<?php
/************************************************************************/
/* Maximus CMS: Web Portal System                                       */
/* ==============================                                       */
/*                                                                      */
/* Copyright (c) 2002 - 2007                                            */
/* http://www.php-maximus.org                                           */
/* dev@php-maximus.org                                                  */
/*                                                                      */
/* This program is free software. You can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 2 of the License.       */
/************************************************************************/
/* Based on PHP-NUKE: Web Portal System                                 */
/************************************************************************/
/* Portage Coppermine Photo Gallery                                     */
/************************************************************************/
defined('MAXIMUS') or require_once("mainfile.php");

$pagetitle = "- Coppermine";

define('IN_COPPERMINE', true);
define('PROFILE_PHP', true);

switch($func) {
default:
incoh();


require('modules/Coppermine/include/init.inc.php');

$edit_profile_form_param = array(
	array('text', 'username', $lang_register_php['username']),
	array('text', 'group', $lang_register_php['group']),
	array('text', 'disk_usage', $lang_register_php['disk_usage'])
);

$display_profile_form_param = array(
	array('text', 'username', $lang_register_php['username']),
	array('text', 'group', $lang_register_php['group'])
);

$change_password_form_param = array(
	array('password', 'current_pass', $lang_register_php['current_pass'], 25),
	array('password', 'new_pass', $lang_register_php['new_pass'], 25),
	array('password', 'new_pass_again', $lang_register_php['new_pass_again'], 25),
);

function make_form($form_param, $form_data)
{
	global $CONFIG, $lang_register_php;

	foreach ($form_param as $element) switch($element[0]) {
		case 'label' :
		echo <<<EOT
	<tr>
    	<td colspan="2" class="tableh2">
			<b>{$element[1]}<b>
        </td>
	</tr>

EOT;
		break;

		case 'text' :
		echo <<<EOT
	<tr>
    	<td width="40%" class="tableb" height="25">
			{$element[2]}
        </td>
        <td width="60%" class="tableb">
			{$form_data[$element[1]]}
        </td>
	</tr>

EOT;

		break;
		case 'input' :
	    $value = $form_data[$element[1]];

		echo <<<EOT
	<tr>
    	<td width="40%" class="tableb"  height="25">
			{$element[2]}
        </td>
        <td width="60%" class="tableb" valign="top">
        	<input type="text" style="width: 100%" name="{$element[1]}" maxlength="{$element[3]}" value="$value" class="textinput" />
		</td>
	</tr>

EOT;
		break;

		case 'password' :
		echo <<<EOT
	<tr>
    	<td width="40%" class="tableb">
			{$element[2]}
        </td>
        <td width="60%" class="tableb" valign="top">
        	<input type="password" style="width: 100%" name="{$element[1]}" maxlength="{$element[3]}" value="" class="textinput" />
		</td>
	</tr>

EOT;
		break;

    	default:
			cpg_die(CRITICAL_ERROR, 'Invalid action for form creation '.$element[0], __FILE__, __LINE__);
	}
}

function get_post_var($var)
{
	global $lang_errors;

	if(!isset($_POST[$var])) cpg_die(CRITICAL_ERROR, $lang_errors['param_missing']." ($var)", __FILE__, __LINE__);
	return addslashes(trim($_POST[$var]));
}

$op2 = isset($_GET['op2']) ? $_GET['op2'] : '';
$uid = isset($_GET['uid']) ? (int)$_GET['uid'] : -1;
if(isset($_POST['change_pass'])) $op2 = 'change_pass';

if (isset($_POST['change_profile']) && USER_ID) {

	$location   = get_post_var('location');
	$interests  = get_post_var('interests');
	$website    = get_post_var('website');
	$occupation = get_post_var('occupation');

	$sql = "UPDATE `".TABLE_USERS."` SET ".
		   "`user_from` = '$location', ".
		   "`user_interests` = '$interests', ".
		   "`user_website` = '$website', ".
		   "`user_occ` = '$occupation' ".
		   "WHERE `user_id` = '".USER_ID."'";

	$result = $GLOBALS['db']->sql_query($sql);

	$title = sprintf($lang_register_php['x_s_profile'], username);
	$redirect = "modules.php?name=Coppermine";
	pageheader($title,"<meta http-equiv=\"refresh\" content=\"3;url=$redirect\">");
	msg_box($lang_info,$lang_register_php['update_success'], $lang_continue, $redirect);
	pagefooter();
	ob_end_flush();
	exit;
}

if (isset($_POST['change_password']) && USER_ID) {

	$current_pass   = get_post_var('current_pass');
	$new_pass       = get_post_var('new_pass');
	$new_pass_again = get_post_var('new_pass_again');

	if(strlen($new_pass) < 2) cpg_die(ERROR, $lang_register_php['err_password_short'], __FILE__, __LINE__);
	if($new_pass != $new_pass_again) cpg_die(ERROR, $lang_register_php['err_password_mismatch'], __FILE__, __LINE__);

	$sql = "UPDATE `".TABLE_USERS."` SET ".
		   "`user_password` = '$new_pass' ".
		   "WHERE `user_id` = '".USER_ID."' AND BINARY `user_password` = '$current_pass'";

