<?
require_once('include/global.php');
require_once("include/admin_lib.php");
require_once("include/member_lib.php");
require_once('include/member_group_lib.php');

// KVE-2022 Stored XSS 취약점 개선
$arr_url=parse_url($_SERVER['HTTP_REFERER']);
if ($arr_url['host'] !== get_http_host_domain($_SERVER['HTTP_HOST']) || $arr_url['path'] !== $nmpath . "/admin_mbr_add.php")
    msg("올바른 URL로 접근하여 주십시오.");

// check
// [2012-08-24]
//if (!$_POST['m_name'] || !$_POST['m_id'] || !$_POST['m_pwd'] || !$_POST['m_level'])
if (!$_POST['m_name'] || !$_POST['m_id'] || !$_POST['m_pwd'] || !$_POST['m_level'] || !$m_id)
	msg("올바른 URL로 접근하여 주십시오.");

if ($_GET['mode_sadmin'])
{
	auth_limit("serveradmin");

	// 사용가능한 도메인인지 확인.
		$sql = "SELECT d_name FROM ".$TB['DOMAIN']." WHERE d_no='". $_POST['sa_d_no'] . "' AND d_is_use='Y' ";
		$G_SYS['MAIL_DOMAIN'] = db_get_one($sql);
		if ($G_SYS['MAIL_DOMAIN'] == '')
			msg("존재하지 않거나 사용할 수 없는 도메인입니다.\\n\\n확인후 다시 시도하여 주십시오.");
} else
{
	auth_limit("admin");

	$_POST['sa_d_no'] = $G['DINFO']['d_no'];
}	// if()


// set
	$_POST['m_quota'] = $_POST['m_quota']*1024;
	$_POST['m_bigfile_quota'] = $_POST['m_bigfile_quota']*1024;
	$_POST['m_webhard_quota'] = $_POST['m_webhard_quota']*1024;


// 메일용량 할당량, 메일계정 할당수 제한
	require_once('include/admin_lib.php');
	mbr_add_limit($_POST['m_quota'], $_POST['m_bigfile_quota'], $_POST['m_webhard_quota']);

// [2006-03-08] 메일서버가 동작중인지 확인
	mail_server_check_limit();

// get
	$mf = get_member_field();

// set
	// data
		$m_id = strtolower($m_id);		// 소문자만 허용
		$m_jumin = $m_jumin_1 . "-" . $m_jumin_2;
		$m_birthday = $m_birthday_1 . "-" . sprintf("%02d", $m_birthday_2) . "-" . sprintf("%02d", $m_birthday_3);
		$m_mobile = $m_mobile_1 . "-" . $m_mobile_2 . "-" . $m_mobile_3;
		$m_home_tel = $m_home_tel_1 . "-" . $m_home_tel_2 . "-" . $m_home_tel_3;
		//$m_home_zipcode = $m_home_zipcode_1 . "-" . $m_home_zipcode_2;
		$m_office_tel = $m_office_tel_1 . "-" . $m_office_tel_2 . "-" . $m_office_tel_3;
		$m_office_fax = $m_office_fax_1 . "-" . $m_office_fax_2 . "-" . $m_office_fax_3;
		//$m_office_zipcode = $m_office_zipcode_1 . "-" . $m_office_zipcode_2;
		$m_marrydate = $m_marrydate_1 . "-" . sprintf("%02d", $m_marrydate_2) . "-" . sprintf("%02d", $m_marrydate_3);
		if (trim($m_homepage) == "http://" ) $m_homepage = NULL;

