<?
  include_once($_SERVER['DOCUMENT_ROOT'] . 'inc/mysql_connect.inc');
  include_once($_SERVER['DOCUMENT_ROOT'] . 'inc/subs.inc');
  include_once 'inc/security.inc';

  if($_POST['task'] == 'add-comment') {
    $sql = "insert into micropulse_comment (user_id, comment, create_date) values (" . $AuthID . "," . strnull($_POST['comment']) . ",now())";
    $res = mysql_query($sql, $mysql_conn);

      $subject = "Iridex Physician Portal - New MicroPulse Comment";
      $headers = "From: portal@iridex.com\r\n";
      $email_content = "A new comment has been posted about MicroPulse in the physician portal.

  Login: " . $auth_row['LOGIN'] . "
  Comment: " . $_POST['comment'] . "

  ";

      mail('ben@wsib2bmarketing.com',$subject,$email_content,$headers);

    header("Location: index.html?msg=" . urlencode("Your comment has been added."));
    exit;
  }

  $blnShowMicroPulse = 0;
  $microPulseFolderName = 'MicroPulse Online Resource';

  $comments = array();
  $sql = "select c.*,u.LOGIN from micropulse_comment c join user u on c.user_id = u.user_id order by c.create_date desc";
    $res = mysql_query($sql,$mysql_conn);
    while($row = mysql_fetch_assoc($res)) {
      $comments[] = $row;
    }

  $auth_doctor_row = get_doctor_row($AuthID,"user_id");
  if($auth_doctor_row) {
    if(!$auth_doctor_row['FIRST_NAME'] || !$auth_doctor_row['LAST_NAME'] || !$auth_doctor_row['ADDRESS1'] || !$auth_doctor_row['CITY'] || !$auth_doctor_row['EMAIL'] || !$auth_doctor_row['WORK_PHONE'] || count($AuthFieldIdList) == 0) {
      header("Location: my_account.html?u-p=1&msg=" . urlencode("Please fill out the required information below to complete the sign in process."));
      exit;
    }
  }

  $parent_folder_list = array();
  if(!empty($folder_id)) {
    $folder_row = get_one_row($folder_id,'pp_folder_id','pp_folder');
    $strGuestAccess = $folder_row['GUEST_ACCESS'];
    $strDoctorAccess = $folder_row['DOCTOR_ACCESS'];
    $strEmployeeAccess = $folder_row['EMPLOYEE_ACCESS'];
    $strSalesRepAccess = $folder_row['SALES_REP_ACCESS'];
    $strDistributorAccess = $folder_row['DISTRIBUTOR_ACCESS'];
    $field_access_id_list = array();
    $sql = "select ffa.FIELD_ID from pp_folder_field_access ffa where ffa.pp_folder_id = " . $folder_row['PP_FOLDER_ID'];
    $res = mysql_query($sql,$mysql_conn);
    while($field_row = mysql_fetch_assoc($res)) {
      $field_access_id_list[] = $field_row['FIELD_ID'];
    }

    if($folder_row['USE_PARENT_PERMISSIONS']) {
      array_unshift($parent_folder_list,$folder_row);
      $parent_folder_id = $folder_row['PARENT_FOLDER_ID'];
      while($parent_folder_id) {
        $temp_folder_row = get_one_row($parent_folder_id,'pp_folder_id','pp_folder');
        array_unshift($parent_folder_list,$temp_folder_row);
        $parent_folder_id = $temp_folder_row['PARENT_FOLDER_ID'];

        if(!$temp_folder_row['USE_PARENT_PERMISSIONS'] || !$parent_folder_id) {
          $strDoctorAccess = $temp_folder_row['DOCTOR_ACCESS'];
          $strGuestAccess = $temp_folder_row['GUEST_ACCESS'];
          $strEmployeeAccess = $temp_folder_row['EMPLOYEE_ACCESS'];
          $strSalesRepAccess = $temp_folder_row['SALES_REP_ACCESS'];
          $strDistributorAccess = $temp_folder_row['DISTRIBUTOR_ACCESS'];

