<?php 
require_once(dirname(__DIR__, 1) . '/config.php');
require_once(BASE_PATH . '/db/idl_connect.php');
echo '<meta charset="utf-8" />';
		
if(isset($_SESSION['user_droits'])) {
	if($_SESSION['user_droits'][5]!="2") {
		echo '<p class="noaccess">'.NOMODULE.'<br><a href="../index.php">'.ACCUEIL.'</a></p>';
	}
	else {
		?><style type="text/css">
		#mda6 { background-color: #fff; }
		#mda6 td { border: 3px #086A87 solid; }
		#mda5 td { border: 0; }
		</style><?php
		echo '<h1>Modifier ou enlever un élève</h1>
		<form method="POST" name="eleve" action="database.php?page=modifier" class="padd4">
			<table class="noborder">
				<tr>
					<td><label for="eleves">'.NAMECH.'</label></td>
					<td>
					  <input type="text" autocomplete="off" aria-autocomplete="none" class="inptxt" name="eleve" size="40" id="eleves" value="">
					</td>
				</tr>
			<tr><td colspan="2" style="text-align:right;">
				<input class="bouton boutdb" type="submit" value="'.MODIFY.'" name="modif" />
				<input class="bouton boutdb" type="submit" value="'.SUPPR.'" name="suppr" />
			</td></tr></table>
		</form>';
		
		$reserv_could=mysqli_fetch_assoc(mysqli_query($bdd,"SELECT valeur FROM ".$prefix."_parametres WHERE param_nom = 'freq_reseleve'"));
		$auth_info = mysqli_fetch_assoc(mysqli_query($bdd,"SELECT valeur FROM ".$prefix."_parametres WHERE param_nom = 'freq_resmodauth'"));

