<?php

#############################################################################
#           			                   Site@School
# Site@School is a website management system designed for primary schools.

# About Site@School:
# Comissioned by: City District 'de Baarsjes', Amsterdam, Netherlands
# Original idea, coding (version 1.0) and design : Mark de Haan (mark@starwave.nl)
# Ideas, improvements, expansions (version 1.1 - 2.4): Fred Stuurman
# Current coder & maintainer: Fred Stuurman (fc.stuurman@hccnet.nl)
############################################################################
# teacher.php: last changed 07/04/2006   2.4
# by Fred Stuurman (fc.stuurman@hccnet.nl)
#$Id: teacher.php,v 1.2 2006/10/15 19:08:54 fstuurman Exp $
############################################################################
#                        LICENSE INFORMATION
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
##############################################################################
if (!defined('IN_SAS'))
{
	die("Hacking attempt");
}

$height = $sas_config['htmlarea_editor_rows'] * 20 + 135;

print "<script type=\"text/javascript\">
function NewWindow (link) 
{
var win_left = (screen.width - 780) / 2;
var win_top = (screen.height - $height) / 2;
  window1 = window.open(link, \"Pupileditor\", \"width=780,height=$height,resizable=yes,scrollbars=no\");
  window1.moveTo(win_left,win_top)
  window1.focus();
}

function checkinput ( form )
{
   if (form.fullname.value == '') 
    {
    alert( \"".$sas_lang['input_error']."\" );
    form.fullname.focus();
    return false ;
    }
    if (form.username.value == '') 
    {
    alert( \"".$sas_lang['input_error']."\" );
    form.username.focus();
    return false ;
    }
    if (form.password.value == '') 
    {
    alert( \"".$sas_lang['input_error']."\" );
    form.password.focus();
    return false ;
    }
	if ((document.form.send_email[0].checked==true) && (document.form.check[0].checked==true))
	{
	alert(\"".$sas_lang['student_project_warning']."\");
	return false ;
	}
  return true ;
}
</script>";		

$num_pages = $sas_config['number_pupilpages']; //get the max number of pupilpages
$d = date("Y-m-d"); //todays date

if (IsSet ($createpage)) //create a pupils page 
{
	$query2 = "SELECT pcheck, send_email FROM $table_studentpages WHERE dir_number='$createpage'"; //get number of pages
	$result2 = mysql_query($query2) or die_script($query2, mysql_error());
	$num_rows = mysql_num_rows($result2);

	if ($num_rows > 0) //there are previous pages
	{
		$check = mysql_result($result2, 0, 'pcheck'); //get the previous pcheck and send_email values
		$send = mysql_result($result2, 0, 'send_email');
	}
	else
	{
		$check = 1; //use default 1
		$send = 0;
	}
	if ($option == "project")
	{
		mysql_query("INSERT INTO $table_studentpages VALUES ('', '', '', '$check', '0', '$send', '[$create]', '$createpage', '$d', '$create' , 0)");
	}
	elseif ($num_rows < $num_pages) //not more than the maximum defined pages.
	{
		mysql_query("INSERT INTO $table_studentpages VALUES ('', '', '', '$check', '0', '$send', '[$create]', '$createpage', '$d' , '$create' , 0)");

		$custompath = $serverpath . "/studentpages/$createpage";
		if (!is_dir($custompath))
		{
			mkdir($custompath, 0755); //create directory 
			chmod($custompath, octdec($perm)); //chmod it with permissions stored in configuration table.
		}
	}
}

if (IsSet ($deletepage))
{
	$query2 = "SELECT dir_number FROM $table_studentpages WHERE studentid='$deletepage'"; //get the dir_number
	$result2 = mysql_query($query2) or die_script($query2, mysql_error());
	$dir_number = mysql_result($result2, 0);
	unset ($query2);
	unset ($result2);
	mysql_query("delete FROM $table_studentpages where studentid='$deletepage'"); //delete page from table
	$query2 = "SELECT * FROM $table_studentpages WHERE dir_number='$dir_number'"; //are there any pages left
	$result2 = mysql_query($query2) or die_script($query2, mysql_error());
	$num_rows = mysql_num_rows($result2);

