<?php
/*
  osCommerce, Open Source E-Commerce Solutions
  http://www.oscommerce.com

  Implemented by Blake Schwendiman (blake@intechra.net)
	Updated 2002/3/30 -- Ross Lapkoff (rlapkoff@austin.rr.com)

  Copyright (c) 2002 osCommerce

  Released under the GNU General Public License
*/

  require('includes/application_top.php');

  if ($HTTP_GET_VARS['action']) {
    switch ($HTTP_GET_VARS['action']) {
      case 'delete_admin_confirm':
		$admin_id=tep_db_prepare_input($HTTP_GET_VARS['aID']);
        	tep_db_query("delete from " . TABLE_ADMINISTRATORS . " where admin_id = '" . $HTTP_GET_VARS['aID'] . "'");
        	tep_redirect(tep_href_link(FILENAME_ADMINISTRATORS, tep_get_all_get_params(array('aID', 'action'))));
        	break;
	case 'update_admin_confirm':
		$admin_id = tep_db_prepare_input($HTTP_GET_VARS['aID']);
		if (!$HTTP_GET_VARS['aID']){
		header ('Location: administrators.php?action=new_admin&error=aID');
		}
		 if ($login_up =='new') {
		  if (empty($username)) {
		    tep_redirect(tep_href_link('update_admin.php', 'action=new_admin&error=name&aID=' . $HTTP_GET_VARS['aID']));
		    break;
		  } elseif (($password != $confpwd) or ($password == '')) {
		    tep_redirect(tep_href_link('update_admin.php', 'action=new_admin&error=pass&aID=' . $HTTP_GET_VARS['aID']));
		    break;
		    }
			require(DIR_WS_FUNCTIONS . 'misc_funcs.php');
			$crypted_password = crypt_password($password);
			$admin_user_name = tep_db_prepare_input($username);
			$admin_user_pass = tep_db_prepare_input($crypted_password);
			$sql_data_array = array('admin_name' => $admin_user_name,
				                  'admin_pass' => $admin_user_pass);			
		} else {
		  $admin_last_modified = date("Y-m-d H:i:s");
		  $sql_data_array = array('admin_last_modified' => $admin_last_modified);
		}
         if ($adm_type == 'all') {
		$insert_sql_data = array('allowed_pages' => '*');
		$sql_data_array = tep_array_merge($sql_data_array, $insert_sql_data);
          } else {
		 // We need to add "support pages" (index.php, login.php, logoff.php) to ALL accounts 
		 $aAdd = array("support");
		 $all_adm_pages = tep_array_merge($allowed_pages, $aAdd);
		 $aPages = implode('|', $all_adm_pages );
		 $insert_sql_data = array('allowed_pages' => $aPages);
		 $sql_data_array = tep_array_merge($sql_data_array, $insert_sql_data);
		 }
		   tep_db_perform(TABLE_ADMINISTRATORS, $sql_data_array, 'update', "admin_id = '" . $HTTP_GET_VARS['aID'] . "'");
		   tep_redirect(tep_href_link(FILENAME_ADMINISTRATORS));
 		break;
	case 'insert_admin_confirm':
	  	if (empty($username)) {
		  tep_redirect(tep_href_link('administrators.php', 'action=new_admin&error=name'));
		  break;
	      } elseif (($password != $confpwd) or ($password == '')) {
		  tep_redirect(tep_href_link('administrators.php', 'action=new_admin&error=pass'));
		  break;
		}
		  require(DIR_WS_FUNCTIONS . 'misc_funcs.php');
		  $crypted_password = crypt_password($password);
		  $admin_user_name = tep_db_prepare_input($username);
		  $admin_user_pass = tep_db_prepare_input($crypted_password);
		  $admin_date_added = date("Y-m-d");

