<%@language=vbscript codepage=936 %>
<%
'Option Explicit
'Response.Buffer = True
Server.ScriptTimeOut = 9999999
%>
<!--#include file="conn/hl_conn.asp"-->
<!--#include file="inc/hl_function.asp"-->
<!--#include file="inc/upiconfig.asp"-->
<!--#include file="inc/md5.asp"-->

<%
If CheckUserLogined() = False Then
    Response.Redirect "User_Login.asp"
    Response.End
End If

Call Execute


Sub Execute()
    Dim ScriptName, TrueSiteUrl, UserTrueIP, cUrl
    '检查页面访问是否为外部链接或直接地址输入
    UserTrueIP = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
    If UserTrueIP = "" Then UserTrueIP = Request.ServerVariables("REMOTE_ADDR")
    UserTrueIP = ReplaceBadChar(UserTrueIP)
    ComeUrl = Trim(Request.ServerVariables("HTTP_REFERER"))
    ScriptName = Trim(Request.ServerVariables("SCRIPT_NAME"))
    TrueSiteUrl = Trim(Request.ServerVariables("HTTP_HOST"))
       
    If CheckUserLogined() = False Then
        Response.Redirect "User_Login.asp"
        Response.End
    End If
	
    Response.Write "<html>" & vbCrLf
    Response.Write "<head>" & vbCrLf
    Response.Write "<title>用户信息</title>" & vbCrLf
    Response.Write "<meta http-equiv='Content-Type' content='text/html; charset=gb2312'>" & vbCrLf
    Response.Write "<link rel='stylesheet' href='css/User_Style.css'>" & vbCrLf
    Response.Write "</head>" & vbCrLf
    Response.Write "<body leftmargin='2' topmargin='0' marginwidth='0' marginheight='0'>" & vbCrLf
    Response.Write "<table cellpadding='2' cellspacing='1' border='0' width='100%' class='border' align=center>" & vbCrLf
    Response.Write "<tr align='center'>" & vbCrLf
    Response.Write "    <td height=25 colspan=2 class='topbg'><strong>通行证管理</strong></tr>" & vbCrLf
    Response.Write "<tr>" & vbCrLf
    Response.Write "    <td width='100' class='tdbg' height=23><strong>管理导航：</strong></td>" & vbCrLf
    Response.Write "    <td class='tdbg'><a href='User_Info.asp?Action=ModifyPwd'>修改密码</a> | <a href='User_Info.asp?Action=Modify'>修改通行证资料</a>"
    
    Response.Write "</tr>" & vbCrLf
    Response.Write "</table>" & vbCrLf
    UserName=session("hl_user")
    Action = Trim(Request("Action"))
    Select Case Action
    Case "Modify"
        Call Modify
    Case "SaveModify"
	
        Call SaveModify
    Case "ModifyPwd"
        Call ModifyPwd
    Case "SaveModifyPwd"
        Call SaveModifyPwd
    Case Else
        Call Show
    End Select
    
