<?php
include("postget.php");
include_once("common.php");
$pagetitle = _USER_MANAGEMENT_SYSTEM;

checklevel(4, $_REQUEST['clientid']);

if ($config[56][1] == 1) {
    $disabled = " disabled ";
    $mensaje = " " . _CHANGE_NOT_ALLOWED_IN_DEMO_MODE;
} else {
    $disabled = " ";
    $mensaje = "";
}


//////////////////////////////////////////////////////////////// si se envi� el formulario, cargar los errores
if (($_REQUEST[sendclick] == "" . _EDIT . "") OR ($_REQUEST[sendclick] == "" . _ADD . "")) {
    $estiloerror = "class='formfielderror'";
    $errors = '';
    if ($_POST['newname'] == '') {
        $errors.= "<br>" . ucfirst(_USER) . ": " . _NOT_SPECIFIED . "";
        $estiloname = $estiloerror;
    }
    if ($_POST['newacc'] < 2 OR $_POST['newacc'] > 4) {
        $errors.= "<br>" . ucfirst(_ACCESS_LEVEL) . ": " . _NOT_SPECIFIED . "";
        $estilolevel = $estiloerror;
    }
    if ($_REQUEST[sendclick] == "" . _ADD . "" AND $_POST['newpass'] == '') {
        $errors.= "<br>" . ucfirst(_PASSWORD) . ": " . _NOT_SPECIFIED . " ";
        $estilopassword = $estiloerror;
    }
}




if ($errors == '' AND $_REQUEST[sendclick] == "" . _EDIT . "") {
    if ($newacc > $_SESSION['hd_accesslvl']) {
        print("You may not set a user's access level higher than you own.<br>");
        print("User $newname will be set at access level " . $_SESSION['hd_accesslvl'] . "<br>");
        $newacc = $_SESSION['hd_accesslvl'];
    }
    if ($newacc == 4) {
        $newdepid = 0;
    }
    if ($newpass <> '') {
        $newpass = md5($newpass);
        $query = "UPDATE hd_users SET name='$newname',password='$newpass',access='$newacc',depid='$newdepid' WHERE name='$name'";
    } else {
        $query = "UPDATE hd_users SET name='$newname',access='$newacc',depid='$newdepid' WHERE name='$name'";
    }
    if (!mysql_query($query, $db_link)) {
        messagetop(_ERROR, mysql_error(), 'users.php', 0);
    } else {
        messagetop(_THE_CHANGES_WHERE_MADE_SUCCESSFULLY, '', 'users.php', 1);
    }
} else if ($errors == '' AND $_REQUEST[sendclick] == "" . _ADD . "" AND $newname <> '') {

    if ($newacc > $_SESSION['hd_accesslvl']) {
        print("You may not set a user's access level higher than you own.<br>");
        print("User $newname will be set at access level " . $_SESSION['hd_accesslvl'] . "<br>");
        $newacc = $_SESSION['hd_accesslvl'];
    }
    $newpass = md5($newpass);
    if ($newacc == 4) {
        $newdepid = 0;
    }
    $query = "INSERT INTO hd_users (name,password,access,depid) VALUES ('$newname','$newpass','$newacc','$newdepid')";
    if (!mysql_query($query, $db_link)) {
        messagetop(_ERROR, mysql_error(), 'users.php', 0);
    } else {
        messagetop(_THE_CHANGES_WHERE_MADE_SUCCESSFULLY, '', 'users.php', 1);
    }
} else {
    if ($name) {
        $query = "SELECT * FROM hd_users WHERE name='$name'";
        $output = mysql_query($query, $db_link);
        $row = mysql_fetch_array($output);
    }
    include("head_template.php");
    ?>
    <div class="container">
        <div class="row">


            <table class="table table-bordered">
                <tr>
                    <td align="center" width="100%">

    <?php
    print errors($errors);
    $errors = '';
    ?>

                        <form method="POST" class="form-horizontal">
                            <div class="control-group">
                                <label class="control-label"><?php echo lang('_USER'); ?>: </label>
                                <input name=newname size=20 maxlength=20");
                                <?php
                                if ($name) {
                                    print(" value='$row[name]'");
                                }
                                ?>
                                       >
                            </div>
                            <div class="control-group">
                                <label class="control-label"><?php echo lang('_PASSWORD'); ?>: </label>
                                <input name=newpass type=password size=20 maxlength=20>
                            </div>


                            <div class="control-group">
                                <label class="control-label"><?php echo lang('_ACCESS_LEVEL'); ?>: </label>

                                <label>
                                    <select name="newacc">
                                        <option value="2"
                                        <?php
                                        if ($name AND $row[access] == '2') {
                                            print(" selected");
                                        }
                                        ?>
                                                >
                                        <?php echo lang('_STAFF'); ?>
                                        </option>
                                        <option value="4"
                                        <?php
                                        if ($name AND $row[access] == '4') {
                                            print(" selected");
                                        }
                                        ?>
                                                >
    <?php echo lang('_ADMINISTRATOR'); ?>
                                        </option>
                                    </select>
                                </label>
                            </div>

                            <div class="control-group">
                                <label class="control-label"><?php echo lang('_DEPARTMENT'); ?>: </label>

                                <label>
                                    <select name="newdepid">

                                        <?php
                                        $query = "SELECT depid, name FROM hd_tickets_dep ORDER BY name";
                                        $depts = mysql_query($query, $db_link);
                                        print ("<option value='0'>" . ucfirst(_ALL) . "</option>");
                                        while ($deptos = mysql_fetch_array($depts)) {
                                            if ($_POST['newdepid']) {
                                                print ("<option value='" . $deptos[depid] . "' " . sele($_POST['newdepid'], $deptos[depid]) . ">" . $deptos[name] . "</option>");
                                            } else {
                                                print ("<option value='" . $deptos[depid] . "' " . sele($row[depid], $deptos[depid]) . ">" . $deptos[name] . "</option>");
                                            }
                                        };
                                        ?>


                                    </select>
                                </label>
                            </div>



                            <div class="control-group">
                                <br><input type="hidden" name="name" value='<?php echo $name; ?>'>
                                <?php
                                if ($name) {
                                    print("<input type=submit name=sendclick value=" . _EDIT . " $disabled>$mensaje<br>");
                                } else {
                                    print("<input type=submit name=sendclick value=" . _ADD . " $disabled>$mensaje<br>");
                                }
                                ?>
                            </div>
                        </form>
                    </td>
                </tr>
            </table>
        </div>
    </div>
    <?php
}
?>
