<?php

	include('config.php');
	dbConn();

	if (!isset($member_id) || $member_id == 0) {
		header("Location: login.php");
		exit();
	}

	include('mod_html_top.php');

	if (isset($_POST['to_id']) && is_numeric($_POST['to_id']) && isset($_POST['message']) && isset($_POST['subject'])) {

		if (empty($_POST['message'])) {
			$msg_system = msgSystem("A message was not filled out.", "error");
		} else {
			if (empty($_POST['subject'])) {
				$msg_system = msgSystem("A subject was not filled out.", "error");
			} else {

				if (isset($member_id) && $member_id > 0) {

					$subject = mysql_real_escape_string($_POST['subject']);
					$message = mysql_real_escape_string($_POST['message']);

					$timestamp = date('Y-m-d H:i:s');

					mysql_query("INSERT INTO `cms_messages` (`to_id`, `from_id`, `subject`, `message`, `timestamp`) VALUES ('" . $_POST['to_id'] . "', '" . $member_id . "', '" . $subject . "', '" . $message . "', '" . $timestamp . "')") or die(mysql_error());

					if (mysql_insert_id() > 0) {
						$msg_system = msgSystem("Thank you, your message has been sent.", "success");
					} else {
						$msg_system = msgSystem("There was an error saving your message.", "error");
					}
				} else {
					$msg_system = msgSystem("You must be logged in to message.", "error");
				}
			}
		}
	}

	if (isset($msg_system)) {
		echo $msg_system;
	}

	if (isset($_GET['action']) && $_GET['action'] == "view" && isset($_GET['message']) && is_numeric($_GET['message'])) {

		$getmessage_sql = mysql_query("SELECT * FROM `cms_messages` WHERE `to_id` = '" . $member_id . "' AND `id` = '" . $_GET['message'] . "'") or die(mysql_error());

		if (mysql_num_rows($getmessage_sql) == 1) {

			$getmessage = mysql_fetch_object($getmessage_sql);

			echo '<div style="text-align: left; margin-top: 20px; color: #333; background-color: #f2f2f2; border: 1px solid #d8d8d8; padding: 20px;">
				<div style="margin-bottom: 10px; font-size: 14px;">Subject</div>
				<div style="font-size: 16px; margin-bottom: 20px;">' . $getmessage->subject . '</div>
				<div style="margin-bottom: 10px; font-size: 14px;">Message</div>
				<div style="font-size: 16px; margin-bottom: 50px;">' . $getmessage->message . '</div>
				<a href="acct_messages.php?action=reply&replyto=' . $getmessage->from_id . '" style="width: 170px; padding: 10px; background-color: #008cba; color: #fff; font-size: 16px;">reply</a>
			</div>';

		} else {
			echo "The system couldn't find that message or you don't have permission to read it.";
		}

	} elseif (isset($_GET['action']) && $_GET['action'] == "reply" && isset($_GET['replyto']) && is_numeric($_GET['replyto'])) {

		$getUser_sql = mysql_query("SELECT * FROM `cms_members` WHERE `member_id` = '" . $_GET['replyto'] . "'") or die(mysql_error());

		if (mysql_num_rows($getUser_sql) > 0) {
			$getUser = mysql_fetch_object($getUser_sql);
		}

		echo '<div style="text-align: left; margin-top: 20px; color: #333; background-color: #f2f2f2; border: 1px solid #d8d8d8; padding: 20px;">';

		?>
		<div class="brown24px" style="margin-bottom: 20px;">Send <?php echo $getUser->display_name; ?> a message.</div>
		<form action="" method="POST">
			<div style="margin-bottom: 10px; font-size: 14px;">Subject</div>
			<input type="text" name="subject" style="width: 100%; margin-bottom: 10px;">
			<div style="margin-bottom: 10px; font-size: 14px;">Message</div>
			<textarea name="message" style="width: 100%; height: 120px;"></textarea>
			<input type="hidden" name="to_id" value="<?php echo $getUser->member_id; ?>">
			<input type="submit" value="     reply     " style="width: 170px; padding: 10px; background-color: #008cba; color: #fff; font-size: 16px; margin-top: 20px;">
		</form>
		<?php

		echo '</div>';

	} else {

		echo '<div style="padding: 8px; font-size: 14px; font-weight: bold;">
			<div style="display: inline-block; width: 100px">FROM</div>
			<div style="display: inline-block; width: 150px">SUBJECT</div>
			<div style="display: inline-block; width: 240px">MESSAGE</div>
			<div style="display: inline-block;">DATE</div>
		</div>';

		$getMessages_sql = mysql_query("SELECT * FROM `cms_messages` WHERE `to_id` = '" . $member_id . "' ORDER BY id DESC") or die(mysql_error());

		if (mysql_num_rows($getMessages_sql) > 0) {

			$messageCounter = 1;

			while ($getMessages = mysql_fetch_object($getMessages_sql)) {

				$getUser_sql = mysql_query("SELECT * FROM `cms_members` WHERE `member_id` = '" . $getMessages->from_id . "'") or die(mysql_error());

				if (mysql_num_rows($getUser_sql) > 0) {
					$getUser = mysql_fetch_object($getUser_sql);
				} else {
					$getUser->display_name = 'user';
				}

				if (strlen($getMessages->subject) > 20) {
					$getMessages->subject = substr_replace($getMessages->subject, '...', 20);
				}

				if (strlen($getMessages->message) > 30) {
					$getMessages->message = substr_replace($getMessages->message, '...', 30);
				}

				echo '<div style="padding: 8px;' . ($messageCounter % 2 == 0 ? "" : " background-color: #f2f2f2;") . ' font-size: 14px;">
					<a href="acct_messages.php?action=view&message=' . $getMessages->id . '">
						<div style="display: inline-block; width: 100px">' . $getUser->display_name . '</div>
						<div style="display: inline-block; width: 150px">' . $getMessages->subject . '</div>
						<div style="display: inline-block; width: 240px">' . $getMessages->message . '</div>
						<div style="display: inline-block;">' . date("F j", strtotime($getMessages->timestamp)) . '</div>
					</a>
				</div>';

				$messageCounter++;

			}

		} else {
			echo 'You have 0 messages.';
		}

	}

	include('mod_html_middle.php');
	include('mod_html_bottom.php');