editprefs.php

<?php 
// GiftWeb: PHP/PostgreSQL online Gift Registry System 
// Matthew T. Jachimstal
// Copyright (C) 2000-2008  Matthew T. Jachimstal
//
// email: matthew@jachimstal.com
//
// Snail mail: Matthew Jachimstal
//             1106 Canterbury Ct, Unit D
//             Elgin, IL 60120
//
// This program is free software; you can redistribute it and/or
// modify it under the terms of the GNU General Public License
// as published by the Free Software Foundation; either version 2
// of the License, or (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
//
//
require "./main.inc";
require "./util.php";

$s = $_COOKIE["GiftWeb_Session"];

$uid = validatesession($s);
$mode = $_GET["mode"];

$conn = ADONewConnection($dbtype);
$conn->PConnect($dbhost, $dbuser, $dbpass, $dbname);

startpage_old("prefs", "Edit personal preferences");

if ($mode == "")
{
	?>
		<div id="mainContent">
		<h1>Update personal preferences</h1>
		<ul class="options">
		<li>
		<a href="editprefs.php?mode=uinfo" title="User Info">Update user
		information</a> (Username, email, password)
		</li>
		<li>
		<a href="editprefs.php?mode=groups" title="Group membership">Update group
		memberships</a> (Group to be listed in, groups to view)
		</li>
		<li>
		<a href="editprefs.php?mode=events" title="Events">Update personal
		events</a> (Dates, descriptions)
		</li>
		<li>
		<a href="editprefs.php?mode=item_groups" title="Gift Groups">Update gift groups</a>
		</li>
		</ul>
		</div>
	<?php 
}

if ($mode == "uinfo")
{
	echo "<div id=\"mainContent\">";
	echo "<h1>Change/update user information</h1>";

	if ( isset($_POST["uinfo_submit"]))
	{
		process_user_form();
		//redir("./editprefs.php", "the main preferences page", 3);
	}

	show_user_form();

	echo "</div>";
}

if ($mode == "item_groups")
{
	echo "<h2>Update gift group information</h2>\n";

	if ( isset($_POST["groups_submit"]))
	{
		process_item_groups_form();
	}

	show_item_groups_form();

	?>
		<center>
		<a href="editprefs.php" title="Main Prefs Page">Back to Main Preferences Page</a>
		</center>
	<?php 
}

if ($mode == "groups")
{
	echo "<h2>Update group information</h2>\n";

	if ( isset($_POST["groups_submit"]))
	{
		process_groups_form();
	}

	show_groups_form();

	?>
		<center>
		<a href="editprefs.php" title="Main Prefs Page">Back to Main Preferences Page</a>
		</center>
	<?php 
}

if ($mode == "events")
{
	echo "<h2>Update personal events</h2>\n";

	if ( isset($_POST["events_submit"]))
	{
		process_events_form();
	}

	show_events_form();

    ?>
		<center>
		<a href="editprefs.php" title="Main Prefs Page">Back to Main Preferences Page</a>
		</center>
	<?php 
}

function show_events_form()
{
	global $uid;
	global $conn;
	global $s;

	$sql = "SELECT * FROM events WHERE uid='$uid' ORDER BY month, day";
	$result = $conn->Execute($sql);

	?>
	<form method="post" action="editprefs.php?mode=events">
	<?php 

	$sysevent_text = 
		" Note that GiftWeb has several
		<a href=\"\" onClick=\"window.open('sysevents.php', 
				'View System Events', 'width=500, height=500')\"
				title=\"System Events\">
			system-defined events</a> (Christmas, Valentine's Date, etc).
		<p />
		";

	if ($result->RecordCount() == 0)
	{
		echo "No personal events defined. Please enter them below.<p \>\n";
		echo $sysevent_text;
	}
	else
	{
	?>
		These are the personal events which you have defined. These<br />
		will allow other users to select the event they are purchasing<br />
		an item for. After the event has passed, GiftWeb will automatically<br />
		delete those items from your list for you!
		<p />
		<?php echo $sysevent_text;?>

		<table border=1 cellpadding=4 cellspacing=0>
		<tr>
			<th>Delete</th>
			<th>Month</th>
			<th>Day</th>
			<th>Description</th>
		</tr>
	<?php 
							   
