<?PHP

#############################################################################
#           			                   Site@School
# Site@School is a website management system designed for primary schools.
#
# About Site@School:
# Comissioned by: City District 'de Baarsjes', Amsterdam, Netherlands
# Original idea, coding (version 1.0) and design : Mark de Haan (mark@starwave.nl)
# Ideas, improvements, expansions (version 1.1 - 2.4): Fred Stuurman 
# Current coder & maintainer: Fred Stuurman (fc.stuurman@hccnet.nl)
############################################################################
# studenteditor.php: last changed 04/10/2006  , version: 2.4.10
#                  by Fred Stuurman (fc.stuurman@hccnet.nl)
#$Id: studenteditor.php,v 1.2 2006/10/15 19:08:54 fstuurman Exp $
############################################################################
#                        LICENSE INFORMATION
# Copyright (C) 2002 - 2006 Municipality of Amsterdam, City District
#  'de Baarsjes', Amsterdam, the Netherlands.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
##############################################################################
define('IN_SAS', true);

if (IsSet ($_GET['editpage']))
{
	$edit_page = intval($_GET['editpage']);
}
else
{
	$edit_page = "";
}

if (IsSet ($_GET['savepage']))
{
	$save_page = intval($_GET['savepage']);
}

include ("../../configuration/database.inc.php"); // connecting to database
mysql_connect("$db_server", "$db_username", "$db_password");
mysql_select_db("$db_name");

require ("../../core/session.php"); //build a session
include ("../../core/common.inc.php"); //include common functions

$query = "SELECT config_value FROM $table_configuration WHERE config_key='sessioncode'";
if ($result = mysql_query($query))
{
	$check_sessioncode = mysql_result($result, 0);
	unset ($query);
	unset ($result);
}

if ($_SESSION['sessioncode'] != "$check_sessioncode")
{
	//if we don't have a session present the login screen
	Header("Location: ../../../index.php");
	exit;
}
else
{

	$query = "SELECT config_value FROM $table_configuration WHERE config_key='language'";
	$result = mysql_query($query) or die_script($query, mysql_error());
	$sas_language = mysql_result($result, 0);
	include ("../../languages/$sas_language/$sas_language.php");
	unset ($query);
	unset ($result);

	$query = "SELECT config_key,config_value FROM $table_configuration WHERE config_key NOT LIKE 'agenda%'";
	//read all the configuration items
	$result = mysql_query($query) or die_script($query, mysql_error());
	while ($config_list = mysql_fetch_array($result))
	{
		$sas_config[$config_list[0]] = $config_list[1];
		//put them in the config array
	}

	$query = "SELECT name, project FROM $table_users WHERE id='$_SESSION[userid]'"; // getting the studentname
	$result = mysql_query($query) or die_script($query, mysql_error());
	$student_name = mysql_result($result, 0, 0);
	$student_project = mysql_result($result, 0, 1);
	$project_array = explode(",", $student_project); //create an array
	unset ($query);
	unset ($result);

	if (IsSet ($save_page))
	{
		if (IsSet ($_POST['title']))
		{
			$title = sql_addslashes(strip_tags($_POST['title']));
		}
		if (IsSet ($_POST['order']))
		{
			$order = sql_addslashes($_POST['order']);
		}
		if (IsSet ($_POST['invisible']))
		{
			$invisible = sql_addslashes($_POST['invisible']);
		}
		if (IsSet ($_POST['check']))
		{
			$check = sql_addslashes($_POST['check']);
		}

		if (IsSet ($_POST['newcontent']))
		{
			$newcontent = sql_addslashes($_POST['newcontent']);
		}

		if ($title != "")
		{
			mysql_query("UPDATE $table_studentpages SET title='$title' WHERE studentid='" . $save_page . "'");
		}

		mysql_query("UPDATE $table_studentpages SET invisible='$invisible' WHERE studentid='" . $save_page . "'");
	}