    If FoundErr = True Then
        Call WriteErrMsg
    End If
    
    Response.Write "</body></html>"
End Sub

Sub Modify()
     hl_user=session("hl_user")
    Response.Write "<script language='JavaScript' src='inc/PopCalendar.js'></script>" & vbCrLf
    Response.Write "<script language='JavaScript'>" & vbCrLf
    Response.Write "    PopCalendar = getCalendarInstance()" & vbCrLf
    Response.Write "    PopCalendar.startAt = 0 // 0 - sunday ; 1 - monday" & vbCrLf
    Response.Write "    PopCalendar.showWeekNumber = 0 // 0 - don't show; 1 - show" & vbCrLf
    Response.Write "    PopCalendar.showTime = 0 // 0 - don't show; 1 - show" & vbCrLf
    Response.Write "    PopCalendar.showToday = 0 // 0 - don't show; 1 - show" & vbCrLf
    Response.Write "    PopCalendar.showWeekend = 1 // 0 - don't show; 1 - show" & vbCrLf
    Response.Write "    PopCalendar.showHolidays = 1 // 0 - don't show; 1 - show" & vbCrLf
    Response.Write "    PopCalendar.showSpecialDay = 1 // 0 - don't show, 1 - show" & vbCrLf
    Response.Write "    PopCalendar.selectWeekend = 0 // 0 - don't Select; 1 - Select" & vbCrLf
    Response.Write "    PopCalendar.selectHoliday = 0 // 0 - don't Select; 1 - Select" & vbCrLf
    Response.Write "    PopCalendar.addCarnival = 0 // 0 - don't Add; 1- Add to Holiday" & vbCrLf
    Response.Write "    PopCalendar.addGoodFriday = 0 // 0 - don't Add; 1- Add to Holiday" & vbCrLf
    Response.Write "    PopCalendar.language = 0 // 0 - Chinese; 1 - English" & vbCrLf
    Response.Write "    PopCalendar.defaultFormat = 'yyyy-mm-dd' //Default Format dd-mm-yyyy" & vbCrLf
    Response.Write "    PopCalendar.fixedX = -1 // x position (-1 if to appear below control)" & vbCrLf
    Response.Write "    PopCalendar.fixedY = -1 // y position (-1 if to appear below control)" & vbCrLf
    Response.Write "    PopCalendar.fade = .5 // 0 - don't fade; .1 to 1 - fade (Only IE) " & vbCrLf
    Response.Write "    PopCalendar.shadow = 1 // 0  - don't shadow, 1 - shadow" & vbCrLf
    Response.Write "    PopCalendar.move = 1 // 0  - don't move, 1 - move (Only IE)" & vbCrLf
    Response.Write "    PopCalendar.saveMovePos = 1  // 0  - don't save, 1 - save" & vbCrLf
    Response.Write "    PopCalendar.centuryLimit = 40 // 1940 - 2039" & vbCrLf
    Response.Write "    PopCalendar.initCalendar()" & vbCrLf
    Response.Write "</script>" & vbCrLf

    Response.Write "<script language=javascript>" & vbCrLf
    Response.Write "function CheckSubmit(){" & vbCrLf
    Response.Write "    if(document.form1.Question.value==''){" & vbCrLf
    Response.Write "        alert('密码提示问题不能为空！');" & vbCrLf
    Response.Write "        document.form1.Question.focus();" & vbCrLf
    Response.Write "        return false;" & vbCrLf
    Response.Write "    }" & vbCrLf
    Response.Write "    document.form1.Country.value=frm1.document.regionform.Country.value;" & vbCrLf
    Response.Write "    document.form1.Province.value=frm1.document.regionform.Province.value;" & vbCrLf
    Response.Write "    document.form1.City.value=frm1.document.regionform.City.value;" & vbCrLf
    Response.Write "}" & vbCrLf
    Response.Write "</script>" & vbCrLf
    Dim rsUser
    Set rsUser = Conn.Execute("select * from hl_user where username='" &hl_user& "'")
	
	response.Write rsUser(1)
    '-------------------------------------------
    Response.Write "<form name='form1' id='form1' action='User_Info.asp' method='post' onSubmit='javascript:return CheckSubmit();'>" & vbCrLf
    Response.Write "<table  cellpadding='2' cellspacing='1' border='0' width='100%' class='border' align=center>" & vbCrLf
	Response.Write"<tr><td clospan=2 height=25 align=center class='title'><strong>通行证资料修改</strong></td></tr>"& vbCrLf
	Response.Write"<tr><td  height=20 width='30%'>通行证号:</td><td  height=20 width='70%'><input name='UserName' type='text' size='35' maxlength='20' value='" & rsUser("username") & "' disabled></td></tr>"& vbCrLf
	Response.Write"<tr><td  height=20 width='30%'>提示问题:</td><td  height=20 width='70%'><input name='Question' type='text' id='Question' size='35' value='" & rsUser("userquestion") & "'></td></tr>"& vbCrLf
	Response.Write"<tr><td  height=20 width='30%'>问题答案:</td><td  height=20 width='70%'><input name='Answer' type='text' id='Answer' size='35'> <font color='#FF0000'>不修改请留空</font></td></tr>"& vbCrLf
	Response.Write"<tr><td  height=20 width='30%'>真实姓名:</td><td  height=20 width='70%'><input name='TrueName' type='text' value='" & rsUser("truename") & "' size='35' maxlength='20'></td></tr>"& vbCrLf
	
