<?php
session_start();
/* All Right Reserved (C) 2010;
  MyTickets;
  Writed By Fahad S. Al-ghudaier;
  faha1ad2@hotmail.com;
  www.phpx3.com;
*/
	include('start.php');
	include('include/system/arrays.php');

	# dos is array that hold the steps
	$dos	= array('control','add','code','update','reply','insert','read','html','text','rating');
	
	$do		= $_GET['do'];
	# if he got to wrong place the he well redirected to control page automaticly
	if(! in_array($do,$dos)){
		$do	= 'control';
	}
	
	if(empty($_GET['pagen']) OR ! is_numeric($_GET['pagen'])){ $pagen = 1; }else{ $pagen = $_GET['pagen']; }
	# now we well set the pages titles
	switch($do){
	case 'control': $page['title']	= $language['lang_20'].' '.$language['page'].' : '.$pagen; break;
	case 'add': 	$page['title']	= $language['lang_19']; break;
	case 'insert': 	$page['title']	= $language['lang_19']; break;
	case 'code': 	$page['title']	= $language['lang_21']; break;
	case 'update': 	$page['title']	= $language['lang_22']; break;
	case 'reply': 	$page['title']	= $language['lang_23']; break;
	case 'read': 	$page['title']	= $language['lang_30']; break;
	}
	
	$page['allow_metas']	= 2;
	$page['other_tags']		= '
	<script type="text/javascript" language="javascript" src="'.$options['site_url'].'/include/js/jquery.js"></script>
	<script type="text/javascript" language="javascript" src="'.$options['site_url'].'/include/js/jquery.rating.js"></script>';
	$page['show_header']	= 1;
	include('content_head.php');


	
	switch($do){
	case 'control':
	# check if he is not a logged member
	if($member['member'] == 2){
		$smarty->assign('msg',$language['lang_33']);
		$smarty->display('error_msg.htm');
		include('content_foot.php');
		die();
	}
	
	# pageination
	$TABLE	= 'tickets';
	$WHERE	= "WHERE `user_id`='".$member['id']."'";
	include('include/system/pagination.php');
	
	#get his tickets
	$query	= mysql_query("SELECT `id`,`subject`,`status`,`section_id`,`date`,`level` FROM `tickets` WHERE `user_id`='".$member['id']."' ORDER BY `id` DESC LIMIT $start,$limit");
	# if he dont add any tickets ?
	if(mysql_num_rows($query) == 0){
		$smarty->assign('msg',$language['lang_333']);
		$smarty->display('error_msg.htm');
		redirect('tickets.php?do=add',5);
		include('content_foot.php');
		die();
	}else{
	#if there is a tickets , get them
		while($rows	= mysql_fetch_array($query)){
			$s_q				= mysql_fetch_array(mysql_query("SELECT `id`,`title` FROM `section` WHERE `id`='".$rows['section_id']."'"));
			$rows['section']	= $s_q['title'];
			
			switch($rows['level']){
				case 1: $rows['l_c'] = 'level1'; break;
				case 2: $rows['l_c'] = 'level2'; break;
				case 3: $rows['l_c'] = 'level2'; break;
			}
			switch($rows['status']){
				case 1: $rows['s_c'] = 'status1'; break;
				case 2: $rows['s_c'] = 'status2'; break;
				case 3: $rows['s_c'] = 'status3'; break;
			}
			
			$rows['level']		= level_replacer($rows['level']);
			$rows['status']		= status_replacer($rows['status']);
			
			$tickets[]			= $rows;
		}
	}
	
	
	$smarty->assign('tickets',$tickets);
	$smarty->display('ticket_control.htm');
	
	
	break;
	
	
	
	
	/* =================== NEW DO ==================== */
	case 'add':
	if($permission['allow_add'] == 2 OR ! $permission['top_man'] == 1){ no_permission(); }
	include('include/system/sections.query.php');
	$smarty->assign('sections',$sections);
	$smarty->display('ticket_add.htm');
	break;
	
	
	
