HotLunches/staff.update.php

<?php
require_once("include/globals.php");

if (SessionActive() != 1 || ! UserLoggedIn()) {
   header("Location: /");
   exit();
}


// Ensure that only valid user types have access to this module
$AllowedUserTypes = array('SuperUser','System Administrator','Application Administrator','Communications Administrator');
if (checkPermission($AllowedUserTypes) != 1) {
   return;
}


//
// Process all actions to list and edit records
//
$CurrentTable = "people";
$DeleteField  = "title,first_name,last_name";
$dSeparator   = " ";
$FormFile     = "staff.form.php";
$TitleText    = "Staff Person";
$OrderBy      = "last_name,first_name";



if (array_key_exists('naction',$_GET)) $naction = $_GET['naction'];
if (array_key_exists('naction',$_POST)) $naction = $_POST['naction'];

$school_num = $school_record['record_num'];


switch (strtolower($naction)) {
   case "insert":
      extract($_POST);

      // Validate the data entered
      // if (strlen($first_name) == 0 || strlen($last_name) == 0) {
      if (strlen($last_name) == 0) {
         $error_message = getLanguageText('MSG-MISSING-STAFF-NAME');
         $new_naction = "add";
         return;
      }


      // Save the record
      $user_num = 0;
      $people_type = 'Staff';
      $class_num = 0;
      if (!isset($active)) $active = 'Y';

      $table = new Table("$CurrentTable");
      $query = $table->BuildInsert();
      db_query($query);
      $staff_num = db_insert_id();
      $form_message = "$TitleText Has Been Inserted";     

      // Create a user account for this staff person
      if (strlen($first_name) > 0) {
         $userid = str_replace(' ','',strtolower(str_replace(".","",$first_name) . "." . str_replace(".","",$last_name)));
      }
      else {
         $userid = str_replace(' ','',strtolower(str_replace(".","",$last_name)));
      }

      $userid = str_replace("'","",$userid);

      // Check if this user id is already in use
      $query = "select * from users " .
               "where school_num = $base_school_num " .
               "and userid = '" . db_escape_string($userid) . "'";
      $results = db_query($query);
      if (db_num_rows($results) > 0) {
         $form_message .= "<br>" . getLanguageText('MSG-ACCOUNT-EXISTS') . " ($userid)";
         $naction = "list";
         header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message));
         exit();
      }
      else {
         $users_table = new Table("users");
         $password = $userid;
         $type = 'Staff';
         $status = 'Active';
         $receive_emails = 'Y';
         $email_reminders = 'N';
         $date_added = date("Y-m-d",time());
         $language = $school_record['default_staff_language'];
         $query = $users_table->BuildInsert();
         db_query($query);
         $user_num = db_insert_id();

         $query = "update people set user_num = $user_num where record_num = $staff_num";
         db_query($query);
      }

      $form_message = getLanguageText('RECORD-INSERTED-MSG');
      $naction = "list";
      header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message));
      exit();

   case "update":
      extract($_POST);

      // Validate the data entered
      // if (strlen($first_name) == 0 || strlen($last_name) == 0) {
      if (strlen($last_name) == 0) {
         $error_message = getLanguageText('MSG-MISSING-STAFF-NAME');
         $new_naction = "edit";
         return;
      }

      if (!isset($active)) $active = 'Y';

      $table = new Table("$CurrentTable");
      $query = $table->BuildUpdate();
      db_query($query);
      $form_message = "$TitleText Has Been Updated";
      $naction = "list";

      // Create a user account for this staff person
      if (!isset($user_num) || strlen($user_num) == 0) {
         if (strlen($first_name) > 0) {
            $userid = str_replace(' ','',strtolower(str_replace(".","",$first_name) . "." . str_replace(".","",$last_name)));
         }
         else {
            $userid = str_replace(' ','',strtolower(str_replace(".","",$last_name)));
         }

         $userid = str_replace("'","",$userid);

         $query = "select * from users " .
                  "where school_num = $school_num " .
                  "and userid = '" . db_escape_string($userid) . "'";
         $results = db_query($query);

         // Create a new user if necessary
         if (db_num_rows($results) == 0) {
            $users_table = new Table("users");
            $password = $userid;
            $type = 'Staff';
            $status = 'Active';
            $receive_emails = 'Y';
            $date_added = date("Y-m-d",time());
            $query = $users_table->BuildInsert();
            db_query($query);
            $user_num = db_insert_id();

            $query = "update people set user_num = $user_num where record_num = $record_num";
            db_query($query);
         }
      }
      else {
         if (strlen($first_name) > 0) {
            $userid = str_replace(' ','',strtolower(str_replace(".","",$first_name) . "." . str_replace(".","",$last_name)));
         }
         else {
            $userid = str_replace(' ','',strtolower(str_replace(".","",$last_name)));
         }

         $userid = str_replace("'","",$userid);

         $set = "last_name = '" . db_escape_string($last_name) . "', first_name = '" . db_escape_string($first_name) . "'";
         $set .= ", userid = '$userid'";

         // Update user account with email if there is one
         if (strlen($email) > 0) {
            $set .= ", email = '$email'";
         }

         db_query("update users set $set where record_num = $user_num");
      }

      $form_message = getLanguageText('RECORD-UPDATED-MSG');
      $naction = "list";
      header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message));
      exit();

   case "delete-confirmed":
      $record_num = intval($_GET['record_num']);

      // Delete the user account for this staff person
      $query = "select user_num from people " .
               "where school_num = $base_school_num " .
               "and record_num = $record_num";
      $user_num = db_getVal($query);

      if ($user_num) {
         $query = "delete from users " .
                  "where school_num = $school_num " .
                  "and record_num = $user_num";
         db_query($query);
      }

      // Delete the current record
      $query = "delete from people " .
               "where school_num = $base_school_num " .
               "and record_num = $record_num";
      db_query($query);

      $form_message = getLanguageText('RECORD-DELETED-MSG');
      $naction = "list";
      header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message));
      exit();
}

?>