<?php
	function Admin($report)
	{
		$user_digest = VerifyUser();
		
		$return_html = "<div class='admin_div'>\n<br />$report<hr />\n\n";
		
		if( !$user_digest ) { $return_html .= AdminLogin(); }
		else if( $user_digest ) { $return_html .= AdminIndex(); }
		
		$return_html .= "</div>\n";
		
		return( $return_html );
	}
	
	function AdminLogin()
	{
		$login_html = "
				<form action='indextest.php?page=admin' method='post' style='position:relative;z-index:10;'>
					<table cellpadding='2' cellspacing='0' border='0'>
						<tr>
							<td align='right'>Login:</td><td><input type='text' size='30' name='user' /></td>
						</tr>
						<tr>
							<td align='right'>Password:</td><td><input type='password' size='30' name='password' /></td>
						</tr>
						<tr>
							<td align='right' colspan='2'><input type='submit' value='Login' name='submit' /></td>
						</tr>
					</table>
				</form>
		";
			
		return($login_html);
	}
	
	function AdminIndex()
	{
		$post_types = array("news","requests","big_requests","great_stuff","austria_trip");
		$post_tables = array("news" => "news_posts",
												"requests" => "requests_posts",
												"big_requests" => "bigrequests_posts",
												"great_stuff" => "greatstuff_posts",
												'austria_trip' => 'austriatrip_posts'
												);
		
		$index_html = "
			<div class='item_title'>Admin Panel</div>
				<form action='indextest.php?page=admin' method='post'>
					<input type='hidden' name='cmd' value='addpost' />
					<div class='sub_title'>Add Post</div>
					<div class='item_content'>
						post type:<br />
							<select name='type' id='type'>
								<option value='news'>News</option>
								<option value='requests'>Normal Prayer Request</option>
								<option value='big_requests'>Big Prayer Request</option>
								<option value='great_stuff'>Great Stuff</option>
								<option value='austria_trip'>Austria Trip</option>
							</select>
						<br />
						title:<br />
						<input type='text' size='30' name='title' /><br />
						author:<br />
						<input type='text' size='20' name='author' /><br />
						content:<br />
						<textarea rows='15' cols='58' name='content'></textarea>
						<br />
						<input type='submit' value='add post' />
					</div>
				</form>
				
				
				<form action='indextest.php?page=admin' method='post'>
					<div class='sub_title'>Edit Posts</div>
					<div class='item_content'>
						post type:<br />
							<select name='type' id='edit_type' onchange='EditDisplay()'>
								<option value='news'>News</option>
								<option value='requests'>Normal Prayer Request</option>
								<option value='big_requests'>Big Prayer Request</option>
								<option value='great_stuff'>Great Stuff</option>
								<option value='austria_trip'>Austria Trip</option>
							</select>
		";
		
		foreach($post_types as $type)
		{
			if($type == 'news') { $visible = "style='visibility:visible;'"; }
			else { $visible = "style='visibility:hidden;'"; }
			
			$index_html .= "
						<div id='$type' $visible>
						Select $type post:<br />
						<select name='{$post_tables[$type]}'>
							<option value='0'>None</option>";
								
			$q_posts = mysql_query("SELECT ID,Title FROM {$post_tables[$type]} ORDER BY ID Desc;");
			while( $post = mysql_fetch_assoc($q_posts) )
			{ $index_html .= "\t\t\t<option value='{$post['ID']}'>{$post['Title']}</option>\n"; }
			
			$index_html .= "
						</select>
						</div>
			";
		}
		
		$index_html .= "
						<br />
						<input type='radio' name='cmd' value='editpost' checked='checked' /> edit post<br />
						<input type='radio' name='cmd' value='deletepost' /> delete post
						<br /> <br />
						<input type='submit' value='edit/delete selected post' />
					</div>
				</form>
		";
		
		return($index_html);
	}
	
	function VerifyUser()
	{
		$digest = mysql_query("SELECT Value FROM rlinks_security WHERE Variable = 'Digest';");
		$digest = mysql_fetch_assoc($digest);
		$digest = $digest['Value'];
		
		if( $_COOKIE['RLINKSDIGEST'] == $digest )
		{ return $digest; }
		else if( $_POST['user'] == "" or $_POST['password'] == "" )
		{ return false; }
		
