<?php
/**
* FILE_NAME : privilege.php
*
* @copyright Copyright (c) www.shuangyulin.com
* @author 双鱼林
* @package 管理员信息以及权限管理程序
* @subpackage
* @version QQ:287307421 或 254540457
*/

define('IN_WEB', TRUE);

session_start();

require_once( str_replace('\\', '/', dirname(__FILE__)). '/include/global.php');
//require(dirname(__FILE__) . '\includes\global.php');

/* act操作项的初始化 */
if (empty($_REQUEST['act'])) {
    $_REQUEST['act'] = 'login';
} else {
    $_REQUEST['act'] = trim($_REQUEST['act']);
}

/*------------------------------------------------------ */
//-- 退出登录
/*------------------------------------------------------ */
if ($_REQUEST['act'] == 'logout')
{
    /* 清除cookie */
    setcookie('WEB[admin_id]',   '', 1);
    setcookie('WEB[admin_pass]', '', 1);

    unset_admin_session();

    $_REQUEST['act'] = 'login';
}

/*------------------------------------------------------ */
//-- 登陆界面
/*------------------------------------------------------ */
if ($_REQUEST['act'] == 'login')
{
    header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
    header("Cache-Control: no-cache, must-revalidate");
    header("Pragma: no-cache");

	$smarty->assign("web_url",$web_url);
	$smarty->assign("css_root",$css_root);
	
   
    $smarty->display('login.tpl');
}

/*------------------------------------------------------ */
//-- 验证登陆信息
/*------------------------------------------------------ */
elseif ($_REQUEST['act'] == 'signin')
{
    if (!empty($_SESSION['code_word'])) {
        include_once(WEB_ROOT . 'include/code.php');

        /* 检查验证码是否正确 */
        $validator = new captcha();
        if (!empty($_POST['login_code']) && !$validator->check_word($_POST['login_code']))
        {
            showmsg("验证码不正确，请准确填写","privilege.php?act=login");
        }
        if (empty($_POST['login_code'])) {
        	showmsg("请填写验证码","privilege.php?act=login");
        }
        
    }

    $_POST['username'] = isset($_POST['username']) ? trim($_POST['username']) : '';
    $_POST['password'] = isset($_POST['password']) ? trim($_POST['password']) : '';

    /* 检查密码是否正确 */
    $sql = "SELECT id, adminname, password, ip, lastlogin FROM  {$dbprefix}admin
            WHERE adminname = '" . $_POST['username']. "' AND password = '" . md5($_POST['password']) . "'";
    $row = $DB->fetch_one_array($sql);

    if ($row)
    {
            // 登录成功
        set_admin_session($row['id'], $row['adminname'], $row['password'], $row['lastlogin']);

        if(empty($row['lastlogin']))
        {
        	/* 这里可以写一些第一次登录要做的事情，比如：设置一个变量，记录是第一次登录
        	 * 进入后台之后判断这个变量的值，可以进行一些操作
        	 */
            
        }

        // 更新最后登录时间和IP
       $DB->query("UPDATE {$dbprefix}admin SET ip= '".getonlineip()."',lastlogin='".$timestamp."' WHERE id='$_SESSION[admin_id]'");

        showmsg("登录成功，页面在2秒后跳转","index.php");
    }
    else
    {
        showmsg("用户名或密码不正确，请重新输入","privilege.php?act=login");
    }
}

/*------------------------------------------------------ */
//-- 修改管理员密码
/*------------------------------------------------------ */
elseif ($_REQUEST['act'] == 'edit')
{
	$smarty->assign("css_root",$css_root);
	
	$smarty->display("editadmin.tpl");
}

/*------------------------------------------------------ */
//-- 更新管理员密码
/*------------------------------------------------------ */
elseif ($_REQUEST['act'] == 'update')
{

    /* 变量初始化 */
    $admin_id    = !empty($_REQUEST['id'])        ? intval($_REQUEST['id'])      : 0;
//    $admin_name  = !empty($_REQUEST['user_name']) ? trim($_REQUEST['user_name']) : '';
//    $admin_email = !empty($_REQUEST['email'])     ? trim($_REQUEST['email'])     : '';

    $admin = $_REQUEST['admin'];

    if (!empty($admin['old_password'])) {
        /* 查询旧密码并与输入的旧密码比较是否相同 */
        $sql = "SELECT password FROM {$dbprefix}admin WHERE id = '$admin_id'";
        $old_password = $DB->fetch_one_array($sql); 
          
        /*
        if ($old_password <> (md5($admin['old_password'])))
        {
           showmsg("旧密码填写错误","privilege.php?act=edit");
        }
        */
   
        
        if(strcmp($old_password['password'],md5($admin['old_password'])) != 0 )
        { 
           showmsg("旧密码填写错误","privilege.php?act=edit");
        }
        
        /* 比较新密码和确认密码是否相同 */
        if ($admin['password'] <> $admin['password2'])
        {
           showmsg("两次密码输入不一致","privilege.php?act=edit");
        }
        else
        {
        	 
            //$sql = "UPDATE {$dbprefix}admin SET password = '".$md5($admin['password'])."' WHERE id = '".$admin_id."'";
        	$sql = "UPDATE {$dbprefix}admin SET password = '".md5($admin['password'])."' WHERE id = '".$admin_id."'";
        	$query = $DB->query($sql);
        	
        	 
            
            if ($query) {
            	showmsg("管理员密码更新成功","privilege.php?act=logout");
            } else {
            	showmsg("管理员密码更新失败","privilege.php?act=edit");
            }
        }
    } else {
    	showmsg("没有填写旧密码");
    }

}


?>