		$sql_data_array = array('admin_name' => $admin_user_name,
			                  'admin_pass' => $admin_user_pass,
						'admin_date_added' => $admin_date_added,
						'admin_last_modified' => $admin_date_added);
         		if ($adm_type == 'all') {
			  $insert_sql_data = array('allowed_pages' => '*');
			  $sql_data_array = tep_array_merge($sql_data_array, $insert_sql_data);
          		} else {
			 // We need to add "support pages" (index.php, login.php, logoff.php) to ALL accounts 
			 $aAdd = array("support");
			 $all_adm_pages = tep_array_merge($allowed_pages, $aAdd);
			 $aPages = implode('|', $all_adm_pages );
			 $insert_sql_data = array('allowed_pages' => $aPages);
			 $sql_data_array = tep_array_merge($sql_data_array, $insert_sql_data);
			}
		   tep_db_perform(TABLE_ADMINISTRATORS, $sql_data_array, 'insert');
		   tep_redirect(tep_href_link(FILENAME_ADMINISTRATORS, 'aID=' . $HTTP_GET_VARS['aID']));
 		break;
 }
} 
?>
<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN">
<html <?php echo HTML_PARAMS; ?>>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=<?php echo CHARSET; ?>">
<title><?php echo TITLE; ?></title>
<link rel="stylesheet" type="text/css" href="includes/stylesheet.css">
<script language="javascript" src="includes/general.js"></script>
</head>
<body marginwidth="0" marginheight="0" topmargin="0" bottommargin="0" leftmargin="0" rightmargin="0" bgcolor="#FFFFFF" onload="SetFocus();">
<!-- header //-->
<?php require(DIR_WS_INCLUDES . 'header.php'); ?>
<!-- header_eof //-->

<!-- body //-->
<table border="0" width="100%" cellspacing="2" cellpadding="2">
  <tr>
    <td width="<?php echo BOX_WIDTH; ?>" valign="top"><table border="0" width="<?php echo BOX_WIDTH; ?>" cellspacing="1" cellpadding="1" class="columnLeft">
<!-- left_navigation //-->
<?php require(DIR_WS_INCLUDES . 'column_left.php'); ?>
<!-- left_navigation_eof //-->
    </table></td>
<!-- body_text //-->
    <td width="100%" valign="top"><table border="0" width="100%" cellspacing="0" cellpadding="2">
<?php
  if ($HTTP_GET_VARS['error'] == 'name') {
	echo  '<tr><td class="messageStackError">&nbsp;&nbsp;  Name field is empty, please try again.</td></tr>';
	} elseif ($HTTP_GET_VARS['error'] == 'pass') {
	echo  '<tr><td class="messageStackError">&nbsp;&nbsp;  Password field is empty or confirmed password does not match, please try again.</td></tr>';
	}
  if ($HTTP_GET_VARS['action'] == 'new_admin') {
    if ( ($HTTP_GET_VARS['aID']) && (!$HTTP_POST_VARS) ) {
      $admin_query = tep_db_query("select admin_name, admin_date_added, admin_last_modified, allowed_pages from " . TABLE_ADMINISTRATORS . " where admin_id = '" . $HTTP_GET_VARS['aID'] . "'");
      $admin = tep_db_fetch_array($admin_query);

      $aInfo = new objectInfo($admin);
    } elseif ($HTTP_POST_VARS) {
      $aInfo = new objectInfo($HTTP_POST_VARS);
      $admin_name = $HTTP_POST_VARS['admin_name'];
    } else {
      $aInfo = new objectInfo(array());
    }
?>
      <tr>
        <td>
	<table border="0" width="100%" cellspacing="0" cellpadding="0">
      <tr>
        <td width="100%"><table border="0" width="100%" cellspacing="0" cellpadding="0">
          <tr>
            <td class="pageHeading">&nbsp;<?php echo HEADING_TITLE; ?>&nbsp;</td>
          </tr>
        <tr><td>&nbsp;<?php echo tep_draw_separator('pixel_trans.gif', '1', '15'); ?>&nbsp;</td></tr>
        </table></td>
      </tr>
      <tr>
        <td><table border="0" width="100%" cellspacing="0" cellpadding="2">
          <tr>
            <td><?php echo tep_draw_separator(); ?></td>
          <tr>
            <td>
                <table width="100%">
                    <tr><td width="10">&nbsp;</td>
                        <td colspan="2" width="25%" class="infoBoxHeading"><b><font size="2">
				<?php echo TEXT_CURRENT_ADMINISTRATORS;  ?></font></b></td>
                        <td class="infoBoxHeading"><b><font size="2"><?php print(TEXT_ADMIN_HAS_ACCESS_TO); ?></font></b></td>
                    </tr>
                    <?php
                        $admin_query  = tep_db_query('select * from ' . TABLE_ADMINISTRATORS);
                        $aNumRows = tep_db_num_rows($admin_query);
                        if ($aNumRows > 0) {
                            while($aData = tep_db_fetch_array($admin_query)) {
                                $aUserID   = $aData['admin_name'];
                                $aAdminID  = $aData['admin_id'];
                                $aAccessTo = $aData['allowed_pages'];
                                
