diff --git a/schoolaccess.php b/schoolaccess.php
index 0b32fc2..ff752cb 100644
--- a/schoolaccess.php
+++ b/schoolaccess.php
@@ -59,9 +59,12 @@ function draw_dashboard(){
echo '
' . i18n("Participant Registration") . "\n";
}
}else if($conference['type'] == 'scienceolympics'){
+ echo "To access science olympics registration, login as a teacher";
+ /*
echo '' . i18n("Manage Students") . "\n";
echo '' . i18n("Manage Teams") . "\n";
echo '' . i18n("Register Teams for Events") . "\n";
+ */
}
echo '' . i18n("School Feedback / Questions") . "";
echo "\n";
diff --git a/schoolschedule.php b/schoolschedule.php
index f699e51..47cd28c 100644
--- a/schoolschedule.php
+++ b/schoolschedule.php
@@ -24,13 +24,15 @@
require("common.inc.php");
require_once("schedule.inc.php");
+ require_once("user.inc.php");
-if($_SESSION['schoolid'] && $_SESSION['schoolaccesscode']){
- // we're logged in, make sure the school is good
- $q=mysql_query("SELECT * FROM schools WHERE id='".$_SESSION['schoolid']."' AND accesscode='".$_SESSION['schoolaccesscode']."'");
- echo mysql_error();
- $school=mysql_fetch_object($q);
- if($school) {
+ user_auth_required("teacher");
+ $schoolid=user_field_required("schools_id","user_edit.php?tab=school");
+
+ $q=mysql_query("SELECT * FROM schools WHERE id='".$schoolid."'");
+ echo mysql_error();
+ $school=mysql_fetch_object($q);
+ if($school) {
if($_GET['action']=="loadschedule") {
$date=$_POST['date'];
@@ -143,24 +145,23 @@ if($_SESSION['schoolid'] && $_SESSION['schoolaccesscode']){
// print_r($_POST);
// get a list of all students that could be put on this team
- $query = 'SELECT * FROM users_student';
- $query .= ' JOIN users ON users_student.users_id = users.uid';
- $query .= ' JOIN users_conferences_link ucl ON ucl.users_uid = users_student.users_id';
- $query .= ' WHERE schools_id = ' . $_SESSION['schoolid'];
- $query .= ' AND ucl.conferences_id=' . $conference['id'];
- $query .= ' AND users.deleted = "no"';
- $results = mysql_query($query);
+
+ $results = mysql_query("SELECT * FROM users_student
+ JOIN users ON users_student.users_id = users.uid
+ JOIN users_conferences_link ucl ON ucl.users_uid = users_student.users_id
+ WHERE schools_id = $schoolid
+ AND ucl.conferences_id={$conference['id']}
+ AND users.deleted = 'no'");
+
$availList = array();
while($record = mysql_fetch_array($results)){
$availList[$record['uid']] = $record['firstname'] . ' ' . $record['lastname'];
}
// let's empty the current list of students for this team
- $query = "DELETE FROM schedule_registrations_users_link";
- $query .= " WHERE users_uid IN (";
- $query .= implode(',', array_keys($availList)) . ')';
- $query .= " AND schedule_registrations_id = " . (int)$_POST['regId'];
- $results = mysql_query($query);
+ $results=mysql_query("DELETE FROM schedule_registrations_users_link
+ WHERE users_uid IN (".implode(',', array_keys($availList)).")
+ AND schedule_registrations_id = ".intval($_POST['regId']));
// and now we'll insert only those that were selected
$query = "INSERT INTO schedule_registrations_users_link (schedule_registrations_id, users_uid)";
@@ -181,7 +182,7 @@ if($_SESSION['schoolid'] && $_SESSION['schoolaccesscode']){
$query = "SELECT sr.*, so_teams.name as name FROM schedule_registrations sr";
$query .= " JOIN so_teams ON so_teams.id = sr.so_teams_id";
$query .= " WHERE sr.id=" . $_POST['regId'];
- $query .= " AND so_teams.schools_id = " . $_SESSION['schoolid'];
+ $query .= " AND so_teams.schools_id = " . $schoolid;
$results = mysql_query($query);
if(!$results){
@@ -195,7 +196,7 @@ if($_SESSION['schoolid'] && $_SESSION['schoolaccesscode']){
$query = 'SELECT * FROM users_student';
$query .= ' JOIN users ON users_student.users_id = users.uid';
$query .= ' JOIN users_conferences_link ucl ON ucl.users_uid = users_student.users_id';
- $query .= ' WHERE schools_id = ' . $_SESSION['schoolid'];
+ $query .= ' WHERE schools_id = ' . $schoolid;
$query .= ' AND ucl.conferences_id=' . $conference['id'];
$query .= ' AND users.deleted = "no"';
$results = mysql_query($query);
@@ -488,5 +489,4 @@ if($_SESSION['schoolid'] && $_SESSION['schoolaccesscode']){
}
}
-}
?>
diff --git a/schoolschedule_event_tab.php b/schoolschedule_event_tab.php
index 4c2823b..b29e596 100644
--- a/schoolschedule_event_tab.php
+++ b/schoolschedule_event_tab.php
@@ -24,10 +24,13 @@
require("common.inc.php");
require_once("schedule.inc.php");
+ require_once("user.inc.php");
+
+ user_auth_required("teacher");
+ $schoolid=user_field_required("schools_id","user_edit.php?tab=school");
-if($_SESSION['schoolid'] && $_SESSION['schoolaccesscode']){
// we're logged in, make sure the school is good
- $q=mysql_query("SELECT * FROM schools WHERE id='".$_SESSION['schoolid']."' AND accesscode='".$_SESSION['schoolaccesscode']."'");
+ $q=mysql_query("SELECT * FROM schools WHERE id='".$schoolid."'");
echo mysql_error();
$school=mysql_fetch_object($q);
if($school) {
@@ -197,9 +200,5 @@ if($_SESSION['schoolid'] && $_SESSION['schoolaccesscode']){
else {
echo "Invalid school";
}
-}
-else {
- echo "Invalid school id or access code";
-}
?>