mods/_core/users/edit_user.php

   1 <?php\r
   2 /************************************************************************/\r
   3 /* ATutor                                                                                                                               */\r
   4 /************************************************************************/\r
   5 /* Copyright (c) 2002-2010                                              */\r
   6 /* Inclusive Design Institute                                           */\r
   7 /* http://atutor.ca                                                                                                             */\r
   8 /*                                                                                                                                              */\r
   9 /* This program is free software. You can redistribute it and/or        */\r
  10 /* modify it under the terms of the GNU General Public License          */\r
  11 /* as published by the Free Software Foundation.                        */\r
  12 /************************************************************************/\r
  13 // $Id: edit_user.php 8901 2009-11-11 19:10:19Z cindy $\r
  14 \r
  15 define('AT_INCLUDE_PATH', '../../../include/');\r
  16 require(AT_INCLUDE_PATH.'vitals.inc.php');\r
  17 admin_authenticate(AT_ADMIN_PRIV_USERS);\r
  18 \r
  19 if (isset($_POST['cancel'])) {\r
  20         if (isset($_POST['ml']) && $_REQUEST['ml']) {\r
  21                 header('Location: '.AT_BASE_HREF.'mods/_core/users/master_list.php');\r
  22         } else {\r
  23                 header('Location: '.AT_BASE_HREF.'mods/_core/users/users.php');\r
  24         }\r
  25         exit;\r
  26 }\r
  27 \r
  28 if (isset($_POST['submit'])) {\r
  29         $missing_fields = array();\r
  30 \r
  31         $id = intval($_POST['id']);\r
  32 \r
  33         //check if student id (public field) is already being used\r
  34         if (!$_POST['overwrite'] && !empty($_POST['student_id'])) {\r
  35                 $result = mysql_query("SELECT public_field FROM ".TABLE_PREFIX."master_list WHERE public_field='$_POST[student_id]' AND member_id<>0 AND member_id<>$id",$db);\r
  36                 if (mysql_num_rows($result) != 0) {\r
  37                         $msg->addError('CREATE_MASTER_USED');\r
  38                 }\r
  39         }\r
  40 \r
  41         /* email check */\r
  42         if ($_POST['email'] == '') {\r
  43                 $missing_fields[] = _AT('email');\r
  44         } else if (!preg_match("/^[a-z0-9\._-]+@+[a-z0-9\._-]+\.+[a-z]{2,6}$/i", $_POST['email'])) {\r
  45                 $msg->addError('EMAIL_INVALID');\r
  46         }\r
  47         $result = mysql_query("SELECT * FROM ".TABLE_PREFIX."members WHERE email LIKE '$_POST[email]' AND member_id <> $id",$db);\r
  48 \r
  49         if (mysql_num_rows($result) != 0) {\r
  50                 $valid = 'no';\r
  51                 $msg->addError('EMAIL_EXISTS');\r
  52         }\r
  53 \r
  54         if (!$_POST['first_name']) { \r
  55                 $missing_fields[] = _AT('first_name');\r
  56         }\r
  57 \r
  58         if (!$_POST['last_name']) { \r
  59                 $missing_fields[] = _AT('last_name');\r
  60         }\r
  61 \r
  62         $_POST['first_name'] = str_replace('<', '', $_POST['first_name']);\r
  63         $_POST['second_name'] = str_replace('<', '', $_POST['second_name']);\r
  64         $_POST['last_name'] = str_replace('<', '', $_POST['last_name']);\r
  65 \r
  66         // check if first+last is unique\r
  67         /*\r
  68          * http://www.atutor.ca/atutor/mantis/view.php?id=3760\r
  69         if ($_POST['first_name'] && $_POST['last_name']) {\r
  70                 $first_name_sql  = $addslashes($_POST['first_name']);\r
  71                 $last_name_sql   = $addslashes($_POST['last_name']);\r
  72                 $second_name_sql = $addslashes($_POST['second_name']);\r
  73 \r
  74                 $sql = "SELECT member_id FROM ".TABLE_PREFIX."members WHERE first_name='$first_name_sql' AND second_name='$second_name_sql' AND last_name='$last_name_sql' AND member_id<>$id LIMIT 1";\r
  75                 $result = mysql_query($sql, $db);\r
  76                 if (mysql_fetch_assoc($result)) {\r
  77                         $msg->addError('FIRST_LAST_NAME_UNIQUE');\r
  78                 }\r
  79         }\r
  80         */\r
  81 \r
  82         \r
  83         //check date of birth\r
  84         $mo = intval($_POST['month']);\r
  85         $day = intval($_POST['day']);\r
  86         $yr = intval($_POST['year']);\r
  87 \r
  88         /* let's us take (one or) two digit years (ex. 78 = 1978, 3 = 2003) */\r
  89         if ($yr < date('y')) { \r
  90                 $yr += 2000; \r
  91         } else if ($yr < 1900) { \r
  92                 $yr += 1900; \r
  93         } \r
  94 \r
  95         $dob = $yr.'-'.$mo.'-'.$day;\r
  96 \r
  97         if ($mo && $day && $yr && !checkdate($mo, $day, $yr)) { \r
  98                 $msg->addError('DOB_INVALID');\r
  99         } else if (!$mo || !$day || !$yr) {\r
