<%@language=vbscript codepage=936 %>
<%
option explicit
response.buffer=true	
Const PurviewLevel=1    '操作权限
'response.write "此功能被WEBBOY暂时禁止了！"
'response.end
%>
<!--#include file="Admin_ChkPurview.asp"-->
<!--#include file="inc/conn.asp"-->
<!--#include file="inc/function.asp"-->
<!--#include file="inc/admin_code.asp"-->
<!--#include file="inc/md5.asp"-->
<%
dim rs, sql, strPurview,iCount
dim Action,FoundErr,ErrMsg
Action=Trim(request("Action"))
%>
<html>
<head>
<title>管理员管理</title>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="Admin_Style.css" rel="stylesheet" type="text/css">
<SCRIPT language=javascript>
function unselectall()
{
    if(document.myform.chkAll.checked){
	document.myform.chkAll.checked = document.myform.chkAll.checked&0;
    } 	
}

function CheckAll(form)
{
  for (var i=0;i<form.elements.length;i++)
    {
    var e = form.elements[i];
    if (e.Name != "chkAll"&&e.disabled!=true)
       e.checked = form.chkAll.checked;
    }
}

function CheckAdd()
{
  if(document.form1.username.value=="")
    {
      alert("用户名不能为空！");
	  document.form1.username.focus();
      return false;
    }
    
  if(document.form1.Password.value=="")
    {
      alert("密码不能为空！");
	  document.form1.Password.focus();
      return false;
    }
    
  if((document.form1.Password.value)!=(document.form1.PwdConfirm.value))
    {
      alert("初始密码与确认密码不同！");
	  document.form1.PwdConfirm.select();
	  document.form1.PwdConfirm.focus();	  
      return false;
    }
}
function CheckModify()
{
  if((document.form1.Password.value)!=(document.form1.PwdConfirm.value))
    {
      alert("初始密码与确认密码不同！");
	  document.form1.PwdConfirm.select();
	  document.form1.PwdConfirm.focus();	  
      return false;
    }
}
</script>
</head>
<body leftmargin="2" topmargin="0" marginwidth="0" marginheight="0">
<table width="100%" border="0" align="center" cellpadding="2" cellspacing="1" class="border">
  <tr class="topbg"> 
    <td height="22" colspan="2" align="center"><strong>管 理 员 管 理</strong></td>
  </tr>
  <tr class="tdbg"> 
    <td width="70" height="30"><strong>管理导航：</strong></td>
    <td height="30"><a href="Admin_Admin.asp">管理员管理首页</a>&nbsp;|&nbsp;<a href="Admin_Admin.asp?Action=Add">新增管理员</a></td>
  </tr>
</table>
<%
if Action="Add" then
	call AddAdmin()
elseif Action="SaveAdd" then
	call SaveAdd()
elseif Action="Modify" then
	call Modify()
elseif Action="SaveModify" then
	call SaveModify()
elseif Action="Del" then
	call DelAdmin()
else
	call main()
end if
if FoundErr=True then
	call WriteErrMsg()
else
	call ShowHelp()
end if
call CloseConn()

