<?php

/*  PowerAdmin, a friendly web-based admin tool for PowerDNS.

 *  See <https://rejo.zenger.nl/poweradmin> for more details.

 *

 *  Copyright 2007, 2008  Rejo Zenger <rejo@zenger.nl>

 *

 *  This program is free software: you can redistribute it and/or modify

 *  it under the terms of the GNU General Public License as published by

 *  the Free Software Foundation, either version 3 of the License, or

 *  (at your option) any later version.

 *

 *  This program is distributed in the hope that it will be useful,

 *  but WITHOUT ANY WARRANTY; without even the implied warranty of

 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 *  GNU General Public License for more details.

 *

 *  You should have received a copy of the GNU General Public License

 *  along with this program.  If not, see <http://www.gnu.org/licenses/>.

 */

require_once("inc/toolkit.inc.php");

/* 

 *  Function to see if user has right to do something. It will check if

 *  user has "ueberuser" bit set. If it isn't, it will check if the user has

 *  the specific permission. It returns "false" if the user doesn't have the

 *  right, and "true" if the user has. 

 */

function verify_permission($permission) {

        global $db;

	if ((!isset($_SESSION['userid'])) || (!is_object($db))) {

		return 0;

	}

        // Set current user ID.

        $userid=$_SESSION['userid'];

        // Find the template ID that this user has been assigned.

        $query = "SELECT perm_templ

			FROM users 

			WHERE id = " . $db->quote($userid) ;

        $templ_id = $db->queryOne($query);

        // Does this user have ueberuser rights?

        $query = "SELECT id 

			FROM perm_templ_items 

			WHERE templ_id = " . $db->quote($templ_id) . " 

			AND perm_id = '53'";

        $result = $db->query($query);

        if ( $result->numRows() > 0 ) {

                return 1;

        }

        // Find the permission ID for the requested permission.

        $query = "SELECT id 

			FROM perm_items 

			WHERE name = " . $db->quote($permission) ;

        $perm_id = $db->queryOne($query);

        // Check if the permission ID is assigned to the template ID. 

        $query = "SELECT id 

			FROM perm_templ_items 

			WHERE templ_id = " . $db->quote($templ_id) . " 

			AND perm_id = " . $db->quote($perm_id) ;

        $result = $db->query($query);

        if ( $result->numRows() > 0 ) {

                return 1;

        } else {

                return 0;

        }

}

function list_permission_templates() {

	global $db;

	$query = "SELECT * FROM perm_templ";

	$result = $db->query($query);

	if (PEAR::isError($response)) { error($response->getMessage()); return false; }

	$template_list = array();

	while ($template= $result->fetchRow()) {

		$tempate_list[] = array(

			"id"	=>	$template['id'],

			"name"	=>	$template['name'],

			"descr"	=>	$template['descr']

			);

	}

	return $tempate_list;

}

/*

 * Retrieve all users.

 * Its to show_users therefore the odd name. Has to be changed.

 * return values: an array with all users in it.

 */

function show_users($id='',$rowstart=0,$rowamount=9999999)

{

 	global $db;

	$add = '';

 	if(is_numeric($id))

 	{

                 //When a user id is given, it is excluded from the userlist returned.

                 $add = " WHERE users.id!=".$db->quote($id);

	}

	// Make a huge query.

	$sqlq = "SELECT users.id AS id,

		users.username AS username,

		users.fullname AS fullname,

		users.email AS email,

		users.description AS description,

		users.active AS active,

		users.perm_templ AS perm_templ,

		count(zones.owner) AS aantal FROM users

		LEFT JOIN zones ON users.id=zones.owner$add

		GROUP BY

			users.id,

			users.username,

			users.fullname,

			users.email,

			users.description,

			users.perm_templ,

			users.active

		ORDER BY

			users.fullname";

	// Execute the huge query.

	$db->setLimit($rowamount, $rowstart);

	$result = $db->query($sqlq);

	$ret = array();

	$retcount = 0;

	while ($r = $result->fetchRow())

	{

		$ret[] = array(

		 "id"                    =>              $r["id"],

		 "username"              =>              $r["username"],

		 "fullname"              =>              $r["fullname"],

		 "email"                 =>              $r["email"],

		 "description"           =>              $r["description"],

		 "level"                 =>              $r["level"],

		 "active"                =>              $r["active"],

		 "numdomains"            =>              $r["aantal"]

		);

	}

	return $ret;

}

/*

 * Check if the given $userid is connected to a valid user.

 * return values: true if user exists, false if users doesnt exist.

 */

 function is_valid_user($id)

{

	global $db;

	if(is_numeric($id))

	{

		$result = $db->query("SELECT id FROM users WHERE id=".$db->quote($id));

		if ($result->numRows() == 1)

		{

			return true;

		}

		else

		{

			return false;

		}

	}

}

/*

 * Checks if a given username exists in the database.

 * return values: true if exists, false if not.

 */

function user_exists($user)

{

	global $db;

	$result = $db->query("SELECT id FROM users WHERE username=".$db->quote($user));

	if ($result->numRows() == 0)

	{

                 return false;

	}

	elseif($result->numRows() == 1)

	{

        	return true;

	}

        else

        {

        	error(ERR_UNKNOWN);

	}

}

/*

 * Delete a user from the system

 * return values: true if user doesnt exist.