	if ($num_rows == 0) // no pages left delete directory
	{
		$custompath = $serverpath . "/studentpages/$dir_number";
		if (is_dir($custompath))
		{
			if (is_empty_folder($custompath) === TRUE)
			{
				rmdir($custompath); //delete the directory
			}
			else
			{
				print "<script language=\"Javascript\">
								   <!--
								   alert (\"" . $sas_lang['directory'] . " studentpages/" . $dir_number . " " . $sas_lang['directory_not_empty'] . "\");
								   //-->
								   </script>";
			}
		}
	}
}

if (IsSet ($savestudent))
{
	$query = mysql_query("SELECT username FROM $table_users WHERE username = '$username'");
	$results = mysql_num_rows($query) or die_script($query, mysql_error());
	if ($results != '0')
	{
		print "<span class=\"error\"><br>" . $sas_lang['student_name_exists'] . "<br><br></span>";
	}
	else
	{
		if ($sas_config[use_encryption] == 1) //passwords are encrypted
		{
			$password = md5($password);
		}
		mysql_query("INSERT INTO $table_users (id, username, password, name, class, type, email, access, highvisibility) VALUES (NULL, '$username', '$password',  '$fullname', '$class1', '1', '$email', '000000000000,000000000000', '0')");
		$query = "SELECT id FROM $table_users WHERE username='$username'"; //get the id of new student
		$result = mysql_query($query) or die_script($query, mysql_error());
		$student_id = mysql_result($result, 0);
		unset ($query);
		unset ($result);
		mysql_query("INSERT INTO $table_studentpages VALUES ('', '', '', '$check', '0', '$send_email', '[1]', '$student_id', '$d', '1', '0')");
		$custompath = $serverpath . "/studentpages/$student_id";
		if (!is_dir($custompath))
		{
			mkdir("$custompath", 0777);
		}
	}
}

if (IsSet ($updatepage)) // approve the studentpage
{
	mysql_query("UPDATE $table_studentpages SET 
	             content = newcontent,
	             newcontent = '' 
	             WHERE studentid='$updatepage' AND newcontent <> ''");
}

if ((IsSet ($userid)) AND ($usertype == "teacher"))
{
	if (IsSet ($viewpage)) // view the studentpage
	{
		$query = "SELECT title, newcontent FROM $table_studentpages WHERE studentid='$viewpage'";
		$result = mysql_query($query) or die_script($query, mysql_error());
		$title = mysql_result($result, 0, 'title');
		$content = mysql_result($result, 0, 'newcontent');
		unset ($query);
		unset ($result);

		if ($content == "") // we need to get the content instead of newcontent
		{
			$query = "SELECT content FROM $table_studentpages WHERE studentid='$viewpage'";
			$result = mysql_query($query) or die_script($query, mysql_error());
			$content = mysql_result($result, 0);
			unset ($query);
			unset ($result);
		}

		print "<center><span class=\"link\">" . $sas_lang['student_header'] . " <b>$name</b><br>" . $sas_lang['title'] . ": <b>$title</b></span></center>";
		$content = str_replace("../", "", $content);
		print "<table height=\"380\" border=\"0\" cellpadding=\"10\" cellspacing=\"0\" style=\"border-collapse: collapse\" bordercolor=\"#111111\" width=\"100%\"><tr><td valign=\"top\" width=\"100%\">";
		print $content;
		print "<br><br><span class=\"link\"><a href=index.php?section=$section&page=$page&new_class=$new_class><< " . $sas_lang['goback'] . "</a></span><br>";
		print "</td></tr></table>";
	}
	elseif (IsSet ($editpage))
	{
		$query = "SELECT title, content, pcheck FROM $table_studentpages WHERE studentid='$editpage'"; // getting the content
		$result = mysql_query($query) or die_script($query, mysql_error());
		$title = mysql_result($result, 0, 0);
		$content = mysql_result($result, 0, 1);
		$pcheck = mysql_result($result, 0, 2);
		unset ($query);
		unset ($result);

