<!--#INCLUDE FILE="setup.asp" -->
<!--#include file="checkuser.asp"-->
<!--#include file=include/encrypt.asp-->
<!--#include file=include/htmlencode.asp-->

<title><%=StrVar(1)%>--管理页面</title>
<link href="css.asp" rel="stylesheet" type="text/css">
<!--#include file=theme.css-->
<body alink=#333333 vlink=#333333 link=#333333 topmargin=0 class=AdminBody>
<%
if  not sysadmin or session("adminlogin")<>"0K" Then
	Errmsg=Errmsg+"<br>"+"<li>本页面为管理员专用，请<a href=superindex.asp target=_top>登陆</a>后进入。"
	Call Error("Information",ErrMsg)
Else

	%>
	<table cellpadding=5 cellspacing=1 border=0 width=100% Class=TableBorder align=center>
	<tr>
		<th>欢迎<b><%=membername%></b>进入管理页面</th>
	</tr>
	</table>

	<%
	sql="select locked from student where userid='"&membername&"'"
	set rs=conn.execute(sql)
	if not (rs.eof and rs.bof) and rs(0)<>3 then
		'response.write "<br><br><center>操作失败！您的权限不够！。</center>"
		'response.end
	end if
	set rs=nothing

	select case Request("action")
	case "SaveNew"
		Call addadmin()
	case "NewAdmin"
		Call addform()
	case "Delete"
		Call RemoveAdmin()
	case "Modify"
		Call ModifyForm()
	case "ChangeAccount"
		Call SaveEdit()
	case else
		call adminlist()
	End select

End if
Call endconnection()


sub SaveEdit()

	dim userid2,userpwd2
	dim adminid

	if request.form("userid2")="" then
		response.write "<br><br><CENTER>请输入后台管理帐号!</CENTER>"
		response.end
	else
		userid2=replace(request.form("userid2"),"'","")
	end if

	if request.form("userpwd2")="" then
		response.write "<br><br><CENTER>请输入后台登陆密码!</CENTER>"
		response.end
	else
		userpwd2=request.form("userpwd2")
		if request.form("olduserpwd2")<>userpwd2 then
			userpwd2=md5(userpwd2)
		end if
	end if
	
	adminid=clng(request.form("superid"))
	sql="update admin set userid='"&userid2&"',userpwd='"&userpwd2&"' where adminid="&adminid
	conn.execute(sql)
	response.write "<br><br><CENTER>成功修改管理帐号!</CENTER>"


end sub


sub ModifyForm()

dim sql,rs
dim adminid

adminid=clng(request("id"))

sql="select A.userid,A.userpwd,S.userid from admin A inner join student S on A.adminid=S.studid where S.studid="&adminid
set rs=conn.execute(sql)
  %> 
<form action="sysadm_admin.asp?action=ChangeAccount" method=post>
<table cellpadding="2" cellspacing="1" border="0" width="80%" class=TableBorder align=center>
               <tr> 
                  <th colspan=2 height=23>管理员帐号修改
                  </th>
                </tr>
          <tr Class=LightTableBody> 
            <td width="26%" align="right" height=23>前台用户名称：</td>
            <td width="74%"><%=htmlencode(rs(2))%>
            </td>
          </tr>
               <tr Class=LightTableBody> 
            <td width="26%" align="right">后台管理帐号：</td>
            <td width="74%">
              <input type=hidden name="olduserid2" value="<%=rs(0)%>">
              <input type=text name="userid2" value="<%=rs(0)%>">  
            </td>
          </tr>
          <tr Class=LightTableBody> 
            <td width="26%" align="right">后台登陆密码：</td>
            <td width="74%">
              <input type="password" name="userpwd2" value="<%=rs(1)%>">
              <input type="hidden" name="olduserpwd2" value="<%=rs(1)%>">
            </td>
          </tr>
          <tr align="center" Class=DarkTableBody> 
            <td colspan="2"> 
              <input type=hidden name=superid value="<%=adminid%>">
              <input type="submit" name="Submit" value="更 新" class=button>&nbsp;&nbsp;<input type=button value="返 回" onClick="location.href='sysadm_admin.asp'" class=button>
            </td>
          </tr>
        </table>
        </form>

