<commit_before><?php
/*******************************************************************************
*
*  filename    : UserEditor.php
*  description : form for adding and editing users
*
*  http://www.churchdb.org/
*  Copyright 2001-2002 <NAME>, <NAME>
* 
*  Updated 2005-03-19 by <NAME>: Updated to remove error that could be created
*  by use of duplicate usernames
*
*  Additional Contributors:
*  2006 <NAME>
*
*  LICENSE:
*  (C) Free Software Foundation, Inc.
*
*  ChurchInfo is free software; you can redistribute it and/or modify
*  it under the terms of the GNU General Public License as published by
*  the Free Software Foundation; either version 3 of the License, or
*  (at your option) any later version.
*
*  This program is distributed in the hope that it will be useful, but
*  WITHOUT ANY WARRANTY; without even the implied warranty of
*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
*  General Public License for more details.
*
*  http://www.gnu.org/licenses
*
*
*  This file best viewed in a text editor with tabs stops set to 4 characters.
*  Please configure your editor to use soft tabs (4 spaces for a tab) instead
*  of hard tab characters.
*
******************************************************************************/
// Include the function library
require 'Include/Config.php';
require 'Include/Functions.php';

// Security: User must be an Admin to access this page.
// Otherwise re-direct to the main menu.
if (!$_SESSION['bAdmin'])
{
    Redirect('Menu.php');
    exit;
}

$iPersonID = -1;
$vNewUser = false;
$bShowPersonSelect = false;

// Get the PersonID out of either querystring or the form, depending and what we're doing
if (isset($_GET['PersonID'])) {
    $iPersonID = FilterInput($_GET['PersonID'],'int');
    $bNewUser = false;

} elseif (isset($_POST['PersonID'])) {
    $iPersonID = FilterInput($_POST['PersonID'],'int');
    $bNewUser = false;

} elseif (isset($_GET['NewPersonID'])) {
    $iPersonID = FilterInput($_GET['NewPersonID'],'int');
    $bNewUser = true;
}

if (isset($_GET['ErrorText'])){
    $sErrorText = FilterInput($_GET['ErrorText'],'string');
}else{
    $sErrorText = '';   
}

//Value to help determine correct return state on error
if (isset($_POST['NewUser'])){
    $NewUser = FilterInput($_POST['NewUser'],'string');
    }

// Has the form been submitted?
if (isset($_POST['save']) && $iPersonID > 0) {

    // Assign all variables locally
    $sAction = $_POST['Action'];

    $defaultFY = CurrentFY ();
    $sUserName = FilterInput($_POST['UserName']);
    
     if (strlen($sUserName) < 3) 
    {   
        if($NewUser == false)
        {
        //Report error for current user creation
        Redirect('UserEditor.php?PersonID='.$iPersonID.'&ErrorText=Login must be a least 3 characters!');
        
        }else{
        //Report error for new user creation            
        Redirect('UserEditor.php?NewPersonID='.$iPersonID.'&ErrorText=Login must be a least 3 characters!');
        }
        
        
    }else{
    if (isset($_POST['AddRecords'])) { $AddRecords = 1; } else { $AddRecords = 0; }
    if (isset($_POST['EditRecords'])) { $EditRecords = 1; } else { $EditRecords = 0; }
    if (isset($_POST['DeleteRecords'])) { $DeleteRecords = 1; } else { $DeleteRecords = 0; }
    if (isset($_POST['MenuOptions'])) { $MenuOptions = 1; } else { $MenuOptions = 0; }
    if (isset($_POST['ManageGroups'])) { $ManageGroups = 1; } else { $ManageGroups = 0; }
    if (isset($_POST['Finance'])) { $Finance = 1; } else { $Finance = 0; }
    if (isset($_POST['Notes'])) { $Notes = 1; } else { $Notes = 0; }
    if (isset($_POST['EditSelf'])) { $EditSelf = 1; } else { $EditSelf = 0; }
    if (isset($_POST['Canvasser'])) { $Canvasser = 1; } else { $Canvasser = 0; }

    $Communication = 0;

    if (isset($_POST['Admin'])) { $Admin = 1; } else { $Admin = 0; }
    $Style = FilterInput($_POST['Style']);

    // Initialize error flag
    $bErrorFlag = false;

    // Were there any errors?
    if (!$bErrorFlag) {
        
        //Check for duplicate user names
        $unSQL = "Select Count(*) as dup from user_usr where usr_UserName like '".
                 $sUserName."' and usr_per_ID not like '".$iPersonID."'";
     
       // Execute the SQL
       $unQueryResult = RunQuery($unSQL);
       //Extract Value, if greater than 0 for add error, greater than 1 for add then error
       $unQueryResultSet = mysql_fetch_array($unQueryResult);
       $undupCount = $unQueryResultSet['dup'];

        // Write the SQL depending on whether we're adding or editing
        if ($sAction == 'add'){
                                    
