Skip to content

Commit 28f9cbc

Browse files
openSISAdminopenSISAdmin
committedJan 16, 2020
User reported defect fixes
Many defects were fixed. Installation files updated to use ethnicity codes from database. If you use this build, then do a fresh install.
·
ver7.4V7.5
1 parent e40d935 commit 28f9cbc

33 files changed

+5690
-941
lines changed
 

‎Bottom.php

+8-2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@
2626
#
2727
#***************************************************************************************
2828
error_reporting(0);
29+
include("functions/ParamLibFnc.php");
30+
require_once("Data.php");
2931
include "./Warehouse.php";
3032
$url=validateQueryString(curPageURL());
3133
if($url===FALSE)
@@ -35,12 +37,16 @@
3537

3638
if(clean_param($_REQUEST['modfunc'],PARAM_ALPHA)=='print')
3739
{
40+
$connection = new mysqli($DatabaseServer, $DatabaseUsername, $DatabasePassword, $DatabaseName);
3841
$_REQUEST = $_SESSION['_REQUEST_vars'];
3942
$_REQUEST['_openSIS_PDF'] = true;
43+
$_REQUEST['_openSIS_PDF'] = mysqli_real_escape_string($connection,optional_param('_openSIS_PDF', '', PARAM_RAW));
44+
$_REQUEST['modname'] = mysqli_real_escape_string($connection,optional_param('modname', '', PARAM_RAW));
45+
$_REQUEST['failed_login'] = mysqli_real_escape_string($connection,optional_param('failed_login', '', PARAM_RAW));
4046
if(strpos($_REQUEST['modname'],'?')!==false)
41-
$modname = substr($_REQUEST['modname'],0,strpos($_REQUEST['modname'],'?'));
47+
$modname = substr(mysqli_real_escape_string($connection,optional_param('modname', '', PARAM_RAW)),0,strpos(mysqli_real_escape_string($connection,optional_param('modname', '', PARAM_RAW)),'?'));
4248
else
43-
$modname = $_REQUEST['modname'];
49+
$modname = mysqli_real_escape_string($connection,optional_param('modname', '', PARAM_RAW));
4450
ob_start();
4551
include('modules/'.$modname);
4652
if($htmldocPath)

‎CalendarModal.php

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?php
2-
2+
include("functions/ParamLibFnc.php");
3+
require_once("Data.php");
34
include('RedirectRootInc.php');
45
include'ConfigInc.php';
56
include 'Warehouse.php';
@@ -10,8 +11,8 @@
1011
*/
1112

1213
//----------------------- modal for event start---------------------//
13-
14-
14+
$connection = new mysqli($DatabaseServer, $DatabaseUsername, $DatabasePassword, $DatabaseName);
15+
$_REQUEST['event_id'] = mysqli_real_escape_string($connection,optional_param('event_id', '', PARAM_DATA));
1516
if (($_REQUEST['event_id'] || !isset($_REQUEST['event_id'])) && !isset($_REQUEST[assignment_id])) {
1617
if ($_REQUEST['event_id'] != 'new' && isset($_REQUEST['event_id'])) {
1718
$RET = DBGet(DBQuery("SELECT TITLE,DESCRIPTION,SCHOOL_DATE,CALENDAR_ID FROM calendar_events WHERE ID='$_REQUEST[event_id]'"));

‎Data.php

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?php
2+
$DatabaseType = 'mysqli';
3+
$DatabaseServer = 'localhost';
4+
$DatabaseUsername = 'root';
5+
$DatabasePassword = 'Ge0rg1a30097%go';
6+
$DatabaseName = 'bobtest';
7+
$DatabasePort = '3306';
8+
?>

