mods/_core/users/create_user.php

   1 <?php\r
   2 /************************************************************************/\r
   3 /* ATutor                                                                                                                               */\r
   4 /************************************************************************/\r
   5 /* Copyright (c) 2002-2010                                              */\r
   6 /* Inclusive Design Institute                                           */\r
   7 /* http://atutor.ca                                                                                                             */\r
   8 /*                                                                                                                                              */\r
   9 /* This program is free software. You can redistribute it and/or        */\r
  10 /* modify it under the terms of the GNU General Public License          */\r
  11 /* as published by the Free Software Foundation.                        */\r
  12 /************************************************************************/\r
  13 // $Id$\r
  14 \r
  15 define('AT_INCLUDE_PATH', '../../../include/');\r
  16 require(AT_INCLUDE_PATH.'vitals.inc.php');\r
  17 admin_authenticate(AT_ADMIN_PRIV_USERS);\r
  18 \r
  19 if (isset($_POST['cancel'])) {\r
  20         header('Location: '.AT_BASE_HREF.'mods/_core/users/users.php');\r
  21         exit;\r
  22 }\r
  23 \r
  24 if (isset($_POST['submit'])) {\r
  25         $missing_fields = array();\r
  26 \r
  27         //check if student id (public field) is already being used\r
  28         if (!$_POST['overwrite'] && !empty($_POST['student_id'])) {\r
  29                 $result = mysql_query("SELECT * FROM ".TABLE_PREFIX."master_list WHERE public_field='$_POST[student_id]' && member_id<>0",$db);\r
  30                 if (mysql_num_rows($result) != 0) {\r
  31                         $msg->addError('CREATE_MASTER_USED');\r
  32                 }\r
  33         }\r
  34 \r
  35         /* login name check */\r
  36         if ($_POST['login'] == '') {\r
  37                 $missing_fields[] = _AT('login_name');\r
  38         } else {\r
  39                 /* check for special characters */\r
  40                 if (!(preg_match("/^[a-zA-Z0-9_.-]([a-zA-Z0-9_.-])*$/i", $_POST['login']))) {\r
  41                         $msg->addError('LOGIN_CHARS');\r
  42                 } else {\r
  43                         $result = mysql_query("SELECT * FROM ".TABLE_PREFIX."members WHERE login='$_POST[login]'",$db);\r
  44                         if (mysql_num_rows($result) != 0) {\r
  45                                 $valid = 'no';\r
  46                                 $msg->addError('LOGIN_EXISTS');\r
  47                         }  else {\r
  48                                 $result = mysql_query("SELECT * FROM ".TABLE_PREFIX."admins WHERE login='$_POST[login]'",$db);\r
  49                                 if (mysql_num_rows($result) != 0) {\r
  50                                         $msg->addError('LOGIN_EXISTS');\r
  51                                 }\r
  52                         }\r
  53                 }\r
  54         }\r
  55 \r
  56         /* password check:      */\r
  57         $_POST['password'] = $_POST['form_password_hidden'];\r
  58 \r
  59         /* password check: password is verified front end by javascript. here is to handle the errors from javascript */\r
  60         if ($_POST['password_error'] <> "")\r
  61         {\r
  62                 $pwd_errors = explode(",", $_POST['password_error']);\r
  63 \r
  64                 foreach ($pwd_errors as $pwd_error)\r
  65                 {\r
  66                         if ($pwd_error == "missing_password")\r
  67                                 $missing_fields[] = _AT('password');\r
  68                         else\r
  69                                 $msg->addError($pwd_error);\r
  70                 }\r
  71         }\r
  72 \r
  73         /* email check */\r
  74         if ($_POST['email'] == '') {\r
  75                 $missing_fields[] = _AT('email');\r
  76         } else if (!preg_match("/^[a-z0-9\._-]+@+[a-z0-9\._-]+\.+[a-z]{2,6}$/i", $_POST['email'])) {\r
