First Commit

ajax.MenuItems.Delete.php

@@ -0,0 +1,86 @@
+<?php
+$ValidAccess = 2010;
+require_once("include/globals.php");
+
+$moduleName = "ajax.MenuItems.Delete.php";
+// if ($_SESSION['UserInfo']['type'] == 'SuperUser') startLog($moduleName);
+
+
+// CSRF token validation
+include "include/ajax.csrfToken.php";
+
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   logExit("Session is not active",$moduleName);
+   exit();
+}
+
+// Set userType
+$userType = "Parent";
+if (array_key_exists('type', $_SESSION['UserInfo']) && in_array($_SESSION['UserInfo']['type'],$AllAdminUserTypes)) $userType = "Admin";
+if ($userType != 'Admin') logExit('Invalid access');
+
+
+// Set default timezone
+date_default_timezone_set("Canada/Pacific");
+$now = date("Y-m-d H:i:s",time());
+
+$return_data = array();
+
+
+// Get parameters
+if (array_key_exists('schedule_num', $_GET)) $schedule_num = intval($_GET['schedule_num']);
+if (array_key_exists('action', $_GET)) $action = db_escape_string($_GET['action']);
+
+if (!isset($schedule_num)) logExit("Schedule Num is not set");
+if (!isset($action)) logExit("Action is not set");
+
+
+writeLog("schedule_num: $schedule_num");
+writeLog("action: $action");
+
+
+// Validate the schedule number
+$swhere = "";
+if ($_SESSION['UserInfo']['type'] == 'Supplier') $swhere = " and supplier_num = " . $_SESSION['UserInfo']['supplier_num'];
+$query = "select * from hotlunch_schedules " .
+         "where record_num = $schedule_num " .
+         "and school_num = $school_num $swhere";
+$results = db_query($query);
+
+if (db_num_rows($results) == 0) {
+   $return_data['error_message'] = getLanguageText('ERRORMSG-INVALID-SCHEDULE-NUM');
+   $return_data['ajax_return_code'] = -1;
+   echo(json_encode($return_data));
+   logExit($error_message);
+   exit();
+}
+
+$hotlunch_schedule = db_fetch_array($results);
+$return_data['reload_data'] = 'Y';
+$return_data['ajax_return_code'] = 0;
+$return_data['ajax_message'] = '';
+
+
+switch ($action) {
+   case 'delete-selected-items':
+      if (array_key_exists('selected_items', $_GET)) $selected_items = db_escape_string($_GET['selected_items']);
+      if (!isset($selected_items) || strlen($selected_items) == 0) {
+         $return_data['error_message'] = getLanguageText('ERRORMSG-NO-ITEMS-SELECTED');
+         $return_data['ajax_return_code'] = -1;
+         echo(json_encode($return_data));
+         logExit($error_message);
+         exit();
+      }
+
+      $query = "DELETE FROM hotlunch_menu_items " .
+               "WHERE school_num = $school_num " .
+               "AND record_num IN ($selected_items)";
+      writeLog($query);
+      db_query($query);
+      break;
+
+}
+
+echo(json_encode($return_data));
+writeLog("completed\n");