arman/science-ation
1
1
Fork 0
forked from science-ation/science-ation
Code Pull Requests Activity

- Fix login check for an expired password

Browse Source 
- Allow user_personal.php to handle committee members
- Add password field if the editer in user_personal has access_super
- Allow a committee member to edit anyone in user_personal.php
- Convert auth_required to user_auth_required, and check for both a user type
  and an access level (if committee)
- Convert the committee to the new user system (BIG change :)
- Remove the ^M from admin/committees.php
This commit is contained in:
dave 2007-11-17 21:59:59 +00:00
parent 1d7f5f9871
commit 2715d67aef
18 changed files with 964 additions and 601 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

849
admin/committees.php
View File

@ -1,500 +1,349 @@
<? <?
/* /*
This file is part of the 'Science Fair In A Box' project This file is part of the 'Science Fair In A Box' project
SFIAB Website: http://www.sfiab.ca SFIAB Website: http://www.sfiab.ca
Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org> Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
Copyright (C) 2005 James Grant <james@lightbox.org> Copyright (C) 2005 James Grant <james@lightbox.org>
This program is free software; you can redistribute it and/or This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public modify it under the terms of the GNU General Public
License as published by the Free Software Foundation, version 2. License as published by the Free Software Foundation, version 2.
This program is distributed in the hope that it will be useful, This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details. General Public License for more details.
You should have received a copy of the GNU General Public License You should have received a copy of the GNU General Public License
along with this program; see the file COPYING. If not, write to along with this program; see the file COPYING. If not, write to
the Free Software Foundation, Inc., 59 Temple Place - Suite 330, the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
Boston, MA 02111-1307, USA. Boston, MA 02111-1307, USA.
*/ */
?> ?>
<? <?
require("../common.inc.php"); require_once("../common.inc.php");
auth_required('admin'); require_once("../committee.inc.php");
send_header("Administration - Committee Management"); user_auth_required('committee', 'admin');
echo "<a href=\"index.php\">&lt;&lt; ".i18n("Back to Administration")."</a>\n";
?> $users_id = intval($_POST['users_id']);
/* Some actions we want to redirect to the personal editor, so deal with those first */
<script type="text/javascript"> if($_POST['add_member'])
<!-- {
$u = user_create('committee');
function getElement(e,f) list($u['firstname'], $u['lastname']) = split(' ', $_POST['add_member']);
{ user_save($u);
if(document.layers) header("location: {$config['SFIABDIRECTORY']}/user_personal.php?edit={$u['id']}");
{ exit;
f=(f)?f:self; }
if(f.document.layers[e]) {
return f.document.layers[e]; if($_POST['action'] == 'edit') {
} header("location: {$config['SFIABDIRECTORY']}/user_personal.php?edit=$users_id");
for(W=0;i<f.document.layers.length;W++) { exit;
return(getElement(e,fdocument.layers[W])); }
}
} /* Now, start the output for this page */
if(document.all) { send_header("Committee Management",
return document.all[e]; array('Committee Main' => 'committee_main.php',
} 'Administration' => 'admin/index.php' ));
return document.getElementById(e);
} $_SESSION['last_page'] = 'committee_management';
?>
function actionChanged()
{ <script type="text/javascript">
if(document.forms.memberaction.action.selectedIndex==1) //assign <!--
{
getElement('assigndiv').style.display = 'block'; function getElement(e,f)
{
} if(document.layers)
else // edit or delete {
{ f=(f)?f:self;
getElement('assigndiv').style.display = 'none'; if(f.document.layers[e]) {
} return f.document.layers[e];
}
} for(W=0;i<f.document.layers.length;W++) {
return(getElement(e,fdocument.layers[W]));
function actionSubmit() }
{ }
if(document.forms.memberaction.action.selectedIndex==0) if(document.all) {
{ return document.all[e];
alert('You must choose an action'); }
return false; return document.getElementById(e);
} }
if(document.forms.memberaction.committees_members_id.selectedIndex==0)
{
alert('You must choose a member'); function actionChanged()
return false; {
} if(document.forms.memberaction.action.selectedIndex==1) //assign
{
if(document.forms.memberaction.action.selectedIndex==3) //remove getElement('assigndiv').style.display = 'block';
{
return confirmClick('Are you sure you want to completely remove this member?'); }
} else // edit or delete
return true; {
} getElement('assigndiv').style.display = 'none';
//--> }
</script>
<? }
if($_POST['addcommittee']) function actionSubmit()
{ {
//add a new committee if(document.forms.memberaction.action.selectedIndex==0)
mysql_query("INSERT INTO committees (name) VALUES ('".mysql_escape_string($_POST['addcommittee'])."')"); {
echo happy(i18n("Committee successfully added")); alert('You must choose an action');
} return false;
}
if($_POST['committees_id'] && $_POST['committees_ord']) if(document.forms.memberaction.users_id.selectedIndex==0)
{ {
//re-order the committees alert('You must choose a member');
$x=0; return false;
$ids=$_POST['committees_id']; }
$ords=$_POST['committees_ord'];
if(document.forms.memberaction.action.selectedIndex==3) //remove
while($ids[$x]) {
{ return confirmClick('Are you sure you want to completely remove this member?');
mysql_query("UPDATE committees SET ord='".$ords[$x]."' WHERE id='".$ids[$x]."'"); }
$x++; return true;
} }
echo happy(i18n("Committees successfully re-ordered")); //-->
</script>
} <?
if($_POST['action']=="assign")
{ if($_POST['addcommittee'])
if($_POST['committees_id'] && $_POST['committees_members_id']) {
{ //add a new committee
$q=mysql_query("SELECT * FROM committees_link WHERE committees_id='".$_POST['committees_id']."' AND committees_members_id='".$_POST['committees_members_id']."'"); mysql_query("INSERT INTO committees (name) VALUES ('".mysql_escape_string($_POST['addcommittee'])."')");
echo happy(i18n("Committee successfully added"));
if(!mysql_num_rows($q)) }
{
mysql_query("INSERT INTO committees_link (committees_id,committees_members_id) VALUES ('".$_POST['committees_id']."','".$_POST['committees_members_id']."')"); if($_POST['committees_id'] && $_POST['committees_ord'])
echo happy(i18n("Successfully added member to committee")); {
} //re-order the committees
else $x=0;
echo error(i18n("That member already exists in that committee")); $ids=$_POST['committees_id'];
} $ords=$_POST['committees_ord'];
else
echo error(("You must choose both a member and a committee")); while($ids[$x])
{
mysql_query("UPDATE committees SET ord='".$ords[$x]."' WHERE id='".$ids[$x]."'");
} $x++;
}
if($_GET['deletecommittee']) echo happy(i18n("Committees successfully re-ordered"));
{
mysql_query("DELETE FROM committees WHERE id='".$_GET['deletecommittee']."'"); }
echo happy(i18n("Committee removed"));
if($_POST['action']=="assign")
} {
if($_POST['committees_id'] && $_POST['users_id'])
if($_POST['action']=="remove") {
{ $cid = intval($_POST['committees_id']);
mysql_query("DELETE FROM committees_members WHERE id='".$_POST['committees_members_id']."'"); $q=mysql_query("SELECT * FROM committees_link WHERE committees_id='$cid' AND users_id='$users_id'");
mysql_query("DELETE FROM committees_link WHERE committees_members_id='".$_POST['committees_members_id']."'");
echo happy(i18n("Committee member removed")); if(!mysql_num_rows($q))
{
} mysql_query("INSERT INTO committees_link (committees_id,users_id) VALUES ('$cid','$users_id')");
echo happy(i18n("Successfully added member to committee"));
if($_GET['unlinkmember'] && $_GET['unlinkcommittee']) }
{ else
//unlink the member from the committee echo error(i18n("That member already exists in that committee"));
mysql_query("DELETE FROM committees_link WHERE committees_members_id='".$_GET['unlinkmember']."' AND committees_id='".$_GET['unlinkcommittee']."'"); }
echo happy(i18n("Committee member unlinked from committee")); else
echo error(("You must choose both a member and a committee"));
}
if($_POST['add_member_to_committees_id']) }
{
mysql_query("INSERT INTO committees_link (committees_id,committees_members_id) VALUES ('".$_POST['add_member_to_committees_id']."')"); if($_GET['deletecommittee'])
$edit=$_POST['committees_members_id']; {
} $del = intval($_GET['deletecommittee']);
mysql_query("DELETE FROM committees WHERE id='$del'");
if($_POST['add_member']) echo happy(i18n("Committee removed"));
{ }
mysql_query("INSERT INTO committees_members (name) VALUES ('".mysql_escape_string(stripslashes($_POST['add_member']))."')");
$edit=mysql_insert_id(); if($_POST['action']=="remove")
} {
user_delete($users_id, 'committee');
if($_POST['save']) mysql_query("DELETE FROM committees_link WHERE users_id='$users_id'");
{ echo happy(i18n("Committee member removed"));
if(auth_has_access("super")) }
{
