docs/mods/_core/users/create_user.php

   1 <?php\r
   2 /************************************************************************/\r
   3 /* ATutor                                                                                                                               */\r
   4 /************************************************************************/\r
   5 /* Copyright (c) 2002-2010                                              */\r
   6 /* Inclusive Design Institute                                           */\r
   7 /* http://atutor.ca                                                                                                             */\r
   8 /*                                                                                                                                              */\r
   9 /* This program is free software. You can redistribute it and/or        */\r
  10 /* modify it under the terms of the GNU General Public License          */\r
  11 /* as published by the Free Software Foundation.                        */\r
  12 /************************************************************************/\r
  13 // $Id$\r
  14 \r
  15 define('AT_INCLUDE_PATH', '../../../include/');\r
  16 require(AT_INCLUDE_PATH.'vitals.inc.php');\r
  17 admin_authenticate(AT_ADMIN_PRIV_USERS);\r
  18 \r
  19 if (isset($_POST['cancel'])) {\r
  20         header('Location: '.AT_BASE_HREF.'mods/_core/users/users.php');\r
  21         exit;\r
  22 }\r
  23 \r
  24 if (isset($_POST['submit'])) {\r
  25         $missing_fields = array();\r
  26         $_POST['password']   = $addslashes($_POST['password']);\r
  27                 $_POST['website']    = $addslashes($_POST['website']);\r
  28                 $_POST['first_name'] = $addslashes($_POST['first_name']);\r
  29                 $_POST['second_name']  = $addslashes($_POST['second_name']);\r
  30                 $_POST['last_name']  = $addslashes($_POST['last_name']);\r
  31                 $_POST['address']    = $addslashes($_POST['address']);\r
  32                 $_POST['postal']     = $addslashes($_POST['postal']);\r
  33                 $_POST['city']       = $addslashes($_POST['city']);\r
  34                 $_POST['province']   = $addslashes($_POST['province']);\r
  35                 $_POST['country']    = $addslashes($_POST['country']);\r
  36                 $_POST['phone']      = $addslashes($_POST['phone']);\r
  37                 $_POST['status']     = intval($_POST['status']);\r
  38                 $_POST['gender']     = $addslashes($_POST['gender']);\r
  39                 $_POST['login']      = $addslashes($_POST['login']);\r
  40         $_POST['email'] = $addslashes($_POST['email']);\r
  41 \r
  42 \r
  43         //check if student id (public field) is already being used\r
  44         if (!$_POST['overwrite'] && !empty($_POST['student_id'])) {\r
  45                 $result = mysql_query("SELECT * FROM ".TABLE_PREFIX."master_list WHERE public_field='$_POST[student_id]' && member_id<>0",$db);\r
  46                 if (mysql_num_rows($result) != 0) {\r
  47                         $msg->addError('CREATE_MASTER_USED');\r
  48                 }\r
  49         }\r
  50 \r
  51         /* login name check */\r
  52         if ($_POST['login'] == '') {\r
  53                 $missing_fields[] = _AT('login_name');\r
  54         } else {\r
  55                 /* check for special characters */\r
  56                 if (!(preg_match("/^[a-zA-Z0-9_.-]([a-zA-Z0-9_.-])*$/i", $_POST['login']))) {\r
  57                         $msg->addError('LOGIN_CHARS');\r
  58                 } else {\r
  59                         $result = mysql_query("SELECT * FROM ".TABLE_PREFIX."members WHERE login='$_POST[login]'",$db);\r
  60                         if (mysql_num_rows($result) != 0) {\r
  61                                 $valid = 'no';\r
  62                                 $msg->addError('LOGIN_EXISTS');\r
  63                         }  else {\r
  64                                 $result = mysql_query("SELECT * FROM ".TABLE_PREFIX."admins WHERE login='$_POST[login]'",$db);\r
  65                                 if (mysql_num_rows($result) != 0) {\r
  66                                         $msg->addError('LOGIN_EXISTS');\r
