<?php
if($admin->isAdmin('admin', 'ladmin') == true) {
	if($_POST['name']) {
		$name = mysql_real_escape_string($_POST['name']);
		$sql = "DELETE FROM ".DBTABLEPREFIX."users WHERE username = '{$name}' LIMIT 1";
		$query = $admin->db_query($sql) or die($admin->message('error', 'MySQL Error', mysql_error()));
		echo $admin->message('success', "User \"{$name}\" Deleted", "Let's hope that wasn't an accident...");
		exit();
	}
	else {
		if($_POST) {
			$error = false;
			$sql = "SELECT * FROM ".DBTABLEPREFIX."users WHERE username = '".mysql_real_escape_string($_POST['username'])."'";
			$query = $admin->db_query($sql) or die(mysql_error());
			$num_rows = mysql_num_rows($query);
			if($num_rows != 0) {
				$output .= $admin->message('error', 'That username already exists!', "Try to think of another one.");
				$error = true;
			}
			if($_POST['username'] == ""){
				$output .= $admin->message('error', 'Please put something in for the username.', "It isn't that hard, so just fix it now.");
				$error = true;
			}
			if($_POST['password'] != $_POST['confirm_password']) {
				$output .= $admin->message('error', 'Passwords don\'t match!', "Sorry but the passwords don't match. You typed {$_POST['password']} and {$_POST['confirm_password']} Try again!");
				$error = true;
			}
			if(validEmail($_POST['email']) == false) {
				$output .= $admin->message('error', "Hey! That isn't a real email!", "Sorry but you didn't put in a valid email. Please fix it.");
				$error = true;
			}
			if($error == false) {
				foreach($_POST as $key => $value) {
					$_POST[$key] = mysql_real_escape_string($value);
				}
				$sql = "INSERT into ".DBTABLEPREFIX."users (username, password, level, email) VALUES ('".$_POST['username']."','".sha1($_POST['password'])."','".$_POST['level']."','".$_POST['email']."')";
				$query = $admin->db_query($sql) or die(mysql_error());
				$output .= $admin->message('success', 'Woohoo! Your user "'.$_POST["username"].'" was added!', "He/She can now log in!");			
				if(!$query) {
					$output .= $admin->message('warning', 'An unknown error has occured', "An unknown error has occured");			
				}
			}
			if($error == true) {
				$output .= $admin->message('message', "Don't Forget!", "Set your permissions level again!");
			}
					$output .= "
				<form action='?page=user-management&add=user' method='post'>
					<fieldset>
						<h2>New User</h2>
						<div class='form-row'>
							<label for='username' class='username'>Username:</label><span><input type='text' class='username' id='username' name='username' value='{$_POST['username']}' /></span>
						</div>		
						<div class='form-row'>
							<label for='password' class='password'>Password:</label><span><input type='password' class='password' name='password' /></span>
						</div>		
						<div class='form-row'>
							<label for='confirm_password' class='confirm_password'>Password (confirm):</label><span><input type='password' class='confirm_password' name='confirm_password' /></span>
						</div>		
						<div class='form-row'>
							<label for='email' class='email'>Email Address:</label><span><input type='text' class='email' name='email' value='{$_POST['email']}' /></span>
						</div>		
						<div class='form-row'>
							<label for='level' class='level'>Permissions Level:</label><span>
							<select name='level'>
								<option value='user'>User (Can't access User management or Settings)</option>
								<option value='manager'>Manager (Can't access Settings)</option>
								<option value='ladmin'>Low-Level Admin (Can't access User management)</option>
								<option value='admin'>Admin (Can do anything)</option>
							</select>
							</span>
						</div>		
						<div class='form-row form-row-last'>
							<label for='add_user' >Save:</label><span><input type='submit' value='Add User' name='add_user' class='button' /></span>
						</div>
					<fieldset>
				</form>
				";
		}
		else {
		$output .= "
			<form action='?page=user-management&add=user' method='post'>
				<fieldset>
					<h2>New User</h2>
					<div class='form-row'>
						<label for='username' class='username'>Username:</label><span><input type='text' id='username' class='username' name='username' /></span>
					</div>		
					<div class='form-row'>
						<label for='password' class='password'>Password:</label><span><input type='password' class='password' name='password' /></span>
					</div>		
					<div class='form-row'>
						<label for='confirm_password' class='confirm_password'>Password (confirm):</label><span><input type='password' class='confirm_password' name='confirm_password' /></span>
					</div>		
					<div class='form-row'>
						<label for='email' class='email'>Email Address:</label><span><input type='text' class='email' name='email' /></span>
					</div>		
					<div class='form-row'>
						<label for='level' class='level'>Permissions Level:</label><span>
						<select name='level'>
							<option value='user'>User (Can't access User management or Settings)</option>
							<option value='manager'>Manager (Can't access Settings)</option>
							<option value='ladmin'>Low-Level Admin (Can't access User management)</option>
							<option value='admin'>Admin (Can do anything)</option>
						</select>
						</span>
					</div>		
					<div class='form-row form-row-last'>
						<label for='add_user' >Save:</label><span><input type='submit' value='Add User' name='add_user' class='button' /></span>
					</div>
				</fieldset>
			</form>
			";
		}
	}
	$table .= "\n
	<div class='right disable-warnings'>Disable warnings when deleting users? <input type='checkbox' id='disable-warnings-checkbox' class='checkbox'/></div>
	<table cellspacing='0' border='0' id='users' cellpadding='0'>\n\t<thead>\n\t\t<tr>\n\t\t\t<th>Username</th><th>Email</th><th>Level</th><th>Actions</th>\n\t\t</tr>\n\t<tbody>";
	$sql = "SELECT * FROM ".DBTABLEPREFIX."users";
	$query = $admin->db_query($sql) or die(mysql_error());
	while($row = mysql_fetch_array($query)) {
		$table .= "\n\t\t<tr><td class='username'>{$row['username']}</td><td>{$row['email']}</td><td>{$row['level']}</td><td><a href='javascript:;' class='delete-user'><img src='".THEME_URL."includes/admin/images/icons/delete-16x16.png' alt='Delete' style='display:block;width:16px;margin:auto;' /></a></td></tr>";
	}
	$table .= "</tbody></table>";

}
else {
	$output .= $admin->message('error', "You don't have sufficent permissions.", "You need to be an Admin or a Manager to access this page.");
}

$admin->page_info['content']['page_title'] = "User Management";
$admin->page_info['content']['page_content']	= $table.$output;
//Display page
include(BASE_URL.'includes/admin/admin.php');

?>