<?
require "include/bittorrent.php";
dbconn(false);
loggedinorreturn();

if (get_user_class() < UC_MODERATOR)
stderr("Fehler", "Zugriff Verweigert.");

$action = $_GET["action"];

///////////////////////////
// Zeige Team Nachrichten //
/////////////////////////

if (!$action) {

if (get_user_class() < UC_MODERATOR)
stderr("Fehler", "Zugriff Verweigert.");

stdhead();
begin_frame ("Team Nachrichten", FALSE, "80%");
begin_table (TRUE);

$res = mysql_query("SELECT count(id) FROM staffmessages") or die(mysql_error());
$row = mysql_fetch_array($res);

$url = " .$_SERVER[PHP_SELF]?";
$count = $row[0];
$perpage = 20;
list($pagertop, $pagerbottom, $limit) = pager($perpage, $count, $url);



if ($count == 0) {
print("<td class=tabletitle><center><b>~Keine Nachrichten Vorhanden~</b></center></td>");
}
else {

echo $pagertop;

begin_table();

print("<table class=tableoutborder width=90% border=0 cellspacing=1 cellpadding=4 align=center>\n");
print("<tr>");
print("<td class=tabletitle align=center><b>Anliegen</b></td>");
print("<td class=tabletitle align=center><b>Mitglied</b></td>");
print("<td class=tabletitle align=center><b>Empfangen</b></td>");
print("<td class=tabletitle align=center><b>Bearbeitet</b></td>");
print("<td class=tabletitle align=center><b>Setze Bearbeitet</b></td>");
if (get_user_class() >= UC_ADMINISTRATOR)
{
print("<td class=tabletitle align=left><b>Löschen</b></td>");
}
print("</tr>");
print("<form method=post action=?action=takecontactanswered>");

$res = mysql_query("SELECT staffmessages.id, staffmessages.added, staffmessages.subject, staffmessages.answered, staffmessages.answeredby, staffmessages.sender, staffmessages.answer, users.username FROM staffmessages INNER JOIN users on staffmessages.sender = users.id ORDER BY id desc $limit");

while ($arr = mysql_fetch_assoc($res))
{
if ($arr[answered])
{
$res3 = mysql_query("SELECT username FROM users WHERE id=$arr[answeredby]");
$arr3 = mysql_fetch_assoc($res3);
$answered = "<font color=green><b>Ja - <a href=userdetails.php?id=$arr[answeredby]><b>$arr3[username]</b></a> (<a href=staffbox.php?action=viewanswer&pmid=$arr[id]>Status Ansehen</a>)</b></font>";
}
else
$answered = "<font color=red><b>Nein</b></font>";

$pmid = $arr["id"];

print("<tr>");
print("<td class=tableb align=center><a href=/staffbox.php?action=viewpm&pmid=$pmid><b>$arr[subject]</b></td>");
print("<td class=tablea align=center><a href=userdetails.php?id=$arr[sender]><b>$arr[username]</b></a></td>");
print("<td class=tableb align=center>$arr[added]</td><td class=tablea align=center>$answered</td>");
print("<td class=tableb align=center><input type=\"checkbox\" name=\"setanswered[]\" value=\"" . $arr[id] . "\" /></td>");
if (get_user_class() >= UC_ADMINISTRATOR)
{
print("<td class=tablea align=center><a href=/staffbox.php?action=deletestaffmessage&id=$arr[id]><b>Lösche PM</b></a></td>");
}
print("</tr>\n");
}

print("</table>\n");

print("<p align=center><input type=submit value=Bestätigen></p>");
print("</form>");

echo $pagerbottom;

end_table();
}
print("</table></table>\n");
stdfoot();
}

//////////////////////////
// Nachrichten Ansehen //
//////////////////////////

if ($action == "viewpm")
{

if (get_user_class() < UC_MODERATOR)
stderr("Fehler", "Zugriff Verweigert.");

$pmid = 0 + $_GET["pmid"];

$ress4 = mysql_query("SELECT id, subject, sender, added, msg, answeredby, answered FROM staffmessages WHERE id=$pmid");
$arr4 = mysql_fetch_assoc($ress4);

$answeredby = $arr4["answeredby"];

$rast = mysql_query("SELECT username FROM users WHERE id=$answeredby");
$arr5 = mysql_fetch_assoc($rast);

$senderr = "" . $arr4["sender"] . "";

if (is_valid_id($arr4["sender"]))
{
$res2 = mysql_query("SELECT username FROM users WHERE id=" . $arr4["sender"]) or sqlerr();
$arr2 = mysql_fetch_assoc($res2);
$sender = "<a href='userdetails.php?id=$senderr'>" . ($arr2["username"] ? $arr2["username"]:"[Gelöscht]") . "</a>";
}
else
$sender = "System";

