<?

require "include/bittorrent.php";

dbconn(false);

loggedinorreturn();

function puke($text = "w00t")
{
  stderr("w00t", $text);
}

if (get_user_class() < UC_MODERATOR)
  puke();

$action = $_POST["action"];

if ($action == "edituser")
{
  $userid = $_POST["userid"];
  $title = $_POST["title"];
  $avatar = $_POST["avatar"];
  $enabled = $_POST["enabled"];
  $warned = $_POST["warned"];
  $warnlength = 0 + $_POST["warnlength"];
  $warnpm = $_POST["warnpm"];
  $donor = $_POST["donor"];
  $support = $_POST["support"];
 	$supportfor = $_POST["supportfor"];
  
  $maxtorrents = $_POST["maxtorrents"];
  $uploaded = $_POST["uploaded"];
  $downloaded = $_POST["downloaded"];
  $invites = $_POST["invites"];
  $donated = $_POST["donated"];
  $modcomment = $_POST["modcomment"];

  $class = (int) $_POST["class"];
  if (!is_valid_id($userid) || !is_valid_user_class($class))
    stderr( _("Error"), "Bad user ID or class ID.");
  // check target user class
  $res = do_mysql_query("SELECT warned, enabled, username, class, passhash, passkey, oldpasskey FROM users WHERE id=$userid") or sqlerr(__FILE__, __LINE__);
  $arr = mysql_fetch_assoc($res) or puke();
  $curenabled = $arr["enabled"];
  $curclass = $arr["class"];
  $curwarned = $arr["warned"];
  // User may not edit someone with same or higher class than himself!
  if ($curclass >= get_user_class())
    puke();

  if ($curclass != $class)
  {
    // Notify user
    $what = ($class > $curclass ? "promoted" : "demoted");
    $msg = "You have been ".$what." to '" . get_user_class_name($class) . "' by ".$CURUSER['username'];
    new_msg(0, $userid, $msg);
    $updateset[] = "class = $class";
    $what = ($class > $curclass ? "Promoted" : "Demoted");
 		$modcomment = gmdate("Y-m-d") . " - $what to '" . get_user_class_name($class) . "' by $CURUSER[username].\n". $modcomment;
  }

  // some Helshad fun
  $fun = ($CURUSER['id'] == 277) ? " Tremble in fear, mortal." : "";

  if ($warned && $curwarned != $warned)
  {
		$updateset[] = "warned = " . sqlesc($warned);
		$updateset[] = "warneduntil = '0000-00-00 00:00:00'";
    if ($warned == 'no')
    {
			$modcomment = gmdate("Y-m-d") . " - Warning removed by " . $CURUSER['username'] . ".\n". $modcomment;
      $msg = "Your warning has been removed by " . $CURUSER['username'] . ".";
    }
		new_msg(0, $userid, $msg);
  }
	elseif ($warnlength)
  {
    if ($warnlength == 255)
    {
			$modcomment = gmdate("Y-m-d") . " - Warned by " . $CURUSER['username'] . ".\nReason: $warnpm\n" . $modcomment;
      $msg = "You have received a [url=rules.php#warning]warning[/url] from ".$CURUSER['username'].$fun." ".($warnpm ? "\n\nReason: $warnpm" : "");
			$updateset[] = "warneduntil = '0000-00-00 00:00:00'";
    }
    else
    {
	    $dur = $warnlength . " week" . ($warnlength > 1 ? "s" : "");
	    $msg = "You have received a ".$dur." [url=rules.php#warning]warning[/url] from " . $CURUSER['username'] ." ".$fun." ".($warnpm ? "\n\nReason: $warnpm" : "");
	    $modcomment = gmdate("Y-m-d") . " - Warned for $dur by " . $CURUSER['username'] .  ".\nReason: $warnpm\n" . $modcomment;
	    $updateset[] = "warneduntil = DATE_ADD(NOW(), INTERVAL ".($warnlength * 7)." DAY)";
		}
 		
		new_msg(0, $userid, $msg);
    $updateset[] = "warned = 'yes'";
	}

  if ($enabled != $curenabled)
  {
  	if ($enabled == 'yes')
  		$modcomment = gmdate("Y-m-d") . " - Enabled by " . $CURUSER['username'] . ".\n" . $modcomment;
  	else
  		$modcomment = gmdate("Y-m-d") . " - Disabled by " . $CURUSER['username'] . ".\n" . $modcomment;
  }

if ($_POST['resetkey'] == 1)
{
$passkey= md5($arr['username'].get_date_time().$arr['passhash']);
$updateset[] = "passkey = " . sqlesc($passkey);
$oldpasskey = "[$arr[passkey]]$arr[oldpasskey]";
if (strlen($oldpasskey)>255)
	bark("You have reset your passkey too many times, ask an Admin for permission");
$updateset[] = "oldpasskey = " . sqlesc($oldpasskey);
} 
if ($_POST['deleteoldkey'] == 1)
$updateset[] = "oldpasskey = " . sqlesc('');

 $updateset[] = "enabled = " . sqlesc($enabled);
  $updateset[] = "donor = " . sqlesc($donor);
  $updateset[] = "supportfor = " . sqlesc($supportfor);
  $updateset[] = "support = " . sqlesc($support);
  $updateset[] = "avatar = " . sqlesc($avatar);
  $updateset[] = "title = " . sqlesc($title);
  $updateset[] = "maxtorrents = ".sqlesc($maxtorrents);
  $updateset[] = "uploaded = ".sqlesc($uploaded);
  $updateset[] = "downloaded= ".sqlesc($downloaded);
  $updateset[] = "invites = ".sqlesc($invites);
  $updateset[] = "donated = ".sqlesc($donated);
  $updateset[] = "modcomment = " . sqlesc($modcomment);
  do_mysql_query("UPDATE users SET  " . implode(", ", $updateset) . " WHERE id=$userid") or sqlerr(__FILE__, __LINE__);
  $returnto = $_POST["returnto"];

  header("Location: ".htmlspecialchars($returnto));
  die;
}

puke();

?>