//FIXME: deal with what the user can actually do based on their own permissions if($_GET['unlinkmember'] && $_GET['unlinkcommittee'])
if($_POST['access_admin']=="Y") $a_admin='Y'; else $a_admin='N'; {
if($_POST['access_config']=="Y") $a_config='Y'; else $a_config='N'; $mem = intval($_GET['unlinkmember']);
if($_POST['access_super']=="Y") $a_super='Y'; else $a_super='N'; $com = intval($_GET['unlinkcommittee']);
//unlink the member from the committee
$access="access_admin='$a_admin', access_config='$a_config', access_super='$a_super', "; mysql_query("DELETE FROM committees_link WHERE users_id='$mem' AND committees_id='$com'");
$pass="password='".mysql_escape_string(stripslashes($_POST['password']))."', "; echo happy(i18n("Committee member unlinked from committee"));
} }
else if(intval($_POST['save']) == $_SESSION['committee_member_id'])
{ /* This seems to be unused (there would also be an sql error on the INSERT :p) :
$access=""; if($_POST['add_member_to_committees_id'])
$pass="password='".mysql_escape_string(stripslashes($_POST['password']))."', "; {
} $add = intval($_POST['add_member_to_committees_id']);
else mysql_query("INSERT INTO committees_link (committees_id,users_id) VALUES ('$add')");
{ $edit=$_POST['committees_members_id'];
$access=""; }
$pass=""; */
}
//check for unique email address echo "<table>";
$q=mysql_query("SELECT id FROM committees_members WHERE (email='".$_POST['email']."' OR emailprivate='".$_POST['email']."') AND id!='".$_POST['save']."'"); echo "<tr><td>";
if(mysql_num_rows($q))
{ echo "<h4>".i18n("Add Committee")."</h4>\n";
$emailupdate=""; echo "<form method=\"post\"action=\"committees.php\">\n";
echo notice(i18n("Cannot update email address. That address already exists for a different committee member")); echo "<table>\n";
} echo "<tr><td>".i18n("Committee Name").": </td><td><input type=\"text\" size=\"15\" name=\"addcommittee\" /></td>";
else echo " <td><input type=\"submit\" value=\"".i18n("Add")."\" /></td></tr>\n";
$emailupdate="email='".mysql_escape_string(stripslashes($_POST['email']))."', "; echo "</table>\n";
echo "</form>\n";
$emailprivate = trim(mysql_escape_string(stripslashes($_POST['emailprivate'])));
if($emailprivate != '') { echo "</td><td width=\"40\">&nbsp;</td><td>";
$q=mysql_query("SELECT id FROM committees_members WHERE (email='$emailprivate' OR emailprivate='$emailprivate') AND id!='".$_POST['save']."'");
if(mysql_num_rows($q)) echo "<h4>".i18n("Add Committee Member")."</h4>\n";
{ echo "<form method=\"post\" action=\"committees.php\">\n";
$emailprivateupdate=""; echo "<table>\n";
echo notice(i18n("Cannot update private email address. That address already exists for a different committee member")); echo "<tr><td>".i18n("Member Name").": </td><td>";
} else { echo "<input type=\"text\" size=\"15\" name=\"add_member\" />\n";
$emailprivateupdate="emailprivate='$emailprivate', "; echo "</td>\n";
} echo " <td><input type=\"submit\" value=\"".i18n("Add")."\" /></td></tr>\n";
} else { echo "</table>\n";
$emailprivateupdate="emailprivate='$emailprivate', "; echo "</form>\n";
}
echo "</td></tr>";
mysql_query("UPDATE committees_members SET ". echo "</table>";
"name='".mysql_escape_string(stripslashes($_POST['name']))."', ".
$pass.
"organization='".mysql_escape_string(stripslashes($_POST['organization']))."', ". echo "<hr />";
$emailupdate. echo "<h4>".i18n("Committee Member Management")."</h4>\n";
$emailprivateupdate. echo "<form name=\"memberaction\" method=\"post\" action=\"committees.php\" onsubmit=\"return actionSubmit()\">\n";
"phonehome='".mysql_escape_string(stripslashes($_POST['phonehome']))."', ". echo "<table>";
"phonework='".mysql_escape_string(stripslashes($_POST['phonework']))."', ". echo "<tr><td>";
"phonecell='".mysql_escape_string(stripslashes($_POST['phonecell']))."', ". echo "<select name=\"action\" onchange=\"javascript:actionChanged()\">";
"fax='".mysql_escape_string(stripslashes($_POST['fax']))."', ". echo "<option value=\"\">".i18n("Choose")."</option>\n";
$access. echo "<option value=\"assign\">".i18n("Assign")."</option>\n";
" displayemail='".$_POST['displayemail']."' ". echo "<option value=\"edit\">".i18n("Edit")."</option>\n";
" WHERE id='".$_POST['save']."'"); echo "<option value=\"remove\">".i18n("Remove")."</option>\n";
echo "</select>";
if($_POST['ord'])
{ echo "</td><td>";
$keys=@array_keys($_POST['ord']); $q=mysql_query("SELECT * FROM users WHERE types LIKE '%committee%' ORDER BY firstname");
foreach ($keys AS $key) echo "<select name=\"users_id\">";
{ echo "<option value=\"\">".i18n("Select a Member")."</option>\n";
mysql_query("UPDATE committees_link SET title='".mysql_escape_string(stripslashes($_POST['titles'][$key]))."', ord='".$_POST['ord'][$key]."' WHERE committees_id='$key' AND committees_members_id='".$_POST['save']."'"); while($r=mysql_fetch_object($q))
echo mysql_error(); {
} $name = $r->firstname.' '.$r->lastname;
} echo "<option value=\"$r->id\">$name</option>\n";
}
echo "</select>";
/*
if($_FILES['picture']['error']==UPLOAD_ERR_OK) echo "</td><td>";
{
system("convert -sample 100 ".$_FILES['picture']['tmp_name']." ".$_SERVER['DOCUMENT_ROOT']."/board/".$_POST['save']."-thumb.jpg");
move_uploaded_file($_FILES['picture']['tmp_name'],$_SERVER['DOCUMENT_ROOT']."/board/".$_POST['save'].".jpg"); //The Assign Div
echo notice("Picture updated"); echo "<div id=\"assigndiv\">";
echo "<br>\n"; echo i18n("To Committee").": ";
} $q=mysql_query("SELECT * FROM committees ORDER BY ord,name");
*/ echo "<select name=\"committees_id\">";
echo "<option value=\"\">".i18n("Select a Committee")."</option>\n";
//print_r($config); while($r=mysql_fetch_object($q))
{
if($config['committees_executeonsave']) echo "<option value=\"$r->id\">$r->name</option>\n";
{ }
echo happy(i18n("Executing:").$config['committees_executeonsave']); echo "</select>";
system($config['committees_executeonsave']); echo "</div>";
}
echo happy(i18n("Committee member saved")); //The Edit or Remove Div
} echo "</td><td><input type=\"submit\" value=\"".i18n("Go")."\" /></td></tr>";
if($_POST['action']=="edit") echo "</table>";
{ echo "</form>";
$edit=$_POST['committees_members_id'];
} echo "<script language=\"javascript\" type=\"text/javascript\">actionChanged()</script>";
echo "<hr />";
if($_GET['edit'] || $edit)
{
if($_GET['edit']) $q=mysql_query("SELECT * FROM committees ORDER BY ord,name");
$e=$_GET['edit']; if(mysql_num_rows($q))
else {
$e=$edit; echo "<h4>".i18n("Committees")."</h4>";
$q=mysql_query("SELECT * FROM committees_members WHERE id='$e'"); echo "<form method=\"post\" action=\"committees.php\">\n";
$r=mysql_fetch_object($q); echo "<table>";
echo "<h4>".i18n("Edit Committee Member")."</h4>"; echo "<tr><td colspan=\"2\"></td><td><b>".i18n("Public Email / Private Email")."</b></td></tr>";
echo "<a href=\"committees.php\">&lt;&lt; ".i18n("Back to Committees Editor")."</a>\n"; while($r=mysql_fetch_object($q))
{
echo "<form action=\"committees.php\" method=\"post\">\n"; echo "<tr>";
echo "<input type=\"hidden\" name=\"save\" value=\"$e\" />\n"; echo "<td colspan=\"3\">";
echo "<input type=\"hidden\" name=\"committees_id[]\" value=\"$r->id\" />";
echo "<input size=\"2\" type=\"text\" name=\"committees_ord[]\" value=\"$r->ord\" />";
echo "<table>"; echo "&nbsp; <b>$r->name</b>";
echo "<tr><td>".i18n("Name").":</td><td><input size=\"25\" type=\"text\" name=\"name\" value=\"".htmlspecialchars($r->name)."\" /></td></tr>"; $q2=mysql_query("SELECT
users.id,
if(auth_has_access("super") || ($_SESSION['committee_member_id'] == intval($e))) users.firstname,users.lastname,
echo "<tr><td>".i18n("Password").":</td><td><input size=\"15\" type=\"text\" name=\"password\" value=\"$r->password\" /></td></tr>"; users.email,
users_committee.emailprivate,
$cq=mysql_query("SELECT committees.name, committees.id, committees_link.title, committees_link.ord FROM committees,committees_link WHERE committees_link.committees_id=committees.id AND committees_link.committees_members_id='$e' ORDER BY committees.name"); committees_link.title,
committees_link.ord
echo "<tr><td valign=\"top\">".i18n("Committees").":</td><td>"; FROM
if(mysql_num_rows($cq)) users, users_committee, committees_link
{ WHERE
echo "<table>"; users_committee.users_id=users.id
echo "<tr><th>".i18n("Committee")."</th><th>".i18n("Title in Committee")."</th><th>".i18n("Order")."</th></tr>"; AND committees_link.users_id=users.id
while($cr=mysql_fetch_object($cq)) AND committees_link.committees_id='$r->id'
{ ORDER BY
echo "<tr><td>$cr->name</td><td><input type=\"text\" name=\"titles[$cr->id]\" value=\"$cr->title\" /></td><td><input type=\"text\" name=\"ord[$cr->id]\" value=\"$cr->ord\" size=\"3\" /></td></tr>"; ord,firstname");
}
if(mysql_num_rows($q2)==0)
echo "</table>"; {
} echo "&nbsp; &nbsp;";
else echo "<a title=\"Remove Committee\" onclick=\"return confirmClick('Are you sure you want to remove this committee?');\" href=\"committees.php?deletecommittee=$r->id\"><img src=\"".$config['SFIABDIRECTORY']."/images/16/button_cancel.".$config['icon_extension']."\" border=\"0\" alt=\"Remove Committee\" /></a>";
