<?php 

//禁止直接访问
!defined('IN_SYSTEM') && exit('Access Denied');

//是否提交
if($AdminLogin->IsPost(array('addusername', 'adduserpw', 'power_sel_box', 'AdduserInputKey'), 'AddUser')){
	//来路判断
	if($AdminLogin->CheckHttpReferer(WEB_URL.'/admin/index.php?location=adduser') == true){
		//验证方法
		$AdminLogin->CheckPostFun = array(
				'addusername' => array(array('ToUtf8', 'trimall', 'DeleteHtml', 'strip_tags'), array('CheckNull', 'CheckAdminUserName')),
				'adduserpw' => array(array('ToUtf8', 'trimall', 'DeleteHtml', 'strip_tags'), array('CheckNull', 'CheckEditUserPW')),
				'power_sel_box' => array(array('ToUtf8', 'trimall', 'DeleteHtml', 'strip_tags'), array('CheckNull', 'CheckAdminPassword')),
				'AdduserInputKey' => array(array('ToUtf8', 'trimall', 'DeleteHtml', 'strip_tags'), array('CheckPostInputKey', 'CheckNull'))
		);
		//验证数据
		if($AdminLogin->CheckPostValue()){
			//过滤后的用户提交的数据
			$UserPostValue = $AdminLogin->Post;
			//判断InputKey
			if($AdminLogin->CheckValue($UserPostValue['AdduserInputKey'], $_SESSION['AdduserInputKey'])){
				//连接到MYSQL并打开系统数据库
				$DataBase->open_db();
				//检测用户名是否存在
				$DataBase->sel("adminuser", "WHERE `username` = '".$UserPostValue['addusername']."'");
				if(count($DataBase->Result) >= 1){
					$AdminShowMessage = AdminShowMessage('用户名存在！', WEB_URL.'/admin/index.php?location=adduser', 0, '#F00');	//用户名存在
				}
				else{
					$UserPostValue['Key'] = generate_rand_string(50);	//key
					$UserPostValue['adduserpw'] = set_password($UserPostValue['adduserpw'], $UserPostValue['Key']);	//密码
					$UserPostValue['power_sel_box'] = AdminUserPower($UserPostValue['power_sel_box']);	//权限
					if($DataBase->Add('adminuser', array('username' => $UserPostValue['addusername'], 'password' => $UserPostValue['adduserpw'], 'key' => $UserPostValue['Key'], 'grade' => '1', 'power' => $UserPostValue['power_sel_box']))){
						$AdminShowMessage = AdminShowMessage('添加新用户成功！', WEB_URL.'/admin/index.php?location=adduser', 1);
					}
					else{
						$AdminShowMessage = AdminShowMessage('添加失败！请检查原因！', WEB_URL.'/admin/index.php?location=adduser', 0, '#F00');
					}
				}	
				//关闭数据库连接
				$DataBase->close_dblink();
			}
			else{
				$AdminShowMessage = AdminShowMessage('来路不正确！', WEB_URL.'/admin/index.php?location=adduser', 0, '#F00');	//InputKey不正确
			}			
		}
		else{
			$AdminShowMessage = AdminShowMessage('您提交的数据不合法！', WEB_URL.'/admin/index.php?location=adduser', 0, '#F00');	//验证不通过
		}		
	}
	else{
		$AdminShowMessage = AdminShowMessage('来路不正确！', WEB_URL.'/admin/index.php?location=adduser', 0, '#F00');	//来路不正确
	}
	//销毁inputkey确保只能使用一次
	$_SESSION['AdduserInputKey'] = '';	
}
else{
	$AdminShowMessage = AdminShowMessage('提交失败！', WEB_URL.'/admin/index.php?location=adduser', 0, '#F00');	//表单未提交
}
?>