		include ("$cmsdir/editors/htmlarea/studenteditor.php");
	}
	else
	{
		$query = "SELECT name, type FROM $table_users WHERE id='$userid'"; // getting the teachers name
		$result = mysql_query($query) or die_script($query, mysql_error());
		$teacher_name = mysql_result($result, 0, 0);
		$user_type = mysql_result($result, 0, 1);
		unset ($query);
		unset ($result);
		if ((IsSet ($new_class)) and ($new_class != "")) // user has selected a class from the dropdownmenu
		{
			$teacher_class = $new_class;
		}
		else
		{
			$query = "SELECT class FROM $table_users WHERE id='$userid'"; // getting the teachers class
			$result = mysql_query($query) or die_script($query, mysql_error());
			$teacher_class = mysql_result($result, 0, 0);
			if (strpos($teacher_class, ",")) //if we have a comma, we only need the first class
			{
				$teacher_class = substr($teacher_class, 0, strpos($teacher_class, ","));
			}
			unset ($query);
			unset ($result);
		}

		$query = "SELECT name FROM $table_classes WHERE id='$teacher_class'"; // getting the teachers class
		$result = mysql_query($query) or die_script($query, mysql_error());
		$num_rows = mysql_num_rows($result);
		if ($num_rows > 0)
		{
			$teacher_class_name = stripslashes(mysql_result($result, 0));
		}
		unset ($query);
		unset ($result);
		$check_sessioncode = $sas_config['sessioncode'];
		$sessioncode = "$check_sessioncode";
		$_SESSION['sessioncode'] = "$sessioncode";

		if ($option == "addstudent") // Add a student
		{
			print "<center>" . $sas_lang['class'] . " : $teacher_class_name , " . $sas_lang['newstudent'] . ":<p>\n";
			print "<FORM METHOD=\"POST\" NAME=\"form\" ACTION=\"index.php?section=$section&page=$page&savestudent=yes&new_class=$new_class\"
					onsubmit=\"return checkinput(this);\"></center>";
			print "<input type=hidden name=\"class1\" value=\"$teacher_class\">";
			print "<table><tr><td align=\"right\" width=\"35%\"><b>" . $sas_lang['fullname'] . " (*):</b></td>
			                   <td><input type=text size=40 class=\"textfield\" tabindex=\"1\" name=\"fullname\" value=\"$fullname\"></td></tr>";
			print "<tr><td>&nbsp</td></tr><tr><td align=\"right\"><b>" . $sas_lang['username'] . " (*):</b></td>
			                   <td><input type=text size=20 class=\"textfield\" tabindex=\"2\" name=\"username\" value=\"$username\"></td></tr>";
			print "<tr><td>&nbsp</td></tr><tr><td align=\"right\"><b>" . $sas_lang['password'] . " (*):</b></td>
			                   <td><input type=text size=20 class=\"textfield\" tabindex=\"3\" name=\"password\" value=\"$password\"></td></tr>";
			print "<tr><td>&nbsp</td></tr><tr><td align=\"right\"><b>" . $sas_lang['email'] . ":</b></td>
			                   <td><input type=text size=50 class=\"textfield\" tabindex=\"4\" name=\"email\" value=\"$email\"></td></tr>";
			print "<tr><td>&nbsp</td></tr><tr><td colspan=\"2\"><table><tr><td><b>" . $sas_lang['student_page_check'] . " </b></td>";
			print "<td>&nbsp;&nbsp;&nbsp;" . $sas_lang['yes'] . "</td>";
			print "<td><input type=\"radio\" value=\"1\" name=\"check\"></td>";
			print "<td>&nbsp;&nbsp;&nbsp; " . $sas_lang['no'] . "</td>";
			print "<td><input type=\"radio\" name=\"check\" value=\"0\" checked></td></tr>";
			print "<tr><td><b>" . $sas_lang['student_page_email'] . " </b></td>";
			print "<td>&nbsp;&nbsp;&nbsp;" . $sas_lang['yes'] . "</td>";
			print "<td><input type=\"radio\" value=\"1\" name=\"send_email\"></td>";
			print "<td>&nbsp;&nbsp;&nbsp; " . $sas_lang['no'] . "</td>";
			print "<td><input type=\"radio\" name=\"send_email\" value=\"0\" checked></td></tr></table></td></tr>";
			print "<tr><td>&nbsp</td></tr><tr><td>&nbsp;</td><td><input type=\"button\" value=\"&nbsp;&nbsp;" . $sas_lang['goback'] . "\" name=\"backbutton\" 
			                   onClick=\"javascript:parent.location='index.php?section=$section&page=$page&new_class=$new_class';\" class=\"backbutton\">";
			print "&nbsp;<input type=\"submit\" value=\"&nbsp;&nbsp;" . $sas_lang['save'] . "\" name=\"savebutton\" class=\"savebutton\">";
			print "</form></td></tr></table>\n";
		}
		else
		{
			$query2 = "SELECT id, name FROM $table_classes ORDER BY name"; //get the classes for dropdown menu
			$result2 = mysql_query($query2) or die_script($query2, mysql_error());

