First Commit

staff.update.php

@@ -0,0 +1,208 @@
+<?php
+require_once("include/globals.php");
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   header("Location: /");
+   exit();
+}
+
+
+// Ensure that only valid user types have access to this module
+$AllowedUserTypes = array('SuperUser','System Administrator','Application Administrator','Communications Administrator');
+if (checkPermission($AllowedUserTypes) != 1) {
+   return;
+}
+
+
+//
+// Process all actions to list and edit records
+//
+$CurrentTable = "people";
+$DeleteField  = "title,first_name,last_name";
+$dSeparator   = " ";
+$FormFile     = "staff.form.php";
+$TitleText    = "Staff Person";
+$OrderBy      = "last_name,first_name";
+
+
+
+if (array_key_exists('naction',$_GET)) $naction = $_GET['naction'];
+if (array_key_exists('naction',$_POST)) $naction = $_POST['naction'];
+
+$school_num = $school_record['record_num'];
+
+
+switch (strtolower($naction)) {
+   case "insert":
+      extract($_POST);
+
+      // Validate the data entered
+      // if (strlen($first_name) == 0 || strlen($last_name) == 0) {
+      if (strlen($last_name) == 0) {
+         $error_message = getLanguageText('MSG-MISSING-STAFF-NAME');
+         $new_naction = "add";
+         return;
+      }
+
+
+      // Save the record
+      $user_num = 0;
+      $people_type = 'Staff';
+      $class_num = 0;
+      if (!isset($active)) $active = 'Y';
+
+      $table = new Table("$CurrentTable");
+      $query = $table->BuildInsert();
+      db_query($query);
+      $staff_num = db_insert_id();
+      $form_message = "$TitleText Has Been Inserted";     
+
+      // Create a user account for this staff person
+      if (strlen($first_name) > 0) {
+         $userid = str_replace(' ','',strtolower(str_replace(".","",$first_name) . "." . str_replace(".","",$last_name)));
+      }
+      else {
+         $userid = str_replace(' ','',strtolower(str_replace(".","",$last_name)));
+      }
+
+      $userid = str_replace("'","",$userid);
+
+      // Check if this user id is already in use
+      $query = "select * from users " .
+               "where school_num = $base_school_num " .
+               "and userid = '" . db_escape_string($userid) . "'";
+      $results = db_query($query);
+      if (db_num_rows($results) > 0) {
+         $form_message .= "<br>" . getLanguageText('MSG-ACCOUNT-EXISTS') . " ($userid)";
+         $naction = "list";
+         header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message));
+         exit();
+      }
+      else {
+         $users_table = new Table("users");
+         $password = $userid;
+         $type = 'Staff';
+         $status = 'Active';
+         $receive_emails = 'Y';
+         $email_reminders = 'N';
+         $date_added = date("Y-m-d",time());
+         $language = $school_record['default_staff_language'];
+         $query = $users_table->BuildInsert();
+         db_query($query);
+         $user_num = db_insert_id();
+
+         $query = "update people set user_num = $user_num where record_num = $staff_num";
+         db_query($query);
+      }
+
+      $form_message = getLanguageText('RECORD-INSERTED-MSG');
+      $naction = "list";
+      header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message));
+      exit();
+
+   case "update":
+      extract($_POST);
+
+      // Validate the data entered
+      // if (strlen($first_name) == 0 || strlen($last_name) == 0) {
+      if (strlen($last_name) == 0) {
+         $error_message = getLanguageText('MSG-MISSING-STAFF-NAME');
+         $new_naction = "edit";
+         return;
+      }
+
+      if (!isset($active)) $active = 'Y';
+
+      $table = new Table("$CurrentTable");
+      $query = $table->BuildUpdate();
+      db_query($query);
+      $form_message = "$TitleText Has Been Updated";
+      $naction = "list";
+
+      // Create a user account for this staff person
+      if (!isset($user_num) || strlen($user_num) == 0) {
+         if (strlen($first_name) > 0) {
+            $userid = str_replace(' ','',strtolower(str_replace(".","",$first_name) . "." . str_replace(".","",$last_name)));
+         }
+         else {
+            $userid = str_replace(' ','',strtolower(str_replace(".","",$last_name)));
+         }
+
+         $userid = str_replace("'","",$userid);
+
+         $query = "select * from users " .
+                  "where school_num = $school_num " .
+                  "and userid = '" . db_escape_string($userid) . "'";
+         $results = db_query($query);
+
+         // Create a new user if necessary
+         if (db_num_rows($results) == 0) {
+            $users_table = new Table("users");
+            $password = $userid;
+            $type = 'Staff';
+            $status = 'Active';
+            $receive_emails = 'Y';
+            $date_added = date("Y-m-d",time());
+            $query = $users_table->BuildInsert();
+            db_query($query);
+            $user_num = db_insert_id();
+
+            $query = "update people set user_num = $user_num where record_num = $record_num";
+            db_query($query);
+         }
+      }
+      else {
+         if (strlen($first_name) > 0) {
+            $userid = str_replace(' ','',strtolower(str_replace(".","",$first_name) . "." . str_replace(".","",$last_name)));
+         }
+         else {
+            $userid = str_replace(' ','',strtolower(str_replace(".","",$last_name)));
+         }
+
+         $userid = str_replace("'","",$userid);
+
+         $set = "last_name = '" . db_escape_string($last_name) . "', first_name = '" . db_escape_string($first_name) . "'";
+         $set .= ", userid = '$userid'";
+
+         // Update user account with email if there is one
+         if (strlen($email) > 0) {
+            $set .= ", email = '$email'";
+         }
+
+         db_query("update users set $set where record_num = $user_num");
+      }
+
+      $form_message = getLanguageText('RECORD-UPDATED-MSG');
+      $naction = "list";
+      header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message));
+      exit();
+
+   case "delete-confirmed":
+      $record_num = intval($_GET['record_num']);
+
+      // Delete the user account for this staff person
+      $query = "select user_num from people " .
+               "where school_num = $base_school_num " .
+               "and record_num = $record_num";
+      $user_num = db_getVal($query);
+
+      if ($user_num) {
+         $query = "delete from users " .
+                  "where school_num = $school_num " .
+                  "and record_num = $user_num";
+         db_query($query);
+      }
+
+      // Delete the current record
+      $query = "delete from people " .
+               "where school_num = $base_school_num " .
+               "and record_num = $record_num";
+      db_query($query);
+
+      $form_message = getLanguageText('RECORD-DELETED-MSG');
+      $naction = "list";
+      header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message));
+      exit();
+}
+
+?>