<?php
/*
UserSpice 4
An Open Source PHP User Management System
by the UserSpice Team at http://UserSpice.com

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/
 // UserSpice Specific Functions
function testUS(){
	echo "<br>";
	echo "UserSpice Functions have been properly included";
	echo "<br>";
}


function get_gravatar($email, $s = 120, $d = 'mm', $r = 'pg', $img = false, $atts = array() ) {
	$url = 'https://www.gravatar.com/avatar/';
	$url .= md5( strtolower( trim( $email ) ) );
	$url .= "?s=$s&d=$d&r=$r";
	if ( $img ) {
		$url = '<img src="' . $url . '"';
		foreach ( $atts as $key => $val )
		$url .= ' ' . $key . '="' . $val . '"';
		$url .= ' />';
	}
	return $url;
}

//Check if a permission level ID exists in the DB
function permissionIdExists($id) {
	$db = DB::getInstance();
	$query = $db->query("SELECT id FROM permissions WHERE id = ? LIMIT 1",array($id));
	$num_returns = $query->count();

	if ($num_returns > 0) {
		return true;
	} else {
		return false;
	}
}

//Check if a user ID exists in the DB
function userIdExists($id) {
	$db = DB::getInstance();
	$query = $db->query("SELECT * FROM users WHERE id = ?",array($id));
	$num_returns = $query->count();
	if ($num_returns > 0){
		return true;
	}else{
		return false;
	}
}

//Retrieve information for a single permission level
function fetchPermissionDetails($id) {
	$db = DB::getInstance();
	$query = $db->query("SELECT id, name FROM permissions WHERE id = ? LIMIT 1",array($id));
	$results = $query->first();
	$row = array('id' => $results->id, 'name' => $results->name);
	return ($row);
}

//Change a permission level's name
function updatePermissionName($id, $name) {
	$db = DB::getInstance();
	$fields=array('name'=>$name);
	$db->update('permissions',$id,$fields);
}

//Checks if a username exists in the DB
function usernameExists($username)   {
	$db = DB::getInstance();
	$query = $db->query("SELECT * FROM users WHERE username = ?",array($username));
	$results = $query->results();
	return ($results);
}

//Retrieve information for all users
function fetchAllUsers() {
	$db = DB::getInstance();
	$query = $db->query("SELECT * FROM users");
	$results = $query->results();
	return ($results);
}

//Retrieve complete user information by username, token or ID
function fetchUserDetails($username=NULL,$token=NULL, $id=NULL){
	if($username!=NULL) {
		$column = "username";
		$data = $username;
	}elseif($id!=NULL) {
		$column = "id";
		$data = $id;
	}
	$db = DB::getInstance();
	$query = $db->query("SELECT * FROM users WHERE $column = $data LIMIT 1");
	$results = $query->first();
	return ($results);
}

//Retrieve list of permission levels a user has
function fetchUserPermissions($user_id) {
	$db = DB::getInstance();
	$query = $db->query("SELECT * FROM user_permission_matches WHERE user_id = ?",array($user_id));
	$results = $query->results();
	return ($results);
}


//Retrieve list of users who have a permission level
function fetchPermissionUsers($permission_id) {
	$db = DB::getInstance();
	$query = $db->query("SELECT id, user_id FROM user_permission_matches WHERE permission_id = ?",array($permission_id));
	$results = $query->results();
	return ($results);
	$row[$user] = array('id' => $id, 'user_id' => $user);
	if (isset($row)){
		return ($row);
	}
}

//Unmatch permission level(s) from user(s)
function removePermission($permissions, $members) {
	$db = DB::getInstance();
	if(is_array($members)){
		$memberString = '';
		foreach($members as $member){
		  $memberString .= $member.',';
		}
		$memberString = rtrim($memberString,',');

		$q = $db->query("DELETE FROM user_permission_matches WHERE permission_id = ? AND user_id IN ({$memberString})",[$permissions]);
	}elseif(is_array($permissions)){
		$permissionString = '';
		foreach($permissions as $permission){
			$permissionString .= $permission.',';
		}
		$permissionString = rtrim($permissionString,',');
		$q = $db->query("DELETE FROM user_permission_matches WHERE user_id = ? AND permission_id IN ({$permissionString})",[$members]);
	}
	return $q->count();
}

//Retrieve a list of all .php files in root files folder
function getPathPhpFiles($absRoot,$urlRoot,$fullPath) {
	$directory = $absRoot.$urlRoot.$fullPath;
	//bold ($directory);
	$pages = glob($directory . "*.php");

	foreach ($pages as $page){
		$fixed = str_replace($absRoot.$urlRoot,'',$page);
		$row[$fixed] = $fixed;
	}
	return $row;
}

