<?PHP
$stage=1;			#1-alpha, 2-beta, 3
include_once(".htfolder.inc.php");
define ('MIME_BOUNDARY',"Identity is the Foundation of Security");
define ('RUNQUERY',"Run Query");
define ('SHOWTABLE',"Show Table");
define ('RESULTS',"results");

loggywoggy("We are in $file.");

if (!isset($_SERVER["HTTPS"]) || ($_SERVER["HTTPS"] != "on"))
{
	buggywuggy("Redirecting to ".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);
	redirects($_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);
}
if (!isset($_SERVER["SSL_CLIENT_CERT"]))
{
	die("You have to present a registered personal certificate to come here.");
}
$cert=$_SERVER["SSL_CLIENT_CERT"];
$serial=$_SERVER["SSL_CLIENT_M_SERIAL"];
$query="select * from officer where serialNumber = ".hexdec($serial);
$res=$db->query($query);
if (!PEAR::isError($res)) while ($officer=$res->fetchRow())
{
	if ($officer["certificate"] == $cert) break;
#echo "<BR>The ".strlen($cert)." character certificate presented is:<BR>$cert<BR>and the ".strlen($officer["certificate"])." character certificate in the database is<BR>".$officer["certificate"];
	unset($officer);
}
else
{
	echo "The error in looking at the officer table is:<BR>".$res->getMessage();
	echo "<BR>and the query was<BR>$query<BR>";
}
if (!isset($officer))
{
	$res=$db->query("select * from bad_officer where serialNumber = ".hexdec($serial));
	if (!PEAR::isError($res)) while ($bad=$res->fetchRow())
	{
		if ($bad["certificate"] == $cert)
		{
			$attempts=$bad["attempts"]+1;
			$db->query("update bad_officer set attempts=$attempts,last=now() where bad_officerid=".$bad["bad_officerid"]);
			die("We still have not registered your certificate and you have now tried $attempts times.");
		}
	}
	$query="insert into bad_officer (serialNumber,commonName,certificate) values ("
		.hexdec($serial).",'".$_SERVER["SSL_CLIENT_S_DN_CN"]."','".$_SERVER["SSL_CLIENT_CERT"]."')";
	$res=$db->query($query);
	if (PEAR::isERROR($res))
	{
		loggywoggy ("Bad insert query<BR>$query\n".$res->getMessage());
		die ("Sorry but we were unable to capture your certificate.");
	}
	die("Your certificate is not registered with us.  Please take care of this before you return.");
}
$officerid=$officer["officerid"];
$msgs="";	$menu="";
################################################################################
################################################################################

if (!isset($_REQUEST["display"])) $_REQUEST["display"]="NIL";

$menu.=addMenu("$self?display=newclient","Register a New Client");
$menu.=addMenu("$self?display=newsubject","Register a New Subject");
$menu.=addMenu("$self?command=editsubject","Modify a Subject");
$menu.=addMenu("$self?command=viewsubject","View a Subject");

echo page_top("ValID database query page","",$menu);
echo "<H2>Officer Input Page for ".$officer["commonname"]."</H2>";

switch ($_REQUEST["display"])
{
	case SHOWTABLE:
		echo DBtable($db,$_REQUEST["query"],1,3);
		break;
	case RESULTS:
	case RUNQUERY:
		if (isset($_REQUEST["query"])) $query=str_replace("\\'","'",$_REQUEST["query"]);
		echo DBqueryTable($db,$query,1,3);
	case "NIL":
	default:
		break;
		
}
		echo "<FORM action=$self method=post>";
		echo "<TABLE>";
		echo "<TR><TD align=right>Query or table name:</TD><TD colspan=2><INPUT name=query></TD></TR>";
		echo "<TR><TD></TD><TD><INPUT type=submit name=display value='".RUNQUERY."'></TD><TD><INPUT type=submit name=display value='".SHOWTABLE."'></TD></TR>";
		echo "</TABLE>";
		echo "</FORM>";


?>