		if(isset($_POST['modif'])||isset($_GET['id'])) {
			echo '<div style="overflow: auto;  white-space: nowrap;"><form method="POST" action="database.php?page=modifier" class="padd4">';
			//sélection de l'élève
			if(isset($_POST['modif'])) {
				include('./db/proc/eleve_select.php');
				echo '<input type="hidden" name="eleve_id" value="'.$eleve_id.'" />';
			}
			else if(isset($_GET['id'])) {
				$eleve_info = mysqli_fetch_assoc(mysqli_query($bdd,"SELECT * FROM ".$prefix."_eleves WHERE eleves_id = '".$_GET['id']."'"));
				echo '<input type="hidden" name="eleve_id" value="'.$eleve_info['eleves_id'].'" />';
				unset($_SESSION['eleves_id']);
			}
			if(isset($eleve_info['nom'])) {
				echo '
				<table class="noborder">
					<tr><td colspan="2"><b>'.OBLCASE.DOTS.'</b></td></tr>
					<tr><td>'.NAME.DOTS.'</td><td><input type="text" class="inptxt" name="nom" maxlength="30" value="'.$eleve_info['nom'].'" /></td></tr>
					<tr><td>'.FORNAME.DOTS.'</td><td><input type="text" class="inptxt" name="prenom" value="'.$eleve_info['prenom'].'" /></td></tr>
					<tr><td>'.DIV.DOTS.'</td><td><div class="box"><select name="division" value=""><option></option>';
					$liste_division = mysqli_query($bdd,"SELECT division FROM ".$prefix."_eleves GROUP BY division ORDER BY division ASC");
					while($liste = mysqli_fetch_assoc($liste_division)) {
						echo '<option';
						if($eleve_info['division']==$liste['division']) {
							echo ' selected ';
						}
						echo '>'.$liste['division'].'</option>';
					}
				echo '</select></div><i>'.DATAC_ADD5.'</i> <input type="text" name="div_new" style="width:5em;" maxlength="5" value="" /></td></tr>
					<tr><td>'.BDAY.DOTS.'</td>';
					echo '<td><input type="date" class="inptxt" name="naissance" value="'.$eleve_info['naissance'].'"/>
					</td></tr>
					<tr><td>'.SEX.DOTS.'</td><td>';
						$sexcode = array('F','M');
						$sexname = array(SEX2,SEX1);
						echo '<div class="box"><select name="sexe">';
						for($i=0;$i<count($sexcode);$i++) {
							echo '<option value="'.$sexcode[$i].'"';
							if($eleve_info['sexe']==$sexcode[$i]) {
								echo ' selected ';
							}
							echo '>'.$sexname[$i].'</option>';
						}
						echo '</select></div>
					</td></tr>
					<tr><td colspan="2"><b>'.OPTCASE2.DOTS.'</b></td></tr>
					<tr><td>'.CODE.DOTS.'</td><td><input type="text" class="inptxt" name="code" maxlength="50" value="'.$eleve_info['code'].'" /></td></tr>
					<tr><td>'.MAIL2.DOTS.'</td><td><input type="text" class="inptxt" name="mail" maxlength="200" value="'.$eleve_info['mail'].'" /></td></tr>
					<tr><td>'.RESPNOM.DOTS.'</td><td><input type="text" class="inptxt" name="resp_nom" maxlength="200" value="'.$eleve_info['resp_nom'].'" /></td></tr>
					<tr><td>'.ADD1.DOTS.'</td><td><input type="text" class="inptxt" name="add1" maxlength="200" value="'.$eleve_info['add1'].'" /></td></tr>
					<tr><td>'.ADD2.DOTS.'</td><td><input type="text" class="inptxt" name="add2" maxlength="200" value="'.$eleve_info['add2'].'" /></td></tr>
					<tr><td>'.CPOSTAL.DOTS.'</td><td><input type="text" class="inptxt" name="cpostal" maxlength="200" value="'.$eleve_info['cpostal'].'" /></td></tr>
					<tr><td>'.VILLE.DOTS.'</td><td><input type="text" class="inptxt" name="ville" maxlength="200" value="'.$eleve_info['ville'].'" /></td></tr>';
					if ($reserv_could['valeur']==2) { 
						echo '<tr><td colspan="2"><b>'.IDENT4.DOTS.'</b></td></tr>';
						if($auth_info['valeur']!='code') {
							echo '<tr><td>'.IDENT2.DOTS.'</td><td><input type="text" class="inptxt" name="ident" maxlength="50" value="';
							if($auth_info['valeur']=='perso') { echo $eleve_info['id_perso']; }
							else { echo $eleve_info['id_constr']; }
							echo '" /></td></tr>';
						}
						echo '<tr><td>'.PW.DOTS.'</td><td>
						<script language="Javascript">
							function showPass() {
							  var x = document.getElementById("id_password");
							  var y = document.getElementById("eye");
							  if (x.type === "password") {
							    x.type = "text";
							    y.className = "fa-solid fa-eye-slash";
							  } else {
							    x.type = "password";
							    y.className = "fa-solid fa-eye";
							  }
							}
						</script>
						<input type="password" class="inptxt" id="id_password" name="mdp" maxlength="30" value="" /><i class="fa-solid fa-eye" id="eye" onclick="showPass()" style="margin-left: -25px; cursor: pointer;"></i></td></tr>';
					}
					echo '<tr><td colspan="2" style="text-align:right;"><input type="hidden" name="divcheck" value="'.$eleve_info['division'].'" /><input class="bouton boutdb" type="submit" value="'.FREQJ_ORDER4.'" name="modif_confirm" /></td></tr>
				</table>
				<p class="maxwidth">* <i>'.DATAC_ADD6.'</p>';
			}
			echo '</form></div>';
			if(isset($_POST['mdpreinit'])) {
				$mdp = mb_strtolower(substr($eleve_info['prenom'],0,1),'UTF-8').substr($eleve_info['naissance'],8,2).substr($eleve_info['naissance'],5,2).substr($eleve_info['naissance'],0,4);
				do {
				    $sel = bin2hex(random_bytes(16));
				} while ($sel === '0');
				$mdp_avec_sel = $mdp.$sel;
				$hashed_password = hash('sha256', $mdp_avec_sel);
				mysqli_query($bdd,"UPDATE ".$prefix."_eleves SET mdp = '".$hashed_password."', sel = '".$sel."' WHERE eleves_id = '".$_GET['id']."'");
				echo '<p class="signal">'.PW_REINIT4.'</p>';
			}
			echo '<form method="post" name="mdpreinit" action=""><p><input type="submit" name="mdpreinit" value="'.PW_REINIT5.'" /></p></form>';
		}
		
