viewlist.php

<?php 
// GiftWeb: PHP/PostgreSQL online Gift Registry System 
// Matthew T. Jachimstal
// Copyright (C) 2000-2008  Matthew T. Jachimstal
//
// email: matthew@jachimstal.com
//
// Snail mail: Matthew Jachimstal
//             1106 Canterbury Ct, Unit D
//             Elgin, IL 60120
//
// This program is free software; you can redistribute it and/or
// modify it under the terms of the GNU General Public License
// as published by the Free Software Foundation; either version 2
// of the License, or (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
//
//

require "./main.inc";
// passed $s=session#, $u=target user id
require "./util.php";

$s = $_COOKIE["GiftWeb_Session"];

$u = $_GET["u"];
$uid = validatesession($s);

$conn = ADONewConnection($dbtype);
$conn->PConnect($dbhost, $dbuser, $dbpass, $dbname);

$num_cols = 4;

cleanup_items();

// FIX:
// make sure the user trying to view this list is a member of the same
// group. Otherwise, you can simply change the uid in the GET line
// and view anyone's list


if ( isset($_POST["submit1"]) )		// adding items not on list
{
	add_items();
}

if ( isset($_POST["purch"]) )		// marking items purchased
{
	purchase_items();
}

if ( isset($_POST["unpurch"]) )		// marking items unpurchased
{
	unpurchase_items();
}

display_list();

function add_items()	// add items not on the list
{
	global $conn;
	global $u;
	global $uid;

	$rows = 0;

	for ($i=1; $i <= 10; $i++)
	{
		$desc = "idesc$i";
		$item = chop ($_POST[$desc]);

		if ( $item != "" )
		{
			$sql = "INSERT INTO items";
			$sql .= " (uid, description, purchased, added, grp_id)";
			$sql .= " VALUES ('$u', '$item', '$uid', 't', '-1')";
			$result = $conn->Execute($sql);

			//$rows += $result->RecordCount();
		}
	}

	if ($rows != 0)
	{
		$res1 = "<h2>An error occured adding an item. Please try again.<br>";
		$res1 .= "If the problem persists, please contact the site ";
		$res1 .= "administrator.</h2>\n";
	}
	else
	{
		$res1 = "<h2>Item(s) added.</h2>\n";
	}
}

// purchase_items and unpurchase_items() do error checking as follows:
// the itemlist[] array potentially contains purchased and unpurchased
// items. Each function (purch/unpurch) filters the UPDATE or DELETE
// SQL statement by the current purchased value. 
//
// If it's marking items as purchased by the current user, it only UPDATEs 
// those items whose purchased field is -1. This prevents them from trying
// to remark items they've already purchased, although that would have
// no net effect. It's just the easiest way to error check this condition.
// It also prevents them from somehow hijacking items that were already
// marked purchased by a third user. This could possibly happen from someone
// writing their own page whose form action POSTs to this php page. 
// This is also a concurrency issue. If two people load the page and one 
// submits a purchase and the second doesn't refresh before submitting 
// the same purchase. The second user will not be able to update, because
// it will only update WHERE purchased=-1. They will reload the page after
// submission, and see that the item's already been marked by someone
// else. Potential cause for UTS and ID-10-T errors.
//
// When unpurchasing, the current value of purchased must be the user's
// uid. If it is -1, they're trying to unpurchased an item that hasn't been
// marked purchased. If it's another uid, they somehow got an invalid
// form that presented them with items they hadn't purchased. This is the
// the last error check to prevent that. Again, that could conceivably
// be caused by a malicious form POSTing to this script.

function purchase_items()
{
	global $conn;
	global $uid;

	$itemlist = $_POST["itemlist"];
	$cnt = count ($itemlist);

	$marked = 0;

	for ( $i=0; $i<$cnt; $i++ )
	{
		// update the purchased field to this user's $uid only if
		// item is not purchased 

		$sql = "UPDATE items SET purchased='$uid'";
		$sql .= " WHERE item_num='$itemlist[$i]' and purchased='-1'";

		$result = $conn->Execute($sql);

		/*
		 * FIX
		 * check for error conditions (are any possible?)
		 * keep count of how many are marked
                 *  can use if($result) and $conn->ErrorMessage(), but to
                 *  what effect here
		 */
	}
}

function unpurchase_items()
{
	global $conn;
	global $uid;

	$itemlist = $_POST["itemlist"];

	$cnt = count($itemlist);
	$unmarked = 0;
	$removed = 0;

	for ( $i=0; $i<$cnt; $i++ )
	{
		// unmarking has two conditions: item added by requestor
		// and item added by purchaser. 
		// In both cases we set the purchaser to -1.
		// Then, we look for any rows with purchaser=-1 and added=t
		// Those are unpurchased items that were added by the purchaser
		// and need to be deleted.
		// Also, we need to make that purchaser=uid, so we don't hijack
		// anyone else's purchases.