                            if ($undupCount == 0) {
                                $sSQL = "INSERT INTO user_usr (usr_per_ID, usr_Password, usr_NeedPasswordChange, usr_LastLogin, usr_AddRecords, usr_EditRecords, usr_DeleteRecords, usr_MenuOptions, usr_ManageGroups, usr_Finance, usr_Notes, usr_Communication, usr_Admin, usr_Style, usr_SearchLimit, usr_defaultFY, usr_UserName, usr_EditSelf, usr_Canvasser) VALUES (" . $iPersonID . ",'" . md5($sDefault_Pass) . "',1,'" . date("Y-m-d H:i:s") . "', " . $AddRecords . ", " . $EditRecords . ", " . $DeleteRecords . ", " . $MenuOptions . ", " . $ManageGroups . ", " . $Finance . ", " . $Notes . ", " . $Communication . ", " . $Admin . ", '" . $Style . "', 10," . $defaultFY . ",\"" . $sUserName . "\"," . $EditSelf . "," . $Canvasser . ")";
                            // Execute the SQL
                            RunQuery($sSQL);

                            }else{
                            // Set the error text for duplicate when new user
                            Redirect('UserEditor.php?NewPersonID='.$PersonID.'&ErrorText=Login already in use, please select a different login!');
                            }
        } else{
        
        if ($undupCount == 0) {
                    $sSQL =  "UPDATE user_usr SET usr_AddRecords = " . $AddRecords . ", usr_EditRecords = " . $EditRecords . ", usr_DeleteRecords = " . $DeleteRecords . ", usr_MenuOptions = " . $MenuOptions . ", usr_ManageGroups = " . $ManageGroups . ", usr_Finance = " . $Finance . ", usr_Notes = " . $Notes . ", usr_Communication = " . $Communication . ", usr_Admin = " . $Admin . ", usr_Style = \"" . $Style . "\", usr_UserName = \"" . $sUserName . "\", usr_EditSelf = " . $EditSelf . "\", usr_Canvasser = " . $Canvasser . " WHERE usr_per_ID = " . $iPersonID;
                    // Execute the SQL
                    RunQuery($sSQL);

                }else{
                    // Set the error text for duplicate when currently existing
                    Redirect('UserEditor.php?PersonID='.$iPersonID.'&ErrorText=Login already in use, please select a different login!');<commit_msg>Missing quote in update statement.<commit_after><?php
/*******************************************************************************
*
*  filename    : UserEditor.php
*  description : form for adding and editing users
*
*  http://www.churchdb.org/
*  Copyright 2001-2002 <NAME>, <NAME>
* 
*  Updated 2005-03-19 by <NAME>: Updated to remove error that could be created
*  by use of duplicate usernames
*
*  Additional Contributors:
*  2006 <NAME>
*
*  LICENSE:
*  (C) Free Software Foundation, Inc.
*
*  ChurchInfo is free software; you can redistribute it and/or modify
*  it under the terms of the GNU General Public License as published by
*  the Free Software Foundation; either version 3 of the License, or
*  (at your option) any later version.
*
*  This program is distributed in the hope that it will be useful, but
*  WITHOUT ANY WARRANTY; without even the implied warranty of
*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
*  General Public License for more details.
*
*  http://www.gnu.org/licenses
*
*
*  This file best viewed in a text editor with tabs stops set to 4 characters.
*  Please configure your editor to use soft tabs (4 spaces for a tab) instead
*  of hard tab characters.
*
******************************************************************************/
// Include the function library
require 'Include/Config.php';
require 'Include/Functions.php';

// Security: User must be an Admin to access this page.
// Otherwise re-direct to the main menu.
if (!$_SESSION['bAdmin'])
{
    Redirect('Menu.php');
    exit;
}

$iPersonID = -1;
$vNewUser = false;
$bShowPersonSelect = false;

// Get the PersonID out of either querystring or the form, depending and what we're doing
if (isset($_GET['PersonID'])) {
    $iPersonID = FilterInput($_GET['PersonID'],'int');
    $bNewUser = false;

} elseif (isset($_POST['PersonID'])) {
    $iPersonID = FilterInput($_POST['PersonID'],'int');
    $bNewUser = false;

} elseif (isset($_GET['NewPersonID'])) {
    $iPersonID = FilterInput($_GET['NewPersonID'],'int');
    $bNewUser = true;
}

if (isset($_GET['ErrorText'])){
    $sErrorText = FilterInput($_GET['ErrorText'],'string');
}else{
    $sErrorText = '';   
}

//Value to help determine correct return state on error
if (isset($_POST['NewUser'])){
    $NewUser = FilterInput($_POST['NewUser'],'string');
    }

// Has the form been submitted?
if (isset($_POST['save']) && $iPersonID > 0) {

    // Assign all variables locally
    $sAction = $_POST['Action'];

