admin/create_user.php

   1 <?php\r
   2 /************************************************************************/\r
   3 /* ATutor                                                                                                                               */\r
   4 /************************************************************************/\r
   5 /* Copyright (c) 2002-2007 by Greg Gay, Joel Kronenberg & Heidi Hazelton*/\r
   6 /* Adaptive Technology Resource Centre / University of Toronto                  */\r
   7 /* http://atutor.ca                                                                                                             */\r
   8 /*                                                                                                                                              */\r
   9 /* This program is free software. You can redistribute it and/or                */\r
  10 /* modify it under the terms of the GNU General Public License                  */\r
  11 /* as published by the Free Software Foundation.                                                */\r
  12 /************************************************************************/\r
  13 // $Id$\r
  14 \r
  15 define('AT_INCLUDE_PATH', '../include/');\r
  16 require(AT_INCLUDE_PATH.'vitals.inc.php');\r
  17 admin_authenticate(AT_ADMIN_PRIV_USERS);\r
  18 \r
  19 if (isset($_POST['cancel'])) {\r
  20         header('Location: '.AT_BASE_HREF.'admin/users.php');\r
  21         exit;\r
  22 }\r
  23 \r
  24 if (isset($_POST['submit'])) {\r
  25         $missing_fields = array();\r
  26 \r
  27         //check if student id (public field) is already being used\r
  28         if (!$_POST['overwrite'] && !empty($_POST['student_id'])) {\r
  29                 $result = mysql_query("SELECT * FROM ".TABLE_PREFIX."master_list WHERE public_field='$_POST[student_id]' && member_id<>0",$db);\r
  30                 if (mysql_num_rows($result) != 0) {\r
  31                         $msg->addError('CREATE_MASTER_USED');\r
  32                 }\r
  33         }\r
  34 \r
  35         /* login name check */\r
  36         if ($_POST['login'] == '') {\r
  37                 $missing_fields[] = _AT('login_name');\r
  38         } else {\r
  39                 /* check for special characters */\r
  40                 if (!(eregi("^[a-zA-Z0-9_.-]([a-zA-Z0-9_.-])*$", $_POST['login']))) {\r
  41                         $msg->addError('LOGIN_CHARS');\r
  42                 } else {\r
  43                         $result = mysql_query("SELECT * FROM ".TABLE_PREFIX."members WHERE login='$_POST[login]'",$db);\r
  44                         if (mysql_num_rows($result) != 0) {\r
  45                                 $valid = 'no';\r
  46                                 $msg->addError('LOGIN_EXISTS');\r
  47                         }  else {\r
  48                                 $result = mysql_query("SELECT * FROM ".TABLE_PREFIX."admins WHERE login='$_POST[login]'",$db);\r
  49                                 if (mysql_num_rows($result) != 0) {\r
  50                                         $msg->addError('LOGIN_EXISTS');\r
  51                                 }\r
  52                         }\r
  53                 }\r
  54         }\r
  55 \r
  56         /* password check:      */\r
  57         if ($_POST['password'] == '') { \r
  58                 $missing_fields[] = _AT('password');\r
  59         } else {\r
  60                 // check for valid passwords\r
  61                 if ($_POST['password'] != $_POST['password2']){\r
  62                         $valid= 'no';\r
  63                         $msg->addError('PASSWORD_MISMATCH');\r
  64                 }\r
  65         }\r
  66         \r
  67         /* email check */\r
  68         if ($_POST['email'] == '') {\r
  69                 $missing_fields[] = _AT('email');\r
  70         } else if (!eregi("^[a-z0-9\._-]+@+[a-z0-9\._-]+\.+[a-z]{2,6}$", $_POST['email'])) {\r
  71                 $msg->addError('EMAIL_INVALID');\r
  72         }\r
  73 \r
  74         $_POST['email'] = $addslashes($_POST['email']);\r
  75         $result = mysql_query("SELECT member_id FROM ".TABLE_PREFIX."members WHERE email LIKE '$_POST[email]'",$db);\r
  76         if (mysql_num_rows($result) != 0) {\r
  77                 $msg->addError('EMAIL_EXISTS');\r
  78         }\r
  79 \r
