<?php 
require_once("incs/processimage.php");
$smarty->assign("heading","Neuen Benutzer einfügen");

$rechte = array(""=>"Bitte wählen","0"=>"Keine","1"=>"Nur ansehen","3"=>"Ansehen und ändern","7"=>"Ansehen, ändern, anlegen und löschen");
$smarty->assign("rechte",$rechte);
$smarty->assign("id",$_GET["id"]);
if($_GET["id"])
{
	if($_GET["block"])
	{
		mysqli_query($dbconn,"UPDATE user SET blocked = NOT blocked WHERE id=".mysql_escape_string($_GET["id"])) or die(error(mysqli_error($dbconn)));
		$finished=1;
	}
	$smarty->assign("heading","Benutzer ändern");
	$smarty->assign("update",1);
}

if($_GET["formsent"])
{
	if(!$_POST["vname"])
		$err=error("Bitte geben Sie einen Vornamen ein!");
	if(!$_POST["nname"])
		$err=error("Bitte geben Sie einen Nachnamen ein!");
	if(!$_POST["nick"])
		$err=error("Bitte geben Sie einen Benutzernamen ein!");
	$qry=mysqli_query($dbconn,"SELECT id FROM user WHERE nick = '".mysql_escape_string($_POST["nick"])."' AND id != '".mysql_escape_string($_GET["id"])."'");
	if(mysqli_num_rows($qry))
		$err=error("Dieser Benutzername ist bereits vergeben!");
	
	if($_GET["id"])
	{
		$qry=mysqli_query($dbconn, "SELECT * FROM user WHERE id = '".mysql_escape_string($_GET["id"])."'");
		if($res=mysqli_fetch_assoc($qry))
		{
			if($_POST["newpw"] || $_POST["newpw2"])
			{
				if($_POST["newpw"] != $_POST["newpw2"])
				{
					$err=error("Das Neue Passwort muss mit der Widerholung übereinstimmen!");
				}
				$newcryptedpw = crypt($_POST["newpw"],$res["salt"]);
				if($_SESSION["rights"] != "777777")
				{
					$cryptedpw = crypt($_POST["pass"],$res["salt"]);
					if($cryptedpw != $res["pass"])
					{
						$err=error("Das alte Passwort ist falsch");
					}
				}
				$changepw=1;
			}
		}
	}
	if(!$err)
	{
		$rights = $_POST["rkunden"].$_POST["rtermine"].$_POST["rrechnungen"].$_POST["rliefer"].$_POST["rrechnungen"].$_POST["radmin"];
		if($_GET["id"])
		{
			$userid=$_GET["id"];
			if($changepw)
				mysqli_query($dbconn,"UPDATE user SET vname='".mysql_escape_string($_POST["vname"])."',
											nname='".mysql_escape_string($_POST["nname"])."',
											nick='".mysql_escape_string($_POST["nick"])."',
											tel_priv='".mysql_escape_string($_POST["telpriv"])."',
											tel_mobil='".mysql_escape_string($_POST["telmob"])."',
											mail='".mysql_escape_string($_POST["mail"])."',
											vname='".mysql_escape_string($_POST["vname"])."',
											rights='".mysql_escape_string($rights)."',
											weekhours='".mysql_escape_string($_POST["weekhours"])."',
											sahours='".mysql_escape_string($_POST["sahours"])."',
											rfid='".mysql_escape_string($_POST["rfid"])."',
											vacationdays='".mysql_escape_string($_POST["vacationdays"])."',
											timelog_start='".mysql_escape_string($_POST["timelog_start"])."',
											pass='".$newcryptedpw."'
											 WHERE id= '".mysql_escape_string($_GET["id"])."'") or $err = error("Fehler in der programmierten Abfrage!<br />".mysqli_error($dbconn));
			else 
				mysqli_query($dbconn,"UPDATE user SET vname='".mysql_escape_string($_POST["vname"])."',
											nname='".mysql_escape_string($_POST["nname"])."',
											nick='".mysql_escape_string($_POST["nick"])."',
											tel_priv='".mysql_escape_string($_POST["telpriv"])."',
											tel_mobil='".mysql_escape_string($_POST["telmob"])."',
											mail='".mysql_escape_string($_POST["mail"])."',
											rights='".mysql_escape_string($rights)."',
											vname='".mysql_escape_string($_POST["vname"])."',
											weekhours='".mysql_escape_string($_POST["weekhours"])."',
											sahours='".mysql_escape_string($_POST["sahours"])."',
											rfid='".mysql_escape_string($_POST["rfid"])."',
											vacationdays='".mysql_escape_string($_POST["vacationdays"])."',
											timelog_start='".mysql_escape_string($_POST["timelog_start"])."'
											 WHERE id= '".mysql_escape_string($_GET["id"])."'") or $err = error("Fehler in der programmierten Abfrage!<br />".mysqli_error($dbconn));
				$finished = 1;
	
