<?php
/////////////////////////////////////////////////////////////////////////////////////////////////////////
// Copyright 2010-2013 Softnik Technologies
// Initial Version: Anil Kumar
//
// Modified: Mar 03, 2013: RG
//
/////////////////////////////////////////////////////////////////////////////////////////////////////////

require_once("config.check.php");
require_once("../../config.php");
require_once("base.php");

/////////////////////////////////////////////////////////////////////////////////////////////////////////

# Ajax script. 
# Check authentication and quit with http error code if auth fails.

session_start();
check_authentication_error_quit();
doSessionSwipeIn();

/////////////////////////////////////////////////////////////////////////////////////////////////////////

# only admin users can set categories

$bool_allow_cat_ops = true;

/////////////////////////////////////////////////////////////////////////////////////////////////////////

# only read+write users and admins can set notes.

if(!is_admin_user())
{
	$bool_allow_cat_ops = false;
	if(!is_read_plus_write_user())
	{
		header("HTTP/1.0 403 Forbidden");
		echo "Permission Denied.";
		exit;
	}
}

/////////////////////////////////////////////////////////////////////////////////////////////////////////

function get_cid_from_category($category)
{
	$category = trim($category);
	if($category != "")
	{
		global $db_config_category_table;
		$sql = "select CategoryID from " . $db_config_category_table . " where CategoryName = '$category'";
		$idresults = mysql_query($sql) or die ("Error reading from database");  
		$row = mysql_fetch_array($idresults, MYSQL_ASSOC);
		if(count($row) == 1 && isset($row['CategoryID']))
			return $row['CategoryID'];
	}
	return 0;
}

/////////////////////////////////////////////////////////////////////////////////////////////////////////

function get_name_from_category_id($cid)
{
	$cid = intval($cid);
	if($cid > 0)
	{
		global $db_config_category_table;
		$sql = "select CategoryName from " . $db_config_category_table . " where CategoryID = $cid";
		$idresults = mysql_query($sql) or die ("Error reading from database");  
		$row = mysql_fetch_array($idresults, MYSQL_ASSOC);
		if(count($row) == 1 && isset($row['CategoryName']))
			return $row['CategoryName'];
	}
	return "";
}

/////////////////////////////////////////////////////////////////////////////////////////////////////////

if(isset($_REQUEST['domcat']))
{
	global $db_config_domain_table, $db_config_category_table, $db_config_catconnection_table;
	connect_to_mysql_and_select_db();
	$did = intval($_REQUEST['domcat']);
	if($did >= 1)
	{
		$htmlText = "";
		$cats[] = 1;
		$sql = "select CategoryID from $db_config_catconnection_table WHERE sid=$did";
		$result = mysql_query( $sql ) or die("Couldn't execute your query.".mysql_error());
		while($row = mysql_fetch_array($result,MYSQL_ASSOC))
			$cats[] = $row['CategoryID'];
		if(isset($_REQUEST['cb']))
		{
			$sql = "select * from $db_config_category_table ORDER BY SortOrder DESC";
			$result = mysql_query( $sql ) or die("Couldn't execute your query.".mysql_error());
			while($row = mysql_fetch_array($result,MYSQL_ASSOC))
			{
				$cid = $row['CategoryID'];
				$name = $row['CategoryName'];
				if(in_array($cid, $cats) && $cid > 1)
					$htmlText .= "<input type=\"checkbox\" name=\"cat-$cid\" id=\"cat-$cid\" value=\"$cid\" checked> $name<br>\n";
				else if($cid > 1)
					$htmlText .= "<input type=\"checkbox\" name=\"cat-$cid\" id=\"cat-$cid\" value=\"$cid\"> $name<br>\n";
			}
			echo $htmlText;
		}
		else
		{
			echo json_encode($cats);
		}
	}
	exit;
}

/////////////////////////////////////////////////////////////////////////////////////////////////////////

if(isset($_REQUEST['catorder']))
{
	global $db_config_category_table, $db_config_catconnection_table;
	connect_to_mysql_and_select_db();
	$catid = intval($_REQUEST['catorder']);
	if($catid > 1)
	{
		$incr = intval($_REQUEST['incr']);
		if($incr == -1 || $incr == 1)
		{
			$cats[] = 1;
			$index = 1;
			$foundat = -1;
			$sql = "select * from $db_config_category_table ORDER BY SortOrder DESC";
			$result = mysql_query( $sql ) or die("Couldn't execute your query.".mysql_error());
			while($row = mysql_fetch_array($result,MYSQL_ASSOC))
			{
				if($row['CategoryID'] > 1)
				{
					$cats[] = $row['CategoryID'];
					if($row['CategoryID'] == $catid)
						$foundat = $index;
					$index++;
				}
			}
			if($incr == 1 && $foundat < count($cats)-1 && $foundat > 0)
			{
				$temp = $cats[$foundat];
				$cats[$foundat] = $cats[$foundat+1];
				$cats[$foundat+1] = $temp;
			}
			else if($incr == -1 && $foundat > 1)
			{
				$temp = $cats[$foundat];
				$cats[$foundat] = $cats[$foundat-1];
				$cats[$foundat-1] = $temp;
			}
			$sorder = 9999;
			foreach($cats as $cat)
			{
				$sql = "update $db_config_category_table set SortOrder=$sorder WHERE CategoryID=$cat";
				$result = mysql_query( $sql ) or die("Couldn't execute your query.".mysql_error());
				$sorder--;
			}
		}
	}
	exit;
}

