137 lines
4.3 KiB
PHP
137 lines
4.3 KiB
PHP
<?php
|
|
$ValidAccess = 2010;
|
|
|
|
$sessionName = 'hotlunch';
|
|
session_name($sessionName);
|
|
session_start();
|
|
|
|
require_once("include/globals.php");
|
|
|
|
$moduleName = "ajax.UserSearch.php";
|
|
// if ($_SESSION['UserInfo']['type'] == 'SuperUser') startLog($moduleName);
|
|
// $db_mode = $_SESSION['user_mode'];
|
|
// writeLog("db_mode: $db_mode");
|
|
// writeLog("_SESSION['db_mode']: ".$_SESSION['db_mode']);
|
|
// writeLog("currentDB: $currentDB");
|
|
// writeLog("_SESSION[db_dbname]: ".$_SESSION['db_dbname']);
|
|
|
|
|
|
if (SessionActive() != 1 || ! UserLoggedIn()) {
|
|
logExit("Session is not active",$moduleName);
|
|
exit();
|
|
}
|
|
|
|
// Set userType
|
|
$userType = "Parent";
|
|
if (array_key_exists('type', $_SESSION['UserInfo']) && in_array($_SESSION['UserInfo']['type'],$AllAdminUserTypes)) $userType = "Admin";
|
|
if ($userType != 'Admin') return;
|
|
|
|
|
|
// Ensure that only valid user types have access to this module
|
|
if ($userType != 'Admin') {
|
|
$error_message = getLanguageText('ERRORMSG-ACCESS-DENIED');
|
|
logExit($error_message);
|
|
exit;
|
|
}
|
|
|
|
|
|
|
|
// CSRF token validation
|
|
include "include/ajax.csrfToken.php";
|
|
|
|
|
|
|
|
// Get search text
|
|
$text = trim(strtolower($_GET['term']));
|
|
$words = explode(' ',$text);
|
|
writeLog("text: $text\n");
|
|
|
|
|
|
// Format where clause
|
|
$uwhere = "";
|
|
$pwhere = "";
|
|
for ($i = 0; $i < count($words); $i++) {
|
|
$word = db_escape_string($words[$i]);
|
|
if (is_numeric($word)) {
|
|
$uwhere .= "AND record_num = $word ";
|
|
$pwhere .= "AND user_num = $word ";
|
|
}
|
|
else {
|
|
$uwhere .= "AND (userid LIKE '%$word%' " .
|
|
"OR first_name LIKE '$word%' " .
|
|
"OR last_name LIKE '$word%' " .
|
|
"OR email LIKE '%$word%' " .
|
|
"OR home_phone LIKE '%$word%' " .
|
|
"OR cell_phone LIKE '%$word%' " .
|
|
"OR daytime_phone LIKE '%$word%') ";
|
|
$pwhere .= "AND (p.first_name LIKE '$word%' " .
|
|
"OR p.last_name LIKE '$word%') ";
|
|
}
|
|
}
|
|
|
|
// Get matching user records
|
|
$query = "SELECT DISTINCT school_num,userid,first_name,last_name,email,type,record_num FROM users " .
|
|
"WHERE school_num = $base_school_num " .
|
|
$uwhere .
|
|
"ORDER BY last_name,first_name";
|
|
writeLog("query: $query\n");
|
|
$results = db_query($query);
|
|
|
|
// Format data for return
|
|
$return_data = array();
|
|
$num_records = db_num_rows($results);
|
|
if ($num_records > 0) {
|
|
writeLog("records: $num_records\n");
|
|
$return_data[] = array("value" => "-- ".getLanguageText('TEXT-USERS')." --------------------",
|
|
"user_num" => 0);
|
|
while ($row = db_fetch_assoc($results)) {
|
|
extract($row);
|
|
$num = db_getVal("SELECT count(*) FROM people WHERE school_num = $base_school_num AND user_num = $record_num");
|
|
if ($userid != $email) $email .= " ($userid)";
|
|
writeLog("$record_num - $first_name $last_name - $type");
|
|
$return_data[] = array("value" => "$first_name $last_name - $type ($num) $email",
|
|
"user_num" => $record_num);
|
|
}
|
|
}
|
|
|
|
|
|
// Get matching student records
|
|
$query = "SELECT DISTINCT school_num,user_num,first_name,last_name,people_type,record_num FROM people " .
|
|
"WHERE school_num = $base_school_num " .
|
|
"AND user_num > 0 " .
|
|
"AND people_type = 'Student' " .
|
|
$pwhere .
|
|
"ORDER BY last_name,first_name";
|
|
$query = "SELECT DISTINCT p.school_num,p.user_num,p.first_name,p.last_name,p.people_type,p.record_num,u.userid " .
|
|
"FROM people AS p, users AS u " .
|
|
"WHERE p.school_num = $base_school_num " .
|
|
"AND u.school_num = $base_school_num " .
|
|
"AND p.user_num > 0 " .
|
|
"AND p.user_num = u.record_num " .
|
|
$pwhere .
|
|
"ORDER BY last_name,first_name";
|
|
writeLog("query: $query\n");
|
|
$results = db_query($query);
|
|
|
|
// Format data for return
|
|
$num_records = db_num_rows($results);
|
|
if ($num_records > 0) {
|
|
writeLog("records: $num_records\n");
|
|
$return_data[] = array("value" => "-- ".$GlobalText['Students']." --------------------",
|
|
"user_num" => 0);
|
|
while ($row = db_fetch_assoc($results)) {
|
|
extract($row);
|
|
writeLog("$user_num - $first_name $last_name - $people_type");
|
|
$return_data[] = array("value" => "$first_name $last_name - $people_type ($userid)",
|
|
"user_num" => $user_num);
|
|
}
|
|
}
|
|
|
|
|
|
|
|
writeLog("completed\n");
|
|
echo(json_encode($return_data));
|
|
return false;
|
|
|
|
?>
|