  77                 $msg->addError('EMAIL_INVALID');\r
  78         }\r
  79 \r
  80         $_POST['email'] = $addslashes($_POST['email']);\r
  81         $result = mysql_query("SELECT member_id FROM ".TABLE_PREFIX."members WHERE email LIKE '$_POST[email]'",$db);\r
  82         if (mysql_num_rows($result) != 0) {\r
  83                 $msg->addError('EMAIL_EXISTS');\r
  84         }\r
  85 \r
  86         if (!$_POST['first_name']) {\r
  87                 $missing_fields[] = _AT('first_name');\r
  88         }\r
  89 \r
  90         if (!$_POST['last_name']) {\r
  91                 $missing_fields[] = _AT('last_name');\r
  92         }\r
  93 \r
  94         $_POST['first_name'] = str_replace('<', '', $_POST['first_name']);\r
  95         $_POST['second_name'] = str_replace('<', '', $_POST['second_name']);\r
  96         $_POST['last_name'] = str_replace('<', '', $_POST['last_name']);\r
  97 \r
  98         $_POST['login'] = strtolower($_POST['login']);\r
  99 \r
 100         //check date of birth\r
 101         $mo = intval($_POST['month']);\r
 102         $day = intval($_POST['day']);\r
 103         $yr = intval($_POST['year']);\r
 104 \r
 105         /* let's us take (one or) two digit years (ex. 78 = 1978, 3 = 2003) */\r
 106         if ($yr < date('y')) { \r
 107                 $yr += 2000; \r
 108         } else if ($yr < 1900) { \r
 109                 $yr += 1900; \r
 110         } \r
 111 \r
 112         $dob = $yr.'-'.$mo.'-'.$day;\r
 113 \r
 114         if ($mo && $day && $yr && !checkdate($mo, $day, $yr)) { \r
 115                 $msg->addError('DOB_INVALID');\r
 116         } else if (!$mo || !$day || !$yr) {\r
 117                 $dob = '0000-00-00';\r
 118                 $yr = $mo = $day = 0;\r
 119         }\r
 120 \r
 121         if ($missing_fields) {\r
 122                 $missing_fields = implode(', ', $missing_fields);\r
 123                 $msg->addError(array('EMPTY_FIELDS', $missing_fields));\r
 124         }\r
 125 \r
 126         if (!$msg->containsErrors()) {\r
 127                 if (($_POST['website']) && (!strstr($_POST['website'], '://'))) { \r
 128                         $_POST['website'] = 'http://' . $_POST['website']; \r
 129                 }\r
 130                 if ($_POST['website'] == 'http://') { \r
 131                         $_POST['website'] = ''; \r
 132                 }\r
 133                 $_POST['postal'] = strtoupper(trim($_POST['postal']));\r
 134         \r
 135                 if (isset($_POST['private_email'])) {\r
 136                         $_POST['private_email'] = 1;\r
 137                 } else {\r
 138                         $_POST['private_email'] = 0;\r
 139                 }\r
 140                 $_POST['password']   = $addslashes($_POST['password']);\r
 141                 $_POST['website']    = $addslashes($_POST['website']);\r
 142                 $_POST['first_name'] = $addslashes($_POST['first_name']);\r
 143                 $_POST['second_name']  = $addslashes($_POST['second_name']);\r
 144                 $_POST['last_name']  = $addslashes($_POST['last_name']);\r
 145                 $_POST['address']    = $addslashes($_POST['address']);\r
 146                 $_POST['postal']     = $addslashes($_POST['postal']);\r
 147                 $_POST['city']       = $addslashes($_POST['city']);\r
 148                 $_POST['province']   = $addslashes($_POST['province']);\r
 149                 $_POST['country']    = $addslashes($_POST['country']);\r
 150                 $_POST['phone']      = $addslashes($_POST['phone']);\r
 151                 $_POST['status']     = intval($_POST['status']);\r
 152                 $_POST['gender']     = $addslashes($_POST['gender']);\r
 153 \r
 154                 $now = date('Y-m-d H:i:s'); // we use this later for the email confirmation.\r
 155 \r
 156                 /* insert into the db. (the last 0 for status) */\r
 157                 $sql = "INSERT INTO ".TABLE_PREFIX."members VALUES (NULL,'$_POST[login]','$_POST[password]','$_POST[email]','$_POST[website]','$_POST[first_name]', '$_POST[second_name]', '$_POST[last_name]', '$dob', '$_POST[gender]', '$_POST[address]','$_POST[postal]','$_POST[city]','$_POST[province]','$_POST[country]', '$_POST[phone]',$_POST[status], '$_config[pref_defaults]', '$now','$_config[default_language]', $_config[pref_inbox_notify], $_POST[private_email], '0000-00-00 00:00:00')";\r
