<?php
	$page_settings = array(
		'formid'     => 'Sys_cms_user', // for permission
		'section'    => 'System Setting', // parent/page title
		'subsection' => 'User Management', // page title
		'domain'     => 'sys_cms_user', // table/model name
		'access'     => 'GNu', // for permission
	);

	require_once "check_login.php";
	require_once 'function_auth.php';

	$cms_user_info = SysCmsLogin::where('cmsloginid', '=', $_SESSION["cmsloginid"])->first();

	$message = "";

	if (empty($_POST["username"])) {
		$message .= _lang("Please enter User Name.") . "\\n\\n";
	}
	
	/*
	if (empty($_POST["loginname"])) {
		$message .= _lang("Please enter Login Name.") . "\\n\\n";
	}*/

	$sql        = "SELECT * FROM sys_cms_login where cmsusername = ? and deleted = ?";
	$parameters = array($_POST["username"], 0);
	$result     = bind_pdo($sql, $parameters, "selectone");
	if (!empty($result)) {
		$message .= _lang("You have already been assigned a login name.") . "\\n\\n";
	}

	if (!empty($message)) {
		echo "<script>alert('" . $message . "'); history.back();</script>";
		exit;
	}


	//$strength = Password::strength($_POST["loginpw"], $_POST["username"]);
	$strength = Password::strength($_POST["loginpw"]);
	if (!$strength) {
		exit(_lang('Insufficient password strength'));
	}
	$loginpw = Password::hash($_POST["loginpw"]);
	$nowdate = date("Y-m-d H:i:s");


	$sql        = "select max(cmsloginid) as maxid from sys_cms_login ";
	$parameters = array();
	$row2       = bind_pdo($sql, $parameters, "selectone");

	$loginid = $row2{"maxid"} + 1;

	$password_expirydate = '2047-07-01';

	$sql        = "insert into sys_cms_login (cmsloginid, cmsusername, cmsloginname, cmsloginpw, cmsrole, cmsstatus, createdate, createby, lastupdate, lastupby, password_expirydate, is_tutor, is_student) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
	$parameters = array($loginid, $_POST["username"], $_POST["username"], $loginpw, $_POST["role_level"], "1", $nowdate, $_SESSION["cmsloginid"], $nowdate, $_SESSION["cmsloginid"], $password_expirydate, 0, 0);
	bind_pdo($sql, $parameters);
	
	if( $_POST['role_level'] == 'super_admin'){
		$profile_id = 1;	
	}else if( $_POST["role_level"] == 'admin'){
		$profile_id = 2;	
	}
	
	$sql        = "insert into profile_user (deleted, profile_id, user_id) values (?, ?, ?)";
	$parameters = array(0, $profile_id, $loginid);
	bind_pdo($sql, $parameters);

	header("Location: sys_cms_user_index.php?type=admin&msg=1");