<?php
	require("settings.php");
	require_once("helper.php");

	session_start();
	html_start("User Manament");

	if(!session_is_registered("id") || !isset($_SESSION["id"]) || ($_SESSION["id"] == "")) {
		login_form("index.php");
	}

	echo "<H1>User Managment</H1>";

	$link = db_connect();

	if(!isset($_SESSION["id"]) || !check_capa($_SESSION["id"], "useredit", $link)) {
		die("Insufficient capabilities");
	}

	$todo = $_REQUEST["todo"];

	if($todo == "add") {
		login_form("users.php", array("todo" => "reallyadd"), "Add User");
	} else if($todo == "reallyadd") {
		$user = mysql_real_escape_string(htmlspecialchars($_REQUEST["user"]), $link);
		$pass = md5($_REQUEST["pass"]);

		$query = "INSERT INTO users SET user = \"$user\", pass = \"$pass\" ";
		$result = mysql_query($query, $link)
		or die("Query failed in file". __FILE__ ." line ". __LINE__ ." with: ". mysql_error($link));
		$id = mysql_insert_id($link);

		if($id == 0) {
			echo "Sorry. Registration failed.";
			die();
		}

		$query = "INSERT INTO capabilities SET id = $id, capability = \"login\" ";
		$result = mysql_query($query, $link)
		or die("Query failed in file". __FILE__ ." line ". __LINE__ ." with: ". mysql_error($link));
		$num = mysql_affected_rows($link);

		if($num != 1) {
			echo "Sorry. Registration failed. ($num)";
			die();
		}

		echo "Registration successfull.\n";

		echo "<BR><BR><A href=\"users.php\">View</A>\n";

	} else if($todo == "rm") {
		$id = intval($_REQUEST["id"]);
		$query = "SELECT user FROM users WHERE id = $id";
		$result = mysql_query($query, $link) or die("Can't fetch user: ".mysql_error($link));
		$num = mysql_num_rows($result);
		if($num < 1) {
			echo "Can't find user.";
			echo "<BR><BR><A href=\"users.php\">View</A>\n";
		} else if($num > 1) {
			echo "Userid not unique";
			echo "<BR><BR><A href=\"users.php\">View</A>\n";
		} else {
			$line = mysql_fetch_array($result);
			echo "Do you really want to remove {$line["user"]}?";
			echo "<FORM action=\"users.php\" method=\"post\">\n";
			echo "<INPUT type=\"hidden\" name=\"todo\" value=\"reallyrm\">\n";
			echo "<INPUT type=\"hidden\" name=\"id\" value=\"$id\">\n";
			echo "<INPUT type=\"submit\" value=\"Yes\">\n";
			echo "</FORM>";
			echo "<A href=\"users.php\"><BUTTON type=\"buttom\">No</BUTTON></A>\n";
		}
	} else if($todo == "reallyrm") {
		$id = intval($_REQUEST["id"]);

		$query = "DELETE FROM capabilities WHERE id = $id";
		$result = mysql_query($query, $link)
		or die("Query failed in file". __FILE__ ." line ". __LINE__ ." with: ". mysql_error($link));
		$num = mysql_affected_rows($link);

		$query = "DELETE FROM users WHERE id = $id";
		$result = mysql_query($query, $link)
		or die("Query failed in file". __FILE__ ." line ". __LINE__ ." with: ". mysql_error($link));

		echo "<BR><BR><A href=\"users.php\">View</A>\n";
	} else if($todo == "edit") {
		$id = intval($_REQUEST["id"]);

		$username = user_from_id($id);
		if($username == "") {
			die("This id does not belong to one user");
		}

		echo "<H3>Editing user $username</H3>\n";

		$query = "SELECT DISTINCT capability FROM capabilities WHERE id = $id";
		$result = mysql_query($query, $link) or die("Can't fetch capabilities: ".mysql_error($link));
		echo "<UL>\n";
		while($line = mysql_fetch_array($result)) {
			echo "<LI>";
			echo "{$line["capability"]}";
			echo "<A href=\"users.php?id=$id&todo=caparm&capa={$line["capability"]}\">";
			echo "<IMG src=\"icons/shield_delete.png\" alt=\"delete\"></A>\n";
			echo "</LI>\n";
		}
		echo "</UL>\n";
		echo "<A href=\"users.php?id=$id&todo=capaadd\"><IMG src=\"icons/shield_add.png\" alt=\"add\">Add capability</A>\n";
	} else if($todo == "caparm") {
		$id = intval($_REQUEST["id"]);
		$username = user_from_id($id);
		echo "<H3>Editing user $username</H3>\n";