echo "None"; }
echo "</td></tr>\n";
echo "<tr><td>".i18n("Organization").":</td><td><input size=\"25\" type=\"text\" name=\"organization\" value=\"$r->organization\" /></td></tr>\n"; echo "</td></tr>\n";
echo "<tr><td>".i18n("Email (Public)").":</td><td><input size=\"25\" type=\"text\" name=\"email\" value=\"$r->email\" /></td></tr>\n"; echo mysql_error();
echo "<tr><td>".i18n("Email (Private)").":</td><td><input size=\"25\" type=\"text\" name=\"emailprivate\" value=\"$r->emailprivate\" /></td></tr>\n"; while($r2=mysql_fetch_object($q2))
echo "<tr><td>".i18n("Display Emails").":</td><td>"; {
if($r->displayemail=="N") $checked="checked=\"checked\""; else $checked=""; echo "<tr><td align=\"right\">&nbsp;&nbsp;&nbsp;&nbsp;";
echo "<input type=\"radio\" name=\"displayemail\" value=\"N\" $checked />".i18n("No"); echo "<a title=\"Edit Member\" href=\"{$config['SFIABDIRECTORY']}/user_personal.php?edit={$r2->id}\"><img src=\"{$config['SFIABDIRECTORY']}/images/16/edit.{$config['icon_extension']}\" border=\"0\" alt=\"Edit\" /></a>";
echo "&nbsp; &nbsp; &nbsp;"; echo "&nbsp;";
if($r->displayemail=="Y") $checked="checked=\"checked\""; else $checked=""; echo "<a title=\"Unlink Member from Committee\" onclick=\"return confirmClick('Are you sure you want to unlink this member from this committee?');\" href=\"committees.php?unlinkmember=$r2->id&amp;unlinkcommittee={$r->id}\"><img src=\"{$config['SFIABDIRECTORY']}/images/16/undo.{$config['icon_extension']}\" border=\"0\" alt=\"Unlink\" /></a>";
echo "<input type=\"radio\" name=\"displayemail\" value=\"Y\" $checked />".i18n("Yes"); echo "</td>";
echo "<td valign=\"top\">";
echo "</td></tr>\n"; $name = $r2->firstname.' '.$r2->lastname;
echo "<tr><td>".i18n("Phone (Home)").":</td><td><input size=\"15\" type=\"text\" name=\"phonehome\" value=\"$r->phonehome\" /></td></tr>\n"; echo " <b>$name</b>";
echo "<tr><td>".i18n("Phone (Work)").":</td><td><input size=\"15\" type=\"text\" name=\"phonework\" value=\"$r->phonework\" /></td></tr>\n";
echo "<tr><td>".i18n("Phone (Cell)").":</td><td><input size=\"15\" type=\"text\" name=\"phonecell\" value=\"$r->phonecell\" /></td></tr>\n"; if($r2->title) echo " - $r2->title &nbsp; &nbsp;";
echo "<tr><td>".i18n("Fax").":</td><td><input size=\"15\" type=\"text\" name=\"fax\" value=\"$r->fax\" /></td></tr>\n";
echo "</td><td>";
if(auth_has_access("super"))
{ if($r2->email)
echo "<tr><td align=\"center\" colspan=\"2\"><hr /></td></tr>"; {
echo "<tr><td>".i18n("Access Controls").":</td><td>"; list($b,$a)=split("@",$r2->email);
if($r->access_admin=="Y") $checked="checked=\"checked\""; else $checked=""; echo "<script language=\"javascript\" type=\"text/javascript\">em('$b','$a')</script>";
echo "<input type=\"checkbox\" name=\"access_admin\" value=\"Y\" $checked /> ".i18n("Administration")."<br />"; }
if($r->access_config=="Y") $checked="checked=\"checked\""; else $checked="";
echo "<input type=\"checkbox\" name=\"access_config\" value=\"Y\" $checked /> ".i18n("Configuration")."<br />"; if($r2->emailprivate)
if($r->access_super=="Y") $checked="checked=\"checked\""; else $checked=""; {
echo "<input type=\"checkbox\" name=\"access_super\" value=\"Y\" $checked /> ".i18n("Superuser")."<br />"; if($r2->email) echo " <b>/</b> ";
list($b,$a)=split("@",$r2->emailprivate);
echo "</td></tr>"; echo "<script language=\"javascript\" type=\"text/javascript\">em('$b','$a')</script>";
} }
echo "</td></tr>\n";
echo "<tr><td align=\"center\" colspan=\"2\">"; }
echo "<br /><br />"; echo "<tr><td colspan=\"2\">&nbsp;</td></tr>\n";
echo "<input type=\"submit\" value=\"".i18n("Save Member")."\" />\n"; }
echo "</td></tr>\n"; echo "<tr><td colspan=\"2\"><input type=\"submit\" value=\"".i18n("Re-Order Committees")."\" /></td></tr>\n";
echo "</table>\n"; echo "</table>";
echo "</form>\n";
echo "</form>\n"; }
}
else send_footer();
{ ?>
echo "<table>";
echo "<tr><td>";
echo "<h4>".i18n("Add Committee")."</h4>\n";
echo "<form method=\"post\"action=\"committees.php\">\n";
echo "<table>\n";
echo "<tr><td>".i18n("Committee Name").": </td><td><input type=\"text\" size=\"15\" name=\"addcommittee\" /></td>";
echo " <td><input type=\"submit\" value=\"".i18n("Add")."\" /></td></tr>\n";
echo "</table>\n";
echo "</form>\n";
echo "</td><td width=\"40\">&nbsp;</td><td>";
echo "<h4>".i18n("Add Committee Member")."</h4>\n";
echo "<form method=\"post\" action=\"committees.php\">\n";
echo "<table>\n";
echo "<tr><td>".i18n("Member Name").": </td><td>";
echo "<input type=\"text\" size=\"15\" name=\"add_member\" />\n";
echo "</td>\n";
echo " <td><input type=\"submit\" value=\"".i18n("Add")."\" /></td></tr>\n";
echo "</table>\n";
echo "</form>\n";
echo "</td></tr>";
echo "</table>";
echo "<hr />";
echo "<h4>".i18n("Committee Member Management")."</h4>\n";
echo "<form name=\"memberaction\" method=\"post\" action=\"committees.php\" onsubmit=\"return actionSubmit()\">\n";
echo "<table>";
echo "<tr><td>";
echo "<select name=\"action\" onchange=\"javascript:actionChanged()\">";
echo "<option value=\"\">".i18n("Choose")."</option>\n";
echo "<option value=\"assign\">".i18n("Assign")."</option>\n";
echo "<option value=\"edit\">".i18n("Edit")."</option>\n";
echo "<option value=\"remove\">".i18n("Remove")."</option>\n";
echo "</select>";
echo "</td><td>";
$q=mysql_query("SELECT * FROM committees_members ORDER BY name");
echo "<select name=\"committees_members_id\">";
echo "<option value=\"\">".i18n("Select a Member")."</option>\n";
while($r=mysql_fetch_object($q))
{
echo "<option value=\"$r->id\">$r->name</option>\n";
}
echo "</select>";
echo "</td><td>";
//The Assign Div
echo "<div id=\"assigndiv\">";
echo i18n("To Committee").": ";
$q=mysql_query("SELECT * FROM committees ORDER BY ord,name");
echo "<select name=\"committees_id\">";
echo "<option value=\"\">".i18n("Select a Committee")."</option>\n";
while($r=mysql_fetch_object($q))
{
echo "<option value=\"$r->id\">$r->name</option>\n";
}
echo "</select>";
echo "</div>";
//The Edit or Remove Div
echo "</td><td><input type=\"submit\" value=\"".i18n("Go")."\" /></td></tr>";
echo "</table>";
echo "</form>";
echo "<script language=\"javascript\" type=\"text/javascript\">actionChanged()</script>";
echo "<hr />";
$q=mysql_query("SELECT * FROM committees ORDER BY ord,name");
if(mysql_num_rows($q))
{
echo "<h4>".i18n("Committees")."</h4>";
echo "<form method=\"post\" action=\"committees.php\">\n";
echo "<table>";
echo "<tr><td colspan=\"2\"></td><td><b>".i18n("Public Email / Private Email")."</b></td></tr>";
while($r=mysql_fetch_object($q))
{
echo "<tr>";
echo "<td colspan=\"3\">";
echo "<input type=\"hidden\" name=\"committees_id[]\" value=\"$r->id\" />";
echo "<input size=\"2\" type=\"text\" name=\"committees_ord[]\" value=\"$r->ord\" />";
echo "&nbsp; <b>$r->name</b>";
$q2=mysql_query("SELECT ".
"committees_members.id,".
"committees_members.name,".
"committees_members.email,".
"committees_members.emailprivate,".
"committees_link.title, ".
"committees_link.ord ".
"FROM committees_members, committees_link ".
"WHERE committees_link.committees_members_id=committees_members.id ".
" AND committees_link.committees_id='$r->id'".
" ORDER BY ord,name");
if(mysql_num_rows($q2)==0)
{
echo "&nbsp; &nbsp;";
echo "<a title=\"Remove Committee\" onclick=\"return confirmClick('Are you sure you want to remove this committee?');\" href=\"committees.php?deletecommittee=$r->id\"><img src=\"".$config['SFIABDIRECTORY']."/images/16/button_cancel.".$config['icon_extension']."\" border=\"0\" alt=\"Remove Committee\" /></a>";
}
echo "</td></tr>\n";
echo mysql_error();
while($r2=mysql_fetch_object($q2))
{
echo "<tr><td align=\"right\">&nbsp;&nbsp;&nbsp;&nbsp;";
echo "<a title=\"Edit Member\" href=\"committees.php?edit=$r2->id\"><img src=\"".$config['SFIABDIRECTORY']."/images/16/edit.".$config['icon_extension']."\" border=\"0\" alt=\"Edit\" /></a>";
echo "&nbsp;";
echo "<a title=\"Unlink Member from Committee\" onclick=\"return confirmClick('Are you sure you want to unlink this member from this committee?');\" href=\"committees.php?unlinkmember=$r2->id&amp;unlinkcommittee=$r->id\"><img src=\"".$config['SFIABDIRECTORY']."/images/16/undo.".$config['icon_extension']."\" border=\"0\" alt=\"Unlink\" /></a>";
echo "</td>";
echo "<td valign=\"top\">";
echo " <b>$r2->name</b>";
if($r2->title) echo " - $r2->title &nbsp; &nbsp;";
echo "</td><td>";
if($r2->email)
{
list($b,$a)=split("@",$r2->email);
echo "<script language=\"javascript\" type=\"text/javascript\">em('$b','$a')</script>";
}
if($r2->emailprivate)
{
if($r2->email) echo " <b>/</b> ";
list($b,$a)=split("@",$r2->emailprivate);
echo "<script language=\"javascript\" type=\"text/javascript\">em('$b','$a')</script>";
}
echo "</td></tr>\n";
}
echo "<tr><td colspan=\"2\">&nbsp;</td></tr>\n";
}
echo "<tr><td colspan=\"2\"><input type=\"submit\" value=\"".i18n("Re-Order Committees")."\" /></td></tr>\n";
echo "</table>";
echo "</form>\n";
}
}
send_footer();
?>

