<!--#INCLUDE FILE="config.asp" -->
<%
Function ChkString(string)
  if string = "" then string = " "
  ChkString = Replace(string, "'", "''")
End Function

Function ChkUser(strName, StrPasswd)
strSql ="SELECT Member_id, M_Name, M_Password from Members where M_Name = '" & strName & "' and M_Password = '" & StrPasswd &"'"
set rs_chk = my_conn.Execute (StrSql)
if rs_chk.BOF or rs_chk.EOF then
  ChkUser = 0
else
  if cint(rs_chk("Member_ID"))= cint(Request.Form("Author")) then
    ChkUser = 1
  else
    strsql = "SELECT Admin.Admin_Name, Admin.Forum_ID from Admin where Admin.Forum_ID = "&Request.form("forum_id")
    set rsAdmin = my_conn.Execute (strsql)
    if not(rsAdmin.eof or rsAdmin.bof) then
      do until rsAdmin.eof
        if rsAdmin("Admin_Name")=strName then ChkUser=1
        rsAdmin.movenext
      loop
    end if
  end If
end if
strsql = "select SFAdmin_Name, SFAdmin_Password from SFAdmin"
set rs_chk = my_conn.Execute (strSQL)
if strName=rs_chk("SFAdmin_Name") and strpasswd=rs_chk("SFAdmin_Password") then ChkUser =3
rs_chk.close	
set rs_chk = nothing
set rsAdmin = nothing
End Function

%>
<!--#INCLUDE FILE="top.asp" -->
<br><table width=<%=TableWidth%> border =0 align="center" class="sft"><tr><td><a href="index.asp">論壇首頁</a> &gt 論壇管理
</table>

<%
if Request.QueryString("mode") = "doit" then
	set my_conn= Server.CreateObject("ADODB.Connection")
	my_Conn.Open ConnString
	
	strSQL = "select T_Top from topics where topic_id = " & Request.Form("topic_id")
	set rs = my_conn.Execute (strSQL)
	
	mlev = cint(ChkUser(Request.Form("user"), Request.Form("pass"))) 
	if ((mlev = 1) and (rs("T_Top")=5)) or ((mlev = 1) and (rs("T_Top")=4)) or (mlev = 3) then
	%><table align="center" bgcolor=<%=TableColor%> border="0" width=360 cellspacing="1" cellpadding="3" class="sft">
  <tr><td bgcolor=<%=CellColor1%> align="center"><%
		if rs("T_Top")=5 then
		 strSQL = "update topics set  T_Top = 4 where topic_id = " & Request.Form("topic_id")
		 if mlev =3 then strSQL = "update topics set  T_Top = 2 where topic_id = " & Request.Form("topic_id")
		else
		 strSQL = "update topics set  T_Top = 5 where topic_id = " & Request.Form("topic_id")
		end if
		my_conn.Execute (strSQL)
		Response.Write "<P align=center>主題已被(置頂/取消)</p>"%><script language=javascript>
setTimeout("location.replace('forum.asp?forum_id=<%=Request.Form("forum_id")%>&forum_title=<%=Request.Form("forum_title")%>')",500)
</script><%
	  
	Else
		Response.Write "<P align=center>不允許(置頂/取消)主題!<br><br>"
		Response.Write "<a href=""Javascript: onClick= history.go(-1) "">退回上一步</a></p>"
	End if
	my_conn.Close
	set my_Conn = nothing
	%>
	</td>
  </tr>
</table>
<%
else 

%>	
<center></center>
<div align="center"><center>
<form action="toptopic.asp?mode=doit" method=post>
<input type=hidden name="topic_id" value="<%=Request.QueryString("topic_id") %>">
<input type=hidden name="forum_id" value="<%=Request.QueryString("forum_id") %>">
<input name="forum_title" type="hidden" value="<%=Request.QueryString("forum_title") %>">
<table align="center"  bgcolor=<%=TableColor%> border="0" width=360 cellspacing="1" cellpadding="3" class="sft">
<tr><td bgcolor="<% =HeadColor %>" colspan=2 class="sfh">(置頂/取消)主題 : <%=Request.QueryString("topic_title") %></td></tr>                
                <TR>
                    <TD bgcolor="<% =CellColor1 %>" width="30%" align="right">用戶名</td>
                    <TD bgcolor="<% =CellColor1 %>" width="70%"><input type=text name="user" size=20 value="<%=Request.Cookies("User")("Name")%>" class="box">
                         </td>
                <TR>
                    <TD bgcolor="<% =CellColor1 %>" align="right">密碼</td>
                    <TD bgcolor="<% =CellColor1 %>"><input type=password name="pass" size=20 value="<%=Request.Cookies("User")("Pword")%>" class="box">
                        </td>
                <TR>
                    <TD bgcolor="<% =CellColor1 %>" colspan=2 align=center><Input type=submit value="確定" class="btn"></td>


</TD>
</TR>
</form>
	
	</TABLE>
	<% end if %>