<?php
/**
 * @copyright (c) Kufer Software GmbH, Loisachstrasse 4, D-84453 Mühldorf
 */

  
  if (!defined('ISKUFERTOOLS')) {
    define('ISKUFERTOOLS', true);
  }

  if (!defined('BASEDIR')) {
    include_once '..' . DIRECTORY_SEPARATOR . 'classes' . DIRECTORY_SEPARATOR . 'constants.php';
  }


  if (!session_id()) {
    session_start();
  }

  CodingOperations::encodeEingaben();
  SecurityOperations::PurgeInput(true);

  $news_id = GetOperations::getVarValue('news_id', '');
  if ($news_id != '') {
    $news_id = CleanOperations::cleanInt($news_id);
  }

  $art = GetOperations::getVarValue('art', '');
  $tool_id = CleanOperations::cleanInt(GetOperations::getVarValue('tool_id', 16));
  $toolsection_id = CleanOperations::cleanInt(GetOperations::getVarValue('toolsection_id', 266));
  $toolsectNewsDetails = 267;
  $userId = SessionOperations::getUserIdentifier();
  $user_id = $userId->getId();

  $dbwUser = new DBWorkUser();
  $user = $dbwUser->getUser($userId);
     
    
    $insertNewsRecht = \SecurityOperations::privilegAllowed($userId, \ToolsAPI::TOOL_AKTUELLES, '266.0.1') == 2;
    $updateNewsRecht = \SecurityOperations::privilegAllowed($userId, \ToolsAPI::TOOL_AKTUELLES, '266.0.2') == 2;
    $delNewsRecht = \SecurityOperations::privilegAllowed($userId, \ToolsAPI::TOOL_AKTUELLES, '266.0.3') == 2;
    
    

  if (SessionOperations::isWtUserLoggedIn()) {
    $newsFeldnamen = array(
        'id',
        'inhalt',
        'titel',
        'erstell_datetime',
        'benutzergruppe',
        'letzter_bearbeiter',
        'letzte_bearbeitung_datetime',
        'dnr_privatnachricht',
        'gueltigBis');

    
    
    $autorid = '';
    if ($news_id != '') {
      $dbwaktuelleswt = new DBWorkAktuellesWT(1, true);
      $aktuelles = $dbwaktuelleswt->getAktuelles4User('-1', array('-1'), $news_id);
      
      $autorid = $aktuelles[0]->autor_id;
    } 



    
    $username = '';
    if ($art == 'saveNews' || $art == 'saveNewNews') {
      if (!empty($user_id)) {
        if ($user->isAdmin()) {
          $username = 'Administrator';
        } else {
          $username = $user->name . ((!empty($user->vorname)) ? ' ' . $user->vorname : '');
        }
      }
    }  


    switch ($art) { 
      case 'saveNews':

        
        $isXsrfOk = Xsrf::checkAndUseXsrfFromGet('wt_aktuelles_update', $news_id) == Xsrf::KEY_OK;
        
        
        if (!$user->isAdmin() && ($user_id !== $autorid || !$updateNewsRecht) || !$isXsrfOk) {
          echo "<script>document.location.href=\"usertools.php?tool_id=16&toolsection_id=$toolsectNewsDetails&editNews=1&news_id=$news_id&disableUpdIns=1\"</script>";
          break;
        }
        $col_titel = PostOperations::getVarValue('Col_titel', '');
        $col_inhalt = PostOperations::getVarValue('Col_inhalt', '');
        $fachbereiche = PostOperations::getVarValue('fachbereich', array(0));
        $use_gueltigkeitszeitraum = PostOperations::isDefined('use_gueltigkeitszeitraum');
        $gueltikeitszeitraum = PostOperations::getVarValue('gueltikeitszeitraum');

        if (empty($col_titel) || empty($col_inhalt)) {
          echo "<script>document.location.href=\"usertools.php?tool_id=16&toolsection_id=$toolsectNewsDetails&err=1&news_id=" . $news_id . '&Col_titel=' . CleanOperations::cleanStringForJs($col_titel) . '&Col_inhalt=' . CleanOperations::cleanStringForJs($col_inhalt) . '"</script>';
          break;
        }
          $dbnews = new DBWorkAktuellesWT(1, true);
          $news = $dbnews->getAktuelles($news_id); 
          
          $news->setValue2Var('letzter_bearbeiter', $username);
        for ($j = 0;$j < count($newsFeldnamen);$j++) {
          
          if (PostOperations::isDefined('Col_' . $newsFeldnamen[$j])) {
            $news->setValue2Var($newsFeldnamen[$j], PostOperations::getVarValue('Col_' . $newsFeldnamen[$j]));
          }
        }

          $addf = new DateTimeOperations();
        
        $news->setValue2Var('letzte_bearbeitung_datetime', $addf->getDateTimeNow());
        
        

        if ($use_gueltigkeitszeitraum && $gueltikeitszeitraum != '') {
          $news->setValue2Var('gueltigBis', $gueltikeitszeitraum);
        } else {
          $news->setValue2Var('gueltigBis', DEFAULTDATE);
        }
        