sub main()
	Set rs=Server.CreateObject("Adodb.RecordSet")
	sql="select * from admin order by id"
	rs.Open sql,conn,1,1
	iCount=rs.recordcount
%>
<br>
<table width='100%' border="0" cellpadding="0" cellspacing="0">
  <tr>
  <form name="myform" method="Post" action="Admin_Admin.asp" onsubmit="return confirm('确定要删除选中的管理员吗？');">
     <td>
<table width="100%" border="0" align="center" cellpadding="2" cellspacing="1" class="border">
  <tr align="center" class="title">
    <td  width="30"><strong>选中</strong></td>
    <td  width="30" height="22"><strong> 序号</strong></td>
    <td height="22"><strong> 用 户 名</strong></td>
    <td  width="100" height="22"><strong> 权 限</strong></td>
    <td width="100"><strong>最后登录IP</strong></td>
    <td width="120"><strong>最后登录时间</strong></td>
    <td  width="60"><strong>登录次数</strong></td>
    <td  width="100" height="22"><strong> 操 作</strong></td>
  </tr>
  <%do while not rs.EOF %>
  <tr align="center" class="tdbg" onmouseout="this.style.backgroundColor=''" onmouseover="this.style.backgroundColor='#BFDFFF'"> 
    <td width="30"><input name="ID" type="checkbox" id="ID" value="<%=rs("ID")%>" <%if rs("UserName")=session("Admin") then response.write " disabled"%> onclick="unselectall()"></td>
    <td width="30"><%=rs("ID")%></td>
    <td><%
	if rs("username")=session("Admin") then
		response.write "<font color=red><b>" & rs("UserName") & "</b></font>"
	else
		response.write rs("UserName")
	end if
	%></td>
    <td width="100"> <%
		  select case rs("purview")
		    case 1
              strPurview="超级用户"
            case 2
              strpurview="高级管理员"
            case 3
			  strpurview="文章总编"
			case 4
			  strpurview="栏目编辑"
			case 5
			  strpurview="文章录入员"
		  end select
		  response.write(strPurview)
         %> </td>
    <td width="100"><%
	if rs("LastLoginIP")<>"" then
		response.write rs("LastLoginIP")
	else
		response.write "&nbsp;"
	end if
	%> </td>
    <td width="120"><%
	if rs("LastLoginTime")<>"" then
		response.write rs("LastLoginTime")
	else
		response.write "&nbsp;"
	end if
	%> </td>
    <td width="60"><%
	if rs("LoginTimes")<>"" then
		response.write rs("LoginTimes")
	else
		response.write "0"
	end if
	%> </td>
    <td width="100"><%
	response.write "<a href='Admin_Admin.asp?Action=Modify&ID=" & rs("ID") & "'>修改</a>&nbsp;&nbsp;"
	if iCount>1 and rs("UserName")<>session("Admin") then
		response.write "<a href='Admin_Admin.asp?Action=Del&ID=" & rs("ID") & "' onClick=""return confirm('确定要删除此管理员吗？');"">删除</a>"
	else
		response.write "&nbsp;&nbsp;&nbsp;&nbsp;"
	end if
	%> </td>
  </tr>
  <%
	rs.MoveNext
loop
  %>
</table>  
<table width="100%" border="0" cellpadding="0" cellspacing="0">
  <tr>
    <td width="200" height="30"><input name="chkAll" type="checkbox" id="chkAll" onclick=CheckAll(this.form) value="checkbox">
              选中本页显示的所有管理员</td>
            <td><input name="Action" type="hidden" id="Action" value="Del">
              <input name="Submit" type="submit" id="Submit" value="删除选中的管理员"></td>
  </tr>
</table>
</td>
</form></tr></table>
<%
	rs.Close
	set rs=Nothing
end sub

sub AddAdmin()
%>
<form method="post" action="Admin_Admin.asp" name="form1" onsubmit="javascript:return CheckAdd();">
  <table width="100%" border="0" align="center" cellpadding="2" cellspacing="1" class="border" >
    <tr class="title"> 
      <td height="22" colspan="2"> <div align="center"><strong>新 增 管 理 员</strong></div></td>
    </tr>
    <tr class="tdbg"> 
      <td width="300" class="tdbg"><strong> 用 户 名：</strong></td>
      <td class="tdbg"><input name="username" type="text"> &nbsp;</td>
    </tr>
    <tr class="tdbg"> 
      <td width="300" class="tdbg"><strong> 初始密码： </strong></td>
      <td class="tdbg"><font size="2"> 
        <input type="password" name="Password">
        </font></td>
    </tr>
    <tr class="tdbg"> 
      <td width="300" class="tdbg"><strong> 确认密码：</strong></td>
      <td class="tdbg"><font size="2"> 
        <input type="password" name="PwdConfirm">
        </font></td>
    </tr>
    <tr class="tdbg"> 
      <td width="300" class="tdbg"><strong>权限设置： </strong></td>
      <td class="tdbg"><select name="purview" id="purview">
          <option value="1" selected>超级用户</option>
          <option value="2">高级管理员</option>
          <option value="3">文章总编</option>
          <option value="4">栏目编辑</option>
          <option value="5">文章录入员</option>
        </select></td>
    </tr>
    <tr class="tdbg">
      <td width="300" class="tdbg"><strong>所管理的栏目：</strong><br>
        <br>
        <strong><font color="#0000FF">注意：</font></strong><br>
        1、仅在管理员权限设为“栏目编辑”时才需设置此参数<br>
        2、<font color="#FF0000">不能指定为外部栏目。</font><br>
        3、可以同时选定多个栏目，所以请<font color="#FF0000">慎重</font>操作！以免让用户权限过大。<br>
        4、栏目管理员权限采用继承制度，所以选中了某一栏目后，无需再选中其子栏目。</td>
      <td class="tdbg"><select name="ClassID" size="1" multiple id="ClassID" style="height:200px;width:300px;">
          <%call Admin_ShowClass_Option(1,0)%>
        </select></td>
    </tr>
    <tr class="tdbg"> 
      <td height="40" colspan="2" align="center" class="tdbg"><input name="Action" type="hidden" id="Action" value="SaveAdd"> 
        <input  type="submit" name="Submit" value=" 添 加 " style="cursor:hand;"> 
        &nbsp; <input name="Cancel" type="button" id="Cancel" value=" 取 消 " onClick="window.location.href='Admin_Admin.asp'" style="cursor:hand;"></td>
    </tr>
  </table>
</form>
<%
end sub