          $field_access_id_list = array();
          $sql = "select ffa.FIELD_ID from pp_folder_field_access ffa where ffa.pp_folder_id = " . $temp_folder_row['PP_FOLDER_ID'];
          $res = mysql_query($sql,$mysql_conn);
          while($field_row = mysql_fetch_assoc($res)) {
            $field_access_id_list[] = $field_row['FIELD_ID'];
          }
        }
      }
    }

    if(!$blnIsAdmin) {
      if($blnIsGuest) {
        if(!$strGuestAccess) {
          header('Location: index.html?msg=' . urlencode("Invalid access attempt."));
          exit;
        }
        $blnOk = false;
        foreach($AuthFieldIdList as $intFieldId) {
          if(in_array($intFieldId,$field_access_id_list)) {
            $blnOk = true;
            break;
          }
        }
        if(!$blnOk) {
          header('Location: index.html?msg=' . urlencode("Invalid field access attempt."));
          exit;
        }
      } elseif($blnIsDoctor) {
        if(!$strDoctorAccess) {
          header('Location: index.html?msg=' . urlencode("Invalid access attempt."));
          exit;
        }
        $blnOk = false;
        foreach($AuthFieldIdList as $intFieldId) {
          if(in_array($intFieldId,$field_access_id_list)) {
            $blnOk = true;
            break;
          }
        }
        if(!$blnOk) {
          header('Location: index.html?msg=' . urlencode("Invalid field access attempt."));
          exit;
        }
      } elseif($blnIsDistributor) {
        if(!$strDistributorAccess) {
          header('Location: index.html?msg=' . urlencode("Invalid access attempt."));
          exit;
        }
        $blnOk = false;
        foreach($AuthFieldIdList as $intFieldId) {
          if(in_array($intFieldId,$field_access_id_list)) {
            $blnOk = true;
            break;
          }
        }
        if(!$blnOk) {
          header('Location: index.html?msg=' . urlencode("Invalid field access attempt."));
          exit;
        }
      } elseif($blnIsSalesRep) {
        if(!$strSalesRepAccess) {
          header('Location: index.html?msg=' . urlencode("Invalid access attempt."));
          exit;
        }
      } else {
        if(!$strEmployeeAccess) {
          header('Location: index.html?msg=' . urlencode("Invalid access attempt."));
          exit;
        }
      }
    }
  }

?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
  <meta http-equiv="content-type" content="text/html; charset=utf-8" />
  <meta name="copyright" content="Copyright 2007" />
  <meta name="description" content="" />
  <meta name="keywords" content="" />
  <meta name="robots" content="all" />

  <link href="pp.css" media="screen" rel="stylesheet" type="text/css" />

  <title>Iridex - MicroPulse&trade; Forum</title>
  <script src='jquery-1.5.1.min.js' type='text/javascript'></script>
<script type='text/javascript'>
function fbl(msg){
	if(typeof(console)!=='undefined' && typeof(console.log)!=='undefined')
		console.log(msg);
	return false;
}
$(document).ready(function(){
	$('#submitContactForm').click(function(){
		var name = $('#conName').val();
		var email = $('#conEmail').val();
		var phone = $('#conPhone').val();
		var newsletter = $('#newsletter:checked').val();
		var reprints = $('#reprints:checked').val();
		var prefContact = $('input:radio[name=prefContact]:checked').val();

		var dataString = 'name='+ name + '&email=' + email + '&phone=' + phone + '&newsletter='+ newsletter +'&reprints='+ reprints +'&prefContact='+ prefContact;
		//debug:
		//alert(dataString);
		//return false;

		$('#waiting, #shadow').show();
		//return false;

		setTimeout(function(){ //here
			$.ajax({
				type: "POST",
				url: "form_thank_you.php",
				data: dataString,
				success: function(data) {
					fbl(data);
					$('#waiting, #shadow').hide();
					$('#formFields').html("<h3>Thank You</h3><p>Your information has been submitted</p>");
				}
			});
		}, 1000) //here
		return false;
	});
});
</script>
<style type="text/css">
#contactForm{position:relative;width:200px;overflow:hidden;}
#shadow{
	width:100%;
	height:100%;
	opacity:0.8;
	filter:alpha(opacity=80);
	display:none;
	position:absolute;
	top:0;
	right:0;
	bottom:0;
	left:0;
	background-color:#fff;
}
#waiting{
	margin:30% auto;
	display:none;
	position:absolute;
	top:0;
	right:0;
	bottom:0;
	left:0;
}
</style>
</head>
<body class="browser">

