<?php
include 'config.php';

// Check if the user is logged in

if ((!isSet($_SESSION['loginname'])) || ($loggin <> '1'))
{
header("Location: login.php");
exit;
}

$index			= $_POST["index"];
$companyid		= $_POST["companyid"];
$parentid		= $_POST["parentid"];
$levelnum		= $_POST["levelnum"];
$folderid 		= $_POST["folderid"];
$fileid 		= $_POST["fileid"];
$title 			= htmlspecialchars($_POST["title"],ENT_QUOTES);
$nowdate 		= date("Y-m-d H:i:s");
//print_r($_POST); 
//exit;

$sql = "select * from file_folder_permission Where folderid=:folderid AND roleid = (select roleid from file_role_user Where userid=:userid) AND p_write = '1'";
$sth = Db::getDbh()->prepare($sql);
$sth->execute(array(":userid" => $_SESSION['loginid'], ":folderid" => $folderid));
if( $error = $sth->getError(array(":userid" => $_SESSION['loginid'], ":folderid" => $folderid)) ){
	var_dump($error);
}
$permission_count = $sth->rowCount();
if ($permission_count <=0 && $_SESSION['role'] == 'User'){
	echo"<script language='javascript'>
		alert('You Do Not Have Permission To Upload.');
		history.back();
		</script>";
		exit;
}	else	{

	// Upload File
	$allowed_size = 10 * 1048576; //Filelimit in 10MB
	if ($_FILES['filename']['name'] <> ''){
		if(($_FILES['filename']['size']) <= $allowed_size) { // check the size of the file
			//Delete Exciting File
			$sql = "SELECT * FROM file_content Where fileid=:fileid";
			$sth = Db::getDbh()->prepare($sql);
			$sth->execute(array(":fileid" => $fileid));
			if( $error = $sth->getError(array(":fileid" => $fileid)) ){
				var_dump($error);
			}
			$row = $sth->fetch(PDO::FETCH_ASSOC);
			if($row{'filename'}){
				$source_path = "../file_manager/file/".$row{'filename'};
				$move_check = rename($source_path,"../file_manager/deleted_file/".date("Y-m-d_H-i-s")."_".$row{'filename'});
				if ($move_check === false){
					if (file_exists($source_path)) {
						//die ("Could not Move the file to the path");
					}
				}
			}
			$hash = hash('sha256', $fileid."_".$nowdate);
			$file_ext = pathinfo($_FILES['filename']['name']);
			move_uploaded_file ($_FILES['filename']['tmp_name'], "../file_manager/file/".$fileid.".".$file_ext['extension']) 
				or die ("Could not copy the file: Upload File");
			$filename = $fileid.".".$file_ext['extension'];
			$extension = $file_ext['extension'];
			if ($title == ''){
				$title = $file_ext['filename'];
			}
		}	else	{
			// file is too large
			?>
			  <script language="javascript">
			  alert("Files must be Under 10MB");
			  history.back();
			  </script>
			<?php
			exit;
		}
	}	else	{
		$filename	= "";
	}
	
	//Modify
	$sql = "update file_content set companyid=:companyid, folderid=:folderid, title=:title, lastupdate=:lastupdate, lastupby=:lastupby";
	$sql_param = array();
	$sql_param[':companyid'] = $companyid;
	$sql_param[':folderid'] = $folderid;
	$sql_param[':title'] = $title;
	$sql_param[':lastupby'] = $_SESSION['loginid'];
	$sql_param[':lastupdate'] = $nowdate;
	$sql_param[':companyid'] = $companyid;
	$sql_param[':fileid'] = $fileid;
	if($_FILES['filename']['name'] <> ''){
		$sql_param[':extension'] = $extension;
		$sql_param[':filename'] = $filename;
		$sql_param[':hash'] = $hash;
		$sql_param[':filesize'] = $_FILES['filename']['size'];
		$sql .= ", extension=:extension, filename=:filename, hash=:hash, filesize=:filesize";
	}
	$sql .= " where fileid=:fileid";
	$sth = Db::getDbh()->prepare($sql);
	$sth->execute($sql_param);
	if( $error = $sth->getError($sql_param) ){
		var_dump($error);
	}
	
	$dbh = null;
	
	header("Location: index.php?index=$index&companyid=$companyid&pid=$parentid");
}
?>