		$m_date1 = $m_date1_1 . "-" . sprintf("%02d", $m_date1_2) . "-" . sprintf("%02d", $m_date1_3);
		$m_date2 = $m_date2_1 . "-" . sprintf("%02d", $m_date2_2) . "-" . sprintf("%02d", $m_date2_3);
		$m_date3 = $m_date3_1 . "-" . sprintf("%02d", $m_date3_2) . "-" . sprintf("%02d", $m_date3_3);
		$m_date4 = $m_date4_1 . "-" . sprintf("%02d", $m_date4_2) . "-" . sprintf("%02d", $m_date4_3);
		$m_date5 = $m_date5_1 . "-" . sprintf("%02d", $m_date5_2) . "-" . sprintf("%02d", $m_date5_3);


	// query
		$m_id = to_db_str($m_id, $mf[m_id][length], "STRIP_TAGS");
//		$m_pwd = to_db_str($m_pwd, $mf[m_pwd][length]);
		$m_lostpwd_q = to_db_str($m_lostpwd_q, $mf[m_lostpwd_q][length]);
		$m_lostpwd_a = to_db_str($m_lostpwd_a, $mf[m_lostpwd_a][length]);
		$m_name = to_db_str($m_name, $mf[m_name][length], "STRIP_TAGS");
		$m_last_name = to_db_str($m_last_name, $mf[m_last_name][length], "STRIP_TAGS");
		$m_email = to_db_str($m_email, $mf[m_email][length], "STRIP_TAGS");
		$m_homepage = to_db_str($m_homepage, $mf[m_homepage][length], "STRIP_TAGS");
		$m_jumin = to_db_str($m_jumin, 14);
		$m_mobile = to_db_str($m_mobile, $mf[m_mobile][length]);
		$m_home_tel = to_db_str($m_home_tel, $mf[m_home_tel][length]);
		$m_home_zipcode = to_db_str($m_home_zipcode, $mf[m_home_zipcode][length]);
		$m_home_addr1 = to_db_str($m_home_addr1, $mf[m_home_addr1][length]);
		$m_home_addr2 = to_db_str($m_home_addr2, $mf[m_home_addr2][length]);
		$m_office = to_db_str($m_office, $mf[m_office][length]);
		$m_office_subject = to_db_str($m_office_subject, $mf[m_office_subject][length]);
		$m_office_tel = to_db_str($m_office_tel, $mf[m_office_tel][length]);
		$m_office_zipcode = to_db_str($m_office_zipcode, $mf[m_office_zipcode][length]);
		$m_office_addr1 = to_db_str($m_office_addr1, $mf[m_office_addr1][length]);
		$m_office_addr2 = to_db_str($m_office_addr2, $mf[m_office_addr2][length]);
		$m_memo = to_db_str($m_memo, $mf[m_memo][length]);
		$m_etc1 = to_db_str($m_etc1, $mf[m_etc1][length]);
		$m_etc2 = to_db_str($m_etc2, $mf[m_etc2][length]);
		$m_etc3 = to_db_str($m_etc3, $mf[m_etc3][length]);
		$m_etc4 = to_db_str($m_etc4, $mf[m_etc4][length]);
		$m_etc5 = to_db_str($m_etc5, $mf[m_etc5][length]);
		$m_date1 = to_db_str($m_date1, $mf[m_date1][length]);
		$m_date2 = to_db_str($m_date2, $mf[m_date2][length]);
		$m_date3 = to_db_str($m_date3, $mf[m_date3][length]);
		$m_date4 = to_db_str($m_date4, $mf[m_date4][length]);
		$m_date5 = to_db_str($m_date5, $mf[m_date5][length]);

		// [2025-09-08] 사번 항목 추가
		$m_emp_no = to_db_str($m_emp_no, $mf[m_emp_no][length]);

	// default
		$m_level;
		$m_regdate = date("Y-m-d H:i:s");
		$m_reghost = $_SERVER[REMOTE_ADDR];
		$m_login_cnt = 0;
		if (!$m_isremail)
			$m_isremail = 'Y';