	Response.Write"<tr><td  height=20 width='30%'>电子邮箱:</td><td  height=20 width='70%'><input name='Email' type='text' id='Email' size='35' maxlength='255' value='" & rsUser("useremail") & "'></td></tr>"& vbCrLf
	
	
	Response.Write "                    <tr class='tdbg'>" & vbCrLf
    Response.Write "                        <td  class='tdbg'>通讯地址：</td>" & vbCrLf
    Response.Write "                        <td  height=100>" & vbCrLf
    Response.Write "                            <iframe name='frm1' id='frm1' src='inc/Region.asp?Country=" & rsUser("country") & "&Province=" & rsUser("province") & "&City=" & rsUser("city") & "' width='100%' height='100' frameborder='0' scrolling='no'></iframe>" & vbCrLf
    Response.Write "                            <input name='Country' id='Country' type='hidden' value=''>" & vbCrLf
    Response.Write "                            <input name='Province' id='Province' type='hidden' value=''>" & vbCrLf
    Response.Write "                            <input name='City' id='City' type='hidden' value=''>" & vbCrLf
    Response.Write "                        </td>" & vbCrLf
    Response.Write "                    </tr>" & vbCrLf
	
	
	Response.Write"<tr><td  height=20 width='30%'>联系地址:</td><td  height=20 width='70%'><input name='Address' type='text' value='" & rsUser("address") & "' size='60' maxlength='255'></td></tr>"& vbCrLf
	Response.Write "        <tr align='center' class='tdbg'>" & vbCrLf
    Response.Write "            <td colspan='2'>" & vbCrLf
    Response.Write "                <input type='hidden' name='action' value='SaveModify'>" & vbCrLf
    Response.Write "                <input type='submit' name='Submit' value='保存修改结果'> &nbsp;&nbsp;&nbsp;&nbsp; <input type='reset' name='Submit' value='重置'>" & vbCrLf
    Response.Write "            </td>" & vbCrLf
    Response.Write "        </tr>" & vbCrLf
    Response.Write "</table>" & vbCrLf
    Response.Write "</form>" & vbCrLf
	'--------------------------------------------------------------------------
	Set rsUser = Nothing
End Sub

Sub SaveModify()
hl_user=session("hl_user")
    Dim Question, Answer
    Dim Email, SpareEmail, Homepage, QQ, ICQ, MSN, Yahoo, UC, Aim,name1
    Dim OfficePhone, Homephone, Fax, Mobile, Country, Province, City, Address, ZipCode
    Dim ClientNum, UserType, TrueName, Sex, Birthday, IDCard, Vocation, Company, Department, PosTitle, Marriage, Income
    Dim NickName, UserFace, FaceWidth, FaceHeight, Sign, JoinTime, LastLoginTime, LoginTimes, LastLoginIP
    Dim Balance, UserPoint, UserExp, Orders, PaidOrders, SentOrders, PostItems, PassedItems, DelItems, UnsignedItems, UnreadMsg
    Dim Privacy
    