  80         if (!$_POST['first_name']) {\r
  81                 $missing_fields[] = _AT('first_name');\r
  82         }\r
  83 \r
  84         if (!$_POST['last_name']) {\r
  85                 $missing_fields[] = _AT('last_name');\r
  86         }\r
  87 \r
  88         $_POST['first_name'] = str_replace('<', '', $_POST['first_name']);\r
  89         $_POST['second_name'] = str_replace('<', '', $_POST['second_name']);\r
  90         $_POST['last_name'] = str_replace('<', '', $_POST['last_name']);\r
  91 \r
  92         // check if first+last is unique\r
  93         if ($_POST['first_name'] && $_POST['last_name']) {\r
  94                 $first_name_sql  = $addslashes($_POST['first_name']);\r
  95                 $last_name_sql   = $addslashes($_POST['last_name']);\r
  96                 $second_name_sql = $addslashes($_POST['second_name']);\r
  97 \r
  98                 $sql = "SELECT member_id FROM ".TABLE_PREFIX."members WHERE first_name='$first_name_sql' AND second_name='$second_name_sql' AND last_name='$last_name_sql' LIMIT 1";\r
  99                 $result = mysql_query($sql, $db);\r
 100                 if (mysql_fetch_assoc($result)) {\r
 101                         $msg->addError('FIRST_LAST_NAME_UNIQUE');\r
 102                 }\r
 103         }\r
 104 \r
 105 \r
 106         $_POST['login'] = strtolower($_POST['login']);\r
 107 \r
 108         //check date of birth\r
 109         $mo = intval($_POST['month']);\r
 110         $day = intval($_POST['day']);\r
 111         $yr = intval($_POST['year']);\r
 112 \r
 113         /* let's us take (one or) two digit years (ex. 78 = 1978, 3 = 2003) */\r
 114         if ($yr < date('y')) { \r
 115                 $yr += 2000; \r
 116         } else if ($yr < 1900) { \r
 117                 $yr += 1900; \r
 118         } \r
 119 \r
 120         $dob = $yr.'-'.$mo.'-'.$day;\r
 121 \r
 122         if ($mo && $day && $yr && !checkdate($mo, $day, $yr)) { \r
 123                 $msg->addError('DOB_INVALID');\r
 124         } else if (!$mo || !$day || !$yr) {\r
 125                 $dob = '0000-00-00';\r
 126                 $yr = $mo = $day = 0;\r
 127         }\r
 128 \r
 129         if ($missing_fields) {\r
 130                 $missing_fields = implode(', ', $missing_fields);\r
 131                 $msg->addError(array('EMPTY_FIELDS', $missing_fields));\r
 132         }\r
 133 \r
 134         if (!$msg->containsErrors()) {\r
 135                 if (($_POST['website']) && (!ereg('://',$_POST['website']))) { \r
 136                         $_POST['website'] = 'http://' . $_POST['website']; \r
 137                 }\r
 138                 if ($_POST['website'] == 'http://') { \r
 139                         $_POST['website'] = ''; \r
 140                 }\r
 141                 $_POST['postal'] = strtoupper(trim($_POST['postal']));\r
 142         \r
 143                 if (isset($_POST['private_email'])) {\r
 144                         $_POST['private_email'] = 1;\r
 145                 } else {\r
 146                         $_POST['private_email'] = 0;\r
 147                 }\r
 148                 $_POST['password']   = $addslashes($_POST['password']);\r
 149                 $_POST['website']    = $addslashes($_POST['website']);\r
 150                 $_POST['first_name'] = $addslashes($_POST['first_name']);\r
 151                 $_POST['second_name']  = $addslashes($_POST['second_name']);\r
 152                 $_POST['last_name']  = $addslashes($_POST['last_name']);\r
 153                 $_POST['address']    = $addslashes($_POST['address']);\r
 154                 $_POST['postal']     = $addslashes($_POST['postal']);\r
 155                 $_POST['city']       = $addslashes($_POST['city']);\r
 156                 $_POST['province']   = $addslashes($_POST['province']);\r
 157                 $_POST['country']    = $addslashes($_POST['country']);\r
 158                 $_POST['phone']      = $addslashes($_POST['phone']);\r
 159                 $_POST['status']     = intval($_POST['status']);\r
 160                 $_POST['gender']     = $addslashes($_POST['gender']);\r
 161 \r
 162                 $now = date('Y-m-d H:i:s'); // we use this later for the email confirmation.\r
 163 \r
 164                 /* insert into the db. (the last 0 for status) */\r
