<?php

session_start(); // début de session

function ManageUser($user) {
	global $sql_query;
	$error = "";
	$login = "";
	$pass = "";
	$nom = "";
	$prenom = "";
	$email = "";
	$privilege = "";
	if (isset($_POST['login']))
	{
		$login = addslashes($_POST['login']);
		if (@$_GET['action']=="new") { $pass = addslashes(md5($_POST['pass'])); }
		$nom = addslashes($_POST['nom']);
		$prenom = addslashes($_POST['prenom']);
		$email = addslashes($_POST['email']);
		$privilege = addslashes($_POST['privilege']);
		if ($login=="" or $nom=="" or $prenom=="")
		{	$error = "Un des champ est vide"; }
		else
		{	
			if (@$_GET['action']=="edit") {
				$result = mysql_query( $sql_query="UPDATE oxg_users SET login='$login', nom='$nom', prenom='$prenom', email='$email', privilege='$privilege' WHERE ID='$user'" ) or mysql_die();
				if ($result)
					{echo "<BR><BR><center>Les modifications ont été effectuées avec succès</center><BR><BR><BR>";}
				else
					{echo "<BR><BR><center>Echec lors de la tentative de mise à jour</center><BR><BR><BR>";}
				echo "<a href='§user_admin.php'>"."Retour au menu d'administration"."</a>";
				return;
			}
			else
			{
			if (@$_GET['action']=="new") {
				$result = mysql_query( $sql_query="INSERT INTO oxg_users (login,password,nom,prenom,email,privilege) VALUES ('$login','$pass','$nom','$prenom','$email','$privilege')" ) or mysql_die();
				if ($result)
					{echo "<BR><BR><center>La création a été effectuée avec succès</center><BR><BR><BR>";}
				else
					{echo "<BR><BR><center>Echec lors de la tentative de création</center><BR><BR><BR>";}
				echo "<a href='§user_admin.php'>"."Retour au menu d'administration"."</a>";
				return;
			}
			return;
			}
		}
	}
	if (@$_GET['action']=="edit")
	{
		$verif_query=sprintf("SELECT * FROM oxg_users WHERE ID=$user");
		$verif = mysql_query($sql_query=$verif_query) or mysql_die();
		$row_verif = mysql_fetch_assoc($verif);
		$login = $row_verif['login']; // Son Login
		$nom = $row_verif['nom']; // Son nom
		$prenom = $row_verif['prenom']; // Son Prénom
		$email = $row_verif['email']; // Son email
		$privilege = $row_verif['privilege']; // Son privilege
		echo "<BR><center>Edition du compte \"".$login."\" (".$prenom." ".$nom.")</center><BR><BR>";
	}
	else
	{
		echo "<BR><center>Création d'un nouveau compte</center><BR><BR>";
	}
	echo "<form action='' method='post' name='valid'>";
	echo "<table width='300'  border='0' align='center' cellpadding='10' cellspacing='0' bgcolor='#eeeeee' class='tableaux'";
	echo "<tr><td width='50%'><div align='right'>"."Login"."</div></td>";
	echo "<td width='50%'><input name='login' type='text' value='$login'></td></tr>";
	if (@$_GET['action']=="new") {
		echo "<tr><td width='50%'><div align='right'>"."mot de passe"."</div></td>";
		echo "<td width='50%'><input name='pass' type='password' value='$pass'></td></tr>";
		}
	echo "<tr><td width='50%'><div align='right'>"."Nom"."</div></td>";
	echo "<td width='50%'><input name='nom' type='text' value='$nom'></td></tr>";
	echo "<tr><td width='50%'><div align='right'>"."Prénom"."</div></td>";
	echo "<td width='50%'><input name='prenom' type='text' value='$prenom'></td></tr>";
	echo "<tr><td width='50%'><div align='right'>"."Email"."</div></td>";
	echo "<td width='50%'><input name='email' type='text' value='$email'></td></tr>";
	echo "<tr><td width='50%'><div align='right'>"."Privilège"."</div></td>";
	echo "<td width='50%'>";
	if ($privilege=="admin") {echo "<select name=privilege><OPTION value='admin'>admin</OPTION><OPTION value='user'>user</OPTION></select></td></tr>";}
	else {echo "<select name=privilege><OPTION value='user'>user</OPTION><OPTION value='admin'>admin</OPTION></select></td></tr>";}
	echo "<tr><td height='34' colspan='2'><div align='center'><input type='submit' name='submit' value=".decode_lng_text('PRIVATE_ENTER')."></td></tr>";
	echo "</div></table></form>";
	if ($error=="") {echo "<BR><BR>";}
	echo "<center><B><I>$error</I></B></center>";
}

