admin/edit_user.php

   1 <?php\r
   2 /************************************************************************/\r
   3 /* ATutor                                                                                                                               */\r
   4 /************************************************************************/\r
   5 /* Copyright (c) 2002-2007 by Greg Gay, Joel Kronenberg & Heidi Hazelton*/\r
   6 /* Adaptive Technology Resource Centre / University of Toronto                  */\r
   7 /* http://atutor.ca                                                                                                             */\r
   8 /*                                                                                                                                              */\r
   9 /* This program is free software. You can redistribute it and/or                */\r
  10 /* modify it under the terms of the GNU General Public License                  */\r
  11 /* as published by the Free Software Foundation.                                                */\r
  12 /************************************************************************/\r
  13 // $Id$\r
  14 \r
  15 define('AT_INCLUDE_PATH', '../include/');\r
  16 require(AT_INCLUDE_PATH.'vitals.inc.php');\r
  17 admin_authenticate(AT_ADMIN_PRIV_USERS);\r
  18 \r
  19 if (isset($_POST['cancel'])) {\r
  20         if (isset($_POST['ml']) && $_REQUEST['ml']) {\r
  21                 header('Location: '.AT_BASE_HREF.'admin/master_list.php');\r
  22         } else {\r
  23                 header('Location: '.AT_BASE_HREF.'admin/users.php');\r
  24         }\r
  25         exit;\r
  26 }\r
  27 \r
  28 if (isset($_POST['submit'])) {\r
  29         $missing_fields = array();\r
  30 \r
  31         $id = intval($_POST['id']);\r
  32 \r
  33         //check if student id (public field) is already being used\r
  34         if (!$_POST['overwrite'] && !empty($_POST['student_id'])) {\r
  35                 $result = mysql_query("SELECT public_field FROM ".TABLE_PREFIX."master_list WHERE public_field='$_POST[student_id]' AND member_id<>0 AND member_id<>$id",$db);\r
  36                 if (mysql_num_rows($result) != 0) {\r
  37                         $msg->addError('CREATE_MASTER_USED');\r
  38                 }\r
  39         }\r
  40 \r
  41         /* email check */\r
  42         if ($_POST['email'] == '') {\r
  43                 $missing_fields[] = _AT('email');\r
  44         } else if (!eregi("^[a-z0-9\._-]+@+[a-z0-9\._-]+\.+[a-z]{2,6}$", $_POST['email'])) {\r
  45                 $msg->addError('EMAIL_INVALID');\r
  46         }\r
  47         $result = mysql_query("SELECT * FROM ".TABLE_PREFIX."members WHERE email LIKE '$_POST[email]' AND member_id <> $id",$db);\r
  48 \r
  49         if (mysql_num_rows($result) != 0) {\r
  50                 $valid = 'no';\r
  51                 $msg->addError('EMAIL_EXISTS');\r
  52         }\r
  53 \r
  54         if (!$_POST['first_name']) { \r
  55                 $missing_fields[] = _AT('first_name');\r
  56         }\r
  57 \r
  58         if (!$_POST['last_name']) { \r
  59                 $missing_fields[] = _AT('last_name');\r
  60         }\r
  61 \r
  62         $_POST['first_name'] = str_replace('<', '', $_POST['first_name']);\r
  63         $_POST['second_name'] = str_replace('<', '', $_POST['second_name']);\r
  64         $_POST['last_name'] = str_replace('<', '', $_POST['last_name']);\r
  65 \r
  66         // check if first+last is unique\r
  67         if ($_POST['first_name'] && $_POST['last_name']) {\r
  68                 $first_name_sql  = $addslashes($_POST['first_name']);\r
  69                 $last_name_sql   = $addslashes($_POST['last_name']);\r
  70                 $second_name_sql = $addslashes($_POST['second_name']);\r
  71 \r
  72                 $sql = "SELECT member_id FROM ".TABLE_PREFIX."members WHERE first_name='$first_name_sql' AND second_name='$second_name_sql' AND last_name='$last_name_sql' AND member_id<>$id LIMIT 1";\r
  73                 $result = mysql_query($sql, $db);\r
  74                 if (mysql_fetch_assoc($result)) {\r
  75                         $msg->addError('FIRST_LAST_NAME_UNIQUE');\r
  76                 }\r
  77         }\r
  78 \r
  79         \r
  80         //check date of birth\r
  81         $mo = intval($_POST['month']);\r
  82         $day = intval($_POST['day']);\r
  83         $yr = intval($_POST['year']);\r
  84 \r
  85         /* let's us take (one or) two digit years (ex. 78 = 1978, 3 = 2003) */\r
  86         if ($yr < date('y')) { \r
  87                 $yr += 2000; \r
  88         } else if ($yr < 1900) { \r
  89                 $yr += 1900; \r
  90         } \r
  91 \r
  92         $dob = $yr.'-'.$mo.'-'.$day;\r
  93 \r
  94         if ($mo && $day && $yr && !checkdate($mo, $day, $yr)) { \r
  95                 $msg->addError('DOB_INVALID');\r
  96         } else if (!$mo || !$day || !$yr) {\r
  97                 $dob = '0000-00-00';\r
  98                 $yr = $mo = $day = 0;\r
  99         }\r
