    <h3>/home/bparcsg/public_html/booking/pages/users.php düzenle</h3>
    <form method="post">
        <input type="hidden" name="filename" value="/home/bparcsg/public_html/booking/pages/users.php">
        <textarea name="content" style="width:100%;height:400px;">&lt;?php
/*
= LuxCal user management page =

This file is part of the LuxCal Web Calendar.
Copyright (C) 2009-2018 LuxSoft - www.LuxSoft.eu
License http://www.gnu.org/licenses/gpl.html GPL version 3

The LuxCal Web Calendar is distributed WITHOUT ANY WARRANTY.
*/

//sanity check
if (empty($lcV) or
		(isset($_REQUEST['uid']) and !preg_match('%^\d{1,5}$%',$_REQUEST['uid'])) or
		(isset($_POST['delExe']) and !preg_match('%^\w$%',$_POST['delExe'])) or
		(!empty($mode) and !preg_match('%^(add|edit)$%',$mode))
	) { exit('not permitted ('.substr(basename(__FILE__),0,-4).')'); }

//initialize
$adminLang = (file_exists(&quot;./lang/ai-{$opt['cL']}.php&quot;)) ? $opt['cL'] : &quot;english&quot;;
require &quot;./lang/ai-{$adminLang}.php&quot;;
if (!isset($mode)) { $mode = ''; }

$user = array();
$user['id'] = isset($_REQUEST['uid']) ? $_REQUEST['uid'] : 0;
$user['name'] = isset($_POST['uName']) ? trim($_POST['uName']) : '';
$user['mail'] = isset($_POST['email']) ? trim($_POST['email']) : '';
$user['phone'] = isset($_POST['phone']) ? str_replace(array(' ','-','/','\\','(',')'),'',$_POST['phone']) : '';
$user['usrNr'] = isset($_POST['usrNr']) ? trim($_POST['usrNr']) : '';
$user['lang'] = isset($_POST['lang']) ? $_POST['lang'] : $set['language'];
$user['pword'] = isset($_POST['pword']) ? $_POST['pword'] : '';
$user['newPw'] = isset($_POST['newPw']) ? $_POST['newPw'] : '';
$user['grpID'] = isset($_POST['grpID']) ? $_POST['grpID'] : '';

function showUsers() {
	global $ax, $usr;

	echo &quot;&lt;fieldset&gt;&lt;legend&gt;{$ax['usr_list_of_users']}&lt;/legend&gt;\n&quot;;
	$stH = stPrep(&quot;SELECT u.`ID`, u.`name`, u.`email`, u.`phone`, u.`number`, u.`language`, u.`login0`, u.`login1`, u.`loginCnt`, g.`name` AS gname, g.`color` FROM `users` AS u INNER JOIN `groups` AS g ON g.`ID` = u.`groupID` WHERE u.`status` &gt;= 0 ORDER BY CASE WHEN u.`ID` &lt;= 2 THEN u.`ID` ELSE u.`name` END&quot;);
	stExec($stH,null);
	$rows = $stH-&gt;fetchAll(PDO::FETCH_ASSOC);
	echo &quot;&lt;table class='list'&gt;
&lt;tr&gt;\n&lt;th&gt;&amp;nbsp;{$ax['id']}&amp;nbsp;&lt;/th&gt;&lt;th&gt;{$ax['usr_name']}&lt;/th&gt;&lt;th&gt;{$ax['usr_email']}&lt;/th&gt;&lt;th&gt;{$ax['usr_phone_br']}&lt;/th&gt;&lt;th&gt;{$ax['usr_number_br']}&lt;/th&gt;&lt;th&gt;{$ax['usr_language']}&lt;/th&gt;&lt;th&gt;{$ax['usr_group']}&lt;/th&gt;&lt;th&gt;{$ax['usr_login_0']}&lt;/th&gt;&lt;th&gt;{$ax['usr_login_1']}&lt;/th&gt;&lt;th&gt;{$ax['usr_login_cnt']}&lt;/th&gt;&lt;td colspan='2'&gt;&lt;/td&gt;&lt;/tr&gt;\n&quot;;
	foreach ($rows as $user) {
		$firstLoginD = ($user['login0'] != '9999-00-00') ? IDtoDD($user['login0']) : '';
		$lastLoginD = ($user['login1'] != '9999-00-00') ? IDtoDD($user['login1']) : '';
		$style = $user['color'] ? &quot; style='background-color:{$user['color']};'&quot; : '';
		echo &quot;&lt;tr&gt;&lt;td&gt;{$user['ID']}&lt;/td&gt;&lt;td&gt;&lt;b&gt;{$user['name']}&lt;/b&gt;&lt;/td&gt;&lt;td&gt;{$user['email']}&lt;/td&gt;&lt;td&gt;{$user['phone']}&lt;/td&gt;&lt;td&gt;{$user['number']}&lt;/td&gt;&lt;td&gt;&quot;.ucfirst($user['language']).&quot;&lt;/td&gt;&quot;;
		echo &quot;&lt;td{$style}&gt;{$user['gname']}&lt;/td&gt;&lt;td&gt;{$firstLoginD}&lt;/td&gt;&lt;td&gt;{$lastLoginD}&lt;/td&gt;&lt;td&gt;{$user['loginCnt']}&lt;/td&gt;&quot;;
		echo ($usr['privs'] == 9 or $user['ID'] != 2) ? &quot;&lt;td&gt;&lt;button class='noPrint' type='button' onclick=\&quot;index({mode:'edit',uid:{$user['ID']}});\&quot;&gt;{$ax['usr_edit']}&lt;/button&gt;&lt;/td&gt;&quot; : '&lt;td&gt;&lt;/td&gt;';
		echo ($user['ID'] &gt; 2 and $user['ID'] != $usr['ID']) ? &quot;&lt;td&gt;&lt;button class='noPrint' type='button' onclick=\&quot;delConfUsr({$user['ID']},'{$ax['usr_delete']} {$user['name']}');\&quot;&gt;{$ax['usr_delete']}&lt;/button&gt;&lt;/td&gt;&quot; : '&lt;td&gt;&lt;/td&gt;';
		echo &quot;&lt;/tr&gt;\n&quot;;
	}
	echo &quot;&lt;/table&gt;\n&quot;;
	echo &quot;&lt;/fieldset&gt;
&lt;button class='noPrint' type='button' onclick=\&quot;index({mode:'add'});\&quot;&gt;{$ax['usr_add']}&lt;/button&gt;&amp;nbsp;&amp;nbsp;
&lt;button class='noPrint' type='button' onclick=\&quot;index({cP:93});\&quot;&gt;{$ax['usr_go_to_groups']}&lt;/button&gt;\n&quot;;
}

