<?php
/* MyTickets [   by = www.phpx3.com   ]
* Faha1ad2@hotmail.com
* Writed By : Fahad S. Al-ghudaier
* All Right Reseved (C) 2010
*/
session_start();
include("Admin_Function.php");
head('rtl','','');
includes();
check_session();

$language			= array();
$language['lang1']	= 'المعذرة ... يوجد خطأ بالمعطيات !!!';
$language['lang2']	= 'لايوجد أي أقسام مضافة ... هل تود <strong><a href="sections.php?step=add">إضافة قسم </a></strong> ?';
$language['lang3']	= 'المعذره ... لايوجد أي تذاكر بقاعدة البيانات للتحكم بها ';
$language['lang4']	= 'هل أنت متأكد من أنك تريد حذف التذاكر المُحددة ? ##################### ملاحظة : لايمكنك التراجع !';
$language['lang5']	= 'حذف التذاكر المُحددة';
$language['lang6']	= 'لا يوجد تحديد !';
$language['lang7']	= 'الرجوع ';
$language['lang8']	= 'يجب عليك كتابة الرمز للتذكرة , سيتم ارجاعك تلقائياً ';
$language['lang9']	= 'المعذرة ... التذكرة المطلوبة غير موجودة في قاعدة البيانات';

if($permission['allow_control'] == 1 OR $permission['top_man'] == 1){ }else{
	show("no_permission.php");
	down();
	die();
}
if(empty($_GET['step'])){
	redirect('admin.php',0);
	die();
}




if($_GET['step'] == 'control'){
	$all			= mysql_fetch_array(mysql_query("SELECT COUNT(`id`) AS `num` FROM `tickets`"));
	if($all == 0){
		echo '<div class="error">'.$language['lang3'].'</div>';
		down();
		die();
	}
	

	switch($_GET['do']){
	case 'unread':  	$GIVEN_T	= '&do=unread';		$GIVEN_Q = "WHERE `new`='1'";break;
	case 'open':		$GIVEN_T	= '&do=open';		$GIVEN_Q = "WHERE `status`='1'"; break;
	case 'closed':		$GIVEN_T	= '&do=closed';		$GIVEN_Q = "WHERE `status`='2'"; break;
	case 'important':	$GIVEN_T	= '&do=important';	$GIVEN_Q	= "WHERE `level`='1'"; break;
	case 'hold':		$GIVEN_T	= '&do=hold';		$GIVEN_Q	= "WHERE `status`='3'"; break;
	case 'section':
		$section_id	= $_GET['section_id'];
		if(! id_check($section_id,'section')){
			echo '<div class="error">'.$language['lang1'].'</div>';
			down();
			die();
		}
		$GIVEN_Q	= "WHERE `section_id`='".$section_id."'";
	break;
	case 'member':
		$member_id	= $_GET['member_id'];
		if(! id_check($member_id,'members')){
			echo '<div class="error">'.$language['lang1'].'</div>';
			down();
			die();
		}
		$GIVEN_Q	= "WHERE `user_id`='".$member_id."'";
	break;
	default:
	break;
	}
	
	

	$page = intval($_GET['page']);
	if($page == 0 OR $page == '' OR !is_numeric($page)){ $page = 1; $start=0; }
	$limit = 20;
	if($page) $start = ($page - 1) * $limit; else
	$start = 0;	
	$targetpage = 'tickets.php?step=control'.$GIVEN_T;
	$adjacents = 10;		
	$xquery = "SELECT COUNT(`id`) as num FROM `tickets` ".$GIVEN_Q."";
	$total_pages = mysql_fetch_array(mysql_query($xquery));
	$total_pages = $total_pages[num];
	$prev = $page - 1;
	$next = $page + 1;
	$lastpage = ceil($total_pages/$limit);
	$lpm1 = $lastpage - 1;
	
