<?php
include 'config.php';

// Check if the user is logged in

if ((!isSet($_SESSION['loginname'])) || ($loggin <> '1'))
{
header("Location: login.php");
exit;
}
require("configure.php"); 

$index			= $_POST["index"];
$companyid		= $_POST["companyid"];
$parentid		= $_POST["parentid"];
$levelnum		= $_POST["levelnum"];
$folderid 		= $_POST["folderid"];
$title 			= htmlspecialchars($_POST["title"],ENT_QUOTES);
$nowdate 		= date("Y-m-d H:i:s");
//print_r($_POST); 
//exit;

$sql = "select * from file_folder_permission Where folderid=:folderid AND roleid = (select roleid from file_role_user Where userid=:userid) AND p_write = '1'";
$sth = Db::getDbh()->prepare($sql);
$sth->execute(array(":userid" => $_SESSION['loginid'], ":folderid" => $folderid));
if( $error = $sth->getError(array(":userid" => $_SESSION['loginid'], ":folderid" => $folderid)) ){
	var_dump($error);
}
$permission_count = $sth->rowCount();
if ($_FILES['filename']['name'] == ''){
	echo"<script language='javascript'>
		alert('Please Upload File.');
		history.back();
		</script>";
		exit;
}	elseif ($permission_count <=0 && $_SESSION['role'] == 'User'){
	echo"<script language='javascript'>
		alert('You Do Not Have Permission To Upload.');
		history.back();
		</script>";
		exit;
}	else	{

	//New ID
	$sql = "select max(fileid) as maxid from file_content";
	$sth = Db::getDbh()->prepare($sql);
	$sth->execute();
	if( $error = $sth->getError() ){
		var_dump($error);
	}
	$row = $sth->fetch(PDO::FETCH_ASSOC);
	$fileid = $row{'maxid'}+1;
	
	// Sort
	$sql = "select max(sort) as maxid from file_content Where folderid=:folderid";
	$sth = Db::getDbh()->prepare($sql);
	$sth->execute(array(":folderid" => $folderid));
	if( $error = $sth->getError(array(":folderid" => $folderid)) ){
		var_dump($error);
	}
	$row = $sth->fetch(PDO::FETCH_ASSOC);
	$sort = $row{'maxid'}+1;
	
	// Upload File
	$allowed_size = 10 * 1048576; //Filelimit in 10MB
	if ($_FILES['filename']['name'] <> ''){
		if(($_FILES['filename']['size']) <= $allowed_size) { // check the size of the file
			$hash = hash('sha256', $fileid."_".$nowdate);
			$file_ext = pathinfo($_FILES['filename']['name']);
			move_uploaded_file ($_FILES['filename']['tmp_name'], "../file_manager/file/".$fileid.".".$file_ext['extension']) 
				or die ("Could not copy the file: Upload File");
			$filename = $fileid.".".$file_ext['extension'];
			$extension = $file_ext['extension'];
			if ($title == ''){
				$title = $file_ext['filename'];
			}
		}	else	{
			// file is too large
			?>
			  <script language="javascript">
			  alert("Files must be Under 10MB");
			  history.back();
			  </script>
			<?php
			exit;
		}
	}	else	{
		$filename	= "";
	}
	
	//Add File
	$sql = "insert into file_content (fileid, companyid, folderid, refid, title, extension, filename, hash, filesize, sort, status, createby, createdate, lastupby, lastupdate, deleted) VALUES(:fileid, :companyid, :folderid, :refid, :title, :extension, :filename, :hash, :filesize, :sort, :status, :createby, :createdate, :lastupby, :lastupdate, :deleted)";
	$sth = Db::getDbh()->prepare($sql);
	$sql_param = array();
	$sql_param[':fileid'] = $fileid;
	$sql_param[':companyid'] = $companyid;
	$sql_param[':folderid'] = $folderid;
	$sql_param[':refid'] = '0';
	$sql_param[':title'] = $title;
	$sql_param[':extension'] = $extension;
	$sql_param[':filename'] = $filename;
	$sql_param[':hash'] = $hash;
	$sql_param[':filesize'] = $_FILES['filename']['size'];
	$sql_param[':sort'] = $sort;
	$sql_param[':status'] = '1';
	$sql_param[':createby'] = $_SESSION['loginid'];
	$sql_param[':createdate'] = $nowdate;
	$sql_param[':lastupby'] = $_SESSION['loginid'];
	$sql_param[':lastupdate'] = $nowdate;
	$sql_param[':deleted'] = '0';
	$sth->execute($sql_param);
	if( $error = $sth->getError($sql_param) ){
		var_dump($error);
	}
	
	$dbh = null;
	
	header("Location: index.php?index=$index&companyid=$companyid&pid=$parentid");
}
?>