2
admin/communication.inc.php
View File

@ -1,7 +1,7 @@
<? <?
$mailqueries=array( $mailqueries=array(
"committee_all"=>array("name"=>"Committee Members (all)","query"=> "committee_all"=>array("name"=>"Committee Members (all)","query"=>
"SELECT name, organization, email FROM committees_members WHERE deleted='N'"), "SELECT firstname, lastname, organization, email FROM users WHERE types LIKE '%committee' AND deleted='no'"),
"judges_all"=>array("name"=>"Judges from all years","query"=> "judges_all"=>array("name"=>"Judges from all years","query"=>
"SELECT firstname, lastname, email FROM judges ORDER BY email"), "SELECT firstname, lastname, email FROM judges ORDER BY email"),

10
admin/index.php
View File

@ -22,9 +22,13 @@
*/ */
?> ?>
<? <?
require("../common.inc.php"); require_once("../common.inc.php");
auth_required('admin'); require_once("../committee.inc.php");
send_header("Administration");
user_auth_required('committee','admin');
send_header("Administration",
array('Committee Main' => 'committee_main.php') );
echo "<br />"; echo "<br />";
echo "<a href=\"registration.php\">".i18n("Participant Registration")."</a> <br />"; echo "<a href=\"registration.php\">".i18n("Participant Registration")."</a> <br />";

16
admin/reports_committees.inc.php
View File

@ -26,37 +26,37 @@ $report_committees_fields = array(
'name' => 'Committee -- Full Name ', 'name' => 'Committee -- Full Name ',
'header' => 'Name', 'header' => 'Name',
'width' => 1.75, 'width' => 1.75,
'table' => 'committees_members.name'), 'table' => "CONCAT(users.firstname, ' ', users.lastname)",
'email' => array( 'email' => array(
'name' => 'Committee -- Email', 'name' => 'Committee -- Email',
'header' => 'Email', 'header' => 'Email',
'width' => 2.0, 'width' => 2.0,
'table' => 'committees_members.email'), 'table' => 'users.email'),
'phone_home' => array( 'phone_home' => array(
'name' => 'Committees -- Phone (Home)', 'name' => 'Committees -- Phone (Home)',
'header' => 'Phone(Home)', 'header' => 'Phone(Home)',
'width' => 1, 'width' => 1,
'table' => 'committees_members.phonehome'), 'table' => 'users.phonehome'),
'phone_work' => array( 'phone_work' => array(
'name' => 'Committees -- Phone (Work)', 'name' => 'Committees -- Phone (Work)',
'header' => 'Phone(Work)', 'header' => 'Phone(Work)',
'width' => 1.25, 'width' => 1.25,
'table' => 'committees_members.phonework'), 'table' => 'users.phonework'),
'phone_cel' => array( 'phone_cel' => array(
'name' => 'Committees -- Phone (Cel)', 'name' => 'Committees -- Phone (Cel)',
'header' => 'Phone(Cel)', 'header' => 'Phone(Cel)',
'width' => 1, 'width' => 1,
'table' => 'committees_members.phonecel'), 'table' => 'users.phonecell'),
'organization' => array( 'organization' => array(
'name' => 'Committees -- Organization', 'name' => 'Committees -- Organization',
'header' => 'Organization', 'header' => 'Organization',
'width' => 2, 'width' => 2,
'table' => 'committees_members.organization'), 'table' => 'users.organization'),
'static_text' => array( 'static_text' => array(
'name' => 'Static Text (useful for labels)', 'name' => 'Static Text (useful for labels)',
@ -78,14 +78,14 @@ $report_committees_fields = array(
$teams_where = ''; $teams_where = '';
if(in_array('teams', $components)) { if(in_array('teams', $components)) {
$teams_from = ",committees_teams_link, committees_teams"; $teams_from = ",committees_teams_link, committees_teams";
$teams_where = "AND committees_teams_link.committees_id=committees_members.id $teams_where = "AND committees_teams_link.committees_id=users.id
AND committees_teams_link.year='$year' AND committees_teams_link.year='$year'
AND committees_teams.id=committees_teams_link.committees_teams_id AND committees_teams.id=committees_teams_link.committees_teams_id
AND committees_teams.year='$year'"; AND committees_teams.year='$year'";
} }
*/ */
$q = " FROM $q = " FROM
committees_members users
WHERE WHERE
1 1
"; ";

17
committee.inc.php Normal file
View File

@ -0,0 +1,17 @@
<?
require_once("user.inc.php");
function committee_auth_has_access($access="")
{
switch($access) {
case 'config': return ($_SESSION['access_config'] == 'yes') ? true : false;
case 'admin': return ($_SESSION['access_admin'] == 'yes') ? true : false;
case 'super': return ($_SESSION['access_super'] == 'yes') ? true : false;
}
return false;
}
?>