		$sql = "UPDATE items SET purchased='-1'";
		$sql .= " WHERE item_num='$itemlist[$i]' and purchased='$uid'";

		$result = $conn->Execute($sql);

		/*
		 * FIX
		 * check for error condition (are any possible?)
		 * count how many are unmarked
		 */
	}

	$sql = "DELETE FROM items WHERE purchased='-1' and added='t'";

	$result = $conn->Execute($sql);

	/*
	 * FIX
	 * count how many were deleted
	 */
}

function display_list()
{
	global $conn;
	global $u;
	global $uid;
	global $num_cols;

	$sql = "SELECT last_name, first_name FROM users WHERE uid='$u'";
	$result = $conn->Execute($sql);
	$name = chop($result->fields["last_name"]);
	$name .= ", " . chop($result->fields["first_name"]);
	$fname = chop($result->fields["first_name"]);

	startpage_old("$fname's Wish list", 0);

	?>
	<script language="JavaScript" type="text/javascript">
	<!-- 
	function CheckAll() 
	{
		for (var i = 0; i < document.itemList.elements.length; i++) 
		{
			if(document.itemList.elements[i].type == 'checkbox')
			{
				document.itemList.elements[i].checked = true;
			}
		}
	}

	function ViewNote(inum)
	{
		window.open("viewnote.php?i="+inum, 
				"ViewNotes", "width=600, height=300");
	}

	//-->
	</script>
	<?php 

	if ( isset($res1))
	{
		echo $res1;
	}

	echo "<h2>$fname's wish list:</h2>";
	?>

	<form name="itemList" method="post" 
		action="viewlist.php?u=<?php echo $u?>">
	<table cellspacing=0 cellpadding=1 border=1>
	<?php 

	// Display items in the viewed user's list
	
	// First, the overall header
	
	echo "<tr><th width=40%>Description</th>";
	echo "<th width=30%>Store/Web Address</th>";

	echo "<th width=10%>Notes</th>";
	echo "<th width=10%>Select</th></tr>\n";

	// Find items purchased by the viewing user
	
	$sql = "SELECT * FROM items WHERE uid='$u' ";
	$sql .= "and purchased='$uid' ORDER BY description";
	$mypurch = $conn->Execute($sql);

	if (!$mypurch->EOF)
	{
		echo "<tr><td class=\"purch_hdr\" colspan=$num_cols align=center>";
		echo "<b>Items purchased by current user</b></td></tr>\n";

		show_items($mypurch, 1);
	}

	// Find items purchased by other users
	
	$sql = "SELECT * FROM items WHERE uid='$u' ";
	$sql .= "and purchased > 0 and purchased != '$uid' ";
	$sql .= "ORDER BY description";
	$opurch = $conn->Execute($sql);

	if (!$opurch->EOF)
	{
		echo "<tr><td class=\"purch_hdr\" colspan=$num_cols align=center>";
		echo "<b>Items purchased by other users</b></td></tr>\n";

		show_items($opurch, 2);
	}

	// Finally, find unpurchased items
	
	$sql = "SELECT * FROM items, item_grp ";
	$sql .= "WHERE items.uid='$u' ";
	$sql .= "and items.purchased = -1 ";
	$sql .= "and items.grp_id = item_grp.grp_id ";
	$sql .= "and items.hidden = 'f' ";
	$sql .= "ORDER BY item_grp.grp_name, items.description";
	$unpurch = $conn->Execute($sql);

	if (!$unpurch->EOF)
	{
		echo "<tr><td class=\"purch_hdr\" colspan=$num_cols align=center>";
		echo "<b>Items not purchased by any users</b></td></tr>\n";

		show_items($unpurch, 3);
	}

	// build the events selector
	
	$sql = "SELECT * FROM events ";
	$sql .= "WHERE uid='-1' or uid='$u' ";
	$sql .= "ORDER BY month, day";
	$result = $conn->Execute($sql);

	$sel_list = "<option value=\"0\">None/Other</option>";

	$result->MoveFirst();

	while (!$result->EOF)
	{
		$evdate = $result->fields["month"]."/".$result->fields["day"];

		$sel_list .= "<option value=\"" . $result->fields["eid"] . "\">";
		$sel_list .= $result->fields["description"] . " ($evdate)";
		$sel_list .= "</option>\n";

		$result->MoveNext();
	}


	?>
		</table>
		<br>
		Select an event these items are being purchased for:
		<br>
		<select name="event_sel">
			<?php echo $sel_list?>
		</select>
		<br>

		<input type=submit name="purch" value="Purchase Selected Items">
		<input type=submit name="unpurch" value="Un-purchase Selected Items">
		<input type=reset name=reset value="Unselect all items">
		<input type="button" value="Select all items"
			onClick=CheckAll()>
		</form>

