//config domain
//$domainname=strtolower(str_replace("www.depotnew.raspund.ro","",$_SERVER['HTTP_HOST']));
$domainname='cni.ngp.ro';
$config_site_url='https://'.$domainname.'/'; //mandatory to end with /
$config_site_short_url=''.$domainname.'';
$config_domain_name=''.$domainname;
//end config domain
//admin
$config_admin_url='https://'.$domainname.'/admin';
//database
$dbhost = 'localhost';
$dbname = 'ngp_cni';
$dbuser = 'ngp_cni';
$dbpass = 'CbzdGrZveaNx';
$cniKey='cnikCFSA%#Q#bzdCbzdGrZve@$%!%@#!%@#aNxGrZveaNx';
//config denumire cat
$config_denumire_pagini='pag';
global $config_denumire_categorii;
$config_denumire_categorii='produse';
$config_denumire_produs='produs';
$config_tva_produs=20;
$dir=$config_site_url;
$GLOBALS['dir']=$dir;
$config_site_name='Compania Nationala de Investitii S.A.';
//pages config
$catname='cat';
$subcatname='subcat';
$subsubname='produse';
$pagname='pag';
$prodname='produs';
//modalitate plata
//OP
$config_numerar_op_active=0; //1-activ 0-dezactivat;
//company details
$config_furnizor_bank=' ';
$config_furnizor_company_details='';
//other
$dir=$config_site_url;
//analytics
$config_analytics="";
?>
class users
{
function profileUpdate($tip=0) //0 parola si marketing, 1-personal, 2 - profesional
{
$db=new bazaDate();
$smarty=$GLOBALS['smarty'];
if ($_POST['step']=='updateDatePersonale')
{
$smarty->assign('mesajSucces',"Datele au fost actualizate
");
if ($_POST['adresaCorespondenta']!='')
$db->simpleQuery("UPDATE users set adresaCorespondenta='".$db->cleanVar($_POST['adresaCorespondenta'])."' where id='".$_SESSION['userId']."' LIMIT 1");
else $errors['adresaCorespondenta']='Nu ati completat adresa';
if ($_POST['judet']>0)
$db->simpleQuery("UPDATE users set judet='".$db->cleanVar($_POST['judet'])."' where id='".$_SESSION['userId']."' LIMIT 1");
if ($_POST['localitate']>0)
$db->simpleQuery("UPDATE users set localitate='".$db->cleanVar($_POST['localitate'])."' where id='".$_SESSION['userId']."' LIMIT 1");
}
if ($_POST['step']=='updateDatePersonale' and $tip==1)
{
$telefonInvalid=0;
if (strlen($_POST['phone'])!=10) { $errors['telefon']='Telefon invalid'; $error=1;$telefonInvalid=1; }
else
{
$telefon=$_POST['phone'];
for ($i=0; $i<=9; $i++)
{
if (!is_numeric($telefon[$i])) { $errors['telefon']='Telefon invalid'; $error=1;$telefonInvalid=1; break;}
}
}
if ($telefonInvalid!=1)
$db->simpleQuery("UPDATE users set phone='".$db->cleanVar($_POST['phone'])."' where id='".$_SESSION['userId']."' LIMIT 1");
if (strlen($_POST['lastName'])<3) { $errors['nume']='Numele este obligatoriu'; $error=1; }
else $db->simpleQuery("UPDATE users set lastName='".$db->cleanVar($_POST['lastName'])."' where id='".$_SESSION['userId']."' LIMIT 1");
if (strlen($_POST['prenume'])<3) { $errors['prenume']='Prenumele este obligatoriu'; $error=1; }
else $db->simpleQuery("UPDATE users set firstName='".$db->cleanVar($_POST['prenume'])."' where id='".$_SESSION['userId']."' LIMIT 1");
}
if ($_POST['step']=='updateDateProfesionale' and $tip==2)
{
$smarty->assign('mesajSucces',"Datele au fost actualizate
");
if ($_POST['ocupatia']>0)
{
$db->simpleQuery("UPDATE users set ocupatia='".$db->cleanVar($_POST['ocupatia'])."' where id='".$_SESSION['userId']."' LIMIT 1");
