<?php
header("Content-Type:text/html; charset=utf-8");
$thisDir=realpath(dirname(__FILE__)."/../");
require("{$thisDir}/webini.inc.php");
extract($_POST);
if(!isset($mod) || ($mod!=='personnel' && $mod!=='public') || !isset($action) || isNull($action)){
	die("Access Denied");
}
$result='';
if($action=="saveAddStation"){
	if(!isset($sName) || isNull($sName)){
		echo"请输入岗位名称后再保存";
	}else{
		$sql="select * from station where comId={$_SESSION['comId']}";
		$row=$db->myQuery($sql,false);
		if(count($row)==0){
			$sql="insert into station(comId,stationName,addUser,ip) values({$_SESSION['comId']},'{$sName}','{$_SESSION['userNick']}','{$cg['ip']}')";
			$result=$db->execSql($sql,false);
			if($result===false){
				echo"保存失败，请重试";
			}else{
				echo"新的岗位保存成功";
			}
		}else{
			echo"已经存在相同的岗位名称，请重新设置新的岗位名称！";
		}
	}
}else if($action=='editStation'){
	if(!isset($stationId) || !is_numeric($stationId)){
		echo"Access Denied";
	}else{
		$sql="select * from station where id={$stationId} and comId={$_SESSION['comId']}";
		$row=$db->myQuery($sql,false);
		if(count($row)==0){
			echo"<center>指定的岗位不存在</center>";
		}else{
			rc_require("editstation.html","personnel");
		}
	}
}else if($action=='saveEditStation'){
	if(!isset($stationId) || !is_numeric($stationId) || !isset($sName) || isNull($sName)){
		echo"数据不完整，请被后保存";
	}else{
		$sql="select * from station where stationName='{$sName}' and comId={$_SESSION['comId']} and id<>{$stationId}";
		$row=$db->myQuery($sql,false);
		if(count($row)>0){
			echo"相同的岗位名称已经存在，请使用其它名称";
		}else{
			$sql="update station set stationName='{$sName}' where id={$stationId}";
			$result=$db->execSql($sql,false);
			if($result===false){
				echo"保存失败，请重试";
			}else{
				echo"保存成功，请返回";
			}
		}
	}
}else if($action=='deleteStation'){
	if(!isset($stationId) || !is_numeric($stationId)){
		echo"参数错误";
	}else{
		$sql="delete from station where id={$stationId} and comId={$_SESSION['comId']}";
		$result=$db->execSql($sql,false);
		if($result===false){
			echo"删除失败";
		}else{
			echo"成功删除";
		}
	}
}else if($action=='editUser'){
	if(!isset($objId) || !is_numeric($objId)){
		echo"参数错误";
	}else{
		$sql="select * from user where id={$objId} and comId={$_SESSION['comId']}";
		$row=$db->myQuery($sql,false);
		if(!is_array($row) || count($row)==0){
			echo"指定的用户不存在";
		}else{
			rc_require("edituser.html","personnel");
		}
	}
}else if($action=="saveEditUser"){
	if(!is_numeric($objId)){
		$result="参数错误";
	}else{
		if(isNull($eName) || !is_numeric($eBranch) || intval($eBranch)===-1 || !is_numeric($eStation) || intval($eStation)===-1 || !is_numeric($eOffice) || intval($eOffice)===-1){
			$result="必填数据未填写完整";
		}else if(!isNull($ePassword) && strlen($ePassword)<4){
			$result="你输入了密码，但密码长度小于4位";
		}else if(!isNull($ePassword) && $ePassword!=$confirm){
			$result="两次输入的密码不一致";
		}else if(!isNull($eBirthday) && !preg_match($zz_date,$eBirthday)){
			$result="出生日期错误";
		}else if(!isNull($eZcDate) && !preg_match($zz_date,$eZcDate)){
			$result="职称获得日期错误";
		}else if(!isNull($eDiYibysj) && !preg_match($zz_date,$eDiYibysj)){
			$result="第一学历毕业日期错误";
		}else if(!isNull($eDiErbysj) && !preg_match($zz_date,$eDiErbysj)){
			$result="第二学历毕业日期错误";
		}else if(!isNull($eDiYibysj) && !preg_match($zz_date,$eWorkDate)){
