<?php
/*******************************************************************
 * 版权协议：2009-2019
 * 版权所有: PHP-北京金南曦网络技术有限公司旗下PHPWMS，PHP商城系统技术支持中心http://www.php188.net，并保留所有权利。 
* PHP商城系统网址: http://www.php188.com
 * PHPWMS系统网址：http://www.phpwms.com
 * 销售电话：010-87875088
 * 销售电话：010-87875188 
*------------------------------------------------------------------
 * 这不是一个完全免费软件！您只能在不用于商业目的的前提下对程序代码进
 * 行修改和使用；不允许对程序代码以任何形式任何目的的再发布。
 *------------------------------------------------------------------
 * 文件名称：admin_managectrller.php
 * 适用范围：PHPWMS 1.0
 * 版　　本：1.0
 *------------------------------------------------------------------
 * Script Written By phpwms项目组
 * 最后更新： 2009-09-24 phpwms 由PHP金南曦网络技术有限公司整理发布
 *******************************************************************/
if(!defined('IN_SYS'))exit('access die');
include('../include/classes/cls.sys_crypt.php'); 
$do		= trim($_REQUEST['do']);
$type	= trim($_REQUEST['type']);
$action = trim($_REQUEST['action']);
$tpl -> assign("do",$do);
$tpl -> assign("type",$type);
$tpl -> assign("action",$action);
//非创始人不让访问
if($_SESSION['manager_data']['is_orgin']!='1')exit(NO_AUTH_LOGIN);
//管理员操作
require dirname(__FILE__).'/private.php';
if ($do) {
	if($do == 'admincper') { //管理员列表
		$sql = 'SELECT * FROM ##__admin order by add_time desc';
		$page = new ShowPage;
		$page->PageSize = 25;
		$page->Total = $db -> getCount($sql);
		$showpage = $page->ShowLink();
		$arr = $db -> fetch($sql." limit  ".$page->OffSet());
		$tpl -> assign("show_page",$showpage);
		$tpl -> assign("checkd","1");
		$tpl -> assign("data",$arr);
	} elseif($do=='adminer_add'){//管理员添加列表
		$data = $_REQUEST['data'];
		$f = trim($_POST['ra_pwd_new']);
		$e = trim($_POST['ra_pwd_old']);
		if(empty($f) || empty($e))die($sp -> bgmsg('请输入密码.！',"admincp.php?action=managectrller&type=core&do=user_add"));
		if($f!=$e)die($sp -> bgmsg('两次密码不一致！',"admincp.php?action=managectrller&type=core&do=user_add"));
		//*********************检查是否用户名是否已经注册*******************************//
		$sqls= 'SELECT id total FROM ##__admin WHERE admin_user = "'.$data['admin_user'].'"';
		$db -> sql_query($sqls);
		$affectrow = $db -> sql_affectedrows();
		if($affectrow>0){  
		   die($sp -> bgmsg('非常抱歉，存在相同的管理员！',"admincp.php?action=managectrller&type=core&do=user_add"));
		}
		//******************END检查是否用户名是否已经注册*******************************//
		$priv = $_POST['group'];
		if(!empty($priv)){
			foreach ($priv as &$v)$v = intval(trim($v));
			$priv = array_filter($priv);
			$priv_string = join('|',$priv);
		}
		$data['pri_config'] =$priv_string;
        $data['admin_pwd'] = md5($e);
        $data['add_user'] = $_SESSION['admin_user']; //添加人的名称
        $data['add_time'] = date("Y-m-d H:i:s"); //添加人的名称
		$sql = 'INSERT INTO ##__admin '.$db -> sql_build_array('INSERT',$data);
		$re  = $db -> query($sql);
		if ($re) {
           die($sp -> bgmsg('恭喜你，管理员用户添加成功！',"admincp.php?action=managectrller&do=admincper"));
