<?php

  session_start();


  if (($_SESSION['user_is_commish']!=1)&&($_POST['formName']!='toggleResults'))

  {

	  header('Location: '.$_SERVER['HTTP_REFERER']);

  }



  ## Password Reset

  elseif ($_POST['formName']=='passReset')

  {

	  include($_SESSION['adminpath']."/dbopen.php");



	  $hmid=$_POST['user_id'];



	  $escapedPW=addslashes("baseball");

	  $salt=bin2hex(random_bytes(32));

	  $saltedPW=$escapedPW . $salt;



	  $hashedPW = hash('sha256', $saltedPW);

  

	  $query="INSERT INTO ootp_sql_admin (scope,module,setting,identifier,value) VALUES ('ALL','admin','salt','".$hmid."','".$salt."') ON DUPLICATE KEY UPDATE value='$salt';";

	  mysqli_query($db,$query);

	  $affRows=mysqli_affected_rows($db);

	  

	  if ($affRows>=1)

	  {

		  $query="INSERT INTO ootp_sql_admin (scope,module,setting,identifier,value) VALUES ('ALL','admin','password','".$hmid."','".$hashedPW."') ON DUPLICATE KEY UPDATE value='$hashedPW';";

		  mysqli_query($db,$query);

		  $affRows=mysqli_affected_rows($db);



		  if ($affRows>=1)

		  {

			  $_SESSION['passReset']=$hmid;

		  }

		  else {echo "2nd::$affRows<br/>$query<br/>".mysqli_error($db)."<br/>\n";exit;}

	  }

	  else {echo "1st::$affRows<br/>$query<br/>".mysqli_error($db)."<br/>\n";exit;}



	  mysqli_close($db);



	  header('Location: '.$_SERVER['HTTP_REFERER']);

  }



  ## Grant Commish Access

  elseif ($_POST['formName']=='grantCommish')

  {

	  include($_SESSION['adminpath']."/dbopen.php");



	  $hmid=$_POST['user_id'];



	  $query="INSERT INTO ootp_sql_admin (scope,module,setting,identifier,value) VALUES ('ALL','users','commish','".$hmid."','1') ON DUPLICATE KEY UPDATE value='1';";

	  mysqli_query($db,$query);

	  $affRows=mysqli_affected_rows($db);



	  if ($affRows==1)

	  {

		  $_SESSION['accessGranted']=$hmid;

	  }



	  mysqli_close($db);



	  header('Location: '.$_SERVER['HTTP_REFERER']);

  }



  ## Remove Commish Access

  elseif ($_POST['formName']=='denyCommish')

  {

	  include($_SESSION['adminpath']."/dbopen.php");



	  $hmid=$_POST['user_id'];



	  $query="DELETE FROM ootp_sql_admin WHERE module='users' AND identifier=$hmid AND setting='commish'";

	  mysqli_query($db,$query);

	  $affRows=mysqli_affected_rows($db);



	  if ($affRows==1)

	  {

		  $_SESSION['accessRemoved']=$hmid;

	  }



	  mysqli_close($db);



	  header('Location: '.$_SERVER['HTTP_REFERER']);

  }



  ## Toggle Results Display

  elseif ($_POST['formName']=='toggleResults')

  {

	  include($_SESSION['adminpath']."/dbopen.php");

	  $hmid=$_POST['user_id'];
	  $resToggle=(isset($_POST['hideScores'])?$_POST['hideScores']:0);

	  if ($resToggle==1)

	  {

		  $_SESSION['hideScores']=1;

		  $query="DELETE FROM ootp_sql_admin WHERE module='users' AND identifier=$hmid AND setting='showScores'";

		  mysqli_query($db,$query);

	  }

	  else

	  {

		  unset($_SESSION['hideScores']);

		  $query="INSERT INTO ootp_sql_admin (scope,module,setting,identifier,value) VALUES ('ALL','users','showScores','".$hmid."','1') ON DUPLICATE KEY UPDATE value='1';";

		  mysqli_query($db,$query);

	  }



	  mysqli_close($db);



	  header('Location: '.$_SERVER['HTTP_REFERER']);

  }



  else

  {

	  echo "You're stuck here!";

	  print_r($_POST);

  }

?>

