<?php

	/* 
	** File: UPDATE_LOGIN_PASSWORD
	** Description: Update the login and password in the "user" table.
	** Version: $Revision: 1.5 $
	** Created: 6/28/99
	** Author: Shannon -jj Behrens
	** Email: shannon.behrens@clearink.com
	** CVS Author: $Author: leon $
	** Last Revised: $Date: 1999/12/09 23:23:26 $
	**
	** Log : $Log: UPDATE_LOGIN_PASSWORD,v $
	** Log : Revision 1.5  1999/12/09 23:23:26  leon
	** Log : Changed ActionResults use so that it's an array instead of a
	** Log : continually-growing string.  Note the little function in standard_library
	** Log : for printing out all the action results.
	** Log :
	** Log : Revision 1.4  1999/11/02 19:09:47  leon
	** Log : Localized the UPDATE action modules
	** Log :
	** Log : Revision 1.3  1999/08/18 22:31:55  leon
	** Log : Returning opening PHP tag to XML-friendly tag
	** Log :
	** Log : Revision 1.2  1999/08/10 20:55:10  jj
	** Log : Added code to allow a user to edit his own address informaation. Strict security was inforced so that he can't edit anyone else's.
	** Log :
	** Log : Revision 1.1  1999/07/28 21:16:42  leon
	** Log : New actions based on code donation from a live project
	** Log :
	** 
	** Copyright (c) 1999 Working Dogs. All rights reserved. 
	**
	** Expected input: $ID, $Login, $Password.
	*/ 

	
	$ProceedWithUpdate = TRUE;



	/* 
	** Deal with security considerations. The admin can call this action with 
	** any $ID. Mortal users can only call it for themselves.
	*/
	if ( !$UserInfo["Permission"]["Administrate"] &&
		$ID != $UserInfo["ID"] )
	{
		$ActionResults[] = L_UPDATEPASS_DENIED . 
			"<!-- User is trying to change the login and password of " . 
			"someone other than himself. --><BR>\n";
		$ProceedWithUpdate = FALSE;
	}
	
	
	
	/* 
	** Trim excess whitespace and (partially) validate the input.
	*/
	if ($ProceedWithUpdate)
	{		
		$inputLogin = trim($Login);
		$inputPassword = trim($Password);
		
		if(strlen($inputLogin) < 4)
		{
			$ActionResults[] =  L_UPDATEPASS_LOGINTOOSHORT . "<BR>\n";
			$ProceedWithUpdate = FALSE;
		}
		if(strlen($inputPassword) < 4)
		{
			$ActionResults[] =  L_UPDATEPASS_PASSTOOSHORT . "<BR>\n";
			$ProceedWithUpdate = FALSE;
		}
	}



	/* 
	** Make sure that the user has selected a unique login. 
	*/
	if ($ProceedWithUpdate)
	{
		$query = "SELECT ID FROM user WHERE Login = ";
		$query .= "'" . addslashes($inputLogin) . "'";

		/* Execute the query. */
		if ( !($queryResults = mysql_query($query, $DatabaseLink)) )
		{
			$ActionResults[] =  mysql_error() . ":" . mysql_error();
			$ProceedWithUpdate = FALSE;
		}
		/* 
		** If the query was successful, and rows were returned, this means
		** that the login has already been used. Make sure that we're reusing
		** the same login, rather than trying to use someone else's. 
		** Supposedly, there should only be one row returned (right?!?).
		*/
		while ($row = mysql_fetch_row($queryResults))		
		{
			/* 
			** If the ID matches $ID, we're okay. Otherwise, tell the user to 
			** pick a different login. 
			*/ 			
			$databaseID = $row[0];
			if ($ID != $databaseID)
			{
				$ActionResults[] =  L_UPDATEPASS_LOGININUSE;
				$ProceedWithUpdate = FALSE;
			}
		}
	}



	/*
	** If everything is okay so far, we can update the user's login and 
	** password.
	*/ 
	if ($ProceedWithUpdate)
	{
		$query = "UPDATE user SET ";
		$query .= "Login = '" . addslashes($inputLogin) . "', ";
		$query .= "Password = '" . addslashes($inputPassword) . "' ";
		$query .= "WHERE ID = " . $ID;
		/* Execute the query. */ 
		if ( !($queryResults = mysql_query($query, $DatabaseLink)) )
		{
			$ActionResults[] =  mysql_errno() . ": " . mysql_error() . 
				"Query was: $query";
			$ActionResults[] = L_UPDATEPASS_FAILED;
		}
		else
		{
			$ActionResults[] = L_UPDATEPASS_SUCCESS;
		}
	}

?>
