First Commit

documents.php

@@ -0,0 +1,369 @@
+<?php
+require_once("include/globals.php");
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   header("Location: /");
+   exit();
+}
+
+
+//
+// Process all actions to list and edit records
+//
+$action       = "manage-documents";
+$CurrentTable = "documents";
+$DeleteField  = "title,uploaded_date";
+$dSeparator   = "<br>\n";
+$FormFile     = "documents.form.php";
+$OrderBy      = "category,document_date desc,title";
+
+
+// Start the template and output buffering
+$templatePageTitle = getLanguageText('TEXT-DOCUMENT-ADMINISTRATION');
+startTemplate();
+
+
+// Ensure that only valid user types have access to this module
+$AllowedUserTypes = array('SuperUser','System Administrator','Application Administrator','Communications Administrator','Administration Team');
+if (checkPermission($AllowedUserTypes) != 1) {
+   $error_message = getLanguageText('ERRORMSG-ACCESS-DENIED');
+   $action = '';
+   $naction = '';
+   header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+   exit();
+}
+
+
+$school_num = $school_record['record_num'];
+
+
+// Determine if there are document categories defined
+$numCats = db_getVal("SELECT count(*) FROM document_categories WHERE school_num = $base_school_num");
+if ($numCats == 0) {
+   $error_message = getLanguageText('ERRORMSG-NO-DOCUMENT-CATEGORIES');
+}
+
+
+if (array_key_exists('naction',$_GET)) $naction = $_GET['naction'];
+if (array_key_exists('naction',$_POST)) $naction = $_POST['naction'];
+
+
+// Perform the requested action
+switch (strtolower($naction)) {
+   case 'add':
+      // Unable to insert if there are no document categories
+      if ($numCats == 0) {
+         $error_message = getLanguageText('ERRORMSG-NO-DOCUMENT-CATEGORIES');
+         header("Location: /?action=document-categories&naction=add&error_message=".urlencode($error_message));
+         exit();
+      }
+
+      $next_naction = "upload";
+      include $FormFile;
+      break;
+
+   case 'upload':
+      extract($_POST);
+
+      $temp_name = $_FILES['filename']['tmp_name'];
+      $file_name = str_replace(' ','_',$_FILES['filename']['name']);
+
+      // Remove accents and special characters from file names
+      $file_name = normalizeString($file_name);
+
+      $error_message = '';
+
+      // Check that a title has been entered
+      if (strlen($title) == 0) {
+         $title = $_FILES['filename']['name'];
+      }
+
+      if (strlen($temp_name) && strlen($file_name)) {
+         // Check if a file with this name already exists
+         if (is_file("$uploaddir/$file_name")) {
+            $error_message = "Unable to upload file - $file_name exists already";
+         }
+
+         // Move file to documents folder
+         if (!move_uploaded_file($temp_name,"$uploaddir/$file_name")) {
+            $error_message = "Unable to upload file - $uploaddir/$file_name";
+         }
+      }
+      else {
+         if (isset($selected_filename) && strlen($selected_filename)) $file_name = $selected_filename;
+         if (strlen($title) == 0) $title = str_replace('_',' ',$file_name);
+      }
+
+      // If there has been an error then display form again
+      if (strlen($error_message) > 0) {
+         $next_naction = "upload";
+         include $FormFile;
+         break;
+      }
+
+
+      // Update database
+      $documents = new Table("documents");
+      $query = $documents->BuildInsert();
+      db_query($query);
+
+      $naction = 'list';
+      break;
+
+   case 'edit':
+      $next_naction = "update";
+
+      $record_num = intval($_GET['record_num']);
+      if ($record_num == 0) {
+         $error_message = getLanguageText('TEXT-INVALID-ACCESS');
+         header("Location: /?error_message=".urlencode($error_message));
+         exit();
+      }
+
+      $query = "select * from documents where record_num = $record_num";
+      $results = db_query($query);
+      if (db_num_rows($results) == 0) {
+         $error_message = getLanguageText('TEXT-INVALID-ACCESS');
+         header("Location: /?error_message=".urlencode($error_message));
+         exit();
+      }
+
+      $row = db_fetch_array($results);
+      extract($row);
+
+      include $FormFile;
+      break;
+
+   case 'update':
+      if (array_key_exists('document_date', $_POST)) $document_date = db_escape_string($_POST['document_date']);
+      if (array_key_exists('title', $_POST)) $title = db_escape_string($_POST['title']);
+      if (array_key_exists('display', $_POST)) $display = db_escape_string($_POST['display']);
+      if (array_key_exists('rnum', $_POST)) $record_num = intval($_POST['rnum']);
+
+      if ($record_num == 0) {
+         $error_message = getLanguageText('TEXT-INVALID-ACCESS');
+         header("Location: /?error_message=".urlencode($error_message));
+         exit();
+      }
+
+      // Update database
+      $documents = new Table("documents");
+      $query = $documents->BuildUpdate();
+      db_query($query);
+
+      $form_message = getLanguageText('RECORD-UPDATED-MSG');
+      $naction = "list";
+      header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+      exit();
+
+   case 'delete':
+      $record_num = intval($_GET['record_num']);
+
+      if ($record_num == 0) {
+         $error_message = getLanguageText('TEXT-INVALID-ACCESS');
+         header("Location: /?error_message=".urlencode($error_message));
+         exit();
+      }
+
+      // Get current record
+      $query = "select * from $CurrentTable " .