if ($_POST['specializare']>0)
$db->simpleQuery("UPDATE users set specializarea='".$db->cleanVar($_POST['specializare'])."' where id='".$_SESSION['userId']."' LIMIT 1");
}
$db->simpleQuery("UPDATE users set specializarea2='".$db->cleanVar($_POST['specializare2'])."' where id='".$_SESSION['userId']."' LIMIT 1");
$db->simpleQuery("UPDATE users set nrMinori='".$db->cleanVar($_POST['nrMinori'])."' where id='".$_SESSION['userId']."' LIMIT 1");
if ($_POST['titluUniversitar']>0)
$db->simpleQuery("UPDATE users set titluUniversitar='".$db->cleanVar($_POST['titluUniversitar'])."' where id='".$_SESSION['userId']."' LIMIT 1");
$db->simpleQuery("UPDATE users set codParafa='".$db->cleanVar($_POST['codParafa'])."' where id='".$_SESSION['userId']."' LIMIT 1");
$cuimInvalid=0;
if ($_POST['ocupatia']==1 or $_POST['ocupatia']==6)
if (strlen($_POST['cuim'])!=10) { $errors['cuim']='CUIM invalid'; $error=1; $cuimInvalid=1;}
else
{
$telefon=$_POST['cuim'];
for ($i=0; $i<=9; $i++)
{
if (!is_numeric($telefon[$i])) { $errors['cuim']='CUIM invalid'; $error=1; $cuimInvalid=1; break;}
}
}
if ($cuimInvalid!=1)
$db->simpleQuery("UPDATE users set cuim='".$db->cleanVar($_POST['cuim'])."' where id='".$_SESSION['userId']."' LIMIT 1");
if (strlen($_POST['denumireaInstitutiei'])>5)
$db->simpleQuery("UPDATE users set denumireaInstitutiei='".$db->cleanVar($_POST['denumireaInstitutiei'])."' where id='".$_SESSION['userId']."' LIMIT 1");
else { $errors['denumireaInstitutiei']='Denumire Invalida'; $error=1;}
if (strlen($_POST['adresaInstitutiei'])>5)
$db->simpleQuery("UPDATE users set adresaInstitutiei='".$db->cleanVar($_POST['adresaInstitutiei'])."' where id='".$_SESSION['userId']."' LIMIT 1");
else { $errors['adresaInstitutiei']='Adresa Invalida'; $error=1;}
if ($_POST['judetInstitutie']>0)
{
$db->simpleQuery("UPDATE users set judetInstitutie='".$db->cleanVar($_POST['judetInstitutie'])."' where id='".$_SESSION['userId']."' LIMIT 1");
if ($_POST['localitateInstitutie']>0)
$db->simpleQuery("UPDATE users set localitateInstitutie='".$db->cleanVar($_POST['localitateInstitutie'])."' where id='".$_SESSION['userId']."' LIMIT 1");
}
}
$smarty->assign('errors',$errors);
if ($tip==0)
{
if ($_POST['step']=='updatePassAndMarketing')
{
$error=0;
$db->simpleQuery("UPDATE users set acordSms='".$db->cleanVar($_POST['acordSms'])."', acordPosta='".$db->cleanVar($_POST['acordPosta'])."', acordEmail='".$db->cleanVar($_POST['acordEmail'])."' where id='".$_SESSION['userId']."' LIMIT 1");
if (strlen($_POST['myPass'])<6) {$errors['parola']='Parola noua, minim 6 caractere'; $error=1; }
if ($_POST['myPass']!=$_POST['myConfirm']) {$errors['confirmare']='Parolele nu corespund'; $error=1; }
if (strlen($_POST['currentPass'])<6) {$errors['parolaCurenta']='Parola veche nu corespunde'; $error=1; }
else
{
if ($error==0)
{
$rUsers=$db->returnArray("SELECT * from users where id='".$_SESSION['userId']."' LIMIT 1");
foreach ($rUsers as $key=>$user)
{
if (password_verify($db->cleanVar($_POST['currentPass']),$user['password']))
{