//Retrieve a list of all .php files in root files folder
function getPageFiles() {
	$directory = "../";
	$pages = glob($directory . "*.php");
	foreach ($pages as $page){
		$fixed = str_replace('../','/'.$us_url_root,$page);
		$row[$fixed] = $fixed;
	}
	return $row;
}

//Retrive a list of all .php files in users/ folder
function getUSPageFiles() {
	$directory = "../users/";
	$pages = glob($directory . "*.php");
	foreach ($pages as $page){
		$fixed = str_replace('../users/','/'.$us_url_root.'users/',$page);
		$row[$fixed] = $fixed;
	}
	return $row;
}

//Delete a page from the DB
function deletePages($pages) {
	$db = DB::getInstance();
	if(!$query = $db->query("DELETE FROM pages WHERE id IN ({$pages})")){
		throw new Exception('There was a problem deleting pages.');
	}else{
		return true;
	}
}

//Fetch information on all pages
function fetchAllPages() {
	$db = DB::getInstance();
	$query = $db->query("SELECT id, page, private FROM pages ORDER BY id DESC");
	$pages = $query->results();
	//return $pages;

	if (isset($row)){
		return ($row);
	}else{
		return $pages;
	}
}

//Fetch information for a specific page
function fetchPageDetails($id) {
	$db = DB::getInstance();
	$query = $db->query("SELECT id, page, private FROM pages WHERE id = ?",array($id));
	$row = $query->first();
	return $row;
}


//Check if a page ID exists
function pageIdExists($id) {
	$db = DB::getInstance();
	$query = $db->query("SELECT private FROM pages WHERE id = ? LIMIT 1",array($id));
	$num_returns = $query->count();
	if ($num_returns > 0){
		return true;
	}else{
		return false;
	}
}

//Toggle private/public setting of a page
function updatePrivate($id, $private) {
	$db = DB::getInstance();
	$result = $db->query("UPDATE pages SET private = ? WHERE id = ?",array($private,$id));
	return $result;
}

//Add a page to the DB
function createPages($pages) {
	$db = DB::getInstance();
	foreach($pages as $page){
		$fields=array('page'=>$page, 'private'=>'0');
		$db->insert('pages',$fields);
	}
}

//Match permission level(s) with page(s)
function addPage($page, $permission) {
	$db = DB::getInstance();
	$i = 0;
	if (is_array($permission)){
		foreach($permission as $id){
			$query = $db->query("INSERT INTO permission_page_matches (
			permission_id, page_id ) VALUES ( $id , $page )");
			$i++;
		}
	} elseif (is_array($page)){
		foreach($page as $id){
			$query = $db->query("INSERT INTO permission_page_matches (
			permission_id, page_id ) VALUES ( $permission , $id )");
			$i++;
		}
	} else {
		$query = $db->query("INSERT INTO permission_page_matches (
		permission_id, page_id ) VALUES ( $permission , $page )");
		$i++;
	}
	return $i;
}

  //Retrieve list of permission levels that can access a page
function fetchPagePermissions($page_id) {
	$db = DB::getInstance();
	$query = $db->query("SELECT id, permission_id FROM permission_page_matches WHERE page_id = ? ",array($page_id));
	$results = $query->results();
	return($results);
}

//Retrieve list of pages that a permission level can access
function fetchPermissionPages($permission_id) {
	$db = DB::getInstance();

	$query = $db->query(
	"SELECT m.id as id, m.page_id as page_id, p.page as page, p.private as private
	FROM permission_page_matches AS m
	INNER JOIN pages AS p ON m.page_id = p.id
	WHERE m.permission_id = ?",[$permission_id]);
	$results = $query->results();
	return ($results);
}

//Unmatched permission and page
function removePage($pages, $permissions) {
	$db = DB::getInstance();
	if(is_array($permissions)){
		$ids = '';
		for($i = 0; $i < count($permissions);$i++){
			$ids .= $permissions[$i].',';
		}
		$ids = rtrim($ids,',');
		if($query = $db->query("DELETE FROM permission_page_matches WHERE permission_id IN ({$ids}) AND page_id = ?",array($pages))){
			return $query->count();
		}
	}elseif(is_array($pages)){
		$ids = '';
		for($i = 0; $i < count($pages);$i++){
			$ids .= $pages[$i].',';
		}
		$ids = rtrim($ids,',');
		if($query = $db->query("DELETE FROM permission_page_matches WHERE page_id IN ({$ids}) AND permission_id = ?",array($permissions))){
			return $query->count();
		}
	}
}