		if(isset($_POST['modif_confirm'])) {			
			function strtoupperFr($string) { // gestion des accents dans la requête
			   $string = strtoupper($string);
			   $string = str_replace(
				  array('é', 'è', 'ê', 'ë', 'à', 'â', 'ç', 'î', 'ï', 'ô', 'ù', 'û'),
				  array('É', 'È', 'Ê', 'Ë', 'À', 'Â', 'Ç', 'Î', 'Ï', 'Ô', 'Ù', 'Û'),
				  $string
			   );
				return $string;
			}
			$nom = strtoupperFr(mysqli_real_escape_string($bdd,trim($_POST['nom'])));
			$prenom = mysqli_real_escape_string($bdd,trim($_POST['prenom']));
			if(!$_POST['division']) {
				$division = mysqli_real_escape_string($bdd,trim($_POST['div_new'])); 
			}
			else {
				$division = mysqli_real_escape_string($bdd,$_POST['division']); 
			}
			$naissance = $_POST['naissance'];
			$sexe = $_POST['sexe'];
			$eleve_id = $_POST['eleve_id'];
			$code = mysqli_real_escape_string($bdd,$_POST['code']);
			if(mysqli_num_rows(mysqli_query($bdd,"SELECT * FROM ".$prefix."_user WHERE login = '$code'"))>0||$code=="reserver") {
				$code=='';
			}
			$mail = mysqli_real_escape_string($bdd,$_POST['mail']);
			$resp_nom = strtoupperFr(mysqli_real_escape_string($bdd,trim($_POST['resp_nom'])));
			$add1 = mysqli_real_escape_string($bdd,trim($_POST['add1']));
			$add2 = mysqli_real_escape_string($bdd,trim($_POST['add2']));
			$cpostal = mysqli_real_escape_string($bdd,trim($_POST['cpostal']));
			$ville = mysqli_real_escape_string($bdd,trim($_POST['ville']));

			if($nom==""||$prenom==""||$division==""||$naissance==""||$sexe=="") {
				echo '<p>'.ALERT3.'</p>';
			}
			else {
				if($reserv_could['valeur']==2) { 
					if($auth_info['valeur']!='code') {
						$login = mysqli_real_escape_string($bdd,$_POST['ident']);
						$reserv_exist = mysqli_num_rows(mysqli_query($bdd,"SELECT * FROM ".$prefix."_eleves WHERE (code = '$login' OR id_constr = '$login' OR id_perso = '$login') AND eleves_id<> '".$eleve_id."' "));
						$checku = mysqli_num_rows(mysqli_query($bdd,"SELECT login FROM ".$prefix."_user WHERE login = '$login'"));
						if($reserv_exist>0||$checku>0||$login=='reserver') {
							echo '<p class="signal">'.DATAC_MOD1.'</p>';
							$chgtlogin=0; // on ne touche pas au login
						}
						else {
							$chgtlogin=1;
						}
						if($auth_info['valeur']=='perso') { $mod = 'id_perso'; }
						else { $mod = 'id_constr'; }
					}
					if($_POST['mdp']!='') {
						$mdp = mysqli_real_escape_string($bdd,$_POST['mdp']);
						do {
					    $sel = bin2hex(random_bytes(16));
						} while ($sel === '0');
						$mdp_avec_sel = $mdp.$sel;
						$hashed_password = hash('sha256', $mdp_avec_sel);
						$chmdp = 1;
					}
					else {
						$chmdp = 0; //on ne touche pas au mdp
					}
				}
				else {
					$mdp = mb_strtolower(substr($prenom,0,1),'UTF-8').substr($naissance,8,2).substr($naissance,5,2).substr($naissance,0,4);
					do {
					    $sel = bin2hex(random_bytes(16));
					} while ($sel === '0');
					$mdp_avec_sel = $mdp.$sel;
					$hashed_password = hash('sha256', $mdp_avec_sel);
					$chmdp = 1;
				}
				