                $result->MoveFirst();					   
		while (!$result->EOF) 
		  {
		    $eid = chop($result->fields["eid"]);
		    $month = chop($result->fields["month"]);
		    $day = chop($result->fields["day"]);
		    $desc = chop($result->fields["description"]);
			?>
			<tr><td align=center><input type=checkbox name="ev_selected[]"
						value="<?php echo $eid?>" /></td>
				<td align=center><?php echo $month?></td>
				<td align=center><?php echo $day?></td>
				<td align=center><?php echo $desc?></td>
			</tr>
			<?php 
		
	        $result->MoveNext();
	        }
		echo "</table>\n";
	}
	?>
	<p />
	<h3>Add an event:</h3>
	<table border=0 cellpadding=2 cellspacing=0>
	<tr><td align="right">Month:</td>
		<td align-left><input type="text" name="ev_mon" size=2 
							maxlength=2 /></td></tr>
	<tr><td align="right">Day:</td>
		<td align="left"><input type="text" name="ev_day" size=2
							manlenght=2 /></td></tr>
	<tr><td align="right">Description:</td>
		<td align="left"><input type="text" name="ev_desc" size=30 /></td></tr>
	</table>
	<p />
	<input type="submit" name="events_submit" value="Add/Delete events" />
	&nbsp;
	<input type="reset" name="reset" value="Clear Form" />
	</form>
	<?php 
}

function process_events_form()
{
	global $uid;
	global $conn;

	// Events to be removed
	if (isset($_POST["ev_selected"]))
	{
		$ev_selected = $_POST["ev_selected"];

		$cnt = count($ev_selected);

		for ($i=0; $i < $cnt; $i++)
		{
			$event = $ev_selected[$i];

			$sql = "DELETE FROM events WHERE eid='$event' AND uid='$uid'";
			$result = $conn->Execute($sql);
		}
	}
		
	// Event to be added

	if (isset($_POST["ev_mon"]) && isset($_POST["ev_day"]) &&
			isset($_POST["ev_desc"]))
	{

		// First, determine the next time the event should be purged.
		$curr_date = getdate();
		$curr_mon = $curr_date["mon"];
		$curr_day = $curr_date["mday"];
		$curr_year = $curr_date["year"];

		$ev_mon = $_POST["ev_mon"];
		$ev_day = $_POST["ev_day"];
		$ev_year = 0;
		$ev_desc = $_POST["ev_desc"];

		if ($ev_mon < $curr_mon) // event already happened this year
		{
			$ev_year = $curr_year + 1;
		}
		else if ($mon > $curr_mon) // event hasn't happened yet this year
		{
			$ev_year = $curr_year;
			}
		else	// event happens this month
		{
			if ($ev_day < $curr_day) // event already happened this year
			{
				$ev_year = $curr_year + 1;
			}
			else	// event is today or hasn't happened yet this year
			{
				$ev_year = $curr_year;
			}
		}

		$nxt_prg = mktime(0, 0, 0, $ev_mon, $ev_day, $ev_year);

		// Insert the event
		$sql = "INSERT INTO events";
		$sql .= " (uid, month, day, description, next_purge)";
		$sql .= " VALUES";
		$sql .= " ('$uid', '$ev_mon', '$ev_day', '$ev_desc', '$nxt_prg')";
		$result = $conn->Execute($sql);

	}
}



function show_user_form()
{
	global $uid;
	global $s;
	global $conn;

	$sql = "SELECT * FROM users WHERE uid='$uid'";
	$result = $conn->Execute($sql);

	$lname = chop($result->fields["last_name"]);
	$fname = chop($result->fields["first_name"]);
	$email = chop($result->fields["email"]);
	$login = chop($result->fields["login"]);
	$prices = chop($result->fields["prices"]);

	if ($prices == "t")
	{
		$track_yes = "CHECKED=\"true\"";
		$track_no = "";
	}
	else
	{
		$track_yes = "";
		$track_no = "CHECKED=\"true\"";
	}