 100                 $dob = '0000-00-00';\r
 101                 $yr = $mo = $day = 0;\r
 102         }\r
 103 \r
 104 \r
 105         if ($missing_fields) {\r
 106                 $missing_fields = implode(', ', $missing_fields);\r
 107                 $msg->addError(array('EMPTY_FIELDS', $missing_fields));\r
 108         }\r
 109 \r
 110         if (!$msg->containsErrors()) {\r
 111                 if (isset($_POST['profile_pic_delete'])) {\r
 112                         profile_image_delete($id);\r
 113                 }\r
 114                 if (($_POST['website']) && (!strstr($_POST['website'], "://"))) { \r
 115                         $_POST['website'] = "http://".$_POST['website']; \r
 116                 }\r
 117                 if ($_POST['website'] == 'http://') { \r
 118                         $_POST['website'] = ''; \r
 119                 }\r
 120                 $_POST['postal'] = strtoupper(trim($_POST['postal']));\r
 121 \r
 122                 if (isset($_POST['private_email'])) {\r
 123                         $_POST['private_email'] = 1;\r
 124                 } else {\r
 125                         $_POST['private_email'] = 0;\r
 126                 }\r
 127 \r
 128                 //$_POST['password']   = $addslashes($_POST['password']);\r
 129                 $_POST['website']    = $addslashes($_POST['website']);\r
 130                 $_POST['first_name'] = $addslashes($_POST['first_name']);\r
 131                 $_POST['second_name'] = $addslashes($_POST['second_name']);\r
 132                 $_POST['last_name']  = $addslashes($_POST['last_name']);\r
 133                 $_POST['address']    = $addslashes($_POST['address']);\r
 134                 $_POST['postal']     = $addslashes($_POST['postal']);\r
 135                 $_POST['city']       = $addslashes($_POST['city']);\r
 136                 $_POST['province']   = $addslashes($_POST['province']);\r
 137                 $_POST['country']    = $addslashes($_POST['country']);\r
 138                 $_POST['phone']      = $addslashes($_POST['phone']);\r
 139                 $_POST['status']     = intval($_POST['status']);\r
 140                 $_POST['old_status']     = intval($_POST['old_status']);\r
 141                 $_POST['gender']     = $addslashes($_POST['gender']);\r
 142 \r
 143                 /* insert into the db. (the last 0 for status) */\r
 144                 $sql = "UPDATE ".TABLE_PREFIX."members SET      email      = '$_POST[email]',\r
 145                                                                                                         website    = '$_POST[website]',\r
 146                                                                                                         first_name = '$_POST[first_name]',\r
 147                                                                                                         second_name= '$_POST[second_name]',\r
 148                                                                                                         last_name  = '$_POST[last_name]', \r
 149                                                                                                         dob      = '$dob',\r
 150                                                                                                         gender   = '$_POST[gender]', \r
 151                                                                                                         address  = '$_POST[address]',\r
 152                                                                                                         postal   = '$_POST[postal]',\r
 153                                                                                                         city     = '$_POST[city]',\r
 154                                                                                                         province = '$_POST[province]',\r
 155                                                                                                         country  = '$_POST[country]', \r
 156                                                                                                         phone    = '$_POST[phone]',\r
 157                                                                                                         status   = $_POST[status],\r
 158                                                                                                         language = '$_SESSION[lang]', \r
 159                                                                                                         private_email = $_POST[private_email],\r
 160                                                                                                         creation_date=creation_date,\r
 161                                                                                                         last_login=last_login\r
 162                                 WHERE member_id = $id";\r
 163                 $result = mysql_query($sql, $db);\r
 164                 if (!$result) {\r
 165                         require(AT_INCLUDE_PATH.'header.inc.php');\r
