<?php die("Security Check - Remove this error from this script before you use it."); ?>
<?php require_once "cmsAdmin/lib/viewer_functions.php"; ?>
<?php if (!@$GLOBALS['WEBSITE_MEMBERSHIP_PLUGIN']) { die("You must activate the Website Membership plugin before you can access this page."); } ?>
<?php if (!$CURRENT_USER) { websiteLogin_redirectToLogin(); } ?>
<?php

  // prepopulate form with current user values
  foreach ($CURRENT_USER as $name => $value) {
    if (array_key_exists($name, $_REQUEST)) { continue; }
    $_REQUEST[$name] = $value;
  }

  // process form
  if (@$_REQUEST['save']) {

    // error checking
    $errorsAndAlerts = "";
    if (!@$_REQUEST['fullname'])                { $errorsAndAlerts .= "You must enter your full name!<br/>\n"; }
    if (!@$_REQUEST['email'])                   { $errorsAndAlerts .= "You must enter your email!<br/>\n"; }
    else if(!isValidEmail(@$_REQUEST['email'])) { $errorsAndAlerts .= "Please enter a valid email (example: user@example.com)<br/>\n"; }
    if (!@$_REQUEST['username'])                { $errorsAndAlerts .= "You must choose a username!<br/>\n"; }

    // new password checking
    if (@$_REQUEST['oldPassword'] || $_REQUEST['newPassword1'] || $_REQUEST['newPassword2']) {
      if (!@$_REQUEST['oldPassword'])                                 { $errorsAndAlerts .= "Please enter a value for: Current Password<br/>\n"; }
      elseif (@$_REQUEST['oldPassword'] != $CURRENT_USER['password']) { $errorsAndAlerts .= "Current password isn't correct!<br/>\n"; }
      elseif (!@$_REQUEST['newPassword1'])                            { $errorsAndAlerts .= "Please enter a value for: New Password<br/>\n"; }
      elseif (!@$_REQUEST['newPassword2'])                            { $errorsAndAlerts .= "Please enter a value for: Confirm New Password<br/>\n"; }
      elseif ($_REQUEST['newPassword1'] != $_REQUEST['newPassword2']) { $errorsAndAlerts .= "New passwords don't match!<br/>\n"; }
    }

    // check for duplicate usernames and emails
    if (@$_REQUEST['username'] != $CURRENT_USER['username']) {
      $count = mysql_select_count_from('accounts', "`username` = '".mysql_escape(@$_REQUEST['username'])."'");
      if ($count > 0 && @$_REQUEST['username']) { $errorsAndAlerts .= "That username is already in use, please choose another!<br/>\n"; }
    }
    if (@$_REQUEST['email'] != $CURRENT_USER['email']) {
      $count = mysql_select_count_from('accounts', "'".mysql_escape($_REQUEST['email'])."' IN (email, username)");
      if ($count > 0) { $errorsAndAlerts .= "That email is already in use, please choose another!<br/>\n"; }
    }

    // update user
    if (!$errorsAndAlerts) {
      mysqlStrictMode(false);   // disable Mysql strict errors for when a field isn't defined below (can be caused when fields are added later)
      if (@$_REQUEST['newPassword2']) { $CURRENT_USER['password'] = $_REQUEST['newPassword2']; } // update password
      $query = "UPDATE `{$TABLE_PREFIX}accounts` SET
                      fullname         = '".mysql_escape( $_REQUEST['fullname'] )."',
                      email            = '".mysql_escape( $_REQUEST['email'] )."',
                      username         = '".mysql_escape( $_REQUEST['username'] )."',
                      password         = '".mysql_escape( $CURRENT_USER['password'] )."',

                      updatedByUserNum = '".mysql_escape( $CURRENT_USER['num'] )."',
                      updatedDate      = NOW()
                 WHERE num = '".mysql_escape( $CURRENT_USER['num'] )."'";
      mysql_query($query) or die("MySQL Error:<br/>\n". htmlspecialchars(mysql_error()) . "\n");
      $userNum = mysql_insert_id();

      // on success
      unset($_REQUEST['oldPassword'], $_REQUEST['newPassword1'], $_REQUEST['newPassword2']); // clear password fields
      $errorsAndAlerts = "Thanks, we've updated your profile!";
    }
  }

  // delete account
  if (@$_POST['deleteAccount']) {
    if ($CURRENT_USER['isAdmin']) { die("Error: Deleting admin accounts is not permitted!"); }

    // delete uploads
    $GLOBALS['tableName'] = 'accounts';
    eraseRecordsUploads( $CURRENT_USER['num'] );

    // delete account
    $query = mysql_escapef("DELETE FROM `{$TABLE_PREFIX}accounts` WHERE num = ?", $CURRENT_USER['num']);
    mysql_query($query) or die("MySQL Error:<br/>\n". htmlspecialchars(mysql_error()) . "\n");

    // redirect to login
    websiteLogin_redirectToLogin();
  }


?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title></title>
<style type="text/css">
  body, td { font-family: arial; font-size: 14px; }
</style>
</head>
<body>

<h1>Sample Edit Profile Page</h1>

<!-- EDIT PROFILE FORM -->
  <?php if (@$errorsAndAlerts): ?>
    <div style="color: #C00; font-weight: bold; font-size: 14px; font-family: arial;"><br/>
      <?php echo $errorsAndAlerts; ?><br/><br/>
    </div>
  <?php endif ?>

  <form method="post" action="?">
  <input type="hidden" name="save" value="1" />

  <table border="0" cellspacing="0" cellpadding="2">
   <tr>
    <td>Full Name</td>
    <td><input type="text" name="fullname" value="<?php echo htmlspecialchars(@$_REQUEST['fullname']); ?>" size="50" /></td>
   </tr>
   <tr>
    <td>Email</td>
    <td><input type="text" name="email" value="<?php echo htmlspecialchars(@$_REQUEST['email']); ?>" size="50" /></td>
   </tr>
   <tr>
    <td>Username</td>
    <td><input type="text" name="username" value="<?php echo htmlspecialchars(@$_REQUEST['username']); ?>" size="50" /></td>
   </tr>

   <tr><td colspan="2">&nbsp;</td></tr>

   <tr>
    <td>Current Password</td>
    <td><input type="password" name="oldPassword" value="<?php echo htmlspecialchars(@$_REQUEST['oldPassword']); ?>" size="50" /></td>
   </tr>
   <tr>
    <td>New Password</td>
    <td><input type="password" name="newPassword1" value="<?php echo htmlspecialchars(@$_REQUEST['newPassword1']); ?>" size="50" /></td>
   </tr>
   <tr>
    <td>New Password (again)</td>
    <td><input type="password" name="newPassword2" value="<?php echo htmlspecialchars(@$_REQUEST['newPassword2']); ?>" size="50" /></td>
   </tr>

   <tr>
    <td colspan="2" align="center">
      <br/><input class="button" type="submit" name="submit" value="Update profile &gt;&gt;" />
    </td>
   </tr>
  </table>

  </form><br/>
<!-- /EDIT PROFILE FORM -->


<!-- REMOVE PROFILE FORM -->
<div style="border: 1px solid #000; background-color: #EEE; padding: 20px; width: 500px">
  <b>Delete Account</b>
  <p>If you want to delete your account you can do so here.<br/>
  Please note that all data will be lost and this is irreversible.</p>

  <form method="post" action="?" onsubmit="return confirm('Are you sure you want to delete your account?')">
  <input type="submit" name="deleteAccount" value="Delete Account" />
  </form>
</div>
<!-- /REMOVE PROFILE FORM -->

</body>
</html>