		// 업로드되었을때만 파일이름을 DB에 저장함.
			// [2015-10-01] upload file 유효성 문제개선
			$m_file1 = $_FILES[m_file1][tmp_name];
			$m_file2 = $_FILES[m_file2][tmp_name];
			$m_file3 = $_FILES[m_file3][tmp_name];
			$m_file4 = $_FILES[m_file4][tmp_name];
			$m_file5 = $_FILES[m_file5][tmp_name];
			$m_file1_dbname = (is_uploaded_file($m_file1)) ? $_FILES[m_file1][name] : NULL;
			$m_file2_dbname = (is_uploaded_file($m_file2)) ? $_FILES[m_file2][name] : NULL;
			$m_file3_dbname = (is_uploaded_file($m_file3)) ? $_FILES[m_file3][name] : NULL;
			$m_file4_dbname = (is_uploaded_file($m_file4)) ? $_FILES[m_file4][name] : NULL;
			$m_file5_dbname = (is_uploaded_file($m_file5)) ? $_FILES[m_file5][name] : NULL;


// check
	// m_id
		$q = "SELECT count(*) AS cnt FROM $TB[MEMBER] WHERE m_id='$m_id' AND d_no='" . $_POST['sa_d_no'] . "'";
		$id_check_cnt = db_get_one($q);
		if($id_check_cnt > 0) msg($m_id."는 이미 가입된 ID입니다.\\n\\n다른 ID를 사용하여 주십시오.");

		if ($m_level > $AUTH['auth_m_level'])
			msg("자신보다 높은 레벨은 지정할 수 없습니다.");

		// [2013-07-08] 비밀번호 안전 레벨
		if ($_POST['m_pwd'] != '')
		{
			$password_security_alert = member_password_security($_POST['m_pwd'], $m_id);
			if ($password_security_alert != '')
				msg("입력하신 비밀번호는 사용할 수 없습니다.\\n\\n사유 : ".$password_security_alert);
		}	// if()


// proc
	// db insert
		$m_is_use = 'Y';
		$m_mail_file_group = get_mail_file_group_now($_POST['sa_d_no']);

		$m_pwd_enc = pwd_enc(stripslashes($_POST['m_pwd']), stripslashes($m_id));

		// 조직 - 기본
		$mg_no_default = member_group_rel_default($_POST['mg_no']);

		$data = array(
			'm_no'              => db_sqc_next($TB['MEMBER'], true),
			'm_id'              => $m_id,
			'm_pwd'             => $m_pwd_enc,
			'm_lostpwd_q'       => $m_lostpwd_q,
			'm_lostpwd_a'       => $m_lostpwd_a,
			'm_level'           => $m_level,
			'm_emp_no'          => $m_emp_no,
			'm_name'            => $m_name,
			'm_last_name'       => $m_last_name,
			'm_email'           => $m_email,
			'm_homepage'        => $m_homepage,
			'm_jumin'           => $m_jumin,
			'm_sex'             => $m_sex,
			'm_birthday'        => $m_birthday,
			'm_birthday_east'   => $m_birthday_east,
			'm_mobile'          => $m_mobile,
			'm_home_tel'        => $m_home_tel,
			'm_home_zipcode'    => $m_home_zipcode,
			'm_home_addr1'      => $m_home_addr1,
			'm_home_addr2'      => $m_home_addr2,
			'm_job'             => $m_job,
			'm_office'          => $m_office,
			'm_office_subject'  => $m_office_subject,
			'm_office_tel'      => $m_office_tel,
			'm_office_fax'      => $m_office_fax,
			'm_office_zipcode'  => $m_office_zipcode,
			'm_office_addr1'    => $m_office_addr1,
			'm_office_addr2'    => $m_office_addr2,
			'm_ismarry'         => $m_ismarry,
			'm_marrydate'       => $m_marrydate,
			'm_isremail'        => $m_isremail,
			'm_memo'            => $m_memo,
			'm_etc1'            => $m_etc1,
			'm_etc2'            => $m_etc2,
			'm_etc3'            => $m_etc3,
			'm_etc4'            => $m_etc4,
			'm_etc5'            => $m_etc5,
			'm_date1'           => $m_date1,
			'm_date2'           => $m_date2,
			'm_date3'           => $m_date3,
			'm_date4'           => $m_date4,
			'm_date5'           => $m_date5,
			'm_file1'           => $m_file1_dbname,
			'm_file2'           => $m_file2_dbname,
			'm_file3'           => $m_file3_dbname,
			'm_file4'           => $m_file4_dbname,
			'm_file5'           => $m_file5_dbname,
			'm_regdate'         => $m_regdate,
			'm_reghost'         => $m_reghost,
			'm_login_cnt'       => $m_login_cnt,
			'm_last_logindate'  => $m_last_logindate,
			'm_last_loginhost'  => $m_last_loginhost,
			'm_last_modifydate' => $m_last_modifydate,
			'm_last_modifyhost' => $m_last_modifyhost,
			'd_no'              => $_POST['sa_d_no'],
			'm_is_use'          => $m_is_use,
			'm_mail_file_group' => $m_mail_file_group,
			'm_quota'           => $_POST['m_quota'],
			'm_bigfile_quota'   => $_POST['m_bigfile_quota'],
			'm_webhard_quota'   => $_POST['m_webhard_quota'],
			'mg_no'             => ($mg_no_default > 0) ? $mg_no_default : null,
			'mc_no'             => $_POST['mc_no'],
			'm_cfg_from_addr'   => $_POST['m_cfg_from_addr'],
			'm_last_pwdchgdate' => $m_regdate,
		);