19
committee_auth.php
View File

@ -1,5 +1,21 @@
<? <?
require_once('committee.inc.php');
require_once('user.inc.php');
function auth_has_access($access="")
{
return committee_auth_has_access($access);
}
function auth_required($access="")
{
return user_auth_required('committee', $access);
}
/*
$accesscache=array(); $accesscache=array();
function auth_has_access($access="") function auth_has_access($access="")
@ -16,6 +32,8 @@ function auth_has_access($access="")
$q=mysql_query("SELECT access_admin, access_config, access_super FROM committees_members WHERE email='".mysql_escape_string($_SESSION['email'])."' AND id='".$_SESSION['committee_member_id']."' AND deleted='N'"); $q=mysql_query("SELECT access_admin, access_config, access_super FROM committees_members WHERE email='".mysql_escape_string($_SESSION['email'])."' AND id='".$_SESSION['committee_member_id']."' AND deleted='N'");
$r=mysql_fetch_object($q); $r=mysql_fetch_object($q);
echo mysql_error();
$accesscache['admin']=$r->access_admin; $accesscache['admin']=$r->access_admin;
$accesscache['config']=$r->access_config; $accesscache['config']=$r->access_config;
$accesscache['super']=$r->access_super; $accesscache['super']=$r->access_super;
@ -44,5 +62,6 @@ function auth_required($access="")
exit; exit;
} }
} }
*/
?> ?>

10
committee_login.php
View File

@ -11,20 +11,20 @@
$r=mysql_fetch_object($q); $r=mysql_fetch_object($q);
$_SESSION['email']=$r->email; $_SESSION['email']=$r->email;
$_SESSION['committee_member_id']=$r->id; $_SESSION['committee_member_id']=$r->id;
send_header("Committee Login"); send_header("Committee Login", array());
echo happy(i18n("Successfully logged in")); echo happy(i18n("Successfully logged in"));
echo i18n("Use the menu on the left to access the committee pages"); echo i18n("Use the menu on the left to access the committee pages");
} }
else else
{ {
send_header("Committee Login"); send_header("Committee Login", array());
echo error(i18n("Invalid Email/Password")); echo error(i18n("Invalid Email/Password"));
} }
} }
else else
{ {
send_header("Committee Login"); send_header("Committee Login", array());
echo error(i18n("Email/Password missing")); echo error(i18n("Email/Password missing"));
} }
} }
@ -32,13 +32,13 @@
{ {
unset($_SESSION['email']); unset($_SESSION['email']);
unset($_SESSION['committee_member_id']); unset($_SESSION['committee_member_id']);
send_header("Committee Login"); send_header("Committee Login", array());
echo notice(i18n("You have been successfully logged out")); echo notice(i18n("You have been successfully logged out"));
} }
else else
{ {
send_header("Committee Login"); send_header("Committee Login", array());
?> ?>
<form method="post" action="committee_login.php"> <form method="post" action="committee_login.php">

64
committee_main.php Normal file
View File

@ -0,0 +1,64 @@
<?
/*
This file is part of the 'Science Fair In A Box' project
SFIAB Website: http://www.sfiab.ca
Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
Copyright (C) 2005 James Grant <james@lightbox.org>
Copyright (C) 2007 David Grant <dave@lightbox.org>
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public
License as published by the Free Software Foundation, version 2.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; see the file COPYING. If not, write to
the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
Boston, MA 02111-1307, USA.
*/
?>
<?
require_once("common.inc.php");
require_once("user.inc.php");
require_once("user_page.inc.php");
user_auth_required('committee');
send_header("Committee Main", array());
switch($_GET['notice']) {
case 'password_changed':
echo happy(i18n('Your password has been successfully updated'));
break;
case 'already_logged_in':
echo error(i18n('You are already logged in, please use the [Logout] link in the upper right to logout'));
break;
case 'no_auth':
echo error(i18n('You do not have permission to view that page'));
break;
}
//only display the named greeting if we have their name
echo i18n("Hello <b>%1</b>",array($_SESSION['name']));
echo "<br />";
echo "<br />";
echo i18n('Things you can do').':<br />';
echo '<ul>';
echo '<li><a href="user_personal.php">'.i18n('Edit My Profile').'</a></li>';
if(committee_auth_has_access('admin')) {
echo '<li><a href="admin/">'.i18n('Administer the Fair').'</a></li>';
}
if(committee_auth_has_access('config')) {
echo '<li><a href="config/">'.i18n('Configure SFIAB').'</a></li>';
}
echo '<li><a href="user_password.php">'.i18n('Change My Password').'</a></li>';
echo '</ul>';
send_footer();
?>

38
committees.php
View File

@ -23,25 +23,28 @@
?> ?>
<? <?
require("common.inc.php"); require("common.inc.php");
send_header("Committee List"); send_header("Committee List", array());
echo "<table>"; echo "<table>";
$q=mysql_query("SELECT * FROM committees ORDER BY ord,name"); $q=mysql_query("SELECT * FROM committees ORDER BY ord,name");
while($r=mysql_fetch_object($q)) while($r=mysql_fetch_object($q))
{ {
$q2=mysql_query("SELECT ". $q2=mysql_query("SELECT
"committees_members.id,". users.id,
"committees_members.name,". users.firstname,users.lastname,
"committees_members.email,". users.email,
"committees_members.emailprivate,". users_committee.emailprivate,
"committees_members.displayemail,". users_committee.displayemail,
"committees_link.title, ". committees_link.title,
"committees_link.ord ". committees_link.ord
"FROM committees_members, committees_link ". FROM
"WHERE committees_link.committees_members_id=committees_members.id ". users, users_committee, committees_link
" AND committees_link.committees_id='$r->id'". WHERE
" ORDER BY ord,name"); users_committee.users_id=users.id
AND committees_link.users_id=users.id
AND committees_link.committees_id='$r->id'
ORDER BY
ord,firstname");
//if there's nobody in this committee, then just skip it and go on to the next one. //if there's nobody in this committee, then just skip it and go on to the next one.
if(mysql_num_rows($q2)==0) if(mysql_num_rows($q2)==0)
@ -56,11 +59,12 @@
{ {
$output=$config['committee_publiclayout']; $output=$config['committee_publiclayout'];
$output=str_replace("name",$r2->name,$output); $name=$r2->firstname.' '.$r2->lastname;
$output=str_replace("name",$name,$output);
$output=str_replace("title",$r2->title,$output); $output=str_replace("title",$r2->title,$output);
//make sure we do emailprivate before email so we dont match the wrong thing //make sure we do emailprivate before email so we dont match the wrong thing
if($r2->emailprivate && $r2->displayemail=='Y') if($r2->emailprivate && $r2->displayemail=='yes')
{ {
list($b,$a)=split("@",$r2->emailprivate); list($b,$a)=split("@",$r2->emailprivate);
$output=str_replace("emailprivate","<script language=\"javascript\" type=\"text/javascript\">em('$b','$a')</script>",$output); $output=str_replace("emailprivate","<script language=\"javascript\" type=\"text/javascript\">em('$b','$a')</script>",$output);
@ -68,7 +72,7 @@
else else
$output=str_replace("emailprivate","",$output); $output=str_replace("emailprivate","",$output);
if($r2->email && $r2->displayemail=='Y') if($r2->email && $r2->displayemail=='yes')
{ {
list($b,$a)=split("@",$r2->email); list($b,$a)=split("@",$r2->email);
$output=str_replace("email","<script language=\"javascript\" type=\"text/javascript\">em('$b','$a')</script>",$output); $output=str_replace("email","<script language=\"javascript\" type=\"text/javascript\">em('$b','$a')</script>",$output);

2
common.inc.php
View File

@ -515,7 +515,7 @@ if(auth_has_access("admin") || auth_has_access("config") || auth_has_access("sup
} }
else else
{ {
?><li><a href="<?=$config['SFIABDIRECTORY']?>/committee_login.php"><?=i18n("Committee Login")?></a></li><? ?><li><a href="<?=$config['SFIABDIRECTORY']?>/user_login.php?type=committee"><?=i18n("Committee Login")?></a></li><?
} }
?></ul> ?></ul>
<br /> <br />

