1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
<?php
include 'config.php';
// Check if the user is logged in
if ((!isSet($_SESSION['loginname'])) || ($loggin <> '1'))
{
header("Location: login.php");
exit;
}
require("configure.php");
require_once 'function_auth.php';
$index = $_POST["index"];
$loginid = $_POST["loginid"];
$companyid = $_POST["companyid"];
$roleid = $_POST["roleid"];
$username = htmlspecialchars($_POST["username"],ENT_QUOTES);
if (strlen($_POST["loginname"]) > 0) {
$loginname = htmlspecialchars($_POST["loginname"],ENT_QUOTES);
}
//$loginpw = md5(htmlspecialchars($_POST["loginpw"],ENT_QUOTES));
$strength = Password::strength($_POST["loginpw"], $_POST["username"]);
if(!empty($_POST["loginpw"]) && !$strength){
exit('Insufficient password strength');
}
$loginpw = Password::hash($_POST["loginpw"]);
$nowdate = date("Y-m-d H:i:s");
//print_r($_POST);
//exit;
$sql = "SELECT * FROM sys_login WHERE loginname = :loginname AND loginid <> '$loginid'";
$sth = Db::getDbh()->prepare($sql);
$sth->execute(array(":loginname" => $loginname));
if( $error = $sth->getError(array(":loginname" => $loginname)) ){
var_dump($error);
}
$colcount = $sth->rowCount();
if ($colcount > 0) {
echo"<script language='javascript'>
alert('Your login name has been assigned, Please choose another.');
history.back();
</script>";
} elseif($_POST["loginpw"] <> $_POST["loginpw_check"] ) {
echo"<script language='javascript'>
alert('Confirm Password Error');
history.back();
</script>";
} else {
// Modify
$sql = "update sys_login set username=:username, lastupby=:lastupby, lastupdate=:lastupdate";
$sql_param = array();
$sql_param[':username'] = $username;
$sql_param[':lastupby'] = $_SESSION['loginid'];
$sql_param[':lastupdate'] = $nowdate;
$sql_param[':loginid'] = $loginid;
if(strlen($_POST["loginname"]) > 0){
$sql_param[':loginname'] = $loginname;
$sql .= ", loginname=:loginname";
}
if(strlen($_POST["loginpw"]) > 0){
$sql_param[':loginpw'] = $loginpw;
$sql .= ", loginpw=:loginpw";
}
$sql .= " where loginid=:loginid";
$sth = Db::getDbh()->prepare($sql);
$sth->execute($sql_param);
if( $error = $sth->getError($sql_param) ){
var_dump($error);
}
//Role User
$sql = "update file_role_user set roleid=:roleid, lastupby=:lastupby, lastupdate=:lastupdate where userid=:userid";
$sth = Db::getDbh()->prepare($sql);
$sth->execute(array(":roleid" => $roleid, ":lastupby" => $_SESSION['loginid'], ":lastupdate" => $nowdate, ":userid" =>$loginid));
if( $error = $sth->getError(array(":roleid" => $roleid, ":lastupby" => $_SESSION['loginid'], ":lastupdate" => $nowdate, ":userid" =>$loginid)) ){
var_dump($error);
}
//Company User
$sql = "update file_company_user set companyid=:companyid, lastupby=:lastupby, lastupdate=:lastupdate where userid=:userid";
$sth = Db::getDbh()->prepare($sql);
$sth->execute(array(":companyid" => $companyid, ":lastupby" => $_SESSION['loginid'], ":lastupdate" => $nowdate, ":userid" =>$loginid));
if( $error = $sth->getError(array(":roleid" => $roleid, ":lastupby" => $_SESSION['loginid'], ":lastupdate" => $nowdate, ":userid" =>$loginid)) ){
var_dump($error);
}
$dbh = null;
header("Location: index.php?index=$index&companyid=$companyid");
}
?>
|