 165                 $sql = "INSERT INTO ".TABLE_PREFIX."members VALUES (NULL,'$_POST[login]','$_POST[password]','$_POST[email]','$_POST[website]','$_POST[first_name]', '$_POST[second_name]', '$_POST[last_name]', '$dob', '$_POST[gender]', '$_POST[address]','$_POST[postal]','$_POST[city]','$_POST[province]','$_POST[country]', '$_POST[phone]',$_POST[status], '$_config[pref_defaults]', '$now','$_config[default_language]', $_config[pref_inbox_notify], $_POST[private_email], '0000-00-00 00:00:00')";\r
 166 \r
 167                 $result = mysql_query($sql, $db);\r
 168 \r
 169                 $m_id   = mysql_insert_id($db);\r
 170                 if (!$result) {\r
 171                         require(AT_INCLUDE_PATH.'header.inc.php');\r
 172                         $msg->addError('DB_NOT_UPDATED');\r
 173                         $msg->printAll();\r
 174                         require(AT_INCLUDE_PATH.'footer.inc.php');\r
 175                         exit;\r
 176                 }\r
 177 \r
 178                 if (defined('AT_MASTER_LIST') && AT_MASTER_LIST) {\r
 179                         $student_id  = $addslashes($_POST['student_id']);\r
 180                         $student_pin = md5($addslashes($_POST['student_pin']));\r
 181                         if ($student_id) {\r
 182                                 $sql = "UPDATE ".TABLE_PREFIX."master_list SET member_id=$m_id WHERE public_field='$student_id'";\r
 183                                 mysql_query($sql, $db);\r
 184                                 if (mysql_affected_rows($db) == 0) {\r
 185                                         $sql = "REPLACE INTO ".TABLE_PREFIX."master_list VALUES ('$student_id', '$student_pin', $m_id)";\r
 186                                         mysql_query($sql, $db);\r
 187                                 }\r
 188                         }\r
 189                 }\r
 190 \r
 191 \r
 192                 if ($_POST['pref'] == 'access') {\r
 193                         $_SESSION['member_id'] = $m_id;\r
 194                         save_prefs();\r
 195                         unset($_SESSION['member_id']);\r
 196                 }\r
 197 \r
 198 \r
 199                 require(AT_INCLUDE_PATH . 'classes/phpmailer/atutormailer.class.php');\r
 200                 $mail = new ATutorMailer();\r
 201                 $mail->AddAddress($_POST['email']);\r
 202                 $mail->From    = $_config['contact_email'];\r
 203                 \r
 204                 if (defined('AT_EMAIL_CONFIRMATION') && AT_EMAIL_CONFIRMATION && ($_POST['status'] == AT_STATUS_UNCONFIRMED)) {\r
 205                         $code = substr(md5($_POST['email'] . $now . $m_id), 0, 10);\r
 206                         $confirmation_link = AT_BASE_HREF . 'confirm.php?id='.$m_id.SEP.'m='.$code;\r
 207 \r
 208                         /* send the email confirmation message: */\r
 209                         $mail->Subject = $_config['site_name'] . ': ' . _AT('email_confirmation_subject');\r
 210                         $body .= _AT('admin_new_account_confirm', $_config['site_name'], $confirmation_link)."\n\n";\r
 211 \r
 212                 } else {\r
 213                         $mail->Subject = $_config['site_name'].": "._AT('account_information');\r
 214                         $body .= _AT('admin_new_account', $_config['site_name'])."\n\n";\r
 215                 }\r
 216                 $body .= _AT('web_site') .' : '.AT_BASE_HREF."\n";\r
 217                 $body .= _AT('login_name') .' : '.$_POST['login'] . "\n";\r
 218                 $body .= _AT('password') .' : '.$_POST['password'] . "\n";\r
 219                 $mail->Body    = $body;\r
 220                 $mail->Send();\r
 221 \r
 222                 $msg->addFeedback('PROFILE_CREATED_ADMIN');\r
 223                 header('Location: '.AT_BASE_HREF.'admin/users.php');\r
 224                 exit;\r
 225         }\r
 226 }\r
 227 \r
 228 $onload = 'document.form.login.focus();';\r
 229 \r
 230 $savant->assign('languageManager', $languageManager);\r
 231 \r
 232 if (!isset($_POST['status'])) {\r
 233         if (defined('AT_EMAIL_CONFIRMATION') && AT_EMAIL_CONFIRMATION) {\r
 234                 $_POST['status'] = AT_STATUS_UNCONFIRMED;\r
 235         } else {\r
 236                 $_POST['status'] = AT_STATUS_STUDENT;\r
 237         }\r
 238 }\r
 239 \r
 240 $savant->display('registration.tmpl.php');\r
 241 \r
 242 ?>