  67                                 }\r
  68                         }\r
  69                 }\r
  70         }\r
  71 \r
  72         /* password check:      */\r
  73         $_POST['password'] = $_POST['form_password_hidden'];\r
  74 \r
  75         /* password check: password is verified front end by javascript. here is to handle the errors from javascript */\r
  76         if ($_POST['password_error'] <> "")\r
  77         {\r
  78                 $pwd_errors = explode(",", $_POST['password_error']);\r
  79 \r
  80                 foreach ($pwd_errors as $pwd_error)\r
  81                 {\r
  82                         if ($pwd_error == "missing_password")\r
  83                                 $missing_fields[] = _AT('password');\r
  84                         else\r
  85                                 $msg->addError($pwd_error);\r
  86                 }\r
  87         }\r
  88 \r
  89         /* email check */\r
  90         if ($_POST['email'] == '') {\r
  91                 $missing_fields[] = _AT('email');\r
  92         } else if (!preg_match("/^[a-z0-9\._-]+@+[a-z0-9\._-]+\.+[a-z]{2,6}$/i", $_POST['email'])) {\r
  93                 $msg->addError('EMAIL_INVALID');\r
  94         }\r
  95 \r
  96         $result = mysql_query("SELECT member_id FROM ".TABLE_PREFIX."members WHERE email LIKE '$_POST[email]'",$db);\r
  97         if (mysql_num_rows($result) != 0) {\r
  98                 $msg->addError('EMAIL_EXISTS');\r
  99         }\r
 100 \r
 101         if (!$_POST['first_name']) {\r
 102                 $missing_fields[] = _AT('first_name');\r
 103         }\r
 104 \r
 105         if (!$_POST['last_name']) {\r
 106                 $missing_fields[] = _AT('last_name');\r
 107         }\r
 108 \r
 109         $_POST['first_name'] = str_replace('<', '', $_POST['first_name']);\r
 110         $_POST['second_name'] = str_replace('<', '', $_POST['second_name']);\r
 111         $_POST['last_name'] = str_replace('<', '', $_POST['last_name']);\r
 112 \r
 113         $_POST['login'] = strtolower($_POST['login']);\r
 114 \r
 115         //check date of birth\r
 116         $mo = intval($_POST['month']);\r
 117         $day = intval($_POST['day']);\r
 118         $yr = intval($_POST['year']);\r
 119 \r
 120         /* let's us take (one or) two digit years (ex. 78 = 1978, 3 = 2003) */\r
 121         if ($yr < date('y')) { \r
 122                 $yr += 2000; \r
 123         } else if ($yr < 1900) { \r
 124                 $yr += 1900; \r
 125         } \r
 126 \r
 127         $dob = $yr.'-'.$mo.'-'.$day;\r
 128 \r
 129         if ($mo && $day && $yr && !checkdate($mo, $day, $yr)) { \r
 130                 $msg->addError('DOB_INVALID');\r
 131         } else if (!$mo || !$day || !$yr) {\r
 132                 $dob = '0000-00-00';\r
 133                 $yr = $mo = $day = 0;\r
 134         }\r
 135 \r
 136         if ($missing_fields) {\r
 137                 $missing_fields = implode(', ', $missing_fields);\r
 138                 $msg->addError(array('EMPTY_FIELDS', $missing_fields));\r
 139         }\r
 140 \r
 141         if (!$msg->containsErrors()) {\r
 142                 if (($_POST['website']) && (!strstr($_POST['website'], '://'))) { \r
 143                         $_POST['website'] = 'http://' . $_POST['website']; \r
 144                 }\r
 145                 if ($_POST['website'] == 'http://') { \r
 146                         $_POST['website'] = ''; \r
 147                 }\r
 148                 $_POST['postal'] = strtoupper(trim($_POST['postal']));\r
 149         \r
 150                 if (isset($_POST['private_email'])) {\r
 151                         $_POST['private_email'] = 1;\r
 152                 } else {\r
 153                         $_POST['private_email'] = 0;\r
 154                 }\r
 155 \r
 156                 $now = date('Y-m-d H:i:s'); // we use this later for the email confirmation.\r
 157 \r
 158                 /* insert into the db. (the last 0 for status) */\r
