<%
' MyPAYE
' Module: Login.asp
'
' This software is the copyright of Mr T J Sheppard and may not be copied, duplicated or 
' modified other than as permitted in the licence agreement.
'
'       © 2012 - 2021  Mr T J Sheppard
'                      Lyndale House
'                      Church Street
'                      Bradwell
'                      Hope Valley
'                      S33 9HJ
'
'  Tel 0845 643 5191
'  Email Support@MyPAYE.co.uk
'
' MyPAYE is a Registered Trademark of MyPAYE Ltd
'-------------------------------------------------------------------
'
' Updated 26 April 2021

''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
'
'   Description -    This module catches any calls to the old Login.asp page
'
' Amendment Log
'------------------------------------------------------------------------------------------
' Date     | Name            | Vers.  | Description
'------------------------------------------------------------------------------------------
' 01/06/14 | TJS             | 4.0.00 | Page added
' 30/09/14 | TJS             | 4.0.04 | Removed SessionVarsID from call to PayrollStartup.aspx as not needed
' 27/10/14 | TJS             | 4.0.05 | Modified RemoveHTML to escape HTML characters
' 08/04/21 | TJS             | 5.9.09 | Modified to use ASPDOTNET/PayrollStartup.aspx pages
' 26/04/21 | TJS             | 5.9.09a | Modified to pass AgencyID branding parameters to PayrollRoot.aspx if present
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

Framed = request.querystring("Framed")
IntroCode = RemoveHTML(request.querystring("ICde"))
AgencyID = RemoveHTML(request.querystring("AID"))
AgencyCode = RemoveHTML(request.querystring("ACde"))

Function RemoveHTML(strText)
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
'
'   Description -    Detects and removes HTML tags from entered text fields to prevent 
'                    users initiating unauthorised actions on the server
'
' Amendment Log
'------------------------------------------------------------------------------------------
' Date     | Name            | Vers.  | Description
'------------------------------------------------------------------------------------------
' 01/06/14 | TJS             | 4.0.00 | Original
' 27/10/14 | TJS             | 4.0.05 | Modified to escape HTML characters
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

Session.LCID = 2057

    Dim TAGLIST

    TAGLIST = ";!--;!DOCTYPE;A;ACRONYM;ADDRESS;APPLET;AREA;xB;BASE;BASEFONT;" &_
              "BGSOUND;BIG;BLOCKQUOTE;BODY;BR;BUTTON;CAPTION;CENTER;CITE;CODE;" &_
              "COL;COLGROUP;COMMENT;DD;DEL;DFN;DIR;DIV;DL;DT;EM;EMBED;FIELDSET;" &_
              "FONT;FORM;FRAME;FRAMESET;HEAD;H1;H2;H3;H4;H5;H6;HR;HTML;I;IFRAME;IMG;" &_
              "INPUT;INS;ISINDEX;KBD;LABEL;LAYER;LEGEND;LI;LINK;LISTING;MAP;MARQUEE;" &_
              "MENU;META;NOBR;NOFRAMES;NOSCRIPT;OBJECT;OL;OPTION;P;PARAM;PLAINTEXT;" &_
              "PRE;Q;S;SAMP;SCRIPT;SELECT;SMALL;SPAN;STRIKE;STRONG;STYLE;SUB;SUP;" &_
              "TABLE;TBODY;TD;TEXTAREA;TFOOT;TH;THEAD;TITLE;TR;TT;U;UL;VAR;WBR;XMP;"

    Const BLOCKTAGLIST = ";APPLET;EMBED;FRAMESET;HEAD;NOFRAMES;NOSCRIPT;OBJECT;SCRIPT;STYLE;"

    Dim nPos1
    Dim nPos2
    Dim nPos3
    Dim strResult
    Dim strTagName
    Dim bRemove
    Dim bSearchForBlock

	' remove any text after |
    nPos1 = InStr(strText, "|")
    if nPos1 > 0 then
 		strText = left(strText, nPos1 - 1)
    end if
    
    nPos1 = InStr(strText, "<")
    Do While nPos1 > 0
        nPos2 = InStr(nPos1 + 1, strText, ">")
        If nPos2 > 0 Then
            strTagName = Mid(strText, nPos1 + 1, nPos2 - nPos1 - 1)
		    strTagName = Replace(Replace(strTagName, vbCr, " "), vbLf, " ")

            nPos3 = InStr(strTagName, " ")
            If nPos3 > 0 Then
                strTagName = Left(strTagName, nPos3 - 1)
            End If

            If Left(strTagName, 1) = "/" Then
                strTagName = Mid(strTagName, 2)
                bSearchForBlock = False
            Else
                bSearchForBlock = True
            End If

