<?php
  ///////////////////////////////////////////////////
  //Администрирование пользователей
  //2007 (C)
  //Карпухин Павел
  ///////////////////////////////////////////////////

  $lang = substr($_SERVER["HTTP_ACCEPT_LANGUAGE"], 0,2);
  if (is_file ("../lang/".$lang."/".$lang.".php")) include "../lang/".$lang."/".$lang.".php";
     else include "../lang/ru/ru.php";

  $title=$titlepage = $TEXT['login-title3'];
  $helppage = "";

  require_once "../config.php";
  require_once "../util/top.php";

  if($result2['administrator'] == 0) puterror2($TEXT['error-loginform2']);

  if(empty($_POST['login_id'])) puterror2($TEXT['error-login15']);
  if(strlen($_POST['login_id'])>11) puterror2($TEXT['error-login14']);
  if(empty($_POST['login'])) puterror2($TEXT['error-login1']);
  if(strlen($_POST['login'])>30) puterror2($TEXT['error-login2']);
  if(strlen($_POST['oldpassword'])>300) puterror2($TEXT['error-login16']);
  if(strlen($_POST['password'])>300) puterror2($TEXT['error-login5']);
  if(strlen($_POST['password2'])>300) puterror2($TEXT['error-login6']);
  if(strlen($_POST['moderator'])>5) puterror2($TEXT['error-login8']);
  if(strlen($_POST['administrator'])>5) puterror2($TEXT['error-login9']);
  if(strlen($_POST['user'])>5) puterror2($TEXT['error-login20']);
  if(strlen($_POST['manager'])>5) puterror2($TEXT['error-login21']);
  if(strlen($_POST['master'])>5) puterror2($TEXT['error-login22']);
  if(strlen($_POST['otvetstvenniy'])>5) puterror2($TEXT['error-login24']);
  if(strlen($_POST['unpriv'])>5) puterror2($TEXT['error-login22']);
  if(strlen($_POST['user_id'])>250) puterror2($TEXT['error-login14']);
  if(strlen($_POST['iduser'])>5) puterror2($TEXT['error-login23']);

  if(isset($_POST['login'])) $login=trim($_POST['login']);
    else $login="";
     if (empty($login)) puterror2($TEXT['error-login3']);

  $_POST['login'] = rep($_POST['login']);
  $_POST['fullname'] = rep($_POST['fullname']);
  $_POST['oldpassword'] = rep($_POST['oldpassword']);
  $_POST['password'] = rep($_POST['password']);
  $_POST['password2'] = rep($_POST['password2']);
  $_POST['moderator'] = rep($_POST['moderator']);
  $_POST['administrator'] = rep($_POST['administrator']);
  $_POST['user'] = rep($_POST['user']);
  $_POST['manager'] = rep($_POST['manager']);
  $_POST['master'] = rep($_POST['master']);
  $_POST['otvetstvenniy'] = rep($_POST['otvetstvenniy']);
  $_POST['unpriv'] = rep($_POST['unpriv']);

  if($_POST['moderator'] == "on") $moderator = "1";
    else $moderator = "0";

  if($_POST['administrator'] == "on") $administrator = "1";
    else $administrator = "0";

  if($_POST['user'] == "on") $user = "1";
    else $user = "0";

  if($_POST['manager'] == "on") $manager = "1";
    else $manager = "0";

  if($_POST['master'] == "on") $master = "1";
    else $master = "0";

  if($_POST['otvetstvenniy'] == "on") $otvetstvenniy = "1";
    else $otvetstvenniy = "0";

  if($_POST['unpriv'] == "on") $unpriv = "1";
    else $unpriv= "0";

  if($_POST['iduser'] == "on") $iduser = $_POST['user_id'];
   elseif ($unpriv == 1) $iduser = "";
    else $iduser = "";

  if($_POST['iduser'] == "on") $new_user_id = ", `usr_id` = '".$_POST['user_id']."'";
   else {
        if($_POST['unpriv'] == "on") $new_user_id = ", `usr_id` = ''";
         else $new_user_id = "";
        }

  if($_POST['chk_upd'] == "on") $chk_upd = "yes";
    else $chk_upd = "no";

