<?php
/**
 * VFM - veno file manager: admin-panel/view/admin-head-users.php
 * main users setting process
 *
 * PHP version >= 5.3
 *
 * @category  PHP
 * @package   VenoFileManager
 * @author    Nicola Franchini <support@veno.it>
 * @copyright 2013 Nicola Franchini
 * @license   https://veno.es/shop/help Veno Commercial License
 * @link      http://filemanager.veno.it/
 */
if (!defined('VFM_APP') || !isset($gateKeeper) || !$gateKeeper->canSuperAdmin('superadmin_can_users')) {
    die('Direct access not allowed or insufficient permissions.');
}

use PHPMailer\PHPMailer\PHPMailer;
require_once dirname(dirname(__DIR__)).'/assets/mail/vendor/autoload.php';
$mail = new PHPMailer();

/**
* Get additional custom fields
*/
$customfields = false;
if (file_exists('_content/users/customfields.php')) {
    include_once '_content/users/customfields.php';
}

/**
 * Update USERS
 */
if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] == 'POST') {

    $resetter = new Resetter();

    $_USERS = $gateKeeper->getUsers();
    $users = $_USERS;

    if ($get_action == "new") {
        $postnewusername = filter_input(INPUT_POST, "newusername", FILTER_SANITIZE_SPECIAL_CHARS);
        $postnewuserpass = isset($_POST['newuserpass']) ? $_POST['newuserpass'] : false;
        $postnewuserfolder = filter_input(INPUT_POST, "newuserfolder", FILTER_SANITIZE_SPECIAL_CHARS);
        $newuserrole = filter_input(INPUT_POST, "newrole", FILTER_SANITIZE_SPECIAL_CHARS);
        $newquota = filter_input(INPUT_POST, "quota", FILTER_SANITIZE_SPECIAL_CHARS);        
        $disabled = isset($_POST['disabled']);

        $postnewusermail = filter_input(INPUT_POST, "newusermail", FILTER_VALIDATE_EMAIL);

        if ($postnewusername  || $postnewuserpass) {
            if (!$postnewusername || !$postnewuserpass) {
                Utils::setError($setUp->getString("indicate_username_and_password_for_new_user"));
            } else {
                $postnewusername = preg_replace('/\s+/', '', $postnewusername);

                $users = $_USERS;
                
                if (!$updater->findUser($postnewusername)
                    && !$updater->findUser($postnewusermail, true)
                ) {
                    $newuser = array();
                    $salt = $setUp->getConfig('salt');
                    $newuserpass = password_hash($salt.urlencode($postnewuserpass), PASSWORD_BCRYPT);
                 
                    $newuser['name'] = $postnewusername;
                    $newuser['pass'] = $newuserpass;
                    $newuser['role'] = $newuserrole;
                    $newuser['disabled'] = $disabled;

                    $newuserfolders = array();

                    if (isset($_POST['newuserfolders']) || $postnewuserfolder) {
                        $newuserfolders = isset($_POST['newuserfolders']) && strlen($_POST['newuserfolders']) ? json_decode($_POST['newuserfolders']) : array();
                    }
                    if ($postnewuserfolder) {
                        $postnewuserfolder = Utils::normalizeStr($postnewuserfolder);

                        if (!file_exists(".".$setUp->getConfig('starting_dir').$postnewuserfolder)) {
                            mkdir(".".$setUp->getConfig('starting_dir').$postnewuserfolder);
                        }
                        if (!in_array($postnewuserfolder, $newuserfolders)) {
                            array_push($newuserfolders, $postnewuserfolder);
                        }
                    }

                    if (!empty($newuserfolders)) {
                        $newuser['dir'] = json_encode($newuserfolders);
                    }

                    if ($newquota) {
                        $newuser['quota'] = $newquota;
                    }

                    if ($postnewusermail) {
                        $newuser['email'] = $postnewusermail;