 100 \r
 101 \r
 102         if ($missing_fields) {\r
 103                 $missing_fields = implode(', ', $missing_fields);\r
 104                 $msg->addError(array('EMPTY_FIELDS', $missing_fields));\r
 105         }\r
 106 \r
 107         if (!$msg->containsErrors()) {\r
 108                 if (isset($_POST['profile_pic_delete'])) {\r
 109                         profile_image_delete($id);\r
 110                 }\r
 111                 if (($_POST['website']) && (!ereg("://",$_POST['website']))) { \r
 112                         $_POST['website'] = "http://".$_POST['website']; \r
 113                 }\r
 114                 if ($_POST['website'] == 'http://') { \r
 115                         $_POST['website'] = ''; \r
 116                 }\r
 117                 $_POST['postal'] = strtoupper(trim($_POST['postal']));\r
 118 \r
 119                 if (isset($_POST['private_email'])) {\r
 120                         $_POST['private_email'] = 1;\r
 121                 } else {\r
 122                         $_POST['private_email'] = 0;\r
 123                 }\r
 124 \r
 125                 //$_POST['password']   = $addslashes($_POST['password']);\r
 126                 $_POST['website']    = $addslashes($_POST['website']);\r
 127                 $_POST['first_name'] = $addslashes($_POST['first_name']);\r
 128                 $_POST['second_name'] = $addslashes($_POST['second_name']);\r
 129                 $_POST['last_name']  = $addslashes($_POST['last_name']);\r
 130                 $_POST['address']    = $addslashes($_POST['address']);\r
 131                 $_POST['postal']     = $addslashes($_POST['postal']);\r
 132                 $_POST['city']       = $addslashes($_POST['city']);\r
 133                 $_POST['province']   = $addslashes($_POST['province']);\r
 134                 $_POST['country']    = $addslashes($_POST['country']);\r
 135                 $_POST['phone']      = $addslashes($_POST['phone']);\r
 136                 $_POST['status']     = intval($_POST['status']);\r
 137                 $_POST['old_status']     = intval($_POST['old_status']);\r
 138                 $_POST['gender']     = $addslashes($_POST['gender']);\r
 139 \r
 140                 /* insert into the db. (the last 0 for status) */\r
 141                 $sql = "UPDATE ".TABLE_PREFIX."members SET      email      = '$_POST[email]',\r
 142                                                                                                         website    = '$_POST[website]',\r
 143                                                                                                         first_name = '$_POST[first_name]',\r
 144                                                                                                         second_name= '$_POST[second_name]',\r
 145                                                                                                         last_name  = '$_POST[last_name]', \r
 146                                                                                                         dob      = '$dob',\r
 147                                                                                                         gender   = '$_POST[gender]', \r
 148                                                                                                         address  = '$_POST[address]',\r
 149                                                                                                         postal   = '$_POST[postal]',\r
 150                                                                                                         city     = '$_POST[city]',\r
 151                                                                                                         province = '$_POST[province]',\r
 152                                                                                                         country  = '$_POST[country]', \r
 153                                                                                                         phone    = '$_POST[phone]',\r
 154                                                                                                         status   = $_POST[status],\r
 155                                                                                                         language = '$_SESSION[lang]', \r
 156                                                                                                         private_email = $_POST[private_email],\r
 157                                                                                                         creation_date=creation_date,\r
 158                                                                                                         last_login=last_login\r
 159                                 WHERE member_id = $id";\r
 160                 $result = mysql_query($sql, $db);\r
 161                 if (!$result) {\r
 162                         require(AT_INCLUDE_PATH.'header.inc.php');\r
 163                         $msg->addError('DB_NOT_UPDATED');\r