 159                 $sql = "INSERT INTO ".TABLE_PREFIX."members VALUES (NULL,'$_POST[login]','$_POST[password]','$_POST[email]','$_POST[website]','$_POST[first_name]', '$_POST[second_name]', '$_POST[last_name]', '$dob', '$_POST[gender]', '$_POST[address]','$_POST[postal]','$_POST[city]','$_POST[province]','$_POST[country]', '$_POST[phone]',$_POST[status], '$_config[pref_defaults]', '$now','$_config[default_language]', $_config[pref_inbox_notify], $_POST[private_email], '0000-00-00 00:00:00')";\r
 160 \r
 161                 $result = mysql_query($sql, $db);\r
 162 \r
 163                 $m_id   = mysql_insert_id($db);\r
 164                 if (!$result) {\r
 165                         require(AT_INCLUDE_PATH.'header.inc.php');\r
 166                         $msg->addError('DB_NOT_UPDATED');\r
 167                         $msg->printAll();\r
 168                         require(AT_INCLUDE_PATH.'footer.inc.php');\r
 169                         exit;\r
 170                 }\r
 171 \r
 172                 if (defined('AT_MASTER_LIST') && AT_MASTER_LIST) {\r
 173                         $student_id  = $addslashes($_POST['student_id']);\r
 174                         $student_pin = md5($addslashes($_POST['student_pin']));\r
 175                         if ($student_id) {\r
 176                                 $sql = "UPDATE ".TABLE_PREFIX."master_list SET member_id=$m_id WHERE public_field='$student_id'";\r
 177                                 mysql_query($sql, $db);\r
 178                                 if (mysql_affected_rows($db) == 0) {\r
 179                                         $sql = "REPLACE INTO ".TABLE_PREFIX."master_list VALUES ('$student_id', '$student_pin', $m_id)";\r
 180                                         mysql_query($sql, $db);\r
 181                                 }\r
 182                         }\r
 183                 }\r
 184 \r
 185 \r
 186                 if ($_POST['pref'] == 'access') {\r
 187                         $_SESSION['member_id'] = $m_id;\r
 188                         save_prefs();\r
 189                         unset($_SESSION['member_id']);\r
 190                 }\r
 191 \r
 192 \r
 193                 require(AT_INCLUDE_PATH . 'classes/phpmailer/atutormailer.class.php');\r
 194                 $mail = new ATutorMailer();\r
 195                 $mail->AddAddress($_POST['email']);\r
 196                 $mail->From    = $_config['contact_email'];\r
 197                 \r
 198                 if (defined('AT_EMAIL_CONFIRMATION') && AT_EMAIL_CONFIRMATION && ($_POST['status'] == AT_STATUS_UNCONFIRMED)) {\r
 199                         $code = substr(md5($_POST['email'] . $now . $m_id), 0, 10);\r
 200                         $confirmation_link = AT_BASE_HREF . 'confirm.php?id='.$m_id.SEP.'m='.$code;\r
 201 \r
 202                         /* send the email confirmation message: */\r
 203                         $mail->Subject = $_config['site_name'] . ': ' . _AT('email_confirmation_subject');\r
 204                         $body .= _AT('admin_new_account_confirm', $_config['site_name'], $confirmation_link)."\n\n";\r
 205 \r
 206                 } else {\r
 207                         $mail->Subject = $_config['site_name'].": "._AT('account_information');\r
 208                         $body .= _AT('admin_new_account', $_config['site_name'])."\n\n";\r
 209                 }\r
 210                 $body .= _AT('web_site') .' : '.AT_BASE_HREF."\n";\r
 211                 $body .= _AT('login_name') .' : '.$_POST['login'] . "\n";\r
 212 //              $body .= _AT('password') .' : '.$_POST['password'] . "\n";\r
 213                 $mail->Body    = $body;\r
 214                 $mail->Send();\r
 215 \r
 216                 $msg->addFeedback('PROFILE_CREATED_ADMIN');\r
 217                 header('Location: '.AT_BASE_HREF.'mods/_core/users/users.php');\r
 218                 exit;\r
 219         }\r
 220 }\r
 221 \r
 222 $onload = 'document.form.login.focus();';\r
 223 \r
 224 $savant->assign('languageManager', $languageManager);\r
 225 $savant->assign('no_captcha', true);\r
 226 \r
 227 if (!isset($_POST['status'])) {\r
 228         if (defined('AT_EMAIL_CONFIRMATION') && AT_EMAIL_CONFIRMATION) {\r
 229                 $_POST['status'] = AT_STATUS_UNCONFIRMED;\r
 230         } else {\r
 231                 $_POST['status'] = AT_STATUS_STUDENT;\r
 232         }\r
 233 }\r
 234 \r
 235 $savant->display('registration.tmpl.php');\r
 236 \r
 237 ?>\r