‎HoldAddressFields.php

+97
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
<?php
2+
3+
#**************************************************************************
4+
# openSIS is a free student information system for public and non-public
5+
# schools from Open Solutions for Education, Inc. web: www.os4ed.com
6+
#
7+
# openSIS is web-based, open source, and comes packed with features that
8+
# include student demographic info, scheduling, grade book, attendance,
9+
# report cards, eligibility, transcripts, parent portal,
10+
# student portal and more.
11+
#
12+
# Visit the openSIS web site at http://www.opensis.com to learn more.
13+
# If you have question regarding this system or the license, please send
14+
# an email to info@os4ed.com.
15+
#
16+
# This program is released under the terms of the GNU General Public License as
17+
# published by the Free Software Foundation, version 2 of the License.
18+
# See license.txt.
19+
#
20+
# This program is distributed in the hope that it will be useful,
21+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
22+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23+
# GNU General Public License for more details.
24+
#
25+
# You should have received a copy of the GNU General Public License
26+
# along with this program. If not, see <http://www.gnu.org/licenses/>.
27+
#
28+
#***************************************************************************************
29+
30+
include('RedirectRootInc.php');
31+
include('Warehouse.php');
32+
33+
ini_set('memory_limit', '1200000000M');
34+
ini_set('max_execution_time', '500000');
35+
36+
37+
if($_POST['ADDR_CONT_USRN'] != "" && $_POST['ADDR_CONT_PSWD'] != "")
38+
{
39+
$qry_one = DBGet(DBQuery('SELECT * FROM login_authentication WHERE username = "'.$_POST['ADDR_CONT_USRN'].'" AND password = "'.$_POST['ADDR_CONT_PSWD'].'"'));
40+
41+
$counted = count($qry_one);
42+
43+
if($counted > 0)
44+
{
45+
$this_password = $qry_one[1]['PASSWORD'];
46+
}
47+
else
48+
{
49+
$this_password = md5($_POST['ADDR_CONT_PSWD']);
50+
}
51+
}
52+
else
53+
{
54+
$this_password = "";
55+
}
56+
57+
58+
$addressHoldSet = array(
59+
"ADDR_PRIM_L1" => $_POST['ADDR_PRIM_L1'],
60+
"ADDR_PRIM_L2" => $_POST['ADDR_PRIM_L2'],
61+
"ADDR_PRIM_CITY" => $_POST['ADDR_PRIM_CITY'],
62+
"ADDR_PRIM_STATE" => $_POST['ADDR_PRIM_STATE'],
63+
"ADDR_PRIM_ZIP" => $_POST['ADDR_PRIM_ZIP'],
64+
"ADDR_PRIM_BUSNO" => $_POST['ADDR_PRIM_BUSNO'],
65+
"ADDR_PRIM_BPU" => $_POST['ADDR_PRIM_BPU'],
66+
"ADDR_PRIM_BDO" => $_POST['ADDR_PRIM_BDO'],
67+
"ADDR_SAME_HOME" => $_POST['ADDR_SAME_HOME'],
68+
"ADDR_SAME_AS" => $_POST['ADDR_SAME_AS'],
69+
"ADDR_MAIL_L1" => $_POST['ADDR_MAIL_L1'],
70+
"ADDR_MAIL_L2" => $_POST['ADDR_MAIL_L2'],
71+
"ADDR_MAIL_CITY" => $_POST['ADDR_MAIL_CITY'],
72+
"ADDR_MAIL_STATE" => $_POST['ADDR_MAIL_STATE'],
73+
"ADDR_MAIL_ZIP" => $_POST['ADDR_MAIL_ZIP'],
74+
"ADDR_CONT_RSHIP" => $_POST['ADDR_CONT_RSHIP'],
75+
"ADDR_CONT_FIRST" => $_POST['ADDR_CONT_FIRST'],
76+
"ADDR_CONT_LAST" => $_POST['ADDR_CONT_LAST'],
77+
"ADDR_CONT_HOME" => $_POST['ADDR_CONT_HOME'],
78+
"ADDR_CONT_WORK" => $_POST['ADDR_CONT_WORK'],
79+
"ADDR_CONT_CELL" => $_POST['ADDR_CONT_CELL'],
80+
"ADDR_CONT_MAIL" => $_POST['ADDR_CONT_MAIL'],
81+
"ADDR_CONT_PORTAL" => $_POST['ADDR_CONT_PORTAL'],
82+
"ADDR_CONT_USRN" => $_POST['ADDR_CONT_USRN'],
83+
"ADDR_CONT_PSWD" => $this_password,
84+
"ADDR_CONT_SAHA" => $_POST['ADDR_CONT_SAHA'],
85+
"ADDR_CONT_ADNA" => $_POST['ADDR_CONT_ADNA'],
86+
"ADDR_CONT_LIN1" => $_POST['ADDR_CONT_LIN1'],
87+
"ADDR_CONT_LIN2" => $_POST['ADDR_CONT_LIN2'],
88+
"ADDR_CONT_CITY" => $_POST['ADDR_CONT_CITY'],
89+
"ADDR_CONT_STAT" => $_POST['ADDR_CONT_STAT'],
90+
"ADDR_CONT_ZIP" => $_POST['ADDR_CONT_ZIP'],
91+
);
92+
93+
$_SESSION["HOLD_ADDR_DATA"] = $addressHoldSet;
94+
95+
print_r($addressHoldSet);
96+
97+
?>

