<!--#INCLUDE FILE="conn.asp" -->
<!--#include file="admin_Checkuser.asp"-->
<!--#include file="inc/md5.asp"-->
<!--#include file="inc/htmlencode.asp"-->
<HTML><HEAD><title><%=StrVar(1)%>--管理页面</title>
<META http-equiv=Content-Type content="text/html; charset=gb2312">
<!--#include file="inc/admin_main.css"-->
</HEAD>
<BODY leftMargin=0 topMargin=0 marginwidth="0" marginheight="0">
<%
if  not sysadmin or session("adminlogin")<>"0K" Then
	Errmsg=Errmsg+"<br>"+"<li>本页面为管理员专用，请<a href=admin_index.asp target=_top>登陆</a>后进入。"
	Call Error("Information",ErrMsg)
Else

	%>
	
<table cellpadding=5 cellspacing=1 border=0 width=90% Class=TableBorder align=center>
  <tr>
		<th>欢迎<b><%=membername%></b>进入管理页面</th>
	</tr>
	</table>

	<%
	sql="select * from student where userid='"&membername&"'"
	set rs=conn.execute(sql)
	if rs.eof and rs.bof then
	Errmsg=Errmsg+"<br>"+"<li>操作失败！您的权限不够！"
	Call Error("Information",ErrMsg)
    response.end
	end if
	set rs=nothing

	select case Request("action")
	case "SaveNew"
		Call addadmin()
	case "NewAdmin"
		Call addform()
	case "Delete"
		Call RemoveAdmin()
	case "Modify"
		Call ModifyForm()
	case "ChangeAccount"
		Call SaveEdit()
	case else
		call adminlist()
	End select

End if
Call endconnection()


sub SaveEdit()

	dim userid2,userpwd2
	dim adminid

	if request.form("userid2")="" then
	Errmsg=Errmsg+"<br>"+"<li>请输入后台管理帐号!"
	Call Error("Information",ErrMsg)
		response.end
	else
		userid2=replace(request.form("userid2"),"'","")
	end if

	if request.form("userpwd2")="" then
	Errmsg=Errmsg+"<br>"+"<li>请输入后台登陆密码!"
	Call Error("Information",ErrMsg)
		response.end
	else
		userpwd2=request.form("userpwd2")
		if request.form("olduserpwd2")<>userpwd2 then
			userpwd2=md5(userpwd2)
		end if
	end if
	
	adminid=clng(request.form("superid"))
	sql="update admin set username='"&userid2&"',[password]='"&userpwd2&"' where managerid="&adminid
	conn.execute(sql)
	Call adminmsg("操作成功，成功修改管理帐号！")


end sub


sub ModifyForm()

dim sql,rs
dim adminid

adminid=clng(request("id"))

sql="select A.username,A.[password],S.userid from admin A inner join student S on A.managerid=S.studid where S.studid="&adminid
set rs=conn.execute(sql)
  %> 
<form action="admin_admin.asp?action=ChangeAccount" method=post>
<table cellpadding="2" cellspacing="1" border="0" width="80%" class=TableBorder align=center>
               <tr> 
                  <th colspan=2 height=23>管理员帐号修改
                  </th>
                </tr>
          <tr> 
            <td width="26%" align="right" height=23 Class=forumrowhighlight>前台用户名称：</td>
            <td width="74%" Class=forumrowhighlight><%=htmlencode(rs(2))%>
            </td>
          </tr>
               <tr> 
            <td width="26%" align="right" class=forumrow>后台管理帐号：</td>
            <td width="74%" class=forumrow>
              <input type=hidden name="olduserid2" value="<%=rs(0)%>">
              <input type=text name="userid2" value="<%=rs(0)%>">  
            </td>
          </tr>
          <tr> 
            <td width="26%" align="right" Class=forumrowhighlight>后台登陆密码：</td>
            <td width="74%" Class=forumrowhighlight>
              <input type="password" name="userpwd2" value="<%=rs(1)%>">
              <input type="hidden" name="olduserpwd2" value="<%=rs(1)%>">
            </td>
          </tr>
          <tr align="center"> 
            <td colspan="2" class=forumrow> 
              <input type=hidden name=superid value="<%=adminid%>">
              <input type="submit" name="Submit" value="更 新" class=button>&nbsp;&nbsp;<input type=button value="返 回" onclick="location.href='admin_admin.asp'" class=button>
            </td>
          </tr>
        </table>
        </form>

