- Add a year field to the users db, we'll need it eventually

- Add a designate field to the schools, to indicate an independent, standard,
  private, etc. school.  It's not editable yet, but.. eventually.
- Fix generatePassword to use proper string indexing, and remove the
  possibility of indexing beyond the end of the string.
- Add "Invite" and "SinglePassword" modes for volunteer registration.
- Update the admin section, add a new volunteers page to contain links to all
  volunteer options

admin/index.php

@@ -43,7 +43,7 @@
  echo "<a href=\"translations.php\">".i18n("Translations Management")."</a> <br />";
  echo "<a href=\"reports_editor.php\">".i18n("Report Management")."</a> <br />";
 if($config['volunteer_enable'] == 'yes') {
-	 echo "<a href=\"volunteer_positions_manager.php\">".i18n("Volunteer Position Management")."</a> <br />";
+	 echo "<a href=\"volunteers.php\">".i18n("Volunteer Management")."</a> <br />";
 }
 if($config['tours_enable'] == 'yes') {
  echo "<a href=\"tours_manager.php\">".i18n("Tour Management")."</a> <br />";

admin/user_invite.php

@@ -0,0 +1,136 @@
+<?
+/* 
+   This file is part of the 'Science Fair In A Box' project
+   SFIAB Website: http://www.sfiab.ca
+
+   Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
+   Copyright (C) 2005 James Grant <james@lightbox.org>
+
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public
+   License as published by the Free Software Foundation, version 2.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; see the file COPYING.  If not, write to
+   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+   Boston, MA 02111-1307, USA.
+*/
+?>
+<?
+ require_once("../common.inc.php");
+ require_once("../user.inc.php");
+ user_auth_required('committee', 'admin');
+
+ $email = stripslashes($_POST['email']);
+
+ $type = $_GET['type'];
+ if(!in_array($type, $user_types)) {
+ 	send_header("Registration");
+	echo i18n("Invalid new registration\n");
+	send_footer();
+	exit;
+ }
+
+ switch($type) {
+ case 'volunteer':
+ 	$header_data = array('Volunteer Management' => 'admin/volunteer.php');
+	break;
+ case 'judge':
+ 	$header_data = array('Judges Management' => 'admin/judges.php');
+	break;
+ }
+
+ if($_POST['action']=='confirm' && $email != '') {
+ 	$header_data = array_merge($header_data, 
+			array("{$user_what[$type]} Invitations" => "admin/user_invite.php?type=$type"));
+ 	 send_header("{$user_what[$type]} Confirm",
+ 			array_merge(array('Committee Main' => 'committee_main.php',
+				'Administration' => 'admin/index.php'),
+				$header_data)	);
+  } else {
+ 	 send_header("{$user_what[$type]} Invitations",
+ 			array_merge(array('Committee Main' => 'committee_main.php',
+				'Administration' => 'admin/index.php'),
+				$header_data)	);
+ }
+
+ $id = intval($_POST['id']);
+ if($_POST['action']=='confirm' && $id > 0) {
+	/* Add $type to their types */
+	$id = intval($_POST['id']);
+	$u = user_load($id);
+	$u = user_create($type, $u);
+	echo happy(i18n("%1 has been added as a {$user_what[$type]}",
+			array($email)));
+	email_send("{$type}_add_invite", $email,
+			array("FAIRNAME"=>$config['fairname']),
+			array("FAIRNAME"=>$config['fairname'],
+				"EMAIL"=>$email));
+ }
+
+ 
+ if($_POST['action']=="invite" && $email != '') {
+ 	$e = mysql_escape_string($email);
+	$q = mysql_query("SELECT id,types FROM users WHERE email='$e' OR username='$e'");
+	if(mysql_num_rows($q) > 0) {
+		/* Check the roles */
+		$r = mysql_fetch_object($q);
+		$types = split(',', $r->types);
+		if(in_array($type, $types)) {
+			echo notice(i18n("%1 already exists and is already a {$user_what[$type]}",
+					array($email)));
+		} else {
+			echo i18n("%1 already exists with the following roles:", array($email));
+			echo '<br /><ul>';
+			foreach($types as $t) {
+				echo '<li>'.i18n($user_what[$t]).'</li>';
+			}
+			echo '</ul>';
+			echo i18n("Instead of generating a new password and
+			creating a new account, the role of {$user_what[$type]}
+			will be added to this account.");
+			echo "<form method=\"post\" action=\"user_invite.php?type=$type\">";
+			echo "<input type=\"hidden\" name=\"action\" value=\"confirm\" />\n";
+			echo "<input type=\"hidden\" name=\"id\" value=\"{$r->id}\" />\n";
+			echo "<input type=\"hidden\" name=\"email\" value=\"$e\" />\n";
+			echo "<input type=\"submit\" value=\"".i18n("Add Role of {$user_what[$type]}")."\" />\n";
+			echo "</form>\n";
+			send_footer();
+			exit;
+		}
+	} else {
+		/* They don't exist, create a new account */
+		$u = user_create($type);
+		$u['username'] = $email;
+		$u['password'] = generatePassword(12);
+		$u['email'] = $email;
+		user_save($u);
+
+		email_send("{$type}_new_invite",$email,
+				array("FAIRNAME"=>$config['fairname']),
+				array("FAIRNAME"=>$config['fairname'],
+					"EMAIL"=>$email,
+					"PASSWORD"=>$u['password']));
+
+		echo happy(i18n("%1 has been invited to be a {$user_what[$type]}",array($email)));
+	}
+ }
+
+
+ echo i18n("Enter the {$user_what[$type]} email address to invite them to be a {$user_what[$type]}");
+ echo "<br />\n";
+ echo "<br />\n";
+ echo "<form method=\"post\" action=\"user_invite.php?type=$type\">\n";
+ echo "<input type=\"hidden\" name=\"action\" value=\"invite\" />\n";
+ echo i18n("Email").": ";
+ echo "<input type=\"text\" name=\"email\" size=\"40\" />\n";
+ echo "<input type=\"submit\" value=\"".i18n("Invite {$user_what[$type]}")."\" />\n";
+ echo "</form>\n";
+
+ send_footer();
+?>

