<!--#include file="../Inc/Conn.asp" -->
<!--#include file="../Inc/SK.Funtion.asp" -->
<!--#include file="../Inc/SK.Md5.asp" -->
<%
Response.buffer=true
Response.Expires=0
Call ChkIsOuter()
If NoCSSHackInput(F("UserName"))="" or NoCSSHackInput(F("UserPass"))="" Then
Response.Write("<script>alert(""对不起,用户名或者密码不能为空!"");history.back(-1);</script>")
response.end
end if

'------------------检测浏览用户端PC信息 ----------------
System = Request.ServerVariables("HTTP_USER_AGENT")
if Instr(System,"Windows NT 5.2") then
	System = "Win2003"
elseif Instr(System,"Windows NT 5.0") then
	System="Win2000"
elseif Instr(System,"Windows NT 5.1") then
	System = "WinXP"
elseif Instr(System,"Windows NT") then
	System = "WinNT"
elseif Instr(System,"Windows 9") then
	System = "Win9x"
elseif Instr(System,"unix") or instr(System,"linux") or instr(System,"SunOS") or instr(System,"BSD") then
	System = "类Unix"
elseif Instr(System,"Mac") then
	System = "Mac"
else
	System = "Other"
end if

set rs=server.createobject("adodb.recordset")
sql="select * from SK_SystemUsers where SK_Name='"&NoCSSHackInput(F("UserName"))&"' and SK_Pass='"&md5(NoCSSHackInput(F("UserPass")),16)&"'"
rs.open sql,conn,1,3
if rs.eof then

'------------------将用户输入错误登录失败信息写入日志数据表 ----------------
Dim RsLogObj,SqlLog
Set RsLogObj = Server.Createobject("adodb.recordset")
SqlLog = "Select * from SK_SystemLog"
RsLogObj.open SqlLog,Conn,3,3
RsLogObj.AddNew
RsLogObj("LogUser") = NoCSSHackInput(F("UserName"))
RsLogObj("LogIP") = request.ServerVariables("Remote_Addr")
RsLogObj("OS") = System
RsLogObj("ErrorPas") = NoCSSHackInput(F("UserPass"))
RsLogObj("Result") = 0
RsLogObj("LoginTime") = Now()
RsLogObj.update
RsLogObj.close
set RsLogObj = Nothing

Response.Write("<script>alert(""对不起,用户名或密码错误!"");history.back(-1);</script>")
response.end
else
if rs("SK_Locked")="1" and rs("SK_Manager")<>"1" then
Response.Write("<script>alert(""对不起,您的账号已被管理员锁定,请与管理员联系!"");history.back(-1);</script>")
response.end
else

if rs("SK_Manager")<>"0" then
Set RsGroupObj = Conn.Execute("Select * from SK_SystemDept where LID="&CStr(Rs("SK_Dept3")))
if Not RsGroupObj.Eof then
TempGetPopedomList = RsGroupObj("SK_PopList")
if IsNull(TempGetPopedomList) then TempGetPopedomList = ""
else
TempGetPopedomList = ""
end if
Set RsGroupObj = Nothing
else
TempGetPopedomList = ""
end if
RsGroupObj.close
set RsGroupObj=Nothing

if TempGetPopedomList="" and rs("SK_Manager")<>"1" then
Response.Write("<script>alert(""对不起, 您的权限还没有分配,请等待管理员给您分配后再登录!"");history.back(-1);</script>")
response.end
else

Session("UID")=rs("UsersID")
Session("Dept1")=rs("SK_Dept1")
Session("Dept2")=rs("SK_Dept2")
Session("Dept3")=rs("SK_Dept3")
Session("UserName")=rs("SK_Name")
Session("Oname")=rs("SK_Oname")
Session("Password")="Password"
Session("PopedomList")=TempGetPopedomList '权限列表
Session("Manager")=rs("SK_Manager")
Session("Locked")=rs("SK_Locked")
Session("Perty")=rs("SK_Property")

conn.execute(sql)
rs("SK_Online")=1
rs("SK_Login")=rs("SK_Login") + 1
rs("SK_LoginTime")=Now()

'------------------将用户登录成功的信息写入日志数据表 ----------------
Set RsLogObj = Server.Createobject("adodb.recordset")
SqlLog = "Select * from SK_SystemLog"
RsLogObj.open SqlLog,Conn,3,3
RsLogObj.addnew
RsLogObj("LogUser") = NoCSSHackInput(F("UserName"))
RsLogObj("LogIP") = request.ServerVariables("Remote_Addr")
RsLogObj("OS") = System
RsLogObj("Result") = 1
RsLogObj("LoginTime") = now()
RsLogObj.update
RsLogObj.close
set RsLogObj = Nothing
end if
rs.Update

end if
end if
Call CloseDB()
response.redirect "Index.asp"
response.end
%>