<?PHP

/* ====================
Seditio - Website engine
Copyright Neocrome & Seditio Team
https://seditio.org
[BEGIN_SED]
File=users.php
Version=179
Updated=2022-jul-15
Type=Core
Author=Seditio Team
Description=Users
[END_SED]
==================== */

if (!defined('SED_CODE')) { die('Wrong URL.'); }

$y = sed_import('y','P','TXT');
$id = sed_import('id','G','INT');
$s = sed_import('s','G','ALP',13);
$w = sed_import('w','G','ALP',4);
$d = sed_import('d','G','INT');
$f = sed_import('f','G','TXT');
$g = sed_import('g','G','INT');

list($usr['auth_read'], $usr['auth_write'], $usr['isadmin']) = sed_auth('users', 'a');
sed_block($usr['isadmin']);

/* === Hook === */
$extp = sed_getextplugins('users.edit.first');
if (is_array($extp))
	{ foreach($extp as $k => $pl) { include(SED_ROOT . '/plugins/'.$pl['pl_code'].'/'.$pl['pl_file'].'.php'); } }
/* ===== */

// ---------- Extra fields - getting
$extrafields = array(); 
$extrafields = sed_extrafield_get('users');  
$number_of_extrafields = count($extrafields);	
// ----------------------	

$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_id='$id' LIMIT 1");
sed_die(sed_sql_numrows($sql) == 0);
$urr = sed_sql_fetchassoc($sql);

$sql1 = sed_sql_query("SELECT gru_groupid FROM $db_groups_users WHERE gru_userid = '$id' and gru_groupid = '5'");
$sys['edited_istopadmin'] = (sed_sql_numrows($sql1) > 0) ? TRUE : FALSE;
$sys['user_istopadmin'] = sed_auth('admin', 'a', 'A');
$sys['protecttopadmin'] = $sys['edited_istopadmin'] && !$sys['user_istopadmin'];

if ($sys['protecttopadmin'])
	{
	sed_redirect(sed_url("message", "msg=930", "", true));
	exit;
	}

if ($a=='update')
	{
	sed_check_xg();

	/* === Hook === */
	$extp = sed_getextplugins('users.edit.update.first');
	if (is_array($extp))
		{ foreach($extp as $k => $pl) { include(SED_ROOT . '/plugins/'.$pl['pl_code'].'/'.$pl['pl_file'].'.php'); } }
	/* ===== */

	$rusername = sed_import('rusername','P','TXT');
  
	$ruserfirstname = sed_import('ruserfirstname','P','TXT', 100, TRUE);   // sed 177
	$ruserlastname = sed_import('ruserlastname','P','TXT', 100, TRUE);     // sed 177  
  
	$rusermaingrp = sed_import('rusermaingrp','P','INT');
	$ruserbanexpire = sed_import('ruserbanexpire','P','INT');
	$rusercountry = sed_import('rusercountry','P','ALP');
	$ruseravatar = sed_import('ruseravatar','P','TXT');
	$ruserphoto = sed_import('ruserphoto','P','TXT');
	$rusersignature = sed_import('rusersignature','P','TXT');
	$rusertext = sed_import('rusertext','P','HTM');
	$ruseremail = sed_import('ruseremail','P','TXT');
	$ruserhideemail = sed_import('ruserhideemail','P','INT');
	$ruserpmnotify = sed_import('ruserpmnotify','P','INT');
	$ruserskin = sed_import('ruserskin','P','TXT');
	$ruserlang = sed_import('ruserlang','P','ALP');
	$ruserwebsite = sed_import('ruserwebsite','P','TXT');
	$ruserskype = sed_import('ruserskype','P','TXT');
	$rusergender = sed_import('rusergender','P','TXT');
	$ryear = sed_import('ryear','P','INT');
	$rmonth = sed_import('rmonth','P','INT');
	$rday = sed_import('rday','P','INT');
	$rhour = sed_import('rhour','P','INT');
	$rminute = sed_import('rminute','P','INT');
	$rusertimezone = sed_import('rusertimezone','P','TXT');
	$ruserlocation = sed_import('ruserlocation','P','TXT');
	$ruseroccupation = sed_import('ruseroccupation','P','TXT');
	$ruserdelete = sed_import('ruserdelete','P','BOL');
	$ruserdelpfs = sed_import('ruserdelpfs','P','BOL');
	$rusernewpass = sed_import('rusernewpass','P','TXT', 16);
	$rusergroupsms = sed_import('rusergroupsms', 'P', 'ARR');
	
