HotLunches/ajax/ajax.DataRecord.Update.php

<?php
uopz_allow_exit(true);

$ValidAccess = 2010;
require_once("include/globals.php");

$sessionName = 'hotlunch';
session_name($sessionName);
session_start();

$moduleName = "ajax.DataRecord.Update.php";
// if ($_SESSION['UserInfo']['type'] == 'SuperUser') startLog($moduleName);
startLog($moduleName);

if (SessionActive() != 1 || ! UserLoggedIn()) {
   logExit("Session is not active\n");
   exit;
}

// CSRF token validation
include "include/ajax.csrfToken.php";


// Set default timezone
date_default_timezone_set("Canada/Pacific");
$now = date("Y-m-d H:i:s",time());

$return_data = array();
$sequence_flag = 'N';



unset($template);

// Get parameters
extract($_REQUEST);
$parameters = $_REQUEST;



// Validate parameters
if (strlen($table_name) == 0) logExit("Table name is undefined\n");
if (strstr($table_name,' ') !== FALSE) logExit("Invalid table name\n");
writeLog("table_name: $table_name");

switch ($table_name) {
   case 'invoice_header':
      if ($_SESSION['UserInfo']['type'] != 'SuperUser') {
         logExit("Invalid user access to table $table_name");
      }
      break;

   case 'schools':
      if ($_SESSION['UserInfo']['type'] != 'SuperUser' && $_SESSION['UserInfo']['type'] != 'Administrator') {
         logExit("Invalid user access to table $table_name");
      }
      break;
}


writeLog("-- $record_num --\n");

// Ensure numeric parameters are numeric
if (!is_numeric($record_num)) logExit("Record num is not numeric\n");
$record_num = intval($record_num);
$parameters['record_num'] = $record_num;


// Sanitize parameters
$table_name = db_escape_string($table_name);
$sequence_flag = db_escape_string($sequence_flag);

$school_num = $school_record['record_num'];
if (array_key_exists('school_num',$_REQUEST)) $school_num = $_REQUEST['school_num'];
$parameters['school_num'] = $school_num;


// Check for custom validation
$validationScript = "ajax.validation." . $table_name . ".php";
if (array_key_exists('userid',$_REQUEST)) {
   if (!isset($Validation) || $Validation != 'N') {
      if (is_file($validationScript)) {
         writeLog("validationScript: $validationScript found\n");
         include $validationScript;
         $msg = dataValidation($_REQUEST);
         if ($msg !== 0) logExit("$moduleName: validation failure - $msg\n");
      }
   }
}


// Reformat phone number fields
if (isset($phone) && strlen($phone)) $parameters['phone'] = formatPhoneNumber($phone,$school_record['country']);
if (isset($cell_phone) && strlen($cell_phone)) $parameters['cell_phone'] = formatPhoneNumber($cell_phone,$school_record['country']);
if (isset($contact_phone) && strlen($contact_phone)) $parameters['contact_phone'] = formatPhoneNumber($contact_phone,$school_record['country']);
if (isset($contact_cell) && strlen($contact_cell)) $parameters['contact_cell'] = formatPhoneNumber($contact_cell,$school_record['country']);


// Error logging
writeLog("table_name: $table_name\n");
writeLog("record_num: $record_num\n");
writeLog("sequence_flag: $sequence_flag\n");


// Defaults
$parameters['date_updated'] = date("Y-m-d",time());

$table = new Table($table_name);

// Create insert query if record_num is zero or else update
if ($record_num == 0) {
   // Defaults
   $parameters['date_added'] = date("Y-m-d",time());

   // Get next sequence number
   if (isset($sequence_flag) && $sequence_flag == 'Y') {
      switch ($table_name) {
         case '_form_fields':
            $parameters['sequence'] = intval(db_getVal("SELECT max(sequence) FROM $table_name")) + 1;
            break;

         default:
            $parameters['sequence'] = intval(db_getVal("SELECT max(sequence) FROM $table_name WHERE school_num = $school_num")) + 1;
            break;
      }
   }

   $query = $table->BuildInsert($parameters);
   writeLog("query: $query\n");
   db_query($query);
   $record_num = db_insert_id();
}
else {
   $query = $table->BuildUpdate($parameters);
   writeLog("query: $query\n");
   db_query($query);

   // Update all orders to status paid if there is a credit
   if ($table_name == 'hotlunch_order_header' && isset($UpdateAll) && $UpdateAll == 'Yes') {
      $query = "SELECT ordered_by_num FROM hotlunch_order_header WHERE school_num = $school_num AND record_num = $record_num";
      $ordered_by = db_getVal($query);

      if ($ordered_by > 0) {
         $query = "SELECT user_num FROM people WHERE school_num = $school_num AND record_num = $ordered_by";
         $user_num = db_getVal($query);

         if ($user_num > 0) {
            $results = db_query("SELECT * FROM people WHERE school_num = $school_num AND user_num = $user_num");
            if (db_num_rows($results)) {
               while ($row = db_fetch_assoc($results)) {
                  $ordered_by .= "," . $row['record_num'];
               }
            }

            // Update all orders to Paid status
            $query = "UPDATE hotlunch_order_header SET amount_paid = order_total, payment_method = '$payment_method', paid_date = '$paid_date', status = 'Paid' " .
                     "WHERE school_num = $school_num " .
                     "AND status IN ('Unpaid','Inactive') " .
                     "AND ordered_by_num IN ($ordered_by)";
            db_query($query);

            // Update all user transactions to Closed status
            $query = "UPDATE user_account SET transaction_status = 'Closed' WHERE school_num = $school_num AND user_num = $user_num";
            db_query($query);
         }
      }
   }

   // Update orders if payment method is being updated
   if ($table_name == 'user_account' && isset($action) && $action == 'edit-payment-method') {
   }
}


writeLog("complete\n");

$return_data["record_num"] = $record_num;
echo(json_encode($return_data));

?>