				if ($reserv_could['valeur']==2&&$auth_info['valeur']!='code') { 
					if($chmdp==1&&$chgtlogin==1) {
						$eleveup = mysqli_query($bdd,"UPDATE ".$prefix."_eleves SET nom='".$nom."', prenom='".$prenom."', division='".$division."', naissance='".$naissance."', sexe='".$sexe."', code='".$code."', ".$mod." = '".$login."', mdp = '".$hashed_password."', sel='".$sel."', mail = '".$mail."', resp_nom = '".$resp_nom."', add1 = '".$add1."', add2 = '".$add2."', cpostal = '".$cpostal."', ville = '".$ville."' WHERE eleves_id='".$eleve_id."'");
					}
					else if($chmdp==0&&$chgtlogin==1) {
						$eleveup = mysqli_query($bdd,"UPDATE ".$prefix."_eleves SET nom='".$nom."', prenom='".$prenom."', division='".$division."', naissance='".$naissance."', sexe='".$sexe."', code='".$code."', ".$mod." = '".$login."', mail = '".$mail."', resp_nom = '".$resp_nom."', add1 = '".$add1."', add2 = '".$add2."', cpostal = '".$cpostal."', ville = '".$ville."' WHERE eleves_id='".$eleve_id."'");
					}
					else {
						$eleveup = mysqli_query($bdd,"UPDATE ".$prefix."_eleves SET nom='".$nom."', prenom='".$prenom."', division='".$division."', naissance='".$naissance."', sexe='".$sexe."', code='".$code."', mail = '".$mail."', resp_nom = '".$resp_nom."', add1 = '".$add1."', add2 = '".$add2."', cpostal = '".$cpostal."', ville = '".$ville."' WHERE eleves_id='".$eleve_id."'");
					}
				}
				else {
					if($chmdp==1) {
						$eleveup = mysqli_query($bdd,"UPDATE ".$prefix."_eleves SET nom='".$nom."', prenom='".$prenom."', division='".$division."', naissance='".$naissance."', sexe='".$sexe."', code='".$code."', mdp = '".$hashed_password."', sel='".$sel."', mail = '".$mail."', resp_nom = '".$resp_nom."', add1 = '".$add1."', add2 = '".$add2."', cpostal = '".$cpostal."', ville = '".$ville."' WHERE eleves_id='".$eleve_id."'");
					}
					else {
						$eleveup = mysqli_query($bdd,"UPDATE ".$prefix."_eleves SET nom='".$nom."', prenom='".$prenom."', division='".$division."', naissance='".$naissance."', sexe='".$sexe."', code='".$code."', mail = '".$mail."', resp_nom = '".$resp_nom."', add1 = '".$add1."', add2 = '".$add2."', cpostal = '".$cpostal."', ville = '".$ville."' WHERE eleves_id='".$eleve_id."'");
					}
				}
				
				
				if($_POST['divcheck']!=$division) {
					$month = date("n");
					if($month>0&&$month<9) {
						$anneesco = (date("Y")-1).'/'.date("Y");
					}
					else {
						$anneesco = date("Y").'/'.(date("Y")+1);
					}
					$checkdiv1 = @mysqli_fetch_assoc(mysqli_query($bdd,"SELECT * FROM ".$prefix."_etab_effectifs WHERE anneesco = '".$anneesco."' AND division = '".$_POST['divcheck']."'"));
					@mysqli_query($bdd,"UPDATE ".$prefix."_etab_effectifs SET effectif = '".($checkdiv1['effectif']-1)."' WHERE anneesco = '".$anneesco."' AND division = '".$_POST['divcheck']."'");
					$checkdiv2 = @mysqli_fetch_assoc(mysqli_query($bdd,"SELECT * FROM ".$prefix."_etab_effectifs WHERE anneesco = '".$anneesco."' AND division = '".$division."'"));
					@mysqli_query($bdd,"UPDATE ".$prefix."_etab_effectifs SET effectif = '".($checkdiv2['effectif']+1)."' WHERE anneesco = '".$anneesco."' AND division = '".$division."'");
				}