sub Modify()
	dim UserID,Purview
	UserID=trim(Request("ID"))
	if UserID="" then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>请指定要修改的管理员ID</li>"
		exit sub
	else
		UserID=Clng(UserID)
	end if
	sql="Select * from Admin where ID=" & UserID
	Set rs=Server.CreateObject("Adodb.RecordSet")
	rs.Open sql,conn,1,3
	if rs.Bof and rs.EOF then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>不存在此用户！</li>"
	else
		Purview=rs("Purview")
%>
<form method="post" action="Admin_Admin.asp" name="form1" onsubmit="javascript:return CheckModify();">
  <table width="100%" border="0" align="center" cellpadding="2" cellspacing="1" class="border" >
    <tr class="title"> 
      <td height="22" colspan="2"> <div align="center"><font size="2"><strong>修 
          改 管 理 员 信 息</strong></font></div></td>
    </tr>
    <tr> 
      <td width="300" class="tdbg"><strong>用 户 名：</strong></td>
      <td class="tdbg"><%=rs("UserName")%> <input name="ID" type="hidden" value="<%=rs("ID")%>"></td>
    </tr>
    <tr> 
      <td width="300" class="tdbg"><strong>新 密 码：</strong><br><font color="#0000FF">如果不想修改，请保持为空</font></td>
      <td class="tdbg"><input type="password" name="Password">
      </td>
    </tr>
    <tr> 
      <td width="300" class="tdbg"><strong>确认密码：</strong><br><font color="#0000FF">如果不想修改，请保持为空</font></td>
      <td class="tdbg"><input type="password" name="PwdConfirm">
      </td>
    </tr>
    <tr> 
      <td width="300" class="tdbg"><strong>权限设置： </strong></td>
      <td class="tdbg"><select name="purview" id="purview">
          <option value="1" <%if purview=1 then %>selected<% end if %>>超级用户</option>
          <option value="2" <%if purview=2 then %>selected<% end if %>>高级管理员</option>
          <option value="3" <%if purview=3 then %>selected<% end if %>>文章总编</option>
          <option value="4" <%if purview=4 then %>selected<% end if %>>栏目编辑</option>
          <option value="5" <%if purview=5 then %>selected<% end if %>>文章录入员</option>
        </select>
        <input name="OldPurview" type="hidden" id="OldPurview" value="<%=purview%>"></td>
    </tr>
    <tr> 
      <td colspan="2" align="center" class="tdbg"><input name="Action" type="hidden" id="Action" value="SaveModify"> 
        <input  type="submit" name="Submit" value=" 确 定 " style="cursor:hand;">
        &nbsp;
        <input name="Cancel" type="button" id="Cancel" value=" 取 消 " onClick="window.location.href='Admin_Admin.asp'" style="cursor:hand;"></td>
    </tr>
  </table>
</form>
<%
	end if
	rs.close
	set rs=nothing
end sub
%>
<%
sub ShowHelp()
%>
<br>
<table width="100%" border="0" cellspacing="1" cellpadding="2" class="border">
  <tr class="title"> 
    <td height="22" colspan="2"><strong>管理员权限说明</strong></td>
  </tr>
  <tr valign="top" class="tdbg"> 
    <td width="120" align="right"><strong>文章录入员：</strong></td>
    <td>只有添加文章的权限。文章发表后不能更改所属栏目及专题，但可以修改和删除自己发表的文章。</td>
  </tr>
  <tr valign="top" class="tdbg"> 
    <td width="120" align="right"><strong>栏目编辑：</strong></td>
    <td>相当于论坛的版主，在自己所管理的栏目（含下属子栏目）里拥有“文章审核”、“固顶”、“推荐”等各种管理权限。</td>
  </tr>
  <tr valign="top" class="tdbg"> 
    <td width="120" align="right"><strong>文章总编：</strong></td>
    <td>拥有所有文章栏目的管理权限。</td>
  </tr>
  <tr valign="top" class="tdbg"> 
    <td width="120" align="right"><strong>高级管理员：</strong></td>
    <td>除上述权限之外，拥有栏目管理、专题管理、评论管理、公告管理、广告管理、友情链接管理、网站调查管理、注册用户管理权限。</td>
  </tr>
  <tr valign="top" class="tdbg"> 
    <td width="120" align="right"><strong>超级用户：</strong></td>
    <td>拥有所有管理权限。</td>
  </tr>
</table>
<%
end sub
%>
</body>
</html>
<%
sub SaveAdd()
	dim username, password,PwdConfirm, purview
	dim ClassID
	username=trim(Request("username"))
	password=trim(Request("Password"))
	PwdConfirm=trim(request("PwdConfirm"))
	purview=trim(Request("purview"))
	ClassID=trim(request("ClassID"))
	if username="" then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>用户名不能为空！</li>"
	end if
	if password="" then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>初始密码不能为空！</li>"
	end if
	if PwdConfirm<>Password then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>确认密码必须与初始密码相同！</li>"
	end if
	if purview="" then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>用户权限不能为空！</li>"
	else
		purview=CInt(purview)
	end if
	if FoundErr=True then
		exit sub
	end if
	sql="Select * from Admin where username='"&username&"'"
	Set rs=Server.CreateObject("Adodb.RecordSet")
	rs.Open sql,conn,1,3
	if not (rs.bof and rs.EOF) then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>数据库中已经存在此管理员！</li>"
		rs.close
		set rs=nothing
		exit sub
	end if
	password=md5(password)
   	rs.addnew
 	rs("username")=username
   	rs("password")=password
    rs("purview")=purview
	rs.update
    rs.Close
	if purview=4 and ClassID<>"" then
		sql="select ClassMaster from ArticleClass where ClassID in (" & ClassID & ")"
		rs.open sql,conn,1,3
		do while not rs.eof
			if rs(0)="" then
				rs(0)=UserName
			else
				rs(0)=rs(0) & "|" & UserName
			end if
			rs.update
			rs.movenext
		loop
		rs.close
	end if
	set rs=Nothing
	Call main()
end sub

