/***********************************************************************************
 * @@ Program Name : HttpGroupDeptList.java Description : 사용자그룹에속한 부서들의 목록 Author : 강원중 Create Date : 2003-12-16 History
 *    :
 * @@
 ***********************************************************************************/

package kr.co.kihyun.beans.user;

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import kr.co.kihyun.lang.Encoder;
//import kr.co.kihyun.lang.MInteger;
//import kr.co.kihyun.lang.MLong;
import kr.co.kihyun.lang.MString;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@WebServlet("/servlet/kr.co.kihyun.beans.user.HttpGroupDeptList")
public class HttpGroupDeptList extends HttpServlet {
        private static final Logger LOG = LoggerFactory.getLogger(HttpGroupDeptList.class);
	/**
	 * 
	 */
	private static final long serialVersionUID = 1L;

	public void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException,
			NumberFormatException {

		doPost(req, res);
		return;
	}

	public void doPost(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException,
			NumberFormatException {
		res.setContentType("text/html;charset=UTF-8");
		PrintWriter out = res.getWriter();

		String tempPartID = req.getParameter("partID");
		String nameList = Encoder.toJava(req.getParameter("nameList"));
		String idList = req.getParameter("idList");
		String selectType = req.getParameter("selectType");

		if (!MString.isNull(tempPartID)) {
			// out.println(getLeftList(tempPartID, selectType));
			out.println(getLeftTreeList(tempPartID, selectType));
		} else if (!MString.isNull(nameList)) {
                        //v2. 9.크로스사이트 스크립트 (PrintWrier) : Update by KWON,HAN
//			out.println(getRightList(nameList, idList));
                        
                        // 수정 : 외부 입력값 필터링
                        String filtered_nameList = nameList.replaceAll("<","").replaceAll(">","").replaceAll("&","").replaceAll(",","");
                        String filtered_idList = idList.replaceAll("<","").replaceAll(">","").replaceAll("&","").replaceAll(",","");
                        LOG.debug("v2 9.크로스사이트 스크립트 (PrintWrier) : HttpGroupDeptList.doPost() filtered_nameList={}, Not Test", filtered_nameList);
                        LOG.debug("v2 9.크로스사이트 스크립트 (PrintWrier) : HttpGroupDeptList.doPost() filtered_idList={}, Not Test", filtered_idList);
                        out.println(getRightList(filtered_nameList, filtered_idList)); 
                        //========================================                          
		}
	}

	private String getLeftTreeList(String partID, String selectType) {

		String[] deptIDList = null;
		String[] deptNameList = null;
		int deptCount = 0;
		int deptTotalCount = 0;

		UserGroup deptList = new UserGroup();

		deptIDList = deptList.getDeptID(partID);
		deptNameList = deptList.getDeptName(partID);
		deptCount = deptList.getDeptCount(partID);

		deptTotalCount = deptCount;

		StringBuffer strbuf = new StringBuffer();

		/******************** Left list(선택리스트) JavaScript 생성 ********************/
		strbuf.append("<script language=javascript>\n\n");
		strbuf.append("	function movelist(id){\n");
		strbuf.append("	}\n\n");

		strbuf.append("</script>\n");

		/******************** HTML 생성 ********************/
		strbuf.append("<html>\n");
		strbuf.append("	<head></head>\n");
		strbuf.append("<link rel='StyleSheet' href='/totsys/common/css/dtree.css' type='text/css' />\n");
		strbuf.append("<script type='text/javascript' src='/totsys/common/js/dtree.js'></script>\n\n");

		strbuf.append("	<body bgcolor=\"#FFFFFF\" text=\"#000000\" leftmargin=\"0\" topmargin=\"0\" marginwidth=\"0\" marginheight=\"0\">\n");
		strbuf.append("		<form name=AddrList method=Post>\n");
		strbuf.append("			<input type=hidden name='selID' value=''>\n");
		strbuf.append("			<input type=hidden name='selName' value=''>\n");
		strbuf.append("		<table border=0 cellpadding=5 cellspacing=2 width=100%>\n");
		strbuf.append("			<tr>\n");
		strbuf.append("				<td>\n");

		strbuf.append("<div class='dtree'>\n");

		strbuf.append("	<p><a href='javascript: d.openAll();'>open all</a> | <a href='javascript: d.closeAll();'>close all</a></p>\n");

		strbuf.append("	<script type='text/javascript'>\n");

		strbuf.append("		d = new dTree('d');\n");

		strbuf.append("		d.add(0,-1,'\").append.(Moumi.getMessageBundle().getString(\"moumi.message.tot_doc.user\")).append(Moumi.getMessageBundle().getString(\"moumi.message.tot_doc.group\")).append(\"');\n");

		for (int i = 0; i < deptTotalCount; i++) {
			strbuf.append("		d.add(" + deptIDList[i] + ",0,'" + deptNameList[i] + "','javascript: parent.leftAdd("
					+ deptIDList[i] + ");');\n");
		}

		strbuf.append("		document.write(d);\n");
		strbuf.append("		d.openAll();\n\n");
		strbuf.append("		//-->");
		strbuf.append("	</script>");

		strbuf.append("</div>");