<? require($_SERVER['DOCUMENT_ROOT'] . 'inc/header.inc'); ?>


  <div id="column-left">
    <div id="login-status" style="font-size: 14pt;">
      Hello,&nbsp;<span class="user"><? echo $auth_row['LOGIN']; ?></span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="logout.html">logout</a><? echo ($blnIsDoctor)?' | <a href="my_account.html">my account</a>':''; ?><? echo ($blnIsDistributor)?' | <a href="my_account_distributor.html">my account</a>':''; ?>
    </div>
    <div id="sub-nav">
      <ul>
<?
    if($blnIsDoctor || $blnIsDistributor) {
      $sql = "select distinct p.* from pp_folder p join pp_folder_field_access ffa on p.pp_folder_id = ffa.pp_folder_id where p.parent_folder_id is null and ffa.field_id in (" . join(",",$AuthFieldIdList) . ") ";

      if($blnIsDoctor) {
        $sql .= " and p.doctor_access is not null";
      } elseif($blnIsDistributor) {
        $sql .= " and p.distributor_access is not null";
      }
    } else {
      $sql = "select distinct p.* from pp_folder p where p.parent_folder_id is null ";

      if(!$blnIsAdmin) {
        if($blnIsSalesRep) {
          $sql .= " and p.sales_rep_access is not null";
        } else {
          $sql .= " and p.employee_access is not null";
        }
      }
    }
    $sql .= " order by p.name + 0";
    $res = mysql_query($sql,$mysql_conn);
    while($row = mysql_fetch_assoc($res)) {
?>
        <li><a href="index.html?folder_id=<? echo $row['PP_FOLDER_ID']; ?>"><? echo $row['NAME']; ?></a></li>
<?
    }
?>
      </ul>
      <!--   commented out the search box on Aug 18, 2011 -->
      <!--
      <form action="<? echo $_SERVER['PHP_SELF']; ?>" class="search-box" method="post">
        <input id="keyword" name="search" type="text" />
        <input name="commit" type="submit" value="Search" />
      </form>
      -->
<table width="100%">
	<tr>
		<td valign="top">
			      <div id="question-box">
			    <div id="contactForm">
				<div id="formFields">
					<h3>Contact Us</h3>

					<label for="conName">Name:</label> <input id="conName" type="text" name="name" size="30"/> <br/>
					<label for="conEmail">Email:</label> <input id="conEmail" type="text" name="email" size="30"/> <br/>
					<label for="conPhone">Phone:</label> <input id="conPhone" type="text" name="phone" size="30"/> <br/><br />
			<br />

					<input type="checkbox" checked="checked" id="newsletter" name="newsletter"/><label for="newsletter">&#160;&#160;Please add me to your email list to receive new product &amp; clinical updates.</label> <br/><br />


					<input type="checkbox" id="reprints" name="reprints"/><label for="reprints">&#160;&#160;I would like to receive article reprints.</label> <br/>
			        <label for="conArticle">Specify Article:</label> <input id="conArticle" type="text" name="article" size="30" /><br /><br />
			<br />


			        <label for="conComments">Comments/Questions:<br />
			</label> <textarea cols="27" rows="7" id="conComments" name="comments"></textarea><br /><br />

					I prefer to be contacted via: <br/>
					<input type="radio" id="cPhone" name="prefContact" value="phone"/><label for="cPhone">&#160;&#160;Phone</label> / <input type="radio" checked="checked" id="cEmail" name="prefContact" value="email"/><label for="cEmail">&#160;&#160;Email</label> <br/><br />

					<input id="submitContactForm" type="button" value="submit"/>
				</div>

				<div id="shadow"><!-- --></div>
				<img id="waiting" src="waiting.gif" />
			</div><!-- end of formFields -->
			    </div><!-- end of contactForm -->