admin/volunteer_positions_manager.php

@@ -28,7 +28,9 @@
 
  user_auth_required('committee', 'admin');
  send_header("Volunteer Positions Manager",
-		 array("Administration" => "admin/") 
+		 array("Committee Main" => 'committee_main.php',
+		 	"Administration" => "admin/",
+			"Volunteer Management" => "admin/volunteers.php") 
 		                 );
 
 

admin/volunteers.php

@@ -0,0 +1,42 @@
+<?
+/* 
+   This file is part of the 'Science Fair In A Box' project
+   SFIAB Website: http://www.sfiab.ca
+
+   Copyright (C) 2005 Sci-Tech Ontario Inc <info@scitechontario.org>
+   Copyright (C) 2005 James Grant <james@lightbox.org>
+
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public
+   License as published by the Free Software Foundation, version 2.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; see the file COPYING.  If not, write to
+   the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+   Boston, MA 02111-1307, USA.
+*/
+?>
+<?
+ require("../common.inc.php");
+ require_once("../user.inc.php");
+ user_auth_required('committee', 'admin');
+
+ send_header("Volunteer Management", 
+ 		array('Committee Main' => 'committee_main.php',
+			'Administration' => 'admin/index.php')
+			);
+ echo "<br />";
+ if($config['volunteer_registration_type']=="invite")
+ {
+ 	echo "<a href=\"user_invite.php?type=volunteer\">".i18n("Invite Volunteers")."</a><br />";
+ }
+  echo "<a href=\"volunteer_positions_manager.php\">".i18n("Volunteer Position Management")."</a> <br />";
+
+ send_footer();
+
+?>

common.inc.php

@@ -991,13 +991,11 @@ function generatePassword($pwlen=8)
 {
 	//these are good characters that are not easily confused with other characters :)
 	$available="ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789";
-	$len=strlen($available);
+	$len=strlen($available) - 1;
 