	if ((IsSet ($save_page)) and ($_SESSION[usertype] == "teacher"))
	{
		mysql_query("UPDATE $table_studentpages SET content='$newcontent' WHERE studentid='" . $save_page . "'");
		mysql_query("UPDATE $table_studentpages SET pcheck='$check', sort='$order' WHERE studentid='" . $save_page . "'");
		print "<script type=\"text/javascript\">
				alert (\"" . $sas_lang['student_page_save'] . "\");
				window.close();
				</script>";
	}
	elseif ((IsSet ($save_page)) and ($_SESSION[usertype] == "student"))
	{
		require ("../../core/class.phpmailer.php"); //use the phpmailer class

		if ($newcontent != "")
		{
			$query = "SELECT dir_number, pcheck, send_email, change_date FROM $table_studentpages WHERE studentid='" . $save_page . "'";
			$result = mysql_query($query) or die_script($query, mysql_error()); //get check bit, email bit and change date
			$project_id = mysql_result($result, 0, 0);
			$check = mysql_result($result, 0, 1);
			$send_email = mysql_result($result, 0, 2);
			$change_date = mysql_result($result, 0, 3);
			unset ($query);
			unset ($result);
			$d = date("Y-m-d");
			mysql_query("UPDATE $table_studentpages SET change_date='$d', sort='$order' WHERE studentid='" . $save_page . "'");

			$query = "SELECT class, email FROM $table_users WHERE id='$_SESSION[userid]'"; //get the student class and email
			$result = mysql_query($query) or die_script($query, mysql_error());
			$class = mysql_result($result, 0, 0);
			$student_email = mysql_result($result, 0, 1);
			$query = "SELECT class FROM $table_users WHERE id = '" . $project_id . "'"; //get the student project
			$result = mysql_query($query) or die_script($query, mysql_error());
			$project = mysql_result($result, 0, 0);
			unset ($query);
			unset ($result);
			$query = "SELECT project, name FROM $table_classes WHERE id = '" . $project . "'"; //are we a project or pupil
			$result = mysql_query($query) or die_script($query, mysql_error());
			$project = mysql_result($result, 0, 0);
			$class_name = mysql_result($result, 0, 1); //get the student class/project name
			unset ($query);
			unset ($result);
			$query = "SELECT email FROM $table_users 
							WHERE (class LIKE '%,$class,%' OR class like '$class,%' OR class like '%,$class' OR class like '$class' OR
							project LIKE '%,$project,%' OR project like '$project,%' OR project like '%,$project' OR project like '$project')
							AND (type = 2 OR type = 22) AND email != ''";

			//get the teachers email
			$result = mysql_query($query) or die_script($query, mysql_error());
			if (mysql_num_rows($result) > 0)
			{
				while ($teacher_email_list = mysql_fetch_array($result))
				{
					$teacher_email .= $teacher_email_list[0] . ",";
				}
				$teacher_email = substr($teacher_email, 0, -1); //strip last comma
			}
			unset ($query);
			unset ($result);
			if ($title != "")
			{
				mysql_query("UPDATE $table_studentpages SET title='$title', change_date='$d', approved = '' WHERE studentid='" . $save_page . "'");
			}

			if ($check == "0")
			{
				mysql_query("UPDATE $table_studentpages SET content='$newcontent' WHERE studentid='" . $save_page . "'");
			}
			else
			{
				if (($teacher_email != "") and ($change_date < $d))
				{
					$msg = "<html><body>";
					$msg .= nl2br($sas_lang['student_email_message1'] . "\n" . $student_name . "\n" . $sas_lang['email'] . " : " . $student_email);
					$msg = str_replace("%title%", $title, $msg);