			$result="上岗日期错误";
		}else if(!isNull($eOutDate) && !preg_match($zz_date,$eOutDate)){
			$result="离职日期错误";
		}else{
			if(!md::findStation($_SESSION['comId'],$eStation)){
				$result="指定的岗位名称不存在";
			}else if(!is_array(md::findOffice($_SESSION['comId'],$eOffice,false,false))){
				$result="指定的岗位不存在";
			}else{
				$sql="select * from user where comId={$_SESSION['comId']} and id={$objId} limit 1";
				$row=$db->myQuery($sql,false);
				if($row===false || count($row)==0){
					$result="指定的账号不存在";
				}else{
					$password=isNull($ePassword)?$row[0]['password']:md5($ePassword.$row[0]['privatePass']);
					$sql="update user set  password='{$password}',branch={$eBranch},officeId='{$eOffice}',station={$eStation},rightId=0,name='{$eName}',sex={$eSex},jiGuan='{$eJiGuan}',telephone='{$eTelephone}',address='{$eAddress}',birthday='{$eBirthday}',teChang='{$eTeChang}',zhiCheng='{$eZhiCheng}',zcDate='{$eZcDate}',diYiXueLi='{$eDiYiXueLi}',diYibyxx='{$eDiYibyxx}',diYibysj='{$eDiYibysj}',deErXueLi='{$eDiErXueLi}',deErbyxx='{$eDiErbyxx}',deErbysj='{$eDiErbysj}',workDate='{$eWorkDate}',outDate='{$eOutDate}',addUser='{$_SESSION['userNick']}',regTime=now(),ip='{$cg['ip']}' where id={$objId} and comId={$_SESSION['comId']}";
					$result=$db->execSql($sql,false)==true?"已经成功保存<br />2秒钟后返回":"保存失败，请重试";
				}
			}
		}
	}
	echo $result;
}else if($action=='addUser'){
	rc_require("adduser.html","personnel");
}else if($action=='saveAddUser'){
	if(!preg_match($zz_userNick,$aUserNick) || mb_strlen($aPassword,"utf-8")<4 || isNull($aName) || !is_numeric($aOffice) || intval($aOffice)===-1 || !is_numeric($aStation) || intval($aStation)===-1 || !is_numeric($aBranch) || intval($aBranch)===-1){
		$result= "必填数据填写不完整，请检查并修改后重试提交";
	}else if($aPassword!==$confirm){
		$result="两次输入的密码不一致";
	}else if(!isNull($aBirthday) && !preg_match($zz_date,$aBirthday)){
		$result="出生日期错误";
	}else if(!isNull($aZcDate) && !preg_match($zz_date,$aZcDate)){
		$result="职称获得日期错误";
	}else if(!isNull($aDiYibysj) && !preg_match($zz_date,$aDiYibysj)){
		$result="第一学历毕业日期错误";
	}else if(!isNull($aDiErbysj) && !preg_match($zz_date,$aDiErbysj)){
		$result="第二学历毕业日期错误";
	}else if(!isNull($aDiYibysj) && !preg_match($zz_date,$aWorkDate)){
		$result="上岗日期错误";
	}else if(!isNull($aOutDate) && !preg_match($zz_date,$aOutDate)){
		$result="离职日期错误";
	}else{
		$sql="select * from user where userNick='{$aUserNick}'";
		$row=$db->myQuery($sql,false);
		if(count($row)){
			$result="已经存在相同的登录账号，请使用其它不重复的账号！";
		}else{
			$pp=md5(time()).date($cg['dateTime']);
			$aPassword=md5($aPassword.$pp);
			$sql="insert into user(userNick,privatePass,password,comId,branch,officeId,station,rightId,name,sex,jiGuan,birthday,telephone,address,photo,teChang,zhiCheng,zcDate,diYiXueLi,diYibyxx,diYibysj,deErXueLi,deErbyxx,deErbysj,workDate,outDate,addUser,regTime,ip) values('{$aUserNick}','{$pp}','{$aPassword}',{$_SESSION['comId']},{$aBranch},{$aOffice},'{$aStation}',0,'{$aName}','{$aSex}','{$aJiGuan}','{$aBirthday}','{$aTelephone}','{$aAddress}','','{$aTeChang}','{$aZhiCheng}','{$aZcDate}','{$aDiYiXueLi}','{$aDiYibyxx}','{$aDiYibysj}','{$aDiErXueLi}','{$aDiErbyxx}','{$aDiErbysj}','{$aWorkDate}','','{$_SESSION['userNick']}',now(),'{$cg['ip']}')";