                                if (trim($aAccessTo) == '*') {
                                    $aTextAccessTo = TEXT_FULL_ACCESS_LIST;
                                } else {
                                    $aTextAccessTo = '';
                                    $aAccessPages = explode('|', $aAccessTo);
                                    foreach($aAccessPages as $aPage) {
                                        $aTextAccessTo .= $aADMBoxes[$aPage] . ', ';
                                    }
                                    $aTextAccessTo = substr($aTextAccessTo, 0, strlen($aTextAccessTo) - 2);
                                }
                                ?>
                                    <tr><td width="10">&nbsp;</td>
                                        <td align="center" class="main"><b><?php echo $aUserID; ?></b></td>
						    <td>&nbsp;</td>
                                        <td class="main"><?php print($aTextAccessTo); ?></td>
                                    </tr>
                                <?php
                            }
                        } else {
                        ?>
                            <tr><td>&nbsp;</td>
                                <td colspan="2" class="main"><?php print(TEXT_NO_CURRENT_ADMINS); ?></td>
                            </tr>
                        <?php
                        }
                    ?>
                </table>
            </td>
          </tr>
          <tr><td>
                <table>
                   <form method="post" action="<?php echo tep_href_link('administrators.php', 'action=insert_admin_confirm');?>">
                    <tr><td width="10">&nbsp;</td>
                        <td colspan="2" class="infoBoxHeading"><font size="2"><b><?php print(TEXT_ADD_ADMINISTRATOR); ?></font></b></td>
                    </tr>
                    <tr><td width="10">&nbsp;</td>
                        <td class="infoBoxHeading" valign="top">
                            <table>
                    <tr><td class="main"><?php print(TEXT_ADMINISTRATOR_USERNAME); ?></td>
                        <td><input type="text" name="username" maxlength="20"></td>
                    </tr>
                    <tr><td class="main"><?php print(TEXT_ADMINISTRATOR_PASSWORD); ?></td>
                        <td><input type="password" name="password" maxlength="20"></td>
                    </tr>
             	  <tr><td class="main"><?php print(TEXT_ADMINISTRATOR_CONFPWD); ?></td>
                        <td><input type="password" name="confpwd" maxlength="20"></td>
                    </tr>
                        </table>
                      </td>
                        <td valign="top">
                            <table>
                                <tr><td class="messageStackError"><input type="checkbox" name="adm_type" value="all"><?php print(TEXT_FULL_ACCESS); ?></td>
                                </tr>
					  <tr><td colspan="2"><?php echo tep_draw_separator(); ?></td></tr>
                                <tr><td class="main"><br>
					  <select name="allowed_pages[]" size="<?php print( count( $aADMBoxes ) ); ?>" multiple align="left">
                                        <?php
                                            foreach($aADMBoxes as $aKey => $aValue) 
							  print( "<option value=\"$aKey\">$aValue</option>" );
                                        ?>
                                        </select>
                                <p>To select specific areas that you want to grant access to, hold down CTRL and click each one.  If you want to give the
					  administrator full access to all files, check the box above instead.
						</td>
					  </tr>
                            </table>
                        </td>
                    </tr>
                    <tr><td width="10">&nbsp;</td>
                        <td colspan="2" class="infoBoxHeading">
				<?php echo '&nbsp;' . tep_image_submit('button_insert.gif', 'Update') . ' <a href="' . tep_href_link(FILENAME_ADMINISTRATORS) . '">' . tep_image_button('button_cancel.gif', IMAGE_CANCEL) . '</a>'; ?>
			  </form>
                   </tr>
                </table>
            </td>
          </tr>
        </table>
<?php
   } else {
?>
      <tr>
        <td><table border="0" width="100%" cellspacing="0" cellpadding="0">
          <tr>
            <td class="pageHeading"><?php echo HEADING_TITLE; ?></td>
            <td class="pageHeading" align="right"><?php echo tep_draw_separator('pixel_trans.gif', 1, HEADING_IMAGE_HEIGHT); ?></td>
          </tr>
        </table></td>
      </tr>
      <tr>
        <td><table border="0" width="100%" cellspacing="0" cellpadding="0">
          <tr><td valign="top"><table border="0" width="100%" cellspacing="0" cellpadding="2">
              <tr class="dataTableHeadingRow">
                <td class="dataTableHeadingContent"><?php echo TABLE_HEADING_ADMIN; ?></td>
                <td class="dataTableHeadingContent" align="center"><?php echo TABLE_HEADING_PRIV; ?></td>
                <td class="dataTableHeadingContent" align="right"><?php echo TABLE_HEADING_ACTION; ?>&nbsp;</td>
              </tr>
<?php
		$admins_count = 0;
    $rows = 0;
		 $admin_query = tep_db_query("select admin_id, admin_name, allowed_pages, admin_date_added, admin_last_modified from " . TABLE_ADMINISTRATORS . " order by admin_id");
		 while($admin = tep_db_fetch_array($admin_query))
		 {
if (($admin['admin_id'] == '1') && ($admin['admin_name'] == 'default')){
 echo '<tr><td colspan="3" class="messageStackError">Default administrator still exists.  Create a new full-access admin and delete the pre-installed administrator.</td></tr>';
}	
     $admins_count++;
     $rows++;
				 
