<?php
$ValidAccess = 2010;
require_once("include/globals.php");


if (SessionActive() != 1 || ! UserLoggedIn()) {
   logExit("Session is not active",$moduleName);
   exit();
}

// Set userType
$userType = "Parent";
if (array_key_exists('type', $_SESSION['UserInfo']) && in_array($_SESSION['UserInfo']['type'],$AllAdminUserTypes)) $userType = "Admin";
if ($userType != 'Admin') return;


// Ensure that only valid user types have access to this module
if ($userType != 'Admin') {
   $error_message = getLanguageText('ERRORMSG-ACCESS-DENIED');
   logExit($error_message);
   exit;
}


// CSRF token validation
include "include/ajax.csrfToken.php";


// Set default timezone
date_default_timezone_set("Canada/Pacific");
$now = date("Y-m-d H:i:s",time());

$return_data = array();
$sequence_flag = 'N';

$moduleName = "ajax.UserUpdate.php";
// startLog($moduleName);


// Get parameters
extract($_REQUEST);


// Validate parameters
writeLog("amount: $amount");
writeLog("naction: $naction");


// Ensure numeric parameters are numeric
if (!is_numeric($amount)) logExit("Amount is not numeric\n");

$school_num = $school_record['record_num'];


// Error logging


switch ($naction) {
   case 'Clear':
      $query = "UPDATE users " .
               "SET can_order = 'Yes' " .
               "WHERE school_num = $school_num " .
               "AND balance_owing <= $amount";
      writeLog("query: $query\n");
      db_query($query);
      break;

   case 'Block':
   default:
      $query = "UPDATE users " .
               "SET can_order = 'Balance' " .
               "WHERE school_num = $school_num " .
               "AND balance_owing >= $amount";
      writeLog("query: $query\n");
      db_query($query);
      break;
}


writeLog("complete\n");
echo(json_encode($return_data));

?>