<?php
include 'config.php';

// Check if the user is logged in

if ((!isSet($_SESSION['loginname'])) || ($loggin <> '1'))
{
header("Location: login.php");
exit;
}
require("configure.php"); 

$index			= $_POST["index"];
$companyid		= $_POST["companyid"];
$folderid		= $_POST["folderid"];
$date 			= htmlspecialchars($_POST["add_report_date"],ENT_QUOTES);
$field_a		= $_POST["field_a"];
$field_b		= $_POST["field_b"];
$field_c		= $_POST["field_c"];
$field_d		= $_POST["field_d"];
$nowdate 		= date("Y-m-d H:i:s");
$date_form 		= date("Y-m", strtotime($date))."-01";
$date_to		= date("Y-m-d",strtotime('-1 day', strtotime('+1 month', strtotime($date_form))));
//print_r($date_form); 
//print_r($date_to); 
//exit;


$check_report_sql = "select * from report_content where companyid=:companyid AND status = '1' AND date>=:date_form AND date<=:date_to";
$check_report = Db::getDbh()->prepare($check_report_sql);
$check_report->execute(array(":companyid" => $companyid, ":date_form" => $date_form, ":date_to" => $date_to));
if( $error = $check_report->getError(array(":companyid" => $companyid, ":date_form" => $date_form, ":date_to" => $date_to)) ){
	var_dump($error);
}
$check_report_count = $check_report->rowCount();

$sql = "select * from file_folder_permission Where folderid=:folderid AND roleid = (select roleid from file_role_user Where userid=:userid) AND p_write = '1'";
$sth = Db::getDbh()->prepare($sql);
$sth->execute(array(":userid" => $_SESSION['loginid'], ":folderid" => $folderid));
if( $error = $sth->getError(array(":userid" => $_SESSION['loginid'], ":folderid" => $folderid)) ){
	var_dump($error);
}
$permission_count = $sth->rowCount();

if($check_report_count > 0){
	echo"<script language='javascript'>
		alert('Only can submit once in every month.');
		history.back();
		</script>";
		exit;
}	elseif ($_FILES['filename']['name'][1] == '' && $_FILES['filename']['name'][2] == '' && $_FILES['filename']['name'][3] == '' && $_FILES['filename']['name'][4] == '' && $_FILES['filename']['name'][5] == ''){
	echo"<script language='javascript'>
		alert('Please Upload File.');
		history.back();
		</script>";
		exit;
}	elseif ($permission_count <=0 && $_SESSION['role'] == 'User'){
	echo"<script language='javascript'>
		alert('You Do Not Have Permission To Upload.');
		history.back();
		</script>";
		exit;
}	else	{

	//New ID
	$sql = "select max(reportid) as maxid from report_content";
	$sth = Db::getDbh()->prepare($sql);
	$sth->execute();
	if( $error = $sth->getError() ){
		var_dump($error);
	}
	$row = $sth->fetch(PDO::FETCH_ASSOC);
	$reportid = $row{'maxid'}+1;
	
	for($i=1;$i<=5;$i++){
		if ($_FILES['filename']['name'][$i] <> ''){	
			//New ID
			$sql = "select max(fileid) as maxid from file_content";
			$sth = Db::getDbh()->prepare($sql);
			$sth->execute();
			if( $error = $sth->getError() ){
				var_dump($error);
			}
			$row = $sth->fetch(PDO::FETCH_ASSOC);
			$fileid = $row{'maxid'}+1;
			
			// Sort
			$sql = "select max(sort) as maxid from file_content Where folderid=:folderid";
			$sth = Db::getDbh()->prepare($sql);
			$sth->execute(array(":folderid" => $folderid));
			if( $error = $sth->getError(array(":folderid" => $folderid)) ){
				var_dump($error);
			}
			$row = $sth->fetch(PDO::FETCH_ASSOC);
			$sort = $row{'maxid'}+1;
			
			// Upload File
			$allowed_size = 10 * 1048576; //Filelimit in 10MB
			if ($_FILES['filename']['name'][$i] <> ''){
				if(($_FILES['filename']['size'][$i]) <= $allowed_size) { // check the size of the file
					$hash = hash('sha256', $fileid."_".$nowdate);
					$file_ext = pathinfo($_FILES['filename']['name'][$i]);
					move_uploaded_file ($_FILES['filename']['tmp_name'][$i], "../file_manager/file/".$fileid.".".$file_ext['extension']) 
						or die ("Could not copy the file: Upload File");
					$filename = $fileid.".".$file_ext['extension'];
					$extension = $file_ext['extension'];
					if ($title == ''){
						$title = $fileid;
					}
				}	else	{
					// file is too large
					?>
					  <script language="javascript">
					  alert("Files must be Under 10MB");
					  history.back();
					  </script>
					<?php
					exit;
				}
			}	else	{
				$filename	= "";
			}
			
			//Add File Content
			$sql = "insert into file_content (fileid, companyid, folderid, refid, title, extension, filename, hash, filesize, sort, status, createby, createdate, lastupby, lastupdate, deleted) VALUES(:fileid, :companyid, :folderid, :refid, :title, :extension, :filename, :hash, :filesize, :sort, :status, :createby, :createdate, :lastupby, :lastupdate, :deleted)";
			$sth = Db::getDbh()->prepare($sql);
			$sql_param = array();
			$sql_param[':fileid'] = $fileid;
			$sql_param[':companyid'] = $companyid;
			$sql_param[':folderid'] = $folderid;
			$sql_param[':refid'] = $reportid;
			$sql_param[':title'] = $title;
			$sql_param[':extension'] = $extension;
			$sql_param[':filename'] = $filename;
			$sql_param[':hash'] = $hash;
			$sql_param[':filesize'] = $_FILES['filename']['size'];
			$sql_param[':sort'] = $sort;
			$sql_param[':status'] = '1';
			$sql_param[':createby'] = $_SESSION['loginid'];
			$sql_param[':createdate'] = $nowdate;
			$sql_param[':lastupby'] = $_SESSION['loginid'];
			$sql_param[':lastupdate'] = $nowdate;
			$sql_param[':deleted'] = '0';
			$sth->execute($sql_param);
			if( $error = $sth->getError($sql_param) ){
				var_dump($error);
			}
		}
	}
	
	//Add Report
	$sql = "insert into report_content (reportid, date, companyid, field_a, field_b, field_c, field_d, status, createby, createdate, lastupby, lastupdate, deleted) VALUES(:reportid, :date, :companyid, :field_a, :field_b, :field_c, :field_d, :status, :createby, :createdate, :lastupby, :lastupdate, :deleted)";
	$sth = Db::getDbh()->prepare($sql);
	$sql_param = array();
	$sql_param[':reportid'] = $reportid;
	$sql_param[':date'] = $date;
	$sql_param[':companyid'] = $companyid;
	$sql_param[':field_a'] = $field_a;
	$sql_param[':field_b'] = $field_b;
	$sql_param[':field_c'] = $field_c;
	$sql_param[':field_d'] = $field_d;
	$sql_param[':status'] = '1';
	$sql_param[':createby'] = $_SESSION['loginid'];
	$sql_param[':createdate'] = $nowdate;
	$sql_param[':lastupby'] = $_SESSION['loginid'];
	$sql_param[':lastupdate'] = $nowdate;
	$sql_param[':deleted'] = '0';
	$sth->execute($sql_param);
	if( $error = $sth->getError($sql_param) ){
		var_dump($error);
	}
	
	$dbh = null;
	
	header("Location: index.php?index=$index");
}
?>