First Commit

ajax/ajax.DataRecord.Update.php

@@ -0,0 +1,180 @@
+<?php
+uopz_allow_exit(true);
+
+$ValidAccess = 2010;
+require_once("include/globals.php");
+
+$sessionName = 'hotlunch';
+session_name($sessionName);
+session_start();
+
+$moduleName = "ajax.DataRecord.Update.php";
+// if ($_SESSION['UserInfo']['type'] == 'SuperUser') startLog($moduleName);
+startLog($moduleName);
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   logExit("Session is not active\n");
+   exit;
+}
+
+// CSRF token validation
+include "include/ajax.csrfToken.php";
+
+
+// Set default timezone
+date_default_timezone_set("Canada/Pacific");
+$now = date("Y-m-d H:i:s",time());
+
+$return_data = array();
+$sequence_flag = 'N';
+
+
+
+unset($template);
+
+// Get parameters
+extract($_REQUEST);
+$parameters = $_REQUEST;
+
+
+
+// Validate parameters
+if (strlen($table_name) == 0) logExit("Table name is undefined\n");
+if (strstr($table_name,' ') !== FALSE) logExit("Invalid table name\n");
+writeLog("table_name: $table_name");
+
+switch ($table_name) {
+   case 'invoice_header':
+      if ($_SESSION['UserInfo']['type'] != 'SuperUser') {
+         logExit("Invalid user access to table $table_name");
+      }
+      break;
+
+   case 'schools':
+      if ($_SESSION['UserInfo']['type'] != 'SuperUser' && $_SESSION['UserInfo']['type'] != 'Administrator') {
+         logExit("Invalid user access to table $table_name");
+      }
+      break;
+}
+
+
+writeLog("-- $record_num --\n");
+
+// Ensure numeric parameters are numeric
+if (!is_numeric($record_num)) logExit("Record num is not numeric\n");
+$record_num = intval($record_num);
+$parameters['record_num'] = $record_num;
+
+
+// Sanitize parameters
+$table_name = db_escape_string($table_name);
+$sequence_flag = db_escape_string($sequence_flag);
+
+$school_num = $school_record['record_num'];
+if (array_key_exists('school_num',$_REQUEST)) $school_num = $_REQUEST['school_num'];
+$parameters['school_num'] = $school_num;
+
+
+// Check for custom validation
+$validationScript = "ajax.validation." . $table_name . ".php";
+if (array_key_exists('userid',$_REQUEST)) {
+   if (!isset($Validation) || $Validation != 'N') {
+      if (is_file($validationScript)) {
+         writeLog("validationScript: $validationScript found\n");
+         include $validationScript;
+         $msg = dataValidation($_REQUEST);
+         if ($msg !== 0) logExit("$moduleName: validation failure - $msg\n");
+      }
+   }
+}
+
+
+// Reformat phone number fields
+if (isset($phone) && strlen($phone)) $parameters['phone'] = formatPhoneNumber($phone,$school_record['country']);
+if (isset($cell_phone) && strlen($cell_phone)) $parameters['cell_phone'] = formatPhoneNumber($cell_phone,$school_record['country']);
+if (isset($contact_phone) && strlen($contact_phone)) $parameters['contact_phone'] = formatPhoneNumber($contact_phone,$school_record['country']);
+if (isset($contact_cell) && strlen($contact_cell)) $parameters['contact_cell'] = formatPhoneNumber($contact_cell,$school_record['country']);
+
+
+// Error logging
+writeLog("table_name: $table_name\n");
+writeLog("record_num: $record_num\n");
+writeLog("sequence_flag: $sequence_flag\n");
+
+
+// Defaults
+$parameters['date_updated'] = date("Y-m-d",time());
+
+$table = new Table($table_name);
+
+// Create insert query if record_num is zero or else update
+if ($record_num == 0) {
+   // Defaults
+   $parameters['date_added'] = date("Y-m-d",time());
+
+   // Get next sequence number
+   if (isset($sequence_flag) && $sequence_flag == 'Y') {
+      switch ($table_name) {
+         case '_form_fields':
+            $parameters['sequence'] = intval(db_getVal("SELECT max(sequence) FROM $table_name")) + 1;
+            break;
+
+         default:
+            $parameters['sequence'] = intval(db_getVal("SELECT max(sequence) FROM $table_name WHERE school_num = $school_num")) + 1;
+            break;
+      }
+   }
+
+   $query = $table->BuildInsert($parameters);
+   writeLog("query: $query\n");
+   db_query($query);
+   $record_num = db_insert_id();
+}
+else {
+   $query = $table->BuildUpdate($parameters);
+   writeLog("query: $query\n");
+   db_query($query);
+
+   // Update all orders to status paid if there is a credit
+   if ($table_name == 'hotlunch_order_header' && isset($UpdateAll) && $UpdateAll == 'Yes') {
+      $query = "SELECT ordered_by_num FROM hotlunch_order_header WHERE school_num = $school_num AND record_num = $record_num";
+      $ordered_by = db_getVal($query);
+
+      if ($ordered_by > 0) {
+         $query = "SELECT user_num FROM people WHERE school_num = $school_num AND record_num = $ordered_by";
+         $user_num = db_getVal($query);
+
+         if ($user_num > 0) {
+            $results = db_query("SELECT * FROM people WHERE school_num = $school_num AND user_num = $user_num");
+            if (db_num_rows($results)) {
+               while ($row = db_fetch_assoc($results)) {
+                  $ordered_by .= "," . $row['record_num'];
+               }
+            }
+
+            // Update all orders to Paid status
+            $query = "UPDATE hotlunch_order_header SET amount_paid = order_total, payment_method = '$payment_method', paid_date = '$paid_date', status = 'Paid' " .
+                     "WHERE school_num = $school_num " .
+                     "AND status IN ('Unpaid','Inactive') " .
+                     "AND ordered_by_num IN ($ordered_by)";
+            db_query($query);
+
+            // Update all user transactions to Closed status
+            $query = "UPDATE user_account SET transaction_status = 'Closed' WHERE school_num = $school_num AND user_num = $user_num";
+            db_query($query);
+         }
+      }
+   }
+
+   // Update orders if payment method is being updated
+   if ($table_name == 'user_account' && isset($action) && $action == 'edit-payment-method') {
+   }
+}
+
+
+writeLog("complete\n");
+
+$return_data["record_num"] = $record_num;
+echo(json_encode($return_data));
+
+?>