	?>
	<form id="UserInfo" method="post" action="editprefs.php?mode=uinfo">
	<p /> <label for="login" class="formLabel">Login Name</label>
		<input type="text" name="login" value="<?php echo $login?>"
			   maxlength="12" class="textInput"/></p />
	<p /> <label for="fname" class="formLabel">First Name</label>
		<input type="text" name="fname" value="<?php echo $fname?>"
			maxlength="25" class="textInput"/></p />
	<p /> <label for="lname" class="formLabel">Last Name</label>
		<input type="text" name="lname" value="<?php echo $lname?>"
			maxlength="25" class="textInput"/></p />
	<p /> <label for="email" class="formLabel">Email Address</label>
		<input type="text" name="email" value="<?php echo $email?>"
			maxlength="40" class="textInput"/></p />
	<p />
	<p class="note">
		(Only enter a password if you wish to change it 
			permanently.)
	</p>
	<p> <label for="passwd1" class="formLabel">Change Password</label>
		<input type="password" name="passwd1" class="textInput"/>
	</p>
	<p> <label for="passwd2" class="formLabel">Verify New Password</label>
		<input type="password" name="passwd2" class="textInput"/></p>
	<p />
	<p> <span class="formLabel">Track amounts spent?</span>
		<label><input type="radio" name="prices" value="t"
					<?php echo $track_yes?> />Yes</label>
		<label><input type="radio" name="prices" value="f"
					<?php echo $track_no?> />No</label>
	</p>
	<p />
	<p> <input type="submit" name="uinfo_submit" id="submit"
				value="Submit Changes" />
		<input type="reset" value="Reset Form" /></p>
	<input type="hidden" name="s" value="<?php echo $s?>" />
	</form>
	<?php 
}

//pah: I really need to understand this function better.
// does $conn->fields[] return array if there are multiple rows?
function show_groups_form()
{

  // ---------> sample
  // $recordSet = &$conn->Execute('select * from products');
  //  if (!$recordSet) 
  // print $conn->ErrorMsg();
  //else
  // while (!$recordSet->EOF) {
  //   print $recordSet->fields[0].' '.$recordSet->fields[1].'<BR>';
  //   $recordSet->MoveNext();
  // }
	global $uid;
	global $conn;
	global $s;

	// change primary group
	$sql = "SELECT * FROM members WHERE uid='$uid' and prim='t'";
	$result = $conn->Execute($sql);
	
	if ($result->RecordCount() == 1)
	{
		$p = $result->fields["prim"];
		$g = $result->fields["gid"];
		if ($p = 't')
		{
			$primary = $g;
		}
	}

	$sql = "SELECT * FROM groups ORDER BY gid";
	$result = $conn->Execute($sql);

	if($result->RecordCount() < 1)
	{
		?>
		<h3>No Groups Defined. Please contact registry administrator.</h3>
		<?php 
	}
	else
	{
		$prim = 0;
		$sql = "SELECT * FROM members WHERE uid='$uid' ORDER BY gid";
		$result2 = $conn->Execute($sql);

		// this should be at first already, but for consistency sake
		$result2->MoveFirst();
		
		while (!$result2->EOF) 
		{
			$group = $result2->fields["gid"];
			$selected[$group] = 1;

			if ($result2->fields["request"] == 't')
			{
				$requests[$group] = 1;
			}

			if ($result2->fields["prim"] == 't')
			{
				$prim = $group;
			}
			$result2->MoveNext();

		}
		


		?>
		Please select which group you want to be listed in. If you wish to
	    request a new group, that can be done <a href="newgrp.php">here</a>.<p />
		<form method="post" action="editprefs.php?mode=groups">

		<select name="primary" size="1">
		<option value="0"></option>
		<?php 

		$result->MoveFirst();
		while (!$result->EOF) 
		{
			$sel = "";

			$gid = $result->fields["gid"];
			$desc = $result->fields["description"];

			if ($gid == $prim)
				$sel = "selected=\"1\"";

			echo "<option $sel value=\"$gid\">$desc</option>\n";
			$result->MoveNext();
		}
		?>
		</select>

		<p />
		Please select which groups you would like to be able to view.<br />
		(You will always be able to view the group you are listed in.)<br />
		<table border="1">
		<tr><th align="center">Group Name</th>
			<th align="center"></th>
		<?php 
		    
		$result->MoveFirst();
		while (!$result->EOF) 
		{

		  $gid = $result->fields["gid"];
		  $description = $result->fields["description"];

			?>
			<tr><td><?php echo $description?></td>
				<td align="center"><input type="checkbox" name="requested[]"
					value="<?php echo $gid?>"
					<?php 
					if ($selected[$gid] == 1)
						echo " checked=\"1\" ";
					?>
					 /></td>
				<td align="center">
					<?php 
					if (isset ($requests) && $requests[$gid] == 1)
					{
						echo "Request pending approval";
					}
					?>
				</td></tr>
			<?php 
				    $result->MoveNext();
                }
		?>
</tr>
		</table>
		<p />
		<input type="submit" name="groups_submit" value="Submit Group Request" />
		&nbsp;&nbsp;
		<input type="reset" Value="Reset Groups" />
		</form>
		<?php 
	}
}
		
function process_user_form()
{
	global $conn;
	global $uid;