  $query10 = "SELECT * FROM `tbl_logins` WHERE `login_id`='".$_POST['login_id']."' ";
  $result10 = mysql_query($query10);
  if(!$result10) puterror2($TEXT['error-tbl20']);
      $result_lib = mysql_fetch_array($result10);
      if($_POST['login']!=$result_lib['login']) {
          $query9 = "SELECT `login` FROM `tbl_logins` WHERE `login`='".$_POST['login']."' ";
            $result9 = mysql_query($query9);
              if(!$result9) puterror2($TEXT['error-tbl20']);
                 if(mysql_num_rows($result9)>0) puterror2($TEXT['global-est']);
                   else $name_login = "`login` = '".$_POST['login']."', ";
        }
       else $name_login = "";

  $query3 = "SELECT `familiya`, `name`, `otchestvo` FROM `tbl_users` WHERE `user_id`='".$_POST['user_id']."' ";
  $result3 = mysql_query($query3);
  if(!$result3) puterror2($TEXT['error-tbl2']);
      $result3 = mysql_fetch_array($result3);
       $usr_new = $result3['familiya']." ".$result3['name']." ".$result3['otchestvo'];
       $ident = $_POST['login_id'];
       $oldident = $_COOKIE['ident'];

  $query4 = "SELECT `familiya`, `name`, `otchestvo` FROM `tbl_users` WHERE `user_id`='".$result_lib['usr_id']."' ";
  $result4 = mysql_query($query4);
  if(!$result4) puterror2($TEXT['error-tbl2']);
      $result4 = mysql_fetch_array($result4);
        $usr_old = $result4['familiya']." ".$result4['name']." ".$result4['otchestvo'];

  if($result2['administrator'] == 1)
  {
   if(!empty($_POST['password2']))
    {
    if($_POST['password'] == $_POST['password2']) $passwd = " `pass` = '".md5($_POST['password'])."', ";
     else puterror2($TEXT['error-login19']);
    } else $passwd = "";
  }
  else
  {
   if(!empty($_POST['oldpassword']))
    {
     $passwrd = md5($_POST['oldpassword']);
     if($passwrd == $result_lib['pass'])
     {
       if($_POST['password'] == $_POST['password2']) $passwd = " `pass` = '".md5($_POST['password'])."', ";
          else puterror2($TEXT['error-login19']);
     }
     else puterror2($TEXT['error-login17']);
    }
    else $passwd = "";
  }

  //*************************************
  //Информация для лога
  if($result_lib['login'] !== $_POST['login']) $log_login = $TEXT['log-login4']."&laquo;".$result_lib['login']."&raquo;".$TEXT['log-nd8']."&laquo;".$_POST['login']."&raquo;<br />";
    else $log_login = "";

  if($result_lib['login'] !== $_POST['login']) $log_login_visible = $_POST['login'];
    else $log_login_visible = $result_lib['login'];

  if($result_lib['fullname'] !== $_POST['fullname']) $log_fullname = $TEXT['log-login6']."&laquo;".$log_login_visible."&raquo; ".$TEXT['log-login5']."&laquo;".$result_lib['fullname']."&raquo;".$TEXT['log-nd8']."&laquo;".$_POST['fullname']."&raquo;<br />";
    else $log_fullname = "";

  if($passwd !== "") $log_passwd = $TEXT['log-login6'].$log_login_visible." ".$TEXT['log-login7']."<br />";
   elseif($passwd == "" && !empty($_POST['password2'])) $log_passwd = $TEXT['log-login6']."&laquo;".$log_login_visible."&raquo; ".$TEXT['log-login14']."&raquo;<br />";
    else $log_passwd = "";

  if($result_lib['moderator'] !== $moderator) $log_moderator = $TEXT['log-login6']."&laquo;".$log_login_visible."&raquo; ".$TEXT['log-login8']."&laquo;".$result_lib['moderator']."&raquo;".$TEXT['log-nd8']."&laquo;".$moderator."&raquo;<br />";
    else $log_moderator = "";

