<!--#INCLUDE FILE="setup.asp" -->
<!--#include file="checkuser.asp"-->
<!--#include file="include/encrypt.asp"-->
<!--#include file="inc/Upiconfig.asp"-->
<!--# include file="inc/md5.asp"-->
<!--#INCLUDE FILE="include/char.asp" -->


<%
dim admin,password
admin=trim(request("name"))
userid=trim(request("name"))
Action=trim(request("action"))

password = Trim(Request("pass"))
If Len(password) = 32 Then password = Mid(password,9,16)

  if not action="" then

		Select Case Action
		Case "LoginUser"
		    Call LoginUser()
		Case "LogoutUser"
			Call LogoutUser()
		Case "ModifyInfo"
			Call ModifyUserInfo()
		Case "AddUser"
			Call AddUser()
		Case "DelUser"
			Call DelUser()
		End Select
end if
sub LoginUser()

	'前台登陆开始

	lastip = Request.ServerVariables("REMOTE_ADDR")

	LoginSQL="update student Set point=point+"&PointSet(1)&",visitcount=visitcount+1,lastlogin=now(),lastip='"&lastip&"' where userid='"&userid&"'"
	conn.execute(LoginSQL)
	response.cookies("fytxl")("fystud")=userid
	Set rs = Server.CreateObject("ADODB.Recordset")
   sql="select * from student where userid='"&userid&"'"
	rs.Open sql,Conn,1,1
	response.cookies("fytxl")("fypasswd")=rs("userpwd")
	response.cookies("fytxl")("logintime")=now()
	session("fytxl")=userid
	rs.close
	set rs=nothing
	'前台登陆结束

	'后台登陆开始
		dim username,userpwd
	dim ip,Adminsql,AdminRs

	username=admin
	userpwd=password
	if membername="" then
		'Errmsg=Errmsg+"<br>"+"<li>您还没有在前台登陆。"
		'Call disperrs(ErrMsg)
	elseif username="" or userpwd="" Then
		'Errmsg=Errmsg+"<br>"+"<li>请输入您的用户名或密码。"
		'Call disperrs(ErrMsg)
	else

		username=replace(username,"'","")
		'userpwd=md5(userpwd)
		Adminsql="select A.userid,A.userpwd from admin A inner join student S on A.adminid=S.studid where A.userid='"&username&"' and A.userpwd='"&userpwd&"' and S.userid='"&username&"' and S.locked>1"
		set AdminRs=conn.execute(Adminsql)
		if AdminRs.eof and AdminRs.bof Then
			Errmsg=Errmsg+"<br>"+"<li>您输入的用户名和密码不正确或者您不是系统管理员。<br>"&_
				"<li>请<a href=sysadm_login.asp target=_top>重新登录</a>。"
				response.write Errmsg
		'	Call disperrs(ErrMsg)
		else
			ip=Request.ServerVariables("REMOTE_ADDR")
			conn.execute("update admin set lastlogin=now(),ip='"&ip&"' where userid='"&username&"'")
			session("adminlogin")="0K"
			session.timeout=20
		'	server.transfer "Superindex.asp"
		end if
response.write "--------d------ok!----s--------"
		Set AdminRs=Nothing
	end if
	'后台登陆结束
end sub 

sub LogoutUser()
	session("adminlogin")=""
end sub

Sub AddUser '添加管理员
''''''''''检验用户不存在时添加
Set rs = Server.CreateObject("ADODB.Recordset")
sql2="select * from student where userid='"& admin &"'"
 	rs.Open sql2,Conn,1,3
        if not  rs.eof then
	    response.write "该用户已经存在！"
			studid=rs("studid")
	    aa=1
	  end if
	  
	if aa<>1 then
	rs.addnew
	rs("userid") = admin
    If Len(password) = 32 Then password = Mid(password,9,16)
	rs("userpwd") =password
	if question<>"" then
		rs("question")=question
	end if
	if answer<>"" then
		rs("answer")=answer
	end if
	'rs("email") =useremail
	'rs("sex")=sex
	rs.update
	studid=rs("studid")
	end if
	rs.close
	Set rs=Nothing

	Conn.Execute("update config Set UserNum=UserNum+1")
    
	userip1 = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
	userip2 = Request.ServerVariables("REMOTE_ADDR")
    if userip1 = ""  then lastip=userip2 else lastip=userip1

	LoginSQL="update student Set point=point+"&PointSet(1)&",lastip='"&lastip&"' where userid='"&userid&"'"
	conn.execute(LoginSQL)
'''''''''''
	sql="select A.userid from admin A inner join student S on A.adminid=S.studid where S.userid='"&admin&"'"
	set rs=conn.execute(sql)
	if not (rs.eof and rs.bof) Then
		response.write "<br><br><center>该用户已经是系统管理员。</center>"
		response.end
	End if
	Set rs=Nothing
	sql="update student set locked=2 where studid="&studid
	conn.execute(sql)
	sql="insert into admin (userid,userpwd,adminid) values ('"&admin&"','"&password&"',"&studid&")"
	conn.execute(sql)

	response.write "<br><br><center>添加管理员成功！</center>"

'set rss=nothing
	
End Sub '添加新管理员

sub ModifyUserInfo()
	adminid=clng(request.form("superid"))
	sql="update admin set userpwd='"&password&"' where userid='"&admin&"'"
	conn.execute(sql)
	sql2="update Student set userpwd='"&password&"' where userid='"&admin&"'"
	conn.execute(sql2)
	response.write "<br><br><CENTER>成功修改管理帐号!</CENTER>"

end sub 

sub DelUser()
Set rs = Server.CreateObject("ADODB.Recordset")
sql="select * from admin where userid='"& admin &"'"
 	rs.Open sql,Conn,1,3
	if not rs.eof then
	rs.delete
	end if
	rs.close
'	dim adminid
'	dim sql,rs
'	
'		sql="delete from admin where adminid="&admin
'		conn.execute(sql)

end sub
%>