function ChangePassword($user) {
	global $sql_query;
	$error="";
	if (isset($_POST['pass1']) or isset($_POST['pass2']))
	{	
		$pass1 = addslashes($_POST['pass1']);
		$pass2 = addslashes($_POST['pass2']);
		if ($pass1=="" and $pass2=="") {$error = "Il faut saisir quelque chose";}
			else { if ($pass1=="" or $pass2=="") {$error = "La saisie est incomplète";}
				else { if ($pass1!=$pass2) {$error = "La validation n'est pas correcte";}
					else
					{
						$pass1 = md5($pass1);
						$result = mysql_query( $sql_query="UPDATE oxg_users SET password='$pass1' WHERE ID='$user'" ) or mysql_die();
						if ($result)
							{echo "<BR><BR><center>Le changement de mot de passe a été effectué avec succès</center><BR><BR><BR>";}
						else
							{echo "<BR><BR><center>Echec lors de la tentative de mise à jour du mot de passe</center><BR><BR><BR>";}
						echo "<a href='§user_admin.php'>"."Retour au menu d'administration"."</a>";
						return;
						}
					}
				}
	}
		$verif_query=sprintf("SELECT * FROM oxg_users WHERE ID=$user");
		$verif = mysql_query($sql_query=$verif_query) or mysql_die();
		if ($row_verif = mysql_fetch_assoc($verif))
		{
			$nom = $row_verif['nom']; // Son nom
			$prenom = $row_verif['prenom']; // Son Prénom
			$login = $row_verif['login']; // Son Login
			echo "<BR><center>Entrer un nouveau mot de passe du compte \"".$login."\" (".$prenom." ".$nom.")</center><BR><BR>";
			echo "<form action='' method='post' name='connect'>";
			echo "<table width='300'  border='0' align='center' cellpadding='10' cellspacing='0' bgcolor='#eeeeee' class='tableaux'";
			echo "<tr><td width='50%'><div align='right'>".decode_lng_text('PRIVATE_PASSWORD')."</div></td>";
			echo "<td width='50%'><input name='pass1' type='password' id='pass1'></td></tr>";
			echo "<tr><td width='50%'><div align='right'>"."Validation"."</div></td>";
			echo "<td width='50%'><input name='pass2' type='password' id='pass2'></td></tr>";
			echo "<tr><td height='34' colspan='2'><div align='center'><input type='submit' name='submit' value=".decode_lng_text('PRIVATE_ENTER')."></td></tr>";
			echo "</div></table></form>";
			if ($error=="") {echo "<BR><BR>";}
			echo "<center><B><I>$error</I></B></center>";
		}
		else
		{
			echo "Error : Nom de compte inconnu<BR>";
			echo "<a href='§user_admin.php'>"."Retour au menu d'administration"."</a>";
		}
}

function DeleteUser($user) {
	global $sql_query;
	$verif_query=sprintf("SELECT * FROM oxg_users WHERE ID=$user");
	$verif = mysql_query($sql_query=$verif_query) or mysql_die();
	$row_verif = mysql_fetch_assoc($verif);
	$login = $row_verif['login']; // Son Login
	$pass = $row_verif['password']; // Son Login
	$nom = $row_verif['nom']; // Son nom
	$prenom = $row_verif['prenom']; // Son Prénom
	$result = mysql_query( $sql_query="DELETE FROM oxg_users WHERE ID='$user'" ) or mysql_die();
	if ($result)
		{echo "<BR><BR><center>La suppression du compte \"".$login."\" (".$prenom." ".$nom.") a été effectuée avec succès</center><BR><BR><BR>";}
	else
		{echo "<BR><BR><center>Echec lors de la tentative de suppression du compte \"".$login."\" (".$prenom." ".$nom.")</center><BR><BR><BR>";}
	echo "<a href='§user_admin.php'>"."Retour au menu d'administration"."</a>";
	return;
}