$db->simpleQuery("UPDATE users set password='".password_hash($db->cleanVar($_POST['myPass']),PASSWORD_DEFAULT)."' where id='".$_SESSION['userId']."' LIMIT 1");
$mesajSucces='
Datele au fost actualizate
';
} else {$errors['parolaCurenta']='Parola veche nu corespunde'; $error=1; }
}
}
}
if ($_POST['myPass']=='' and $_POST['myConfirm']=='' and $_POST['currentPass']=='')
$error=0;
if ($error==1)
{
$smarty->assign('errors',$errors);
}
$smarty->assign('mesajSucces',$mesajSucces);
}
$rUsers=$db->returnArray("SELECT * from users where id='".$_SESSION['userId']."' LIMIT 1");
foreach ($rUsers as $key=>$user)
{
if ($user['acordEmail']==1) $checked['email']='checked';
if ($user['acordSms']==1) $checked['sms']='checked';
if ($user['acordPosta']==1) $checked['posta']='checked';
$smarty->assign('checked',$checked);
}
}
$rUsers=$db->returnArray("SELECT * from users where id='".$_SESSION['userId']."' LIMIT 1");
foreach ($rUsers as $key=>$user)
{
$smarty->assign('post',$user);
$smarty->assign('user',$user);
if ($tip==2 or $tip==1)
{
$judResult=$db->returnArray("SELECT * from judete order by denumire");
foreach ($judResult as $key=>$judet)
{
if ($judet['id']==$user['judet']) $judete.='';
else $judete.='';
if ($judet['id']==$user['judetInstitutie']) $judeteInstitutie.='';
else $judeteInstitutie.='';
}
$smarty->assign('judete', $judete);
$smarty->assign('judeteInstitutie', $judeteInstitutie);
$ocupatiiResult=$db->returnArray("SELECT * from ocupatii where denumire!='' and status=1 order by pozitie");
foreach ($ocupatiiResult as $key=>$ocupatie)
{
if ($ocupatie['id']==$user['ocupatia']) $ocupatii.='';
else $ocupatii.='';
}
$smarty->assign('ocupatii', $ocupatii);
if ($user['judet']>0)
{
$locResult=$db->returnArray("SELECT * from localitati where idjudet='".$db->cleanVar($user['judet'])."' order by denumire");
foreach ($locResult as $key=>$localitate)
{
if ($localitate['id']==$user['localitate']) $localitati.='';
else $localitati.='';
}
$smarty->assign('localitati', $localitati);
}
if ($user['judetInstitutie']>0)
{
$locResult=$db->returnArray("SELECT * from localitati where idjudet='".$db->cleanVar($user['judetInstitutie'])."' order by denumire");
foreach ($locResult as $key=>$localitate)
{
if ($localitate['id']==$user['localitateInstitutie']) $localitatiInstitutie.='';
else $localitatiInstitutie.='';
}
$smarty->assign('localitatiInstitutie', $localitatiInstitutie);
}
$specResult=$db->returnArray("SELECT specializari.id,specializari.denumire from specializari
INNER join ocupatii_specializari on specializari.id=ocupatii_specializari.idSpecializare
Where ocupatii_specializari.idOcupatie='".$db->cleanVar($user['ocupatia'])."' order by denumire");
foreach ($specResult as $key=>$specializare)
{
if ($specializare['id']==$user['specializarea']) $specializari.='';
else $specializari.='';
if ($specializare['id']==$user['specializarea2']) $specializari2.='';
else $specializari2.='';
}
$smarty->assign('specializari', $specializari);
$smarty->assign('specializari2', $specializari2);
}
}
}
function tryCookieLogin()
{
$db=new bazaDate();
if ($_SESSION['userId']<1 and $_COOKIE['user']>0)
{
if ($_COOKIE['secret']==md5($_COOKIE['user'].'proiectMedichub2022'))
{
$userId=$db->cleanVar($_COOKIE['user']);