‎ParentLookup.php

+92-64
Original file line numberDiff line numberDiff line change
@@ -20,73 +20,101 @@
2020
//echo $_REQUEST['USERINFO_FIRST_NAME'];
2121
//echo '<br>';
2222
//echo $_REQUEST['USERINFO_LAST_NAME'];
23-
if ($_REQUEST['USERINFO_FIRST_NAME'] || $_REQUEST['USERINFO_LAST_NAME'] || $_REQUEST['USERINFO_EMAIL'] || $_REQUEST['USERINFO_MOBILE'] || $_REQUEST['USERINFO_SADD'] || $_REQUEST['USERINFO_CITY'] || $_REQUEST['USERINFO_STATE'] || $_REQUEST['USERINFO_ZIP']) {
24-
$stf_ids = '';
25-
$sql = 'SELECT distinct stf.STAFF_ID AS BUTTON , stf.STAFF_ID,CONCAT(stf.FIRST_NAME," ",stf.LAST_NAME) AS FULLNAME, CONCAT(s.FIRST_NAME," ",s.LAST_NAME) AS STUFULLNAME,stf.PROFILE,stf.EMAIL FROM people stf';
26-
$sql_where = 'WHERE stf.PROFILE_ID=4 AND s.STUDENT_ID!=' . UserStudentID() . ' ';
27-
if ($_REQUEST['USERINFO_FIRST_NAME'] || $_REQUEST['USERINFO_LAST_NAME'] || $_REQUEST['USERINFO_EMAIL'] || $_REQUEST['USERINFO_MOBILE']) {
28-
if ($_REQUEST['USERINFO_FIRST_NAME']!='')
29-
$sql_where.= 'AND LOWER(stf.FIRST_NAME) LIKE \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_FIRST_NAME']))) . '%\' ';
30-
if ($_REQUEST['USERINFO_LAST_NAME']!='')
31-
$sql_where.= 'AND LOWER(stf.LAST_NAME) LIKE \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_LAST_NAME']))) . '%\' ';
32-
if ($_REQUEST['USERINFO_EMAIL']!='')
33-
$sql_where.= 'AND LOWER(stf.EMAIL) = \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_EMAIL']))) . '\' ';
34-
if ($_REQUEST['USERINFO_MOBILE']!='')
35-
$sql_where.= 'AND stf.CELL_PHONE = \'' . str_replace("'", "''", trim($_REQUEST['USERINFO_MOBILE'])) . '\' ';
36-
}
37-
if ($_REQUEST['USERINFO_SADD'] || $_REQUEST['USERINFO_CITY'] || $_REQUEST['USERINFO_STATE'] || $_REQUEST['USERINFO_ZIP']) {
38-
$sql.=' LEFT OUTER JOIN student_address sa on sa.PEOPLE_ID=stf.STAFF_ID';
39-
$sql_where.=' AND sa.TYPE IN (\'Primary\',\'Secondary\',\'Other\') ';
40-
if ($_REQUEST['USERINFO_SADD']!='')
41-
$sql_where.= ' AND LOWER(STREET_ADDRESS_1) LIKE \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_SADD']))) . '%\' ';
42-
if ($_REQUEST['USERINFO_CITY']!='')
43-
$sql_where.= ' AND LOWER(CITY) LIKE \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_CITY']))) . '%\' ';
44-
if ($_REQUEST['USERINFO_STATE']!='')
45-
$sql_where.= ' AND LOWER(STATE) LIKE \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_STATE']))) . '%\' ';
46-
if ($_REQUEST['USERINFO_ZIP']!='')
47-
$sql_where.= ' AND ZIPCODE = \'' . str_replace("'", "''", trim($_REQUEST['USERINFO_ZIP'])) . '\' ';
48-
}
49-
50-
$sql.=' Left outer join students_join_people sju on stf.STAFF_ID=sju.PERSON_ID Left outer join students s on s.STUDENT_ID = sju.STUDENT_ID ';
51-