	// --------- Extra fields     
	if ($number_of_extrafields > 0) $ruserextrafields = sed_extrafield_buildvar($extrafields, 'ruser', 'user');    
	// ----------------------	

	$error_string .= (mb_strlen($rusername) < 2 || mb_strpos($rusername, ",") !== FALSE || mb_strpos($rusername, "'") !== FALSE) ? $L['aut_usernametooshort']."<br />" : '';
	$error_string .= (!empty($rusernewpass) && (mb_strlen($rusernewpass) < 4 || sed_alphaonly($rusernewpass)!=$rusernewpass)) ? $L['aut_passwordtooshort']."<br />" : '';

	if ($ruserdelete)
		{
		if ($sys['user_istopadmin'] && !$sys['edited_istopadmin'])
			{
			$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_id='$id'");

			if ($row = sed_sql_fetchassoc($sql))
				{
				if ($cfg['trash_user'])
					{ sed_trash_put('user', $L['User']." #".$id." ".$row['user_name'], $id, $row); }
				$sql = sed_sql_query("DELETE FROM $db_users WHERE user_id='$id'");
				$sql = sed_sql_query("DELETE FROM $db_groups_users WHERE gru_userid='$id'");
				if ($ruserdelpfs) { sed_pfs_deleteall($id); }
				sed_log("Deleted user #".$id,'adm');
				sed_redirect(sed_url("message", "msg=109&rc=200&id=".$id, "", true));
				exit;
			   }
			}
		else
			{
			sed_redirect(sed_url("message", "msg=930", "", true));
			exit;
			}
		}

	if (empty($error_string))
		{
		if (mb_strlen($rusernewpass)>0) 
		  {
			$rusermdsalt = sed_unique(16); // New sed172          		        
			$ruserpassword = sed_hash($rusernewpass, 1, $rusermdsalt);
			$ruserpasstype = 1;		
			} 
		else 
		  {
			$ruserpassword = $urr['user_password'];
			$rusermdsalt = $urr['user_salt'];
			$ruserpasstype = $urr['user_passtype'];
		  }

		if ($rusername=='')
			{ $rusername = $urr['user_name']; }
		if ($ruserhideemail=='')
			{ $ruserhideemail = $urr['user_hideemail']; }
		if ($ruserpmnotify=='')
			{ $ruserpmnotify = $urr['user_pmnotify']; }

		$ruserbirthdate = ($rmonth == 0 || $rday == 0 || $ryear == 0) ? 0 : sed_mktime(1, 0, 0, $rmonth, $rday, $ryear);

	   	if (!isset($ruserbanned))
	   		{ $rbanexpire = 0; }
		elseif ($ruserbanned && $rbanexpire > 0)
			{ $rbanexpire += $sys['now']; }

		if ($rusername != $urr['user_name'])
			{
			$oldname = sed_sql_prep($urr['user_name']);
			$newname = sed_sql_prep($rusername);
			$sql = sed_sql_query("UPDATE $db_forum_topics SET ft_lastpostername='$newname' WHERE ft_lastpostername='$oldname'");
			$sql = sed_sql_query("UPDATE $db_forum_topics SET ft_firstpostername='$newname' WHERE ft_firstpostername='$oldname'");
			$sql = sed_sql_query("UPDATE $db_forum_posts SET fp_postername='$newname' WHERE fp_postername='$oldname'");
			$sql = sed_sql_query("UPDATE $db_pages SET page_author='$newname' WHERE page_author='$oldname'");
			$sql = sed_sql_query("UPDATE $db_com SET com_author='$newname' WHERE com_author='$oldname'");
			$sql = sed_sql_query("UPDATE $db_online SET online_name='$newname' WHERE online_name='$oldname'");
			$sql = sed_sql_query("UPDATE $db_pm SET pm_fromuser='$newname' WHERE pm_fromuser='$oldname'");
			}
			