$subject = $arr4["subject"];

if ($arr4["answered"] == '0') {
$answered = "<font color=red><b>Nein</b></font>";
}
else {
$answered = "<font color=green><b>Ja</b></font> von <a href=userdetails.php?id=$answeredby>$arr5[username]</a> (<a href=staffbox.php?action=viewanswer&pmid=$pmid>Antwort Ansehen</a>)";
}

if ($arr4["answered"] == '0') {
$setanswered = "[<a href=/staffbox.php?action=setanswered&id=$arr4[id]>Setze als Beantwortet</a>]";
}
else {
$setanswered = "";
}

$iidee = $arr4["id"];

    stdhead("Team-PM ansehen");
    begin_frame("Team-PM-Ansicht", FALSE, "600px;");
$elapsed = get_elapsed_time(sql_timestamp_to_unix_timestamp($arr4["added"]));
    begin_table(TRUE);
    ?>
  <colgroup>
    <col width="50">
    <col>
  </colgroup>
  <tr>
    <td class="tablecat" colspan="2"><b>Betreff:</b> <?=$subject?></td>
  </tr>
  <tr>
    <td class="tableb"><b>Absender:</b></td>
    <td class="tablea"><b><?=$sender?></b> am <?=$arr4["added"]?> (vor <?=$elapsed?>)</td>
  </tr>
  <tr>
    <td class="tableb"><b>Bearbeitet:</b></td>
    <td class=tablea><?=$answered?>&nbsp;&nbsp;<?=$setanswered?></td>
  </tr>
  <tr>
    <td class="tableb" valign="top"><b>Nachricht:</b></td>
    <td class="tablea"><?=format_comment($arr4["msg"])?></td>
  </tr>
  <tr>
    <td class="tablea" style="text-align:center;" colspan="2">
<?php
   print(($arr4["sender"] ? "<a href=/staffbox.php?action=answermessage&receiver=" . $arr4["sender"] . "&answeringto=$iidee><input type=submit class=btn value=Antworten></a>" : "<input type=submit class=btn value=Antworten>") ."");
   ?>
</td>
  </tr>
    <?php
    end_table();
    end_frame();
    stdfoot();

}

//////////////////////////
// Antworten Ansehen //
//////////////////////////

if ($action == "viewanswer")
{

if (get_user_class() < UC_MODERATOR)
stderr("Fehler", "Zugriff Verweigert.");

$pmid = 0 + $_GET["pmid"];

$ress4 = mysql_query("SELECT id, subject, sender, added, msg, answeredby, answered, answer FROM staffmessages WHERE id=$pmid");
$arr4 = mysql_fetch_assoc($ress4);

$answeredby = $arr4["answeredby"];

$rast = mysql_query("SELECT username FROM users WHERE id=$answeredby");
$arr5 = mysql_fetch_assoc($rast);

if (is_valid_id($arr4["sender"]))
{
$res2 = mysql_query("SELECT username FROM users WHERE id=" . $arr4["sender"]) or sqlerr();
$arr2 = mysql_fetch_assoc($res2);
$sender = "<a href=userdetails.php?id=" . $arr4["sender"] . ">" . ($arr2["username"]?$arr2["username"]:"[Gelöscht]") . "</a>";
}
else
$sender = "System";

if ($arr4['subject'] == "") {
$subject = "No subject";
}

else {
$subject = "<a style='color: green' href=staffbox.php?action=viewpm&pmid=$pmid>$arr4[subject]</a>";
}


$iidee = $arr4["id"];

if ($arr4[answer] == "") {

$answer = "Diese Nachricht wurde bisher noch nicht beantwortet!";
}

else {

$answer = $arr4["answer"];
}


    stdhead("Antwort Ansicht");
    begin_frame("Antwort Ansehen", FALSE, "600px;");

$elapsed = get_elapsed_time(sql_timestamp_to_unix_timestamp($arr4["added"]));

    ?>

    <?php
    begin_table(TRUE);
    ?>
  <colgroup>
    <col width="50">
    <col>
  </colgroup>
  <tr>
    <td class="tablecat" colspan="2"><b>Betreff:</b> <?=$subject?></td>
  </tr>
  <tr>
    <td class="tableb"><b>Bearbeiter:</b></td>
    <td class="tablea"><b><a href=userdetails.php?id=<?=$answeredby?>><?=$arr5[username]?></a></b> beantwortete die Nachricht von <?=$sender?></td>
  </tr>
  <tr>
    <td class="tableb"><b>Erhalten:</b></td>
    <td class="tablea">vor <?=$elapsed?></td>
  </tr>
  <tr>
    <td class="tableb" valign="top"><b>Antwort:</b></td>
    <td class="tablea"><?=format_comment($answer)?></td>
  </tr>

    <?php
    end_table();
    end_frame();
    stdfoot();

}


//////////////////////////
// Beantwortung der Nachricht //
//////////////////////////

if ($action == "answermessage") {

if (get_user_class() < UC_MODERATOR)
stderr("Fehler", "Zugriff Verweigert");