			$result=$db->execSql($sql,false)==true?"新的职员已经成功保存<br />2秒钟后自动返回":"保存失败，请重试";
		}
	}
	echo $result;
}else if($action=='checkAddUser'){
	if($objId=='aUserNick' && preg_match($zz_userNick,$v)){
		$sql="select * from user where userNick='{$v}'";
		$row=$db->myQuery($sql,false);
		if(count($row)){
			echo"<script type=text/javascript>alert('账号已经存在，请使用其它账号');</script>";
		}else{
			echo"账号合法";
		}
	}
}else if($action=='addUserImport'){
	$sum=$errSum=$sucSum=$errId=0;
	if(count($_FILES)==0 || !isset($_FILES['userFile']) || $_FILES['userFile']['error']!==0){
		$result='没有上传文件';
	}else{
		$filePath="{$cg['root']}/temp/".md5(time()).mt_rand(10000,99999);
		$file=$_FILES['userFile'];
		$fName=strtolower($file['name']);
		$xlsx=$xls=-1;
		$xlsx=strrpos($fName,'.xlsx');
		$xlsx=is_numeric($xlsx)?$xlsx:-1;
		if($xlsx==-1 || mb_strlen($fName,"utf-8")!=$xlsx+5){
			$xls=strrpos($fName,'.xls');
			$xls=is_numeric($xls)?$xls:-1;
		}
		if($xls==-1 && $xlsx==-1){
			$result='你上传的不是Excel文件';
		}else if($file['size']/1024>$cg['fileMax']){
			$result="文件大小超过{$cg['fileMax']}KB，请减小文件后再重试";
		}else{
			$filePath.=$xls==-1?".xlsx":".xls";
			if(@move_uploaded_file($file['tmp_name'],$filePath)){
				$rs=$db->connectExcel($filePath,"[Sheet1$]");
				if($rs==false){
					unlink($filePath);
					$result="打开Excel失败，导入失败，请重试，或检查您的Excel数据文件是否与模板一致";
				}else{
					if(count($rs->recordCount)==0){
						$result='数据表是空的';
					}else{
						$error='';
						$isExist="";
						$isMust='';
						$isError='';
						$insertSql="insert into user(userNick,privatePass,password,comId,branch,officeId,station,rightId,name,sex,jiGuan,birthday,telephone,address,photo,teChang,zhiCheng,zcDate,diYiXueLi,diYibyxx,diYibysj,deErXueLi,deErbyxx,deErbysj,workDate,outDate,addUser,ip) values(:userNick,:privatePass,:password,:comId,:branch,:officeId,:station,:rightId,:name,:sex,:jiGuan,:birthday,:telephone,:address,:photo,:teChang,:zhiCheng,:zcDate,:diYiXueLi,:diYibyxx,:diYibysj,:deErXueLi,:deErbyxx,:deErbysj,:workDate,:outDate,:addUser,:ip)";
						$pdo=$db->conn->prepare($insertSql);
						$rs->movefirst;
						$sum=$rs->recordCount;
						while(!$rs->eof){
							$errId+=1;
							if(!preg_match($zz_date,$rs->fields[8]->value)){
								echo $rs->fields[8]->value;
							}
							if(!preg_match($zz_userNick,$rs->fields[0]->value) || !preg_match($zz_password,$rs->fields[1]->value) || !is_numeric($rs->fields[3]->value) || intval($rs->fields[3]->value)===-1 || !is_numeric($rs->fields[4]->value) || intval($rs->fields[4]->value)===-1 || isNull($rs->fields[5]->value) || ($rs->fields[6]->value!=='男' && $rs->fields[6]->value!=='女') || !preg_match($zz_date,$rs->fields[20]->value) || !preg_match($zz_date,$rs->fields[8]->value)){
								$errSum+=1;
								$isMust.="{$errId}、";
							}else{
								$sql="select userNick from user where userNick='".$rs->fields[0]->value."'";
								$row=$db->myQuery($sql,false);
								if(count($row)){
									$errSum+=1;
									$isExist.="{$errId}、";
								}else{
									$privatePass=md5(time()).mt_rand(10000,99999);
									$password=md5($rs->fields[1]->value.$privatePass);
									$sex=($rs->fields[6]->value=='1' || $rs->fields[6]->value=='男')?1:2;
									$zcDate=!preg_match($zz_date,$rs->fields[13]->value)?'':$rs->fields[13]->value;