+               "where school_num = $school_num " .
+               "and record_num = $record_num";
+      $results = db_query($query);
+
+      if (db_num_rows($results) == 1) {
+         $row = db_fetch_array($results);
+         extract($row);
+
+         $dFields = explode(",",$DeleteField);
+         $dTitle = "";
+         for ($i = 0; $i < count($dFields); $i++) {
+            $dTitle .= $row[$dFields[$i]] . $dSeparator;
+         }
+
+         include "delete.form.php";
+      }
+      else {
+         $error_message = getLanguageText('ERRORMSG-NOT-FOUND');
+         $naction = 'list';
+         header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+         exit();
+      }
+      break;
+
+   case "delete-confirmed":
+      extract($_GET);
+
+      if ($record_num == 0) {
+         $error_message = getLanguageText('TEXT-INVALID-ACCESS');
+         header("Location: /?error_message=".urlencode($error_message));
+         exit();
+      }
+
+      // Get file name
+      $file_name = db_getVal("SELECT file_name FROM documents WHERE school_num = $school_num AND record_num = $record_num");
+
+      // Delete record from database
+      $query = "delete from documents " .
+               "where school_num = $school_num " .
+               "and record_num = $record_num";
+      db_query($query);
+
+      // Remove file
+      if (is_file("$uploaddir/$file_name")) {
+         unlink("$uploaddir/$file_name");
+      }
+
+      $form_message = getLanguageText('RECORD-DELETED-MSG');
+      $naction = "list";
+      header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+      exit();
+
+   default:
+      $date = date("Y-m-d",time());
+      $naction = "list";
+      break;
+}
+
+
+//
+// List all records if naction is "list"
+//
+if ($naction == "list") {
+
+   if (1 == 2 && $school_num == 240) {
+      // Check uploads directoy for files not in database
+      $dir = opendir($uploaddir);
+      $files = array();
+      while (($file = readdir($dir)) != false) {
+         if ($file == ".") continue;
+         if ($file == "..") continue;
+         $files[] = $file;
+      }
+
+      $documents = new Table("documents");
+
+      for ($i = 0; $i < count($files); $i++) {
+         $file = db_escape_string($files[$i]);
+         $query = "SELECT * FROM documents WHERE school_num = $school_num AND file_name = '$file'";
+         $r = db_getVal($query);
+         if (is_array($r)) {
+            continue;
+         }
+         else {
+            $sequence = intval(db_getVal("SELECT max(sequence) FROM documents WHERE school_num = $school_num"));
+            $sequence++;
+
+            $title = $file;
+
+            $uploaded_date = date("Y-m-d H:i:s",filemtime("$uploaddir/$file"));
+            $document_date = $uploaded_date;
+            $category_num = 8835;
+            $category = "Misc";
+            $uploaded_by = 0;
+            $file_name = $file;
+
+            $entry = array();
+            if (isset($school_num)) $entry['school_num'] = $school_num;
+            if (isset($category)) $entry['category'] = $category;
+            if (isset($category_num)) $entry['category_num'] = $category_num;
+            if (isset($title)) $entry['title'] = $title;
+            if (isset($document_date)) $entry['document_date'] = $document_date;
+            if (isset($description)) $entry['description'] = $description;
+            if (isset($file_name)) $entry['file_name'] = $file_name;
+            if (isset($uploaded_by)) $entry['uploaded_by'] = $uploaded_by;
