<?php

  /*

      details.php

      User's Details. Allow the user to change certain personal details.
      [Commented]

      Changelog:
        2006-01-14 dave: Cleaned up code for v1.0 release
        2005-07-03 arne_sf: Replaced all instances of column name 'user'
          for table tbl_UserDomains with 'userid'
        2005-07-03 arne_sf: Replaced all instances of column name 'user'
          for table tbl_EmailConfirmation with 'userid'

      ----

      Copyright (C) 2003  Central Manchester CLC
      Copyright (C) 2003  David Thorne (davethorne@gmail.com)

      This program is free software; you can redistribute it and/or
      modify it under the terms of the GNU General Public License
      as published by the Free Software Foundation version 2.

      This program is distributed in the hope that it will be useful,
      but WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      GNU General Public License for more details.

      You should have received a copy of the GNU General Public License
      along with this program; if not, write to the Free Software
      Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.

  */

  // Start session and populate it with data
  session_start();
  
  // Page security
  if ($_SESSION['_usertype'] == '' || $_SESSION['_restricted'] == '1') {
    require_once 'system/security.php';
    ThrowOut();
  }

  // Includes
  require_once 'system/db.php';
  require_once 'system/lang.php';
  require_once 'system/message.php';
  require_once 'system/user_preferences.php';

  // Language selection
  set_text_domain("details");

  // Retrieve Get/Post variables
  $act = $_REQUEST['act'];
  $name = $_POST['name'];
  $email = $_POST['email'];
  $password = $_POST['password'];
  $password1 = $_POST['password1'];
  $password2 = $_POST['password2'];
  $defaultdomain = $_POST['defaultdomain'];
  $user_prefs = get_user_prefs($_SESSION['_id']);

  // Action: change any details that were amended
  if ($act == 'action') {
    $act = '';
    // Check for errors
    if ($name == '') {
      $message = gettext('CORRECTION: You must give yourself a name.');
    } elseif ($password != '' && $password1 != $password2) {
      $message = gettext('CORRECTION: The two new password fields do not match.');
    } elseif ($password != '' && $password1 == '') {
      $message = gettext('CORRECTION: You must give yourself a password.');
    } else {
      // Retrieve this user's encrypted password
      if ($password != '') {
        $pass = db_recordset("SELECT pass FROM tbl_Users WHERE id=$_SESSION[_id]");
      }
      
      // Is the entered password correct?
      if ($password != '' && $pass[0][pass] != md5($password)) {
        $message = gettext('ERROR: Incorrect password.');
      } else {
        // Update values
        $sql = "UPDATE tbl_Users SET name='$name'";
        if ($password != '') {
          $sql .= ",pass='" . md5($password1) . "'";
        }
        $sql .= " WHERE id=$_SESSION[_id]";
        db_send($sql);
        $_SESSION['_name'] = $name;

        // Has email address changed?
        $oldmail = db_recordset("SELECT email FROM tbl_Users WHERE id=$_SESSION[_id]");
        $oldmail = $oldmail[0]['email'];
        if ($oldmail != $email) {
          if ($user_prefs['verify-email'] == 'true') {
            // if so, sort out email confirmation
            mt_srand ((double) microtime() * 1000000);
            $hash = md5($email . mt_rand());

            require_once 'system/mail.php';

            send_mail('verify', $user_prefs['language'],
              $email ,-1,$_SESSION['_name'],$hash);

            // And add the hash information to the database
            db_send("INSERT INTO tbl_EmailConfirmation
                     (email, hash, userid, date)
                     VALUES ('$email', '$hash', {$_SESSION['_id']}, ".mktime().")");
          } else {
            // Email verification is off - change email address immediately
            db_send("UPDATE tbl_Users SET email='$email'
                     WHERE `id`={$_SESSION['_id']}");
            $_SESSION['_email'] = $email;
          }
        }