		}
		else 
		{
			$userid = createUser($dbconn,$_POST["nick"], $_POST["newpw"], $_POST["vname"], $_POST["nname"], $_POST["mail"], $rights, $_POST["telpriv"], $_POST["telmob"], $_POST["weekhours"], $_POST["sahours"],$_POST["rfid"]);
			$finished = 1;
		}
		if($_FILES['sign']['name'])
		{
			message("Unterschrift wird analysiert...");
			$err = resize_image($_FILES['sign']['tmp_name'],"./".UPLOADS_PATH."signs/$userid.png",300,100);
		}
	}
	$smarty->assign("vname",$_POST["vname"]);
	$smarty->assign("nname",$_POST["nname"]);
	$smarty->assign("mail",$_POST["mail"]);
	$smarty->assign("nick",$_POST["nick"]);
	$smarty->assign("telpriv",$_POST["telpriv"]);
	$smarty->assign("telmob",$_POST["telmob"]);
	$smarty->assign("rkunden",$_POST["rkunden"]);
	$smarty->assign("rtermine",$_POST["rtermine"]);
	$smarty->assign("rangebote",$_POST["rangebote"]);
	$smarty->assign("rliefer",$_POST["rliefer"]);
	$smarty->assign("rrechnungen",$_POST["rrechnungen"]);
	$smarty->assign("radmin",$_POST["radmin"]);
	$smarty->assign("weekhours",$_POST["weekhours"]);
	$smarty->assign("sahours",$_POST["sahours"]);
	$smarty->assign("rfid",$_POST["rfid"]);
	$smarty->assign("vacationdays",$_POST["vacationdays"]);
	$smarty->assign("timelog_start",$_POST["timelog_start"]);
	
}
else if($_GET["id"])
{
	$qry=mysqli_query($dbconn, "SELECT * FROM user WHERE id = '".mysql_escape_string($_GET["id"])."'");
	
	if($res=mysqli_fetch_assoc($qry))
	{
		$smarty->assign("vname",$res["vname"]);
		$smarty->assign("nname",$res["nname"]);
		$smarty->assign("mail",$res["mail"]);
		$smarty->assign("nick",$res["nick"]);
		$smarty->assign("telpriv",$res["tel_priv"]);
		$smarty->assign("telmob",$res["tel_mobil"]);
		$smarty->assign("rkunden",substr($res["rights"],RIGHTS_KUNDEN,1));
		$smarty->assign("rtermine",substr($res["rights"],RIGHTS_TERMINE,1));
		$smarty->assign("rangebote",substr($res["rights"],RIGHTS_ANGEBOTE,1));
		$smarty->assign("rliefer",substr($res["rights"],RIGHTS_LIEFER,1));
		$smarty->assign("rrechnungen",substr($res["rights"],RIGHTS_RECHNUNGEN,1));
		$smarty->assign("radmin",substr($res["rights"],RIGHTS_SUPERADMIN,1));
		$smarty->assign("weekhours",$res["weekhours"]);
		$smarty->assign("sahours",$res["sahours"]);
		$smarty->assign("rfid",$res["rfid"]);
		$smarty->assign("vacationdays",$res["vacationdays"]);
		$smarty->assign("timelog_start",$res["timelog_start"]);
	}	
}

$smarty->display("templates/heading.tpl");
if(!$finished | $err)
	$smarty->display("templates/useradd.tpl");
else 
{
	doneNreturn("Erfolgreich erledigt!");
}
?>