    Question = ReplaceBadChar(Trim(Request.Form("Question")))
    Answer = ReplaceBadChar(Trim(Request.Form("Answer")))
    Email = ReplaceBadChar(Trim(Request.Form("Email")))
    Country = ReplaceBadChar(Trim(Request.Form("Country")))
    Province = ReplaceBadChar(Trim(Request.Form("Province")))
    City = ReplaceBadChar(Trim(Request.Form("City")))
    Address = ReplaceBadChar(Trim(Request.Form("Address")))
    TrueName = ReplaceBadChar(Trim(Request.Form("TrueName")))
    Sex = ReplaceBadChar(Trim(Request.Form("Sex")))
    
    
    If (Trim(Request.Form("Question"))) = "" Then
        FoundErr = True
        ErrMsg = "所有带<font color=red>*</font>符号的字段必须全部填写！"
   call  WriteErrMsg(ErrMsg)
	    response.End()
    End If
            
    If FoundErr = True Then
        Exit Sub
    End If
    
    Dim sqlUser, rsUser
    sqlUser = "SELECT * FROM hl_user Where username='" & hl_user & "'"
    Set rsUser = Server.CreateObject("adodb.recordset")
    rsUser.Open sqlUser, Conn, 1, 3
  
    rsUser("userquestion") = Question
    If Answer <> "" Then
        rsUser("Answer") = Answer
    End If
    rsUser("useremail") = Email
    rsUser("country") = Country
    rsUser("province") = Province
    rsUser("city") = City
    rsUser("address") = Address
    rsUser("truename") = TrueName
	if Sex<>"" then
    rsUser("sex") = Sex
	end if
    rsUser.Update
	
	'-------------------------------------赋值
	name1= rsUser("UserName")
	Question=rsUser("UserQuestion")
	Answer=rsUser("UserAnswer")
	Address=rsUser("Address")
	City= rsUser("City")
	 Province=rsUser("Province")
	 Country=rsUser("Country")
	 TrueName=rsUser("TrueName")
	 Email=rsUser("UserEmail")
	 if Sex<>"" then
	 Sex=rsUser("Sex")
	 end if
	'---------------------------------------------
     
	 '----------------------
	 If HLIntegration = True Then
            Dim PEUpi
            Dim iNum
            If IsNull(SecurityKey) = False And SecurityKey <> "" And IsNull(arrUpiUrls) = False And arrUpiUrls <> "" Then
                PEUpi = Split(arrUpiUrls, "|")
                For iNum = 0 To UBound(PEUpi)
                    Response.Write "<iframe id='ModifyInfo' width='100%' height='0' frameborder='0' src=""" & PEUpi(iNum) & "?action=ModifyInfo&Md5Info=" & MD5(UserName & SecurityKey, 32) & "&name=" & name1 & "&question=" & Question & "&answer=" & MD5(Answer, 32) & "&Email=" & Email & "&sex=" & Sex & "&address=" & Address & "&TrueName=" & TrueName & "&Country=" & Country & "&Province=" & Province & "&City=" & City & "&domain=" & PE_Url & "&key=" & SecurityKey & "&lock=0&save=0""></iframe>" & vbCrLf
                Next
            End If
        End If
	 
	 '-----------
	rsUser.Close
	Set rsUser = Nothing
 Call WriteSuccessMsg("修改用户信息成功！")