		}
	} else if ($do=='adminer_del') { //删除管理员
		if($_SESSION['manager_data']['is_orgin'] !='1')die($sp -> bgmsg('您不是网站创始人,无权操作此项.！',"admincp.php?action=managectrller&do=admincper"));
		$id = to_int($_GET['id']);
		if(empty($id))exit($sp->bgmsg('参数错误.'));
		$arr = $db ->fetch("SELECT `add_user`,`is_orgin` FROM ##__admin WHERE `id` = '$id'",TRUE);
		
		if(empty($arr))exit($sp->bgmsg('无可用数据'));
		if ($arr['is_orgin'] == '1') {
			die($sp -> bgmsg('不允许删除初始安装管理员账号！',"admincp.php?action=managectrller&do=admincper"));
		}
		$sql = 'DELETE FROM ##__admin WHERE id = '.$id;
		$re  = $db ->query($sql);
		if ($re) {
			die($sp -> bgmsg('恭喜你，删除管理员操作成功！',"admincp.php?action=managectrller&do=admincper"));
		} else {
			die($sp -> bgmsg('非常抱歉，删除操作失败！',"admincp.php?action=managectrller&do=admincper"));
		}
    } else if ($do == 'user_edit') {
		$admin_id = trim($_REQUEST['id']); 
		$sql = "SELECT * FROM ##__admin WHERE id = ".$admin_id;
		$re  = $db -> sql_query($sql);
        $data = $db -> sql_fetchrowset($re);
		$db -> sql_freeresult($re);
		$priv = $data[0]['pri_config'];
		$priv_user_array = array_filter(array_map("trim",explode('|',$priv)));
		foreach ($private_ary as &$v){
			$v['checked'] = in_array(trim($v['p']),$priv_user_array)?'1':'0';
		}
		$prive_tress = array_to_tree($private_ary,'id','parent','childrens');
        $tpl -> assign("data",$data);
	} else if ($do == 'sure_edit') { //确定修改
		//if($_SESSION['manager_data']['is_orgin'] !='1')die($sp -> bgmsg('您不是网站创始人,无权操作此项.！',"admincp.php?action=managectrller&do=admincper"));
		$id = $data['id'];
		if(($_SESSION['manager_data']['is_orgin'] !='1') && ($id!=$_SESSION['manager_data']['id'])){
			die($sp -> bgmsg('您无权修改其他管理员信息！',"admincp.php?action=managectrller&do=admincper"));
		}
		$data = $_REQUEST['data'];
		$priv = $_POST['group'];
		if(!empty($priv)){
			foreach ($priv as &$v)$v = intval(trim($v));
			$priv = array_filter($priv);
			$priv_string = join('|',$priv);
		}
		$data['pri_config'] =$priv_string;
	    $new_pass = $_POST['ra_pwd_new'];
	    if(!empty($new_pass)){
	    	$data['admin_pwd'] = trim(md5($new_pass));
	    }
		$sql = 'UPDATE ##__admin'.' SET '.$db -> sql_build_array('UPDATE', $data).' WHERE id = '.$data['id'];
		$re = $db -> sql_query($sql);
		$affectrow = $db -> sql_affectedrows();
		if ($re) {
            die($sp -> bgmsg('恭喜你，修改管理员操作成功 ！',"admincp.php?action=managectrller&do=admincper"));
		} else {
			die($sp -> bgmsg('非常抱歉，修改管理员操作失败 ！',"admincp.php?action=managectrller&do=admincper"));
		}
	}
}
$pn  = '管理员管理';
$tpl->assign('manager_data',$_SESSION['manager_data']);
if($do =='user_add'){
	$prive_tress = array_to_tree($private_ary,'id','parent','childrens');
}
$tpl->assign('group_list',$prive_tress);
$tpl -> assign("admin_nav",shownav('<a href="admincp.php?action=managectrller&do=admincper">'.$pn.'</a>&nbsp;&raquo;&nbsp;管理员管理'));
$sp -> outPut('managectrller.tpl',$pn);
?>