	if($permission['top_man'] == 1 OR $permission['allowed_sections'] == 'all' ){
		$sections_query	= mysql_query("SELECT `id`,`title` FROM `section`");
		$ADD_SQL	= '';
	}else{
		$ADD_SQL	= "AND `section_id` IN (".$permission['allowed_sections'].")";
		$sections_query	= mysql_query("SELECT `id`,`title` FROM `section` WHERE `id` IN (".$permission['allowed_sections'].")");
	}

	switch($_GET['do']){
	case 'unread':
		$query		= mysql_query("SELECT `id`,`subject`,`status`,`user_id`,`new`,`level`,`section_id`  FROM `tickets` WHERE `new`='1' ".$ADD_SQL." ORDER BY `id` DESC LIMIT $start,$limit");
		$num		= mysql_num_rows(mysql_query("SELECT `id` FROM `tickets` WHERE `new`='1' ".$ADD_SQL.""));
		$GIVEN_T	= '&do=unread';
		$GIVEN_Q	= "WHERE `new`='1'";
	break;
	case 'open':
		$query		= mysql_query("SELECT `id`,`subject`,`status`,`user_id`,`new`,`level`,`section_id`  FROM `tickets` WHERE `status`='1' ".$ADD_SQL." ORDER BY `id` DESC LIMIT $start,$limit");
		$num		= mysql_num_rows(mysql_query("SELECT `id` FROM `tickets` WHERE `status`='1' ".$ADD_SQL.""));
		$GIVEN_T	= '&do=open';
		$GIVEN_Q	= "WHERE `status`='1'";
	break;
	case 'closed':
		$query		= mysql_query("SELECT `id`,`subject`,`status`,`user_id`,`new`,`level`,`section_id`  FROM `tickets` WHERE `status`='2' ".$ADD_SQL." ORDER BY `id` DESC LIMIT $start,$limit");
		$num		= mysql_num_rows(mysql_query("SELECT `id` FROM `tickets` WHERE `status`='2' ".$ADD_SQL.""));
		$GIVEN_T	= '&do=closed';
		$GIVEN_Q	= "WHERE `status`='2'";
	break;
	case 'important':
		$query		= mysql_query("SELECT `id`,`subject`,`status`,`user_id`,`new`,`level`,`section_id`  FROM `tickets` WHERE `level`='1' ".$ADD_SQL." ORDER BY `id` DESC LIMIT $start,$limit");
		$num		= mysql_num_rows(mysql_query("SELECT `id` FROM `tickets` WHERE `level`='1' ".$ADD_SQL.""));
		$GIVEN_T	= '&do=important';
		$GIVEN_Q	= "WHERE `level`='1'";
	break;
	case 'section':
		$query		= mysql_query("SELECT `id`,`subject`,`status`,`user_id`,`new`,`level`,`section_id`  FROM `tickets` WHERE `section_id`='".$section_id."' ".$ADD_SQL." ORDER BY `id` DESC LIMIT $start,$limit");
		$num		= mysql_num_rows(mysql_query("SELECT `id` FROM `tickets` WHERE `section_id`='".$section_id."' ".$ADD_SQL.""));
		$GIVEN_Q	= "WHERE `section_id`='".$section_id."'";
	break;
	case 'member':
		$query		= mysql_query("SELECT `id`,`subject`,`status`,`user_id`,`new`,`level`,`section_id`  FROM `tickets` WHERE `user_id`='".$member_id."' ".$ADD_SQL." ORDER BY `id` DESC LIMIT $start,$limit");
		$num		= mysql_num_rows(mysql_query("SELECT `id` FROM `tickets` WHERE `user_id`='".$member_id."' ".$ADD_SQL.""));
		$GIVEN_Q	= "WHERE `user_id`='".$member_id."'";
	break;
	default:
		$query	= mysql_query("SELECT `id`,`subject`,`status`,`user_id`,`new`,`level`,`section_id` FROM `tickets` ".str_replace('AND','WHERE',$ADD_SQL)." ORDER BY `id` DESC LIMIT $start,$limit");
		$num	= mysql_num_rows(mysql_query("SELECT `id` FROM `tickets` ".str_replace('AND','WHERE',$ADD_SQL).""));
	break;
	}

	show('tickets_control.php');