 158 \r
 159                 $result = mysql_query($sql, $db);\r
 160 \r
 161                 $m_id   = mysql_insert_id($db);\r
 162                 if (!$result) {\r
 163                         require(AT_INCLUDE_PATH.'header.inc.php');\r
 164                         $msg->addError('DB_NOT_UPDATED');\r
 165                         $msg->printAll();\r
 166                         require(AT_INCLUDE_PATH.'footer.inc.php');\r
 167                         exit;\r
 168                 }\r
 169 \r
 170                 if (defined('AT_MASTER_LIST') && AT_MASTER_LIST) {\r
 171                         $student_id  = $addslashes($_POST['student_id']);\r
 172                         $student_pin = md5($addslashes($_POST['student_pin']));\r
 173                         if ($student_id) {\r
 174                                 $sql = "UPDATE ".TABLE_PREFIX."master_list SET member_id=$m_id WHERE public_field='$student_id'";\r
 175                                 mysql_query($sql, $db);\r
 176                                 if (mysql_affected_rows($db) == 0) {\r
 177                                         $sql = "REPLACE INTO ".TABLE_PREFIX."master_list VALUES ('$student_id', '$student_pin', $m_id)";\r
 178                                         mysql_query($sql, $db);\r
 179                                 }\r
 180                         }\r
 181                 }\r
 182 \r
 183 \r
 184                 if ($_POST['pref'] == 'access') {\r
 185                         $_SESSION['member_id'] = $m_id;\r
 186                         save_prefs();\r
 187                         unset($_SESSION['member_id']);\r
 188                 }\r
 189 \r
 190 \r
 191                 require(AT_INCLUDE_PATH . 'classes/phpmailer/atutormailer.class.php');\r
 192                 $mail = new ATutorMailer();\r
 193                 $mail->AddAddress($_POST['email']);\r
 194                 $mail->From    = $_config['contact_email'];\r
 195                 \r
 196                 if (defined('AT_EMAIL_CONFIRMATION') && AT_EMAIL_CONFIRMATION && ($_POST['status'] == AT_STATUS_UNCONFIRMED)) {\r
 197                         $code = substr(md5($_POST['email'] . $now . $m_id), 0, 10);\r
 198                         $confirmation_link = AT_BASE_HREF . 'confirm.php?id='.$m_id.SEP.'m='.$code;\r
 199 \r
 200                         /* send the email confirmation message: */\r
 201                         $mail->Subject = $_config['site_name'] . ': ' . _AT('email_confirmation_subject');\r
 202                         $body .= _AT('admin_new_account_confirm', $_config['site_name'], $confirmation_link)."\n\n";\r
 203 \r
 204                 } else {\r
 205                         $mail->Subject = $_config['site_name'].": "._AT('account_information');\r
 206                         $body .= _AT('admin_new_account', $_config['site_name'])."\n\n";\r
 207                 }\r
 208                 $body .= _AT('web_site') .' : '.AT_BASE_HREF."\n";\r
 209                 $body .= _AT('login_name') .' : '.$_POST['login'] . "\n";\r
 210 //              $body .= _AT('password') .' : '.$_POST['password'] . "\n";\r
 211                 $mail->Body    = $body;\r
 212                 $mail->Send();\r
 213 \r
 214                 $msg->addFeedback('PROFILE_CREATED_ADMIN');\r
 215                 header('Location: '.AT_BASE_HREF.'mods/_core/users/users.php');\r
 216                 exit;\r
 217         }\r
 218 }\r
 219 \r
 220 $onload = 'document.form.login.focus();';\r
 221 \r
 222 $savant->assign('languageManager', $languageManager);\r
 223 $savant->assign('no_captcha', true);\r
 224 \r
 225 if (!isset($_POST['status'])) {\r
 226         if (defined('AT_EMAIL_CONFIRMATION') && AT_EMAIL_CONFIRMATION) {\r
 227                 $_POST['status'] = AT_STATUS_UNCONFIRMED;\r
 228         } else {\r
 229                 $_POST['status'] = AT_STATUS_STUDENT;\r
 230         }\r
 231 }\r
 232 \r
 233 $savant->display('registration.tmpl.php');\r
 234 \r
 235 ?>