	if (((!$HTTP_GET_VARS['aID']) || (@$HTTP_GET_VARS['aID'] == $admin['admin_id'])) && (!$aInfo)) {
	$aInfo = new objectInfo($admin);
	}
      if ( (is_object($aInfo)) && ($admin['admin_id'] == $aInfo->admin_id) ) {
        echo '              <tr class="dataTableRowSelected" onmouseover="this.style.cursor=\'hand\'" onclick="document.location.href=\'' . tep_href_link(FILENAME_ADMINISTRATORS, tep_get_all_get_params(array('aID')) . 'aID=' . $aInfo->admin_id) . '\'">' . "\n";
      } else {
        echo '              <tr class="dataTableRow" onmouseover="this.className=\'dataTableRowOver\';this.style.cursor=\'hand\'" onmouseout="this.className=\'dataTableRow\'" onclick="document.location.href=\'' .  tep_href_link(FILENAME_ADMINISTRATORS, tep_get_all_get_params(array('aID')) . 'aID=' . $admin['admin_id']) . '\'">' . "\n";
      }
?>
 <td class="dataTableContent"><?php echo '<a href="' . tep_href_link(FILENAME_ADMINISTRATORS, 'aID=' . $aInfo->admin_id) . '">' . $admin['admin_name'] . '</a>&nbsp;'; ?></td>
                <td class="dataTableContent" align="center">
<?php
      if ($admin['allowed_pages'] == '*') {
        echo 'Full Access';
      } else {
        echo 'Partial Access';
      } 
?></td>
  <td class="dataTableContent" align="right"><?php if ( (is_object($aInfo)) && ($admin['admin_id'] == $aInfo->admin_id) ) { echo tep_image(DIR_WS_IMAGES . 'icon_arrow_right.gif', ''); } else { echo '<a href="' . tep_href_link(FILENAME_ADMINISTRATORS, tep_get_all_get_params(array('aID')) . 'aID=' . $admin['admin_id']) . '">' . tep_image(DIR_WS_IMAGES . 'icon_info.gif', IMAGE_ICON_INFO) . '</a>'; } ?>&nbsp;</td>
  </tr>												
<?php
}
?>
           <tr><td colspan="3"><table border="0" width="100%" cellspacing="0" cellpadding="2">
               <tr><td class="smallText"><?php echo TEXT_TOTAL_ADMINS . '&nbsp;' . $admins_count; ?></td>
                   <td align="right" class="smallText"><?php if (!$HTTP_GET_VARS['search']) echo '</a>&nbsp;<a href="' . tep_href_link(FILENAME_ADMINISTRATORS, 'action=new_admin') . '">' . tep_image_button('button_new_admin.gif', 'New Admin') . '</a>'; ?>&nbsp;</td>
               </tr>
               </table></td>
              </tr>
            </table></td>
<?php
    $heading = array();
    $contents = array();
    switch ($HTTP_GET_VARS['action']) {
      case 'delete_admin':
        $heading[] = array('text' => '<center><b>' . TEXT_INFO_HEADING_DELETE_ADMIN . '</b></center>');
        $contents = array('form' => tep_draw_form('admin', FILENAME_ADMINISTRATORS, 'aID=' . $aInfo->admin_id . '&action=delete_admin_confirm'));