//Delete a defined array of users
function deleteUsers($users) {
	$db = DB::getInstance();
	$i = 0;
	foreach($users as $id){
		$query1 = $db->query("DELETE FROM users WHERE id = ?",array($id));
		$query2 = $db->query("DELETE FROM user_permission_matches WHERE user_id = ?",array($id));
		$query3 = $db->query("DELETE FROM profiles WHERE user_id = ?",array($id));
		$i++;
	}
	return $i;
}


//Check if a user has access to a page
function securePage($uri){
	//Separate document name from uri
	//$tokens = explode('/', $uri);
	//$page = end($tokens);

	$abs_us_root=$_SERVER['DOCUMENT_ROOT'];

	$self_path=explode("/", $_SERVER['PHP_SELF']);
	$self_path_length=count($self_path);
	$file_found=FALSE;

	for($i = 1; $i < $self_path_length; $i++){
		array_splice($self_path, $self_path_length-$i, $i);
		$us_url_root=implode("/",$self_path)."/";

		if (file_exists($abs_us_root.$us_url_root.'z_us_root.php')){
			$file_found=TRUE;
			break;
		}else{
			$file_found=FALSE;
		}
	}

	$urlRootLength=strlen($us_url_root);
	$page=substr($uri,$urlRootLength,strlen($uri)-$urlRootLength);

	//bold($page);

	$db = DB::getInstance();
	$id = null;
	$private = null;
	// dnd($page);
	global $user;
	// dnd($user);
	if(isset($user) && $user->data() != null){
		if($user->data()->permissions==0){
			bold('<br><br><br>Sorry. You have been banned. If you feel this is an error, please contact the administrator.');
			die();
		}
	}
	//retrieve page details
	$query = $db->query("SELECT id, page, private FROM pages WHERE page = ?",[$page]);
	$count = $query->count();
	if ($count==0){
		//Get line from z_us_root.php that starts with $path
		$file = fopen($abs_us_root.$us_url_root."z_us_root.php","r");
		while(!feof($file)){
			$currentLine=fgets($file);
			if (substr($currentLine,0,5)=='$path'){
				//echo $currentLine;
				//if here, then it found the line starting with $path so break to preserve $currentLine value
				break;
			}
		}
		fclose($file);

		//sample text: $path=('/','/users/','/usersc/');
		//Get array of paths, with quotes removed
		$lineLength=strlen($currentLine);
		$pathString=str_replace("'","",substr($currentLine,7,$lineLength-11));
		$paths=explode(',',$pathString);

		$pages=[];

		//Get list of php files for each $path
		foreach ($paths as $path){
			$rows=getPathPhpFiles($abs_us_root,$us_url_root,$path);
		 	foreach ($rows as $row){
				$pages[]=$row;
			}
		}

		$dbpages = fetchAllPages(); //Retrieve list of pages in pages table

		$count = 0;
		$dbcount = count($dbpages);
		$creations = array();

		foreach ($pages as $page) {
		    $page_exists = false;
		    foreach ($dbpages as $k => $dbpage) {
		        if ($dbpage->page === $page) {
		            unset($dbpages[$k]);
		            $page_exists = true;
		            break;
		        }
		    }
		    if (!$page_exists) {
		        $creations[] = $page;
		    }
		}
		$query = $db->query("SELECT id, page, private FROM pages WHERE page = ?",[$page]);
		$count = $query->count();
			if ($count==0){
		bold('<br><br>You must go into the Admin Panel and click the Manage Pages button to add this page to the database. Doing so will make this error go away.');
		die();
		}
	}
	$results = $query->first();

	$pageDetails = array( 'id' =>$results->id, 'page' => $results->page, 'private' =>$results->private);

	$pageID = $results->id;

	//If page does not exist in DB, allow access
	if (empty($pageDetails)){
		return true;
	}elseif ($pageDetails['private'] == 0){//If page is public, allow access
		return true;
	}elseif(!$user->isLoggedIn()){ //If user is not logged in, deny access
		Redirect::to($us_url_root.'users/login.php');
		return false;
	}else {
		//Retrieve list of permission levels with access to page

		$query = $db->query("SELECT permission_id FROM permission_page_matches WHERE page_id = ?",[$pageID]);

		$permission = $query->results();
		$pagePermissions[] = $permission;

		//Check if user's permission levels allow access to page
		if (checkPermission($pagePermissions)){
			return true;
		}elseif ($user->data()->id == $master_account){ //Grant access if master user
			return true;
		}else {
			Redirect::to("index.php");
			return false;
		}
	}
}