	$result = $GLOBALS['db']->sql_query($sql);
	if (!mysql_affected_rows()) cpg_die(ERROR, $lang_register_php['pass_chg_error'], __FILE__, __LINE__);

	@setcookie($CONFIG['cookie_name'].'_pass', md5($HTTP_POST_VARS['new_pass']), time()+86400, $CONFIG['cookie_path']);

	$title = sprintf($lang_register_php['x_s_profile'], username);
	$redirect = $PHP_SELF."?op2=edit_profile";
	pageheader($title,"<meta http-equiv=\"refresh\" content=\"3;url=$redirect\">");
	msg_box($lang_info,$lang_register_php['pass_chg_success'], $lang_continue, $redirect);
	pagefooter();
	ob_end_flush();
	exit;
}

switch($op2){
	case 'edit_profile' :
	if(!USER_ID) cpg_die(ERROR, $lang_errors['access_denied'], __FILE__, __LINE__);

	$sql =  "SELECT username, user_email, UNIX_TIMESTAMP(user_regdate) as user_regdate_cp, group_name, ".
			"user_from, user_interests, user_website, user_occ, ".
			"COUNT(pid) as pic_count, ROUND(SUM(total_filesize)/1024) as disk_usage, group_quota ".
			"FROM `".TABLE_USERS."` AS u ".
			"INNER JOIN `".TABLE_CPG_USERGROUPS."` AS g ON user_group_cp = group_id ".
			"LEFT JOIN `".TABLE_CPG_ALBUMS."` AS a ON category = ".FIRST_USER_CAT." + user_id ".
			"LEFT JOIN `".TABLE_CPG_PICTURES."` AS p ON p.aid = a.aid ".
			"WHERE `user_id` ='".USER_ID."' ".
			"GROUP BY `user_id` ";

	$result = $GLOBALS['db']->sql_query($sql);

	if(!$GLOBALS['db']->sql_numrows($result)) cpg_die(ERROR, $lang_register_php['err_unk_user'], __FILE__, __LINE__);
	$user_data = $GLOBALS['db']->sql_fetchrow($result);
	$GLOBALS['db']->sql_free($result);

	$form_data = array(
		'username' => $user_data['username'],
		'reg_date' => localised_date($user_data['user_regdate_cp'], $register_date_fmt),
		'group' => $user_data['group_name'],
		'email' => $user_data['user_email'],
		'disk_usage' => $user_data['disk_usage'].
						($user_data['group_quota'] ? '/'.$user_data['group_quota'] : '').
						' '.$lang_byte_units[1],
		'location' => $user_data['user_from'],
		'interests' => $user_data['user_interests'],
		'website' => $user_data['user_website'],
		'occupation' => $user_data['user_occ'],
	);

	$title = sprintf($lang_register_php['x_s_profile'], username);
	pageheader($title);
	starttable(-1, $title, 2);
	echo <<<EOT
	<form method="post" action="$PHP_SELF">

EOT;
	make_form($edit_profile_form_param, $form_data);
	echo <<<EOT

	</form>

EOT;
	endtable();
	pagefooter();
	ob_end_flush();
	break;

	case 'change_pass' :
	if(!USER_ID) cpg_die(ERROR, $lang_errors['access_denied'], __FILE__, __LINE__);

	$title = $lang_register_php['change_pass'];
	pageheader($title);
	starttable(-1, $title, 2);
	echo <<<EOT
	<form method="post" action="$PHP_SELF">

EOT;
	make_form($change_password_form_param, '');
	echo <<<EOT
	<tr>
		<td colspan="2" align="center" class="tablef">
			<input type="submit" name="change_password" value="$title" class="button" />
		</td>
	</tr>
	</form>

EOT;
	endtable();
	pagefooter();
	ob_end_flush();
	break;


	default :
	$sql =  "SELECT username, user_email, UNIX_TIMESTAMP(user_regdate_cp) as user_regdate_cp, group_name, ".
			"user_from, user_interests, user_website, user_occ ".
			"FROM `".TABLE_USERS."` AS u ".
			"INNER JOIN `".TABLE_CPG_USERGROUPS."` AS g ON user_group_cp = group_id ".
			"WHERE `user_id` ='".intval( $uid ) ."' ";

	$result = $GLOBALS['db']->sql_query($sql);

	if(!$GLOBALS['db']->sql_numrows($result)) cpg_die(ERROR, $lang_register_php['err_unk_user'], __FILE__, __LINE__);
	$user_data = $GLOBALS['db']->sql_fetchrow($result);
	$GLOBALS['db']->sql_free($result);

	$form_data = array(
		'username' => $user_data['username'],
		'reg_date' => localised_date($user_data['user_regdate_cp'], $register_date_fmt),
		'group' => $user_data['group_name'],
		'location' => $user_data['user_from'],
		'interests' => $user_data['user_interests'],
		'website' => make_clickable($user_data['user_website']),
		'occupation' => $user_data['user_occ'],
	);

	$title = sprintf($lang_register_php['x_s_profile'], $user_data['username']);
	pageheader($title);
	starttable(-1, $title, 2);
	make_form($display_profile_form_param, $form_data);
	endtable();
	pagefooter();
	ob_end_flush();
	break;
}
incof();
break;
}