			$prot_theme = $sas_config['protected_theme'];
			$table = $dbprefix . "prot_pages";
			$query = "SELECT name FROM $table";
			$result = mysql_query($query) or die_script($query, mysql_error());
			$RecordCount = mysql_num_rows($result); //see if we have pages on the intranet
			unset ($query);
			unset ($result);
			if ($teacher_class_name == "--------") // teacher has no class
			{
				// only display the intranet button.
				print "<table width=\"100%\" border=\"0\">                   
				                    <tr>
				                    <td colspan=\"3\" align=\"center\">
				                    <h4>$teacher_name</h4></td>
				                    <td align=\"right\">";
				if ($user_type == 22)
				{
					print "<input type=\"button\" value=\"" . $sas_lang['startcenter'] . "\" onClick=\"javascript:parent.location='$cmsdir/index.php';\">";
				}
				else
				{
					print "&nbsp;";
				}

				print "<td align=\"right\">";
				if ($RecordCount > 0)
				{
					print "<input type=\"button\" value=\"" . $sas_lang['intranet'] . "\" onClick=\"javascript:parent.location='index.php?site=protected&settheme=$prot_theme';\">";
				}
				else
				{
					print "&nbsp";
				}
				print "</td></tr><tr><td colspan=\"5\">&nbsp;</td></tr></table>";
			}
			else
			{
				print "<table width=\"100%\" border=\"0\">
				           <tr>
				            <td colspan=\"3\"><h4>$teacher_name : </h4></td> 
				            <td>";
				print "<form method=\"POST\" action=\"index.php?section=$section&page=$page\">
				                       <select onChange=\"form.submit();\" name=\"new_class\">";
				while ($class_list = mysql_fetch_array($result2))
				{
					$class_list[1] = stripslashes($class_list[1]);
					if ($class_list[1] != "--------")
					{
						if ($class_list[0] == $teacher_class)
						{
							print "<option selected value=\"$class_list[0]\">$class_list[1]</option>\n";
						}
						else
						{
							print "<option value=\"$class_list[0]\">$class_list[1]</option>\n";
						}
					}
				}
				print "</select>";
				print "</td><td align=\"right\">";
				if ($user_type == 22)
				{
					print "<input type=\"button\" value=\"" . $sas_lang['startcenter'] . "\" 
					                           onClick=\"javascript:parent.location='$cmsdir/index.php';\">";
				}
				else
				{
					print "&nbsp;";
				}
				print "<td align=\"right\">";
				if ($RecordCount > 0)
				{
					//record the page and section number where the teacher is now.
					$_SESSION['page_came_from'] = $page;
					$_SESSION['section_came_from'] = $section;

