From 0d497163fe6fd98856f979bfa345ad691f1c74f0 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Fri, 18 Aug 2023 15:35:31 -0400
Subject: [PATCH] Feature: Login Message now complete can be set in settings >
 security

---
 get_settings.php      |  3 ++-
 login.php             | 10 ++++++++--
 portal/login.php      | 21 +++++++++++++--------
 post/setting.php      |  3 ++-
 settings_security.php |  9 +++++++--
 5 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/get_settings.php b/get_settings.php
index a1ad9a5a..fc526b62 100644
--- a/get_settings.php
+++ b/get_settings.php
@@ -89,7 +89,8 @@ $config_module_enable_ticketing = intval($row['config_module_enable_ticketing'])
 $config_module_enable_accounting = intval($row['config_module_enable_accounting']);
 $config_client_portal_enable = intval($row['config_client_portal_enable']);
 
-// Login key
+// Login
+$config_login_message = $row['config_login_message'];
 $config_login_key_required = $row['config_login_key_required'];
 $config_login_key_secret = $row['config_login_key_secret'];
 
diff --git a/login.php b/login.php
index 0478cdd9..5e106ae1 100644
--- a/login.php
+++ b/login.php
@@ -37,6 +37,7 @@ $row = mysqli_fetch_array($sql_settings);
 $company_name = $row['company_name'];
 $company_logo = $row['company_logo'];
 $config_start_page = nullable_htmlentities($row['config_start_page']);
+$config_login_message = nullable_htmlentities($row['config_login_message']);
 
 // Mail
 $config_smtp_host = $row['config_smtp_host'];
@@ -266,9 +267,14 @@ if (isset($_POST['login'])) {
     <!-- /.login-logo -->
     <div class="card">
         <div class="card-body login-card-body">
-            <p class="login-box-msg"><?php if (isset($response)) { echo $response; } ?></p>
-            <form method="post">
+            <?php if(!empty($config_login_message)){ ?>
+            <p class="login-box-msg"><?php echo nl2br($config_login_message); ?></p>
+            <?php } ?>
+            <?php if (isset($response)) { ?>
+            <p class="login-box-msg"><?php echo $response; ?></p>
+            <?php } ?>
 
+            <form method="post">
 
                 <div class="input-group mb-3" <?php if (isset($token_field)) { echo "hidden"; } ?>>
                     <input type="text" class="form-control" placeholder="Agent Email" name="email" value="<?php if (isset($token_field)) { echo $email; }?>" required <?php if (!isset($token_field)) { echo "autofocus"; } ?> >
diff --git a/portal/login.php b/portal/login.php
index f4eae805..9dceba8a 100644
--- a/portal/login.php
+++ b/portal/login.php
@@ -30,9 +30,10 @@ if($config_client_portal_enable == 0) {
 $ip = sanitizeInput(getIP());
 $user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']);
 
-$sql_settings = mysqli_query($mysqli, "SELECT config_azure_client_id FROM settings WHERE company_id = 1");
+$sql_settings = mysqli_query($mysqli, "SELECT config_azure_client_id, config_login_message FROM settings WHERE company_id = 1");
 $settings = mysqli_fetch_array($sql_settings);
 $azure_client_id = $settings['config_azure_client_id'];
+$config_login_message = nullable_htmlentities($settings['config_login_message']);
 
 $company_sql = mysqli_query($mysqli, "SELECT company_name, company_logo FROM companies WHERE company_id = 1");
 $company_results = mysqli_fetch_array($company_sql);
@@ -106,13 +107,17 @@ if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['login'])) {
     </div>
     <div class="card">
         <div class="card-body login-card-body">
-            <p class="login-box-msg text-danger">
-                <?php
-                if (!empty($_SESSION['login_message'])) {
-                    echo $_SESSION['login_message'];
-                    unset($_SESSION['login_message']);
-                }
-                ?>
+            <?php if(!empty($config_login_message)){ ?>
+            <p class="login-box-msg"><?php echo nl2br($config_login_message); ?></p>
+            <?php } ?>
+            <?php
+            if (!empty($_SESSION['login_message'])) { ?>
+                <p class="login-box-msg text-danger">
+                <?php 
+                echo $_SESSION['login_message'];
+                unset($_SESSION['login_message']);
+            }
+            ?>
             </p>
             <form method="post">
                 <div class="input-group mb-3">
diff --git a/post/setting.php b/post/setting.php
index 547bd506..6ee42e7b 100644
--- a/post/setting.php
+++ b/post/setting.php
@@ -373,10 +373,11 @@ if (isset($_POST['edit_module_settings'])) {
 if (isset($_POST['edit_security_settings'])) {
     validateAdminRole();
 
+    $config_login_message = sanitizeInput($_POST['config_login_message']);
     $config_login_key_required = intval($_POST['config_login_key_required']);
     $config_login_key_secret = sanitizeInput($_POST['config_login_key_secret']);
 
-    mysqli_query($mysqli,"UPDATE settings SET config_login_key_required = '$config_login_key_required', config_login_key_secret = '$config_login_key_secret' WHERE company_id = 1");
+    mysqli_query($mysqli,"UPDATE settings SET config_login_message = '$config_login_message', config_login_key_required = '$config_login_key_required', config_login_key_secret = '$config_login_key_secret' WHERE company_id = 1");
 
     // Logging
     mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified login key settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id");
diff --git a/settings_security.php b/settings_security.php
index e4c16ba6..9dad9dc9 100644
--- a/settings_security.php
+++ b/settings_security.php
@@ -9,6 +9,11 @@ require_once("inc_all_settings.php");
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
 
+                <div class="form-group">
+                    <label>Login Message</label>
+                    <textarea class="form-control" name="config_login_message" rows="5" placeholder="Enter a message to be displayed on the login screen"><?php echo nullable_htmlentities(($config_login_message); ?></textarea>
+                </div>
+
                 <div class="form-group">
                     <div class="custom-control custom-switch">
                         <input type="checkbox" class="custom-control-input" name="config_login_key_required" <?php if ($config_login_key_required == 1) { echo "checked"; } ?> value="1" id="customSwitch1">
@@ -17,12 +22,12 @@ require_once("inc_all_settings.php");
                 </div>
 
                 <div class="form-group">
-                    <label>Login key secret value <small class="text-secondary">(This must be provided in the URL as /login.php?key=<?php echo htmlentities($config_login_key_secret)?>)</small></label>
+                    <label>Login key secret value <small class="text-secondary">(This must be provided in the URL as /login.php?key=<?php echo nullable_htmlentities(($config_login_key_secret)?>)</small></label>
                     <div class="input-group">
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-key"></i></span>
                         </div>
-                        <input type="text" class="form-control" name="config_login_key_secret" required pattern="\w{3,99}" placeholder="Something really easy for techs to remember: e.g. MYSECRET" value="<?php echo htmlentities($config_login_key_secret); ?>">
+                        <input type="text" class="form-control" name="config_login_key_secret" pattern="\w{3,99}" placeholder="Something really easy for techs to remember: e.g. MYSECRET" value="<?php echo nullable_htmlentities(($config_login_key_secret); ?>">
                     </div>
                 </div>