMIT 1",'id'); if ($userId>0) { $db->simpleQuery("UPDATE usersCni set emailValidat=1, dataValidareEmail=NOW() where id='$userId' LIMIT 1"); } else header("Location: ".$GLOBALS['dir']); return $userId; } function login($username, $password) { $db = new bazaDate(); $errorRecaptcha = 0; // IP-uri pentru care nu e nevoie de 2FA $ipWhitelist = [ '86.107.237.162', // Exemplu IP '81.196.246.79' ]; $userIp = $_SERVER['REMOTE_ADDR']; if (strlen($username) >= 6 && strlen($password) >= 6) { $username = $db->cleanVar($username); $password = $db->cleanVar($password); $passwordHash = $db->getField("SELECT parola FROM usersCni WHERE email='$username' AND status=1 LIMIT 1", 'parola'); if (md5($password) == $passwordHash) { $userId = $db->getField("SELECT id FROM usersCni WHERE email='$username' AND status=1 LIMIT 1", 'id'); $userName = $db->getField("SELECT denumire AS name FROM usersCni WHERE email='$username' AND status=1 LIMIT 1", 'name'); $userType = $db->getField("SELECT userType FROM usersCni WHERE email='$username' AND status=1 LIMIT 1", 'userType'); if (in_array($userIp, $ipWhitelist)) { // IP-ul este �n whitelist -> logam direct $_SESSION['userId'] = $userId; $_SESSION['userName'] = $userName; $cookiesDomain = ""; // aici pui domeniul tau setcookie("user", $_SESSION['userId'], time() + 3600 * 24 * 30, "/", $cookiesDomain, 1); setcookie("secret", md5($_SESSION['userId'].'cni2024'), time() + 3600 * 24 * 30, "/", $cookiesDomain, 1); $db->insert('userLoginLog', ['userId' => $_SESSION['userId']]); if ($userType==2) header("Location: ".$GLOBALS['dir'].'erp'); if ($userType==1) header("Location: ".$GLOBALS['dir'].''); if ($userType==0) header("Location: ".$GLOBALS['dir'].'choose'); exit; } else { // IP-ul nu este �n whitelist -> trimitem cod 2FA $_SESSION['temp_userId'] = $userId; $_SESSION['temp_userName'] = $userName; $_SESSION['temp_email'] = $username; $code2FA = rand(100000, 999999); $_SESSION['2fa_code'] = $code2FA; $_SESSION['2fa_expires'] = time() + 300; // valabil 5 minute $subiect = "Codul tau de autentificare"; $mesaj = ' Cod de autentificare

Salut, ' . htmlspecialchars($userName) . '!

Codul tau de autentificare este:

' . htmlspecialchars($code2FA) . '

Codul este valabil 5 minute.



Compania Nationala de Investitii S.A.