	$pagination = "";
	if($lastpage > 1)
	{	
		$pagination .= "<div class=\"pagination\">";
		//previous button
		if ($page > 1) 
			$pagination.= "<a href=\"$targetpage&page=$prev\">« السابق</a>";
		else
			$pagination.= "<span class=\"disabled\">« السابق</span>";	
		
		//pages	
		if ($lastpage < 7 + ($adjacents * 2))	//not enough pages to bother breaking it up
		{	
			for ($counter = 1; $counter <= $lastpage; $counter++)
			{
				if ($counter == $page)
					$pagination.= "<span class=\"current\">$counter</span>";
				else
					$pagination.= "<a href=\"$targetpage&page=$counter\">$counter</a>";					
			}
		}
		elseif($lastpage > 5 + ($adjacents * 2))	//enough pages to hide some
		{
			//close to beginning; only hide later pages
			if($page < 1 + ($adjacents * 2))		
			{
				for ($counter = 1; $counter < 4 + ($adjacents * 2); $counter++)
				{
					if ($counter == $page)
						$pagination.= "<span class=\"current\">$counter</span>";
					else
						$pagination.= "<a href=\"$targetpage?page=$counter\">$counter</a>";					
				}
				$pagination.= "...";
				$pagination.= "<a href=\"$targetpage&page=$lpm1\">$lpm1</a>";
				$pagination.= "<a href=\"$targetpage?page=$lastpage\">$lastpage</a>";		
			}
			//in middle; hide some front and some back
			elseif($lastpage - ($adjacents * 2) > $page && $page > ($adjacents * 2))
			{
				$pagination.= "<a href=\"$targetpage&page=1\">1</a>";
				$pagination.= "<a href=\"$targetpage&page=2\">2</a>";
				$pagination.= "...";
				for ($counter = $page - $adjacents; $counter <= $page + $adjacents; $counter++)
				{
					if ($counter == $page)
						$pagination.= "<span class=\"current\">$counter</span>";
					else
						$pagination.= "<a href=\"$targetpage&page=$counter\">$counter</a>";					
				}
				$pagination.= "...";
				$pagination.= "<a href=\"$targetpage&page=$lpm1\">$lpm1</a>";
				$pagination.= "<a href=\"$targetpage&page=$lastpage\">$lastpage</a>";		
			}
			//close to end; only hide early pages
			else
			{
				$pagination.= "<a href=\"$targetpage&page=1\">1</a>";
				$pagination.= "<a href=\"$targetpage&page=2\">2</a>";
				$pagination.= "...";
				for ($counter = $lastpage - (2 + ($adjacents * 2)); $counter <= $lastpage; $counter++)
				{
					if ($counter == $page)
						$pagination.= "<span class=\"current\">$counter</span>";
					else
						$pagination.= "<a href=\"$targetpage&page=$counter\">$counter</a>";					
				}
			}
		}
		
		//next button
		if ($page < $counter - 1) 
			$pagination.= "&nbsp;&nbsp;<a href=\"$targetpage&page=$next\">التالي »</a>";
		else
			$pagination.= "&nbsp;&nbsp;<span class=\"disabled\">التالي »</span>";
		$pagination.= "</div>\n";		
	}

	if($all > 20){
	echo '<br />',$pagination,'<br />';
	}
	?>
	<br />
	<input  onclick="javascript:return confirm('<?= $language['lang4']; ?>')" type="submit" 
	name="submit" value="<?= $language['lang5']; ?>" /> 
<?php
	
	
}






if($_GET['step'] == 'delete_one'){
	$id	= $_GET['id'];
	if(! id_check($id,'tickets')){
		echo '<div class="error">'.$language['lang1'].'</div>';
		down();
		die();
	}
	