2
db/db.code.version.txt
View File

@ -1 +1 @@
61 63

87
db/db.update.62.php Normal file
View File

@ -0,0 +1,87 @@
<?
/* This file may contain 2 functions, a db_update_pre() and a db_update_post()
* db_update_pre() is called before the SQL patch is applied, and as expected,
* db_update_post() is called after.
*
* These functions are called from the main db_update.php file, and included
* once, so any global variables declared in here WILL REMAIN across both
* calls. meaning you can pull some stuff out of the database in _pre(), and
* then the patch will be applied, and they it can be inserted back into the
* database in _post(). */
$committee = array();
function db_update_pre()
{
global $committee;
$q = mysql_query("SELECT * FROM committees_members");
while($r = mysql_fetch_assoc($q)) {
$committee[] = $r;
}
}
function db_update_post()
{
global $committee;
global $config;
foreach($committee as $c) {
list($fn, $ln) = split(' ', $c['name'], 2);
$username = $c['email'];
$fn = mysql_escape_string($fn);
$ln = mysql_escape_string($ln);
if($config['committee_password_expiry_days'] > 0) {
$passwordexpiry = "DATE_ADD(CURDATE(),
INTERVAL {$config['committee_password_expiry_days']} DAY)";
} else {
$passwordexpiry = "'0000-00-00'";
}
$deleted = ($c['deleted'] == 'Y') ? 'yes' : 'no';
$q = "INSERT INTO users
(`types`,`firstname`,`lastname`,`username`,`password`,`passwordexpiry`,
`email`,`phonehome`,`phonework`,`phonecell`,`fax`,`organization`,
`created`,`deleted`)
VALUES ('committee','$fn', '$ln', '$username',
'".mysql_escape_string($c['password'])."',
$passwordexpiry,
'{$c['email']}',
'{$c['phonehome']}',
'{$c['phonework']}',
'{$c['phonecell']}',
'{$c['fax']}',
'".mysql_escape_string($c['organization'])."',
NOW(),
'$deleted')";
mysql_query($q);
echo "$q\n";
$id = mysql_insert_id();
$access_admin = ($c['access_admin'] == 'Y') ? 'yes' : 'no';
$access_config = ($c['access_config'] == 'Y') ? 'yes' : 'no';
$access_super = ($c['access_super'] == 'Y') ? 'yes' : 'no';
$displayemail = ($c['displayemail'] == 'Y') ? 'yes' : 'no';
$q = "INSERT INTO users_committee(`users_id`,`emailprivate`,
`ord`,`displayemail`,`access_admin`,`access_config`,
`access_super`) VALUES (
'$id', '{$c['emailprivate']}',
'{$c['ord']}',
'$displayemail',
'$access_admin',
'$access_config',
'$access_super')";
mysql_query($q);
echo "$q\n";
echo mysql_error();
/* Update committee links */
$q = "UPDATE committees_link SET users_id='$id'
WHERE committees_members_id='{$c['id']}'";
mysql_query($q);
echo "$q\n";
}
}
?>

12
db/db.update.62.sql Normal file
View File

@ -0,0 +1,12 @@
ALTER TABLE `users_committee` CHANGE `displayemail` `displayemail` ENUM( 'no', 'yes' ) NOT NULL DEFAULT 'no',
CHANGE `access_admin` `access_admin` ENUM( 'no', 'yes' ) NOT NULL DEFAULT 'no',
CHANGE `access_config` `access_config` ENUM( 'no', 'yes' ) NOT NULL DEFAULT 'no',
CHANGE `access_super` `access_super` ENUM( 'no', 'yes' ) NOT NULL DEFAULT 'no';
ALTER TABLE `committees_link` ADD `users_id` INT NOT NULL AFTER `committees_members_id` ;
INSERT INTO `emails` ( `id` , `val` , `name` , `description` , `from` , `subject` , `body` , `type` )
VALUES (
'', 'committee_recover_password', 'Committee Members - Recover Password', 'Recover the password for a committee member if they submit a ''forgot password'' request', '', 'Committee Member for [FAIRNAME]', 'We have received a request for the recovery of your password from this email address. Please find your new password below:\n\nCommittee Member Email Address: [EMAIL]\nCommittee Member Password: [PASSWORD] ', 'system'
);

12
db/db.update.63.sql Normal file
View File

@ -0,0 +1,12 @@
ALTER TABLE `committees_link` DROP `committees_members_id` ;
DROP TABLE `committees_members` ;
ALTER TABLE `users` ADD `oldpassword` VARCHAR( 32 ) NOT NULL AFTER `passwordexpiry` ;

202
user.inc.php
View File

@ -31,7 +31,6 @@ $user_what = array('student'=>'Participant', 'judge' => 'Judge',
'committee'=>'Committee Member','volunteer' => 'Volunteer', 'committee'=>'Committee Member','volunteer' => 'Volunteer',
'region'=>'Region'); 'region'=>'Region');
function user_load_region($u) function user_load_region($u)
{ {
/* Double check, make sure the user is of this type */ /* Double check, make sure the user is of this type */
@ -72,14 +71,15 @@ function user_load_committee($u)
WHERE users_id='{$u['id']}'"); WHERE users_id='{$u['id']}'");
if(mysql_num_rows($q)!=1) return false; if(mysql_num_rows($q)!=1) return false;
$r = mysel_fetch_object($q); $r = mysql_fetch_object($q);
$ret = array(); $ret = array();
$ret['emailprivate'] = $r->emailprivate; $ret['emailprivate'] = $r->emailprivate;
$ret['ord'] = intval($r->ord); $ret['ord'] = intval($r->ord);
$ret['displayemail'] = ($r->displayemail == 'Y') ? 'Y' : 'N'; $ret['displayemail'] = ($r->displayemail == 'yes') ? 'yes' : 'no';
$ret['access_admin'] = ($r->access_admin == 'Y') ? 'Y' : 'N'; $ret['access_admin'] = ($r->access_admin == 'yes') ? 'yes' : 'no';
$ret['access_config'] = ($r->access_config == 'Y') ? 'Y' : 'N'; $ret['access_config'] = ($r->access_config == 'yes') ? 'yes' : 'no';
$ret['access_super'] = ($r->access_super == 'Y') ? 'Y' : 'N'; $ret['access_super'] = ($r->access_super == 'yes') ? 'yes' : 'no';
return $ret; return $ret;
} }
@ -91,7 +91,7 @@ function user_load_volunteer($u)
return $ret; return $ret;
} }
function user_load($user, $load_full=false, $force_type=false) function user_load($user, $load_full=false)
{ {
$id = 0; $id = 0;
@ -136,13 +136,6 @@ function user_load($user, $load_full=false, $force_type=false)
/* Turn the type into an array, because there could be more than one */ /* Turn the type into an array, because there could be more than one */
$ts = explode(',', $ret['types']); $ts = explode(',', $ret['types']);
$ret['types'] = $ts; /* Now we can use in_array($ret['type'], 'judge') ; */ $ret['types'] = $ts; /* Now we can use in_array($ret['type'], 'judge') ; */
/* Set the current type if there's only one */
if(count($ret['types']) == 1) {
$ret['type'] = $ret['types'][0];
} else {
$ret['type'] = false;
}
} else { } else {
$ret = $user; $ret = $user;
} }
@ -150,16 +143,17 @@ function user_load($user, $load_full=false, $force_type=false)
if($load_full) { if($load_full) {
$r = true; $r = true;
foreach($ret['types'] as $t) { foreach($ret['types'] as $t) {
if($ret['load_full'] == true) continue;
/* These all pass $ret by reference, and can modify /* These all pass $ret by reference, and can modify
* $ret */ * $ret */
$r = call_user_func("user_load_$type", $ret); $r = call_user_func("user_load_$t", $ret);
if($r == false) return false; if(!is_array($r)) return false;
/* It is important that each type database doesn't /* It is important that each type database doesn't
have conflicting column names */ have conflicting column names */
foreach($r as $k->$v) { foreach($r as $k=>$v) {
if(array_key_exists($k, $ret)) { if(array_key_exists($k, $ret)) {
echo "DATABSE DESIGN ERROR, duplicate user key $k"; echo "DATABASE DESIGN ERROR, duplicate user key $k";
exit; exit;
} }
} }
@ -171,13 +165,57 @@ function user_load($user, $load_full=false, $force_type=false)
} }
/* Do this assignment without recursion :) */ /* Do this assignment without recursion :) */
unset($ret['orig']);
$orig = $ret; $orig = $ret;
$ret['orig'] = $orig; $ret['orig'] = $orig;
// echo "<pre>User load returning:\n";
// print_r($ret);
// echo "</pre>";
return $ret; return $ret;
} }
function user_save_volunteer($u)
{
}
function user_save_committee($u)
{
$fields = array('emailprivate','ord','displayemail','access_admin',
'access_config','access_super');
//echo "<pre>";
// print_r($u);
// echo "</pre>";
$set = '';
foreach($fields as $f) {
if($u[$f] == $u['orig'][$f]) continue;
if($set != '') $set .=',';
$data = mysql_escape_string(stripslashes($u[$f]));
$set .= "$f='$data'";
}
if($set != "") {
$query = "UPDATE users_committee SET $set WHERE users_id='{$u['id']}'";
mysql_query($query);
}
}
function user_save_judge($u)
{
}
function user_save_student($u)
{
}
function user_save_region($u)
{
}
function user_save($u) function user_save($u)
{ {
$fields = array('firstname','lastname','username','password', $fields = array('firstname','lastname','username','password',
@ -206,6 +244,92 @@ function user_save($u)
// echo "query=[$query]"; // echo "query=[$query]";
echo mysql_error(); echo mysql_error();
} }
/* If this was a full load, do a full save */
if($u['load_full'] == true) {
foreach($u['types'] as $t) {
call_user_func("user_save_$t", $u);
}
}
}
function user_delete_committee($u)
{
mysql_query("DELETE FROM users_committee WHERE users_id='{$u['id']}'");
mysql_query("DELETE FROM committees_link WHERE users_id='{$u['id']}'");
}
function user_delete_volunteer($u)
{
}
function user_delete_judge($u)
{
}
function user_delete_region($u)
{
}
function user_delete_student($u)
{
}
function user_delete($u, $type=false)
{
$finish_delete = false;
if(!is_array($u)) {
$u = user_load($u);
}
if($type != false) {
if(!in_array($type, $u['types'])) {
/* Hum, type specified, but the user is not this type,
* so, i guess we're done. */
return;
}
if(count($u['types']) > 1) {
/* Don't delete the whole user */
$types='';
foreach($u['types'] as $t) {
if($t == $type) continue;
if($types != '') $types .= ',';
$types .= $t;
}
mysql_query("UPDATE users SET types='$types' WHERE id='{$u['id']}'");
} else {
$finish_delete = true;
}
call_user_func("user_delete_$type", $u);
} else {
/* Delete the whole user */
foreach($u['types'] as $t) call_user_func("user_delete_$t", $u);
$finish_delete = true;
}
if($finish_delete == true) {
mysql_query("DELETE FROM users WHERE id='{$u['id']}'");
}
}
function user_create($type)
{
mysql_query("INSERT INTO users (`types`,`created`) VALUES ('$type', NOW())");
$uid = mysql_insert_id();
switch($type) {
case 'volunteer':
case 'student':
case 'judge':
case 'region':
break;
case 'committee':
mysql_query("INSERT INTO users_committee(`users_id`) VALUES ('$uid')");
break;
}
return user_load($uid, true);
} }
@ -235,7 +359,7 @@ function user_valid_password($pass)
/* Perform some checks. Make sure the person is logged in, and that their /* Perform some checks. Make sure the person is logged in, and that their
* password hasn't expired (the password_expired var is set in the login page) * password hasn't expired (the password_expired var is set in the login page)
*/ */
function user_auth_required($type, $check_expiry=true) function user_auth_required($type, $access='')
{ {
if(!isset($_SESSION['users_type'])) { if(!isset($_SESSION['users_type'])) {
header("location: user_login.php?type=$type&notice=auth_required"); header("location: user_login.php?type=$type&notice=auth_required");
@ -247,10 +371,22 @@ function user_auth_required($type, $check_expiry=true)
exit; exit;
} }
if($_SESSION['password_expired'] == true && $check_expiry==true) { if($_SESSION['password_expired'] == true) {
header("location: user_password.php"); header("location: user_password.php");
exit; exit;
} }
if($access != '') {
if($type != 'committee') {
echo "CRITICAL ERROR, cannot check access in user_auth_required without specifying type=committee";
exit;
}
if(committee_auth_has_access($access) == false) {
header("Location: ".$config['SFIABDIRECTORY']."/committee_main.php?notice=no_auth");
exit;
}
}
return true; return true;
} }
@ -280,17 +416,21 @@ function user_personal_fields($type)
switch($type) { switch($type) {
case 'volunteer': case 'volunteer':
$f = array(); $f = array();
break;
case 'committee': case 'committee':
$f = array('workphone','fax'); $f = array('phonework','fax');
break;
case 'judge': case 'judge':
$f = array(); $f = array();
break;
case 'student': case 'student':
$f = array(); $f = array();
break;
case 'region': case 'region':
$f = array(); $f = array();
break;
} }
return array_merge($all_fields, $f); return array_merge($all_fields, $f);
return null;
} }
function user_personal_required_fields($type) function user_personal_required_fields($type)
@ -299,17 +439,21 @@ function user_personal_required_fields($type)
switch($type) { switch($type) {
case 'volunteer': case 'volunteer':
$f = array(); $f = array();
break;
case 'committee': case 'committee':
$f = array(); $f = array();
break;
case 'judge': case 'judge':
$f = array(); $f = array();
break;
case 'student': case 'student':
$f = array(); $f = array();
break;
case 'region': case 'region':
$f = array(); $f = array();
break;
} }
return array_merge($all_fields, $f); return array_merge($all_fields, $f);
return null;
} }
function user_personal_info_status($u = false) function user_personal_info_status($u = false)
@ -350,13 +494,15 @@ function user_update_complete(&$u, $status)
function user_committee_login($u) function user_committee_login($u)
{ {
/* Double check, make sure the user is of this type */ /* Double check, make sure the user is of this type */
if(!in_array('committee', $u['types'])) return false; if(!in_array('committee', $u['types'])) {
echo "ERROR: attempted to login committee on a non-committee user\n";
exit;
}
$u = user_load($u, true); $u = user_load($u, true);
$_SESSION['access_admin'] = $u['access_admin'];// == 'yes') ? true : false;
$_SESSION['access_admin'] = ($u['access_admin'] == 'Y') ? true : false; $_SESSION['access_config'] = $u['access_config'];// == 'yes') ? true : false;
$_SESSION['access_config'] = ($u['access_config'] == 'Y') ? true : false; $_SESSION['access_super'] = $u['access_super'];// == 'yes') ? true : false;
$_SESSION['access_super'] = ($u['access_super'] == 'Y') ? true : false;
} }