/////////////////////////////////////////////////////////////////////////////////////////////////////////

if(isset($_REQUEST['cat']))
{
	global $db_config_domain_table, $db_config_catconnection_table;
	connect_to_mysql_and_select_db();
	$catid = intval($_REQUEST['cat']);
	if($catid > 1)
	{
		$sqlCatConnection = "delete from $db_config_catconnection_table where CategoryID = $catid";
		$result = mysql_query( $sqlCatConnection );
	}
	exit;
}

/////////////////////////////////////////////////////////////////////////////////////////////////////////

if(isset($_REQUEST['id']))
{
	global $db_config_domain_table, $db_config_catconnection_table;
	global $db_allowed_domain_columns;
	
	connect_to_mysql_and_select_db();
	$idarray = validate_request_data($_REQUEST['id']);
	$ids = explode(",", $idarray);
	$sqlor = "";
	for($i = 0; $i < count($ids); $i++)
	{
		if($sqlor != "")
			$sqlor .= " OR ";
		$sqlor .= $db_config_domain_table . ".sid = " . $ids[$i];
		
		$sid = $ids[$i];
		if(isset($_REQUEST['cat_add']) && $bool_allow_cat_ops)
		{
			$cname = validate_request_data($_REQUEST['cat_add']);
			$cid = get_cid_from_category($cname);
			if($sid > 0 && $cid > 0)
			{
				$sqlCount = "SELECT COUNT(*) AS count FROM $db_config_catconnection_table WHERE sid=$sid AND CategoryID=$cid";  
				$result = mysql_query( $sqlCount );
				$existing = mysql_fetch_array($result);  
				if ($existing['count'] == 0) 
				{  
					$sqlCatConnection = "insert into $db_config_catconnection_table (`CategoryID`, `sid`) values ($cid, $sid);";
					$result = mysql_query( $sqlCatConnection );
				}
			}
		}
		if(isset($_REQUEST['cat_delete']) && $bool_allow_cat_ops)
		{
			$cname = validate_request_data($_REQUEST['cat_delete']);
			$cid = get_cid_from_category($cname);
			if($sid > 0 && $cid > 0)
			{
				$sqlCount = "SELECT COUNT(*) AS count FROM $db_config_catconnection_table WHERE sid=$sid AND CategoryID=$cid";  
				$result = mysql_query( $sqlCount );
				$existing = mysql_fetch_array($result);  
				if ($existing['count'] == 1) 
				{  
					$sqlCatConnection = "delete from $db_config_catconnection_table where CategoryID = $cid AND sid = $sid";
					$result = mysql_query( $sqlCatConnection );
				}
			}
		}
	}
	
	if($sqlor != "")
	{
		if(isset($_REQUEST['notes_a']))
		{
			$notes = validate_request_data($_REQUEST['notes_a']);
			if($notes != "")
			{
				$notes = trim($notes);
				$sql = 'update ' . $db_config_domain_table . ' set notes_a = ' . "'" . $notes . "' " ;
				$sql .= "WHERE " . $sqlor;
				$result = mysql_query( $sql ) or die("Couldn't execute your query.".mysql_error());
			}
		}
		if(isset($_REQUEST['notes_b']))
		{
			$notes = validate_request_data($_REQUEST['notes_b']);
			if($notes != "")
			{
				$notes = trim($notes);
				$sql = 'update ' . $db_config_domain_table . ' set notes_b = ' . "'" . $notes . "' " ;
				$sql .= "WHERE " . $sqlor;
				$result = mysql_query( $sql ) or die("Couldn't execute your query.".mysql_error());
			}
		}
		if(isset($_REQUEST['notes_c']))
		{
			$notes = validate_request_data($_REQUEST['notes_c']);
			if($notes != "")
			{
				$notes = trim($notes);
				$sql = 'update ' . $db_config_domain_table . ' set notes_c = ' . "'" . $notes . "' " ;
				$sql .= "WHERE " . $sqlor;
				$result = mysql_query( $sql ) or die("Couldn't execute your query.".mysql_error());
			}
		}
		if(isset($_REQUEST['notes_d']))
		{
			$notes = validate_request_data($_REQUEST['notes_d']);
			if($notes != "")
			{
				$notes = trim($notes);
				$sql = 'update ' . $db_config_domain_table . ' set notes_d = ' . "'" . $notes . "' " ;
				$sql .= "WHERE " . $sqlor;
				$result = mysql_query( $sql ) or die("Couldn't execute your query.".mysql_error());
			}
		}
		if(isset($_REQUEST['bt-field-set']) && isset($_REQUEST['field_set']))
		{
			$custom_fields = SetupAllowableFields();
			$field = validate_request_data($_REQUEST['bt-field-set']);
			$fvalue = validate_request_data($_REQUEST['field_set']);
			$field = str_replace("f-", "", $field);
			if($field != "none" && $field != "-" && $field != "" && in_array($field, $db_allowed_domain_columns))
			{
				if(strcasecmp($fvalue, "NULL") == 0)
					$sql = 'update ' . $db_config_domain_table . ' set ' . $field . ' = NULL ';
				else
					$sql = 'update ' . $db_config_domain_table . ' set ' . $field . ' = ' . "'" . $fvalue . "' ";
				$sql .= "WHERE " . $sqlor;
				echo $sql;
				$result = mysql_query( $sql ) or die("Couldn't execute your query.".mysql_error());
				if(!in_array($field, $custom_fields) && strcasecmp($field, "manual_edited_at") && strcasecmp($field, "edited"))
				{
					$sql = 'update ' . $db_config_domain_table . ' set edited=1,manual_edited_at=NOW()';
					$sql .= "WHERE " . $sqlor;
					$result = mysql_query( $sql ) or die("Couldn't execute your query.".mysql_error());
				}
			}
		}
	}
}

/////////////////////////////////////////////////////////////////////////////////////////////////////////

?>