$_SESSION['userName']=$db->getField("SELECT CONCAT (lastName,' ',firstName) as name from users where id=$userId and status=1 LIMIT 1",'name');
$_SESSION['firstName']=$db->getField("SELECT firstName as name from users where id=$userId and status=1 LIMIT 1",'name');
$_SESSION['userId']=$userId;
}
}
}
function chpass($userId)
{
$db=new bazaDate();
if (strlen($_POST['myPass'])<6) $error='Parola minim 6 caractere';
else if ($_POST['myPass']!=$_POST['confirm']) $error='Confirmarea parolei nu corespunde';
else
{
$db->simpleQuery("UPDATE usersCni set parola='".md5($_POST['myPass'])."' where id='$userId' LIMIT 1");
$db->simpleQuery("UPDATE usersLostPass set status=1 where status=0 and userId='$userId'");
// $_SESSION['userName']=$db->getField("SELECT CONCAT (lastName,' ',firstName) as name from usersCni where id=$userId and status=1 LIMIT 1",'name');
// $_SESSION['firstName']=$db->getField("SELECT firstName as name from usersCni where id=$userId and status=1 LIMIT 1",'name');
// $_SESSION['userId']=$userId;
// header("Location: ".$GLOBALS['dir'].$_SESSION['lastVisited']);
$error='
Parola a fost schimbata
';
}
return $error;
}
function verifyChange($act)
{
$db=new bazaDate();
if (strlen($act)>7)
{
$act=$db->cleanVar($act);
$userId=$db->getField("SELECT userId from usersLostPass where status=0 and act='$act' LIMIT 1",'userId');
}
return $userId;
}
function recoverPass()
{
$db=new bazaDate();
$smarty=$GLOBALS['smarty'];
$err = 0;
$erori = '';
// Verificare CSRF doar dacă se trimite formularul
if (isset($_POST['step']) && $_POST['step'] == 'recoverPass') {
$csrftok = isset($_POST['csrf_token']) ? $_POST['csrf_token'] : '';
$sessionToken = isset($_SESSION['csrf_token']) ? $_SESSION['csrf_token'] : '';
if (!hash_equals($sessionToken, $csrftok)) {
$err = 1;
$erori = 'Sesiunea a expirat sau cererea nu este valida. Reincarca pagina si incearca din nou. ';
}
else if (strlen($_POST['email'])>5)
{
$userId=$db->getField("SELECT id from usersCni where status=1 and lower(email)='".strtolower($db->cleanVar($_POST['email']))."' LIMIT 1",'id');
if ($userId>0)
{
$db->simpleQuery("UPDATE usersLostPass set status=2 where userId='$userId'");
$act=md5($userId.'nmf-=a'.date("Y-m-d H:i:s").'---'.strtolower($db->cleanVar($_POST['email'])).'88'.rand(0,11111));
$myarr=array('userId'=>$userId,'act'=>$act);
$db->insert('usersLostPass',$myarr);
$linkActivare=$GLOBALS['dir'].'users/passwordchange/'.$act;
$mesaj='Buna ziua,
Pentru schimbarea parolei este nevoie sa accesati link-ul de mai jos: {linkChangePass}
Compania Nationala de Investitii';
$mesaj=str_replace('{linkChangePass}',$linkActivare,$mesaj);
mail_new(trim($db->cleanVar($_POST['email'])),'Recuperare parola cont achizitii.cni.ro',$mesaj);
}
$continut='
';
$smarty->assign('continut2',$continut);
return;
}
}
// Afișare formular (fie la prima încărcare, fie dacă sunt erori)
$continut='
';
$smarty->assign('continut2',$continut);
}
function activateUser($act)
{
$db=new bazaDate();
$act=$db->cleanVar($act);
$userId=$db->getField("SELECT id from usersCni where act='$act' and status=0 and emailValidat=0 LIMIT 1",'id');
if ($userId>0)
{