					if ($project == 1) //we have a project here
					{
						$type = $sas_lang['student_project'];
					}
					else
					{
						$type = $sas_lang['student'];
					}
					$msg = str_replace("%type%", $type, $msg);
					$msg .= "</body></html>";
					$mail = new PHPMailer();
					$mail->From = $sas_config['email']; //site email address
					$mail->FromName = $sitename;
					$mail->Subject = $sas_lang[student_page_check] . " " . $student_name;
					$mail->Body = $msg;
					$mail->IsHTML(true);
					$mail->AddAddress($teacher_email); //add email address teacher.
					$mail->Send();
				}
				mysql_query("UPDATE $table_studentpages SET newcontent='$newcontent' WHERE studentid='$save_page'");
			}
			if (($teacher_email != "") and ($send_email == "1") and ($change_date < $d))
			{ //get the page and section number for the pupilpages
				$result = mysql_query("SELECT id, section FROM $table_pages WHERE name='" . $class_name . "' AND module='sn_studentpages/viewpage2.php'");
				if (mysql_num_rows($result) > 0)
				{
					$student_pages = mysql_result($result, 0, 0);
					$student_section = mysql_result($result, 0, 1);
				}
				else
				{
					$result = mysql_query("SELECT id, section FROM $table_pages WHERE module='sn_studentpages/viewpage.php'");
					$student_pages = mysql_result($result, 0, 0);
					$student_section = mysql_result($result, 0, 1);
				}
				if (mysql_num_rows($result) > 0)
				{
					$link = "<a href=\"" . $sas_config['url'] . "index.php?section=$student_section&page=$student_pages&student=$save_page&name=$student_name\">" . $sas_config['url'] . "index.php?section=$student_section&page=$student_pages&student=$save_page&name=$student_name</a>";
				}
				$msg = "<html><body>" . $sas_lang['student_email_message2'] . "\n" . $student_name . "<br>" . $sas_lang['email'] . " : " . $student_email;
				$msg = nl2br($msg);
				$msg = str_replace("%title%", $title, $msg);
				$msg = str_replace("%link%", $link, $msg);
				$msg .= "</body></html>";
				$mail = new PHPMailer();
				$mail->From = $sas_config['email']; //site email address
				$mail->FromName = $sitename;
				$mail->Subject = $sas_lang['student_pages'] . ": " . $student_name . " " . $sas_lang['title'] . ": " . $title;
				$mail->Body = $msg;
				$mail->IsHTML(true);
				$mail->AddAddress($teacher_email); //add email address teacher.
				$mail->Send();
			}
			//update the last change date in pages table
			if ($project == 1) //we have a project here
			{
				mysql_query("UPDATE $table_pages SET lastupdate='$d' WHERE module = 'sn_studentpages/viewproject.php' AND name = '$class_name'");
			}
			else
			{
				mysql_query("UPDATE $table_pages SET lastupdate='$d' WHERE module = 'sn_studentpages/viewpage.php'");
				mysql_query("UPDATE $table_pages SET lastupdate='$d' WHERE module = 'sn_studentpages/viewpage2.php' AND name = '" . $class_name . "'");
			}
		}

		print "<script type=\"text/javascript\">
					alert (\"" . $sas_lang['student_page_save'] . "\");
					window.close();
					</script>";
	}

	$server_path = $sas_config['serverpath'];
	$user_path = $sas_config['user_path'];
	$media = $sas_config['media_dir'];

	$query = "SELECT dir_number FROM $table_studentpages WHERE studentid ='" . $edit_page . "'";
	$result = mysql_query($query) or die_script($query, mysql_error()); //get the  project id!
	$student_id = mysql_result($result, 0);

	$query = "SELECT id FROM $table_users WHERE id = '" . $student_id . "' AND type = '0'";
	$result = mysql_query($query) or die_script($query, mysql_error()); //check if student has a project assigned!
	if (mysql_num_rows($result) > 0)
	{
		$project_id = mysql_result($result, 0);
	}
	else
	{
		$project_id = "";
	}
	$query = "SELECT studentid, approved FROM $table_studentpages 
	              WHERE studentid='$edit_page' AND (dir_number='$_SESSION[userid]' OR dir_number = '" . $project_id . "')";
	//approved field is used to hold the userid owning the pupil page.

