<?php

	$administrator = ($role == 3);

	if ($administrator) {
		// get the record ID passed in from the form
		$ID = initialize("ID", "get", "integer");
		$delete = initialize("delete", "get", "integer");
	} else {
		// only allow non-adminstrators to edit their own records
		$ID = $user;
	}
	
	if ($delete) {
	
		require_role($role, 3);
	
		// check for dependent records
		$query = "
			SELECT ID FROM content
			WHERE user=$ID
		";
		$result = db_do_query($query);
		$edits_count = ($result) ? db_num_rows($result) : 0 ;
		
		if ($edits_count) {
			set_feedback(0, "This user has performed $edits_count edits. You cannot delete this user record, but you can deactive it.");
		} else {
			// delete the record
			$query = "DELETE FROM user WHERE ID=$ID";
			$result = db_do_query($query);
			if ($result) { 
				set_feedback(1, "The user has been deleted.");
			} else {
				set_feedback(0, "There was an error deleting the user. Please try again.");
			}
		}
		
	} else {
	
		// get the posted data
		$ID_new = initialize("ID", "post", "integer");
		$name = initialize("name", "post", "text");
		$password = initialize("password", "post", "text");
		$email = initialize("email", "post", "text");
		$timezone = initialize("timezone", "post", "integer");
		$role = initialize("role", "post", "integer");
		$access = initialize("access", "post", "text");
		$active = initialize("active", "post", "integer");
		
		// clean up the data if necessary
		$access = implode(",", $access);
		
		if ($ID) {
			// if we're in integration mode, allow setting the user ID
			$ID_variable = (INTEGRATION_MODE) ? $ID_new : "ID" ;
		
			// if the password hasn't changed, just save it to itself
			$password_variable = ($password == "xxxxxxxx") ? "password" : "md5('$password')" ;

			// update the record
			$query = "
				UPDATE user
				SET
					ID=$ID_variable,
					name='$name',
					password=$password_variable,
					email='$email',
					timezone=$timezone,
					role=$role,
					access='$access',
					active=$active
				WHERE ID=$ID
			";
			$result = db_do_query($query);
			if ($result) { 
				// if we're editing our own record, update the session variables so the changes take effect immediately
				if ($ID == $user) {
					$timezone = intval(get_value("timezone", "ID", "offset", $timezone));
					$_SESSION["editor"]["user"] = $ID;
					$_SESSION["editor"]["username"] = $name;
					$_SESSION["editor"]["timezone"] = $timezone;
					$_SESSION["editor"]["role"] = $role;
					$_SESSION["editor"]["access"] = ($access) ? explode(",", $access) : array() ;
				}

				set_feedback(1, "The user has been saved.");
			} else {
				set_feedback(0, "There was an error saving the user. Please try again.");
			}
		} else {
			// if we're in integration mode, allow setting the user ID
			$ID_variable = (INTEGRATION_MODE) ? $ID_new : 0 ;
		
			// insert a new record
			$query = "
				INSERT INTO user (
					ID,
					name,
					password,
					email,
					timezone,
					role,
					access,
					active
				) VALUES (
					 $ID_variable,
					'$name',
					 md5('$password'),
					'$email',
					 $timezone,
					 $role,
					'$access',
					 $active
				)
			";
			$result = db_do_query($query);
			if ($result) { 
				set_feedback(1, "The user has been added.");
			} else {
				set_feedback(0, "There was an error adding the user. Please try again.");
			}
		}
		
	}
	
	redirect($wrapper_page."?page=users_manage");
			
?>