@ -16,23 +16,30 @@ require_once '../inc/global.inc.php';
$this_section = SECTION_PLATFORM_ADMIN;
api_protect_admin_script();
$category = $_GET['category'];
$category = Database::escape_string($category);
$category = Database::escape_string($_GET['category']);
$action = $_GET['action'];
$action = isset( $_GET['action']) ? $_GET['action'] : null ;
$tbl_course = Database::get_main_table(TABLE_MAIN_COURSE);
$tbl_category = Database::get_main_table(TABLE_MAIN_CATEGORY);
$errorMsg = '';
$id = isset($_GET['id']) ? $_GET['id'] : null;
$categoryCode = isset($_POST['categoryCode']) ? $_POST['categoryCode'] : null;
$categoryName = isset($_POST['categoryName']) ? $_POST['categoryName'] : null;
$formSent = isset($_POST['formSent']) ? $_POST['formSent'] : false;
$canHaveCourses = 0;
if (!empty($action)) {
if ($action == 'delete') {
deleteNode($_GET['id']);
deleteNode($id);
header('Location: ' . api_get_self() . '?category=' . Security::remove_XSS($category));
exit();
} elseif (($action == 'add' || $action == 'edit') & & $_POST['formSent']) {
} elseif (($action == 'add' || $action == 'edit') & & $formSent) {
$_POST['categoryCode'] = trim($_POST['categoryCode']);
$_POST['categoryName'] = trim($_POST['categoryName']);
@ -40,7 +47,7 @@ if (!empty($action)) {
if ($action == 'add') {
$ret = addNode($_POST['categoryCode'], $_POST['categoryName'], $_POST['canHaveCourses'], $category);
} else {
$ret = editNode($_POST['categoryCode'], $_POST['categoryName'], $_POST['canHaveCourses'], $_GET[' id'] );
$ret = editNode($_POST['categoryCode'], $_POST['categoryName'], $_POST['canHaveCourses'], $id);
}
if ($ret) {
@ -52,16 +59,17 @@ if (!empty($action)) {
$errorMsg = get_lang('PleaseEnterCategoryInfo');
}
} elseif ($action == 'edit') {
$categoryCode = Database::escape_string($_GET['id']);
$result = Database::query("SELECT name,auth_course_child FROM $tbl_category WHERE code='$categoryCode'");
list($categoryName, $canHaveCourses) = Database::fetch_row($result);
if (!empty($id)) {
$categoryCode = $id;
$sql = "SELECT name, auth_course_child FROM $tbl_category WHERE code='$id'";
$result = Database::query($sql);
list($categoryName, $canHaveCourses) = Database::fetch_row($result);
$canHaveCourses = ($canHaveCourses == 'FALSE') ? 0 : 1;
$canHaveCourses = ($canHaveCourses == 'FALSE') ? 0 : 1;
}
} elseif ($action == 'moveUp') {
moveNodeUp($_GET['id'], $_GET['tree_pos'], $category);
moveNodeUp($id, $_GET['tree_pos'], $category);
header('Location: ' . api_get_self() . '?category=' . Security::remove_XSS($category));
exit();
}
@ -106,7 +114,7 @@ if ($action == 'add' || $action == 'edit') {
$form->addElement('header', '', $form_title);
$form->display();
?>
< form method = "post" action = " <?php echo api_get_self (); ?> ?action= <?php echo Security :: remove_XSS ( $action ); ?> &category= <?php echo Security :: remove_XSS ( $category ); ?> &id= <?php echo Security :: remove_XSS ( $_GET [ ' id' ]) ; ?> " >
< form method = "post" action = " <?php echo api_get_self (); ?> ?action= <?php echo Security :: remove_XSS ( $action ); ?> &category= <?php echo Security :: remove_XSS ( $category ); ?> &id= <?php echo $id ; ?> " >
< input type = "hidden" name = "formSent" value = "1" / >
< table border = "0" cellpadding = "5" cellspacing = "0" >
<?php
@ -118,17 +126,16 @@ if ($action == 'add' || $action == 'edit') {
<?php
Display::display_normal_message($errorMsg); //main API
?>
< / td >
< / tr >
<?php
}
?>
< tr >
< td nowrap = "nowrap" > <?php echo get_lang ( "CategoryCode" ); ?> :</ td >
< td >< input type = "text" name = "categoryCode" size = "20" maxlength = "20" value = " <?php echo api_htmlentities ( stripslashes ( $categoryCode ), ENT_QUOTES , $charset ); ?> " /></ td >
< td >
< input type = "text" name = "categoryCode" size = "20" maxlength = "20" value = " <?php echo api_htmlentities ( stripslashes ( $categoryCode ), ENT_QUOTES , $charset ); ?> " /></ td >
< / tr >
< tr >
< td nowrap = "nowrap" > <?php echo get_lang ( "CategoryName" ); ?> :</ td >
@ -144,7 +151,7 @@ if ($action == 'add' || $action == 'edit') {
< tr >
< td > < / td >
<?php
if (isset($_GET['id']) & & !empty($_GET[' id'] )) {
if (!empty($id)) {
$class = "save";
$text = get_lang('CategoryMod');
} else {
@ -161,17 +168,17 @@ if ($action == 'add' || $action == 'edit') {
} else {
?>
< div class = "actions" >
<?php
if (!empty($category) & & empty($action)) {
$myquery = "SELECT parent_id FROM $tbl_category WHERE code='$category'";
$result = Database::query($myquery);
$parent_id = 0;
if (Database::num_rows($result) > 0) {
$parent_id = Database::fetch_array($result);
}
<?php
if (!empty($category) & & empty($action)) {
$myquery = "SELECT parent_id FROM $tbl_category WHERE code='$category'";
$result = Database::query($myquery);
$parent_id = 0;
if (Database::num_rows($result) > 0) {
$parent_id = Database::fetch_array($result);
}
$parent_id['parent_id'] ? $link = ' (' . $parent_id['parent_id'] . ')' : $link = '';
?>
$parent_id['parent_id'] ? $link = ' (' . $parent_id['parent_id'] . ')' : $link = '';
?>
< a href = " <?php echo api_get_self (); ?> ?category= <?php echo $parent_id [ 'parent_id' ]; ?> " > <?php echo Display :: return_icon ( 'folder_up.png' , get_lang ( "Back" ), '' , ICON_SIZE_MEDIUM );
if (!empty($parent_id)) echo $link ?>< / a >
@ -211,16 +218,11 @@ if ($action == 'add' || $action == 'edit') {
}
?>
< / ul >
<?php
}
Display::display_footer();
/* * ****** Functions ******* */
function deleteNode($node) {
global $tbl_category, $tbl_course;
$node = Database::escape_string($node);
@ -338,4 +340,5 @@ function compterFils($pere, $cpt) {
}
return ($cpt + 1);
}
}