		// autogeneration avatar from letter sed v178		
		if (empty($urr['user_avatar']))
			{
			$gen_avatar = sed_autogen_avatar($urr['user_id']);
			$ruseravatar = ($gen_avatar['status']) ? $gen_avatar['imagepath'] : $ruseravatar;
			}
			
		// ------ Extra fields 
		$ssql_extra = '';
		if(count($extrafields) > 0) 
			{ 
			foreach($extrafields as $i => $row) 
				{ 
				$ssql_extra .= ", user_".$row['code']." = "."'".sed_sql_prep($ruserextrafields['user_'.$row['code']])."'"; 
				} 
			} 
		// ----------------------			
			
		$sql = sed_sql_query("UPDATE $db_users SET
			user_banexpire='$rbanexpire',
			user_name='".sed_sql_prep($rusername)."',
			user_firstname='".sed_sql_prep($ruserfirstname)."', 
			user_lastname='".sed_sql_prep($ruserlastname)."',            
			user_password='".sed_sql_prep($ruserpassword)."',
			user_salt='".sed_sql_prep($rusermdsalt)."',
			user_passtype =".(int)$ruserpasstype.",
			user_country='".sed_sql_prep($rusercountry)."',
			user_text='".sed_sql_prep($rusertext)."',
			user_avatar='".sed_sql_prep($ruseravatar)."',
			user_signature='".sed_sql_prep($rusersignature)."',
			user_photo='".sed_sql_prep($ruserphoto)."',
			user_email='".sed_sql_prep($ruseremail)."',
			user_hideemail='$ruserhideemail',
			user_pmnotify='$ruserpmnotify',
			user_skin='".sed_sql_prep($ruserskin)."',
			user_lang='".sed_sql_prep($ruserlang)."',
			user_website='".sed_sql_prep($ruserwebsite)."',
			user_skype='".sed_sql_prep($ruserskype)."',
			user_gender='".sed_sql_prep($rusergender)."',
			user_birthdate='".sed_sql_prep($ruserbirthdate)."',
			user_timezone='".sed_sql_prep($rusertimezone)."',
			user_location='".sed_sql_prep($ruserlocation)."',
			user_occupation='".sed_sql_prep($ruseroccupation)."',
			user_auth=''".$ssql_extra." 
			WHERE user_id='$id'");

		if ($sys['user_istopadmin'])
			{
			$rusermaingrp = ($rusermaingrp < 4 && $id == 1) ? 5 : $rusermaingrp;

			if (!isset($rusergroupsms[$rusermaingrp]))
				{ $rusergroupsms[$rusermaingrp] = 1; }

			$sql = sed_sql_query("UPDATE $db_users SET user_maingrp='$rusermaingrp' WHERE user_id='$id'");

			foreach($sed_groups as $k => $i)
				{
				if (isset($rusergroupsms[$k]))
					{
					$sql = sed_sql_query("SELECT gru_userid FROM $db_groups_users WHERE gru_userid='$id' AND gru_groupid='$k'");
					if (sed_sql_numrows($sql) == 0 && !(($id == 1 && $k == 3) || ($id == 1 && $k == 2)))
						{ $sql = sed_sql_query("INSERT INTO $db_groups_users (gru_userid, gru_groupid) VALUES (".(int)$id.", ".(int)$k.")"); }
					}
				elseif (!($id == 1 && $k == 5))
					{ $sql = sed_sql_query("DELETE FROM $db_groups_users WHERE gru_userid='$id' AND gru_groupid='$k'"); }
				}

			if ($rusermaingrp == 4 && $urr['user_maingrp'] == 2)
				{
				$rsubject = $cfg['maintitle']." - ".$L['useed_accountactivated'];
				$rbody = $L['Hi']." ".$urr['user_name'].",\n\n";
				$rbody .= $L['useed_email'];
				$rbody .= $L['auth_contactadmin'];
				sed_mail($urr['user_email'], $rsubject, $rbody);
				}
			}
			