		echo "Do you really want to remove the capability {$_REQUEST["capa"]}?<BR><BR>\n";
		echo "<FORM action=\"users.php\" method=\"post\">\n";
		echo "<INPUT type=\"hidden\" name=\"todo\" value=\"capareallyrm\">\n";
		echo "<INPUT type=\"hidden\" name=\"id\" value=\"$id\">\n";
		echo "<INPUT type=\"hidden\" name=\"capa\" value=\"{$_REQUEST["capa"]}\">\n";
		echo "<INPUT type=\"submit\" value=\"Remove capability\">\n";
		echo "</FORM>\n";

		echo "<A href=\"users.php?todo=edit&id=$id\">";
		echo "<IMG src=\"icons/user_edit.png\" alt=\"edit\">Edit user</A><BR>\n";
		echo "<A href=\"users.php\"><IMG src=\"icons/user.png\" alt=\"view\">User managment</A><BR>\n";
	} else if($todo == "capareallyrm") {
		$id = intval($_REQUEST["id"]);
		echo "<H3>Editing user $username</H3>\n";

		$capa = mysql_real_escape_string($_REQUEST["capa"], $link);

		$query = "DELETE FROM capabilities WHERE id=$id AND capability=\"$capa\"";
		$result = mysql_query($query, $link) or die("Can't revoke capability: ".mysql_error($link));
		$num = mysql_affected_rows($link);
		if($num < 1) {
			die("Can't revoke capability");
		} else {
			echo "Capabilty revoked<BR><BR>\n";
		}

		echo "<A href=\"users.php?todo=edit&id={$_REQUEST["id"]}\">";
		echo "<IMG src=\"icons/user_edit.png\" alt=\"edit\">Edit user</A><BR>\n";
		echo "<A href=\"users.php\"><IMG src=\"icons/user.png\" alt=\"view\">User managment</A><BR>\n";
	} else if($todo == "capaadd") {
		$id = intval($_REQUEST["id"]);
		$username = user_from_id($id);
		echo "<H3>Editing user $username</H3>\n";

		echo "<FORM action=\"users.php\" method=\"post\">\n";
		echo "<INPUT type=\"hidden\" name=\"id\" value=\"$id\">\n";
		echo "<INPUT type=\"hidden\" name=\"todo\" value=\"capareallyadd\">\n";
		echo "<SELECT name=\"capa\" size=\"1\">\n";
		echo "<OPTION value=\"login\">login</OPTION>\n";
		echo "<OPTION value=\"taskedit\">taskedit</OPTION>\n";
		echo "<OPTION value=\"useredit\">useredit</OPTION>\n";
		echo "<OPTION value=\"foobar\">foobar</OPTION>\n";
		echo "</SELECT><BR>\n";
		echo "<INPUT type=\"submit\" value=\"Grant capability\">\n";
		echo "</FORM>\n";
	} else if($todo == "capareallyadd") {
		$id = intval($_REQUEST["id"]);
		$username = user_from_id($id);
		echo "<H3>Editing user $username</H3>\n";

		$capa = mysql_real_escape_string($_REQUEST["capa"], $link);

		$query = "INSERT INTO capabilities SET id=$id, capability = \"$capa\"";
		$result = mysql_query($query, $link) or die("Can't save capability: ".mysql_error($link));
		$num = mysql_affected_rows($link);
		if($num != 1) {
			die("Granting capability failed");
		} else {
			echo "Capability granted<BR><BR>\n";
		}

		echo "<A href=\"users.php?todo=edit&id=$id\">";
		echo "<IMG src=\"icons/user_edit.png\" alt=\"edit\">Edit user</A><BR>\n";
		echo "<A href=\"users.php\"><IMG src=\"icons/user.png\" alt=\"view\">User managment</A><BR>\n";
	} else {
		$query = "SELECT id, user FROM users ORDER BY id";
		$result = mysql_query($query, $link) or die("Can't fetch users: ".mysql_error($link));

		echo "<UL class=\"user\">\n";
		while($line = mysql_fetch_array($result)) {
			echo "<LI>{$line["user"]} ";
			echo "<A href=\"users.php?todo=edit&id={$line["id"]}\"><IMG src=\"icons/user_edit.png\" alt=\"edit\"></A>";
			echo "<A href=\"users.php?todo=rm&id={$line["id"]}\"><IMG src=\"icons/user_delete.png\" alt=\"delete\"></A>";
			echo "</LI>\n";
		}
		echo "</UL>\n";
		echo "<A href=\"users.php?todo=add\"><IMG src=\"icons/user_add.png\" alt=\"add\">Add user</A>";
	}
	mysql_close($link);


	echo "<DIV class=\"footer\">\n";
	echo "<A href=\"index.php\"><IMG src=\"icons/house.png\" alt=\"home\">Home</A>\n";
	echo "<A href=\"logout.php\"><IMG src=\"icons/door_in.png\" alt=\"logout\">Logout</A>\n";
	echo "</DIV>\n";
?>
 </BODY>
</HTML>
