<?php
    include "include/koneksi.php";

    //memulai session
    session_start();
    //cek apakah sudah login atau belum
    if (isset($_SESSION['email_user']) && ($_SESSION['pass_user']) && ($_SESSION['level_user']))
    {
?>
        <?php
            if ($_SESSION['level_user'] == 'Admin')
            {
                include "include/navigasiadmin.php";
            }
            else if ($_SESSION['level_user'] == 'Human Resource')
            {
                include "include/navigasihr.php";
            }
            else if ($_SESSION['level_user'] == 'Head')
            {
                include "include/navigasihead.php";
            }
            else
            {
                include "include/navigasigs.php";
            }
        ?>

            <div class="panel panel-primary">
                <div class="panel-heading">
                    <h3 class="panel-title"><a href="profile.php"><b>Profile</b></a> :: Edit Password</h3>
                </div>

                <?php
                    if (isset($_POST['profileeditpass']))
                    {
                        $old_pass = md5($_POST['old_pass']);
                        $pass_user = md5($_POST['pass_user']);
                        $new_pass = md5($_POST['new_pass']);
                        $id_user = $_SESSION['id_user'];

                        //cek kesesuian old_pass berdasarkan data
                        $pass = "SELECT * FROM user WHERE id_user='$id_user'";
                        $passres = mysql_query($pass);
                        $viewpass = mysql_fetch_array($passres);

                        if (($old_pass != $viewpass['pass_user']) || ($pass_user != $new_pass) || (($pass_user = "") || ($new_pass = "")))
                        {
                ?>
                            <div class="alert alert-danger" role="alert">
                                <b>Failed. Invalid password.</b>
                            </div>
                <?php
                        }
                        else
                        {
                            $pass_user = md5($_POST['pass_user']);
                            //mendapatkan id_user berdasarkan sesi login
                            $id_user = $_SESSION['id_user'];
                            //query update data
                            $updpass = "UPDATE user SET pass_user='$pass_user' WHERE id_user='$id_user'";
                            $updt = mysql_query($updpass);

                            header("location: profile.php?epropass=ok");
                        }
                    }
                ?>

                <div class="panel-body">
                    <form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>" role="">
                        <div class="form-group">
                            <label>Old Password</label>
                            <input type="password" name="old_pass" class="form-control" placeholder="Old Password" required>
                        </div>
                        <div class="form-group">
                            <label>New Password</label>
                            <input type="password" name="pass_user" class="form-control" placeholder="New Password" required>
                        </div>
                        <div class="form-group">
                            <label>Re-type New Password</label>
                            <input type="password" name="new_pass" class="form-control" placeholder="Re-type New Password" required>
                        </div>
                        <div class="form-group">
                            <div class="row">
                                <div class="col-md-8">
                                    <button type="submit" class="btn btn-block btn-primary" name="profileeditpass">Save</button>
                                </div>
                                <div class="col-md-4">
                                    <a class="btn btn-block btn-default" href="profile.php">Cancel</a>
                                </div>
                            </div>
                        </div>
                    </form>
                </div>
            </div>

        <?php
            include "include/footer.php";
        ?>
<?php
    }
    //jika belum login
    else
    {
        //alihkan ke halaman login
        header("location: login.php?ref=profileeditpass.php");
    }
?>