<?php
include 'config.php';

// Check if the user is logged in

if ((!isSet($_SESSION['loginname'])) || ($loggin <> '1'))
{
header("Location: login.php");
exit;
}
require("configure.php"); 

require("configure.php"); 
require_once 'function_auth.php';
$index			= $_POST["index"];
$companyid		= $_POST["companyid"];
$roleid			= $_POST["roleid"];
$role 			= 'User';
$username		= htmlspecialchars($_POST["username"],ENT_QUOTES);
$loginname		= htmlspecialchars($_POST["loginname"],ENT_QUOTES);
//$loginpw		= md5(htmlspecialchars($_POST["loginpw"],ENT_QUOTES));
$strength		= Password::strength($_POST["loginpw"], $_POST["username"]);
if(!$strength){
	exit('Insufficient password strength');	
}
$loginpw		= Password::hash($_POST["loginpw"]);
$nowdate 		= date("Y-m-d H:i:s");
//print_r($_POST); 

$sql = "SELECT * FROM sys_login WHERE loginname = :loginname";
$sth = Db::getDbh()->prepare($sql);
$sth->execute(array(":loginname" => $loginname));
if( $error = $sth->getError(array(":loginname" => $loginname)) ){
	var_dump($error);
}
$colcount = $sth->rowCount();

if ($colcount > 0)	{
	echo"<script language='javascript'>
			alert('Your login name has been assigned, Please choose another.');
			history.back();
		</script>";
}	elseif($_POST["loginpw"] <> $_POST["loginpw_check"] ) {
	echo"<script language='javascript'>
			alert('Confirm Password Error');
			history.back();
		</script>";
}	else	{

	//New ID	
	$sql = "select max(loginid) as maxid from sys_login";
	$sth = Db::getDbh()->prepare($sql);
	$sth->execute();
	if( $error = $sth->getError() ){
		var_dump($error);
	}
	$row = $sth->fetch(PDO::FETCH_ASSOC);
	$loginid = $row{'maxid'}+1;
	
	//Add User
	$sql = "insert into sys_login (loginid, username, loginname, loginpw, role, status, createby, createdate, lastupby, lastupdate, deleted) VALUES(:loginid, :username, :loginname, :loginpw, :role, :status, :createby, :createdate, :lastupby, :lastupdate, :deleted)";
	$sth = Db::getDbh()->prepare($sql);
	$sql_param = array();
	$sql_param[':loginid'] = $loginid;
	$sql_param[':username'] = $username;
	$sql_param[':loginname'] = $loginname;
	$sql_param[':loginpw'] = $loginpw;
	$sql_param[':role'] = $role;
	$sql_param[':status'] = '1';
	$sql_param[':createby'] = $_SESSION['loginid'];
	$sql_param[':createdate'] = $nowdate;
	$sql_param[':lastupby'] = $_SESSION['loginid'];
	$sql_param[':lastupdate'] = $nowdate;
	$sql_param[':deleted'] = '0';
	$sth->execute($sql_param);
	if( $error = $sth->getError($sql_param) ){
		var_dump($error);
	}

	//Add User Role Sort
	$sql = "select max(sort) as maxid from file_role_user Where roleid=:roleid";
	$sth = Db::getDbh()->prepare($sql);
	$sth->execute(array(":roleid" => $roleid));
	if( $error = $sth->getError(array(":roleid" => $roleid)) ){
		var_dump($error);
	}
	$row = $sth->fetch(PDO::FETCH_ASSOC);
	$sort = $row{'maxid'}+1;

	//Add User role
	$sql = "insert into file_role_user (roleid, userid, sort, status, createby, createdate, lastupby, lastupdate, deleted) VALUES(:roleid, :userid, :sort, :status, :createby, :createdate, :lastupby, :lastupdate, :deleted)";
	$sth = Db::getDbh()->prepare($sql);
	$sql_param = array();
	$sql_param[':roleid'] = $roleid;
	$sql_param[':userid'] = $loginid;
	$sql_param[':sort'] = $sort;
	$sql_param[':status'] = '1';
	$sql_param[':createby'] = $_SESSION['loginid'];
	$sql_param[':createdate'] = $nowdate;
	$sql_param[':lastupby'] = $_SESSION['loginid'];
	$sql_param[':lastupdate'] = $nowdate;
	$sql_param[':deleted'] = '0';
	$sth->execute($sql_param);
	if( $error = $sth->getError($sql_param) ){
		var_dump($error);
	}

	//Add Company Sort
	$sql = "select max(sort) as maxid from file_company_user Where companyid=:companyid";
	$sth = Db::getDbh()->prepare($sql);
	$sth->execute(array(":companyid" => $companyid));
	if( $error = $sth->getError(array(":companyid" => $companyid)) ){
		var_dump($error);
	}
	$row = $sth->fetch(PDO::FETCH_ASSOC);
	$sort = $row{'maxid'}+1;

	//Add Company
	$sql = "insert into file_company_user (companyid, userid, sort, status, createby, createdate, lastupby, lastupdate, deleted) VALUES(:companyid, :userid, :sort, :status, :createby, :createdate, :lastupby, :lastupdate, :deleted)";
	$sth = Db::getDbh()->prepare($sql);
	$sql_param = array();
	$sql_param[':companyid'] = $companyid;
	$sql_param[':userid'] = $loginid;
	$sql_param[':sort'] = $sort;
	$sql_param[':status'] = '1';
	$sql_param[':createby'] = $_SESSION['loginid'];
	$sql_param[':createdate'] = $nowdate;
	$sql_param[':lastupby'] = $_SESSION['loginid'];
	$sql_param[':lastupdate'] = $nowdate;
	$sql_param[':deleted'] = '0';
	$sth->execute($sql_param);
	if( $error = $sth->getError($sql_param) ){
		var_dump($error);
	}

	$dbh = null;
	
	header("Location: index.php?index=$index&companyid=$companyid");
}
?>