grpadm.php

<?php 
// GiftWeb: PHP/PostgreSQL online Gift Registry System 
// Matthew T. Jachimstal
// Copyright (C) 2000-2008  Matthew T. Jachimstal
//
// email: matthew@jachimstal.com
//
// Snail mail: Matthew Jachimstal
//             1106 Canterbury Ct, Unit D
//             Elgin, IL 60120
//
// This program is free software; you can redistribute it and/or
// modify it under the terms of the GNU General Public License
// as published by the Free Software Foundation; either version 2
// of the License, or (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
//

require "./main.inc";
require "./util.php";

$s = $_COOKIE["GiftWeb_Session"];

$uid = validatesession($s);

$conn = ADONewConnection($dbtype);
$conn->PConnect($dbhost, $dbuser, $dbpass, $dbname);

// check if this user is the admin of any groups

$sql = "SELECT * FROM groups WHERE admin='$uid' ORDER BY description";
$result1 = $conn->Execute($sql);

if ($result1->RecordCount() == 0)
{
	startpage_old("Error: Not Administrator", 0);
	?>
	<h2>Error: You are not a group administrator</h2>
	<?php 
	redir("./main.php", "the Main GiftWeb page", 3);
	endpage_old(-1);
	exit();
}
	
// user is admin of at least on group

startpage_old("Group Administration", 0);

if (isset($_GET["grp"]))
{
	if (isset($_POST["submit"]))
	{
		process_form();
	}

	admin_group($_GET["grp"]);
}
else
{
	list_groups();
}

endpage_old(0);


// process_form()
// Remove members and approve or deny membership requests

function process_form()
{
	global $conn;

	// copy POST variables for easy reference

	$group = $_POST["group"];
	$approve = $_POST["approve"];
	$deny = $_POST["deny"];
	$userdel = $_POST["userdel"];

	$cntdel = count($userdel);
	$cntapp = count($approve);
	$cntdeny = count($deny);

	// setup an associative array (by uid) of requests to deny
	$deny_check[0]=0;

	for ( $i=0; $i < $cntdeny; $i++ )
	{
		$deny_check[$deny[$i]] = 1;
	}

	// if they're in the $approve array, set the deny_check[uid] to 0
	for ( $i=0; $i < $cntapp; $i++ )
	{
		$deny_check[$approve[$i]] = 0;
	}

	// delete users
	$del_err = 0;

	for ( $i=0; $i < $cntdel; $i++ )
	{
		$sql = "DELETE FROM members WHERE uid='$userdel[$i]'";
		$sql .= " and gid='$group'";

		$result = $conn->Execute($sql);

		// remove all purchases in the group this user is being 
		// removed from. If they're no longer a member and can't see
		// the lists, they shouldn't be able to purchase anything on it
		// right?

		// Since this has to be about the most complex SQL I've ever
		// written by hand (CASE tools don't count), I'm going to 
		// explain it in detail. Lines are number to make it easier to follow

		// 1: Mark these items as not purchased
		// 2: duh!
		// 3: ditto
		// 4: we're going to join members to items
		// 5: only the group being removed from
		// 6: find all items of users in the group
		// 7: that have been marked purchased by the user being removed

		$sql = "UPDATE items SET purchased = -1 ";						//1
		$sql .= "WHERE item_num in ";									//2
		$sql .= "(SELECT items.item_num ";								//3
		$sql .= " FROM members, items ";								//4
		$sql .= " WHERE members.gid = '$group' ";						//5
		$sql .= " AND members.uid=items.uid ";							//6
		$sql .= " AND items.purchased='$userdel[$i]')";					//7

		$result = $conn->Execute($sql);

		// cleanup any items this user added to the lists

		$sql = "DELETE FROM items WHERE purchased=-1 and added='t'";

		$result = $conn->Execute($sql);

		/*
		 * FIX
		 * check for deletion error
		 * mail to user that they've been removed
		 */
	}

	if ($del_err == 1)
	{
		/* 
		 * FIX
		 * display error 
		 */
	}

	// approve requests
	$app_err = 0;

	for ( $i=0; $i < $cntapp; $i++ )
	{
		$sql = "UPDATE members SET request = 'f' WHERE";
		$sql .= " uid='$approve[$i]' and gid='$group'";
		$result = $conn->Execute($sql);

		/* 
		 * FIX
		 * check for error 
		 */

		notify_user($approve[$i], $group, 1);
	}

	if ($app_err == 1)
	{
		/*
		 * FIX 
		 * display error
		 */
	}

	// deny requests, only if the check_deny value for that uid is 1
	$deny_err = 0;

	for ( $i=0; $i < $cntdeny; $i++ )
	{
		if ( $deny_check[$deny[$i]] == 1 )
		{
			$sql = "DELETE FROM members WHERE uid='$deny[$i]'";
			$sql .= " and gid='$group'";
			$result = $conn->Execute($sql);

