/* CLASS:   	WebPWClass  A rudimentary class that adds UserID/password
					clearing to the dB2K Web classes    

   Requirements: Requires the table Users.dbf with UserID and
   				Password character fields (ea 30 chars). The table may 
               reside in your CGI-bin folder, or you may pass a database 
               alias to this the checkPassword method and thereby use 
               a BDE alias to locate the table in another 
               folder/computer/drive.

   WARNING: 	The password clearing method in this
       			class is not secure. Later versions may be. The password is
       			sent to the Web browser and back in plain text. BE WARNED!!  The
       			only way to make passwords secured is to use encryption such as
       			Secure Sockets Layer.

  Author:		A. A. Katz 01/14/2000 (c) dBASE Inc., all rights reserved.
  					Revised 01/23/2000
  */




Class CGIPWSession of CGISession from "WebClass.cc"

   // Append two elements to this array, reserved for password and
   // UserID clearing using the password table and clearing routines
   // in this class. Name your HTML inputs exactly as these elements
   // are named, including case. 


   this["UserID"] = "XXXYYYZZZ123"  // prevents crashing if
   this["XPD"] = "XXXYYYZZZZ123"    // UserID and PW data missing

   ////// Method:   	validatePassword /////////////////////////////////////
   ////// Purpose:  	confirm UserID and Password///////////////////////////
   ////// Param:		cDatabaseName (optional) Name of BDE Alias ///////////

   function validatePassword(cDatabaseName)

      if empty(this['UserID'])  // if no UserID
         this.sorryPage('No User ID was submitted!')
      elseif empty(this["XPD"])   // if no password
         this.sorryPage('No Password was submitted!')
      endif

      ////// if database specified open database
      if not empty(cDatabaseName)
         d = new database()
         d.databasename = cDatabase
         d.active = true
      endif

      // run query on user table

      p = new query()
      if not empty(cDatabaseName)
         p.database = d
      endif
      p.sql = 'select * from "Users.dbf"'
      p.active = true
      p.rowset.indexName = 'User'

      ///// Pad user name out to length:30 and convert to upper
      cUserID = upper(substr(aData["UserID"]+space(30),1,30))
      cPassword = upper(substr(aData["XPD"]+space(30),1,30))

      ////// Check to see if user exists
      if not p.rowset.findkey(cUserID)

         ///if not, sorry....
         p.active = false  // close table query
         p = null
         if not empty(cDatabaseName)
            d.active = false  // close database
            d = null
         endif

         // return Sorry page to the user
         this.sorryPage('Invalid UserID: '+aData["UserID"])

      elseif cPassword # upper(p.rowset.fields["Password"].value)

         /// note we're testing for upper() to ensure NOT case sensitive
 
         p.active = false // close table query
         p = null

         if not empty(cDatabaseName)
            d.active = false  // close database
            d = null
         endif

         // return Sorry page to the user
         this.sorryPage('Invalid Password: '+aData["XPD"])
      endif

      p.active = false
      p = null
      return true

Endclass