		if (isset($_POST['m_team_mail_is_use'])) {
			$data['m_team_mail_is_use'] = $_POST['m_team_mail_is_use'];
		}

		db_create($TB[MEMBER], $data);

		$curr_m_no = db_sqc_curr($TB['MEMBER']);		// 삽입된 데이타 키

		// 조직 갱신
		if ($_POST['mg_no'])
			$_POST['mg_no'] = member_group_rel_update($curr_m_no, $_POST['mg_no'], $isReset=false);


	// 웹메일용 처리.
		#require_once('include/admin_lib.php');
		mbr_add($curr_m_no, $m_id, $_POST['m_pwd'], $_POST['m_quota'], $m_mail_file_group);


	// upload
		require_once("include/file.php");
		$errorMsg = NULL;
		$errorMsg .= file_up($m_file1, $_FILES[m_file1][name], $_FILES[m_file1][size], $UPLOAD_DIR[MEMBER], $curr_m_no, "ALL");
		$errorMsg .= file_up($m_file2, $_FILES[m_file2][name], $_FILES[m_file2][size], $UPLOAD_DIR[MEMBER], $curr_m_no, "ALL");
		$errorMsg .= file_up($m_file3, $_FILES[m_file3][name], $_FILES[m_file3][size], $UPLOAD_DIR[MEMBER], $curr_m_no, "ALL");
		$errorMsg .= file_up($m_file4, $_FILES[m_file4][name], $_FILES[m_file4][size], $UPLOAD_DIR[MEMBER], $curr_m_no, "ALL");
		$errorMsg .= file_up($m_file5, $_FILES[m_file5][name], $_FILES[m_file5][size], $UPLOAD_DIR[MEMBER], $curr_m_no, "ALL");

// view
	if ($_POST['is_continue'] == 1)		// 계속추가시
	{
		msg("메일 계정이 추가되었습니다.\\n\\n=> ".$m_id."@".$G_SYS['MAIL_DOMAIN']."\\n\\n[확인]을 누르시면 추가작업을 계속합니다.".$errorMsg, 0);
		movepage('admin_mbr_add.php?'.get_qs());
	} else
	{
		if ($errorMsg)
			msg("메일 계정이 추가되었습니다.".$errorMsg, 0);
		movepage('admin_mbr_list.php?'.get_qs('mode'));
	}	// if()

require_once('include/global_end.php');
?>