        $contents[] = array('text' => '<center>' . TEXT_DELETE_ADMIN . '</center>');
        $contents[] = array('text' => '<center><br><b>' . tep_get_admin_name($aInfo->admin_id) . '</b></center>');
				$contents[] = array('align' => 'center', 'text' => '<br>' . tep_image_submit('button_delete.gif', IMAGE_DELETE) . ' <a href="' . tep_href_link(FILENAME_ADMINISTRATORS, tep_get_all_get_params(array('aID', 'action')) . 'aID=' . $aInfo->admin_id) . '">' . tep_image_button('button_cancel.gif', IMAGE_CANCEL) . '</a>');
        break;
      default:
	  if (is_object($aInfo))  { 
          $heading[] = array('text' => '<center><b>' . tep_get_admin_name($aInfo->admin_id) . '</b></center>');
          $contents[] = array('align' => 'center', 'text' => '<a href="' . tep_href_link(FILENAME_UPDATE_ADMIN, 'aID=' . $aInfo->admin_id) . '">' . tep_image_button('button_edit.gif', IMAGE_EDIT) . '</a> <a href="' . tep_href_link(FILENAME_ADMINISTRATORS, tep_get_all_get_params(array('aID', 'action')) . 'aID=' . $aInfo->admin_id . '&action=delete_admin') . '">' . tep_image_button('button_delete.gif', IMAGE_DELETE) . '</a>');
	    $contents[] = array('aling' => 'center', 'text' => '<b>Has access to:</b>');
          $aAccessTo = $aInfo->allowed_pages;
		if ($aAccessTo == '*'){ $aTextAccessTo = 'Everything!'; }
		else {
               $aAccessPages = explode('|', $aAccessTo);
               foreach($aAccessPages as $aPage) {
            $aTextAccessTo .= '&nbsp;&nbsp; ' . $aADMBoxes[$aPage] . '<BR>';
		}
            $aTextAccessTo = substr($aTextAccessTo, 0, strlen($aTextAccessTo) - 2);
			}
		$contents[] = array('text' => $aTextAccessTo);
            $contents[] = array('text' => '<BR>' . TEXT_DATE_ADDED . ' ' . tep_date_short($aInfo->admin_date_added));
            if (tep_not_null($aInfo->admin_last_modified)) $contents[] = array('text' => TEXT_LAST_MODIFIED . ' ' . tep_date_short($aInfo->admin_last_modified));
          }
        break;
     }

    if ( (tep_not_null($heading)) && (tep_not_null($contents)) ) {
      echo '            <td width="25%" valign="top">' . "\n";
      $box = new box;
      echo $box->infoBox($heading, $contents);
      echo '            </td>' . "\n";
    }
?>
          </tr>
        </table></td>
      </tr>
<?php
  } 
?>
    </table></td>
<!-- body_text_eof //-->
  </tr>
</table>
<!-- body_eof //-->

<!-- footer //-->
<?php require(DIR_WS_INCLUDES . 'footer.php'); ?>
<!-- footer_eof //-->
<br>
</body>
</html>
<?php require(DIR_WS_INCLUDES . 'application_bottom.php'); ?>