            If InStr(1, TAGLIST, ";" & strTagName & ";", vbTextCompare) > 0 Then
                bRemove = True
                If bSearchForBlock Then
                    If InStr(1, BLOCKTAGLIST, ";" & strTagName & ";", vbTextCompare) > 0 Then
                        nPos2 = Len(strText)
                        nPos3 = InStr(nPos1 + 1, strText, "</" & strTagName, vbTextCompare)
                        If nPos3 > 0 Then
                            nPos3 = InStr(nPos3 + 1, strText, ">")
                        End If

                        If nPos3 > 0 Then
                            nPos2 = nPos3
                        End If
                    End If
                End If
            Else
                bRemove = False
            End If

            If bRemove Then
                strResult = strResult & Left(strText, nPos1 - 1)
                strText = Mid(strText, nPos2 + 1)
            Else
                strResult = strResult & Left(strText, nPos1)
                strText = Mid(strText, nPos1 + 1)
            End If
        Else
            strResult = strResult & strText
            strText = ""
        End If

        nPos1 = InStr(strText, "<")
    Loop
    strResult = strResult & strText

	' start of code added TJS 27/10/14
	strResult = replace(strResult, "&", "&amp;")
	strResult = replace(strResult, "<", "&lt;")
	strResult = replace(strResult, ">", "&gt;")
	strResult = replace(strResult, """", "&quot;")
	strResult = replace(strResult, "'", "&#x27;")	
	' end of code added TJS 27/10/14

    RemoveHTML = strResult
End Function

if UCase(request.servervariables("SERVER_NAME")) = "WWW.MYPAYE.COM" then
	SiteName = "www.MyPAYE.co.uk"
elseif UCase(request.servervariables("SERVER_NAME")) = "MYPAYE.COM" then
	SiteName = "www.MyPAYE.co.uk"
elseif UCase(request.servervariables("SERVER_NAME")) = "MYPAYE.CO.UK" then
	SiteName = "www.MyPAYE.co.uk"
elseif UCase(request.servervariables("SERVER_NAME")) = "WWW.MYPAYE.CO.UK" then
	SiteName = "www.MyPAYE.co.uk" ' TJS 16/07/07
elseif UCase(request.servervariables("SERVER_NAME")) = "WWW.WEBPAYROLLSYSTEM.CO.UK" then ' TJS 01/06/14
	SiteName = "www.WebPayrollSystem.co.uk" ' TJS 01/06/14
elseif UCase(request.servervariables("SERVER_NAME")) = "WEBPAYROLLSYSTEM.CO.UK" then
	SiteName = "www.WebPayrollSystem.co.uk"
elseif UCase(request.servervariables("SERVER_NAME")) = "WWW.MYPAYEDEV.CO.UK" then ' TJS 01/06/14
	SiteName = "www.MyPAYEDev.co.uk" ' TJS 01/06/14
elseif UCase(request.servervariables("SERVER_NAME")) = "MYPAYEDEV.CO.UK" then ' TJS 01/06/14
	SiteName = "www.MyPAYEDev.co.uk" ' TJS 01/06/14
else
	DotPosn = instr(1, request.servervariables("SERVER_NAME"), ".")
	if DotPosn > 0 then
		if UCase(mid(request.servervariables("SERVER_NAME"), DotPosn)) = ".MYPAYE.CO.UK" or _
			UCase(mid(request.servervariables("SERVER_NAME"), DotPosn)) = ".MYPAYE.COM"  then
			SiteName = "www.MyPAYE.co.uk"
		elseif UCase(mid(request.servervariables("SERVER_NAME"), DotPosn)) = ".WEBPAYROLLSYSTEM.CO.UK"  then
			SiteName = "www.WebPayrollSystem.co.uk"
		elseif UCase(mid(request.servervariables("SERVER_NAME"), DotPosn)) = ".MYPAYEDEV.CO.UK"  then ' TJS 01/06/14
			SiteName = "www.MyPAYEDev.co.uk" ' TJS 01/06/14
		else
			SiteName = request.servervariables("SERVER_NAME")
		end if
	else
		SiteName = request.servervariables("SERVER_NAME")
	end if
end if

' start of code added TJS 26/04/21
if "" &  AgencyID <> "" and "" &  AgencyID <> "-1" then
	strAgencyParams = "&AID=" & AgencyID
else
	strAgencyParams = ""
end if
' end of code added TJS 26/04/21

response.redirect "https://" & SiteName & "/Secure/ASPDOTNET/PayrollStartup.aspx?ACde=" & AgencyCode & "&ICde=" & IntroCode & "&Fn=Login&Framed=" & Framed & strAgencyParams ' TJS 30/09/14 TJS 08/04/21 TJS 26/04/21
%>