<?php
include_once $_SERVER['DOCUMENT_ROOT'] . '/../include/magicquotes.inc.php';

require_once $_SERVER['DOCUMENT_ROOT'] . '/../include/access.inc.php';

if (!userIsLoggedIn()) {
	include '../login.html.php';
	exit();
}

if (isset($_POST['add'])) {
	$action = 'addform';
	$text = '';
	$type = 'Presentation';
	$recipient = $_POST['recipient'];
	$button = 'Submit Critique';

	include $_SERVER['DOCUMENT_ROOT'] . '/../include/db.inc.php';

	// Build the full name of the recipient of this critique
	$sql = "SELECT firstname, lastname FROM user WHERE username='{$recipient}'";
	$result = mysqli_query($link, $sql);
	if (!$result) {
		$err = 'Error fetching recipient&rsquo;s full name.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}
    $row = mysqli_fetch_array($result);
	$fullname = $row['firstname'] . ' ' . $row['lastname'];
	$pagetitle = "New Critique for {$fullname}";

	include 'form.html.php';
	exit();
}

if (isset($_GET['addform'])) {
	include $_SERVER['DOCUMENT_ROOT'] . '/../include/db.inc.php';

	$recipient = mysqli_real_escape_string($link, $_POST['recipient']);
	$type = mysqli_real_escape_string($link, $_POST['type']);
	$text = mysqli_real_escape_string($link, $_POST['text']);
	$critic = $_SESSION['username'];

	if ($recipient == '') {
		$err = 'No recipient specified for this critique.
				Click &lsquo;back&rsquo; and try again.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}

	if ($type == '') {
		$err = 'No type specified for this critique.
				Click &lsquo;back&rsquo; and try again.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}

	$sql = "INSERT INTO critique SET
			critic='$critic',
			recipient='$recipient',
			type='$type',
			content='$text'";
	if (!mysqli_query($link, $sql)) {
		$err = 'Error storing submitted critique.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}

	header('Location: .');
	exit();
}

if (isset($_POST['edit'])) {
	include $_SERVER['DOCUMENT_ROOT'] . '/../include/db.inc.php';

	$id = mysqli_real_escape_string($link, $_POST['id']);
	$sql = "SELECT critic, recipient, type, content FROM critique WHERE id='$id'";
	$result = mysqli_query($link, $sql);
	if (!$result) {
		$err = 'Error fetching critique for editing.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}
	$row = mysqli_fetch_assoc($result);

	if ($row['critic'] != $_SESSION['username']) {
		$err = 'Invalid attempt to edit critique.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}

	// Build the full name of the recipient of this critique
	$recipient = $row['recipient'];
	$sql = "SELECT firstname, lastname FROM user WHERE username='{$recipient}'";
	$result = mysqli_query($link, $sql);
	if (!$result) {
		$err = 'Error fetching recipient&rsquo;s full name.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}
    $row2 = mysqli_fetch_assoc($result);
	$fullname = $row2['firstname'] . ' ' . $row2['lastname'];

	$pagetitle = "Edit Critique for {$fullname}";
	$action = 'editform';
	$text = $row['content'];
	$type = $row['type'];
	$recipient = $row['recipient'];
	$button = 'Update Critique';
	
	include 'form.html.php';
	exit();
}

if (isset($_GET['editform']))
{
	include $_SERVER['DOCUMENT_ROOT'] . '/../include/db.inc.php';

	$recipient = mysqli_real_escape_string($link, $_POST['recipient']);
	$type = mysqli_real_escape_string($link, $_POST['type']);
	$text = mysqli_real_escape_string($link, $_POST['text']);
	$id = mysqli_real_escape_string($link, $_POST['id']);
	$critic = $_SESSION['username'];

	if ($recipient == '') {
		$err = 'No recipient specified for this critique.
				Click &lsquo;back&rsquo; and try again.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}

	if ($type == '') {
		$err = 'No type specified for this critique.
				Click &lsquo;back&rsquo; and try again.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}

	$sql = "UPDATE critique SET
			critic='$critic',
			recipient='$recipient',
			type='$type',
			content='$text'
			WHERE id='$id'";
	if (!mysqli_query($link, $sql)) {
		$err = 'Error storing edited critique.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}

	header('Location: .');
	exit();
}

if (isset($_POST['action']) and $_POST['action'] == 'Delete') {
	include $_SERVER['DOCUMENT_ROOT'] . '/includes/db.inc.php';
	$id = mysqli_real_escape_string($link, $_POST['id']);

	// Delete category assignments for this joke
	$sql = "DELETE FROM jokecategory WHERE jokeid='$id'";
	if (!mysqli_query($link, $sql)) {
		$err = 'Error removing joke from categories.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}

	// Delete the joke
	$sql = "DELETE FROM joke WHERE id='$id'";
	if (!mysqli_query($link, $sql)) {
		$err = 'Error deleting joke.';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}

	header('Location: .');
	exit();
}

// Display listing of submitted critiques
include $_SERVER['DOCUMENT_ROOT'] . '/../include/db.inc.php';
$result = mysqli_query($link, "SELECT username, firstname, lastname FROM user WHERE active='1' AND admin='0' ORDER BY lastname");
if (!$result)
{
	$err = 'Error fetching users from database!';
	include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
	exit();
}

while ($row = mysqli_fetch_array($result))
{
	$rec = $row['username'];
	$uname = $_SESSION['username'];
	$result2 = mysqli_query($link, "SELECT critique.id, posted, content FROM critique 
							            INNER JOIN user ON critic=user.username 
										WHERE recipient='{$rec}' AND user.username='{$uname}'");
	/*
	print "SELECT critique.id, posted, content FROM critique 
							            INNER JOIN user ON critic=user.username 
										WHERE recipient='{$row[username]}'";
	die("\n\nDone");
	*/
	if (!$result2) {
		$err = 'Error fetching critiques from database!';
		include $_SERVER['DOCUMENT_ROOT'] . '/../include/errmsg.html.php';
		exit();
	}
	/*
	print_r(mysqli_fetch_assoc($result2));
	die("\n\nDone");
	*/
	$critiques = array();
	while ($crit = mysqli_fetch_assoc($result2)) {
		$critiques[] = $crit;
	}
	
	$users[] = array('recipient' => $row['username'], 
		             'firstname' => $row['firstname'], 
					 'lastname' => $row['lastname'], 
					 'critiques' => $critiques);
}

include 'listcritiques.html.php';
?>