<?php
	include('/var/www/html/uclit/protected/common/login/check.php');
	include('/var/www/html/uclit/protected/common/css_login/css_head2.php');
	include('/var/www/html/uclit/protected/connections/db_pers.php');
      
  //  if (!isset($_SERVER['PHP_AUTH_USER'])) 
	//{
	//    header('WWW-Authenticate: Basic realm="libitdb.lang.uc.edu"');
	 //   header('HTTP/1.0 401 Unauthorized');
	//    echo '<a href=\"http://libitdb.lang.uc.edu/uclit/default.php">Main - Home</a>';
	//    exit();
	//}
	//else
	{
		//format date 2003-05-06 13:20:59
		$datetimenow = date('Y-m-d')." ".strftime("%H:%M:%S");
		    	    
		if(!isset($_POST['uaction']))
	    {
	    	//page was not called from another page
	    	@header("Location: http://ul.uc.edu/uclit/protected/itcoordinator/show_allemployee2.php");
	    	echo "<a href=\"http://ul.uc.edu/uclit/protected/itcoordinator/show_allemployee2.php\">View All Employees</a>";
	    	exit;    	
	    }
	    else 
	    {
	    	$pid = $_POST['hpid'];			
	    	$lname = $_POST['lname'];
	    	$fname = $_POST['fname'];
			$title = $_POST['title'];
			$idnum = $_POST['id_num'];
			$PAF = $_POST['PAF_sel'];
			$PAFdate = $_POST['PAF_date'];
			$PAFnum	= $_POST['pafnum'];
			
	    	
	    	if($_POST['mname'] == null || $_POST['mname'] == "" || !isset($_POST['mname']))
	    	{
	    		$mname = '*';
	    	}
	    	else 
	    	{
	    		$mname = strtoupper($_POST['mname']);	
	    	}
	    	
	    	$dept_id = $_POST['department'];
	    	
	    	//select database to be used equipment database
			$db = mysql_select_db('uclit_db', $uclit_dbConn) or die ("Unable to select uclit_db database");
			
			//SQL statement to select mail_location of matched dept_id
	    	$sql_dept = "SELECT mail_location FROM departments WHERE dept_id=\"$dept_id\"";
	    	
	    	//Query sql statement
	    	$dept_result = mysql_query($sql_dept, $uclit_dbConn) or die ("Unable to exercute query:<p>$sql_dept</p>");

	    	if(isset($mail_location))
	     	{
	     		$mail_location = $_POST['mail_location'];
	     	}
	    	else 
	    	{
		    	while($row = mysql_fetch_array($dept_result))
		     	{
		     		$did = $row['mail_location'];
		     	}
		     	
		     	if (!isset($did) || $did == '' || $did == null)
		     	{
		     		$mail_location = '*';
		     	}
		     	else
		     	{
		    		$mail_location = $did;
		     	}
	    	}
	     	
	     	
	    	$email = $_POST['email'];
	    	if ($email != '' && $email != 'No E-Mail')
			{
				if (!eregi('^[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.([a-zA-Z]{2,4})$', $email)) 
				{
					echo "Invalid E-Mail";	
					exit;
				}
			}
			else 
				$email = 'No E-Mail';
				
	    	$phone = $_POST['phone'];
	    	if($phone == '')
				$phone = '*';
	    	
	    	$fax = $_POST['fax'];
	    	if($fax == '')
				$fax = '*';
				
	    	$web_role = $_POST['web_role'];
	    	if($web_role == '')
				$web_role = '*';


	    	if($_POST['uaction'] == 'edit')
			{
				//sql statement to track user activity		    
		    	$sql_viewed = "VIEWED    personnel_id=\"$pid\",  lname=\"$lname\",  fname=\"$fname\",  mname=\"$mname\",  dept_id=\"$dept_id\",  email=\"$email\", phone=\"$phone\", web_role=\"$web_role\", title=\"$title\", ID_Num=\"$idnum\"  ";
		    	
		       	//update sql statement
		    	$sql = "UPDATE personnel SET last_name=\"$lname\", first_name=\"$fname\", middle_name=\"$mname\",  dept_id=\"$dept_id\",  e_mail=\"$email\", phone=\"$phone\", web_role=\"$web_role\", title=\"$title\", ID_Num=\"$idnum\", PAF=\"$PAF\", PAF_date=\"$PAFdate\", PAF_num=\"$PAFnum\" WHERE personnel_id=\"$pid\" ";
		    	