    $defaultFY = CurrentFY ();
    $sUserName = FilterInput($_POST['UserName']);
    
     if (strlen($sUserName) < 3) 
    {   
        if($NewUser == false)
        {
        //Report error for current user creation
        Redirect('UserEditor.php?PersonID='.$iPersonID.'&ErrorText=Login must be a least 3 characters!');
        
        }else{
        //Report error for new user creation            
        Redirect('UserEditor.php?NewPersonID='.$iPersonID.'&ErrorText=Login must be a least 3 characters!');
        }
        
        
    }else{
    if (isset($_POST['AddRecords'])) { $AddRecords = 1; } else { $AddRecords = 0; }
    if (isset($_POST['EditRecords'])) { $EditRecords = 1; } else { $EditRecords = 0; }
    if (isset($_POST['DeleteRecords'])) { $DeleteRecords = 1; } else { $DeleteRecords = 0; }
    if (isset($_POST['MenuOptions'])) { $MenuOptions = 1; } else { $MenuOptions = 0; }
    if (isset($_POST['ManageGroups'])) { $ManageGroups = 1; } else { $ManageGroups = 0; }
    if (isset($_POST['Finance'])) { $Finance = 1; } else { $Finance = 0; }
    if (isset($_POST['Notes'])) { $Notes = 1; } else { $Notes = 0; }
    if (isset($_POST['EditSelf'])) { $EditSelf = 1; } else { $EditSelf = 0; }
    if (isset($_POST['Canvasser'])) { $Canvasser = 1; } else { $Canvasser = 0; }

    $Communication = 0;

    if (isset($_POST['Admin'])) { $Admin = 1; } else { $Admin = 0; }
    $Style = FilterInput($_POST['Style']);

    // Initialize error flag
    $bErrorFlag = false;

    // Were there any errors?
    if (!$bErrorFlag) {
        
        //Check for duplicate user names
        $unSQL = "Select Count(*) as dup from user_usr where usr_UserName like '".
                 $sUserName."' and usr_per_ID not like '".$iPersonID."'";
     
       // Execute the SQL
       $unQueryResult = RunQuery($unSQL);
       //Extract Value, if greater than 0 for add error, greater than 1 for add then error
       $unQueryResultSet = mysql_fetch_array($unQueryResult);
       $undupCount = $unQueryResultSet['dup'];

        // Write the SQL depending on whether we're adding or editing
        if ($sAction == 'add'){
                                    
                            if ($undupCount == 0) {
                                $sSQL = "INSERT INTO user_usr (usr_per_ID, usr_Password, usr_NeedPasswordChange, usr_LastLogin, usr_AddRecords, usr_EditRecords, usr_DeleteRecords, usr_MenuOptions, usr_ManageGroups, usr_Finance, usr_Notes, usr_Communication, usr_Admin, usr_Style, usr_SearchLimit, usr_defaultFY, usr_UserName, usr_EditSelf, usr_Canvasser) VALUES (" . $iPersonID . ",'" . md5($sDefault_Pass) . "',1,'" . date("Y-m-d H:i:s") . "', " . $AddRecords . ", " . $EditRecords . ", " . $DeleteRecords . ", " . $MenuOptions . ", " . $ManageGroups . ", " . $Finance . ", " . $Notes . ", " . $Communication . ", " . $Admin . ", '" . $Style . "', 10," . $defaultFY . ",\"" . $sUserName . "\"," . $EditSelf . "," . $Canvasser . ")";
                            // Execute the SQL
                            RunQuery($sSQL);

                            }else{
                            // Set the error text for duplicate when new user
                            Redirect('UserEditor.php?NewPersonID='.$PersonID.'&ErrorText=Login already in use, please select a different login!');
                            }
        } else{
        
        if ($undupCount == 0) {
                    $sSQL =  "UPDATE user_usr SET usr_AddRecords = " . $AddRecords . ", usr_EditRecords = " . $EditRecords . ", usr_DeleteRecords = " . $DeleteRecords . ", usr_MenuOptions = " . $MenuOptions . ", usr_ManageGroups = " . $ManageGroups . ", usr_Finance = " . $Finance . ", usr_Notes = " . $Notes . ", usr_Communication = " . $Communication . ", usr_Admin = " . $Admin . ", usr_Style = \"" . $Style . "\", usr_UserName = \"" . $sUserName . "\", usr_EditSelf = \"" . $EditSelf . "\", usr_Canvasser = " . $Canvasser . " WHERE usr_per_ID = " . $iPersonID;
                    // Execute the SQL
                    RunQuery($sSQL);

                }else{
                    // Set the error text for duplicate when currently existing
                    Redirect('UserEditor.php?PersonID='.$iPersonID.'&ErrorText=Login already in use, please select a different login!');
{'fraction_non_alphanumeric': 0.16798579776610695, 'fraction_numerical': 0.008432576373992159, 'mean_word_length': 2.709190672153635, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 13, 'https://': 0, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6506803', 'n_tokens_mistral': 4186, 'n_tokens_neox': 4005, 'n_words': 1135}