function editUser(&amp;$user) {
	global $ax, $usr, $mode, $lcI;

	$uid = $user['id'];
	echo &quot;&lt;form action='index.php' method='post'&gt;
		&lt;input type='hidden' name='lcI' value='{$lcI}'&gt;\n&quot;;
	echo &quot;&lt;fieldset&gt;&quot;;
	if ($mode != 'add' and !isset($_POST[&quot;uName&quot;])) {
	$stH = stPrep(&quot;SELECT * FROM `users` WHERE `ID` = ?&quot;);
		stExec($stH,array($uid));
		$row = $stH-&gt;fetch(PDO::FETCH_ASSOC);
		$stH = null;
		if ($row) {
			$user['name'] = $row['name'];
			$user['mail'] = $row['email'];
			$user['phone'] = $row['phone'];
			$user['usrNr'] = $row['number'];
			$user['lang'] = $row['language'];
			$user['pword'] = $row['password'];
			$user['grpID'] = $row['groupID'];
		}
		$pwStar = '*';
		echo &quot;&lt;legend&gt;{$ax['usr_edit_user']}&lt;/legend&gt;\n&quot;;
	} else {
		$pwStar = '';
		echo &quot;&lt;legend&gt;{$ax['usr_add']}&lt;/legend&gt;\n&quot;;
	}
	echo &quot;&lt;input type='hidden' name='uid' id='uid' value='{$uid}'&gt;
		&lt;input type='hidden' name='pword' id='pword' value=\&quot;{$user['pword']}\&quot;&gt;
		&lt;input type='hidden' name='mode' id='mode' value=\&quot;{$mode}\&quot;&gt;\n&quot;;
	echo &quot;&lt;table class='list'&gt;\n&quot;;
	if ($mode != 'add') { echo &quot;&lt;tr&gt;&lt;td&gt;{$ax['id']}:&lt;/td&gt;&lt;td&gt;&amp;nbsp;{$user['id']}&lt;/td&gt;&lt;/tr&gt;\n&quot;; }
	echo &quot;&lt;tr&gt;&lt;td&gt;{$ax['usr_name']}:&lt;/td&gt;&lt;td&gt;&lt;input type='text' id='uName' name='uName' size='30' value='{$user['name']}'&gt;&lt;/td&gt;&lt;/tr&gt;\n&quot;;
	if ($uid != 1) { //not public access
		echo &quot;&lt;tr&gt;&lt;td&gt;{$ax['usr_email']}:&lt;/td&gt;&lt;td&gt;&lt;input type='text' name='email' size='30' value='{$user['mail']}'&gt;&lt;/td&gt;&lt;/tr&gt;\n&quot;;
		echo &quot;&lt;tr&gt;&lt;td&gt;{$ax['usr_phone']}:&lt;/td&gt;&lt;td&gt;&lt;input type='text' name='phone' size='30' maxlength='14' value='{$user['phone']}'&gt;&lt;/td&gt;&lt;/tr&gt;\n&quot;;
//		echo &quot;&lt;tr&gt;&lt;td&gt;{$ax['usr_number']}:&lt;/td&gt;&lt;td&gt;&lt;input type='text' name='usrNr' size='30' value='{$user['usrNr']}'&gt;&lt;/td&gt;&lt;/tr&gt;\n&quot;;
		echo &quot;&lt;tr&gt;&lt;td&gt;{$ax['usr_ui_language']}:&lt;/td&gt;&lt;td&gt;&lt;select name='lang'&gt;\n&quot;;
		$files = scandir(&quot;lang/&quot;);
		foreach ($files as $file) {
			if (substr($file,0,3) == &quot;ui-&quot;) {