 */

function delete_user($uid,$zones)

{

	global $db;

	if (($uid != $_SESSION['userid'] && !verify_permission(user_edit_others)) || ($uid == $_SESSION['userid'] && !verify_permission(user_edit_own))) {

		 error(ERR_PERM_DEL_USER);

		 return false;

	} else {

		if (is_array($zones)) {

			foreach ($zones as $zone) {

				if ($zone['target'] == "delete") {

					delete_domain($zone['zid']);

				} elseif ($zone['target'] == "new_owner") {

					add_owner_to_zone($zone['zid'], $zone['newowner']);

				}

			}

		}

		$query = "DELETE FROM zones WHERE owner = " . $db->quote($uid) ;

		$result = $db->query($query);

		if (PEAR::isError($response)) { error($response->getMessage()); return false; }

		$query = "DELETE FROM users WHERE id = " . $db->quote($uid) ;

		$result = $db->query($query);

		if (PEAR::isError($response)) { error($response->getMessage()); return false; }

	}

	return true;

}

/*

 * Edit the information of an user.. sloppy implementation with too many queries.. (2) :)

 * return values: true if succesful

 */

function edit_user($id, $user, $fullname, $email, $perm_templ, $description, $active, $password)

{

	global $db;

	verify_permission(user_edit_own) ? $perm_edit_own = "1" : $perm_edit_own = "0" ;

	verify_permission(user_edit_others) ? $perm_edit_others = "1" : $perm_edit_others = "0" ;

	if (($id == $_SESSION["userid"] && $perm_edit_own == "1") || ($id != $_SESSION["userid"] && $perm_edit_others == "1" )) {

		if (!is_valid_email($email)) {

			error(ERR_INV_EMAIL);

			return false;

		}

		if ($active != 1) {

			$active = 0;

		}

		// Before updating the database we need to check whether the user wants to 

		// change the username. If the user wants to change the username, we need 

		// to make sure it doesn't already exists. 

		//

		// First find the current username of the user ID we want to change. If the 

		// current username is not the same as the username that was given by the 

		// user, the username should apparantly changed. If so, check if the "new" 

		// username already exists.

		$query = "SELECT username FROM users WHERE id = " . $db->quote($id);

		$result = $db->query($query);

		if (PEAR::isError($response)) { error($response->getMessage()); return false; }

		$usercheck = array();

		$usercheck = $result->fetchRow();

		if ($usercheck['username'] != $user) {

			// Username of user ID in the database is different from the name

			// we have been given. User wants a change of username. Now, make

			// sure it doesn't already exist.

			$query = "SELECT id FROM users WHERE username = " . $db->quote($user);

			$result = $db->query($query);

			if (PEAR::isError($response)) { error($response->getMessage()); return false; }

			if($result->numRows() > 0) {

				error(ERR_USER_EXIST);

				return false;

			}

		}

		// So, user doesn't want to change username or, if he wants, there is not

		// another user that goes by the wanted username. So, go ahead!

		$query = "UPDATE users SET

				username = " . $db->quote($user) . ",

				fullname = " . $db->quote($fullname) . ",

				email = " . $db->quote($email) . ",

				perm_templ = " . $db->quote($perm_templ) . ",

				description = " . $db->quote($description) . ", 

				active = " . $db->quote($active) ;

		if($password != "") {

			$query .= ", password = " . $db->quote(md5($password)) ;

		}

		$query .= " WHERE id = " . $db->quote($id) ;

		$result = $db->query($query);

		if (PEAR::isError($response)) { error($response->getMessage()); return false; }

	} else {

		error(ERR_PERM_EDIT_USER);

		return false;

	}

	return true;

}

/*

 * Change the pass of the user.

 * The user is automatically logged out after the pass change.

 * return values: none.

 */

function change_user_pass($details) {

	global $db;

	if ($details['newpass'] != $details['newpass2']) {

		error(ERR_USER_MATCH_NEW_PASS);

		return false;

	}

	$query = "SELECT id, password FROM users WHERE username = " . $db->quote($_SESSION["userlogin"]);

	$result = $db->query($query);

	if (PEAR::isError($response)) { error($response->getMessage()); return false; }

	$rinfo = $result->fetchRow();

	if(md5($details['currentpass']) == $rinfo['password']) {

		$query = "UPDATE users SET password = " . $db->quote(md5($details['newpass'])) . " WHERE id = " . $db->quote($rinfo['id']) ;

		$result = $db->query($query);

		if (PEAR::isError($response)) { error($response->getMessage()); return false; }

		logout( _('Password has been changed, please login.')); 

	} else {

		error(ERR_USER_WRONG_CURRENT_PASS);

		return false;

	}

}

/*

 * Get a fullname when you have a userid.

 * return values: gives the fullname from a userid.

 */

function get_fullname_from_userid($id) {

	global $db;

	if (is_numeric($id)) {

		$result = $db->query("SELECT fullname FROM users WHERE id=".$db->quote($id));

		$r = $result->fetchRow();

		return $r["fullname"];

	} else {

		error(ERR_INV_ARG);

		return false;

	}

}

/*

 * Get a fullname when you have a userid.

 * return values: gives the fullname from a userid.

 */

function get_owner_from_id($id)

{

	global $db;

	if (is_numeric($id))

	{

		$result = $db->query("SELECT fullname FROM users WHERE id=".$db->quote($id));

		if ($result->numRows() == 1)

		{

			$r = $result->fetchRow();

			return $r["fullname"];

		}