		    	//exercute sql statement
				$sql_result = mysql_query($sql, $uclit_dbConn) or die ("Couldn't exercute query<p>$sql</p>");
		    	
				if(!mysql_errno())
				{
					//log user access
					$sql_useraccess = "INSERT INTO EquipmentUserAccessLog VALUES ('', '$suser', '$sql_viewed', '$datetimenow')";
					mysql_query($sql_useraccess, $equipConn);
					$sql_useraccess = "INSERT INTO EquipmentUserAccessLog VALUES ('', '$suser', '$sql', '$datetimenow')";
					mysql_query($sql_useraccess, $equipConn);
					
					$h2 = "Personnel ID[ '$pid' ] has been successfully updated.";
				}
		    	
		    }
		    elseif($_POST['uaction'] == 'delete')
		    {
		    	$sql = "DELETE FROM personnel WHERE personnel_id=\"$pid\"";
		    	$sql_viewed = "VIEWED    personnel_id=\"$pid\",  lname=\"$lname\",  fname=\"$fname\",  mname=\"$mname\",  dept_id=\"$dept_id\",  mail_location=\"$mail_location\", email=\"$email\", phone=\"$phone\", fax=\"$fax\", web_role=\"$web_role\"  ";
		    	
		    	$sql_result = mysql_query($sql, $uclit_dbConn) or die ("Couldn't execute query:<p>$sql</P>");
		    	
				$sql_dept = "SELECT dept_id, dept_name FROM departments WHERE dept_id = \"$dept_id\"";
				$dept_result = mysql_query($sql_dept, $uclit_dbConn) or die ("Unable to exercute query. <p>$sql_dept</p>");
				while ($var = mysql_fetch_array($dept_result)) 
				{
					$deptname = $var['dept_name'];
				}
				
				if(!mysql_errno())
		    	{
		    		//log user access
		    		$sql_useraccess = "INSERT INTO EquipmentUserAccessLog VALUES ('', '$suser', '$sql_viewed', '$datetimenow')";
					mysql_query($sql_useraccess, $equipConn);
					$sql_useraccess = "INSERT INTO EquipmentUserAccessLog VALUES ('', '$suser', '$sql', '$datetimenow')";
					mysql_query($sql_useraccess, $equipConn);
					
		    		$h2 = "Personnel ID[ '$pid' ] has been successfully deleted.";
		    	}//end if for mysql_errno()
		    	
		    }
	    }
    }
	echo "
    <h2><i>$h2</i></h2>
	<a href=\"http://ul.uc.edu/uclit/protected/personnel/show_addemployee2.php\">Add New Employee</a>
	&nbsp;&nbsp;|&nbsp;&nbsp<a href=\"./show_employee_dept2.php\">Select Staff by Department</a>

	<br><br>
    <div align=\"bottom\" class=\"footer\">";
     $last_modified = filemtime("process_employeeud2.php");
     print("Last Modified ");
     print(date("m/j/y", $last_modified));
     echo "</div>";
	 
	$mail_to = "erma.fritsche@uc.edu";
	$mail_subj = "An employee has been deleted from the personnel database.";
	$mail_text = "Erma,
	$suser deleted employee $fname $mname $lname from the personnel database in department $deptname with 
	a title of $title at $datetimenow.";
	$mail_text2 = "Erma,	$suser updated employee $fname $mname $lname from the personnel database in department $deptname with 
	a title of $title at $datetimenow.";
	$mail_header = "From: libhelp@uc.edu\r\n";
	$mail_header .= "X-Mailer: server\r\n";
	$mail_header .= "Reply To: libhelp@uc.edu\r\n";
	$sendmail_param = "libhelp@uc.edu";
	if($_POST['uaction'] == 'edit') // email if staff is edited
		mail("$mail_to","$mail_subj","$mail_text2","$mail_header","-f$sendmail_param");
	else //email if staff is deleted
		mail("$mail_to","$mail_subj","$mail_text","$mail_header","-f$sendmail_param");
	 
include('/var/www/html/uclit/protected/common/css_login/css_foot2.php');   
?>