	$login = chop($_POST["login"]);
	$fname = chop($_POST["fname"]);
	$lname = chop($_POST["lname"]);
	$email = chop($_POST["email"]);
	$passwd1 = chop($_POST["passwd1"]);
	$passwd2 = chop($_POST["passwd2"]);
	$prices = chop($_POST["prices"]);

	$sql = "SELECT passwd FROM users WHERE uid='$uid'";
	$result = $conn->Execute($sql);
// FIX this is an ugly way to do it. retrieve, change if needed, write out, write out with larger sql below
	$old_pass = $result->fields["passwd"];


	if ( $passwd1 != "" )
	{
		if ( $passwd1 == $passwd2 )
		{
			$md5_pass = md5($passwd1);
			$sql = "UPDATE users SET passwd='$md5_pass' WHERE uid='$uid'";

			$result = $conn->Execute($sql);
			print $conn->ErrorMsg();

			if (!$result)
			{
				echo "<h2>An error occured changing your password. Please ";
				echo "try again.</h2>\n";
			}
			else
			{
				echo "<h3>Password changed</h3>\n";
				$old_pass = $md5_pass;
				return;
			}
		}
		else
		{
			echo "<h3>Passwords entered do not match, please try again.</h3\n";
		}
	}

	$sql = "SELECT count(*) AS count FROM users where login='$login' and uid != '$uid'";
	$result = $conn->Execute($sql);

	if ( $result->fields["count"] > 0 )
	{
		echo "<h3>That login name is already taken, please choose a different login name.</h3>\n";
	}
	else
	{
		$sql = "UPDATE users SET login='$login', email='$email', 
		        last_name='$lname', first_name='$fname', 
				passwd='$old_pass', prices='$prices'
				WHERE uid='$uid'";
		$result = $conn->Execute($sql);


		if (!$result) 
		{
			echo "<h2>An error occured updating your information, please try";
			echo "again</h2>\n";
		}
		else
		{
			echo "<h2>Your changes have been completed.</h2>\n";
		}
	}
}
		
function process_groups_form()
{
	global $conn;
	global $uid;

	// convert POST variables to normal names, makes references easier
	$primary = $_POST["primary"];
	$requested = $_POST["requested"];


	// build an associative array of which groups the user wants 
	// to be listed in (member of)
	// We'll comapre this list against the list of groups they're currently
	// in and decide what to do below
	$reqd_cnt = count($requested);

	for ($i=0; $i < $reqd_cnt; $i++)
	{
		// if $requests[gid] is 1, they want to be a member
		$requests[$requested[$i]] = 1;
	}

	// find what groups they're listed in right now, to compare to the
	// desired list build above
	$sql = "SELECT * FROM members WHERE uid='$uid' ORDER BY gid";
	$result = $conn->Execute($sql);
	$rows = $result->RecordCount();
	$old_prim = 0;

	
	$result->MoveFirst();
	while (!$result->EOF) 
	  {
	    $gid =  $result->fields["gid"];

		// if $requests[this_gid] is not set, they've removed that group
		if ( !$requests[$gid] )
		{
			$sql2 = "DELETE FROM members WHERE uid='$uid' and gid='$gid'";
			$result2 = $conn->Execute($sql2);

			// track deleted groups for later checking WRT the primary group
			$deleted[$gid]=1;
		}
		else
		{
			// track which groups they're still in and find if it's their
			// old primary group
			$member[$gid] = 1;

			if ($result->fields["prim"]  == 't')
			{
				$old_prim = $gid;
			}
		}
		$result->MoveNext();
	  }
	

	//
	// check if they want any new groups, if it's in the requested[] array
	// but not in the member[] array, it's a new request
	//

	for ($i=0; $i < $reqd_cnt; $i++)
	{
		$grp = $requested[$i];

		// if $member[$grp] is not set, it's a new request
		if ( !$member[$grp] )
		{
			$sql = "SELECT * FROM groups WHERE gid='$grp'";
			$rslt = $conn->Execute($sql);

			if ($rslt->RecordCount() == 1)
			{
				$approve = $rslt->fields["verify_requests"];
			
				$sql3 = "INSERT INTO members (gid, uid, prim, request) ";
				$sql3 .= "VALUES ('$grp', '$uid', 'f', '$approve')";
				$conn->Execute($sql3);

				if ($approve == 't')
				{
					notify_group_admin($uid, $grp, 1);
				}
			}
		}
	}