				// Messages :
				$eleveupd = mysqli_query($bdd,"SELECT * FROM ".$prefix."_eleves WHERE eleves_id = '".$eleve_id."'");
				$eleveupd_info = mysqli_fetch_assoc($eleveupd);
				echo '<p><b>'.DATAC_MOD2.'</b></p><p><a href="database.php?page=modifier&id='.$eleveupd_info['eleves_id'].'"><i class="fa-solid fa-screwdriver-wrench"></i> '.$eleveupd_info['nom'].' '.$eleveupd_info['prenom'].' - '.$eleveupd_info['division'].'</a></p>';
				echo BDAY.DOTS.' ';
				if($eleveupd_info['naissance'] == '0000-00-00') {
					echo DATAC_MOD3; }
				else {
					echo date("d/m/Y", strtotime($eleveupd_info['naissance'])).'. ';
				}
				echo '<br>'.SEX.DOTS.' ';
				if(!$eleveupd_info['sexe']) {
					echo DATAC_MOD3;}
				else {
					echo $eleveupd_info['sexe'].'. ';
				}
				echo '<br>'.CODE.DOTS.' ';
				if(!$eleveupd_info['code']) {
					echo DATAC_MOD3;}
				else {
					echo $eleveupd_info['code'].'. ';
				}
				if($reserv_could['valeur']==2&&$auth_info['valeur']!='code') {
					echo '<br>'.LOGIN.DOTS.' ';
					if(@$multi=="ON"&&@$multipref==1) {
						echo $_SESSION['prefident'];
					}
					if($auth_info['valeur']=='perso') {
						echo $eleveupd_info['id_perso'];
					}
					else {
						echo $eleveupd_info['id_constr'];
					}
				}
				echo '<br>'.MAIL2.DOTS.' ';
				if(!$eleveupd_info['mail']) {
					echo DATAC_MOD3;}
				else {
					echo ''.$eleveupd_info['mail'].'. ';
				}
				echo '<br> <br>'.RESPNOM.DOTS.' ';
				if(!$eleveupd_info['resp_nom']) {
					echo DATAC_MOD3;}
				else {
					echo $eleveupd_info['resp_nom'].'. ';
				}
				echo '<br>'.ADD1.DOTS.' ';
				if(!$eleveupd_info['add1']) {
					echo DATAC_MOD3;}
				else {
					echo $eleveupd_info['add1'].'. ';
				}
				echo '<br>'.ADD2.DOTS.' ';
				if(!$eleveupd_info['add2']) {
					echo DATAC_MOD3;}
				else {
					echo $eleveupd_info['add2'].'. ';
				}
				echo '<br>'.CPOSTAL.DOTS.' ';
				if(!$eleveupd_info['cpostal']) {
					echo DATAC_MOD3;}
				else {
					echo $eleveupd_info['cpostal'].'. ';
				}
				echo '<br>'.VILLE.DOTS.' ';
				if(!$eleveupd_info['ville']) {
					echo DATAC_MOD3;}
				else {
					echo $eleveupd_info['ville'].'. ';
				}
				if($_POST['divcheck']!=$division&&isset($checkdiv1['effectif'])) {
					echo '<br>'.DATAC_ADD3.' '.$_POST['divcheck'].' '.EN.' '.$anneesco.' ('.($checkdiv1['effectif']-1).' '.ELEVS1.').';
					echo '<br>'.DATAC_ADD3.' '.$division.' '.EN.' '.$anneesco.' ('.($checkdiv2['effectif']+1).' '.ELEVS1.').';
				}
				echo '</p>';
			}
			$_POST['modif'] = "";
		}
		
