First Commit

ajax.resellerSearch.php

@@ -0,0 +1,151 @@
+<?php
+$ValidAccess = 2010;
+require_once("include/globals.php");
+
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   logExit("Session is not active",$moduleName);
+   exit();
+}
+
+// Set userType
+$userType = "Parent";
+if (array_key_exists('type', $_SESSION['UserInfo']) && in_array($_SESSION['UserInfo']['type'],$AllAdminUserTypes)) $userType = "Admin";
+if ($userType != 'Admin') return;
+
+
+// Ensure that only valid user types have access to this module
+if ($userType != 'Admin') {
+   $error_message = getLanguageText('ERRORMSG-ACCESS-DENIED');
+   logExit($error_message);
+   exit;
+}
+
+
+$moduleName = "ajax.resellerSearch.php";
+// startLog($moduleName);
+
+// CSRF token validation
+include "include/ajax.csrfToken.php";
+
+
+$reseller_code = $school_record['reseller'];
+$schools = '';
+$Schools = array();
+
+$query = "SELECT school_name,record_num FROM schools WHERE status = 'Active' AND reseller = '$reseller_code'";
+$results = db_query($query);
+while ($row = db_fetch_assoc($results)) {
+   if (strlen($schools) > 0) $schools .= ',';
+   $schools .= $row['record_num'];
+   $Schools[$row['record_num']] = $row['school_name'];
+}
+
+
+// Get search text
+$text = trim(strtolower($_GET['term']));
+$words = explode(' ',$text);
+writeLog("text: $text\n");
+
+
+// Format where clause
+$pwhere = "";
+$uwhere = "";
+for ($i = 0; $i < count($words); $i++) {
+   $word = db_escape_string($words[$i]);
+   $pwhere .= "AND (people.first_name LIKE '$word%' " .
+                "OR people.last_name LIKE '$word%' " .
+                "OR users.userid LIKE '$word%' " .
+                "OR users.last_name LIKE '$word%' " .
+                "OR users.first_name LIKE '$word%' " .
+                "OR users.email LIKE '$word%' " .
+                "OR users.email2 LIKE '$word%' " .
+                "OR users.email3 LIKE '$word%' " .
+                ") ";
+
+   $uwhere .= "AND (first_name LIKE '$word%' " .
+                "OR last_name LIKE '$word%' " .
+                "OR userid LIKE '$word%' " .
+                "OR email LIKE '$word%' " .
+                "OR email2 LIKE '$word%' " .
+                "OR email3 LIKE '$word%' " .
+                ") ";
+}
+
+$return_data = array();
+
+
+// Get matching user records
+$query = "SELECT * FROM users " .
+         "WHERE users.school_num IN ($schools) " .
+         $uwhere .
+         "ORDER BY last_name, first_name";
+writeLog("query: $query\n");
+$results = db_query($query);
+
+// Format data for return
+$num_records = db_num_rows($results);
+if ($num_records > 0) {
+   writeLog("records: $num_records\n");
+   $return_data[] = array("value" => "-- ".getLanguageText('TEXT-USERS')." --------------------",
+                          "user_num" => 0,
+                          "people_num" => 0);
+   while ($row = db_fetch_assoc($results)) {
+      extract($row);
+
+      $school_name = $Schools[$school_num];
+
+      $return_data[] = array("value" => "$first_name $last_name - $type ($school_name)",
+                             "school_num" => $school_num,
+                             "user_num" => $record_num,
+                             "people_num" => 0);
+   }
+}
+
+
+// Get matching people records
+$query = "SELECT DISTINCT people.school_num,people.first_name,people.last_name,user_num,people.record_num," .
+            "users.first_name AS parent_first_name,users.last_name AS parent_last_name,users.type AS user_type " .
+         "FROM people,users " .
+         "WHERE people.school_num IN ($schools) " .
+         "AND users.school_num IN ($schools) " .
+         "AND people.user_num = users.record_num " .
+         $pwhere .
+         "ORDER BY last_name,first_name";
+writeLog("query: $query\n");
+$results = db_query($query);
+
+// Format data for return
+$num_records = db_num_rows($results);
+if ($num_records > 0) {
+   writeLog("records: $num_records\n");
+   $return_data[] = array("value" => "-- ".getLanguageText('TEXT-PEOPLE')." --------------------",
+                          "user_num" => 0,
+                          "people_num" => 0);
+   while ($row = db_fetch_assoc($results)) {
+      extract($row);
+      $num = db_getVal("SELECT count(*) FROM hotlunch_order_header WHERE school_num = $school_num AND ordered_by_num = $record_num AND status NOT IN ('Pending','Deleted')");
+
+      $school_name = $Schools[$school_num];
+
+      if ($user_type == 'Staff') {
+         $return_data[] = array("value" => "$first_name $last_name ($num) - $user_type ($school_name)",
+                                "school_num" => $school_num,
+                                "user_num" => $user_num,
+                                "people_num" => $record_num);
+      }
+      else {
+         $return_data[] = array("value" => "$first_name $last_name ($num) - $parent_first_name $parent_last_name ($school_name)",
+                                "school_num" => $school_num,
+                                "user_num" => $user_num,
+                                "people_num" => $record_num);
+      }
+   }
+}
+
+
+writeLog("completed\n");
+echo(json_encode($return_data));
+return false;
+
+?>