	// see if they've changed their primary group
	$sql = "SELECT * FROM members WHERE uid='$uid' and prim='t'";
	$result = $conn->Execute($sql);

	if ($primary == 0)   
	{
		// blank primary group, do nothing, user's
		// not supposed to pick it, only used
		// for new users, they'll get the no primary
		// group warning from util.php
	}
	else if ($result->RecordCount() == 0)  // no current primary (new user)
											// they can still be in groups, 
											// they just haven't picked
		 									// a primary yet!
	{
		if (!$deleted[$primary])  // and they've not asked to be removed
								  // from their primary group
		{
			$sql3 = "SELECT * FROM groups where gid='$primary'";
			$rslt3 = $conn->Execute($sql3);

			if ($rslt3->RecordCount() == 1)
			{
			  $approve =  $rslt3->fields["verify_requests"];

			  // just in case
			  $conn->Execute("DELETE FROM members WHERE gid='$primary' AND uid='$uid'");

			  $sql2 = "INSERT INTO members VALUES ('$primary', '$uid', 't', '$approve')";
			  $conn->Execute($sql2);

				if ($approve == 't')
				{
					notify_group_admin($uid, $primary, 1);
				}
			}
		}
	}
	else if ($result->RecordCount() == 1) // current primary group exists
	{
		if ($primary != $old_prim) // new primary group
		{
			// clear current primary
			$sql2 = "UPDATE members SET prim='f' WHERE uid='$uid'";
			$conn->Execute($sql2);

			// set new primary
			$sql2 = "UPDATE members SET prim='t' WHERE uid='$uid' ";
			$sql2 .= "and gid='$primary'";
			$conn->Execute($sql2);
		}
	}
	else    // bad number of rows
			// print an error and do nothing
	{
		?>
		<h3>There is a problem with your group listing choices. Please
		make your select and try again. If the problem persists, please
		contact the site administrator.<br />
		Thank you.</h3>
		<?php 
	}
	
}

function show_item_groups_form()
{
	global $uid;
	global $conn;

	$sql = "SELECT * FROM item_grp WHERE uid='$uid' 
			OR uid='-1' ORDER BY grp_name";
	$result = $conn->Execute($sql);

	if ($result->RecordCount() < 1)
	{
		echo "<h3>No groups defined. Please contact the registry ";
		echo "administrator to create your default group</h3>\n";
		return;
	}

	echo "<form method=\"post\" action=\"editprefs.php?mode=item_groups\">\n";

	?>
		<table border>
		<tr>
			<th align=center>Group Name</th>
			<th align=center>Delete</th>
		</tr>

	<?php 

	$result->MoveFirst();

	while (!$result->EOF)
	{
		$grpid = $result->fields["grp_id"];
		$grp_uid = $result->fields["uid"];
		$name = $result->fields["grp_name"];

		?>
			<tr>
				<td><?php echo $name?></td>
		<?php 

		if ($grp_uid == -1)
		{
			echo "<td>&nbsp;</td>";
		}
		else
		{
			?>
			<td align=center><input type=checkbox name="dellist[]"
									value="<?php echo $grpid?>"</td>
			<?php 
		}

		echo "</tr>";

		$result->MoveNext();
	}

	echo "</table>\n";
	
	?>
		<p />
		<h3>Add a gift group:</h3>
		<table border=0 cellpadding=2 cellspacing=0>
			<tr>
				<td align="right">Name:</td>
				<td align="left"><input type="text" name="grp_name" size=30
									  maxlength=30></td>
			</tr>
		</table>
		<p />
		<input type="submit" name="groups_submit" value="Add/Delete groups">
		&nbsp;
		<input type="reset" name="reset" value="Clear Form">
		</form>
	<?php 
}

function process_item_groups_form()
{
	global $uid;
	global $conn;


	if (isset($_POST["dellist"]))
	{
		$dellist = $_POST["dellist"];
		$cnt = count($dellist);

		for ($i=0; $i < $cnt; $i++)
		{
			$del_grp = $dellist[$i];

			$sql = "DELETE FROM item_grp WHERE grp_id='$del_grp'";
			$result = $conn->Execute($sql);
		}

		echo "<h3>Groups deleted.</h3>\n";
	}

	if (chop($_POST["grp_name"] != ""))
	{
		$new_grp = chop($_POST["grp_name"]);

		$sql = "INSERT INTO item_grp (uid, grp_name) ";
		$sql .= "VALUES ('$uid', '$new_grp')";
		$result = $conn->Execute($sql);
		if (!$result)
			print $conn->ErrorMsg();

		echo "<h3>Group '$new_grp' added.</h3>\n";
	}
}


endpage(0);

?>