	$delete	= mysql_query("DELETE FROM `reply` WHERE `ticket_id`='".$id."'");
	$delete2= mysql_query("DELETE FROM `tickets` WHERE `id`='".$id."'");
	
	$to	= $_GET['to'];
	if(empty($to)){
		$to	= 'tickets.php?step=control';
	}else{
		$to	= replace_to($to);
	}
	if($delete2){
		ok($to,3);
	}else{
		echo mysql_error();
	}
}



if($_GET['step'] == 'delete_group'){

	$to = $_GET['to'];
	if(!isset($to)){
		$to = 'tickets.php?step=control';
	}else{
		$to	= replace_to($to);
	}
	$Array = $_POST['id'];
	if(! is_array($Array)){
		echo '<div class="error">'.$language['lang6'].'<br />&lt;&lt; <a href="'.$to.'">'.$language['lang7'].'</a></div>';
		down();
		die();
	}else{
		$Array		= mysql_real_escape_string(@implode(',',$Array));
		$DELETE		= mysql_query("DELETE FROM `tickets` WHERE `id` IN ($Array)");
		$DELETE2	= mysql_query("DELETE FROM `reply` WHERE `ticket_id` IN ($Array)");
			if($DELETE){
				ok($to);
			}else{
				echo mysql_error();
			}
	}

}





if($_GET['step'] == 'read'){
	$id	= $_GET['id'];
	if(! id_check($id,'tickets')){
		echo '<div class="error">'.$language['lang1'].'</div>';
		down();
		die();
	}
	
	
	$query		= mysql_query("SELECT * FROM `tickets` WHERE `id`='".$id."'");
	$rows		= mysql_fetch_array($query);
	if(empty($rows['first_read'])){
		$update		= mysql_query("UPDATE `tickets` SET `first_read`='".$_SESSION['member_id']."' WHERE `id`='".$id."'");
	}
	
	if($permission['top_man'] == 1 OR $permission['allowed_sections'] == 'all' ){
	}else{
		$permission['allowed_sections']	= explode(',',$permission['allowed_sections']);
		if(! $rows['section_id'] == $permission['allowed_sections'] OR ! in_array($rows['section_id'],$permission['allowed_sections'])){
				show("no_permission.php");
				down();
				die();
		}
	}
	
	
	$r_num		= mysql_num_rows(mysql_query("SELECT `id` FROM `reply` WHERE `ticket_id`='".$id."'"));
	
	$update		= mysql_query("UPDATE `tickets` SET `new`='2' WHERE `id`='".$rows['id']."'");
	show('ticket_read.php');
}





if($_GET['step'] == 'update'){
	$id	= $_GET['id'];
	if(! id_check($id,'tickets')){
		echo '<div class="error">'.$language['lang1'].'</div>';
		down();
		die();
	}
	
	$status		= $_POST['status'];
	$level		= $_POST['level'];
	$section_id	= $_POST['section_id'];
	
	$to = $_GET['to'];
	if(!isset($to)){
		$to = 'tickets.php?step=control';
	}else{
		$to	= replace_to($to);
	}
	
	$update	= mysql_query("UPDATE `tickets` SET `status`='".$status."',
	`level`='".$level."',`section_id`='".$section_id."' WHERE `id`='".$id."'");
	
	if($update){
		ok($to,3);
	}else{
		echo mysql_error();
	}
}



if($_GET['step'] == 'reply'){
	$id	= $_GET['id'];
	if(! id_check($id,'tickets')){
		echo '<div class="error">'.$language['lang1'].'</div>';
		down();
		die();
	}

	$posted['id']		= addslashes($_GET['id']);
	$posted['text']		= text_handler($_POST['text']);
	$posted['ip']		= $_SERVER['REMOTE_ADDR'];
	$posted['date']		= date("F j, Y, g:i a");
	
	
	$to = $_GET['to'];
	if(!isset($to)){
		$to = 'tickets.php?step=control';
	}else{
		$to	= replace_to($to);
	}
	