			  </div><!-- end of question-box -->



			    </div><!-- end of subnav -->



			  
		</td>
		<td valign="top" style="padding-left: 50px;">
			<div id="content">

			  <h1>Physician Portal</h1>
			      <? 
			      echo getcwd() . "\n";
			       echo PP_FILES_PATH;

			      if(!empty($msg)) { ?>
			        <? echo '<div style="font-size: 1.5em; color: #f00; font-weight: bold;">' . $msg . '</div>'; ?>
			        <p>
			      <? } ?>

			    <p>&nbsp;</p>

			<?
			  if($search) {
			    echo '<h2>Search Results for "' . htmlentities($search) . '"</h2>';
			  } elseif($folder_id) {
			    echo '<h2><a href="index.html">Home</a>';
			    foreach($parent_folder_list as $key => $temp_folder) {
			      if($key == count($parent_folder_list) - 1) {
			        echo ' / ' . $temp_folder['NAME'];
			      } else {
			        echo ' / <a href="index.html?folder_id=' . $temp_folder['PP_FOLDER_ID'] . '">' . $temp_folder['NAME'] . '</a>';
			      }
			    }
			    echo '</h2>';
			  } else {
			    echo '<h2>Home</h2>';
			  }
			?>

			<table id="browser">
			  <colgroup>
			    <col class="icon" />
			    <col class="name" />
			    <col class="size" />
			  </colgroup>
			  <thead>
			    <tr>
			      <th></th>
			      <th>Name</th>
			      <th>Size</th>
			      <th>Last Updated</th>
			      <th></th>
			    </tr>
			  </thead>
			  <tbody id="browser-contents">
			      <tr id="top-folder-row" style="display: none"><td colspan="5" /></tr>



			        <?
			          if(!$search) {


			            $sql = "select distinct p.* from pp_folder p where ";
			            if($folder_row) {
			              $sql .= " p.parent_folder_id = " . $folder_row['PP_FOLDER_ID'];
			            } else {
			              $sql .= " p.parent_folder_id is null";
			            }
			            $sql .= " order by p.name + 0";

			            $res = mysql_query($sql,$mysql_conn);
			            while($row = mysql_fetch_assoc($res)) {
			              if(!$row['USE_PARENT_PERMISSIONS'] || !$folder_row) {
			                if(!$blnIsAdmin) {
			                  if($blnIsSalesRep) {
			                    if(!$row['SALES_REP_ACCESS']) {
			                      continue;
			                    }
			                  } elseif($blnIsDoctor) {
			                    if(!$row['DOCTOR_ACCESS']) {
			                      continue;
			                    }
			                  } elseif($blnIsDistributor) {
			                    if(!$row['DISTRIBUTOR_ACCESS']) {
			                      continue;
			                    }
			                  } else {
			                    if(!$row['EMPLOYEE_ACCESS']) {
			                      continue;
			                    }
			                  }
			                  if($blnIsDoctor || $blnIsDistributor) {
			                    $blnOk = false;
			                    $sql = "select ffa.FIELD_ID from pp_folder_field_access ffa where ffa.pp_folder_id = " . $row['PP_FOLDER_ID'];
			                    $res2 = mysql_query($sql,$mysql_conn);
			                    while($fieldRow = mysql_fetch_assoc($res2)) {
			                      if(in_array($fieldRow['FIELD_ID'],$AuthFieldIdList)) {
			                        $blnOk = true;
			                        break;
			                      }
			                    }
			                    if(!$blnOk) {
			                      continue;
			                    }
			                  }
			                }
			              }
			                if ($row['NAME'] == $microPulseFolderName) {
			                    $blnShowMicroPulse = 1;
			                }