	$result = mysql_query($query) or die_script($query, mysql_error()); //check if student is owner of this page!
	if (mysql_num_rows($result) > 0)
	{
		$userid_in_use = mysql_result($result, 0, 1);
		$ses_table = $dbprefix . "sessions";
		$str_len = strlen($userid_in_use);
		$ses_value = "%userid|s:$str_len:\"" . $userid_in_use . "\";%";
		$result1 = mysql_query("SELECT ses_id FROM $ses_table WHERE ses_value like '" . $ses_value . "'");

		//check to see if userid holding the page still has a session
		if (mysql_num_rows($result1) == 0)
		{
			mysql_query("UPDATE $table_studentpages SET approved = '' WHERE studentid='" . $edit_page . "'");
			$userid_in_use = ''; //no session , reset approved field.
		}
		if (($userid_in_use == '') OR ($userid_in_use == $_SESSION['userid'])) //nobody is holding the page
		{
			$query = "SELECT title, newcontent, invisible, sort, pcheck FROM $table_studentpages WHERE studentid='" . $edit_page . "'";
			$result = mysql_query($query) or die_script($query, mysql_error()); // getting the title, newcontent
			$title = mysql_result($result, 0, 0);
			$content = mysql_result($result, 0, 1);
			$invisible = mysql_result($result, 0, 2);
			$order = mysql_result($result, 0, 3);
			$pcheck = mysql_result($result, 0, 4);

			unset ($query);
			unset ($result);
			if ($content == "")
			{
				$query = "SELECT content FROM $table_studentpages WHERE studentid='" . $edit_page . "'"; // getting the content
				$result = mysql_query($query) or die_script($query, mysql_error());
				$content = mysql_result($result, 0);
				unset ($query);
				unset ($result);
			}
			mysql_query("UPDATE $table_studentpages SET approved = '$_SESSION[userid]' WHERE studentid='" . $edit_page . "'");
		}
		else
		{
			$query = "SELECT name FROM $table_users WHERE id = '" . $userid_in_use . "'";
			$result = mysql_query($query);
			$pupil_name = mysql_result($result, 0);
			$msg = str_replace("%user_name%", $pupil_name, $sas_lang['page_in_use']);
			print $msg;
			print "<br><br><span class=\"link\"><a href='javascript:window.close();'><< " . $sas_lang['goback'] . "</a></span><br>";
			exit;
		}
	}
	$template_path = $server_path . $user_path . "/" . $media . "/templates";

	if (IsSet ($_GET['template']))
	{
		$filename = $template_path . "/" . $_GET['template'];
		if (file_exists($filename))
		{
			$handle = fopen($filename, "r");
			$content = fread($handle, filesize($filename));
			fclose($handle);
		}
	}

	print "</head><body TOPMARGIN=0 LEFTMARGIN=0 MARGINWIDTH=0 MARGINHEIGHT=0>";

	$_SESSION['editpage'] = $edit_page; //used for image browser plugin to go to the right (project) directory
	include ("fckeditor.php");

	print "<FORM METHOD=\"POST\" NAME=\"form\" ACTION=\"studenteditor.php?savepage=$edit_page\">
	<table class=\"ToolBar\" id=\"idToolbar\" cellSpacing=\"0\" cellPadding=\"0\" width=\"100%\" border=\"0\">
	<tbody>
	<tr style=\"background:ButtonFace\">
	<td colspan=\"18\" height=\"28\" valign=\"bottom\">";

	print "<span class=text>&nbsp;" . $sas_lang['title'] . ":&nbsp;</span>
	      <input type=\"text\" name=\"title\" size=\"40\" value=\"$title\">
		  <span class=text>&nbsp;" . $sas_lang['order'] . ":&nbsp;</span>
	      <input type=\"text\" name=\"order\" size=\"4\" value=\"$order\">
	      <input type=\"hidden\" name=\"approved\" value=\"$approved\">";

	if (is_dir($template_path))
	{
		print "&nbsp;&nbsp;" . $sas_lang['template'] . ":&nbsp;&nbsp;<select size=\"1\" name=\"template\" 
			onchange=\"parent.location.href='studenteditor.php?option=editpage&editpage=$edit_page&template=' + this.options[this.selectedIndex].value\">>\n";
		$dir_handle = @ opendir($template_path);
		print "<option value=\"" . $sas_lang['choose_one'] . "\">" . $sas_lang['choose_one'] . "</option>";
		while ($file = readdir($dir_handle))
		{
			//if($file != ".." AND $file != "." AND $file != "/")
			if ((eregi('.html', $file)) OR (eregi('.htm', $file)))
			{
				echo "<option value=\"$file\">$file</option>";
			}