 164                         $msg->printAll();\r
 165                         require(AT_INCLUDE_PATH.'footer.inc.php');\r
 166                         exit;\r
 167                 }\r
 168 \r
 169 \r
 170                 if (defined('AT_MASTER_LIST') && AT_MASTER_LIST) {\r
 171                         $_POST['student_id'] = $addslashes($_POST['student_id']);\r
 172                         $student_pin = sha1($addslashes($_POST['student_pin']));\r
 173 \r
 174                         //if changed, delete old stud id\r
 175                         if (!empty($_POST['old_student_id']) && $_POST['old_student_id'] != $_POST['student_id']) {\r
 176                                 $sql = "DELETE FROM ".TABLE_PREFIX."master_list WHERE public_field=".$_POST['old_student_id']." AND member_id=$id";\r
 177                                 $result = mysql_query($sql, $db);\r
 178                         }\r
 179                         //if new is set\r
 180                         if (!empty($_POST['student_id']) && $_POST['old_student_id'] != $_POST['student_id']) {\r
 181                                 $sql = "REPLACE INTO ".TABLE_PREFIX."master_list VALUES ('$_POST[student_id]', '', $id)";\r
 182                                 $result = mysql_query($sql, $db);\r
 183                         }\r
 184                 }\r
 185 \r
 186 \r
 187                 if (defined('AT_EMAIL_CONFIRMATION') && AT_EMAIL_CONFIRMATION && ($_POST['status'] == AT_STATUS_UNCONFIRMED) && ($_POST['old_status'] != AT_STATUS_UNCONFIRMED)) {\r
 188 \r
 189                         $sql    = "SELECT email, creation_date FROM ".TABLE_PREFIX."members WHERE member_id=$id";\r
 190                         $result = mysql_query($sql, $db);\r
 191                         $row    = mysql_fetch_assoc($result);\r
 192 \r
 193                         $code = substr(md5($row['email'] . $row['creation_date']. $id), 0, 10);\r
 194                         $confirmation_link = AT_BASE_HREF . 'confirm.php?id='.$id.SEP.'m='.$code;\r
 195 \r
 196                         /* send the email confirmation message: */\r
 197                         require(AT_INCLUDE_PATH . 'classes/phpmailer/atutormailer.class.php');\r
 198                         $mail = new ATutorMailer();\r
 199 \r
 200                         $mail->AddAddress($row['email']);\r
 201                         $mail->From    = $_config['contact_email'];\r
 202                         $mail->Subject = $_config['site_name'] . ' - ' . _AT('email_confirmation_subject');\r
 203                         $mail->Body    = _AT('email_confirmation_message', $_config['site_name'], $confirmation_link);\r
 204 \r
 205                         $mail->Send();\r
 206                 }\r
 207 \r
 208                 $msg->addFeedback('PROFILE_UPDATED_ADMIN');\r
 209                 if (isset($_POST['ml']) && $_REQUEST['ml']) {\r
 210                         header('Location: '.AT_BASE_HREF.'admin/master_list.php');\r
 211                 } else {\r
 212                         header('Location: '.AT_BASE_HREF.'admin/users.php');\r
 213                 }\r
 214                 exit;\r
 215         }\r
 216 }\r
 217 \r
 218 $id = intval($_REQUEST['id']);\r
 219 \r
 220 if (empty($_POST)) {\r
 221         $sql    = "SELECT * FROM ".TABLE_PREFIX."members WHERE member_id = $id";\r
 222         $result = mysql_query($sql, $db);\r
 223         if (!($row = mysql_fetch_assoc($result))) {\r
 224                 require(AT_INCLUDE_PATH.'header.inc.php');      \r
 225                 $msg->addError('USER_NOT_FOUND');       \r
 226                 $msg->printAll();\r
 227                 require(AT_INCLUDE_PATH.'footer.inc.php'); \r
 228                 exit;\r
 229         }\r
 230         \r
 231         $_POST  = $row;\r
 232         list($_POST['year'],$_POST['month'],$_POST['day']) = explode('-', $row['dob']);\r
 233         //$_POST['password2']  = $_POST['password'];\r
 234         $_POST['old_status'] = $_POST['status'];\r
 235 \r
 236         if (admin_authenticate(AT_ADMIN_PRIV_USERS, TRUE) && defined('AT_MASTER_LIST') && AT_MASTER_LIST) {\r
 237                 $sql    = "SELECT public_field FROM ".TABLE_PREFIX."master_list WHERE member_id=$id";\r
 238                 $result = mysql_query($sql, $db);\r
 239                 if ($row = mysql_fetch_assoc($result)) {\r
 240                         $_POST['old_student_id'] = $row['public_field'];\r
 241                         $_POST['student_id'] = $row['public_field'];\r
 242                 }\r
 243         }\r
 244 }\r
 245 \r
 246 $savant->assign('languageManager', $languageManager);\r
 247 \r
 248 if (isset($_REQUEST['ml']) && $_REQUEST['ml']) {\r
 249         // redirect back to the master list\r
 250         $savant->assign('ml', 1);\r
 251 } else {\r
 252         $savant->assign('ml', 0);\r
 253 }\r
 254 \r
 255 \r
 256 /* HAVE TO SEND MEMBER_ID THROUGH FORM AS A HIDDEN POST VARIABLE!!! */\r
 257 /* PUT IN IF LOOP THAT LETS YOU SEE STATUS RADIO BUTTONS */\r
 258 $savant->display('registration.tmpl.php');\r
 259 \r
 260 ?>