<?php
/**
* 用户管理
* @author moufer<moufer@163.com>
* @copyright www.modoer.com
* @version $Id: users.inc.php 2 2007-12-20 15:36$
*/

(!defined('IN_ADMIN') || !defined('IN_MUDDER')) && exit('Access Denied');

if(!check_submit('userssubmit')) {

    $op = $op == 'add' ? 'add' : ($op == 'edit' ? 'edit' : 'list');

    if($op == 'list') {
        $row = $db->get_one("SELECT COUNT(*) as total FROM {$dbpre}admin WHERE id<>'{$admin->id}'");
        $total = $row['total'];
        if($total > 0) {
            $offset = 15;
            $limit = get_limit($page, $offset);
            $query = $db->query("SELECT id,adminname,email,admintype,is_founder,logintime,loginip,logincount FROM {$dbpre}admin WHERE id<>'{$admin->id}' LIMIT $limit");
            while($controluser = $db->fetch_array($query)) {
                $controluser['logintime'] = date('Y-m-d H:i:s', $controluser['logintime']);
                $controlusers[] = $controluser;
            }
            $multipage = multi($total, $offset, $page, "admincp?action=action&file=$file");
        }
    } elseif($op == 'edit') {
        if(!$adminid || !is_numeric($adminid) || $adminid < 0) cpmsg('无效的后台用户。');
        if(!$admin->is_founder && $adminid != $admin->id) cpmsg('您不是网站创始人，无法修改其他管理员账户。');
        $controluser = $db->get_one("SELECT id,adminname,email FROM {$dbpre}admin WHERE id={$adminid}");
    } else {
        $op == 'add';
        if(!$admin->is_founder) cpmsg('您不是网站创始人，无法增加管理员帐号。');
    }

    $tplname = $op;
    include cptpl('cpuser_'.$tplname);

} else {

    if($op == 'list') {
        if(!$admin->is_founder) cpmsg('您不是网站创始人，无法删除后台用户。');
        if($adminids && is_array($adminids)) {
            foreach($adminids as $var_adminid) {
                if($var_adminid == $admin->id) cpmsg('无法删除自身。');
                $db->query("DELETE FROM {$dbpre}admin WHERE id='{$var_adminid}'");
            }
            cpmsg('删除完毕！',"admincp.php?action=$action&file=$file&op=$op");
        } else {
            cpmsg('未选择删除项，请返回重选。');
        }

    } elseif($op == 'edit') {
        if(!$admin->is_founder && $adminid != $admin->id) cpmsg('您不是网站创始人，无法修改其他后台用户。');
        $email = trim($email);
        $password = trim($password);
        $password2 = trim($password2);
        if(!$adminid || !is_numeric($adminid) || $adminid < 0) {
            cpmsg('无效的后台用户。');
        } elseif(!$email) {
            cpmsg('未填写E-mail地址，请返回修改。');
        } elseif(!isemail($email)) {
            cpmsg('E-mail格式不正确，请返回修改。');
        } elseif($password && strlen($password) < 5) {
            cpmsg('密码不能小于5个字符。');
        } elseif($password && $password != $password2) {
            cpmsg('2次输入的密码不一致，请返回修改。');
        }
        $md5pwd = $password ? md5($password) : '';
        if($md5pwd) {
            $up_set = " email='$email', password='$md5pwd' ";
        } else {
            $up_set = " email='$email' ";
        }
        $db->query("UPDATE {$dbpre}admin SET $up_set WHERE id='$adminid'");
        cpmsg('修改完毕。');

    } elseif($op == 'add') {
        if(!$admin->is_founder) cpmsg('您不是网站创始人，无法增加后台用户。');
        $password = trim($password);
        $password2 = trim($password2);
        $username = stripslashes(trim($username));
        $guestexp = '\xA1\xA1|\xAC\xA3|^Guest|^\xD3\xCE\xBF\xCD|\xB9\x43\xAB\xC8';
        if(preg_match("/^\s*$|^c:\\con\\con$|[%,\*\"\s\t\<\>\&]|$guestexp/is", $username)) {
            cpmsg('用户名存在敏感字符，请返回修改。');
        } elseif(!$email) {
            cpmsg('未填写E-mail地址，请返回修改。');
        } elseif(!isemail($email)) {
            cpmsg('E-mail格式不正确，请返回修改。');
        } elseif(!$password) {
            cpmsg('未填写密码，请返回修改。');
        } elseif(strlen($password) < 6) {
            cpmsg('密码不能小于6个字符，请返回修改。');
        } elseif($password != $password2) {
            cpmsg('2次输入的密码不一致，请返回修改。');
        }

        $exist = $db->get_one("SELECT COUNT(*) as total FROM {$dbpre}admin WHERE adminname='$username'");
        $exist['total'] >=1 && cpmsg('用户已存在，请返回修改。');

        $md5pwd = md5($password);

        $db->query("INSERT INTO {$dbpre}admin (adminname,password,email,admintype,is_founder,logintime,loginip,logincount) VALUES ('$username','$md5pwd','$email','1','N','$timestamp','','0')");
        cpmsg('成功添加一个后台用户。');

    } else {
        cpmsg('未定义操作。');
    }

}
?>