 	$key="";
 	for($x=0;$x<$pwlen;$x++)
-	{
+		$key.=$available{rand(0,$len)};
-		$key.=$available[rand(0,$len)];
-	}
 	return $key;
 }
 

db/db.code.version.txt

@@ -1 +1 @@
-78
+79

db/db.update.79.sql

@@ -0,0 +1,19 @@
+ALTER TABLE `users` ADD `year` INT NOT NULL AFTER `email` ;
+ALTER TABLE `schools` ADD `designate` VARCHAR( 32 ) NOT NULL AFTER `postalcode` ;
+
+INSERT INTO `config` ( `var` , `val` , `category` , `type` , `type_values` , `ord` , `description` , `year`) VALUES (
+'volunteer_registration_type', 'open', 'Volunteer Registration', 'enum', 'open=Open|singlepassword=Single Password|invite=Invite', '150', 'The type of Volunteer Registration to use', '-1');
+
+INSERT INTO `config` ( `var` , `val` , `category` , `type` , `type_values` , `ord` , `description` , `year`) VALUES (
+ 'volunteer_registration_singlepassword', '', 'Volunteer Registration', 'text', '', '160', 'The single password to use if using Single Password Volunteer Registration (the option above this one). Ignored if not using Single Password volunteer registration.', '-1');
+
+INSERT INTO `emails` ( `id` , `val` , `name` , `description` , `from` , `subject` , `body` , `type` )
+VALUES (
+'', 'volunteer_new_invite', 'Volunteers - New Volunteeer Invitation', 'This is sent to a new volunteer when they are invited using the invite volunteers administration section, only available when the Volunteer Registration Type is set to Invite', '', 'Volunteer Registration for [FAIRNAME]', 'You have been invited to be a volunteer for the [FAIRNAME].  An account has been created for you to login with and complete your information.  You can login to the volunteer registration site with:\n\nEmail Address: [EMAIL]\nPassword: [PASSWORD]\n
+You can change your password once you login.', 'system'
+);
+
+INSERT INTO `emails` ( `id` , `val` , `name` , `description` , `from` , `subject` , `body` , `type` )
+VALUES (
+'', 'volunteer_add_invite', 'Volunteers - New Volunteeer Invitation', 'This is sent to existing users when they are invited using the invite volunteers administration section, only available when the Volunteer Registration Type is set to Invite', '', 'Volunteer Registration for [FAIRNAME]', 'The role of volunteer for the [FAIRNAME] has been added to your account by a committee member.  When you login again, there will be a [Switch Roles] link in the upper right hand area of the page.  Clicking on [Switch Roles] will let you switch between being a Volunteer and your other roles without needing to logout.\n', 'system');
+

register_participants_tours.php

@@ -85,6 +85,8 @@ echo mysql_error();
 				foreach($ts AS $rank=>$tid) {
 					if($tid == -1) continue;
 
+					$rank = intval($rank);
+
 					$x = intval($tid);
 
 					/* If this choice has already been selected, don't record it */
@@ -98,7 +100,7 @@ echo mysql_error();
 						"'".intval($students_id)."', ".
 						"'".intval($tid)."', ".
 						"'".$config['FAIRYEAR']."', ".
-						"'".intval($rank)."')");
+						"'$rank')");
 						echo mysql_error();
 				}
 

user_multirole.php

@@ -40,8 +40,8 @@
  {
  	global $user_what;
  	if(user_add_role_allowed($type, $u) && !in_array($type, $u['types'])) {
-		echo "<li><a href=\"user_new.php?action=new&type=$type\" 
+		echo "<li><a href=\"user_new.php?type=$type\">{$user_what['volunteer']}</a>";
-			onClick=\"return confirm('Are you sure you want to also be a {$user_what[$type]}?')\">{$user_what['volunteer']}</a>";
+//onClick=\"return confirm('Are you sure you want to also be a {$user_what[$type]}?')\"
 		echo '</li>';
 		return 1;
 	}

user_new.php

@@ -52,8 +52,8 @@
  case 'volunteer':
 	// returns "notopenyet", "closed", or "open"
 	$reg_open = user_volunteer_registration_status(); 
-	$reg_mode = 'open';
+	$reg_mode = $config['volunteer_registration_type'];
-	$reg_single_password = '';
+	$reg_single_password = $config['volunteer_registration_singlepassword'];
 	$password_expiry_days = $config['volunteer_password_expiry_days'];
 	$welcome_email = "volunteer_welcome";
  	break;
@@ -87,7 +87,7 @@
  $data_email = '';
 