  if($result_lib['administrator'] !== $administrator) $log_administrator = $TEXT['log-login6']."&laquo;".$log_login_visible."&raquo; ".$TEXT['log-login9']."&laquo;".$result_lib['administrator']."&raquo;".$TEXT['log-nd8']."&laquo;".$administrator."&raquo;<br />";
    else $log_administrator = "";

  if($result_lib['user'] !== $user) $log_user = $TEXT['log-login6']."&laquo;".$log_login_visible."&raquo; ".$TEXT['log-login10']."&laquo;".$result_lib['user']."&raquo;".$TEXT['log-nd8']."&laquo;".$user."&raquo;<br />";
    else $log_user = "";

  if($result_lib['manager'] !== $manager) $log_manager = $TEXT['log-login6']."&laquo;".$log_login_visible."&raquo; ".$TEXT['log-login11']."&laquo;".$result_lib['manager']."&raquo;".$TEXT['log-nd8']."&laquo;".$manager."&raquo;<br />";
    else $log_manager = "";

  if($result_lib['master'] !== $master) $log_master = $TEXT['log-login6']."&laquo;".$log_login_visible."&raquo; ".$TEXT['log-login12']."&laquo;".$result_lib['master']."&raquo;".$TEXT['log-nd8']."&laquo;".$master."&raquo;<br />";
    else $log_master = "";

  if($result_lib['otvetstvenniy'] !== $otvetstvenniy) $log_otvetstvenniy = $TEXT['log-login6']."&laquo;".$log_login_visible."&raquo; ".$TEXT['log-login15']."&laquo;".$result_lib['otvetstvenniy']."&raquo;".$TEXT['log-nd8']."&laquo;".$otvetstvenniy."&raquo;<br />";
    else $log_otvetstvenniy = "";

  if($_POST['iduser'] == "on") $log_user_id = $TEXT['log-login6']."&laquo;".$log_login_visible."&raquo; ".$TEXT['log-login13']."&laquo;".$usr_old."&raquo;".$TEXT['log-nd8']."&laquo;".$usr_new."&raquo;<br />";
   else {
        if($_POST['unpriv'] == "on") $log_user_id = $TEXT['log-login6']."&laquo;".$log_login_visible."&raquo; ".$TEXT['log-login13']."&laquo;".$usr_old."&raquo;".$TEXT['log-nd8']."&laquo;".$TEXT['tbl-priv-no']."&raquo;<br />";
         else $log_user_id = "";
        }

  $ip = $_SERVER['REMOTE_ADDR'];
  $doing = $TEXT['log-login3'];
  $what = $log_login." ".$log_fullname." ".$log_passwd." ".$log_moderator." ".$log_administrator." ".$log_user." ".
  $log_manager." ".$log_master." ".$log_user_id." ".$log_otvetstvenniy." ".$TEXT['log-id'].$_POST['login_id'];
  $who = $result2['fullname'];
  //*************************************
  $query = "UPDATE `tbl_logins` SET
  $name_login
  `fullname` = '".$_POST['fullname']."',
  ".$passwd."
  `moderator` = '$moderator',
  `administrator` = '$administrator',
  `user` = '$user',
  `manager` = '$manager',
  `master` = '$master',
  `otvetstvenniy` = '$otvetstvenniy'
  ".$new_user_id.",
  `chk_upd` = '".$chk_upd."'
  WHERE `login_id`='".$_POST['login_id']."'";
  if(mysql_query($query))
  {
    $query2 = "INSERT INTO tbl_logs ( `log_id` , `data` , `ip` , `who` , `doing` , `what` ) VALUES ( NULL , NOW() , '$ip' , '$who' , '$doing' , '$what')";
        if(mysql_query($query2))
           {
             if($oldident == $ident)
             {
             echo "<html><head>
                   <meta HTTP-EQUIV='Refresh' CONTENT='0; URL=../index.php' />
                   </head></html>";
             }
             else
              {
               echo "<html><head>
                   <meta HTTP-EQUIV='Refresh' CONTENT='0; URL=index.php' />
                   </head></html>";
              }
           } else puterror2($TEXT['error-log']);
  } else puterror2($TEXT['error-login18']);
  require_once "../util/bottom.php";
?>