		<?php 

		// add a section where users can add items they've purchased
		// that aren't on the list

		?>
		<p>
		<hr width=70% size=5
		<?php 
		echo "<h4><ul><li>If you've purchased items not on $fname's list, ";
   		echo "please add them below.</li>\n";
	   	echo "<li>They will be displayed to other users to see that ";
	   	echo "they've been purchased.</li>\n";
	   	echo "<li>$fname will not see these items and will not be ";
	   	echo "able to delete them.</li></ul></h4>";
		?>
		<form method="post" action="viewlist.php?u=<?php echo $u?>">
		<table cellspacing=0 cellpadding=2>
		<tr><td></td><td align=center>Description</td></tr>
		<tr><td>1</td><td><input type="text" name="idesc1" size=50></td></tr>
		<tr><td>2</td><td><input type="text" name="idesc2" size=50></td></tr>
		<tr><td>3</td><td><input type="text" name="idesc3" size=50></td></tr>
		<tr><td>4</td><td><input type="text" name="idesc4" size=50></td></tr>
		<tr><td>5</td><td><input type="text" name="idesc5" size=50></td></tr>
		<br>
		Select an event these items are being purchased for:
		<br>
		<select name="event_sel">
			<?php echo $sel_list?>
		</select>
		<br>
		<tr><td></td><td align=center><input type="submit" name="submit1" 
		value="Add item(s)">
		<input type="reset" name="reset" value="Clear"></tr></tr>
		</table>
		</form>
		<?php 

		endpage_old(0);

}

// show_items(res, type)
// res: result set from the Execute() call
// type: 1->purchased by current user
// 		 2->purchased by other users
// 		 3->unpurchased

function show_items($res, $type)
{
	global $conn;
	global $u;
	global $num_cols;

	if ($type == 3)
	{
		// build list of all groups for this user
		// associative array indexed by grp_id
		$grp_sql = "SELECT * FROM item_grp WHERE uid='$u'
					OR uid='-1'";
		$grp_res = $conn->Execute($grp_sql);

		$grp_res->MoveFirst();
		
		while(!$grp_res->EOF)
		{
			$groups[$grp_res->fields["grp_id"]] = $grp_res->fields["grp_name"];
			$grp_res->MoveNext();
		}
	}

	$res->MoveFirst();

	$prev_grp = "";

	while(!$res->EOF)
	{

		$desc = $res->fields["description"];
		$url = chop($res->fields["url"]);
		$image = chop($res->fields["image"]);
		$purchased = $res->fields["purchased"];
		$added = $res->fields["added"];
		$item_num = $res->fields["item_num"];
		$item_grp = $res->fields["grp_id"];

		if ($pad_images && !$image)
		{
			$image = "./images/60-60-blank.gif";
		}


    if(filter_var($url, FILTER_VALIDATE_URL))
    {
      $host = parse_url($url, PHP_URL_HOST);
			$url = "<a href=\"$url\" target=\"_new\">$host</a>";
    }

		if ($type == 3)
		{
			// See if we're starting a new group
			if ($prev_grp != $item_grp)
			{
				echo "<tr><td class=\"group_hdr\" colspan=$num_cols>";
				echo "<b>&nbsp;$groups[$item_grp]</b></td></td>\n";

				$prev_grp = $item_grp;
			}
		}

		if ($image)
		{
			echo "<tr><td><img src=\"$image\" width=60 height=60 align=middle>&nbsp;$desc</td>";
		}
		else
		{
			echo "<tr><td>$desc</td>";
		}

		echo "<td>$url&nbsp;</td>";

		$sql = "SELECT * FROM notes WHERE item_num='$item_num'";
		$res2 = $conn->Execute($sql);

		if (!$res2->EOF)
		{
			$note_text = "<a href=\"javascript:ViewNote($item_num)\">";
			$note_text .= "ViewNotes</a>";
		}
		else
		{
			$note_text = "&nbsp;";
		}

		if ($added == 't' )
		{
			if ($type == 1)
				$note_text = "Added by<br>current user";
			else
				$note_text = "Added by<br>another user";
		}

		switch ($type)
		{
			case 1:
				$sel_text = "<input type=checkbox name=\"itemlist[]\" ";
				$sel_text .= "value=\"$item_num\">";
				break;
			case 2:
				$sel_text = "&nbsp;";
				break;
			case 3:
				$sel_text = "<input type=checkbox name=\"itemlist[]\" ";
				$sel_text .= "value=\"$item_num\">";
				break;
		}

		?>
			<td align=center><?php echo $note_text?></td>
			<td align=center><?php echo $sel_text?></td>
			</tr>
			<?php 

			$res->MoveNext();
	}
}

?>