		$phrase = mysql_query("SELECT Value FROM rlinks_security WHERE Variable = 'Phrase';");
		$phrase = mysql_fetch_assoc($phrase);
		$phrase = $phrase['Value'];
		
		$user_password = $_POST['password'];
		$user_login = $_POST['user'];
		
		$user_digest = sha1("$user_login^$user_password^$phrase");
		
		if( $user_digest == $digest )
		{
			return $user_digest;
		}
		else
		{ return false; }
	}
	
	function AddPost($type)
	{
		$dbs = array( 'news' => 'news_posts',
									'requests' => 'requests_posts',
									'big_requests' => 'bigrequests_posts',
									'great_stuff' => 'greatstuff_posts',
									'austria_trip' => 'austriatrip_posts'
								);
		
		if( !(VerifyUser()) ) { return; }
		
		$content = addslashes($_POST['content']);
		$author = addslashes($_POST['author']);
		$title = addslashes($_POST['title']);
		
		$query = mysql_query("INSERT INTO {$dbs[$type]} (Title,Author,Content,Date,NumComments) VALUES ('$title','$author','$content',UNIX_TIMESTAMP(NOW()),0);");
		
		if( $query ) { return "Successfully added post."; }
		else { return "Could not add post."; }
	}
	
	function DeletePost($type)
	{
		$dbs = array( 'news' => 'news_posts',
									'requests' => 'requests_posts',
									'big_requests' => 'bigrequests_posts',
									'great_stuff' => 'greatstuff_posts',
									'austria_trip' => 'austriatrip_posts'
								);
		
		if( !(VerifyUser()) ) { return; }
		
		$query = mysql_query("DELETE FROM {$dbs[$type]} WHERE ID = {$_POST[$dbs[$type]]} LIMIT 1;" );
		
		if($query) { return "Post successfully deleted."; }
		else { return "Post could not be deleted."; }
	}
	
	function EditPost($type)
	{
		$dbs = array( 'news' => 'news_posts',
									'requests' => 'requests_posts',
									'big_requests' => 'bigrequests_posts',
									'great_stuff' => 'greatstuff_posts',
									'austria_trip' => 'austriatrip_posts'
								);
		
		if( !(VerifyUser()) ) { return; }
		
		if( !(isset($_POST['doediting'])) )
		{
			$edit_html = "
				<div align='left' style='position:relative;z-index:10;'>
				<form action='indextest.php?page=admin' method='post'>
					<input type='hidden' name='doediting' value='1' />
					<input type='hidden' name='cmd' value='editpost' />
					<input type='hidden' name='type' value='$type' />
			";
			
			$post_id = $_POST[$dbs[$type]];
			$post = mysql_query("SELECT * FROM {$dbs[$type]} WHERE ID = $post_id LIMIT 1;");
			$post = mysql_fetch_assoc( $post );
			
			$post['Title'] = stripslashes($post['Title']);
			$post['Content'] = stripslashes($post['Content']);
			$post['Author'] = stripslashes($post['Author']);
			
			$edit_html .="
			<div class='sub_title'>Edit Post</div>
				<input type='hidden' name='id' value='{$_POST[$dbs[$type]]}' />
				Title: <br />
				<input type='text' name='title' value='{$post['Title']}' /><br />
				Author: <br />
				<input type='text' name='author' value='{$post['Author']}' /><br />
				Content: <br />
				<textarea rows='15' cols='58' name='content'>{$post['Content']}</textarea>
				<br /> <br />
			";
			
			$edit_html .= "
					<input type='submit' value='make changes to post' />
				</form>
				</div>
				<hr  />
			";
		}
		else
		{
			if( isset($_POST['id']) )
			{
				$content = addslashes($_POST['content']);
				$title = addslashes($_POST['title']);
				$author = addslashes($_POST['author']);
				
				$query = mysql_query("UPDATE {$dbs[$type]} SET Content = '$content', Title = '$title', Author = '$author'
											WHERE ID = {$_POST['id']} LIMIT 1;");
											
											print mysql_error();
				
				if( $query ) { $edit_html .= "Successfully edited post.<br />\n\n"; }
				else { $edit_html .= "Could not edit post.<br />\n\n"; }
			}
		}
		
		return( $edit_html );
	}
	
	function SetAdminCookie($p_digest)
	{
		setcookie('RLINKSDIGEST',$p_digest,time() + (30*60),'/');
	}
?>