End Sub

Sub ModifyPwd()
    Response.Write "<form name='myform' action='User_Info.asp' method='post'>" & vbCrLf
    Response.Write "  <table width='400' border='0' align='center' cellpadding='2' cellspacing='1' class='border'>" & vbCrLf
    Response.Write "    <tr align='center' class='title'>" & vbCrLf
    Response.Write "      <td height='22' colSpan='2'><b>修改用户密码</b></td>" & vbCrLf
    Response.Write "    </tr>" & vbCrLf
    Response.Write "    <tr class='tdbg'>" & vbCrLf
    Response.Write "      <td width='120' align='right'><b>用 户 名：</b></td>" & vbCrLf
    Response.Write "      <td>" & UserName & "</td>" & vbCrLf
    Response.Write "    </tr>" & vbCrLf
    Response.Write "    <tr class='tdbg'> " & vbCrLf
    Response.Write "      <td width='120' align='right'><b>旧 密 码：</b></td>" & vbCrLf
    Response.Write "      <td><input name='OldPassword' type='password' maxLength='16' size='30'></td>" & vbCrLf
    Response.Write "    </tr>" & vbCrLf
    Response.Write "    <tr class='tdbg'>" & vbCrLf
    Response.Write "      <td width='120' align='right'><b>新 密 码：</b></td>" & vbCrLf
    Response.Write "      <td> <input name='Password' type='password' maxLength='16' size='30'> </td>" & vbCrLf
    Response.Write "    </tr>" & vbCrLf
    Response.Write "    <tr class='tdbg'>" & vbCrLf
    Response.Write "      <td width='120' align='right'><b>确认密码：</b></td>" & vbCrLf
    Response.Write "      <td><input name='PwdConfirm' type='password' maxLength='16' size='30'>" & vbCrLf
    Response.Write "      </td>" & vbCrLf
    Response.Write "    </tr>" & vbCrLf
    Response.Write "    <tr align='center' class='tdbg'>" & vbCrLf
    Response.Write "      <td height='40' colspan='2'>" & vbCrLf
    Response.Write "        <input name='Action' type='hidden' id='Action' value='SaveModifyPwd'>" & vbCrLf
    Response.Write "        <input name='Submit' type='submit' id='Submit' value=' 保 存 '>" & vbCrLf
    Response.Write "      </td>" & vbCrLf
    Response.Write "    </tr>" & vbCrLf
    Response.Write "  </table>" & vbCrLf
    Response.Write "</form>" & vbCrLf
End Sub

Sub SaveModifyPwd()
    Dim OldPassword, Password, PwdConfirm
    Dim rsUser, sqlUser,hl_user
	hl_user=session("hl_user")
    OldPassword = Trim(Request("OldPassword"))
    Password = Trim(Request("Password"))
    PwdConfirm = Trim(Request("PwdConfirm"))
    If OldPassword = "" Then
        FoundErr = True
        ErrMsg = ErrMsg & "<li>请输入旧密码！</li>"
		call  WriteErrMsg(ErrMsg)
	    response.End()
    Else
        If InStr(OldPassword, "=") > 0 Or InStr(OldPassword, "%") > 0 Or InStr(OldPassword, Chr(32)) > 0 Or InStr(OldPassword, "?") > 0 Or InStr(OldPassword, "&") > 0 Or InStr(OldPassword, ";") > 0 Or InStr(OldPassword, ",") > 0 Or InStr(OldPassword, "'") > 0 Or InStr(OldPassword, ",") > 0 Or InStr(OldPassword, Chr(34)) > 0 Or InStr(OldPassword, Chr(9)) > 0 Or InStr(OldPassword, "") > 0 Or InStr(OldPassword, "$") > 0 Then
            ErrMsg = ErrMsg + "<li>旧密码中含有非法字符</li>"
            FoundErr = True
			call  WriteErrMsg(ErrMsg)
	        response.End()
        End If
    End If
    If Len(Password) > 12 Or Len(Password) < 6 Then
        FoundErr = True
        ErrMsg = ErrMsg & "<li>请输入新密码(不能大于12小于6)。</li>"
		call  WriteErrMsg(ErrMsg)
	    response.End()
    Else
        If InStr(Password, "=") > 0 Or InStr(Password, "%") > 0 Or InStr(Password, Chr(32)) > 0 Or InStr(Password, "?") > 0 Or InStr(Password, "&") > 0 Or InStr(Password, ";") > 0 Or InStr(Password, ",") > 0 Or InStr(Password, "'") > 0 Or InStr(Password, ",") > 0 Or InStr(Password, Chr(34)) > 0 Or InStr(Password, Chr(9)) > 0 Or InStr(Password, "") > 0 Or InStr(Password, "$") > 0 Then
            ErrMsg = ErrMsg + "<li>新密码中含有非法字符</li>"
            FoundErr = True
			call  WriteErrMsg(ErrMsg)
	        response.End()
        End If
    End If
    If PwdConfirm = "" Then
        FoundErr = True
        ErrMsg = ErrMsg & "<li>请输入确认密码！</li>"
		call  WriteErrMsg(ErrMsg)
	   response.End()
    Else
        If PwdConfirm <> Password Then
            FoundErr = True
            ErrMsg = ErrMsg & "<li>确认密码与新密码不一致！</li>"
			call  WriteErrMsg(ErrMsg)
	       response.End()
        End If
    End If
    If FoundErr = True Then
        Exit Sub
    End If