	/* =================== NEW DO ==================== */
	
	case 'insert':
	# if he dont have the permission to add tickets
	if($permission['allow_add'] == 2 OR ! $permission['top_man'] == 1){ no_permission(); }
	# get the sections query ; and assign it to smarty
	include('include/system/sections.query.php');
	$smarty->assign('sections',$sections);
	# get the added ticket info.
	$posted['subject']		= input_handler($_POST['subject']);
	$posted['status']		= 3;
	$posted['code']			= rand(000000,999999).'-'.substr(md5(rand(000000,999999)),0,6);
	$posted['text']			= text_handler($_POST['text']);
	$posted['section_id']	= intval($_POST['section_id']);
	$posted['user_id']		= $member['id'];
	$posted['name']			= input_handler($_POST['name']);
	$posted['email']		= $_POST['email'];
	$posted['ip']			= $_SERVER['REMOTE_ADDR'];
	$posted['date']			= date("F j, Y, g:i a");
	$posted['level']		= $_POST['level'];
	$posted['captcha']		= $_POST['captcha'];
	
	# he didnt write a subject for the ticket ?
	if(empty($posted['subject']) OR empty($posted['text'])){
		$error['error']	= 1;
		$error['msg']	= $language['lang_3'];
		$smarty->assign('error',$error);
		$smarty->assign('posted',$posted);
		$smarty->display('ticket_add.htm');
		include('content_foot.php');
		die();
	}
	
	if($member['member'] == 2){
		$posted['user_id']	= 0;
		if(empty($posted['name']) OR empty($posted['email'])){
			$error['error']	= 1;
			$error['msg']	= $language['lang_3'];
			$smarty->assign('error',$error);
			$smarty->assign('posted',$posted);
			$smarty->display('ticket_add.htm');
			include('content_foot.php');
			die();
		}
		if(check($posted['email'],'email') == false){
			$error['error']	= 1;
			$error['msg']	= $language['lang_4'];
			$smarty->assign('error',$error);
			$smarty->assign('posted',$posted);
			$smarty->display('ticket_add.htm');
			include('content_foot.php');
			die();
		}
		if($options['allow_captcha'] == 1){
			if(empty($posted['captcha']) OR $posted['captcha'] != $_SESSION['captchacode'] OR $_SESSION["captchacode"]=='') {
				$error['error']	= 1;
				$error['msg']	= $language['lang_6'];
				$smarty->assign('error',$error);
				$smarty->assign('posted',$posted);
				$smarty->display('ticket_add.htm');
				include('content_foot.php');
				die();
			}
		}
	}
	
	$insert	= mysql_query("INSERT INTO `tickets` (`subject`,`code`,`status`,`text`,`section_id`,`user_id`,`name`,
	`email`,`ip`,`date`,`level`) VALUES (
	'".$posted['subject']."','".$posted['code']."','".$posted['status']."','".$posted['text']."',
	'".$posted['section_id']."','".$posted['user_id']."','".$posted['name']."','".$posted['email']."','".$posted['ip']."','".$posted['date']."',
	'".$posted['level']."')");
	
	if($insert){
			$ID				= mysql_insert_id();
			$aq				= mysql_fetch_array(mysql_query("SELECT `username`,`email` FROM `members` WHERE `id`='1'"));
			$AdminEmail		= $aq['email'];
			$AdminName		= $aq['username'];
			$query			= mysql_fetch_array(mysql_query("SELECT `id`,`code` FROM `tickets` WHERE `id`='".$ID."'"));
			$ticket_code	= $query['code'];
			global $ticket_code;
			
		$mail				= array();
		$mail['from_email']	= $AdminEmail;
		$mail['to_email']	= $posted['email'];
		$mail['to_name']	= $posted['name'];
		$mail['subject']	= $posted['subject'];
		$text				= email_codes($language['email1'],$posted['name'],$ticket_code);
		
		mytickets_mail($options['site_name'],$AdminEmail,$posted['name'],$posted['email'],$language['email1s'],email_codes($language['email1'],$posted['name'],$ticket_code));
		if(! isset($SENT)){ $SENT	= $GLOBALS['sent']; }
		$sec	= 5;
		if($SENT	== 1){
			$sec	= 5;
			$show_i	= 2;
		}elseif($SENT == 2 AND $member['member'] == 2){
			$sec	= 12;
			$show_i	= 1;
		}
	