			            ?>
			              <tr>
			                <td>&nbsp;<img alt="D" class="icon" src="images/icon-folder.gif" /></td>
			                <td><strong><a href="index.html?folder_id=<? echo $row['PP_FOLDER_ID']; ?>"><? echo $row["NAME"]; ?></a></strong></td>
			                <td>&nbsp;</td>
			                <td>&nbsp;</td>
			              </tr>
			            <?
			            }
			          }

			          unset($sql);
			          if($search) {
			            $sql = "
			              select
			                f.*,
			                p.USE_PARENT_PERMISSIONS,
			                p.PARENT_FOLDER_ID
			              from
			                pp_file f
			                join pp_folder p on f.top_parent_folder_id = p.pp_folder_id
			              where
			                f.name like '%" . preg_replace("/\'/","",$search) . "%'
			              order by
			                f.name + 0";
			            $res = mysql_query($sql,$mysql_conn);
			          } elseif($folder_row) {
			            $sql = "
			              select
			                f.*
			              from
			                pp_file f
			              where
			                f.parent_folder_id = " . $folder_row['PP_FOLDER_ID'] . "
			              order by
			                f.name + 0";
			          }

			          if(isset($sql)) {
			            $res = mysql_query($sql,$mysql_conn);
			            while($row = mysql_fetch_assoc($res)) {
			              if($search) {
			                if(!$blnIsAdmin) {
			                  $permission_folder_id = $row['PP_FOLDER_ID'];
			                  $blnUseParentPermissions = $row['USE_PARENT_PERMISSIONS'];
			                  $temp_parent_folder_id = $row['PARENT_FOLDER_ID'];
			                  while($blnUseParentPermissions && $temp_parent_folder_id) {
			                    $temp_folder_row = get_one_row($temp_parent_folder_id,'pp_folder_id','pp_folder');
			                    $permission_folder_id = $temp_folder_row['PP_FOLDER_ID'];
			                    $blnUseParentPermissions = $temp_folder_row['USE_PARENT_PERMISSIONS'];
			                    $temp_parent_folder_id = $temp_folder_row['PARENT_FOLDER_ID'];
			                  }

			                  $permission_folder_row = get_one_row($permission_folder_id,'pp_folder_id','pp_folder');

			                  if($blnIsSalesRep) {
			                    if(!$permission_folder_row['SALES_REP_ACCESS']) {
			                      continue;
			                    }
			                  } elseif($blnIsDoctor) {
			                    if(!$permission_folder_row['DOCTOR_ACCESS']) {
			                      continue;
			                    }
			                  } elseif($blnIsDistributor) {
			                    if(!$permission_folder_row['DISTRIBUTOR_ACCESS']) {
			                      continue;
			                    }
			                  } else {
			                    if(!$permission_folder_row['EMPLOYEE_ACCESS']) {
			                      continue;
			                    }
			                  }
			                  if($blnIsDoctor || $blnIsDistributor) {
			                    $blnOk = false;
			                    $sql = "select ffa.FIELD_ID from pp_folder_field_access ffa where ffa.pp_folder_id = " . $permission_folder_row['PP_FOLDER_ID'];
			                    $res2 = mysql_query($sql,$mysql_conn);
			                    while($fieldRow = mysql_fetch_assoc($res2)) {
			                      if(in_array($fieldRow['FIELD_ID'],$AuthFieldIdList)) {
			                        $blnOk = true;
			                        break;
			                      }
			                    }
			                    if(!$blnOk) {
			                      continue;
			                    }
			                  }
			                }
			              }

			          ?>

			            <tr class="icon">
			              <td>&nbsp;<img alt="<? echo $row['EXTENSION']; ?>" src="images/icon-<? echo $row['EXTENSION']; ?>.gif" /></td>
			<?
			  /*
			              <td><a href="http://www.iridexets.com/pp_files<? echo $row['PATH']; ?>" title="Download"><? echo $row["NAME"]; ?></a></td>
			  */
			?>
			              <td><a href="get_file.html?id=<? echo $row['PP_FILE_ID']; ?>" title="Download"><? echo $row["NAME"]; ?></a></td>
			              <td><? echo human_readable_filesize($row['BYTES']); ?></td>
			              <td><? echo date("n/j/Y g:ia",mysql_to_time($row["LAST_UPDATE_DATE"])); ?></td>
			            </tr>
			          <?
			            }
			          }
			          ?>
			      </table>
			<? if ($blnShowMicroPulse) { ?>