$sql_where.= ' AND LOWER(stf.FIRST_NAME)<>\'\' AND LOWER(stf.LAST_NAME)<>\'\' AND sju.PERSON_ID NOT IN (SELECT PERSON_ID FROM students_join_people WHERE STUDENT_ID=' . UserStudentID() . ') GROUP BY sju.PERSON_ID';
52-
53-
$searched_staffs = DBGet(DBQuery($sql . $sql_where), array('BUTTON' => 'makeChooseCheckbox'));
54-
foreach ($searched_staffs as $key => $value) {
55-
$stf_usrname = DBGet(DBQuery('SELECT USERNAME FROM login_authentication WHERE USER_ID=' . $value['STAFF_ID'] . ' AND PROFILE_ID=4'));
56-
$searched_staffs[$key]['USERNAME'] = $stf_usrname[1]['USERNAME'];
57-
}
58-
} else {
59-
60-
$sql = 'SELECT stf.STAFF_ID AS BUTTON , stf.STAFF_ID,CONCAT(stf.FIRST_NAME," ",stf.LAST_NAME) AS FULLNAME, CONCAT(s.FIRST_NAME," ",s.LAST_NAME) AS STUFULLNAME,stf.PROFILE,stf.EMAIL FROM people stf left outer join students_join_people sju on stf.STAFF_ID=sju.PERSON_ID left outer join students s on s.STUDENT_ID = sju.STUDENT_ID WHERE s.STUDENT_ID!=' . UserStudentID() . ' AND stf.FIRST_NAME<>\'\' AND stf.LAST_NAME<>\'\' AND sju.PERSON_ID NOT IN (SELECT PERSON_ID FROM students_join_people WHERE STUDENT_ID=' . UserStudentID() . ') Group by stf.STAFF_ID';
61-
62-
$searched_staffs = DBGet(DBQuery($sql), array('BUTTON' => 'makeChooseCheckbox'));
63-
foreach ($searched_staffs as $key => $value) {
64-
$stf_usrname = DBGet(DBQuery('SELECT USERNAME FROM login_authentication WHERE USER_ID=' . $value['STAFF_ID'] . ' AND PROFILE_ID=4'));
65-
$searched_staffs[$key]['USERNAME'] = $stf_usrname[1]['USERNAME'];
66-
}
67-
}
23+
if ($_REQUEST['USERINFO_FIRST_NAME'] || $_REQUEST['USERINFO_LAST_NAME'] || $_REQUEST['USERINFO_EMAIL'] || $_REQUEST['USERINFO_MOBILE'] || $_REQUEST['USERINFO_SADD'] || $_REQUEST['USERINFO_CITY'] || $_REQUEST['USERINFO_STATE'] || $_REQUEST['USERINFO_ZIP'])
24+
{
25+
$stf_ids = '';
26+
27+
$sql = 'SELECT distinct stf.STAFF_ID AS BUTTON , stf.STAFF_ID,CONCAT(stf.FIRST_NAME," ",stf.LAST_NAME) AS FULLNAME, CONCAT(s.FIRST_NAME," ",s.LAST_NAME) AS STUFULLNAME,stf.PROFILE,stf.EMAIL FROM people stf';
28+
$sql_where = 'WHERE stf.PROFILE_ID=4 AND s.STUDENT_ID!=' . UserStudentID() . ' ';
29+
30+
if ($_REQUEST['USERINFO_FIRST_NAME'] || $_REQUEST['USERINFO_LAST_NAME'] || $_REQUEST['USERINFO_EMAIL'] || $_REQUEST['USERINFO_MOBILE'])
31+
{
32+
if ($_REQUEST['USERINFO_FIRST_NAME']!='')
33+
$sql_where.= 'AND LOWER(stf.FIRST_NAME) LIKE \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_FIRST_NAME']))) . '%\' ';
34+
if ($_REQUEST['USERINFO_LAST_NAME']!='')
35+
$sql_where.= 'AND LOWER(stf.LAST_NAME) LIKE \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_LAST_NAME']))) . '%\' ';
36+
if ($_REQUEST['USERINFO_EMAIL']!='')
37+
$sql_where.= 'AND LOWER(stf.EMAIL) = \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_EMAIL']))) . '\' ';
38+
if ($_REQUEST['USERINFO_MOBILE']!='')
39+