		# Tell The Administrator
		$mail				= array();
		$mail['from_email']	= $AdminEmail;
		$mail['to_email']	= $AdminEmail;
		$mail['to_name']	= $AdminName;
		$mail['subject']	= $language['email4s'];
		$text				= email_codes($language['email4'],$AdminName,$ticket_code);
		
		mytickets_mail($options['site_name'],$AdminEmail,$AdminName,$AdminEmail,
		$language['email4s'],$text);
		# End 
		
		
		$_SESSION['allowed_'.$ID.''] = 1;
		$smarty->assign('msg',$language['lang_27']);
		$smarty->display('ok_msg.htm');
		if($member['member'] == 2){
		$smarty->assign('notice',str_replace('[code]','<input type="text" value="'.$ticket_code.'" style="width: 100px" />',$language['lang_37']));
		$smarty->display('notice.htm');
		}
		redirect('tickets.php?do=read&id='.$ID.'',$sec);
	}else{
		$error['error']	= 1;
		$error['msg']	= $language['lang_26'];
		$smarty->assign('error',$error);
		$smarty->assign('posted',$posted);
		$smarty->display('ticket_add.htm');
		include('content_foot.php');
		die();
	}
	
	break;
	
	
	
	
	/* =================== NEW DO ==================== */
	
	case 'code':
	$code	= addslashes(strip_tags($_GET['code']));
	if($code == ''){
		$smarty->display('ticket_find.htm');
	}else{
		$look	= mysql_query("SELECT `id` FROM `tickets` WHERE `code`='".$code."'");
		if(mysql_num_rows($look) == 0){
			$smarty->assign('msg',$language['lang_24']);
			$smarty->display('ticket_find.htm');
			include('content_foot.php');
			die();
		}else{
			$ticket	= mysql_fetch_array($look);
			$_SESSION['allowed_'.$ticket['id'].'']	= 1;
			$smarty->assign('msg',$language['lang_25']);
			$smarty->display('ok_msg.htm');
			redirect('tickets.php?do=read&id='.$ticket['id']);
		}
	}
	
	
	break;
	
	
	
	
	/* =================== NEW DO ==================== */
	
	case 'update':
	//$status	= $_POST['status'];
	//$statuss= array('1','2','3');
	//$level	= $_POST['level'];
	//$levels	= array('1','2','3');
	$id		= addslashes($_POST['id']);
	
	/* if the id is not right or doesnt exist */
	if(empty($id) OR  check($id,'numeric') == false OR mysql_num_rows(mysql_query("SELECT `id` FROM `tickets` WHERE `id`='".$id."'")) == 0){
			$smarty->assign('msg',$language['lang_31']);
			$smarty->display('error_msg.htm');
			include('content_foot.php');
			die();
	}
		
	
	/* get the ticket info to check the user id */
	$query	= mysql_query("SELECT `id`,`user_id` FROM `tickets` WHERE `id`='".$id."'");
	$rows	= mysql_fetch_array($query);
	
	/* if he is not own the tickets , or he is not allowed here */
	if($member['member'] == 2 AND ! $_SESSION['allowed_'.$id.''] == 1){
			$msg	= $language['lang_34'];
			$smarty->assign('msg',$msg);
			$smarty->display('error_msg.htm');
			include('content_foot.php');
			die();
	}
	if($member['member'] == 1 AND ! $member['id'] == $rows['user_id']){
			$msg	= $language['lang_34'];
			$smarty->assign('msg',$msg);
			$smarty->display('error_msg.htm');
			include('content_foot.php');
			die();
	}
	