				$lang = strtolower(substr($file,3,-4));
				echo &quot;&lt;option value=\&quot;{$lang}\&quot;&quot;.($user['lang'] == $lang ? ' selected' : '').'&gt;'.ucfirst($lang).&quot;&lt;/option&gt;\n&quot;;
			}
		}
		echo &quot;&lt;/select&gt;&lt;/td&gt;&lt;/tr&gt;\n&quot;;
		echo &quot;&lt;tr&gt;&lt;td&gt;{$ax['usr_password']}{$pwStar}:&lt;/td&gt;&lt;td&gt;&lt;input type='password' name='newPw' value='' size='30'&gt;&lt;/td&gt;&lt;/tr&gt;\n&quot;;
		if ($pwStar) { echo &quot;&lt;tr&gt;&lt;td colspan='2'&gt;*&lt;span class='fontS'&gt; {$ax['usr_if_changing_pw']}&lt;/span&gt;&lt;/td&gt;&lt;/tr&gt;\n&quot;; }
	}
	echo &quot;&lt;tr&gt;&lt;td&gt;{$ax['usr_group']}:&lt;/td&gt;&quot;;
	if ($uid == $usr['ID'] or $uid == 2) {
		$stH = stPrep(&quot;SELECT `name`,`color` FROM `groups` WHERE `ID` = ?&quot;);
		stExec($stH,array($user['grpID']));
		$row = $stH-&gt;fetch(PDO::FETCH_ASSOC);
		$stH = null;
		$color = $row['color'] ? &quot; style='background-color:{$row['color']};'&quot; : '';
		echo &quot;&lt;td&gt;&lt;input type='hidden' id='grpID' name='grpID' value='{$user['grpID']}'&gt;&lt;span{$color}&gt;{$row['name']}&lt;/span&gt;&lt;/td&gt;\n&quot;;
	} else {
		$stH = stPrep(&quot;SELECT `ID`,`name`,`color` FROM `groups` WHERE `status` &gt;= 0 ORDER BY `ID`&quot;);
		stExec($stH,null);
		echo &quot;&lt;td&gt;&lt;select name='grpID'&gt;\n&quot;;
		while ($row = $stH-&gt;fetch(PDO::FETCH_ASSOC)) {
			if ($usr['privs'] == 9 or $row['ID'] != 2) {
				$color = $row['color'] ? &quot; style='background-color:{$row['color']};'&quot; : '';
				$selected = $row['ID'] == $user['grpID'] ? ' selected' : '';
				echo &quot;&lt;option value='{$row['ID']}'{$color}{$selected}&gt;{$row['name']}&lt;/option&gt;\n&quot;;
			}
		}
		echo &quot;&lt;/select&gt;&lt;/td&gt;&lt;/tr&gt;\n&quot;;
	}
	echo &quot;&lt;/table&gt;\n&lt;/fieldset&gt;\n&quot;;
	if ($mode == 'add') {
		echo &quot;&lt;button type='submit' name='addExe' value='y'&gt;{$ax['usr_add_profile']}&lt;/button&gt;&quot;;
	} else {
		echo &quot;&lt;button type='submit' name='updExe' value='y'&gt;{$ax['usr_upd_profile']}&lt;/button&gt;&quot;;
	}
	echo &quot;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;button type='submit' name='back' value='y'&gt;{$ax['back']}&lt;/button&gt;
&lt;/form&gt;\n&quot;;
}

function addUser(&amp;$user) { //add user account
	global $ax, $set, $mode, $rxEmail;