        // Set default domain if appropriate
        if ($defaultdomain <> '') {
          db_send("UPDATE tbl_UserDomains SET defaultflag=0 WHERE userid=$_SESSION[_id]");
          db_send("UPDATE tbl_UserDomains SET defaultflag=1 WHERE userid=$_SESSION[_id] AND domain=$defaultdomain");
        }

        if ($oldmail != $email && $user_prefs['verify-email'] == 'true') {
          // Take user to a page for them to enter in the hash.
          header("Location: verifyemail.php");
        } else {
          $message = gettext('NOTE: Details successfully updated.');
        }
      }
    }
  }

  // Default Action: Request search details
  if ($act == '') {
    // Page title
    $ptitle = 'Details';
    
    // Included here to allow redirect header() command to be executed above.
    require 'header.php';
    
    // Language selection
    set_text_domain("details");
  
    if ($message) { display(gettext($message)); }
?>

  <h1><?php echo gettext("My Details")?></h1>
  <h2><?php echo gettext("Here you can set up your details.")?></h2>
  
  <div class="block">
    <form name="mainform" id="mainform" method="post" action="">
      <input type="hidden" name="act" value="action" />
      <div class="labelfieldpair">
        <div class="name"><label for="site"><?php echo gettext("Name")?></label></div>
        <div class="field"><input type="text" name="name" id="name" size="35" maxlength="50" value="<?php echo $_SESSION['_name']?>" /></div>
      </div>
      <div class="labelfieldpair">
        <div class="name"><?php echo gettext("Username")?>:</div>
        <div class="value"><?php echo $_SESSION['_username']?></div>
      </div>
      <div class="labelfieldpair">
        <div class="name"><label for="email"><?php echo gettext("Email")?></label></div>
        <div class="field"><input type="text" name="email" id="email" size="35" maxlength="50" value="<?php echo $_SESSION['_email']?>" /></div>
      </div>
      <div class="labelfieldpair">
        <div class="name"><label for="password"><?php echo gettext("Old Password")?></label></div>
        <div class="field"><input type="password" name="password" id="password" size="20" maxlength="20" value="" /></div>
      </div>
      <div class="labelfieldpair">
        <div class="name"><label for="password1"><?php echo gettext("New Password")?></label></div>
        <div class="field"><input type="password" name="password1" id="password1" size="20" maxlength="20" value="" /></div>
      </div>
      <div class="labelfieldpair">
        <div class="name"><label for="password2"><?php echo gettext("Retype")?></label></div>
        <div class="field"><input type="password" name="password2" id="password2" size="20" maxlength="20" value="" /></div>
      </div>
<?php
    if ($_SESSION['_usertype'] != 'Root') {
      $sql = "SELECT DISTINCT tbl_UserDomains.domain AS domain,
              tbl_Domains.domain AS domainname,
              tbl_UserDomains.defaultflag
              FROM tbl_UserDomains,tbl_Domains
              WHERE tbl_UserDomains.userid=$_SESSION[_id]
              AND tbl_UserDomains.domain = tbl_Domains.id";
      $domainsRS = db_recordset($sql);
      if (count($domainsRS) > 1) {
?>
      <div class="labelfieldpair">
        <div class="name"><label for="defaultdomain"><?php echo gettext("Default Domain")?></label></div>
        <div class="field"><select name="defaultdomain" id="defaultdomain">
<?php
        foreach ($domainsRS as $record) {
          if ($record[defaultflag] == 1) {$checked = " selected=\"selected\"";} else {$checked = "";};
          print "          <option value=\"${record[domain]}\"$checked>${record[domainname]}</option>";
        }
?>
        </select></div>
      </div>
<?php
      }
    }
?>
      <div class="buttonpanel">
        <input name="submit" type="submit" id="submit" value="<?php echo gettext("Commit Changes")?>" />
        <input name="reset" type="reset" id="reset" value="<?php echo gettext("Reset")?>" />
      </div>
    </form>
  </div>

<?php
  }

  // Include
  require 'footer.php';
?>