									$diYibysj=!preg_match($zz_date,$rs->fields[16]->value)?'':$rs->fields[16]->value;
									$deErbysj=!preg_match($zz_date,$rs->fields[19]->value)?'':$rs->fields[19]->value;
									$outDate=!preg_match($zz_date,$rs->fields[21]->value)?'':$rs->fields[21]->value;
									$pdo->bindValue(":userNick",$rs->fields[0]->value);
									$pdo->bindValue(":privatePass",$privatePass);
									$pdo->bindValue(":password",$password);
									$pdo->bindValue(":comId",$_SESSION['comId']);
									$pdo->bindValue(":branch",$rs->fields[2]->value);
									$pdo->bindValue(":officeId",$rs->fields[3]->value);
									$pdo->bindValue(":station",$rs->fields[4]->value);
									$pdo->bindValue(":rightId",1);
									$pdo->bindValue(":name",$rs->fields[5]->value);
									$pdo->bindValue(":sex",$sex);
									$pdo->bindValue(":jiGuan",$rs->fields[7]->value);
									$pdo->bindValue(":birthday",$rs->fields[8]->value);
									$pdo->bindValue(":telephone",$rs->fields[9]->value);
									$pdo->bindValue(":address",$rs->fields[10]->value);
									$pdo->bindValue(":photo",'');
									$pdo->bindValue(":teChang",$rs->fields[11]->value);
									$pdo->bindValue(":zhiCheng",$rs->fields[12]->value);
									$pdo->bindValue(":zcDate",$zcDate);
									$pdo->bindValue(":diYiXueLi",$rs->fields[14]->value);
									$pdo->bindValue(":diYibyxx",$rs->fields[15]->value);
									$pdo->bindValue(":diYibysj",$diYibysj);
									$pdo->bindValue(":deErXueLi",$rs->fields[17]->value);
									$pdo->bindValue(":deErbyxx",$rs->fields[18]->value);
									$pdo->bindValue(":deErbysj",$deErbysj);
									$pdo->bindValue(":workDate",$rs->fields[20]->value);
									$pdo->bindValue(":outDate",$outDate);
									$pdo->bindValue(":addUser",$_SESSION['userNick']);
									$pdo->bindValue(":ip",$cg['ip']);
									if($pdo->execute()){
										$sucSum+=1;
									}else{
										$isError.="{$errId}、";
										$errSum++;
									}
								}
							}
							$rs->movenext;
						}
					}
					if(!isNull($isExist)){
						$error.="第{$isExist}行的登录账号已经存在，";
					}
					if(!isNull($isMust)){
						$error.="第{$isMust}行的必填数据有错误，";
					}
					if(!isNull($isError)){
						$error.="第{$isError}行的数据有错误";
					}
					$rs->close;
					$db->xlsConn->close;
					unlink($filePath);
				}
			}else{
				$result="文件上传失败，请重试";
			}
		}
	}
	if(isNull($result)){
		echo"本次共上传{$sum}条记录，";
		if(isNull($error)){
			echo"数据已经全部成功导入到数据库中";
		}else{
			echo"但有错误发生：",$error;
		}
	}else{
		echo $result;
	}
	echo'<script type="text/javascript">
	parent.window.document.getElementById("saveAddImportUser").setAttribute("value","导入新职员");
	parent.window.document.getElementById("saveAddImportUser").removeAttribute("disabled");
	</script>';
}else if($action=='displayPowerForUserNick'){
	if(!isset($v) || !preg_match($zz_userNick,$v)){
		exit("账号不正确");
	}else if($v=='admin'){
		exit("无权编辑此用户");
	}else{
		$sql="select * from user where userNick='{$v}'";
		$row=$db->myQuery($sql,false);
		if(count($row)==0){
			echo"未找到指定的职员";
		}else{
			rc_require("powermg.html","personnel");
		}
	}
}else if($action=='savePower'){
	if(!isset($v)){
		$result="提交的数据错误";
	}else{
		$v=trim(preg_replace("/\,{2,}/",",",$v),',');
		if(isNull($v)){
			$result="提交的数据错误";
