<%
'=============================================================================
' FILE: editprinter.asp
' PURPOSE: Edit printer information with nested entity creation
' SECURITY: Parameterized queries, HTML encoding, input validation
' UPDATED: 2025-10-27 - Migrated to secure patterns
'=============================================================================
%><html>
<head>
<link rel="stylesheet" href="./style.css" type="text/css">
<!--#include file="./includes/sql.asp"-->
<!--#include file="./includes/validation.asp"-->
<!--#include file="./includes/db_helpers.asp"-->
</head>

<body>
<div class="page">
<%
	'=============================================================================
	' SECURITY: Validate printerid from querystring
	'=============================================================================
	Dim printerid
	printerid = GetSafeInteger("QS", "printerid", 0, 1, 999999)

	If printerid = 0 Then
		Response.Write("<div class='alert alert-danger'>Error: Invalid printer ID.</div>")
		Response.Write("<a href='displayprinters.asp'>Go back</a>")
		objConn.Close
		Response.End
	End If

	'=============================================================================
	' SECURITY: Get and validate all form inputs
	'=============================================================================
	Dim modelid, serialnumber, ipaddress, fqdn, printercsfname, printerwindowsname, machineid, maptop, mapleft
	modelid = GetSafeString("FORM", "modelid", "", 1, 50)
	serialnumber = GetSafeString("FORM", "serialnumber", "", 0, 100)
	ipaddress = GetSafeString("FORM", "ipaddress", "", 0, 50)
	fqdn = GetSafeString("FORM", "fqdn", "", 0, 255)
	printercsfname = GetSafeString("FORM", "printercsfname", "", 0, 50)
	printerwindowsname = GetSafeString("FORM", "printerwindowsname", "", 0, 255)
	machineid = GetSafeInteger("FORM", "machineid", 0, 1, 999999)
	maptop = GetSafeInteger("FORM", "maptop", 50, 0, 9999)
	mapleft = GetSafeInteger("FORM", "mapleft", 50, 0, 9999)

	' Get form inputs for new model
	Dim newmodelnumber, newvendorid, newmodelnotes, newmodeldocpath
	newmodelnumber = GetSafeString("FORM", "newmodelnumber", "", 0, 255)
	newvendorid = GetSafeString("FORM", "newvendorid", "", 0, 50)
	newmodelnotes = GetSafeString("FORM", "newmodelnotes", "", 0, 255)
	newmodeldocpath = GetSafeString("FORM", "newmodeldocpath", "", 0, 255)

	' Get form inputs for new vendor
	Dim newvendorname
	newvendorname = GetSafeString("FORM", "newvendorname", "", 0, 50)

	'=============================================================================
	' Validate required fields
	'=============================================================================
	If modelid <> "new" And (Not IsNumeric(modelid)) Then
		Response.Write("<div class='alert alert-danger'>Error: Invalid model ID.</div>")
		Response.Write("<a href='displayprinter.asp?printerid=" & Server.HTMLEncode(printerid) & "'>Go back</a>")
		objConn.Close
		Response.End
	End If

	If machineid = 0 Then
		Response.Write("<div class='alert alert-danger'>Error: Invalid machine ID.</div>")
		Response.Write("<a href='displayprinter.asp?printerid=" & Server.HTMLEncode(printerid) & "'>Go back</a>")
		objConn.Close
		Response.End
	End If

	'=============================================================================
	' SECURITY: Handle new model creation with parameterized query
	'=============================================================================
	If modelid = "new" Then
		If Len(newmodelnumber) = 0 Then
			Response.Write("<div class='alert alert-danger'>New model number is required</div>")
			Response.Write("<a href='displayprinter.asp?printerid=" & Server.HTMLEncode(printerid) & "'>Go back</a>")
			objConn.Close
			Response.End
		End If

		If Len(newvendorid) = 0 Then
			Response.Write("<div class='alert alert-danger'>Vendor is required for new model</div>")
			Response.Write("<a href='displayprinter.asp?printerid=" & Server.HTMLEncode(printerid) & "'>Go back</a>")
			objConn.Close
			Response.End
		End If

		' Handle new vendor creation (nested)
		If newvendorid = "new" Then
			If Len(newvendorname) = 0 Then
				Response.Write("<div class='alert alert-danger'>New vendor name is required</div>")
				Response.Write("<a href='displayprinter.asp?printerid=" & Server.HTMLEncode(printerid) & "'>Go back</a>")
				objConn.Close
				Response.End
			End If

			' Insert new vendor using parameterized query
			Dim sqlNewVendor
			sqlNewVendor = "INSERT INTO vendors (vendor, isactive, isprinter, ispc, ismachine) VALUES (?, 1, 1, 0, 0)"

			On Error Resume Next
			Dim cmdNewVendor
			Set cmdNewVendor = Server.CreateObject("ADODB.Command")
			cmdNewVendor.ActiveConnection = objConn
			cmdNewVendor.CommandText = sqlNewVendor
			cmdNewVendor.CommandType = 1
			cmdNewVendor.Parameters.Append cmdNewVendor.CreateParameter("@vendor", 200, 1, 50, newvendorname)
			cmdNewVendor.Execute