54
user_login.php
View File

@ -81,7 +81,6 @@
$reg_open = user_volunteer_registration_status(); $reg_open = user_volunteer_registration_status();
break; break;
case 'committee': case 'committee':
exit;
$reg_open = 'notpermitted'; $reg_open = 'notpermitted';
break; break;
case 'judge': case 'judge':
@ -105,33 +104,53 @@
exit; exit;
} else { } else {
$u = user_load($id); $u = user_load($id);
/* Make sure $type is in their types */
if(!in_array($type, $u['types'])) {
/* Huh, someone is fudging with the HTML, get
* out before touching the session */
header("location: index.php");
exit;
}
$_SESSION['name']="{$u['firstname']} {$u['lastname']}"; $_SESSION['name']="{$u['firstname']} {$u['lastname']}";
$_SESSION['username']=$u['username']; $_SESSION['username']=$u['username'];
$_SESSION['email']=$u['email']; $_SESSION['email']=$u['email'];
$_SESSION['users_id']=$u['id']; $_SESSION['users_id']=$u['id'];
$_SESSION['users_type']=$u['type']; $_SESSION['users_type']=$type;
/* Check for an expired password */ /* Check for an expired password */
$now = date('Y-m-d H:i:s'); if($u['passwordexpiry'] == NULL) {
if($now > $u['passwordexpiry']) { unset($_SESSION['password_expired']);
$_SESSION['password_expired'] = true; } else {
/* The main page (or any other user page) will catch this now and $now = date('Y-m-d H:i:s');
* require them to set a password */ if($now > $u['passwordexpiry']) {
$_SESSION['password_expired'] = true;
/* The main page (or any other user page) will catch this now and
* require them to set a password */
}
} }
/* FIXME: call a type sepcific function /* Call login functions for each type, so multirole
to set type specific session variables */ * users can easily switch */
foreach($u['types'] as $t) {
if(is_callable("user_{$t}_login")) {
call_user_func_array("user_{$t}_login", array($u));
}
}
mysql_query("UPDATE users SET lastlogin=NOW() mysql_query("UPDATE users SET lastlogin=NOW()
WHERE id={$u['id']}"); WHERE id={$u['id']}");
if(count($u['types']) > 1) { /* Setup multirole so a multirole user can switch if they want to
* without logging in/out */
if($u['types'] > 1) {
$_SESSION['multirole'] = true; $_SESSION['multirole'] = true;
header("location: user_multirole.php");
} else { } else {
$_SESSION['multirole'] = false; $_SESSION['multirole'] = false;
header("location: {$type}_main.php");
} }
/* Now finally, take them to whatever main page they logged in for */
header("location: {$type}_main.php");
exit; exit;
} }
@ -152,7 +171,10 @@
$keys = array_keys($_SESSION); $keys = array_keys($_SESSION);
foreach($keys as $k) unset($_SESSION[$k]); foreach($keys as $k) unset($_SESSION[$k]);
header("location: user_login.php?type=$type&notice=logged_out"); if($type != '')
header("location: user_login.php?type=$type&notice=logged_out");
if($type != '')
header("location: user_login.php?type=$type&notice=logged_out");
exit; exit;
} }
else if($_GET['action']=="recover") else if($_GET['action']=="recover")
@ -210,6 +232,11 @@
$pchars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; $pchars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
for($x=0;$x<12;$x++) $password .= $pchars{rand(0,61)}; for($x=0;$x<12;$x++) $password .= $pchars{rand(0,61)};
/* Save their old password so it can be recovered if someone is just trying
* to reset someones password */
mysql_query("UPDATE users SET oldpassword=password WHERE id={$r->id}");
/* Set the new password, and force it to expire */
mysql_query("UPDATE users SET password='$password',passwordexpiry='0000-00-00' WHERE id={$r->id}"); mysql_query("UPDATE users SET password='$password',passwordexpiry='0000-00-00' WHERE id={$r->id}");
/* volunteer_recover_password, judge_recover_password, student_recover_password, /* volunteer_recover_password, judge_recover_password, student_recover_password,
@ -220,6 +247,7 @@
array( "PASSWORD"=>$password, array( "PASSWORD"=>$password,
"EMAIL"=>$email) "EMAIL"=>$email)
); );
header("Location: user_login.php?type=$type&notice=recover_sent"); header("Location: user_login.php?type=$type&notice=recover_sent");
exit; exit;
} else { } else {