$sql_where.= 'AND stf.CELL_PHONE = \'' . str_replace("'", "''", trim($_REQUEST['USERINFO_MOBILE'])) . '\' ';
40+
}
41+
42+
43+
if ($_REQUEST['USERINFO_SADD'] || $_REQUEST['USERINFO_CITY'] || $_REQUEST['USERINFO_STATE'] || $_REQUEST['USERINFO_ZIP'])
44+
{
45+
$sql.=' LEFT OUTER JOIN student_address sa on sa.PEOPLE_ID=stf.STAFF_ID';
46+
$sql_where.=' AND sa.TYPE IN (\'Primary\',\'Secondary\',\'Other\') ';
47+
if ($_REQUEST['USERINFO_SADD']!='')
48+
$sql_where.= ' AND LOWER(STREET_ADDRESS_1) LIKE \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_SADD']))) . '%\' ';
49+
if ($_REQUEST['USERINFO_CITY']!='')
50+
$sql_where.= ' AND LOWER(CITY) LIKE \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_CITY']))) . '%\' ';
51+
if ($_REQUEST['USERINFO_STATE']!='')
52+
$sql_where.= ' AND LOWER(STATE) LIKE \'' . str_replace("'", "''", strtolower(trim($_REQUEST['USERINFO_STATE']))) . '%\' ';
53+
if ($_REQUEST['USERINFO_ZIP']!='')
54+
$sql_where.= ' AND ZIPCODE = \'' . str_replace("'", "''", trim($_REQUEST['USERINFO_ZIP'])) . '\' ';
55+
}
56+
57+
$sql.=' Left outer join students_join_people sju on stf.STAFF_ID=sju.PERSON_ID Left outer join students s on s.STUDENT_ID = sju.STUDENT_ID ';
58+
$sql_where.= ' AND LOWER(stf.FIRST_NAME)<>\'\' AND LOWER(stf.LAST_NAME)<>\'\' AND sju.PERSON_ID NOT IN (SELECT PERSON_ID FROM students_join_people WHERE STUDENT_ID=' . UserStudentID() . ') GROUP BY sju.PERSON_ID';
59+
60+
$searched_staffs = DBGet(DBQuery($sql . $sql_where), array('BUTTON' => 'makeChooseCheckbox'));
61+
62+
foreach ($searched_staffs as $key => $value)
63+
{
64+
$stf_usrname = DBGet(DBQuery('SELECT USERNAME FROM login_authentication WHERE USER_ID=' . $value['STAFF_ID'] . ' AND PROFILE_ID=4'));
65+
$searched_staffs[$key]['USERNAME'] = $stf_usrname[1]['USERNAME'];
66+
}
67+
}
68+
else
69+
{
70+
$sql = 'SELECT stf.STAFF_ID AS BUTTON , stf.STAFF_ID,CONCAT(stf.FIRST_NAME," ",stf.LAST_NAME) AS FULLNAME, CONCAT(s.FIRST_NAME," ",s.LAST_NAME) AS STUFULLNAME,stf.PROFILE,stf.EMAIL FROM people stf left outer join students_join_people sju on stf.STAFF_ID=sju.PERSON_ID left outer join students s on s.STUDENT_ID = sju.STUDENT_ID WHERE s.STUDENT_ID!=' . UserStudentID() . ' AND stf.FIRST_NAME<>\'\' AND stf.LAST_NAME<>\'\' AND sju.PERSON_ID NOT IN (SELECT PERSON_ID FROM students_join_people WHERE STUDENT_ID=' . UserStudentID() . ') Group by stf.STAFF_ID';
71+
72+
$searched_staffs = DBGet(DBQuery($sql), array('BUTTON' => 'makeChooseCheckbox'));
73+
74+
foreach ($searched_staffs as $key => $value)
75+
{
76+
$stf_usrname = DBGet(DBQuery('SELECT USERNAME FROM login_authentication WHERE USER_ID=' . $value['STAFF_ID'] . ' AND PROFILE_ID=4'));
77+
78+
$searched_staffs[$key]['USERNAME'] = $stf_usrname[1]['USERNAME'];
79+
}
80+
}
6881