//Does user have permission
//This is the old school UserSpice Permission System
function checkPermission($permission) {
	$db = DB::getInstance();
	global $user;
	//Grant access if master user
	$access = 0;

	foreach($permission[0] as $perm){
		if ($access == 0){
			$query = $db->query("SELECT id FROM user_permission_matches  WHERE user_id = ? AND permission_id = ?",array($user->data()->id,$perm->permission_id));
			$results = $query->count();
			if ($results > 0){
				$access = 1;
			}
		}
	}
	if ($access == 1){
		return true;
	}
	if ($user->data()->id == 1){
		return true;
	}else{
		return false;
	}
}

function checkMenu($permission, $id) {
	$db = DB::getInstance();
	global $user;
	//Grant access if master user
	$access = 0;

	if ($access == 0){
		$query = $db->query("SELECT id FROM user_permission_matches  WHERE user_id = ? AND permission_id = ?",array($id,$permission));
		$results = $query->count();
		if ($results > 0){
			$access = 1;
		}
	}
	if ($access == 1){
		return true;
	}
	if ($user->data()->id == 1){
		return true;
	}else{
		return false;
	}
}

//Retrieve information for all permission levels
function fetchAllPermissions() {
	$db = DB::getInstance();
	$query = $db->query("SELECT id, name FROM permissions");
	$results = $query->results();
	return ($results);
}

//Displays error and success messages
function resultBlock($errors,$successes){
	//Error block
	if(count($errors) > 0){
		echo "<div class='alert alert-danger alert-dismissible' role='alert'> <button type='button' class='close' data-dismiss='alert' aria-label='Close'><span aria-hidden='true'>&times;</span></button>
		<ul>";
		foreach($errors as $error){
			echo "<li>".$error."</li>";
		}
		echo "</ul>";
		echo "</div>";
	}

	//Success block
	if(count($successes) > 0){
		echo "<div class='alert alert-success alert-dismissible' role='alert'> <button type='button' class='close' data-dismiss='alert' aria-label='Close'><span aria-hidden='true'>&times;</span></button>
		<ul>";
		foreach($successes as $success){
			echo "<li>".$success."</li>";
		}
		echo "</ul>";
		echo "</div>";
	}
}

//Inputs language strings from selected language.
function lang($key,$markers = NULL){
	global $lang;
	if($markers == NULL){
		$str = $lang[$key];
	}else{
	//Replace any dyamic markers
	$str = $lang[$key];
	$iteration = 1;
		foreach($markers as $marker){
			$str = str_replace("%m".$iteration."%",$marker,$str);
			$iteration++;
		}
	}
	//Ensure we have something to return
	if($str == ""){
		return ("No language key found");
	}else{
		return $str;
	}
}


//Check if a permission level name exists in the DB
function permissionNameExists($permission) {
	$db = DB::getInstance();
	$query = $db->query("SELECT id FROM permissions WHERE
	name = ?",array($permission));
	$results = $query->results();
}

//Match permission level(s) with user(s)
function addPermission($permission_ids, $members) {
	$db = DB::getInstance();
	$i = 0;
	if(is_array($permission_ids)){
		foreach($permission_ids as $permission_id){
			if($db->query("INSERT INTO user_permission_matches (user_id,permission_id) VALUES (?,?)",[$members,$permission_id])){
				$i++;
			}
		}
	}elseif(is_array($members)){
		foreach($members as $member){
			if($db->query("INSERT INTO user_permission_matches (user_id,permission_id) VALUES (?,?)",[$member,$permission_ids])){
				$i++;
			}
		}
	}
	return $i;
}


//Delete a permission level from the DB
function deletePermission($permission) {
	global $errors;
	$i = 0;
	$db = DB::getInstance();
	foreach($permission as $id){
		if ($id == 1){
		$errors[] = lang("CANNOT_DELETE_NEWUSERS");
		}
		elseif ($id == 2){
			$errors[] = lang("CANNOT_DELETE_ADMIN");
		}else{
			$query1 = $db->query("DELETE FROM permissions WHERE id = ?",array($id));
			$query2 = $db->query("DELETE FROM user_permission_matches WHERE permission_id = ?",array($id));
			$query3 = $db->query("DELETE FROM permission_page_matches WHERE permission_id = ?",array($id));
			$i++;
		}
	}
	return $i;

	//Redirect::to('admin_permissions.php');
}

//Checks if an email is valid
function isValidEmail($email){
	if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
		return true;
	}
	else {
		return false;
	}
}

//Check if an email exists in the DB
function emailExists($email) {
	$db = DB::getInstance();
	$query = $db->query("SELECT email FROM users WHERE email = ?",array($email));
	$num_returns = $query->count();
	if ($num_returns > 0){
		return true;
	}else{
		return false;
	}
}

//Update a user's email
function updateEmail($id, $email) {
	$db = DB::getInstance();
	$fields=array('email'=>$email);
	$db->update('users',$id,$fields);

	return true;
}