    Set rsUser = Server.CreateObject("Adodb.RecordSet")
    sqlUser = "select * from hl_User where username='" &hl_user& "'"
    rsUser.Open sqlUser, Conn, 1, 3
   ' If MD5(OldPassword, 16) <> rsUser("userpassword") Then
    If OldPassword <> rsUser("userpassword") Then
        FoundErr = True
        ErrMsg = ErrMsg & "<li>你输入的旧密码不对，没有权限修改！</li>"
		call  WriteErrMsg(ErrMsg)
	    response.End()
    Else
        'Password = MD5(Password, 16)
        rsUser("UserPassword") = Password
        rsUser.Update
		PwdConfirm=MD5(PwdConfirm, 16)
		
		Md5Info=MD5(UserName & SecurityKey, 32)
		If HLIntegration = True Then
            Dim PEUpi
            Dim iNum
            If IsNull(SecurityKey) = False And SecurityKey <> "" And IsNull(arrUpiUrls) = False And arrUpiUrls <> "" Then
                PEUpi = Split(arrUpiUrls, "|")
                For iNum = 0 To UBound(PEUpi)
                    Response.Write "<iframe id='ModifyPsw' width='100%' height='0' frameborder='0' src='" & PEUpi(iNum) & "?action=ModifyPsw&pass=" & PwdConfirm & "&Md5Info=" & Md5Info & "&name=" & UserName & "'></iframe>" & vbCrLf
                response.Write""&SecurityKey&"<br>"
				response.Write""&PEUpi(iNum)&"<br>"
				response.Write""&PwdConfirm&"<br>"
				response.Write""&UserName&"<br>"
				response.Write""&arrUpiUrls&"<br>"
				Next
            End If
        End If
		
        Response.Write "<br><br>" & vbCrLf
        Response.Write "<table cellpadding=2 cellspacing=1 border=0 width=400 class='border' align=center>" & vbCrLf
        Response.Write "  <tr align='center' class='title'><td height='22'><strong>恭喜你！</strong></td></tr>" & vbCrLf
        Response.Write "  <tr class='tdbg'><td height='100' valign='top'><br>密码已经修改成功，请记住您的新密码：<font color=red>" & PwdConfirm & "</font></td></tr>" & vbCrLf
        Response.Write "  <tr align='center' class='tdbg'><td>"
        Response.Write "修改密码成功！"
        Response.Write "</td></tr>" & vbCrLf
        Response.Write "</table>" & vbCrLf
        
        
    End If
    rsUser.Close
    Set rsUser = Nothing
End Sub



Function ReplaceUrlBadChar(strChar)
    If strChar = "" Or IsNull(strChar) Then
        ReplaceUrlBadChar = ""
        Exit Function
    End If
    Dim strBadChar, arrBadChar, tempChar, i
    strBadChar = "',(,),<,>,[,],{,},\,;," & Chr(34) & "," & Chr(0) & ""
    arrBadChar = Split(strBadChar, ",")
    tempChar = strChar
    For i = 0 To UBound(arrBadChar)
        tempChar = Replace(tempChar, arrBadChar(i), "")
    Next
    ReplaceUrlBadChar = tempChar
End Function
%>