		     <style>
			 .featured-case-study-description{margin-top:-5px;}
			 .featured-case-study-description h2{font-size:14px;margin-top:40px;}
			 #commenting-tool{margin-top:20px;}
			 .be-the-first-button{float:right;position:relative;left:45px;top:137px;margin-top:-40px;}
			 #post-comment-box{background:#f5f5f5;border:1px solid #333;padding:10px;margin-top:40px;}
			 </style>

		     <!-- begin featured case study -->

		     <div id="featured-case-study">
				<img src="images/title-featured-case-study.jpg" /><br /><br />

		        <img src="images/mp-logo-plus-titles.jpg" />
		     <div class="be-the-first-button">
		     	<a href="/micropulsefeature/" target="_blank"><img src="images/be-the-first-button.png" /></a>
		     </div><!-- end of be-the-first-button -->

		     	<table>
		        	<tr>
		            	<td><a href="/micropulsefeature/" target="_blank"><img src="images/pre-oct.jpg?version=10162011" border="0"></a><br />
							<h2>OD Pre-Op. VA: 20/60, CRT: 403 µm</h2></td>
		                <td width="20">&#160;</td>
		                <td><a href="/micropulsefeature/" target="_blank"><img src="images/post-oct.jpg?version=10162011" border="0"></a><br />
							<h2>OD 3 Weeks Post-Op. VA: 20/50, CRT: 159 µm</h2></td>
		           </tr>
		       </table>

		     <div class="featured-case-study-description">
		     <h2>Physician: Aaron Appiah, MD | Tallahassee, FL</h2>

		     <p><strong>Patient:</strong> 80-year-old, female with DME in both eyes. Anti-VEGF Non-Responder

		     <p><strong>Laser:</strong> IQ 532</p>

		     <p><strong>Wavelength:</strong> 532 nm</p>
		     <p><strong>Spot Size on SLA:</strong> 100 μm</p>
		     <p><strong>Contact lens &amp; magnification:</strong> Mainster Focal Grid Lens (1.05x)</p>
		     <p><strong>Power:</strong> 500 mW</p>

		     <p><strong>Duration:</strong> 200 ms</p>
		     <p><strong>Duty Cycle:</strong> 5%</p>
		     <p><strong>Laser Technique and Treatment Pearls:</strong> Dense treatment - contiguous pattern with the laser over the edematous area based on OCT. </p>
		     <p><strong>Evidence of Laser Treatment on FA:</strong> No</p>

		     <p><strong>Follow-up and re-treatment protocol:</strong> Monthly. Retreat at 3 to 4 months if needed. Retreatment is guided by OCT using initial treatment protocol, usually treating a smaller area.</p>
		     </div><!-- end of .featured-case-study-description -->
		     <div id="commenting-tool"><!-- begin commenting-tool -->

		         <hr />
		         <h3><?= count($comments); ?> Comments</h3>
		         <? foreach($comments as $comment) { ?>
		         <p><b><?= $comment['LOGIN'] ?></b> - <?= get_time_diff(mysql_to_time($comment['CREATE_DATE']), true) ?> ago<?= ($blnIsAdmin)?' (<a href="delete_mp_comment.html?id=' . $comment['MICROPULSE_COMMENT_ID'] . '">delete</a>)':'' ?></p>
		         <p><?= $comment['COMMENT'] ?></p>
		         <hr />
		         <? } ?>

		         <div id="post-comment-box">
		    <form method="post" action="<?= $_SERVER['PHP_SELF'] ?>">
		        <a name="post-comment"></a>
		        <textarea name="comment" cols="73" rows="4"></textarea>
		        <input type="hidden" name="task" value="add-comment" />
		        <br />
		        <input type="submit" value="Post Comment">
		    </form>
				</div><!-- end of post-comment-box -->
		        <br />
		        <p>Submit your questions to micropulse@iridex.com</p>


		     </div><!-- end of commenting-tool -->
		     </div><!-- end of #featured-case-study -->

		     <? } ?>

		    </div>
		    <p>&nbsp;</p>
		</td>
	</tr>
</table>



      <br /><br />

      


   <div class="clear"></div>

  <? require($_SERVER['DOCUMENT_ROOT'] . 'inc/footer.inc'); ?>


</body>
</html>