$db->simpleQuery("UPDATE usersCni set emailValidat=1, dataValidareEmail=NOW() where id='$userId' LIMIT 1");
} else header("Location: ".$GLOBALS['dir']);
return $userId;
}
function login($username, $password)
{
$db = new bazaDate();
$errorRecaptcha = 0;
// IP-uri pentru care nu e nevoie de 2FA
$ipWhitelist = [
'86.107.237.162', // Exemplu IP
'81.196.246.79'
];
$userIp = $_SERVER['REMOTE_ADDR'];
if (strlen($username) >= 6 && strlen($password) >= 6)
{
$username = $db->cleanVar($username);
$password = $db->cleanVar($password);
$passwordHash = $db->getField("SELECT parola FROM usersCni WHERE email='$username' AND status=1 LIMIT 1", 'parola');
if (md5($password) == $passwordHash)
{
$userId = $db->getField("SELECT id FROM usersCni WHERE email='$username' AND status=1 LIMIT 1", 'id');
$userName = $db->getField("SELECT denumire AS name FROM usersCni WHERE email='$username' AND status=1 LIMIT 1", 'name');
$userType = $db->getField("SELECT userType FROM usersCni WHERE email='$username' AND status=1 LIMIT 1", 'userType');
if (in_array($userIp, $ipWhitelist)) {
// IP-ul este �n whitelist -> logam direct
$_SESSION['userId'] = $userId;
$_SESSION['userName'] = $userName;
$cookiesDomain = ""; // aici pui domeniul tau
setcookie("user", $_SESSION['userId'], time() + 3600 * 24 * 30, "/", $cookiesDomain, 1);
setcookie("secret", md5($_SESSION['userId'].'cni2024'), time() + 3600 * 24 * 30, "/", $cookiesDomain, 1);
$db->insert('userLoginLog', ['userId' => $_SESSION['userId']]);
if ($userType==2) header("Location: ".$GLOBALS['dir'].'erp');
if ($userType==1) header("Location: ".$GLOBALS['dir'].'');
if ($userType==0) header("Location: ".$GLOBALS['dir'].'choose');
exit;
} else {
// IP-ul nu este �n whitelist -> trimitem cod 2FA
$_SESSION['temp_userId'] = $userId;
$_SESSION['temp_userName'] = $userName;
$_SESSION['temp_email'] = $username;
$code2FA = rand(100000, 999999);
$_SESSION['2fa_code'] = $code2FA;
$_SESSION['2fa_expires'] = time() + 300; // valabil 5 minute
$subiect = "Codul tau de autentificare";
$mesaj = '
Cod de autentificare
Salut, ' . htmlspecialchars($userName) . '!
Codul tau de autentificare este:
' . htmlspecialchars($code2FA) . '
Codul este valabil 5 minute.
Compania Nationala de Investitii S.A.
';
mail_new($username, $subiect, $mesaj);
header("Location: ".$GLOBALS['dir'].'2fa');
exit;
}
}
}
if (empty($_SESSION['userId']))
{
$avemUserInactiv = $db->getField("SELECT id FROM usersCni WHERE email='$username' AND status=0 LIMIT 1", 'id');
if ($avemUserInactiv > 0) return -1;
}
else
{
return $_SESSION['userId'];
}
}
function logout()
{
unset($_SESSION['userName']);
unset($_SESSION['userId']);
unset($_SESSION['hourLogin']);
unset($_SESSION['statusPlata']);
setcookie("user", '0', time()+3600*24*30, "/", $cookiesDomain, 1);
setcookie("secret", '0', time()+3600*24*30, "/", $cookiesDomain, 1);
unset($_COOKIE['user']);
unset($_COOKIE['secret']);
unset($_SESSION['triedLogin']);
header("Location: ".$GLOBALS['dir']);
}
function register()
{
$db=new bazaDate();
$smarty=$GLOBALS['smarty'];
$dir=$GLOBALS['dir'];
$smarty->assign('secure', md5(date("Y-m-d").'nf0fanfalonfonfsanoifsa'));
if ($_SERVER["REQUEST_METHOD"] == "POST")
if ($_POST['step']=='userRegister')