		// autogeneration avatar from letter sed v178
		if (empty($ruseravatar))
			{
			sed_autogen_avatar($id);
			}
		
		/* === Hook === */
		$extp = sed_getextplugins('users.edit.update.done');
		if (is_array($extp))
			{ foreach($extp as $k => $pl) { include(SED_ROOT . '/plugins/'.$pl['pl_code'].'/'.$pl['pl_file'].'.php'); } }
		/* ===== */

		sed_auth_clear($id);
		sed_log("Edited user #".$id,'adm');
		sed_redirect(sed_url("users", "m=edit&id=".$id, "", true));
		exit;
		}
	}

$user_form_pmnotify =  sed_radiobox("ruserpmnotify", $yesno_arr, $urr['user_pmnotify']);
$user_form_hideemail =  sed_radiobox("ruserhideemail", $yesno_arr, $urr['user_hideemail']);
$user_form_delete =  ($sys['user_istopadmin']) ? sed_radiobox("ruserdelete", $yesno_arr, 0)."<br />+ ".$L['PFS'].":".sed_checkbox('ruserdelpfs') : $L['na']; 

$user_form_pass = $sys['protecttopadmin'] ? sed_textbox("rusernewpass", "", 16, 32, "password", true, "password") : sed_textbox("rusernewpass", "", 16, 32, "password", false, "password");
$user_form_username = $sys['protecttopadmin'] ? sed_textbox("rusername", $urr['user_name'], 24, 100, "text", true) : sed_textbox("rusername", $urr['user_name'], 24, 100);

$user_form_countries = sed_selectbox_countries($urr['user_country'], 'rusercountry');
$user_form_gender = sed_selectbox_gender($urr['user_gender'], 'rusergender');
$user_form_birthdate = sed_selectbox_date($urr['user_birthdate'], 'short');
$urr['user_lastip'] = sed_build_ipsearch($urr['user_lastip']);

$out['subtitle'] = sed_cc($urr['user_name']);
$title_tags[] = array('{MAINTITLE}', '{TITLE}', '{SUBTITLE}');
$title_tags[] = array('%1$s', '%2$s', '%3$s');
$title_data = array($cfg['maintitle'], $out['subtitle'], $cfg['subtitle']);
$out['subtitle'] = sed_title('userstitle', $title_tags, $title_data);

// ---------- Breadcrumbs
$urlpaths[sed_url("users")] = $L['Users'];
$urlpaths[sed_url("users", "m=details&id=".$urr['user_id'])] = sed_cc($urr['user_name']);
$urlpaths[sed_url("users", "m=edit&id=".$urr['user_id'])] = $L['Edit'];	

/* === Hook === */
$extp = sed_getextplugins('users.edit.main');
if (is_array($extp))
	{ foreach($extp as $k => $pl) { include(SED_ROOT . '/plugins/'.$pl['pl_code'].'/'.$pl['pl_file'].'.php'); } }
/* ===== */

require(SED_ROOT . "/system/header.php");

$mskin = sed_skinfile(array('users', 'edit', $usr['maingrp']));
$t = new XTemplate($mskin);

if (!empty($error_string))
	{
	$t->assign("USERS_EDIT_ERROR_BODY",$error_string);
	$t->parse("MAIN.USERS_EDIT_ERROR");
	}