<%
set rs=nothing


end sub


sub RemoveAdmin()

	dim adminid
	dim sql,rs

	adminid=clng(request("id"))
	sql="select A.username from admin A inner join student S on A.managerid=S.studid where S.studid="&adminid
	set rs=conn.execute(sql)
	if rs.eof and rs.bof then
		ErrMsg=ErrMsg+"<br>"+"<li>操作失败！没有找到要进行操作的对象！"
    Call Error("Information",ErrMsg)
	else
		sql="delete from admin where managerid="&adminid
		conn.execute(sql)

		response.redirect "admin_admin.asp"
	end if
	set rs=nothing

end sub



sub adminlist()

dim sql,rs
%>
<table border=0 width=90% align=center Class=TableBorder>
  <tr>
    <td Class=forumrowhighlight><BR>
      <B><a name=top>说明</a></B>：<br>
      (1)删除管理员的操作将删除后台管理员帐号，前台的登陆帐号仍会保留。<br>
      (2)要修改管理员的后台登陆帐号请点击相应的用户名。<br>
      (3)添加的系统管理员必须首先是本系统的用户(在前台已注册)！ </td>
  </tr>
  <tr>
    <td align=right class=forumrow>[<a href=admin_admin.asp?action=NewAdmin>添加系统管理员</a>]</td>
  </tr>
</table>
<table width=80% align=center cellspacing=1 cellpadding=5 Class=TableBorder>
<tr><th>用户名</th><th>最后登陆时间</th><th>最后登陆IP</th><th>操作</th></tr>

<%
sql="select S.userid,A.lastlogin,A.ip,A.managerid from admin A inner join student S on A.managerid=S.studid"
set rs=conn.execute(sql)


do until rs.eof
response.write "<tr><td Class=forumrowhighlight>&nbsp;<a href=""admin_admin.asp?action=Modify&id="&rs("managerid")&""">"&rs("userid")&"</td><td align=center Class=forumrowhighlight>"&rs("lastlogin")&"</td><td align=center Class=forumrowhighlight>"&rs("ip")&"</td><td align=center Class=forumrowhighlight><a href=""admin_admin.asp?action=Delete&id="&rs("managerid")&""">删除</a></td></tr>"

rs.movenext
loop

end sub



Sub addform()
%><BR><BR>
<form action="admin_admin.asp?action=SaveNew" method=post>
<table width="80%" border="0" cellspacing="1" cellpadding="4" align=center Class=TableBorder>
<tr><th colspan=2>添加管理员</th></tr>
<tr><td width=30% align=right Class=forumrowhighlight>前台用户名&nbsp;</td><td Class=forumrowhighlight><input name=username1 type=text size=30>&nbsp;请填系统中已注册的用户名</td></tr>
<tr><td width=30% align=right class=forumrow>后台管理帐号&nbsp;</td><td class=forumrow><input name=username2 type=text size=30></td></tr>
<tr><td width=30% align=right Class=forumrowhighlight>后台登陆密码&nbsp;</td><td Class=forumrowhighlight><input name=userpwd2 type=text size=30></td></tr>
<tr><td colspan=2 align=center class=forumrow><input type="submit" name="Submit" value="&nbsp;添&nbsp;加&nbsp;" class=button>
</td></tr></table>
</form>

<%End Sub


Sub addadmin()

	Dim username1,username2,userpwd2
	dim sql,rs
	dim studid
	if Request.form("username1")="" Then
		ErrMsg=ErrMsg+"<br>"+"<li>操作失败，请填写前台用户名称！"
Call Error("Information",ErrMsg)
		response.end
	Else
		username1=replace(Request.form("username1"),"'","")
	End if
	if Request.form("username2")="" Then
		ErrMsg=ErrMsg+"<br>"+"<li>操作失败，请填写后台管理帐号！"
Call Error("Information",ErrMsg)
		response.end
	Else
		username2=replace(Request.form("username2"),"'","")
	End if
	if Request.form("userpwd2")="" Then
		ErrMsg=ErrMsg+"<br>"+"<li>操作失败，请填写后台登陆密码！"
Call Error("Information",ErrMsg)
		response.end
	Else
		userpwd2=md5(request.form("userpwd2"))
	End if

	sql="select studid from student where userid='"&username1&"'"
	set rs=conn.execute(sql)
	if rs.eof and rs.bof Then
		ErrMsg=ErrMsg+"<br>"+"<li>操作失败，校友录注册用户中没有该用户名称！"
Call Error("Information",ErrMsg)
		response.end
	else
		studid=rs(0)
	End if

	sql="select A.username from admin A inner join student S on A.managerid=S.studid where S.userid='"&username1&"'"
	set rs=conn.execute(sql)
	if not (rs.eof and rs.bof) Then
		ErrMsg=ErrMsg+"<br>"+"<li>操作失败，该用户已经是系统管理员！"
Call Error("Information",ErrMsg)
		response.end
	End if
	Set rs=Nothing
	sql="insert into admin (username,[password],managerid) values ('"&username2&"','"&userpwd2&"',"&studid&")"
	conn.execute(sql)
Call adminmsg("操作成功，添加管理员成功！")

End Sub
%>
</BODY></HTML>