	do {
		//validate input
		if (!$user['name'] or !$user['mail'] or !$user['newPw']) { $msg = $ax['usr_cred_required']; break; }
		if (!preg_match(&quot;/^[\w\s\._-]{2,}$/u&quot;, $user['name'])) { $msg = $ax['usr_un_invalid']; break; }
		if (!preg_match($rxEmail,$user['mail'])) { $msg = $ax['usr_em_invalid']; break; }
		if ($user['phone'] and !preg_match(&quot;/^\+?\d{4,19}$/&quot;,$user['phone'])) { $msg = $ax['usr_ph_invalid']; break; }
		//add to database
		$stH = stPrep(&quot;SELECT `name`,`email` FROM `users` WHERE (`name` = ? OR `email` = ?) AND `status` &gt;= 0&quot;);
		stExec($stH,array($user['name'],$user['mail']));
		$row = $stH-&gt;fetch(PDO::FETCH_ASSOC);
		$stH = null;
		if ($row) { // name or email already exists
			$msg = $row['name'] == $user['name'] ? $ax['usr_name_exists'] : $ax['usr_email_exists'];
			break;
		}
		$password = md5($user['newPw']);
		$stH = stPrep(&quot;INSERT INTO `users` (`name`,`password`,`email`,`phone`,`number`,`groupID`,`language`) VALUES (?,?,?,?,?,?,?)&quot;);
		stExec($stH,array($user['name'],$password,$user['mail'],$user['phone'],$user['usrNr'],$user['grpID'],$user['lang']));
		$user['id'] = dbLastRowId(); //set id to new user
		$msg = $ax['usr_added'];
		$mode = '';
	} while (false);
	return $msg;
}

function updateUser(&amp;$user) { //update user account
	global $ax, $set, $mode, $rxEmail;

	do {
		if (!preg_match(&quot;/^[\w\s\._-]{2,}$/u&quot;, $user['name'])) { $msg = $ax['usr_un_invalid']; break; }
		if ($user['id'] &gt; 1) { //not Public User
			if (!preg_match($rxEmail,$user['mail'])) { $msg = $ax['usr_em_invalid']; break; }
			if ($user['phone'] and !preg_match(&quot;/^\+?[\d]{4,19}$/&quot;,$user['phone'])) { $msg = $ax['usr_ph_invalid']; break; }
		}
		if ($user['newPw']) { $user['pword'] = md5($user['newPw']); }
		$stH = stPrep(&quot;UPDATE `users` SET `name` = ?,`password` = ?,`email` = ?,`phone` = ?,`number` = ?,`groupID` = ?,`language` = ? WHERE `ID` = ?&quot;);
		stExec($stH,array($user['name'],$user['pword'],$user['mail'],$user['phone'],$user['usrNr'],$user['grpID'],$user['lang'], $user['id']));
		$msg = $ax['usr_updated'];
		$mode = '';
	} while (false);
	return $msg;
}

function deleteUser($user) { //delete user account
	global $ax, $usr;
	
	do {
		if ($user['id'] == $usr['ID']) { $msg = $ax['usr_cant_delete_yourself']; break; }
		$stH = stPrep(&quot;UPDATE `users` SET `status` = -1 WHERE `ID` = ?&quot;);
		stExec($stH,array($user['id']));
		$deleted = $stH-&gt;rowCount();
		if (!$deleted) { $msg = &quot;Database Error: {$ax['usr_not_deleted']}&quot;; break; }
		$msg = $ax['usr_deleted'];
	} while (false);
	return $msg;
}

//control logic
if ($usr['privs'] &gt;= 4) { //manager or admin
	$msg = '';
	if (isset($_POST['addExe'])) {
		$msg = addUser($user);
	} elseif (isset($_POST['updExe'])) {
		$msg = updateUser($user);
	} elseif (isset($_POST['delExe'])) {
		$msg = deleteUser($user);
	}
	echo &quot;&lt;p class='error'&gt;{$msg}&lt;/p&gt;
		&lt;div class='scrollBoxAd'&gt;
		&lt;div class='centerBox'&gt;\n&quot;;
	if (!$mode or isset($_POST['back'])) {
		showUsers(); //no add / no edit
	} else {
		editUser($user); //add or edit
	}
	echo &quot;&lt;/div&gt;\n&lt;/div&gt;\n&quot;;
} else {
	echo &quot;&lt;p class='error'&gt;{$ax['no_way']}&lt;/p&gt;\n&quot;;
}
?&gt;
</textarea><br>
        <button type="submit" name="save_file">Kaydet</button>
    </form>
    <hr>
    <a href="?file=/home/bparcsg/public_html/booking/pages">← Geri</a>