		}else{
			$v=explode(",",$v);
			foreach($cg_mod as $key=>$m){
				$power='';
				foreach($v as $k=>$value){
					if(is_numeric(stripos($value,$key))){
						$power.=",".str_replace("{$key}_","",$value);
					}
				}
				if(!isNull($power)){
					$power=$power.",";
					$sql="select * from power where userNick='{$userNick}' and operateObj='{$key}'";
					$row=$db->myQuery($sql,false);
					if(count($row)){
						$sql="update power set operate='{$power}' where userNick='{$userNick}' and operateObj='{$key}'";
					}else{
						$sql="insert into power(userNick,comId,operateObj,operate,addUser,ip) value('{$userNick}',{$_SESSION['comId']},'{$key}','{$power}','{$_SESSION['userNick']}','{$cg['ip']}');";
					}
					$result=$db->execSql($sql,false)==false?"保存失败":"已经成功保存";
				}
			}
		}
	}
	return $result;
}else if($action=='dropPower'){
	if(!isset($v) || !is_numeric($v)){
		$result="参数错误";
	}else{
		$sql="update power set operate='' where comId={$_SESSION['comId']} and id={$v}";
		$result=$db->execSql($sql,false);
		if(is_bool($result) && $result===false){
			$result="清空失败，请重试";
		}else{
			$result="已经成功清空";
		}
	}
	echo $result;
}else if($action==='saveAddTongZhi'){
	if(isNull($aCaption) || isNull($aContent)){
		$result="请输入新通知的标题和内容";
	}else{
		$aContent=str_replace(array("\r\n","\r","\n"),"<br />",$aContent);
		$sql="insert into tongzhi(comId,status,caption,content,addUser,ip) values({$_SESSION['comId']},1,'{$aCaption}','{$aContent}','{$_SESSION['userNick']}','{$cg['ip']}');";
		$result=$db->execSql($sql,false)?"保存成功":"保存失败";
	}
	echo $result;
}else if($action==='startTongZhi' || $action==='stopTongZhi'){
	if(!isset($objId) || !is_numeric($objId)){
		$result='参数错误';
	}else{
		$status=$action==='startTongZhi'?1:0;
		$sql="update tongzhi set status={$status} where comId={$_SESSION['comId']} and id={$objId}";
		$result=$db->execSql($sql,false)===true?"保存成功":"保存失败";
	}
	echo $result;
}else if($action==='editTongZhi'){
	if(!isset($objId) || !is_numeric($objId)){
		$result='参数错误';
	}else{
		$sql="select * from tongzhi where comId={$_SESSION['comId']} and id={$objId} limit 1";
		$row=$db->myQuery($sql,false);
		if($row===false || count($row)==0){
			$result="不存在指定的通知";
		}else{
			$row=$row[0];
			$row['content']=str_ireplace("<br />","\r",$row['content']);
			rc_require("edittongzhi.html","personnel");
		}
	}
	echo $result;
}else if($action==='saveEditTongZhi'){
	if(!isset($objId) || !is_numeric($objId)){
		$result="参数错误";
	}else if(isNull($eCaption) || isNull($eContent)){
		$result="请输入编辑后通知的标题和内容";
	}else{
		$eContent=str_replace(array("\r\n","\r","\n"),"<br />",$eContent);
		$sql="update tongzhi set caption='{$eCaption}',content='{$eContent}',addUser='{$_SESSION['userNick']}',ip='{$cg['ip']}' where comId={$_SESSION['comId']} and id={$objId};";
		$result=$db->execSql($sql,false)?"保存成功":"保存失败";
	}
	echo $result;
}else if($action==='showTongZhi'){
	if(!isset($objId) || !is_numeric($objId)){
		$result="参数错误";
	}else{
		$sql="select * from tongzhi where comId={$_SESSION['comId']} and id={$objId} limit 1";
		$row=$db->myQuery($sql,false);
		if($row===false || count($row)==0){
			$result="不存在指定的通知";
		}else{
			$row=$row[0];
			rc_require("showtongzhi.html","personnel");
		}
	}
	echo $result;
}
?>