					print "<input type=\"button\" value=\"" . $sas_lang['intranet'] . "\" 
					                           onClick=\"javascript:parent.location='index.php?site=protected';\">";
				}
				else
				{
					print "&nbsp";
				}
				print "</td></tr><tr><td colspan=\"6\">&nbsp;</td></tr>";

				print "<tr><td colspan=\"6\">";

				$query = "SELECT studentid, title FROM $table_studentpages WHERE dir_number = '$userid' ORDER BY sort"; //get the teachers pages
				$result2 = mysql_query($query) or die_script($query, mysql_error());
				$num_rows = mysql_num_rows($result2);
				$name = htmlspecialchars(rawurlencode($teacher_name));
				while ($row = mysql_fetch_array($result2))
				{
					$title_list[] = $row['title'];
					$studentid_list[] = $row['studentid'];
				}
				if ($num_rows > 0)
				{
					$i = 0;
					print "<table cellpadding=\"5\"><tr><td><b>" . $sas_lang['student_view'] . " :</b></td>";
					foreach ($title_list as $title)
					{
						print "<td><a href=index.php?section=$section&page=$page&viewpage=$studentid_list[$i]&name=$name>$title </a></td>";
						$i++;
					}
					print "<tr><td><b>" . $sas_lang['page_edit'] . " :</b></td>";
					$i = 0;
					foreach ($title_list as $title)
					{
						//print "<td><a href=index.php?section=$section&page=$page&editpage=$studentid_list[$i]>$title </a></td>";
						print "<td><a href=\"javascript:NewWindow('" . $sas_config['url'] . "$cmsdir/editors/fckeditor/studenteditor.php?editpage=$studentid_list[$i]')\">$title </a></td>\n";
						$i++;
					}
					print "</tr></table></td></tr>";
				}

				$query1 = "SELECT id, name, class, type FROM $table_users 
				                           WHERE class='$teacher_class' 
				                           ORDER BY name";
				$result1 = mysql_query($query1) or die_script($query1, mysql_error());
				$num_pages = $sas_config['number_pupilpages'];
				$bgcolor = "E7E7EF";
				print " </tr><tr><td align=\"center\" colspan=\"4\"><span class=text><b>" . $sas_lang['class'] . ": " . $teacher_class_name . "</b></span></td>
						<td colspan=\"2\">
				                <a href=index.php?section=$section&page=$page&option=addstudent&new_class=$teacher_class><b>[" . $sas_lang['newstudent'] . "]</a></b></td></tr>
				                <tr><td colspan=\"6\" align=\"center\">&nbsp;</td></tr>
				                <tr>
				                 <td>&nbsp;</td>
				                 <td><span class=text><b>" . $sas_lang['students'] . "</b></span></td>
				                 <td><span class=text><b>" . $sas_lang['student_update'] . "</b></span></td>
				                 <td><span class=text><b>" . $sas_lang['student_view'] . "</b></span></td>
				                 <td><span class=text><b>" . $sas_lang['student_create_delete'] . "</b></span></td>
				                 <td><span class=text><b>" . $sas_lang['student_create_page'] . "</b></span></td></tr>";
				while ($student_list = mysql_fetch_array($result1))
				{
					print " <tr bgcolor=\"$bgcolor\">
					                            <td><img src=$cmsdir/graphics/user.gif>";
					print "</td><td>";
					// block for creation of the student data
					$query2 = "SELECT studentid, newcontent, pcheck, title FROM $table_studentpages WHERE dir_number='$student_list[0]' ORDER BY sort";
					$result2 = mysql_query($query2) or die_script($query2, mysql_error());
					$num_rows = mysql_num_rows($result2);

					unset ($newcontent_list); //clear the new contents array
					unset ($studentid_list);
					unset ($student_title);
					while ($row = mysql_fetch_array($result2))
					{
						$newcontent_list[] = $row['newcontent'];
						$studentid_list[] = $row['studentid'];
						$student_title[] = $row['title'];
					}

