protected void Button1_Click(object sender, EventArgs e)
{
byte[] generatedSalt = ClassHashing.generateSalt();
byte[] hashPassword = ClassHashing.generateSaltedHash(txtPassword.Text, generatedSalt);
//string abc = "Salt:" + Convert.ToBase64String(generatedSalt) + "\n";
//abc = abc + "hashedPassword 1：" + Convert.ToBase64String(hashPassword) + "\n";
//abc = abc + "hashedPassword 2：" + Convert.ToBase64String(ClassHashing.generateSaltedHash(TextBox3.Text, generatedSalt));
//Button1.Text = abc;
try
{
SqlConnection conPrint;
string connStr = ConfigurationManager.ConnectionStrings["printDBServer"].ConnectionString;
conPrint = new SqlConnection(connStr);
conPrint.Open();
string strInsert;
SqlCommand cmdInsert;
strInsert = "Insert Into Customer (CustomerName, CustomerEmail, CustomerPassword, CustomerDOB, CustomerPhoneNo, CustomerContactMethod, CustomerSalt) Values ( @CustomerName, @CustomerEmail, @CustomerPassword, @CustomerDOB, @CustomerPhoneNo, @CustomerContactMethod, @CustomerSalt)";
cmdInsert = new SqlCommand(strInsert, conPrint);
//cmdInsert.Parameters.AddWithValue("@CustomerID", TextBox6.Text); (not neccessary as database will handle with trigger)
cmdInsert.Parameters.AddWithValue("@CustomerName", txtName.Text);
cmdInsert.Parameters.AddWithValue("@CustomerEmail", txtEmail.Text);
cmdInsert.Parameters.AddWithValue("@CustomerPassword", hashPassword);
cmdInsert.Parameters.AddWithValue("@CustomerDOB", Convert.ToDateTime(txtDOB.Text));
cmdInsert.Parameters.AddWithValue("@CustomerPhoneNo", txtPhoneNumber.Text);
cmdInsert.Parameters.AddWithValue("@CustomerContactMethod", rblMethod.SelectedValue);
cmdInsert.Parameters.AddWithValue("@CustomerSalt", generatedSalt);
int n = cmdInsert.ExecuteNonQuery();
if (n > 0)
{
MessageBox.Show("Sign up done. Redirecting to homepage.", "Congratulation !!",
MessageBoxButtons.OK,
MessageBoxIcon.Exclamation,
MessageBoxDefaultButton.Button1);
//Response.Write("<script LANGUAGE='JavaScript' >alert('Register Successfully')</script>");
Response.Redirect("Login.aspx");
}
else
{
Response.Write("<script LANGUAGE='JavaScript' >alert('sign up failded')</script>");
}
conPrint.Close();
}
catch (SqlException ex)
{
Response.Write("<script LANGUAGE='JavaScript' >alert('Something gone wrong with the database.')</script>");
}
}
protected void btnSubmit_Click(object sender, EventArgs e)
{
if (ViewState["StaffID"] != null)
{
SqlConnection conPrintDB;
string connStr = ConfigurationManager.ConnectionStrings["printDBServer"].ConnectionString;
conPrintDB = new SqlConnection(connStr);
conPrintDB.Open();
try
{
string strUpdate;
SqlCommand cmdUpdate;
strUpdate = "Update CompanyStaff SET StaffPassword = @password ,StaffSalt = @salt WHERE StaffID = @staffID";
byte[] generatedSalt = ClassHashing.generateSalt();
byte[] hashPassword = ClassHashing.generateSaltedHash(txtPassword.Text, generatedSalt);
cmdUpdate = new SqlCommand(strUpdate, conPrintDB);
cmdUpdate.Parameters.AddWithValue("@password", hashPassword);
cmdUpdate.Parameters.AddWithValue("@salt", generatedSalt);
cmdUpdate.Parameters.AddWithValue("@staffID", ClassHashing.basicDecryption((string)ViewState["StaffID"]));
int n = cmdUpdate.ExecuteNonQuery();
if (n > 0)
{
Response.Write("<script LANGUAGE='JavaScript' >alert('Successfully activated your account. Redirecting to login page.')</script>");
Response.Redirect("Login.aspx");
}
else
{
lblMessage.Text = "Unable to update account inforation. Please try again later.";
messageHolder.Visible = true;
}
}
catch (Exception ex)
{
lblMessage.Text = "An error occured when setting the password to the account :" + ex.ToString();
messageHolder.Visible = true;
}
finally
{
conPrintDB.Close();
}
}
else
{
lblMessage.Text = "Unable to retrieve account inforation. Please try again later.";
messageHolder.Visible = true;
}
}
protected void Button2_Click(object sender, EventArgs e)
{
try
{
if (txtNewPassword.Text.Equals(txtComfirmPassword.Text))
{
byte[] generatedSalt = ClassHashing.generateSalt();
byte[] hashPassword = ClassHashing.generateSaltedHash(txtNewPassword.Text, generatedSalt);
//received customerID from forgetPassword.