                        if (isset($_POST['usernotif'])) {
                            $resetter->sendUserReminder($mail, $newuser['email'], $newuser['name'], true);
                        }
                    }

                    if (is_array($customfields)) {
                        foreach ($customfields as $customkey => $customfield) {
                            $cleanfield = false;
                            if ($customfield['type'] == 'email') {
                                $cleanfield = filter_input(INPUT_POST, $customkey, FILTER_VALIDATE_EMAIL);
                            } else {
                                if (isset($_POST[$customkey])) {
                                    if ($customfield['type'] == 'select' && is_array($_POST[$customkey])) {
                                        $cleanfield = array();
                                        foreach ($_POST[$customkey] as $value) {
                                            $cleanfield[] = filter_var($value, FILTER_SANITIZE_SPECIAL_CHARS);
                                        }
                                        $cleanfield = json_encode($cleanfield);
                                    } else {
                                        $cleanfield = filter_input(INPUT_POST, $customkey, FILTER_SANITIZE_SPECIAL_CHARS);
                                    }
                                }
                            }
                            if ($cleanfield) {
                                $newuser[$customkey] = $cleanfield;
                            }
                        }
                    }

                    array_push($users, $newuser);
                    $admin->updateUsers($users);
                } else {
                    if ($updater->findUser($postnewusername)) {
                        $colpevole = $postnewusername;
                    }
                    if ($updater->findUser($postnewusermail, true)) {
                        $colpevole = $postnewusermail;
                    }
                    Utils::setError('<strong>'.$colpevole.'</strong> '.$setUp->getString('file_exists'));
                }
            }
        }
    }

    if ($get_action == "updatemaster") {
        $blockup = false;
        $blockupmail = false;

        $postusernameold = filter_input(INPUT_POST, "masterusernameold", FILTER_SANITIZE_SPECIAL_CHARS);
        $postusername = filter_input(INPUT_POST, "masterusername", FILTER_SANITIZE_SPECIAL_CHARS);
        $postuserpassnew = isset($_POST['masteruserpassnew']) ? $_POST['masteruserpassnew'] : false;
        $postusermailold = filter_input(INPUT_POST, "masterusermailold", FILTER_VALIDATE_EMAIL);
        $postusermail = filter_input(INPUT_POST, "masterusermail", FILTER_VALIDATE_EMAIL);

        $users = false;

        if ($postusername) {
            $postusername = preg_replace('/\s+/', '', $postusername);

            if ($postuserpassnew) {
                $users = $updater->updateUserPwd($postusernameold, $postuserpassnew, $users);
            }

            if ($postusername !== $postusernameold) {
                if ($updater->findUser($postusername)) {
                    $blockup = true;
                } else {
                    GateKeeper::removeCookie($postusernameold, "");
                    Updater::updateAvatar($postusernameold, $postusername, "");
                    $users = $updater->updateUserData($postusernameold, 'name', $postusername, $users);
                    $_SESSION['vfm_user_name'] = $postusername;
                }
            }

            if ($postusermail !== $postusermailold) {
                if ($updater->findUser($postusermail, true)) {
                    $blockupmail = true;
                } else {
                    $users = $updater->updateUserData($postusernameold, 'email', $postusermail, $users);
                }
            }

            if ($blockup == true || $blockupmail == true) {
                if ($blockup == true) {
                    Utils::setWarning($setUp->getString("file_exists").': '.$postusername);
                }
                if ($blockupmail == true) {
                    Utils::setWarning($setUp->getString("email_in_use"));
                }
            } else {
                $admin->updateUsers($users);
                header('Location: ?section=users');
            }
        }
    }

    if ($get_action == "update") {
        $blockup = false;
        $blockupmail = false;
        $users = false;

        $postusernameold = filter_input(INPUT_POST, "usernameold", FILTER_SANITIZE_SPECIAL_CHARS);
        $postusername = filter_input(INPUT_POST, "username", FILTER_SANITIZE_SPECIAL_CHARS);
        $postuserpassnew = isset($_POST['userpassnew']) ? $_POST['userpassnew'] : false;
        $postuserfolder = filter_input(INPUT_POST, "userfolder", FILTER_SANITIZE_SPECIAL_CHARS);
        $quota = filter_input(INPUT_POST, "quota", FILTER_SANITIZE_SPECIAL_CHARS);
        $role = filter_input(INPUT_POST, "role", FILTER_SANITIZE_SPECIAL_CHARS);
        $delme = filter_input(INPUT_POST, "delme", FILTER_SANITIZE_SPECIAL_CHARS);
        $disabled = isset($_POST['disabled']);