					$name = htmlspecialchars(rawurlencode($student_list[1]));
					$student_name = stripslashes($student_list[1]);
					print "<span class=link>$student_name";
					if (($student_list[3] == 2) OR ($student_list[3] == 22))
					{
						print " (*)";
					}
					print "</span></td><td>";

					if ($num_rows > 0) // we have at least 1 page
					{
						$i = 0;
						$first = 0;
						foreach ($newcontent_list as $c) // check if newcontent is filled.
						{
							if ($c != "")
							{
								print "<span class=link><a href=index.php?section=$section&page=$page&updatepage=$studentid_list[$i]&new_class=$new_class
																		alt=\"$student_title[$i]\" title=\"$student_title[$i]\" >";
								$k = $i +1;
								print "[$k] </a></span>";
							}
							$i++;
						}
						print "&nbsp;</td><td>";
						$i = 0;
						foreach ($studentid_list as $p)
						{
							print "<span class=link><a href=index.php?section=$section&page=$page&viewpage=$studentid_list[$i]&name=$name&new_class=$new_class
																alt=\"$student_title[$i]\" title=\"$student_title[$i]\" >";
							$i++;
							print "[$i] </a></span>";
						}
						print "</td><td>";
						$i = 0;
						foreach ($studentid_list as $p)
						{
							print "<span class=link><a href=index.php?section=$section&page=$page&deletepage=$studentid_list[$i]&new_class=$new_class 
																alt=\"$student_title[$i]\" title=\"$student_title[$i]\" onClick=\"return confirm('" . $sas_lang['page_delete_confirm'] . "')\">";
							$i++;
							print "[$i] </a></span>";
						}
						print "</td><td>";
						$k = $i +1; //add 1 for the next page to be created.
						if ($student_list[3] == 0) //we have a project here
						{
							print "<span class=link>
													<a href=index.php?section=$section&page=$page&createpage=$student_list[0]&option=project&create=$k&new_class=$new_class>[" . $sas_lang['newpage'] . "]</a></span>";
						}
						else
						{
							if ($i < $num_pages) // if total pages is not greater than config of pupil pages so make create links
							{
								print "<span class=link><a href=index.php?section=$section&page=$page&createpage=$student_list[0]&create=$k&new_class=$new_class>[" . $sas_lang['newpage'] . "]</a></span>";
							}
						}
						print "</td>";
					}
					else
					{
						print "<td colspan=\"2\">&nbsp;</td><td>";
						$k = $i +1; //add 1 for the next page to be created.
						if ($i < $num_pages)
						{
							print "<span class=link><a href=index.php?section=$section&page=$page&createpage=$student_list[0]&createpage=$student_list[0]&create=1&viewclass=$viewclass>[" . $sas_lang['newpage'] . "]</a></span>";
						}
					}
					// end of block for creation of the student data
					print "</td></tr>";

					if ($bgcolor == "#FFFFFF")
					{
						$bgcolor = "#E7E7EF";
					}
					else
					{
						$bgcolor = "#FFFFFF";
					}
				}

				print "<tr><td colspan=\"6\">(*) " . $sas_lang['teachers'] . "</td><tr>
						<tr><td colspan=\"4\">&nbsp;</td><td colspan=\"2\"><a href=index.php?section=$section&page=$page&option=addstudent&new_class=$teacher_class><b>[" . $sas_lang['newstudent'] . "]</a></b></td></tr></table>";
			}
		}
	}
	print "<br><br><a href=index.php?section=$section&page=$page&logout=yes>
	            <b><< " . $sas_lang['logout'] . " <b>" . $teacher_name . "</b> >>&nbsp;</b></a>";
}
?>