<%
set rs=nothing


end sub


sub RemoveAdmin()

	dim adminid
	dim sql,rs

	adminid=clng(request("id"))
	sql="select A.userid,S.locked from admin A inner join student S on A.adminid=S.studid where S.studid="&adminid
	set rs=conn.execute(sql)
	if rs.eof and rs.bof then
		response.write "<br><br><center>操作失败！没有找到要进行操作的对象。</center>"
	elseif rs(1)=3 then
		response.write "<br><br><center>操作失败！超级系统管理员不能删除。</center>"
	else
		sql="update student set locked=0 where studid="&adminid
		conn.execute(sql)

		sql="delete from admin where adminid="&adminid
		conn.execute(sql)

		response.redirect "sysadm_admin.asp"
	end if
	set rs=nothing

end sub



sub adminlist()

dim sql,rs
%>
<BR>
<table border=0 width=80% align=center><tr><td class=mp><BR><B><a name=top>说明</a></B>：<br>
(1)删除管理员的操作将删除后台管理员帐号，前台的登陆帐号仍会保留。<br>
(2)系统初始的超级管理员帐号不能删除！<br>
(3)要修改管理员的后台登陆帐号请点击相应的用户名,仅超级系统管理员可操作。<br>
(4)添加的系统管理员必须首先是本系统的用户(在前台已注册),仅超级系统管理员可操作！
</td></tr></table>

<TABLE width=80% align=center>
<TR>
	<TD align=right>[<a href=sysadm_admin.asp?action=NewAdmin>添加系统管理员</a>]</TD>
</TR>
</TABLE>
<table width=80% align=center cellspacing=1 cellpadding=5 Class=TableBorder><tr><th>用户名</th><th>最后登陆时间</th><th>最后登陆IP</th><th>操作</th></tr>

<%
sql="select S.userid,A.lastlogin,A.ip,A.adminid from admin A inner join student S on A.adminid=S.studid"
set rs=conn.execute(sql)


do until rs.eof
response.write "<tr Class=LightTableBody><td>&nbsp;<a href=""sysadm_admin.asp?action=Modify&id="&rs("adminid")&""">"&rs("userid")&"</td><td align=center>"&rs("lastlogin")&"</td><td align=center>"&rs("ip")&"</td><td align=center><a href=""sysadm_admin.asp?action=Delete&id="&rs("adminid")&""">删除</a></td></tr>"

rs.movenext
loop

end sub



Sub addform()
%><BR><BR>
<form action="sysadm_admin.asp?action=SaveNew" method=post>
<table width="80%" border="0" cellspacing="1" cellpadding="4" align=center Class=TableBorder>
<tr><th colspan=2>添加管理员</th></tr>
<tr Class=LightTableBody><td width=30% align=right>前台用户名&nbsp;</td><td><input name=username1 type=text size=30>&nbsp;请填系统中已注册的用户名</td></tr>
<tr Class=LightTableBody><td width=30% align=right>后台管理帐号&nbsp;</td><td><input name=username2 type=text size=30></td></tr>
<tr Class=LightTableBody><td width=30% align=right>后台登陆密码&nbsp;</td><td><input name=userpwd2 type=text size=30></td></tr>
<tr Class=DarkTableBody><td colspan=2 align=center><input type="submit" name="Submit" value="&nbsp;添&nbsp;加&nbsp;" class=button>
</td></tr></table>
</form>

<%End Sub


Sub addadmin()

	Dim username1,username2,userpwd2
	dim sql,rs
	dim studid
	if Request.form("username1")="" Then
		response.write "<br><br><center>请填写前台用户名称。</center>"
		response.end
	Else
		username1=replace(Request.form("username1"),"'","")
	End if
	if Request.form("username2")="" Then
		response.write "<br><br><center>请填写后台管理帐号。</center>"
		response.end
	Else
		username2=replace(Request.form("username2"),"'","")
	End if
	if Request.form("userpwd2")="" Then
		response.write "<br><br><center>后台登陆密码。</center>"
		response.end
	Else
		userpwd2=md5(request.form("userpwd2"))
	End if

	sql="select studid from student where userid='"&username1&"'"
	set rs=conn.execute(sql)
	if rs.eof and rs.bof Then
		response.write "<br><br><center>同学录注册用户中没有该用户名称。</center>"
		response.end
	else
		studid=rs(0)
	End if

	sql="select A.userid from admin A inner join student S on A.adminid=S.studid where S.userid='"&username1&"'"
	set rs=conn.execute(sql)
	if not (rs.eof and rs.bof) Then
		response.write "<br><br><center>该用户已经是系统管理员。</center>"
		response.end
	End if
	Set rs=Nothing
	sql="update student set locked=2 where studid="&studid
	conn.execute(sql)
	sql="insert into admin (userid,userpwd,adminid) values ('"&username2&"','"&userpwd2&"',"&studid&")"
	conn.execute(sql)

	response.write "<br><br><center>添加管理员成功！</center>"


End Sub
%>



