First Commit

staff-user.php

@@ -0,0 +1,224 @@
+<?php
+require_once("include/globals.php");
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   header("Location: /");
+   exit();
+}
+
+
+// Ensure that only valid user types have access to this module
+$AllowedUserTypes = array('SuperUser','System Administrator','Application Administrator','Communications Administrator');
+if (checkPermission($AllowedUserTypes) != 1) {
+   $error_message = getLanguageText('ERRORMSG-ACCESS-DENIED');
+   $action = '';
+   header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+   exit();
+}
+
+
+//
+// Process all actions to list and edit records
+//
+$action       = "staff-user";
+$CurrentTable = "users";
+$DeleteField  = "userid";
+$FormFile     = "users.form.php";
+$TitleText    = getLanguageText('TEXT-STAFF-USER');
+$OrderBy      = "userid,last_name,first_name";
+
+// Start the template and output buffering
+startTemplate();
+
+$templatePageTitle = "$TitleText " . getLanguageText('TEXT-ADMINISTRATION');
+
+
+if (array_key_exists('staff_num',$_GET)) $staff_num = intval($_GET['staff_num']);
+if (array_key_exists('staff_num',$_POST)) $staff_num = intval($_POST['staff_num']);
+
+// Check if this is a valid staff_num
+$query = "select user_num,concat_ws(' ',title,first_name,last_name) as name1,coteacher,grade,division,record_num " .
+         "from staff " .
+         "where school_num = $school_num " .
+         "and record_num = $staff_num";
+$results = db_query($query);
+
+if (db_num_rows($results) == 0) {
+   echo("<br>\n");
+   $error_message = "The staff number is invalid";
+   include "form.messages.php";
+   return;
+}
+
+$staff_record = db_fetch_array($results);
+
+$unum = $staff_record['user_num'];
+$staff_name = $staff_record['name1'];
+$coteacher = $staff_record['coteacher'];
+if (isset($coteacher) && $coteacher != NULL) {
+   $query = "select concat_ws(' ',title,first_name,last_name) " .
+            "from staff " .
+            "where school_num = $school_num " .
+            "and record_num = $coteacher";
+   $staff_name .= " / " . db_getVal($query);
+}
+
+
+
+if (array_key_exists('naction',$_GET)) $naction = $_GET['naction'];
+if (array_key_exists('naction',$_POST)) $naction = $_POST['naction'];
+
+switch (strtolower($naction)) {
+   case "add":
+      $next_naction = "insert";
+
+      include $FormFile;
+      break;
+
+   case "insert":
+      extract($_POST);
+      $date_added = date("Y-m-d",time());
+
+      $table = new Table("$CurrentTable");
+      $query = $table->BuildInsert();
+      db_query($query);
+
+      // Update staff record with new user id
+      $unum = db_insert_id();
+      $query = "update staff set user_num = $unum " .
+               "where school_num = $school_num " .
+               "and record_num = $staff_num";
+      db_query($query);
+
+      $form_message = getLanguageText('RECORD-INSERTED-MSG');
+      $naction = 'list';
+      header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+      exit();
+
+   case "edit":
+      $next_naction = "update";
+
+      // Get current record
+      $record_num = intval($_GET['record_num']);
+      $query = "select * from $CurrentTable " .
+               "where school_num = $school_num " .
+               "and record_num = $record_num";
+      $results = db_query($query);
+      $row = db_fetch_array($results);
+      extract($row);
+
+      include $FormFile;
+      break;
+
+   case "update":
+      extract($_POST);
+      $table = new Table("$CurrentTable");
+      $query = $table->BuildUpdate();
+      db_query($query);
+
+      $form_message = getLanguageText('RECORD-UPDATED-MSG');
+      $naction = 'list';
+      header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+      exit();
+
+   case "delete":
+      $record_num = intval($_GET['record_num']);
+
+      // Check if this user has students linked to it
+      $query = "select count(*) num from classes " .
+               "where school_num = $school_num " .
+               "and (teacher1 = $record_num " .
+                  "or teacher2 = $record_num " .
+                  "or teacher3 = $record_num " .
+                  "or teacher4 = $record_num " .
+                  "or teacher5 = $record_num)";
+      $num = db_getVal($query);
+
+      if ($num > 0) {
+         $error_message = "This user is an assigned class teacher. Unable to delete user account";
+         include "form.messages.php";
+         $naction = "list";
+         break;
+      }
+
+
+      $query = "select * from $CurrentTable where record_num = $record_num";
+      $results = db_query($query);
+      if (db_num_rows($results) == 1) {
+         $row = db_fetch_array($results);
+         extract($row);
+
+         $dFields = explode(",",$DeleteField);
+         $dTitle = "$TitleText ";
+         for ($i = 0; $i < count($dFields); $i++) {
+            $dTitle .= $row[$dFields[$i]] . $dSeparator;
+         }
+
+         include "delete.form.php";
+      }
+      else {
+         $error_message = getLanguageText('ERRORMSG-NOT-FOUND');
+         $naction = 'list';
+         header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+         exit();
+      }
+
+      break;
+
+   case "delete-confirmed":
+      $record_num = intval($_GET['record_num']);
+
+      // Delete the current record
+      $query = "delete from $CurrentTable where record_num = $record_num";
+      db_query($query);
+
+      // Delte contacts records
+      $query = "delete from contacts " .
+               "where school_num = $school_num " .
+               "and user_num = $record_num";
+      db_query($query);
+
+      $form_message = getLanguageText('RECORD-DELETED-MSG');
+      $naction = 'list';
+      header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+      exit();
+
+   default:
+      $naction = "list";
+      break;
+}
+
+
+//
+// List all records if naction is "list"
+//
+if ($naction == "list") {
+
+   $scriptName = str_replace("/m/data1/app.hotlunches.net/","",__FILE__);
+   include "help.docs.php";
+
+   $columnHeaders = array(getLanguageText('TEXT-USER-ID'),
+                          getLanguageText('TEXT-EMAIL'),
+                          getLanguageText('TEXT-TYPE'),
+                          getLanguageText('TEXT-STATUS'),
+                          getLanguageText('TEXT-LAST-LOGIN')
+                          );
+   $query = "select userid,email,type,status,last_login,record_num " .
+            "from users " .
+            "where school_num = $base_school_num " .
+            "and record_num = $unum";
+
+   $results = db_query($query);
+   $add_record = 'N';
+   if (db_num_rows($results) == 0) $add_record = 'Y';
+
+   echo("<center>\n");
+   echo("<p><b>".getLanguageText('TEXT-NAME').": $staff_name</b></p>\n");
+   echo("</center>\n");
+
+   $action = "$action&staff_num=$staff_num";
+   listData($results,$columnHeaders,$action,array(),$add_record);
+}
+
+endTemplate();
+?>