$t->assign(array(
	"USERS_EDIT_SHORTTITLE" => $urr['user_name']." ".$L['Edit'],
	"USERS_EDIT_TITLE" => "<a href=\"".sed_url("users")."\">".$L['Users']."</a> ".$cfg['separator']." ".sed_build_user($urr['user_id'], sed_cc($urr['user_name']))." ".$cfg['separator']." <a href=\"".sed_url("users", "m=edit&id=".$urr['user_id'])."\">".$L['Edit']."</a>",
	"USERS_EDIT_SUBTITLE" => $L['useed_subtitle'],
	"USERS_EDIT_BREADCRUMBS" => sed_breadcrumbs($urlpaths),
	"USERS_EDIT_SEND" => sed_url("users", "m=edit&a=update&".sed_xg()."&id=".$urr['user_id']),
	"USERS_EDIT_ID" => $urr['user_id'],
	"USERS_EDIT_NAME" => $user_form_username,
	"USERS_EDIT_FIRSTNAME" => sed_textbox('ruserfirstname', $urr['user_firstname'], 32, 100), 
	"USERS_EDIT_LASTNAME" => sed_textbox('ruserlastname', $urr['user_lastname'], 32, 100),     
	"USERS_EDIT_SKIN" => sed_textbox('ruserskin', $urr['user_skin'], 16, 32),
	"USERS_EDIT_LANG" => sed_textbox('ruserlang', $urr['user_lang'], 16, 32),
	"USERS_EDIT_NEWPASS" => $user_form_pass,
	"USERS_EDIT_MAINGRP" => sed_build_group($urr['user_maingrp']),
	"USERS_EDIT_GROUPS" => sed_build_groupsms($urr['user_id'], $sys['user_istopadmin'], $urr['user_maingrp']),
	"USERS_EDIT_COUNTRY" => $user_form_countries,
	"USERS_EDIT_EMAIL" => sed_textbox('ruseremail', $urr['user_email'], 32, 64),
	"USERS_EDIT_HIDEEMAIL" => $user_form_hideemail,
	"USERS_EDIT_PMNOTIFY" => $user_form_pmnotify,
	"USERS_EDIT_TEXT" => sed_textarea("rusertext", $urr['user_text'], 8, $cfg['textarea_default_width']),
	"USERS_EDIT_AVATAR" => sed_textbox('ruseravatar', $urr['user_avatar'], 32, 255),
	"USERS_EDIT_PHOTO" => sed_textbox('ruserphoto', $urr['user_photo'], 32, 255),
	"USERS_EDIT_SIGNATURE" => sed_textbox('rusersignature', $urr['user_signature'], 32, 255),
	"USERS_EDIT_WEBSITE" => sed_textbox('ruserwebsite', $urr['user_website'], 56, 128),
	"USERS_EDIT_SKYPE" => sed_textbox('ruserskype', $urr['user_skype'], 32, 64),
	"USERS_EDIT_GENDER" => $user_form_gender,
	"USERS_EDIT_BIRTHDATE" => $user_form_birthdate,
	"USERS_EDIT_TIMEZONE" => sed_textbox('rusertimezone', $urr['user_timezone'], 16, 16),
	"USERS_EDIT_LOCATION" => sed_textbox('ruserlocation', $urr['user_location'], 32, 64),
	"USERS_EDIT_OCCUPATION" => sed_textbox('ruseroccupation', $urr['user_occupation'], 32, 64),
	"USERS_EDIT_REGDATE" => sed_build_date($cfg['dateformat'], $urr['user_regdate'])." ".$usr['timetext'],
	"USERS_EDIT_LASTLOG" => sed_build_date($cfg['dateformat'], $urr['user_lastlog'])." ".$usr['timetext'],
	"USERS_EDIT_LOGCOUNT" => $urr['user_logcount'],
	"USERS_EDIT_LASTIP" => $urr['user_lastip'],
	"USERS_EDIT_DELETE" => $user_form_delete,
));

// Extra fields 
if(count($extrafields)>0) 
	{ 
	$extra_array = sed_build_extrafields('user', 'USERS_EDIT', $extrafields, $urr, 'ruser');
	$t->assign($extra_array); 
	} 

/* === Hook === */
$extp = sed_getextplugins('users.edit.tags');
if (is_array($extp))
	{ foreach($extp as $k => $pl) { include(SED_ROOT . '/plugins/'.$pl['pl_code'].'/'.$pl['pl_file'].'.php'); } }
/* ===== */


$t->parse("MAIN");
$t->out("MAIN");

require(SED_ROOT . "/system/footer.php");

?>