 166                         $msg->addError('DB_NOT_UPDATED');\r
 167                         $msg->printAll();\r
 168                         require(AT_INCLUDE_PATH.'footer.inc.php');\r
 169                         exit;\r
 170                 }\r
 171 \r
 172 \r
 173                 if (defined('AT_MASTER_LIST') && AT_MASTER_LIST) {\r
 174                         $_POST['student_id'] = $addslashes($_POST['student_id']);\r
 175                         $student_pin = sha1($addslashes($_POST['student_pin']));\r
 176 \r
 177                         //if changed, delete old stud id\r
 178                         if (!empty($_POST['old_student_id']) && $_POST['old_student_id'] != $_POST['student_id']) {\r
 179                                 $sql = "DELETE FROM ".TABLE_PREFIX."master_list WHERE public_field=".$_POST['old_student_id']." AND member_id=$id";\r
 180                                 $result = mysql_query($sql, $db);\r
 181                         }\r
 182                         //if new is set\r
 183                         if (!empty($_POST['student_id']) && $_POST['old_student_id'] != $_POST['student_id']) {\r
 184                                 $sql = "REPLACE INTO ".TABLE_PREFIX."master_list VALUES ('$_POST[student_id]', '', $id)";\r
 185                                 $result = mysql_query($sql, $db);\r
 186                         }\r
 187                 }\r
 188 \r
 189 \r
 190                 if (defined('AT_EMAIL_CONFIRMATION') && AT_EMAIL_CONFIRMATION && ($_POST['status'] == AT_STATUS_UNCONFIRMED) && ($_POST['old_status'] != AT_STATUS_UNCONFIRMED)) {\r
 191 \r
 192                         $sql    = "SELECT email, creation_date FROM ".TABLE_PREFIX."members WHERE member_id=$id";\r
 193                         $result = mysql_query($sql, $db);\r
 194                         $row    = mysql_fetch_assoc($result);\r
 195 \r
 196                         $code = substr(md5($row['email'] . $row['creation_date']. $id), 0, 10);\r
 197                         $confirmation_link = AT_BASE_HREF . 'confirm.php?id='.$id.SEP.'m='.$code;\r
 198 \r
 199                         /* send the email confirmation message: */\r
 200                         require(AT_INCLUDE_PATH . 'classes/phpmailer/atutormailer.class.php');\r
 201                         $mail = new ATutorMailer();\r
 202 \r
 203                         $mail->AddAddress($row['email']);\r
 204                         $mail->From    = $_config['contact_email'];\r
 205                         $mail->Subject = $_config['site_name'] . ' - ' . _AT('email_confirmation_subject');\r
 206                         $mail->Body    = _AT('email_confirmation_message', $_config['site_name'], $confirmation_link);\r
 207 \r
 208                         $mail->Send();\r
 209                 }\r
 210 \r
 211                 $msg->addFeedback('PROFILE_UPDATED_ADMIN');\r
 212                 if (isset($_POST['ml']) && $_REQUEST['ml']) {\r
 213                         header('Location: '.AT_BASE_HREF.'mods/_core/users/master_list.php');\r
 214                 } else {\r
 215                         header('Location: '.AT_BASE_HREF.'mods/_core/users/users.php');\r
 216                 }\r
 217                 exit;\r
 218         }\r
 219 }\r
 220 \r
 221 $id = intval($_REQUEST['id']);\r
 222 \r
 223 if (empty($_POST)) {\r
 224         $sql    = "SELECT * FROM ".TABLE_PREFIX."members WHERE member_id = $id";\r
 225         $result = mysql_query($sql, $db);\r
 226         if (!($row = mysql_fetch_assoc($result))) {\r
 227                 require(AT_INCLUDE_PATH.'header.inc.php');      \r
 228                 $msg->addError('USER_NOT_FOUND');       \r
 229                 $msg->printAll();\r
 230                 require(AT_INCLUDE_PATH.'footer.inc.php'); \r
 231                 exit;\r
 232         }\r
 233         \r
 234         $_POST  = $row;\r
 235         list($_POST['year'],$_POST['month'],$_POST['day']) = explode('-', $row['dob']);\r
 236         //$_POST['password2']  = $_POST['password'];\r
 237         $_POST['old_status'] = $_POST['status'];\r
 238 \r
 239         if (admin_authenticate(AT_ADMIN_PRIV_USERS, TRUE) && defined('AT_MASTER_LIST') && AT_MASTER_LIST) {\r
 240                 $sql    = "SELECT public_field FROM ".TABLE_PREFIX."master_list WHERE member_id=$id";\r
 241                 $result = mysql_query($sql, $db);\r
 242                 if ($row = mysql_fetch_assoc($result)) {\r
 243                         $_POST['old_student_id'] = $row['public_field'];\r
 244                         $_POST['student_id'] = $row['public_field'];\r
 245                 }\r
 246         }\r
 247 }\r
 248 \r
 249 $savant->assign('languageManager', $languageManager);\r
 250 \r
 251 if (isset($_REQUEST['ml']) && $_REQUEST['ml']) {\r
 252         // redirect back to the master list\r
 253         $savant->assign('ml', 1);\r
 254 } else {\r
 255         $savant->assign('ml', 0);\r
 256 }\r
 257 \r
 258 \r
 259 /* HAVE TO SEND MEMBER_ID THROUGH FORM AS A HIDDEN POST VARIABLE!!! */\r
 260 /* PUT IN IF LOOP THAT LETS YOU SEE STATUS RADIO BUTTONS */\r
 261 $savant->display('registration.tmpl.php');\r
 262 \r
 263 ?>