        
        
        
        

        $existingusergroup = array();
        $existingusergrpstr = $news->getVarValue('benutzergruppe');
        if (!empty($existingusergrpstr)) {
          $existingusergroup = explode(',', $existingusergrpstr);
        }
        
        if ($user->isAdmin()) {
          $usergroup4login = array('1', '2', '3', '4');
        } else {
          $usergroup4login = array();
          if ($user->ben > 0) {
            array_push($usergroup4login, '1');
          }
          if ($user->dnr > 0) {
            array_push($usergroup4login, '2');
          }
          if ($user->tnr > 0) {
            array_push($usergroup4login, '3');
          }
          if ($user->anr > 0) {
            array_push($usergroup4login, '4');
          }
        }
        
        
        $allowedusergroupIds = array_diff($existingusergroup, $usergroup4login);
        

        
        $usergroup = array_merge($allowedusergroupIds, PostOperations::getVarValue('benutzergruppe'));
        
        $usergroup = array_unique($usergroup);
        $strusergrp = '';
        if (!empty($usergroup)) {
          $strusergrp = implode(',', $usergroup);
        }
        $news->setValue2Var('benutzergruppe', $strusergrp);

        $dbnews->updateAktuelles($news, $fachbereiche); 
        echo "<script>document.location.href=\"usertools.php?tool_id=16&toolsection_id=$toolsection_id\"</script>";
        break;

      
      case 'saveNewNews':

        
        $isXsrfOk = Xsrf::checkAndUseXsrfFromGet('wt_aktuelles_insert') == Xsrf::KEY_OK;
          if (!$insertNewsRecht || !$isXsrfOk) {
            
            echo "<script>document.location.href=\"usertools.php?tool_id=16&toolsection_id=$toolsectNewsDetails&disableUpdIns=1\"</script>";
            break;
          }
        $col_titel = PostOperations::getVarValue('Col_titel', '');
        $col_inhalt = PostOperations::getVarValue('Col_inhalt', '');
        $fachbereiche = PostOperations::getVarValue('fachbereich', array(0));
        $usergroup = PostOperations::getVarValue('benutzergruppe');
        $use_gueltigkeitszeitraum = PostOperations::isDefined('use_gueltigkeitszeitraum');
        $gueltikeitszeitraum = PostOperations::getVarValue('gueltikeitszeitraum');

          if (empty($col_titel) || empty($col_inhalt)) {
            echo "<script>document.location.href=\"usertools.php?tool_id=16&toolsection_id=$toolsectNewsDetails&err=1&Col_titel=" . CleanOperations::cleanStringForJs($col_titel) . '&Col_inhalt=' . CleanOperations::cleanStringForJs($col_inhalt) . '"</script>';
            break;
          }

          $dbnews = new DBWorkAktuellesWT();
          $news = $dbnews->getNewObject();
          
          $news->setValue2Var('letzter_bearbeiter', $username);
        $news->setValue2Var('autor_id', $user_id);
        for ($j = 0;$j < count($newsFeldnamen);$j++) {
          if (PostOperations::isDefined('Col_' . $newsFeldnamen[$j])) {
            $news->setValue2Var($newsFeldnamen[$j], PostOperations::getVarValue('Col_' . $newsFeldnamen[$j]));
          }
        } 

        $addf = new DateTimeOperations();
        
        $news->setValue2Var('erstell_datetime', $addf->getDateTimeNow());

        if ($use_gueltigkeitszeitraum && $gueltikeitszeitraum != '') {
          $news->setValue2Var('gueltigBis', $gueltikeitszeitraum);
        } else {
          $news->setValue2Var('gueltigBis', DEFAULTDATE);
        }

        
        $news->setValue2Var('letzte_bearbeitung_datetime', $addf->getDateTimeNow());
        
        $news->setValue2Var('benutzergruppe', (!empty($usergroup) ? implode(',', $usergroup) : '0'));

        $news->setValue2Var('dnr_privatnachricht', '0');

        $dbnews->insertAktuelles($news, $fachbereiche);
        echo "<script>document.location.href=\"usertools.php?tool_id=16&toolsection_id=$toolsection_id\"</script>";
        break;

      case 'loescheNews': 

        
        $isXsrfOk = Xsrf::checkAndUseXsrfFromGet('wt_aktuelles_delete', $news_id) == Xsrf::KEY_OK;
        
        
        if (!$user->isAdmin() && ($user_id !== $autorid || !$delNewsRecht) || !$isXsrfOk) {
          echo "<script>document.location.href=\"usertools.php?tool_id=16&toolsection_id=$toolsection_id&disableDelete=1\"</script>";
          break;
        }
        $dbnews = new DBWorkAktuellesWT();
        $dbnews->deleteAktuelles($news_id); 
        echo "<script>document.location.href=\"usertools.php?tool_id=16&toolsection_id=$toolsection_id\"</script>";
        break;

    }
  }
  else {
    header('Location: index.php?sessionfail=1');
    die();
  }