<!--#include file="conn.asp"-->
<!--#include file="inc/class_sys.asp"-->
<!--#include file="inc/hl_md5.asp"-->
<!--#include file="inc/upiconfig.asp"-->
<%
'*********Design By Jackie For HoWaveV4.05_Oblog4.0_0904*****
'***************定义接口变量*********************************
Dim Action,UpiUserName,UpiUserPass,UpiMd5Info,UpiQuestion,UpiAnswer,UpiEmail,UpiUserSex,UpiSaveCookies,OldPassword
Dim HLMd5Info
dim oblog
set oblog=new class_sys
oblog.start
Action = Trim(Request("action"))                           '---接口动作
UpiUserName = oblog.filt_badstr(Trim(Request("name")))     '---用户名
UpiUserPass = oblog.filt_badstr(Trim(Request("pass")))     '---密码
UpiMd5Info = Ucase(Trim(Request("Md5Info")))               '---密钥
UpiQuestion = oblog.filt_badstr(Trim(Request("question"))) '---问题
UpiAnswer = Trim(Request("answer"))                        '---答案
UpiEmail = oblog.filt_badstr(Trim(Request("email")))       '---邮箱
UpiUserSex = Trim(Request("sex"))                          '---性别
UpiSaveCookies = Trim(Request("save"))                     '---Cookie保存时间
OldPassword=oblog.filt_badstr(Trim(Request("oldpass"))) 
'***********将32位加密转换成16位***********************   
If Len(UpiUserPass) = 32 Then UpiUserPass = Mid(UpiUserPass,9,16)
If Len(UpiAnswer)=32 Then UpiAnswer=Mid(UpiAnswer,9,16)
If Len(OldPassword) = 32 Then OldPassword = Mid(OldPassword,9,16)
'***********收到退出命令后执行退出子程序***************
If Action="LogoutUser" Then Call LogoutUser()

If Not (Action = "" or UpiUserName = "" or UpiMd5Info = "" Or UpiUserPass = "") And HLIntegration = True Then
	   Md5OLD=0          '整合中文同步设置兼容PHP
	   HLMd5Info = MD5(UpiUserName&AdminSecurityKey,32)	
	If UpiMd5Info <> UCase(HLMd5Info) Then	
	   Md5OLD=1          '整合中文同步设置不兼容PHP
 	   HLMd5Info = MD5(UpiUserName&AdminSecurityKey,32)
	   If UpiMd5Info <> UCase(HLMd5Info) Then
	      Response.End()
	   End IF
	End IF
	
    Select Case Action
		Case "AddUser"
			Call AddUser()			
		Case "LoginUser"
			Call LoginUser()
		Case "LogoutUser"
			Call LogoutUser()
		Case "ModifyInfo"
			Call ModifyUserInfo()		
		Case "DelUser"
			Call DelUser()
    End Select
	
End If

Sub AddUser()

dim rs,sql,username,password,roleId,userid

    username=Replace(UpiUserName,"'","")	
	password=UpiUserPass
	if not IsObject(conn) then link_database
	If roleId="" Then
		roleId=0
	Else
		roleid=int(roleid)
	End If
	If userid="" Then
		userid=0
	Else
		if not IsNumeric(userid) then
			oblog.showok "用户id必须为数字！","back"
			exit sub
		end if
		userid=Int(userid)
	End If
	
	sql="Select * from oblog_admin where username='"&username&"'"	
	Set rs=Server.CreateObject("Adodb.RecordSet")
	rs.Open sql,conn,1,3	
	if not (rs.bof and rs.EOF) then
		Response.Write"<script language=JavaScript>"
		Response.Write"alert(""对不起！此用管理员已经存在，请更换用户名再进行注册！"");"
		Response.Write"window.history.go(-1);"
		Response.Write"</script>"
		rs.close
		set rs=nothing
		exit sub
	end if
   	rs.addnew
   	rs("roleid")=roleid
 	rs("username")=username
   	rs("password")=password
   	rs("userid")=userid
	rs.update
    rs.Close
	set rs=Nothing	
	If userid>0 Then oblog.Execute "Update Oblog_user Set roleid=" & roleid & " Where userid=" & userid		
End Sub


Sub LoginUser()
dim sql,rs
	dim username,password
	dim founderr,errmsg	
	username=oblog.filt_badstr(UpiUserName)
	password=trim(UpiUserPass)
	if username="" then
		FoundErr=True
		errmsg=errmsg & "<br><li>用户名不能为空！</li>"
	end if
	if password="" then
		FoundErr=True
		errmsg=errmsg & "<br><li>密码不能为空！</li>"
	end if
	if FoundErr<>True then
		
		set rs=server.createobject("adodb.recordset")
		sql="select * from oblog_admin where username='"&username&"'"
		if not IsObject(conn) then link_database
		rs.open sql,conn,1,3
		if rs.bof and rs.eof then
			FoundErr=True
			errmsg=errmsg & "<br><li>用户名或密码错误！</li>"
		else
			if password<>rs("password") then
				FoundErr=True
				errmsg=errmsg & "<br><li>用户名或密码错误！</li>"
			Else
				If rs("roleid")=0 Then
					rs("LastLoginIP")=Request.ServerVariables("REMOTE_ADDR")
					rs("LastLoginTime")=now()
					rs("LoginTimes")=rs("LoginTimes")+1
					rs.update
					session.Timeout=60
					session("adminname")=rs("username")
					session("adminpassword")=rs("password")
					Session("roleid")="0"
					rs.close
					'---------------------------------------
					'写日志
					Dim sIP
					sIP=oblog.userIp
					rs.Open "Select * From oblog_syslog Where 1=0",conn,1,3
					rs.AddNew
					rs("username")=session("adminname")
					rs("addtime")=Now
					rs("addip")=sIP
					rs("desc")=session("adminname") & " 于 " & Now() & " 自 " & sIP & " 登入系统管理员界面"
					rs("itype")=1 '0系统自动记录类/1:管理员操作类
					rs.Update					
					rs.Close
					'---------------------------------------
					set rs=nothing
					response.redirect "admin_index.asp"
				Else					
					FoundErr=True
					errmsg=errmsg & "<br><li>用户名或密码错误！</li>"
				End If
			end if
		end if
		rs.close
		set rs=nothing
	end if
	if founderr=True then
		oblog.sys_err(errmsg)
	end if
End Sub

Sub DelUser()
	Dim sql,rs	
	sql="select * from oblog_Admin where username='" & UpiUserName &"'"
	Set rs=Server.CreateObject("Adodb.RecordSet")
	if not IsObject(conn) then link_database
	rs.Open sql,conn,1,3
	
	do while not rs.eof
		rs.delete
		rs.update
		rs.movenext
	loop
	rs.close
	set rs=nothing	
End Sub

Sub LogoutUser()
session("AdminName")=""
End Sub

Sub ModifyUserInfo()
    Dim sql,rs	
	sql="select * from oblog_Admin where username='" & UpiUserName &"'"
	Set rs=Server.CreateObject("Adodb.RecordSet")
	if not IsObject(conn) then link_database
	rs.Open sql,conn,1,3	
	do while not rs.eof
		rs("password")=UpiUserPass
		rs.update
		rs.movenext
	loop
	rs.close
	set rs=nothing
End Sub
%>