		if(isset($_POST['suppr'])) {
			
			//sélection de l'élève
			include('./db/proc/eleve_select.php');
			if(isset($eleve_info['nom'])) {
				echo '<p class="maxwidth">'.DATAC_MOD4.'<br><br>'.$eleve_info['nom'].', '.$eleve_info['prenom'].', '.$eleve_info['division'].'<br />';
				echo BDAY.DOTS.' ';
				if($eleve_info['naissance'] == '0000-00-00') {
					echo DATAC_MOD3; }
				else {
					echo date("d/m/Y", strtotime($eleve_info['naissance'])).'. ';
				}
				echo SEX.DOTS.' ';
				if(!$eleve_info['sexe']) {
					echo DATAC_MOD3;}
				else {
					echo $eleve_info['sexe'].'. ';
				}
				echo CODE.DOTS.' ';
				if(!$eleve_info['code']) {
					echo DATAC_MOD3.'</p>';}
				else {
					echo ''.$eleve_info['code'].'.</p>';
				}
				echo '<form method="POST" action="database.php?page=modifier" class="padd2">
					<input type="hidden" name="divmaj" value="'.$eleve_info['division'].'" />
					<input class="bouton boutdb" type="submit" value="'.DATAC_MOD5.'" name="suppr_confirm" />
					<input class="bouton boutdb" type="submit" value="'.DATAC_MOD6.'" name="suppr_annule" />
				</form>';
			}
		}
		
		if(isset($_POST['suppr_confirm'])) {
			$eleve_id = $_SESSION['eleves_id'];
			// Suppressions :
			mysqli_query($bdd,"DELETE FROM ".$prefix."_eleves WHERE eleves_id = '$eleve_id'");
			mysqli_query($bdd,"UPDATE ".$prefix."_freqres SET statut = '1', eleves_id = '0' WHERE eleves_id = '$eleve_id' AND statut = '0'");
			mysqli_query($bdd,"UPDATE ".$prefix."_freqres SET eleves_id = '0' WHERE eleves_id = '$eleve_id'");
			mysqli_query($bdd,"DELETE FROM ".$prefix."_freqresref WHERE eleves_id = '$eleve_id'");
			mysqli_query($bdd,"DELETE FROM ".$prefix."_savele WHERE eleves_id = '$eleve_id'");
			mysqli_query($bdd,"DELETE FROM ".$prefix."_groupele WHERE eleves_id = '$eleve_id'");
			
			// Mise à jour des effectifs :
			$month = date("n");
			if($month>0&&$month<9) {
				$anneesco = (date("Y")-1).'/'.date("Y");
			}
			else {
				$anneesco = date("Y").'/'.(date("Y")+1);
			}
			$checkdiv = mysqli_fetch_assoc(mysqli_query($bdd,"SELECT * FROM ".$prefix."_etab_effectifs WHERE anneesco = '".$anneesco."' AND division = '".$_POST['divmaj']."'"));
			@mysqli_query($bdd,"UPDATE ".$prefix."_etab_effectifs SET effectif = '".($checkdiv['effectif']-1)."' WHERE anneesco = '".$anneesco."' AND division = '".$_POST['divmaj']."'");

			echo '<p>'.DATAC_MOD7;
			if(isset($checkdiv['effectif'])) {
				echo '<br>'.DATAC_ADD3.' '.$_POST['divmaj'].' '.EN.' '.$anneesco.' ('.($checkdiv['effectif']-1).' '.ELEVS1.').</p>';
			}
			
			$_POST['suppr'] = "";
			$_POST['suppr_confirm'] = "";
		}
		
		if(isset($_POST['suppr_annule'])) {
			
			$_POST['suppr'] = "";
			$_POST['suppr_confirm'] = "";
			$_POST['suppr_annule'] = "";
		}
		echo "<script type=\"text/javascript\">
				document.getElementById('eleves').focus();
			</script>";
	}
}	
	
else {
	include('include/noaccess.php');
	echo '<a href="../index.php">'.ACCUEIL.'</a></p>';
}
?>