'; mail_new($username, $subiect, $mesaj); header("Location: ".$GLOBALS['dir'].'2fa'); exit; } } } if (empty($_SESSION['userId'])) { $avemUserInactiv = $db->getField("SELECT id FROM usersCni WHERE email='$username' AND status=0 LIMIT 1", 'id'); if ($avemUserInactiv > 0) return -1; } else { return $_SESSION['userId']; } } function logout() { unset($_SESSION['userName']); unset($_SESSION['userId']); unset($_SESSION['hourLogin']); unset($_SESSION['statusPlata']); setcookie("user", '0', time()+3600*24*30, "/", $cookiesDomain, 1); setcookie("secret", '0', time()+3600*24*30, "/", $cookiesDomain, 1); unset($_COOKIE['user']); unset($_COOKIE['secret']); unset($_SESSION['triedLogin']); header("Location: ".$GLOBALS['dir']); } function register() { $db=new bazaDate(); $smarty=$GLOBALS['smarty']; $dir=$GLOBALS['dir']; $smarty->assign('secure', md5(date("Y-m-d").'nf0fanfalonfonfsanoifsa')); if ($_SERVER["REQUEST_METHOD"] == "POST") if ($_POST['step']=='userRegister') { $errors = array(); $csrftok = isset($_POST['csrf_token']) ? $_POST['csrf_token'] : ''; $sessionToken = isset($_SESSION['csrf_token']) ? $_SESSION['csrf_token'] : ''; if (!hash_equals($sessionToken, $csrftok)) { $err = 1; $errors[] = 'Sesiunea a expirat sau cererea nu este valida. Reincarca pagina si incearca din nou.
'; } // Validate mandatory fields if (empty($_POST['denumire'])) { $errors[] = "Denumirea este obligatorie."; } if (empty($_POST['sediu'])) { $errors[] = "Sediu este un camp obligatoriu."; } if (empty($_POST['cui'])) { $errors[] = "CUI este un camp obligatoriu."; } if (empty($_POST['telefon'])) { $errors[] = "Telefon este un camp obligatoriu."; } if (empty($_POST['email'])) { $errors[] = "Email este un camp obligatoriu."; } if (strlen($_POST['myPass'])<6) { $errors[] = "Parola Minim 6 Caractere"; } else if ($_POST['myPass']!=$_POST['confirm']) { $errors[] = "Parolele nu corespund"; } if (empty($errors)) { $verifyMail=$db->getField("SELECT id from usersCni where lower(email)='".$db->cleanVar((strtolower($_POST['email'])))."' LIMIT 1",'id'); if (intval($verifyMail)>0) { $errors[] = 'Acest e-mail exista in baza de date. Recuperare Parola '; } else if (isset($_FILES["pdfFile"]) && $_FILES["pdfFile"]["error"] == 0) { $allowedExtensions = array("pdf"); $fileExtension = pathinfo($_FILES["pdfFile"]["name"], PATHINFO_EXTENSION); // Check if the file extension is allowed if (in_array(strtolower($fileExtension), $allowedExtensions)) { $maxFileSize = 150 * 1024 * 1024; // 100MB in bytes // Check file size if ($_FILES["pdfFile"]["size"] <= $maxFileSize) { // File is within the size limit, move it to the desired location // Generate new file name $dateTime = new DateTime(); $timestamp = $dateTime->format('Ymd_His'); $randomString = bin2hex(random_bytes(8)); // Generate an 8-byte random string $originalFileName = pathinfo($_FILES["pdfFile"]["name"], PATHINFO_FILENAME). '.' . $fileExtension; $newFileName = $timestamp . '_' . $randomString . '.' . $fileExtension; // Encrypt the uploaded file $encryptedFile = "offers/users/cui/" . $newFileName; encryptFile($_FILES["pdfFile"]["tmp_name"], $encryptedFile, $GLOBALS['cniKey']); unlink($_FILES["pdfFile"]["tmp_name"]); $act=md5(date("Ymdhis").'$$'.rand(0,99999).$_POST['denumire']); $arr=array( 'denumire'=>$_POST['denumire'], 'adresa'=>$_POST['sediu'], 'cui'=>$_POST['cui'], 'regcom'=>$_POST['regcom'], 'telefon'=>$_POST['telefon'], 'email'=>$_POST['email'], 'parola'=>md5($_POST['myPass']), 'act'=>$act, 'userType'=>0, 'cuiPDF'=>$encryptedFile, 'originalFileName'=>$originalFileName ); $db->insert('usersCni',$arr); $subiect='Verificare adresa de e-mail'; $mesaj=' Buna ziua,

Pentru validarea adresei de e-mail este nevoie sa accesati link-ul de mai jos:
'.$dir.'activare/'.$act.'

Compania Nationala de Investitii '; mail_new($_POST['email'],$subiect,$mesaj); $succes=1; } else $errors[] = "Atasati Certificat Constatator ONRC in format PDF"; } else $errors[] = "Atasati Certificat Constatator ONRC in format PDF"; } else $errors[] = "Atasati Certificat Constatator ONRC in format PDF"; } } if (!empty($errors)) $erori=''.implode("
", $errors).'


'; if ($succes==1) { $textRegister.='

Un e-mail a fost trimis pentru validare.

'; } if ($succes!=1) { $textRegister.='
'.$erori.'
'; } return $textRegister; } } ?>' . "\r\n"; //mail($to, $subject, $message, $headers); $headers = array ('From' => $smtp_user, 'To' => $to, 'Subject' => $subject, 'MIME-Version' => 1, "Content-Transfer-Encoding" => "8bit", 'Date' => date('r', time())); { // 'debug'=>'false', $smtp = Mail::factory('smtp', array ('host' => 'achizitii.cni.ro', 'port' => 25, 'auth' => 'PLAIN', 'socket_options' => array('ssl' => array('verify_peer_name' => false)), 'username' => $smtp_user, 'password' => $smtp_pass)); $mime = new Mail_mime($crlf); // Setting the body of the email // $mime->setTXTBody(strip_tags($message)); $mime->setHTMLBody($message); $body = $mime->get($mimeparams); $headers = $mime->headers($headers); // Sending the email $mail = Mail::factory('mail'); $mail = $smtp->send($to, $headers, $body); } /* if (PEAR::isError($mail)) { echo("

" . $mail->getMessage() . "

"); } else { echo("

Message successfully sent!

"); } */ } //mail_new('darius.d@infinite.ro','Acces platforma','Stimate Darius merge platforma'); ?>