		/******************** HTML 생성 ********************/
		strbuf.append("				</td>\n");
		strbuf.append("			</tr>\n");
		strbuf.append("		</table>\n");
		strbuf.append("		</form>\n");
		strbuf.append("	</body>\n");
		strbuf.append("</html>\n");

		return strbuf.toString();
	}

	private String getRightList(String name, String id) {
		StringBuffer strbuf = new StringBuffer();
		// String[] arrayName = name.split(",");
		String[] arrayName = null;
		DeptView deptView = new DeptView();

		String[] arrayID = id.split(",");
		int count = 0;
		name = null;

		if (arrayID.length > 0) {
			count = arrayID.length;

			arrayName = new String[count];
			for (int i = 0; i < count; i++) {
                                //v2. 6.SQL 삽입 : deptView.executeQuery에서 prepare SQL 문으로 되어 있다.
				deptView.executeQuery(arrayID[i]);
                                //================
				arrayName[i] = deptView.getName();
			}

			name = arrayName[0];
			for (int i = 1; i < count; i++) {
				name = name + "," + arrayName[i];
			}
		} else {
			throw new NullPointerException();
		}

		/******************** Right Frame(추가 리스트) JavaScript 생성 ********************/
		strbuf.append("<script language=\"javascript\">\n\n");
		strbuf.append("	function movelist(){\n");
		strbuf.append("		var name = '';\n");
		strbuf.append("		var id = '';\n");
		strbuf.append("		var addForm = document.AddrList;\n");
		for (int i = 0; i < count; i++) {
			strbuf.append("		if(addForm.name");
			strbuf.append(i);
			strbuf.append(".checked == false){\n");
			strbuf.append("			id += addForm.id");
			strbuf.append(i);
			strbuf.append(".value+',';\n");
			strbuf.append("			name += addForm.name");
			strbuf.append(i);
			strbuf.append(".value+',';\n");
			strbuf.append("		}\n\n");
		}
		strbuf.append("		parent.leftFrameDel(name, id);\n");
		strbuf.append("	}\n\n");

		strbuf.append("	function AllSelect() {\n");
		strbuf.append("		var addForm = document.AddrList;\n");
		for (int i = 0; i < count; i++) {
			strbuf.append("		addForm.name");
			strbuf.append(i);
			strbuf.append(".checked = true;\n");
		}
		strbuf.append("	}\n\n");

		strbuf.append("	function AllCancel() {\n");
		strbuf.append("		var addForm = document.AddrList;\n");
		for (int i = 0; i < count; i++) {
			strbuf.append("		addForm.name");
			strbuf.append(i);
			strbuf.append(".checked = false;\n");
		}
		strbuf.append("	}\n\n");

		strbuf.append("	function setNameList() {\n");
		strbuf.append("		parent.nameList = \"" + name + "\";\n");
		strbuf.append("	}\n\n");
		strbuf.append("</script>\n");

		/******************** HTML 생성 ********************/
		strbuf.append("<html>\n");
		strbuf.append("	<head></head>\n");
		strbuf.append("	<body bgcolor=\"#FFFFFF\" text=\"#000000\" leftmargin=\"0\" topmargin=\"0\" marginwidth=\"0\" marginheight=\"0\" onload=\"setNameList()\">\n");
		strbuf.append("		<form name=AddrList method=Post>\n");
		strbuf.append("		<table border=0 cellpadding=5 cellspacing=2 width=100%>\n");
		strbuf.append("			<tr>\n");
		strbuf.append("				<td>\n");
		for (int i = 0; i < count; i++) {
			strbuf.append("					<input type=checkbox name=name");
			strbuf.append(i);
			strbuf.append(" value=\"");
			strbuf.append(arrayName[i]);
			strbuf.append("\" onclick=\"\"><font size=2 face=\"돋움\">");
			strbuf.append(arrayName[i]);
			strbuf.append("</font><br>\n");
			strbuf.append("					<input type=hidden name=id");
			strbuf.append(i);
			strbuf.append(" value=\"");
			strbuf.append(arrayID[i]);
			strbuf.append("\">\n");
		}
		strbuf.append("				</td>\n");
		strbuf.append("			</tr>\n");
		strbuf.append("		</table>\n");
		strbuf.append("		</form>\n");
		strbuf.append("	</body>\n");
		strbuf.append("</html>\n");

		return strbuf.toString();
	}
}