	$posted['mid'] = $_SESSION['member_id'];
	
	$insert	= mysql_query("INSERT INTO `reply` (`subject`,`text`,`ticket_id`,`user_id`,`name`,`email`,`ip`,`date`) VALUES (
	'".$posted['subject']."','".$posted['text']."','".$posted['id']."',
	'".$posted['mid']."','".$posted['name']."','".$posted['email']."',
	'".$posted['ip']."','".$posted['date']."')");
	
	$uptodate	= mysql_query("UPDATE `tickets` SET `status`='1' WHERE `id`='".$posted['id']."'");
	
	if($insert){
			$aq				= mysql_fetch_array(mysql_query("SELECT `email` FROM `members` WHERE `id`='1'"));
			$AdminEmail		= $aq['email'];
			$options		= mysql_fetch_array(mysql_query("SELECT `id`,`site_name`,`site_url`,`main_language` FROM `option` WHERE `id`='1'"));
			
			$iticket		= mysql_fetch_array(mysql_query("SELECT `id`,`user_id`,`subject`,`code`,`name`,`email` FROM `tickets` WHERE `id`='".$posted['id']."'"));
			if(! $iticket['user_id'] == 0){
				$imember		= mysql_fetch_array(mysql_query("SELECT `id`,`username`,`email`,`language` FROM `members` WHERE `id`='".$iticket['user_id']."'"));
				
				$ilanguage		= mysql_query("SELECT * FROM `languages` WHERE `id`='".$imember['language']."'");
				if(mysql_num_rows($ilanguage) == 0 OR empty($imember['language'])){
					$ilanguage	= mysql_query("SELECT * FROM `languages` WHERE `id`='".$options['main_language']."'");
				}
			}else{
				$imember['username']		= $iticket['name'];
				$imember['email']			= $iticket['email'];
				$ilanguage	= mysql_query("SELECT * FROM `languages` WHERE `id`='".$options['main_language']."'");
			}
			
			$flanguage		= mysql_fetch_array($ilanguage);
			include('../languages/'.$flanguage['file']);
			
		$mail				= array();
		$mail['from_email']	= $AdminEmail;
		$mail['to_email']	= $imember['email'];
		$mail['to_name']	= $imember['username'];
		$mail['subject']	= $language['email3s'];
		$text				= email_codes($language['email3'],$posted['name'],$iticket['code']);
			
		mytickets_mail($options['site_name'],$AdminEmail,$imember['username'],$imember['email'],$language['email3s'],$text,1);
		
		ok($to,3);
	}else{
		echo mysql_error();
	}
}



if($_GET['step'] == 'make_new'){
	$id	= $_GET['id'];
	if(! id_check($id,'tickets')){
		echo '<div class="error">'.$language['lang1'].'</div>';
		down();
		die();
	}
	
	$update	= mysql_query("UPDATE `tickets` SET `new`='1' WHERE `id`='".$id."'");	
	
	$to	= $_GET['to'];
	if(empty($to)){
		$to	= 'tickets.php?step=control';
	}else{
		$to	= replace_to($to);
	}
	if($update){
		ok($to,3);
	}else{
		echo mysql_error();
	}
}



if($_GET['step'] == 'find_ticket'){
	$code	= addslashes(trim($_POST['code']));
	if(empty($code)){
		echo '<div class="error">'.$language['lang8'].'</div>';
		redirect('admin.php',3);
		down();
		die();
	}else{
		$query	= mysql_query("SELECT `id` FROM `tickets` WHERE `code`='".$code."'");
		if(mysql_num_rows($query) == 1){
		$fetch	= mysql_fetch_array($query);
		$ID		= $fetch['id'];
			ok('tickets.php?step=edit&id='.$ID.'',3);
		}else{
			echo '<div class="error">'.$language['lang9'].'</div>';
			redirect('admin.php',3);
			down();
			die();
			}
	}
}
down();
?>