        if ($delme == $postusernameold) {
            $users = $updater->deleteUser($postusernameold);
            $admin->updateUsers($users);
            Utils::setError('<strong>'.$postusernameold.'</strong>');
        } else {
            if (is_array($customfields)) {
                foreach ($customfields as $customkey => $customfield) {
                    $cleanfield = false;
                    if ($customfield['type'] == 'email') {
                        $cleanfield = filter_input(INPUT_POST, $customkey, FILTER_VALIDATE_EMAIL);
                    } else {
                        if (isset($_POST[$customkey])) {
                            if ($customfield['type'] == 'select' && is_array($_POST[$customkey])) {
                                $cleanfield = array();
                                foreach ($_POST[$customkey] as $value) {
                                    $cleanfield[] = filter_var($value, FILTER_SANITIZE_SPECIAL_CHARS);
                                }
                                $cleanfield = json_encode($cleanfield);
                            } else {
                                $cleanfield = filter_input(INPUT_POST, $customkey, FILTER_SANITIZE_SPECIAL_CHARS);
                            }
                        }
                    }
                    if ($cleanfield) {
                        $users = $updater->updateUserData($postusernameold, $customkey, $cleanfield, $users);
                    }
                }
            }
            $userfolders = false;

            if (isset($_POST['userfolders']) || $postuserfolder) {
                $userfolders = isset($_POST['userfolders']) ? json_decode($_POST['userfolders'], true) : array();
            }

            $postusermailold = filter_input(INPUT_POST, "usermailold", FILTER_VALIDATE_EMAIL);
            $postusermail = filter_input(INPUT_POST, "usermail", FILTER_VALIDATE_EMAIL);

            if (strlen($_POST['usernotif_again']) && $postusermail && $postusername) {
                $resetter->sendUserReminder($mail, $postusermail, $postusername);
            }

            if ($postusername) {
                $postusername = preg_replace('/\s+/', '', $postusername);

                if ($postuserpassnew) {
                    $users = $updater->updateUserPwd($postusernameold, $postuserpassnew, $users);
                }

                if ($postusername !== $postusernameold) {
                    if ($updater->findUser($postusername)) {
                        $blockup = true;
                    } else {
                        GateKeeper::removeCookie($postusernameold, "");
                        Updater::updateAvatar($postusernameold, $postusername, "");
                        $users = $updater->updateUserData($postusernameold, 'name', $postusername, $users);
                    }
                }

                if ($postusermail !== $postusermailold) {
                    if ($updater->findUser($postusermail, true)) {
                        $blockupmail = true;
                    } else {
                        $users = $updater->updateUserData($postusernameold, 'email', $postusermail, $users);
                    }
                }

                if ($postuserfolder) {
                    $postuserfolder = Utils::normalizeStr($postuserfolder);
                    if (!file_exists(".".$setUp->getConfig('starting_dir').$postuserfolder)) {
                        mkdir(".".$setUp->getConfig('starting_dir').$postuserfolder);
                    }
                    if (!in_array($postuserfolder, $userfolders)) {
                        array_push($userfolders, $postuserfolder);
                    }
                }

                $userfolders = $userfolders ? json_encode($userfolders) : $userfolders;

                $users = $updater->updateUserData($postusernameold, 'quota', $quota, $users);
                $users = $updater->updateUserData($postusernameold, 'dir', $userfolders, $users);
                if ($disabled) {
                    GateKeeper::removeCookie($postusernameold, "");
                }
                $users = $updater->updateUserData($postusernameold, 'disabled', $disabled, $users);
                
                if ($blockup == true || $blockupmail == true) {
                    if ($blockup == true) {
                        Utils::setWarning($postusername.' '.$setUp->getString("file_exists"));
                    }
                    if ($blockupmail == true) {
                        Utils::setWarning($setUp->getString("email_in_use"));
                    }
                } else {
                    $users = $updater->updateUserData($postusernameold, 'role', $role, $users);
                    $admin->updateUsers($users);
                }
            }
        }
    }
    header('Location:'.$script_url.'vfm-admin/?section=users');
    exit();
}