13
user_password.php
View File

@ -31,12 +31,21 @@
if(isset($_SESSION['users_type'])) { if(isset($_SESSION['users_type'])) {
$type = $_SESSION['users_type']; $type = $_SESSION['users_type'];
} else { } else {
header("location: index.php"); header("location: index.php?notice=auth_requird");
exit; exit;
} }
/* Make sure the user is logged in, but don't check passwd expiry */ /* Make sure the user is logged in, but don't check passwd expiry */
user_auth_required($type, false); if(!isset($_SESSION['users_type'])) {
header("location: user_login.php?type=$type&notice=auth_required");
exit;
}
if($_SESSION['users_type'] != $type) {
header("location: user_login.php?type=$type&notice=auth_required");
exit;
}
$notice=$_GET['notice']; $notice=$_GET['notice'];

156
user_personal.php
View File

@ -25,6 +25,7 @@
<? <?
require_once("common.inc.php"); require_once("common.inc.php");
require_once("user.inc.php"); require_once("user.inc.php");
require_once("committee.inc.php");
if(!isset($_SESSION['users_type'])) { if(!isset($_SESSION['users_type'])) {
/* No type set, invalid session */ /* No type set, invalid session */
@ -32,7 +33,22 @@
exit; exit;
} }
$u = user_load($_SESSION['users_id']); /* See if there is an edit request */
$eid = intval($_GET['edit']);
if($eid != 0) {
/* There is an edit request, the user must be:
* - on the committee
* - with admin access */
user_auth_required('committee', 'admin');
$u = user_load($eid, true);
} else {
/* Else, force them to edit themselves */
$eid = false;
$u = user_load($_SESSION['users_id'], true);
}
/* Load the fields the user can edit, and theones that are required */ /* Load the fields the user can edit, and theones that are required */
$fields = array(); $fields = array();
@ -44,36 +60,96 @@
user_personal_required_fields($t)); user_personal_required_fields($t));
} }
//send the header if(committee_auth_has_access('super')) {
$type = $_SESSION['users_type']; /* If the editer is super, let them see/edit/save the password */
send_header("{$user_what[$type]} - Personal Information", $fields[] = 'password';
array("{$user_what[$type]} Registration" => "{$type}_main.php") }
);
if($_POST['action']=="save") if($_POST['action']=="save")
{ {
/* Set values */ /* Set values */
foreach($fields as $f) { foreach($fields as $f) {
$u[$f] = mysql_escape_string(stripslashes($_POST[$f])); $u[$f] = mysql_escape_string(stripslashes($_POST[$f]));
} }
user_save($u); if(in_array('committee', $u['types'])) {
/* Trying to save a committee member eh? Well, we established above
* that we're allowed to be here, so go ahead and save it */
$u['displayemail'] = ($_POST['displayemail'] == 'yes') ? 'yes' : 'no';
$u['emailprivate'] = mysql_escape_string(stripslashes($_POST['emailprivate']));
if(committee_auth_has_access('super')) {
/* But only superusers can save these ones */
$u['access_admin'] = ($_POST['access_admin'] == 'yes') ? 'yes' : 'no';
$u['access_config'] = ($_POST['access_config'] == 'yes') ? 'yes' : 'no';
$u['access_super'] = ($_POST['access_super'] == 'yes') ? 'yes' : 'no';
}
}
/* Check for an email collision */
$em = mysql_escape_string(stripslashes($_POST['email']));
$q=mysql_query("SELECT id FROM users WHERE email='$em'");
if(mysql_num_rows($q) > 0) {
$notice = 'email_exists';
} else {
user_save($u);
if($_SESSION['last_page'] == 'committee_management') {
header("location: {$config['SFIABDIRECTORY']}/admin/committees.php");
exit;
}
$notice = 'success';
}
echo notice(i18n("%1 %2 successfully updated",array($_POST['firstname'],$_POST['lastname'])));
} }
// updateJudgeCompleteStatus($judgeinfo); //send the header
if($eid == false) {
$type = $_SESSION['users_type'];
send_header("{$user_what[$type]} - Personal Information",
array("{$user_what[$type]} Registration" => "{$type}_main.php")
);
} else {
if($_SESSION['last_page'] == 'committee_management') {
send_header("Personal Information for {$u['firstname']} {$u['lastname']}",
array('Committee Main' => 'committee_main.php',
'Administration' => 'admin/index.php',
'Committee Management' => 'admin/committees.php')
);
} else {
send_header("Personal Information for {$u['firstname']} {$u['lastname']}",
array("Committee Main" => "committee_main.php")
);
}
}
//output the current status switch($notice) {
$newstatus=user_personal_info_status($u); case 'success':
if($newstatus!='complete') echo notice(i18n("%1 %2 successfully updated",array($_POST['firstname'],$_POST['lastname'])));
{ break;
echo error(i18n("Personal Information Incomplete")); case 'email_exists':
echo notice(i18n("That email address is in use by another user"));
break;
}
if($eid == false) {
//output the current status
$newstatus=user_personal_info_status($u);
if($newstatus!='complete')
echo error(i18n("Personal Information Incomplete"));
else
echo happy(i18n("Personal Information Complete"));
} }
else
{ if(count($u['types']) > 1) {
echo happy(i18n("Personal Information Complete")); $roles='';
foreach($u['types'] as $t) {
$roles.= (($roles=='')?'':', ').i18n($user_what[$t]);
}
echo notice(i18n('This user has multiple roles, the fields shown below are a combination of every role. Some may not apply to some roles. This user has the following roles:').' '.$roles);
} }
function item($user, $text, $fname) function item($user, $text, $fname)
@ -91,8 +167,11 @@ function item($user, $text, $fname)
} }
$eidstr = '';
echo "<form name=\"personalform\" method=\"post\" action=\"user_personal.php\">\n"; if($eid != false) {
$eidstr="?edit=$eid";
}
echo "<form name=\"personalform\" method=\"post\" action=\"user_personal.php$eidstr\">\n";
echo "<input type=\"hidden\" name=\"action\" value=\"save\" />\n"; echo "<input type=\"hidden\" name=\"action\" value=\"save\" />\n";
echo "<table>\n"; echo "<table>\n";
@ -102,7 +181,7 @@ item($u, "Last Name", 'lastname');
echo "</tr>\n"; echo "</tr>\n";
echo "<tr>\n"; echo "<tr>\n";
item($u, "Email Address", 'email'); item($u, "Email Address", 'email');
echo "<td></td><td></td>"; item($u, "Password", 'password');
echo "</tr>\n"; echo "</tr>\n";
echo "<tr>\n"; echo "<tr>\n";
item($u, "Address 1", 'address'); item($u, "Address 1", 'address');
@ -138,10 +217,43 @@ item($u, "Fax", 'fax');
echo '<td></td><td></td>'; echo '<td></td><td></td>';
echo "</tr>"; echo "</tr>";
echo "<tr><td colspan=\"4\"><hr /></td></tr>"; echo "<tr><td colspan=\"4\"><hr /></td></tr>";
echo "</table>"; echo "</table>";
/* Committee specific fields */
if(in_array('committee', $u['types'])) {
echo "<table><tr>\n";
item($u, "Email (Private)", 'emailprivate');
echo "</tr>";
echo "<tr><td>".i18n("Email (Private)").":</td><td><input size=\"25\" type=\"text\" name=\"emailprivate\" value=\"{$u['emailprivate']}\" /></td></tr>\n";
echo "<tr><td>".i18n("Display Emails").":</td><td>";
if($u['displayemail']=="no") $checked="checked=\"checked\""; else $checked="";
echo "<input type=\"radio\" name=\"displayemail\" value=\"no\" $checked />".i18n("No");
echo "&nbsp; &nbsp; &nbsp;";
if($u['displayemail']=="yes") $checked="checked=\"checked\""; else $checked="";
echo "<input type=\"radio\" name=\"displayemail\" value=\"yes\" $checked />".i18n("Yes");
if(committee_auth_has_access("super"))
{
/* If the user is a committee member, only print these fields
* if the editer has super access */
echo "<tr><td align=\"center\" colspan=\"2\"><hr /></td></tr>";
echo "<tr><td>".i18n("Access Controls").":</td><td>";
$ch = ($u['access_admin']=="yes") ? 'checked="checked"' : '';
echo "<input type=\"checkbox\" name=\"access_admin\" value=\"yes\" $ch /> ".i18n("Administration")."<br />";
$ch = ($u['access_config']=="yes") ? 'checked="checked"' : '';
echo "<input type=\"checkbox\" name=\"access_config\" value=\"yes\" $ch /> ".i18n("Configuration")."<br />";
$ch = ($u['access_super']=="yes") ? 'checked="checked"' : '';
echo "<input type=\"checkbox\" name=\"access_super\" value=\"yes\" $ch /> ".i18n("Superuser")."<br />";
echo "</td></tr>";
}
echo '</table>';
}
echo "<input type=\"submit\" value=\"".i18n("Save Personal Information")."\" />\n"; echo "<input type=\"submit\" value=\"".i18n("Save Personal Information")."\" />\n";
echo "</form>"; echo "</form>";