	/* it's ok , update the ticket */
	$update	= mysql_query("UPDATE `tickets` SET `status`='2' WHERE `id`='".$id."'");
	
	
	if($update){
		$smarty->assign('msg',$language['lang_16']);
		$smarty->display('ok_msg.htm');
		redirect('tickets.php?do=read&id='.$id.'');
	}else{
		$smarty->assign('msg',$language['lang_29']);
		$smarty->display('error_msg.htm');
		redirect('tickets.php?do=read&id='.$id.'',4);
	}
	
	break;
	
	
	
	
	
	/* =================== NEW DO ==================== */
	
	case 'reply':
	$posted['id']		= addslashes($_POST['id']);
	$posted['text']		= text_handler($_POST['text']);
	$posted['name']		= input_handler($_POST['name']);
	$posted['email']	= trim($_POST['email']);
	$posted['ip']		= $_SERVER['REMOTE_ADDR'];
	$posted['date']		= date("F j, Y, g:i a");
	
	if($member['member'] == 2 AND ! $_SESSION['allowed_'.$posted['id'].''] == 1){
			$error['error']	= 1;
			$error['msg']	= $language['lang_33'];
			$smarty->assign('error',$error);
			$smarty->assign('posted',$posted);
			$smarty->display('ticket_reply.htm');
			include('content_foot.php');
			die();
	}

	if(empty($posted['id']) OR  check($posted['id'],'numeric') == false OR mysql_num_rows(mysql_query("SELECT `id` FROM `tickets` WHERE `id`='".$posted['id']."'")) == 0){
			$error['error']	= 1;
			$error['msg']	= $language['lang_31'];
			$smarty->assign('error',$error);
			$smarty->assign('posted',$posted);
			$smarty->display('ticket_reply.htm');
			include('content_foot.php');
			die();
	}
	
	if(empty($posted['text']) OR check($posted['text'],'count',5) == false){
			$error['error']	= 1;
			$error['msg']	= $language['lang_32'];
			$smarty->assign('error',$error);
			$smarty->assign('posted',$posted);
			$smarty->display('ticket_reply.htm');
			include('content_foot.php');
			die();
	}
	if($member['member'] == 2){
		$posted['mid']		= 0;
		$posted['captcha']	= $_POST['captcha'];
		if(empty($posted['name']) OR check($posted['name'],'count',3) == false){
			$error['error']	= 1;
			$error['msg']	= $language['lang_3'];
			$smarty->assign('error',$error);
			$smarty->assign('posted',$posted);
			$smarty->display('ticket_reply.htm');
			include('content_foot.php');
			die();
		}
		if(empty($posted['email']) OR check($posted['email'],'email') == false){
			$error['error']	= 1;
			$error['msg']	= $language['lang_4'];
			$smarty->assign('error',$error);
			$smarty->assign('posted',$posted);
			$smarty->display('ticket_reply.htm');
			include('content_foot.php');
			die();
		}
		if($posted['captcha'] != $_SESSION['captchacode'] OR $_SESSION["captchacode"]=='') {
			$error['error']	= 1;
			$error['msg']	= $language['lang_6'];
			$smarty->assign('error',$error);
			$smarty->assign('posted',$posted);
			$smarty->display('ticket_reply.htm');
			include('content_foot.php');
			die();
		}
	}else{
		$posted['mid']	= $member['id'];

	}
	
	$ch	= mysql_fetch_array(mysql_query("SELECT `id`,`status` FROM `tickets` WHERE `id`='".$posted['id']."'"));
	if($ch['status'] == 2){
		no_permission();
	}
	