+            if (isset($uploaded_date)) $entry['uploaded_date'] = $uploaded_date;
+            if (isset($status)) $entry['status'] = $status;
+            if (isset($sequence)) $entry['sequence'] = $sequence;
+
+            $query = $documents->BuildInsert($entry);
+            db_query($query);
+            echo("<!-- $uploaddir/$file - $query -->\n");
+         }
+      }
+   }
+
+   // Manage subset selection
+   $swhere = "";
+   $show_type = "";
+   if (array_key_exists('show_type',$_REQUEST) && strlen($_REQUEST['show_type'])) {
+      $show_type = $_REQUEST['show_type'];
+      $swhere = "and u.type = '$show_type' ";
+      $TitleText = "$show_type $TitleText";
+   }
+
+
+   $scriptName = str_replace("/m/data1/app.hotlunches.net/","",__FILE__);
+   include "help.docs.php";
+
+   // Check document entries
+   $query = "SELECT * FROM documents WHERE school_num = $school_num";
+   $results = db_query($query);
+   while ($row = db_fetch_assoc($results)) {
+      extract($row);
+
+      if (!is_file("$uploaddir/$file_name")) {
+         // db_query("DELETE from documents WHERE school_num = $school_num AND record_num = $record_num");
+      }
+   }
+
+   // Get set of document records
+   $columnHeaders = array(getLanguageText('TEXT-TITLE'),
+                          getLanguageText('TEXT-UPLOADED-DATE'),
+                          getLanguageText('TEXT-CATEGORY'),
+                          getLanguageText('TEXT-STATUS')
+                          );
+   $query = "SELECT d.title,d.document_date,d.uploaded_date,dc.category,d.status,file_name,d.record_num " .
+            "FROM documents as d, document_categories as dc " .
+            "WHERE d.school_num = $school_num " .
+            "AND dc.school_num = $base_school_num " .
+            "AND d.category_num = dc.record_num " .
+            $swhere .
+            "ORDER BY dc.sequence,d.sequence,document_date";
+
+   echo("\n\n");
+   echo("<!-- $query -->\n");
+   echo("\n\n");
+   $results = db_query($query);
+
+   $data = array();
+   while ($row = db_fetch_assoc($results)) {
+      extract($row);
+
+      if (is_file("$uploaddir/$file_name")) {
+         $data[] = array($title,$uploaded_date,$category,$status,"record_num" => $record_num);
+      }
+      else {
+         db_query("DELETE from documents WHERE school_num = $school_num AND record_num = $record_num");
+      }
+   }
+
+   include "form.messages.php";
+
+   if ($school_num != 3) {
+      $msg = getLanguageText('TEXT-CONFIRM-DELETE');
+      $commands = array(
+                     "<a href='?action=$action&naction=edit&record_num=%d' title='Edit Current Entry'>$edit_icon</a>",
+                     "<a href='?action=$action&naction=delete-confirmed&record_num=%d' onClick='return confirm(\"$msg\");' title='Delete Current Entry'>$delete_icon</a>",
+                     "<a href='view-doc.php?dnum=%d' title='View Document'>$view_icon</a>"
+                     );
+   }
+   else {
+      $commands = array(
+                     "<a href='?action=$action&naction=edit&record_num=%d' title='Edit Current Entry'>$edit_icon</a>",
+                     "<a href='view-doc.php?dnum=%d' title='View Document'>$view_icon</a>"
+                     );
+   }
+
+   $customTableID = "documents-table";
+   $useRowIDS = true;
+   include "table.dnd.php";
+   listDataCustom($data,$columnHeaders,$action,$commands,'N');
+?>
+    <br>
+    <p><a href='?action=manage-documents&naction=add' class='btn btn--primary>'>&nbsp;&nbsp;Upload New&nbsp;&nbsp;</a></p>
+<?php
+}
+
+endTemplate();
+?>