$answeringto = $_GET["answeringto"];
$receiver = 0 + $_GET["receiver"];

if (!is_valid_id($receiver))
die;

$res = mysql_query("SELECT * FROM users WHERE id=$receiver") or die(mysql_error());
$user = mysql_fetch_assoc($res);

if (!$user)
stderr("Fehler", "Keinen User gefunden mit der ID.");

$res2 = mysql_query("SELECT * FROM staffmessages WHERE id=$answeringto") or die(mysql_error());
$array = mysql_fetch_assoc($res2);

stdhead("Antwort zur Team PM", false);

    begin_frame("Antwort zur Team PM", false, "600px;");
    ?>
<form action=?action=takeanswer method="post" name="message" enctype="multipart/form-data">
<? if ($_GET["returnto"] || $_SERVER["HTTP_REFERER"]) { ?>
<input type=hidden name=returnto value=<?=$_GET["returnto"] ? $_GET["returnto"] : $_SERVER["HTTP_REFERER"]?>>
<? } ?>
    <?php
    begin_table(TRUE);
    ?>
  <colgroup>
    <col width="50">
    <col>
  </colgroup>
  <tr>
    <td class="tableb" valign="top"><b>Nachricht:</b></td>
    <td class=tablea align=left input type=text style='padding: 0px'><? textbbcode("message","msg","$body")?></td>
  </tr>
  <tr>
    <td class="tableb"<?=$replyto?" colspan=2":""?> colspan=2 align=center><input type=submit value="Und ab!" class=btn>
     <input type=hidden name=receiver value=<?=$receiver?>>
     <input type=hidden name=answeringto value=<?=$answeringto?>>
     </form>
    </td>
  </tr>

    <?php
    end_table();
    end_frame();
    stdfoot();
}


//////////////////////////
// Antwort Abschicken //
//////////////////////////

$ress4 = mysql_query("SELECT staffmessages.subject FROM staffmessages ORDER BY id desc");
$arr4 = mysql_fetch_assoc($ress4);
$subject = $arr4["subject"];


if ($action == "takeanswer") {


if ($_SERVER["REQUEST_METHOD"] != "POST")
stderr("Fehler", "Methode");

if (get_user_class() < UC_MODERATOR)
stderr("Fehler", "Zugriff verweigert");

$receiver = 0 + $_POST["receiver"];
$answeringto = $_POST["answeringto"];

if (!is_valid_id($receiver))
stderr("Fehler","Falsche ID");

$userid = $CURUSER["id"];

$msg = trim($_POST["msg"]);

$message = sqlesc($msg);

$added = "'" . get_date_time() . "'";

if (!$msg)
stderr("Fehler","Bitte eine Nachricht eingeben!");

sendPersonalMessage($userid, $receiver, "Team-PM Antwort - " . $subject . "", "[size=2][b]" . $msg . "[/b][/size]", PM_FOLDERID_INBOX, 0);

mysql_query("UPDATE staffmessages SET answer=$message WHERE id=$answeringto") or sqlerr(__FILE__, __LINE__);

mysql_query("UPDATE staffmessages SET answered='1', answeredby='$userid' WHERE id=$answeringto") or sqlerr(__FILE__, __LINE__);

header("Location: staffbox.php?action=viewpm&pmid=$answeringto");
die;
}
//////////////////////////
// Lösche Team Nachrichten //
//////////////////////////

if ($action == "deletestaffmessage") {

$id = 0 + $_GET["id"];

if (!is_numeric($id) || $id < 1 || floor($id) != $id)
die;

if (get_user_class() < UC_ADMINISTRATOR)
stderr("Fehler", "Zugriff verweigert.");

mysql_query("DELETE FROM staffmessages WHERE id=" . sqlesc($id)) or die();

header("Location: $BASEURL/staffbox.php");
}

///////////////////////////////////
//Setze Nachricht als Beantwortet //
//////////////////////////////////

if ($action == "setanswered") {

if (get_user_class() < UC_MODERATOR)
stderr("Fehler", "Zugriff Verweigert.");

$id = 0 + $_GET["id"];

mysql_query ("UPDATE staffmessages SET answered=1, answeredby = $CURUSER[id] WHERE id = $id") or sqlerr();

header("Refresh: 0; url=staffbox.php?action=viewpm&pmid=$id");
}

/////////////////////////////////////////
// Setze Nachricht als Beantwortet  #2 //
////////////////////////////////////////

if ($action == "takecontactanswered") {

if (get_user_class() < UC_MODERATOR)
stderr("Fehler", "Zugriff Verweigert.");

$res = mysql_query ("SELECT id FROM staffmessages WHERE answered=0 AND id IN (" . implode(", ", $_POST[setanswered]) . ")");

while ($arr = mysql_fetch_assoc($res))
mysql_query ("UPDATE staffmessages SET answered=1, answeredby = $CURUSER[id] WHERE id = $arr[id]") or sqlerr();

header("Refresh: 0; url=staffbox.php");
}

?>