  if($reg_open != "open") {
- 	send_header("{$user_what[$type]} - Registration",
+ 	send_header("{$user_what[$type]} Registration",
 		array("{$user_what[$type]} Login" => "user_login.php?type=$type") );
 	echo i18n("{$user_what[$type]} registration is not open");
 	echo "<br />";
@@ -96,33 +96,38 @@
  }
 
  if($reg_mode == 'invite') {
- 	send_header("{$user_what[$type]} - Registration",
+ 	send_header("{$user_what[$type]} Registration",
 		array("{$user_what[$type]} Login" => "user_login.php?type=$type") );
 
-	echo i18n("{$user_what[$type]} is by invitation only.  You can not create a new account.   In order to register you must have your account created for you by the science fair committee.")."<br />";
+	echo i18n("{$user_what[$type]} Registration is by invitation only.  You can not create a new account.")."<br /><br />";
-	echo i18n("Once your account is created you'll be invited via email to login and complete your {$user_what[$type]} registration information.	If you have been invited already, you need to use login using the email address that you were invited with.  If you need an invitation, please contact the science fair committee by sending us an email:  <a href=\"mailto:%1\">%1</a>.",
+	echo i18n("In order to register you must have your account created for you by the science fair committee.")."<br /><br />";
+	echo i18n("Once your account is created you'll be invited via email to login and complete your {$user_what[$type]} registration information.	If you have been invited already, you need to use login using the email address that you were invited with.  If you need an invitation, please contact the science fair committee by sending us an email:  <a href=\"mailto:%2\">%1</a>.",
 		array($config['fairname'],$config['fairmanageremail']));
 	echo "<br />";
-	echo "<br />";
-	echo "<a href=\"user_login.php?type=$type\">Back to Login</a>";
 	send_footer();
 	exit;
  }
  
- if($action == 'new') {
+ /* We're going to use a case statement here, so we can break out of 
-	$create = true;
+  * it at any moment.. there are a lot of reasons why we don't want
+  * to create a new account.. too many to nest inside IF statements..
+  * this is the one time I wish php had a goto statement. */
+ switch($action) {
+ case 'new':
 	$data_fn = mysql_escape_string(stripslashes($_POST['fn']));
 	$data_ln = mysql_escape_string(stripslashes($_POST['ln']));
 	$data_email = stripslashes($_POST['email']);
 	$sql_email = mysql_escape_string($data_email);
 	$registrationpassword = $_POST['registrationpassword'];
 
-	/* Strict validate the email */
+	/* Check the registration singlepassword */
-	if(!user_valid_email($data_email)) {
+	if($reg_mode == 'singlepassword') {
-		$notice = 'email_invalid';
+		if($reg_single_password != $_POST['registrationpassword']) {
-		$data_email = '';
+			$notice = 'singlepassword_wrong';
-		$create  = false;
+			break; /* Don't want to create an account */
 		}
+	}
+
 	/* See if this email already exists */
 	$q = mysql_query("SELECT id,types FROM users WHERE email='$sql_email' OR username='$sql_email'");
 
@@ -132,7 +137,7 @@
 		$types = split(',', $r->types);
 		if(in_array($type, $types)) {
 			$notice = 'role_exists';
-			$create = false;
+			break; /* Don't want to create an account */
 		} else {
 			/* If they're already logged in, we can go ahead and
 			 * add this role.  We've passed all the required checks
@@ -140,7 +145,7 @@
 			 * The user has already been warned about being logged
 			 * out. */
 			if(isset($_SESSION['users_id'])) {
-				/* User create does last minute checks, like
+				/* user_create does last minute checks, like
 				 * ensuring a student doesn't try to also
 				 * register as a judge */
 				$u = user_load($_SESSION['users_id']);
@@ -157,17 +162,24 @@
 		}
 	}
 
-	if($data_fn == '' or $data_ln == '') {
+	/* Strict validate the email */
-		$notice = 'name_invalid';
+	if(!user_valid_email($data_email)) {
-		$create = false;
+		$notice = 'email_invalid';
+		$data_email = '';
+		break; /* Don't want to create an account */
 	}
 