string customerID = (string)(Session["CustomerID"]);
SqlConnection conPrint;
string connStr = ConfigurationManager.ConnectionStrings["printDBServer"].ConnectionString;
conPrint = new SqlConnection(connStr);
conPrint.Open();
string strInsert;
SqlCommand cmdInsert;
strInsert = "Update Customer SET CustomerPassword = @CustomerPassword, CustomerSalt = @CustomerSalt WHERE CustomerID = @customerID";
cmdInsert = new SqlCommand(strInsert, conPrint);
cmdInsert.Parameters.AddWithValue("@CustomerPassword", hashPassword);
cmdInsert.Parameters.AddWithValue("@CustomerSalt", generatedSalt);
cmdInsert.Parameters.AddWithValue("@customerID", customerID);
int n = cmdInsert.ExecuteNonQuery();
conPrint.Close();
Response.Write("<script LANGUAGE='JavaScript' >alert('Successful ResetPassword.')</script>");
Response.Redirect("Login.aspx");
}
else
{
Response.Write("<script LANGUAGE='JavaScript' >alert('Comfirm Password invalid.')</script>");
}
}
catch {
Response.Write("<script LANGUAGE='JavaScript' >alert('Please fill in the password.')</script>");
}
}
protected void btnCompanySubmit_Click1(object sender, EventArgs e)
{
byte[] generatedSalt = ClassHashing.generateSalt();
byte[] hashPassword = ClassHashing.generateSaltedHash(txtStaffPassword.Text, generatedSalt);
//try
//{
SqlConnection conPrint;
SqlConnection conOwner;
string connStr = ConfigurationManager.ConnectionStrings["printDBServer"].ConnectionString;
conPrint = new SqlConnection(connStr);
conOwner = new SqlConnection(connStr);
conPrint.Open();
string strInsert;
SqlCommand cmdInsert;
strInsert = "Insert Into Company (CompanyName, CompanyAddress, CompanyContactNo, CompanyEmail) Values ( @CompanyName, @CompanyAddress, @CompanyContactNo, @CompanyEmail);SELECT MAX(CompanyID) from Company where CompanyName=@CompanyName and CompanyContactNo=@CompanyContactNo ";
cmdInsert = new SqlCommand(strInsert, conPrint);
cmdInsert.Parameters.AddWithValue("@CompanyName", txtName.Text);
cmdInsert.Parameters.AddWithValue("@CompanyAddress", txtAddress.Text);
cmdInsert.Parameters.AddWithValue("@CompanyContactNo", txtContNo.Text);
cmdInsert.Parameters.AddWithValue("@CompanyEmail", txtEmail.Text);
var getCompanyId = cmdInsert.ExecuteScalar();
if (getCompanyId != null)
{
conOwner.Open();
string strOwnerInsert;
SqlCommand cmdCompanyInsert;
strOwnerInsert = "Insert Into CompanyStaff (StaffName, StaffEmail, StaffPassword, StaffNRIC, StaffDOB, StaffPhoneNo, StaffSalt, StaffRole, CompanyID) Values ( @StaffName, @StaffEmail, @StaffPassword, @StaffNRIC, @StaffDOB, @StaffPhoneNo, @StaffSalt, @StaffRole, @CompanyID)";
cmdCompanyInsert = new SqlCommand(strOwnerInsert, conOwner);
cmdCompanyInsert.Parameters.AddWithValue("@StaffName", txtStaffName.Text);
cmdCompanyInsert.Parameters.AddWithValue("@StaffEmail", txtStaffEmail.Text);
cmdCompanyInsert.Parameters.AddWithValue("@StaffPassword", hashPassword);
cmdCompanyInsert.Parameters.AddWithValue("@StaffNRIC", txtStaffNRIC.Text);
cmdCompanyInsert.Parameters.AddWithValue("@StaffDOB", Convert.ToDateTime(txtCalender.Text));
cmdCompanyInsert.Parameters.AddWithValue("@StaffPhoneNo", txtStaffPhoneNumber.Text);
cmdCompanyInsert.Parameters.AddWithValue("@StaffSalt", generatedSalt);
cmdCompanyInsert.Parameters.AddWithValue("@StaffRole", UserVerification.ROLE_ADMIN);
cmdCompanyInsert.Parameters.AddWithValue("@CompanyID", getCompanyId);
cmdCompanyInsert.ExecuteNonQuery();
conOwner.Close();
Response.Write("<script LANGUAGE='JavaScript' >alert('Login Successful')</script>");
Response.Redirect("~/Login.aspx");
}
else
{
Response.Write("<script LANGUAGE='JavaScript' >alert('sign up failded')</script>");
}
conPrint.Close();
//}
//catch (SqlException ex)
//{
// Response.Write("<script LANGUAGE='JavaScript' >alert('Something gone wrong with the database.')</script>");
//}
}