			If Err.Number <> 0 Then
				Response.Write("<div class='alert alert-danger'>Error creating new vendor: " & Server.HTMLEncode(Err.Description) & "</div>")
				Response.Write("<a href='displayprinter.asp?printerid=" & Server.HTMLEncode(printerid) & "'>Go back</a>")
				objConn.Close
				Response.End
			End If

			' Get the newly created vendor ID
			Dim rsNewVendor
			Set rsNewVendor = objConn.Execute("SELECT LAST_INSERT_ID() AS newid")
			newvendorid = CLng(rsNewVendor("newid"))
			rsNewVendor.Close
			Set rsNewVendor = Nothing
			Set cmdNewVendor = Nothing
			On Error Goto 0
		End If

		' Insert new model using parameterized query
		Dim sqlNewModel
		sqlNewModel = "INSERT INTO models (modelnumber, vendorid, notes, documentationpath, isactive) VALUES (?, ?, ?, ?, 1)"

		On Error Resume Next
		Dim cmdNewModel
		Set cmdNewModel = Server.CreateObject("ADODB.Command")
		cmdNewModel.ActiveConnection = objConn
		cmdNewModel.CommandText = sqlNewModel
		cmdNewModel.CommandType = 1
		cmdNewModel.Parameters.Append cmdNewModel.CreateParameter("@modelnumber", 200, 1, 255, newmodelnumber)
		cmdNewModel.Parameters.Append cmdNewModel.CreateParameter("@vendorid", 3, 1, , CLng(newvendorid))
		cmdNewModel.Parameters.Append cmdNewModel.CreateParameter("@notes", 200, 1, 255, newmodelnotes)
		cmdNewModel.Parameters.Append cmdNewModel.CreateParameter("@documentationpath", 200, 1, 255, newmodeldocpath)
		cmdNewModel.Execute

		If Err.Number <> 0 Then
			Response.Write("<div class='alert alert-danger'>Error creating new model: " & Server.HTMLEncode(Err.Description) & "</div>")
			Response.Write("<a href='displayprinter.asp?printerid=" & Server.HTMLEncode(printerid) & "'>Go back</a>")
			objConn.Close
			Response.End
		End If

		' Get the newly created model ID
		Dim rsNewModel
		Set rsNewModel = objConn.Execute("SELECT LAST_INSERT_ID() AS newid")
		modelid = CLng(rsNewModel("newid"))
		rsNewModel.Close
		Set rsNewModel = Nothing
		Set cmdNewModel = Nothing
		On Error Goto 0
	End If

	'=============================================================================
	' SECURITY: Update printer using parameterized query
	'=============================================================================
	Dim strSQL
	strSQL = "UPDATE printers SET modelid = ?, serialnumber = ?, ipaddress = ?, fqdn = ?, " & _
	         "printercsfname = ?, printerwindowsname = ?, machineid = ?, maptop = ?, mapleft = ? " & _
	         "WHERE printerid = ?"

	On Error Resume Next
	Dim cmdUpdate
	Set cmdUpdate = Server.CreateObject("ADODB.Command")
	cmdUpdate.ActiveConnection = objConn
	cmdUpdate.CommandText = strSQL
	cmdUpdate.CommandType = 1

	' Add parameters in order
	cmdUpdate.Parameters.Append cmdUpdate.CreateParameter("@modelid", 3, 1, , CLng(modelid))
	cmdUpdate.Parameters.Append cmdUpdate.CreateParameter("@serialnumber", 200, 1, 100, serialnumber)
	cmdUpdate.Parameters.Append cmdUpdate.CreateParameter("@ipaddress", 200, 1, 50, ipaddress)
	cmdUpdate.Parameters.Append cmdUpdate.CreateParameter("@fqdn", 200, 1, 255, fqdn)
	cmdUpdate.Parameters.Append cmdUpdate.CreateParameter("@printercsfname", 200, 1, 50, printercsfname)
	cmdUpdate.Parameters.Append cmdUpdate.CreateParameter("@printerwindowsname", 200, 1, 255, printerwindowsname)
	cmdUpdate.Parameters.Append cmdUpdate.CreateParameter("@machineid", 3, 1, , CLng(machineid))
	cmdUpdate.Parameters.Append cmdUpdate.CreateParameter("@maptop", 3, 1, , CLng(maptop))
	cmdUpdate.Parameters.Append cmdUpdate.CreateParameter("@mapleft", 3, 1, , CLng(mapleft))
	cmdUpdate.Parameters.Append cmdUpdate.CreateParameter("@printerid", 3, 1, , CLng(printerid))

	cmdUpdate.Execute

	If Err.Number <> 0 Then
		Response.Write("<div class='alert alert-danger'>Error: " & Server.HTMLEncode(Err.Description) & "</div>")
		Response.Write("<a href='displayprinter.asp?printerid=" & Server.HTMLEncode(printerid) & "'>Go back</a>")
		Set cmdUpdate = Nothing
		objConn.Close
		Response.End
	End If

	Set cmdUpdate = Nothing
	On Error Goto 0
%>
<meta http-equiv="refresh" content="0; url=./displayprinter.asp?printerid=<%=Server.HTMLEncode(printerid)%>">
<%
'=============================================================================
' CLEANUP
'=============================================================================
objConn.Close
%>
</div>
</body>
</html>