$sPage="Administration";
require("admin/§lib_inc.php");
	
// recup variable du formulaire
$user = @$_GET['user'];
$action = @$_GET['action'];

$FAMILY=isset($_REQUEST["FAMILY"])?$_REQUEST["FAMILY"] : -1; 

$nb_msg_par_page = @$_GET['nb_msg_par_page'];

flush();
	
//Vérification si accès zone privée et privilège=admin
if(isset($_SESSION['privilege']) and $_SESSION['privilege']=="admin")
{
	//$sTitle = decode_lng_text("STATS_ARTICLE")." $nbre ".decode_lng_text("STATS_TOP15_PATRO");
	$sTitle = "Administration";
	require("§menu.php");


	if (($user!="" and $action!="" ) or ($action=="new"))
	{
		if ($action=="edit" ) {ManageUser($user);}
		if ($action=="pass" ) {ChangePassword($user);}
		if ($action=="new" ) {ManageUser($user);}
		if ($action=="delete" ) {DeleteUser($user);}
	}
	else
	{
		$message = "";
		if ($user!="" and $action=="" ) {$message = "Error: il faut sélectionner une action";}
		if ($user=="" and $action!="new" ) {$message = "Error: il faut sélectionner un utilisateur";}
		echo "<CENTER><TABLE border=1><TR bgcolor=lightblue align=left>";
		echo "<CENTER><TABLE border=1><TR bgcolor=lightblue align=left>";
		echo "<TD>choix</TD>";
		echo "<TD>user</TD>";
		echo "<TD>firstname</TD>";
		echo "<TD>lastname</TD>";
		echo "<TD>email</TD>";
		echo "<TD>role</TD>";
		echo "</TR></CENTER>";
		echo "<form action=\"\" method=get>";
		$result = mysql_query($sql_query="select * from oxg_users where 1=1 ORDER BY privilege, nom asc") or mysql_die();
		while ($row = mysql_fetch_array($result))
		{
			echo "<TR bgcolor=white align=left>";
			echo "<TD><CENTER><input type=radio name=user value=\"$row[ID]\"></CENTER></TD>";
			echo "<TD>".$row['login']."</TD>";
			echo "<TD>".$row['nom']."</TD>";
			echo "<TD>".$row['prenom']."</TD>";
			echo "<TD>".$row['email']."</TD>";
			echo "<TD>".$row['privilege']."</TD>";
			echo "</TR>";
		}
		echo "</TABLE></CENTER>";
		echo "<div id=panel>";
		echo "<br/>";
		echo "<br/>";
		//echo "<form action=\"\" method=get>";
		//echo "<input type=hidden name=FAMILY value=\"$FAMILY\">";
		echo "<center>";
		echo "<table border=1><tr><td>";
		echo "Edition user<input type=radio name=action value=edit></td>\n";
		echo "<td>Changement mot de passe<input type=radio name=action value=pass></td>\n";
		echo "<td>Nouveau user<input type=radio name=action value=new></td>\n";
		echo "<td>Suppression user<input type=radio name=action value=delete></td>\n";
		echo "<td><input type=submit value=".decode_lng_text('PRIVATE_ENTER')."></td></tr></table></form>";
		echo "</center>";
		echo "<center><B><I>".$message."</I></B></center>";		
		echo "</div>";
	}

	//@mysql_close($dbh);
}
else
{
	//display_lng_text('PRIVATE_ERROR');
	$url = str_replace ("&", "*", $_SERVER['REQUEST_URI']);
	header("Location: §private.php?erreur=intru&URL=".$url);
}
	
echo "<div id=footer>";
affiche_pied_page(true);
echo "</div>";

?>