	$insert	= mysql_query("INSERT INTO `reply` (`subject`,`text`,`ticket_id`,`user_id`,`name`,`email`,`ip`,`date`) VALUES (
	'".$posted['subject']."','".$posted['text']."','".$posted['id']."',
	'".$posted['mid']."','".$posted['name']."','".$posted['email']."',
	'".$posted['ip']."','".$posted['date']."')");
	
	if($insert){
		$uptodate	= mysql_query("UPDATE `tickets` SET `status`='3' WHERE `id`='".$posted['id']."'");
		$smarty->assign('msg',$language['lang_35']);
		$smarty->display('ok_msg.htm');
		redirect('tickets.php?do=read&id='.$posted['id'].'');
	}else{
			$error['error']	= 1;
			$error['msg']	= $language['lang_36'];
			$smarty->assign('error',$error);
			$smarty->assign('posted',$posted);
			$smarty->display('ticket_reply.htm');
			include('content_foot.php');
			die();
	}
	
	
	break;
	case 'read':
	# get the id
	# check about the id
	# get the ticket
	# check if he owns it
	# get replys
	
	$id	= addslashes($_GET['id']);
	
	if($member['member'] == 2 AND ! $_SESSION['allowed_'.$id.''] == 1){
			$msg	= $language['lang_34'];
			$smarty->assign('msg',$msg);
			$smarty->display('error_msg.htm');
			include('content_foot.php');
			die();
	}

	if(empty($id) OR check($id,'numeric') == false OR mysql_num_rows(mysql_query("SELECT `id` FROM `tickets` WHERE `id`='".$id."'")) == 0){
			$msg	= $language['lang_31'];
			$smarty->assign('msg',$msg);
			$smarty->display('error_msg.htm');
			include('content_foot.php');
			die();
	}
	
	$query				= mysql_query("SELECT * FROM `tickets` WHERE `id`='".$id."'");
	$rows				= mysql_fetch_array($query);
	$u_q				= mysql_fetch_array(mysql_query("SELECT `username`,`website`,`group_id` FROM `members` WHERE `id`='".$rows['user_id']."'"));
	$g_q				= mysql_fetch_array(mysql_query("SELECT `name` FROM `groups` WHERE `id`='".$u_q['group_id']."'"));
	$rows['username']	= $u_q['username'];
	$rows['usersite']	= $u_q['website'];
	$rows['group']		= $g_q['name'];

	if($member['member'] == 1 AND  $member['id'] != $rows['user_id'] AND ! $_SESSION['allowed_'.$id.''] == 1){
			$msg	= $language['lang_34'];
			$smarty->assign('msg',$msg);
			$smarty->display('error_msg.htm');
			include('content_foot.php');
			die();
	}
	
	$reply_query	= mysql_query("SELECT * FROM `reply` WHERE `ticket_id`='".$rows['id']."'");
	$replys			= mysql_num_rows($reply_query);
	
	if($replys > 0){
		while($row	= mysql_fetch_array($reply_query)){
			$user				= mysql_fetch_array(mysql_query("SELECT `id`,`username`,`group_id`,`ip` FROM `members` WHERE `id`='".$row['user_id']."'"));
			
			if($row['user_id'] == 0){
				$group				= mysql_fetch_array(mysql_query("SELECT `id`,`name` FROM `groups` WHERE `id`='".$options['main_group']."'"));
			}else{
				$group				= mysql_fetch_array(mysql_query("SELECT `id`,`name` FROM `groups` WHERE `id`='".$user['group_id']."'"));
			}
			
			
			if($row['user_id'] == 0){
				$row['username']	= $row['name'];
			}else{
				$row['username']	= $user['username'];
			}
			
			$row['group']		= $group['name'];
			$reply[]			= $row;
		}
	}
	
	$smarty->assign('ticket',$rows);
	$smarty->assign('replys',$replys);
	$smarty->assign('reply',$reply);
	
	$smarty->display('ticket_read.htm');
			
	
	break;
	case 'rating':
	if($options['allow_rate'] == 1){
		# Original By Saleh [saphplesson Script ]
		if ($_SERVER['REQUEST_METHOD']=='POST'){
				$star1 = intval($_POST['star1']);
				$id    = intval($_POST['id']);
				if($id){
						$Query = mysql_query("UPDATE `members` SET `votes`=votes+1, rate=rate+$star1 WHERE `id`='".$id."'");
				}
		}
	}
	break;
	}
	
	
	include('content_foot.php');
?>