+	/* Check the names */
+	if($data_fn == '' or $data_ln == '') {
+		$notice = 'name_invalid';
+		break; /* Don't want to create an account */
+	}
+
+	/* If we havne't encountered a break; or an exit; yet, then go ahead
+	 * and create the account */
 
-	if($create == true) {
 	/* Generate a password */
-		$password = '';
+	$password = generatePassword(12);
-		$pchars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
-		for($x=0;$x<12;$x++) $password .= $pchars{rand(0,61)};
 
 	/* Add the user */
 	$u = user_create($type);
@@ -190,10 +202,7 @@
 	exit;
  }
 
-
+ send_header("{$user_what[$type]} Registration",
- }
-
- 	send_header("{$user_what[$type]} - Registration",
 		array("{$user_what[$type]} Login" => "user_login.php?type=$type") );
 
 	switch($notice) {
@@ -207,10 +216,16 @@
 		echo error(i18n("You must enter your first and last name"));
 		echo '<br />';
 		break;
+	case 'singlepassword_wrong':
+		echo '<br />';
+		echo error(i18n("The {$user_what[$type]} Registration Password you have entered is incorrect."));
+		echo '<br />';
+		break;
 	case 'role_exists':
 		echo '<br />';
 		echo error(i18n("That email address has an existing {$user_what[$type]} registration"));
-		echo notice(i18n("Use the 'recover password' option on the {$user_what[$type]} login page if you have forgotten your password"));
+		echo notice(i18n("Use the 'recover password' option on the %1 {$user_what[$type]} login page %2 if you have forgotten your password",
+				array("<a href=\"user_login.php?type=$type\">", "</a>")));
 		echo '<br />';
 		break;
 	}
@@ -218,6 +233,8 @@
 	?>
 	<form method="post" action="user_new.php?type=<?=$type?>">
 	<input type="hidden" name="action" value="new" />
+	<? /* If the user is already logged in, don't show this stuff */
+	if(!isset($_SESSION['users_id'])) { ?>
 		<table><tr><td>
 		<?=i18n("First Name")?>:</td><td><input type="text" size="20" name="fn" value="<?=$data_fn?>" />
 		</td></tr><tr><td>
@@ -225,30 +242,28 @@
 		</td></tr><tr><td>
 		<?=i18n("Email")?>:</td><td><input type="text" size="20" name="email" value="<?=$data_email?>"  />
 		</td></tr>
-	<?
+		</table>
+	<? } else {
+		echo "<br />";
+		echo i18n("Remember, once you click the Register button below, you will be logged out.  You can immediately log back in.");
+		echo "<br />";
+	}	
 	if($reg_mode == 'singlepassword') {
-		echo "<tr><td>";
+		echo '<br />';
-		echo i18n("{$user_what[$type]} Password").":</td><td><input type=\"password\" size=\"20\" name=\"registrationpassword\" />";
+		echo i18n("{$user_what[$type]} Registration is protected by a password.  You must know the <b>{$user_what[$type]} Registration Password</b> in order to create an account.  Please contact the committee to obtain the password if you wish to register.");
-		echo "</td></tr>";
+		echo "<br />";
+		echo i18n("{$user_what[$type]} Password").":<input type=\"password\" size=\"20\" name=\"registrationpassword\" />";
+		echo "<br />";
 	}		
 	?>
-
+	<br /><input type="submit" value=<?=i18n("Register")?> />
-	<tr><td colspan=2>
-	<input type="submit" value=<?=i18n("Register")?> />
-	</td></tr>
-	</table>
 	</form>
 	<?
 
+	if(!isset($_SESSION['users_id'])) {
 		echo "<br />";
 		echo i18n("When you click the 'Register' button, your password will be randomly created and emailed to you.  When you login for the first time you will be prompted to change your password.  It can sometimes take several minutes for the email to send, so be patient.");
 		echo "<br />";
-
-	if($reg_mode == 'singlepassword') {
-		echo "<br />";
-		echo i18n("{$user_what[$type]} registration is protected by a password.  You must know the <b>$what Password</b> in order to create an account.  Please contact the committee to obtain the password if you wish to register.");
-		echo "<br />";
 	} 
-
 	 send_footer();
 ?>