			/* 
			 * FIX
			 * check for error
			 */

			notify_user($deny[$i], $group, 0);
		}
	}

	if ( $deny_error == 1)
	{
		/* 
		 * FIX
		 * display error
		 */
	}
}

// list_groups()
// List all groups that the user is group admin for.
// Each group name is a clickable link to show the members and 
// requests of that group

function list_groups()
{
	global $uid;
	global $conn;

	$sql = "SELECT * FROM groups WHERE admin='$uid' ORDER BY description";
	$result = $conn->Execute($sql);

	$result->MoveFirst();

	echo "<h2>Choose the group you wish to view</h2>";

	while (!$result->EOF)
	{
		$gid = $result->fields["gid"];
		$group = chop($result->fields["description"]);

		$sql = "SELECT * FROM members ";
		$sql .= "WHERE gid='$gid' and request='t'";
		$result2 = $conn->Execute($sql);

		?>
			<a href="./grpadm.php?grp=<?php echo $gid?>"><?php echo $group?></a>
		<?php 

		if ($result2->RecordCount() > 0)
		{
			echo "&nbsp;&nbsp;Requests pending";
		}

		echo "<br>";

		$result->MoveNext();
	}
}

// admin_group()
// Show all current members and allow them to be removed
// Show all pending requests for membership and allow them to 
// be approved or denied

function admin_group($gid)
{
	global $uid;
	global $conn;

	$sql = "SELECT * FROM groups WHERE gid='$gid'";
	$result = $conn->Execute($sql);

	$group = chop($result->fields["description"]);

	?>
		<h2>Group: <?php echo $group?></h2>
		<table>
			<tr>
				<th width=10%></th>
				<th><h3>Members:</h3></th>
			</tr>
		</table>

		<form method="post" action="./grpadm.php?grp=<?php echo $gid?>">
		<input type="hidden" name="group" value="<?php echo $gid?>">
		
		<table>
			<tr>
				<th width=5%></th>
				<th width=25% align=left>Name</th>
				<th width=5%></th>
				<th align=left>Remove User</th>
			</tr>
	<?php 

	$sql = "SELECT * FROM members, users ";
	$sql .= "WHERE members.gid='$gid' and members.request='f' ";
	$sql .= "and members.uid = users.uid ";
	$sql .= "ORDER BY users.last_name, users.first_name";
	$result2 = $conn->Execute($sql);

	if (!$result2)
	{
		echo "<tr></tr>\n";
	}

	// foreach user that is an approved member of this group
	$result2->MoveFirst();

	while (!$result2->EOF)
	{
		$user = $result2->fields["uid"];
		$name = chop($result2->fields["last_name"]);
		$name .= ", " . chop($result2->fields["first_name"]);

		?>
			<tr>
				<td></td>
				<td><?php echo $name?></td>
				<td></td>
				<td>
		<?php 

		if ($user != $uid)
		{
		?>
					<input type=checkbox name="userdel[]"
						value="<?php echo $user?>">
		<?php 
		}
		else
		{
			echo "Group Admin";
		}
		?>
					</td>
				</tr>
		<?php 

		$result2->MoveNext();
	}

	echo "</table>\n";

	$sql = "SELECT * FROM members, users ";
	$sql .= "WHERE members.gid='$gid' and members.request='t' ";
	$sql .= "and members.uid = users.uid ";
	$sql .= "ORDER BY users.last_name, users.first_name";

	$result2 = $conn->Execute($sql);

	if ($result2->RecordCount() > 0)
	{
		?>
		<hr align=center width=70% size=5>
		<table>
			<tr>
				<td width=10%></td>
				<td><h3>Requests to be added:</h3></td>
			</tr>
		</table>

		<table cellspacing=0 cellpadding=5>
			<tr>
				<th width=10%></th>
				<th>Name</th>
				<th>Approve</th>
				<th>Deny</th>
			</tr>
		<?php 

		$result2->MoveFirst();

		while(!$result2->EOF)
		{
			$user = $result2->fields["uid"];
			$name = chop($result2->fields["last_name"]);
			$name .= ", " . chop($result2->fields["first_name"]);
			?>
			<tr>
				<td></td>
				<td><?php echo $name?></td>
				<td><input type=checkbox name="approve[]"
					value="<?php echo $user?>"></td>
				<td><input type=checkbox name="deny[]"
					value="<?php echo $user?>"></td>
			<?php 

			$result2->MoveNext();
		}

		echo "</table>\n";
		echo "(If both approve and deny are selected for a user, ";
		echo "they will be approved.)";
	}

	?>
		<p>
		<input type=submit name=submit value="Update Group">
		<input type=reset value="Clear changes">
		<p>
		</form>

		<p>
		<a href="./grpadm.php">Return to group list</a>
	<?php 
}

?>