<?php
	if ( !defined('IN_MFA') )
		die("Hacking attempt");

	$user->DieNotAdmin();
 
 if(! IsSet($_GET['step']))
		$_GET['step'] = 1;
		
	if($_GET['step'] == 1)
	{
		$show_after_header = "<a href='index.php?dir=".$_GET['dir']."'>".$lang['back']."</a><p class='error' width='100%' align='center'>".$lang['htaccess_request1']."</p>
													<div width='100' align='center'>
														<form action='index.php?mode=htaccess&amp;dir=".$_GET['dir']."&amp;step=2' method='POST'>
															<input type='text' name='numusers' size='2' maxlength='2'><input type='submit' name='subforward' value='".$lang['next']." -->'>
														</form>
													</div><p class='hr' width='100%'></p>";
	}
	if(($_GET['step'] == 2) && ($_POST['numusers']))
	{
		settype($_POST['numusers'],integer);
		if($_POST['numusers'] == 0)
			$show_after_header .= "<p class='error'>That does not work!</p>";
		else
		{
			$show_after_header .= "<a href='index.php?dir=".$_GET['dir']."'>".$lang['back']."</a><p class='error' width='100%' align='center'>".$lang['htaccess_request2']."</p>";
			$show_after_header .= "<div width='100%' align='center'><table border='0'><form action='index.php?mode=htaccess&amp;dir=".$_GET['dir']."&amp;step=3' method='POST'>";
			$show_after_header .= $lang['crypt'].": <input type='radio' name='encoding' value='1'>Crypt (UNIX)&nbsp;|&nbsp;<input type='radio' name='encoding' value='0'>".$lang['nothing']." (Windows)";
			for($I = 1; $I <= $_POST['numusers']; $I++)
			{
				$show_after_header .= "<tr>
															 		<td><b>".$lang['username'].": </b></td><td><input type='text' name='username[]'></td>
															 </tr>
															 <tr>
																  <td><b>".$lang['password'].": </b></td><td><input type='password' name='passw[]'></td>
															 </tr>
															 <tr>
															 	  <td><b>".$lang['repeat'].": </b></td><td><input type='password' name='passw_repeat[]'></td>
															 </tr>
															 <tr><td colspan='2'>&nbsp;</td></tr>";
			}
			
			$show_after_header .= "<tr><td colspan='2'><input type='submit' name='subforward' value='".$lang['next']." -->'></td></tr></form></table></div>";		
		}
	}
	
	if(($_GET['step'] == 3) && (IsSet($_POST['username'])))
	{
		$I = 0;
		$escape = '';
		if(!IsSet($_POST['encoding']))
			$escape .= "No encoding given<br>";
		foreach($_POST['username'] as $usr)
		{
			if($usr == '')
				$escape .= "No user <br>";
			if($_POST['passw'][$I] == '')
				$escape .= "For User ".$usr." you haven`t placed a password! <br>";
			if($_POST['passw'][$I] != $_POST['passw_repeat'][$I])
				$escape .= "The password and the repeat ".$usr." arenīt the same! <br>";
			$I++;
		}	
			
		if($escape != '')
			$show_after_header = "<p class='error'>".$escape."</p>";
		else
		{
			//erstelle Datei .htusers
			$orig_file = create_tmpfile();
			$orig_file = new file(SCRIPT_PATH."/".$orig_file);
			if(!$orig_file->open("w"))
				message_die("Error while open file","I canīt open a temporary file","Error");
			fputs($orig_file->file_resource, "# Users for ".$_GET['dir']."\n");
			
			$I = 0;
			foreach($_POST['username'] as $usr)
			{
				$passw = ($_POST['encoding'] == 1)? crypt($_POST['passw'][$I]): $_POST['passw'][$I];
				fputs($orig_file->file_resource , $usr.":".$passw."\n");
				$I++;
			}
			
			$orig_file->close();
			$orig_file->move_to($user->user_root_dir.$_GET['dir'].".htusers");
			$orig_file->delete();
			
			//eine neue und vor allem LEERE datei
			$orig_file = create_tmpfile();
			$orig_file = new file(SCRIPT_PATH."/".$orig_file);
			
			if(!$orig_file->open("w"))
				message_die("Error while open file","I canīt open a temporary file","Error");
			//erstelle datei .htaccess
			fputs($orig_file->file_resource, "# .htaccess-Datei fuer Web-Verzeichnis ".$user->user_root_dir.$_GET['dir']."\n");
  		fputs($orig_file->file_resource, "AuthType Basic\n");
  		fputs($orig_file->file_resource, "AuthName \"".ROOT_DIR."/".$user->user_root_dir.$_GET['dir']."\"\n");
  		fputs($orig_file->file_resource, "require valid-user\n");
  		fputs($orig_file->file_resource, "AuthUserFile ".ROOT_DIR."/".$user->user_root_dir.$_GET['dir'].".htusers\n");
  		
  		$user_list = $_POST['username'][0]; 
  		$I = false;
  		foreach($_POST['username'] as $usr)
  		{
  		  if($I == true)
  		  	$user_list .= ", ".$usr;
  		  
  		  $I = true;
  		}
  		$orig_file->close();
			$orig_file->move_to($user->user_root_dir.$_GET['dir'].".htaccess");
			$orig_file->delete();
				
			if(LOG_USED == 1)
				write_in_log("Directory '".$user->user_root_dir.$_GET['dir']."'locked with htaccess");	
			message_die("Job successfully done","The job, requested by you was successfully done. You will be redirected in one second", "Message");
		}
	}
?>