sub SaveModify()
	dim UserID, UserName,password,PwdConfirm,Purview,OldPurview
	UserID=trim(Request("ID"))
	if UserID="" then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>请指定要修改的管理员ID</li>"
	else
		UserID=Clng(UserID)
	end if
	password=trim(Request("Password"))
	PwdConfirm=trim(request("PwdConfirm"))
	purview=trim(Request("purview"))
	if PwdConfirm<>Password then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>确认密码必须与新密码相同！</li>"
	end if
	if purview="" then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>用户权限不能为空！</li>"
	else
		purview=CInt(purview)
	end if
	if FoundErr=True then
		exit sub
	end if
	
	sql="Select * from Admin where ID=" & UserID
	Set rs=Server.CreateObject("Adodb.RecordSet")
	rs.Open sql,conn,1,3
	if rs.Bof and rs.EOF then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>不存在此用户！</li>"
		rs.close
		set rs=nothing
		exit sub
	end if
	if Password<>"" then
		rs("password")=md5(password)
	end if
   	rs("purview")=purview
 	rs.update
	if OldPurview=4 and Purview<>4 then
		call RemoveClassMaster(rs("UserName"))
	end if
	rs.Close
   	set rs=Nothing
    call main()
end sub

sub DelAdmin()
	dim UserID
	UserID=trim(Request("ID"))
	if UserID="" then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>请指定要删除的管理员ID</li>"
		exit sub
	end if
	if instr(UserID,",")>0 then
		UserID=replace(UserID," ","")
		sql="Select * from Admin where ID in (" & UserID & ")"
	else
		UserID=clng(UserID)
		sql="select * from Admin where ID=" & UserID
	end if
	Set rs=Server.CreateObject("Adodb.RecordSet")
	rs.Open sql,conn,1,3
	do while not rs.eof
		if rs("Purview")=4 then
			call RemoveClassMaster(rs("UserName"))
		end if
		rs.delete
		rs.update
		rs.movenext
	loop
	rs.close
	set rs=nothing
	call main()
end sub

sub RemoveClassMaster(UserName)
	dim sqlMaster,rsMaster,ClassMaster
	sqlMaster="select ClassMaster from ArticleClass"
	Set rsMaster=Server.CreateObject("Adodb.RecordSet")
	rsMaster.open sqlMaster,conn,1,3
	do while not rsMaster.eof
		if rsMaster(0)<>"" then
			ClassMaster=rsMaster(0)
			ClassMaster=replace(ClassMaster,"|" & UserName,"")
			ClassMaster=replace(ClassMaster,UserName & "|","")
			ClassMaster=replace(ClassMaster,Username,"")
			rsMaster(0)=ClassMaster
			rsMaster.update
		end if
		rsMaster.movenext
	loop
	rsMaster.close
	set rsMaster=nothing
end sub
%>