69-
$singular = 'User';
70-
$plural = 'Users';
71-
$options['save'] = false;
72-
$options['print'] = false;
73-
$options['search'] = false;
74-
75-
$columns = array('BUTTON' => 'Select any one', 'FULLNAME' => 'Name', 'USERNAME' => 'Username', 'EMAIL' => 'Email', 'STUFULLNAME' => 'Associated Student\'s Name');
76-
if ($_REQUEST['add_id'] == 'new')
77-
echo '<FORM name=sel_staff id=sel_staff action="ForWindow.php?modname=' . $_REQUEST[modname] . '&modfunc=lookup&type=' . $_REQUEST['type'] . '&func=search&nfunc=status&ajax=' . $_REQUEST['ajax'] . '&add_id=new&address_id=' . $_REQUEST['address_id'] . '" METHOD=POST>';
78-
else
79-
echo '<FORM name=sel_staff id=sel_staff action="ForWindow.php?modname=' . $_REQUEST[modname] . '&modfunc=lookup&type=' . $_REQUEST['type'] . '&func=search&nfunc=status&ajax=' . $_REQUEST['ajax'] . '&add_id=' . $_REQUEST['add_id'] . '&address_id=' . $_REQUEST['address_id'] . '" METHOD=POST>';
80-
echo '<span id="sel_err" class="text-danger"></span>';
81-
// print_r($searched_staffs);
82-
ListOutput($searched_staffs, $columns, $singular, $plural, false, $group = false, $options, 'ForWindow');
83-
unset($_REQUEST['func']);
84-
if(!empty($searched_staffs))
85-
echo '<div id="select-people-div"><input type="button" value="Select" name="button" onclick="SelectedParent(\''.$_REQUEST['address_id'].'\',\''.$_REQUEST['p_type'].'\',\''.$_REQUEST['other_p_erson_id'].'\')"></div>';
82+
$singular = 'User';
83+
$plural = 'Users';
84+
$options['save'] = false;
85+
$options['print'] = false;
86+
$options['search'] = false;
87+
88+
$columns = array('BUTTON' => 'Select any one', 'FULLNAME' => 'Name', 'USERNAME' => 'Username', 'EMAIL' => 'Email', 'STUFULLNAME' => 'Associated Student\'s Name');
89+
90+
// echo "<pre>";
91+
// print_r($searched_staffs);
92+
// echo die();
93+
94+
95+
if ($_REQUEST['add_id'] == 'new')
96+
echo '<FORM name=sel_staff id=sel_staff action="ForWindow.php?modname=' . $_REQUEST[modname] . '&modfunc=lookup&type=' . $_REQUEST['type'] . '&func=search&nfunc=status&ajax=' . $_REQUEST['ajax'] . '&add_id=new&address_id=' . $_REQUEST['address_id'] . '" METHOD=POST>';
97+
else
98+
echo '<FORM name=sel_staff id=sel_staff action="ForWindow.php?modname=' . $_REQUEST[modname] . '&modfunc=lookup&type=' . $_REQUEST['type'] . '&func=search&nfunc=status&ajax=' . $_REQUEST['ajax'] . '&add_id=' . $_REQUEST['add_id'] . '&address_id=' . $_REQUEST['address_id'] . '" METHOD=POST>';
8699