		}
		closedir($dir_handle);
		print "</select>";
	}
	if ($invisible == 1)
	{
		print "&nbsp;&nbsp;<input type=\"checkbox\" name=\"invisible\" value=\"1\" checked>" . $sas_lang['invisible'];
	}
	else
	{
		print "&nbsp;&nbsp;<input type=\"checkbox\" name=\"invisible\" value=\"1\">" . $sas_lang['invisible'];
	}
	print "</tr><tr valign=\"center\"><td>";
	$height = $sas_config['htmlarea_editor_rows'] * 18 + 75;
	$fck_lang = strtolower($sas_config[language]);
	$oFCKeditor = new FCKeditor('newcontent');
	$oFCKeditor->BasePath = '';
	$oFCKeditor->Config['DefaultLanguage'] = "$fck_lang";
	$oFCKeditor->Width = '100%';
	$oFCKeditor->Height = $height;
	$oFCKeditor->Value = $content;
	$oFCKeditor->Create();

	print "</td><tr></table>";
	print "<table width=\"100%\" border=\"0\"><tr>";

	if ($_SESSION['usertype'] == "teacher")
	{
		print "<td width=\"30%\">" . $sas_lang['page_on'] . " &nbsp;&nbsp;&nbsp;" . $sas_lang['teacher_pages'] . "</td>";
		if ($pcheck == "1")
		{
			print "<td><input type=\"radio\" value=\"1\" name=\"check\" checked></td>";
			print "<td width=\"30%\" align=\"right\">&nbsp;&nbsp;&nbsp;" . $sas_lang['student_pages'] . "</td>";
			print "<td><input type=\"radio\" name=\"check\" value=\"0\"></td>";
			print "<td width=\"30%\" align=\"right\">&nbsp;&nbsp;&nbsp;" . $sas_lang['both'] . "</td>";
			print "<td><input type=\"radio\" name=\"check\" value=\"2\"></td>";
		}
		elseif ($pcheck == "0")
		{
			print "<td><input type=\"radio\" value=\"1\" name=\"check\"></td>";
			print "<td width=\"30%\" align=\"right\">&nbsp;&nbsp;&nbsp;" . $sas_lang['student_pages'] . "</td>";
			print "<td><input type=\"radio\" name=\"check\" value=\"0\" checked></td>";
			print "<td width=\"30%\" align=\"right\">&nbsp;&nbsp;&nbsp;" . $sas_lang['both'] . "</td>";
			print "<td><input type=\"radio\" name=\"check\" value=\"2\"></td>";
		}
		else
		{
			print "<td><input type=\"radio\" value=\"1\" name=\"check\"></td>";
			print "<td width=\"30%\" align=\"right\">&nbsp;&nbsp;&nbsp;" . $sas_lang['student_pages'] . "</td>";
			print "<td><input type=\"radio\" name=\"check\" value=\"0\"></td>";
			print "<td width=\"30%\" align=\"right\">&nbsp;&nbsp;&nbsp;" . $sas_lang['both'] . "</td>";
			print "<td><input type=\"radio\" name=\"check\" value=\"2\"  checked></td>";
		}

		print "<tr>";
	}

	print "<tr><td align=\"right\" colspan=\"6\"><input type=\"button\" value=\"&nbsp;&nbsp;" . $sas_lang['cancel'] . "\" name=\"backbutton\" 
			onClick=\"javascript:window.close();\" class=\"backbutton\">";
	print "&nbsp;<input type=\"submit\" value=\"&nbsp;&nbsp;" . $sas_lang['save'] . "\" name=\"savebutton\" class=\"savebutton\">&nbsp;&nbsp;</form></td>";
	print "</tr></table>";
}
?>