<?php

	include "library.php";

	$cxn = start_code();

			/* get variables */

	$member_id = val( $_POST, "member_id" );
	$handle = val( $_POST, "handle" );
	$email = val( $_POST, "email" );
	$password = val( $_POST, "password" );
	$sys_available = val( $_POST, "sys_available" );
	$sys_not_available = val( $_POST, "sys_not_available" );
	$lock = val( $_POST, "lock" );
	$unlock = val( $_POST, "unlock" );
	$delete = val( $_POST, "delete" );
	$undelete = val( $_POST, "undelete" );
	$returned_mail = val( $_POST, "returned_mail" );
	$change_email = val( $_POST, "change_email" );
	$scam_check_valid = val( $_POST, "scam_check_valid" );
	$scam_reported = val( $_POST, "scam_reported" );
	$confirm_delete = val( $_POST, "confirm_delete" );

	if ($password != "plastic1" && val( $_SESSION, 'admin_window_password' ) != "plastic1")
		exit();

	$_SESSION['admin_window_password'] = "plastic1";


		/* work out who it is */

	if ($member_id != "")
		$id = $member_id;
	else
	if ($handle != "")
	{
		$query = "SELECT member_id FROM handle_history WHERE handle = '".$handle."'";

		$result = run_query( $query, $cxn );

		if (mysql_num_rows($result) == 0)
		{
			echo black( "Handle not found<br><br>" );
			exit();
		}

		$data = get_row( $result );

		$id = $data['member_id'];
	}
	else
	if ($email != "")
	{
			// TODO: what if two members with same email address

		$query = "SELECT id FROM profile WHERE email = '".$email."'";

		$result = run_query( $query, $cxn );

		if (mysql_num_rows($result) == 0)
		{
			echo black( "Email address not found<br><br>" );
			exit();
		}

		if (mysql_num_rows($result) > 1)
		{
			echo black( "There is more than one profile with this email address<br><br>" );
			exit();
		}

		$data = get_row( $result );

		$id = $data['id'];
	}
	else
	if ($sys_available != "on" && $sys_not_available != "on")
	{
		echo black( "Please enter a method of locating the member<br><br>" );
		exit();
	}

		/* activate system */

	if ($sys_available == "on")
	{
		$query = "UPDATE sys_config SET value = 'yes' WHERE param = 'system_available'";

		$result = run_query( $query, $cxn );

		echo black( "System activated<br><br>" );
	}


		/* deactivate system */

	if ($sys_not_available == "on")
	{
		$query = "UPDATE sys_config SET value = 'no' WHERE param = 'system_available'";

		$result = run_query( $query, $cxn );

		echo black( "System deactivated<br><br>" );
	}


		/* returned mail */

	if ($returned_mail == "on")
	{
		$query = "UPDATE profile SET returned_mail = 'yes', email_address_valid = 'no' WHERE id = ".$id;

		$result = run_query( $query, $cxn );

		echo black( "Returned mail flags set<br><br>" );

		show_affected_rows( $cxn );
	}

		/* lock account */

	if ($lock == "on")
	{
		$query = "UPDATE profile SET locked = 'yes' WHERE id = ".$id;

		$result = run_query( $query, $cxn );

		$query = "INSERT INTO account_activity (member_id, event, event_datetime) VALUES (".$id.", 'profile locked by admin', '".date("Y-m-d H:i:s")."')";

		$result = run_query( $query, $cxn );

		echo black( "Profile locked<br><br>" );

		show_affected_rows( $cxn );
	}

    	/* scam reported by member */

	if ($scam_reported == "on")
	{
		$query = "UPDATE profile SET locked = 'yes' WHERE id = ".$id;

		$result = run_query( $query, $cxn );

		$query = "INSERT INTO account_activity (member_id, event, event_datetime) VALUES (".$id.", 'profile locked, scam reported by member', '".date("Y-m-d H:i:s")."')";

		$result = run_query( $query, $cxn );

		echo black( "Profile locked due to scam report from member<br><br>" );

		show_affected_rows( $cxn );
	}


		/* unlock account */

	if ($unlock == "on")
	{
		$query = "UPDATE profile SET locked = 'no' WHERE id = ".$id;

		$result = run_query( $query, $cxn );

		$query = "INSERT INTO account_activity (member_id, event, event_datetime) VALUES (".$id.", 'profile unlocked by admin', '".date("Y-m-d H:i:s")."')";

		$result = run_query( $query, $cxn );

		echo black( "Profile unlocked<br><br>" );

		show_affected_rows( $cxn );
	}

		/* undelete account */

	if ($undelete == "on")
	{
		$query = "UPDATE profile SET deleted = 'no' WHERE id = ".$id;

		$result = run_query( $query, $cxn );

		$query = "INSERT INTO account_activity (member_id, event, event_datetime) VALUES (".$id.", 'profile undeleted by admin', '".date("Y-m-d H:i:s")."')";

		$result = run_query( $query, $cxn );

		echo black( "Profile undeleted<br><br>" );

		show_affected_rows( $cxn );
	}

	
		/* manual review of a system scam detection said email was legitimate */

	if ($scam_check_valid == "on")
	{
		$query = "INSERT INTO account_activity (member_id, event, event_datetime) VALUES (".$id.", 'profile unlocked after scam check review', '".date("Y-m-d H:i:s")."')";

		$result = run_query( $query, $cxn );

		$query = "UPDATE profile SET locked = 'no' WHERE id = ".$id;

		$result = run_query( $query, $cxn );

		echo black( "Profile unlocked, scam ok<br><br>" );

		show_affected_rows( $cxn );
	}

		/* correct an obvious spelling mistake in an email address */

	if ($change_email == "on")
	{
		$query = "UPDATE profile SET email = '".$correct_email."' WHERE id = ".$id;

		$result = run_query( $query, $cxn );

		$query = "SELECT email_verification_code FROM profile WHERE id = ".$id;

		$result = run_query( $query, $cxn );

		$data = get_row( $result );

		send_verification_email( $id, $data['email_verification_code'], $cxn );

		echo black( "Email address updated, verification email sent<br><br>" );

		show_affected_rows( $cxn );
	}




//	show_flags( $id, $cxn );

	echo black( "Finished" );


		// show all tables - handle history, email history, sys messages, account activity


			/* show number of affected rows */

	function show_affected_rows( $cxn )
	{
		$rows = mysql_affected_rows( $cxn );

		echo $rows." rows affected<br><br>";
	}


		/* show the new profile flags */

	function show_flags( $id, $cxn )
	{
		$query = "SELECT * FROM profile WHERE id = ".$id;

		$result = run_query( $query, $cxn );

		$data = get_row( $result );

		echo "<table>";

		show_field( "ID", $data['id'] );
		show_field( "Handle", $data['handle'] );
		show_field( "Email", $data['email'] );
		show_field( "locked", $data['locked'] );
		show_field( "deleted", $data['deleted'] );
		show_field( "email_address_valid".sp(3), $data['email_address_valid'] );
		show_field( "returned_mail", $data['returned_mail'] );

		echo "</table><br><br>";
	}
?>