87-
function makeChooseCheckbox($value, $title) {
100+
echo '<span id="sel_err" class="text-danger"></span>';
101+
102+
ListOutput($searched_staffs, $columns, $singular, $plural, false, $group = false, $options, 'ForWindow');
103+
unset($_REQUEST['func']);
104+
105+
// echo "<pre>";
106+
// print_r($searched_staffs);
107+
// echo die();
108+
109+
if(!empty($searched_staffs))
110+
echo '<div id="select-people-div"><br><input type="button" class="btn btn-primary" value="Select" name="button" onclick="SelectedParent(\''.$_REQUEST['address_id'].'\',\''.$_REQUEST['p_type'].'\',\''.$_REQUEST['other_p_erson_id'].'\')"></div>';
111+
112+
function makeChooseCheckbox($value, $title)
113+
{
88114
global $THIS_RET;
89-
if ($THIS_RET['BUTTON']) {
115+
116+
if ($THIS_RET['BUTTON'])
117+
{
90118
return "<INPUT type=radio name=staff value=" . $THIS_RET['BUTTON'] . ">";
91119
}
92120
}

‎api/SchoolInfo.php

+4-3
Original file line numberDiff line numberDiff line change
@@ -362,11 +362,12 @@ function _makeLetterGrade($percent,$course_period_id=0,$staff_id=0,$ret='')
362362
}
363363
}
364364

365+
$connection = new mysqli($DatabaseServer, $DatabaseUsername, $DatabasePassword, $DatabaseName);
365366

367+
$format = mysqli_real_escape_string($connection,strtolower(optional_param('format', '', PARAM_RAW)));
368+
$api_key= mysqli_real_escape_string($connection,optional_param('api_key', '', PARAM_RAW));
369+
$api_secret= mysqli_real_escape_string($connection, optional_param('api_secret', '', PARAM_RAW));
366370

367-
$format = strtolower($_REQUEST['format']);
368-
$api_key= $_REQUEST['api_key'];
369-
$api_secret= $_REQUEST['api_secret'];
370371
$validate= DBGet(DBQuery('SELECT * FROM api_info WHERE API_KEY=\''.$api_key.'\' AND API_SECRET=\''.$api_secret.'\''));
371372
if(count($validate) > 0)
372373
{

0 commit comments

Comments
 (0)
Please sign in to comment.