{
$errors = array();
$csrftok = isset($_POST['csrf_token']) ? $_POST['csrf_token'] : '';
$sessionToken = isset($_SESSION['csrf_token']) ? $_SESSION['csrf_token'] : '';
if (!hash_equals($sessionToken, $csrftok)) {
$err = 1;
$errors[] = 'Sesiunea a expirat sau cererea nu este valida. Reincarca pagina si incearca din nou. ';
}
// Validate mandatory fields
if (empty($_POST['denumire'])) {
$errors[] = "Denumirea este obligatorie.";
}
if (empty($_POST['sediu'])) {
$errors[] = "Sediu este un camp obligatoriu.";
}
if (empty($_POST['cui'])) {
$errors[] = "CUI este un camp obligatoriu.";
}
if (empty($_POST['telefon'])) {
$errors[] = "Telefon este un camp obligatoriu.";
}
if (empty($_POST['email'])) {
$errors[] = "Email este un camp obligatoriu.";
}
if (strlen($_POST['myPass'])<6) {
$errors[] = "Parola Minim 6 Caractere";
} else if ($_POST['myPass']!=$_POST['confirm'])
{
$errors[] = "Parolele nu corespund";
}
if (empty($errors)) {
$verifyMail=$db->getField("SELECT id from usersCni where lower(email)='".$db->cleanVar((strtolower($_POST['email'])))."' LIMIT 1",'id');
if (intval($verifyMail)>0)
{
$errors[] = 'Acest e-mail exista in baza de date. Recuperare Parola ';
}
else
if (isset($_FILES["pdfFile"]) && $_FILES["pdfFile"]["error"] == 0) {
$allowedExtensions = array("pdf");
$fileExtension = pathinfo($_FILES["pdfFile"]["name"], PATHINFO_EXTENSION);
// Check if the file extension is allowed
if (in_array(strtolower($fileExtension), $allowedExtensions)) {
$maxFileSize = 150 * 1024 * 1024; // 100MB in bytes
// Check file size
if ($_FILES["pdfFile"]["size"] <= $maxFileSize) {
// File is within the size limit, move it to the desired location
// Generate new file name
$dateTime = new DateTime();
$timestamp = $dateTime->format('Ymd_His');
$randomString = bin2hex(random_bytes(8)); // Generate an 8-byte random string
$originalFileName = pathinfo($_FILES["pdfFile"]["name"], PATHINFO_FILENAME). '.' . $fileExtension;
$newFileName = $timestamp . '_' . $randomString . '.' . $fileExtension;
// Encrypt the uploaded file
$encryptedFile = "offers/users/cui/" . $newFileName;
encryptFile($_FILES["pdfFile"]["tmp_name"], $encryptedFile, $GLOBALS['cniKey']);
unlink($_FILES["pdfFile"]["tmp_name"]);
$act=md5(date("Ymdhis").'$$'.rand(0,99999).$_POST['denumire']);
$arr=array(
'denumire'=>$_POST['denumire'],
'adresa'=>$_POST['sediu'],
'cui'=>$_POST['cui'],
'regcom'=>$_POST['regcom'],
'telefon'=>$_POST['telefon'],
'email'=>$_POST['email'],
'parola'=>md5($_POST['myPass']),
'act'=>$act,
'userType'=>0,
'cuiPDF'=>$encryptedFile,
'originalFileName'=>$originalFileName
);
$db->insert('usersCni',$arr);
$subiect='Verificare adresa de e-mail';
$mesaj='
Buna ziua,
Pentru validarea adresei de e-mail este nevoie sa accesati link-ul de mai jos: '.$dir.'activare/'.$act.'
Compania Nationala de Investitii
';
mail_new($_POST['email'],$subiect,$mesaj);
$succes=1;
} else $errors[] = "Atasati Certificat Constatator ONRC in format PDF";
} else $errors[] = "Atasati Certificat Constatator ONRC in format PDF";
} else $errors[] = "Atasati Certificat Constatator ONRC in format PDF";
}
}
if (!empty($errors)) $erori=''.implode(" ", $errors).'