chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Adding intval function to querys see DT#4389

Browse Source
skala
Julio Montoya 16 years ago
parent c2e4f5c677
commit 8999b49e33
12 changed files with 73 additions and 102 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 4
      main/inc/lib/urlmanager.lib.php
  2. 35
      main/inc/lib/usermanager.lib.php
  3. 22
      main/mySpace/access_details.php
  4. 2
      main/mySpace/admin.php
  5. 8
      main/mySpace/coaches.php
  6. 1
      main/mySpace/course.php
  7. 38
      main/mySpace/myStudents.php
  8. 7
      main/mySpace/progression.php
  9. 27
      main/mySpace/session.php
  10. 2
      main/mySpace/student.php
  11. 4
      main/mySpace/teachers.php
  12. 25
      main/mySpace/user_import.php

4
main/inc/lib/urlmanager.lib.php
Unescape View File

@ -66,6 +66,7 @@ class UrlManager
*/
function udpate($url_id, $url, $description, $active)
{
$url_id = intval($url_id);
$table_access_url= Database :: get_main_table(TABLE_MAIN_ACCESS_URL);
$tms = time();
$sql = "UPDATE $table_access_url
@ -88,6 +89,7 @@ class UrlManager
* */
function delete($id)
{
$id = intval($id);
$table_access_url= Database :: get_main_table(TABLE_MAIN_ACCESS_URL);
$sql= "DELETE FROM $table_access_url WHERE id = ".Database::escape_string($id);
$result = Database::query($sql, __FILE__, __LINE__);
@ -156,7 +158,7 @@ class UrlManager
* @return array
* */
function get_url_data_from_id($url_id)
{
{
$table_access_url= Database :: get_main_table(TABLE_MAIN_ACCESS_URL);
$sql = "SELECT id, url, description, active FROM $table_access_url WHERE id = ".Database::escape_string($url_id);
$res = Database::query($sql, __FILE__, __LINE__);

35
main/inc/lib/usermanager.lib.php
Unescape View File

@ -20,10 +20,9 @@ define('USER_FIELD_TYPE_DATETIME', 7);
define('USER_FIELD_TYPE_DOUBLE_SELECT', 8);
define('USER_FIELD_TYPE_DIVIDER', 9);
class UserManager {
class UserManager
{
private function __construct () {
}
/**
@ -68,7 +67,7 @@ class UserManager {
}
if ($_user['user_id']) {
$creator_id = $_user['user_id'];
$creator_id = intval($_user['user_id']);
} else {
$creator_id = '';
}
@ -143,10 +142,12 @@ class UserManager {
*/
public static function can_delete_user($user_id) {
$table_course_user = Database :: get_main_table(TABLE_MAIN_COURSE_USER);
if ($user_id != strval(intval($user_id))) return false;
if ($user_id === false) return false;
$sql = "SELECT * FROM $table_course_user WHERE status = '1' AND user_id = '".$user_id."'";
$res = Database::query($sql, __FILE__, __LINE__);
while ($course = Database::fetch_object($res)) {
$sql = "SELECT user_id FROM $table_course_user WHERE status='1' AND course_code ='".$course->course_code."'";
$sql = "SELECT user_id FROM $table_course_user WHERE status='1' AND course_code ='".Database::escape_string($course->course_code)."'";
$res2 = Database::query($sql, __FILE__, __LINE__);
if (Database::num_rows($res2) == 1) {
return false;
@ -162,6 +163,10 @@ class UserManager {
*/
public static function delete_user($user_id) {
global $_configuration;
if ($user_id != strval(intval($user_id))) return false;
if ($user_id === false) return false;
if (!self::can_delete_user($user_id)) {
return false;
}
@ -203,7 +208,8 @@ class UserManager {
$user_info = api_get_user_info($user_id);
if (strlen($user_info['picture_uri']) > 0) {
$img_path = api_get_path(SYS_CODE_PATH).'upload/users/'.$user_id.'/'.$user_info['picture_uri'];
unlink($img_path);
if (file_exists($img_path))
unlink($img_path);
}
// Delete the personal course categories
@ -233,7 +239,6 @@ class UserManager {
$sqlv = "DELETE FROM $t_ufv WHERE user_id = $user_id";
$resv = Database::query($sqlv, __FILE__, __LINE__);
if ($_configuration['multiple_access_urls']) {
require_once api_get_path(LIBRARY_PATH).'urlmanager.lib.php';
$url_id = 1;
@ -259,6 +264,8 @@ class UserManager {
*/
public static function update_openid($user_id, $openid) {
$table_user = Database :: get_main_table(TABLE_MAIN_USER);
if ($user_id != strval(intval($user_id))) return false;
if ($user_id === false) return false;
$sql = "UPDATE $table_user SET
openid='".Database::escape_string($openid)."'";
$sql .= " WHERE user_id='$user_id'";
@ -285,6 +292,8 @@ class UserManager {
*/
public static function update_user($user_id, $firstname, $lastname, $username, $password = null, $auth_source = null, $email, $status, $official_code, $phone, $picture_uri, $expiration_date, $active, $creator_id = null, $hr_dept_id = 0, $extra = null, $language = 'english') {
global $userPasswordCrypted;
if ($user_id != strval(intval($user_id))) return false;
if ($user_id === false) return false;
$table_user = Database :: get_main_table(TABLE_MAIN_USER);
$sql = "UPDATE $table_user SET
lastname='".Database::escape_string($lastname)."',
@ -329,7 +338,7 @@ class UserManager {
*/
public static function is_username_available($username) {
$table_user = Database :: get_main_table(TABLE_MAIN_USER);
$sql = "SELECT username FROM $table_user WHERE username = '".addslashes($username)."'";
$sql = "SELECT username FROM $table_user WHERE username = '".Database::escape_string($username)."'";
$res = Database::query($sql, __FILE__, __LINE__);
return Database::num_rows($res) == 0;
}
@ -508,6 +517,7 @@ class UserManager {
*/
public static function get_user_info($username) {
$user_table = Database :: get_main_table(TABLE_MAIN_USER);
$username = Database::escape_string($username);
$sql = "SELECT * FROM $user_table WHERE username='".$username."'";
$res = Database::query($sql, __FILE__, __LINE__);
if (Database::num_rows($res) > 0) {
@ -560,6 +570,7 @@ class UserManager {
public static function get_teacher_list($course_id, $sel_teacher = '') {
$user_course_table = Database :: get_main_table(TABLE_MAIN_COURSE_USER);
$user_table = Database :: get_main_table(TABLE_MAIN_USER);
$course_id = Database::escape_string($course_id);
$sql_query = "SELECT * FROM $user_table a, $user_course_table b where a.user_id=b.user_id AND b.status=1 AND b.course_code='$course_id'";
$sql_result = Database::query($sql_query, __FILE__, __LINE__);
echo "<select name=\"author\">";
@ -770,10 +781,10 @@ class UserManager {
* @return A string containing the XHTML code to dipslay the production list, or FALSE
*/
public static function build_production_list($user_id, $force = false, $showdelete = false) {
if (!$force && !empty($_POST['remove_production'])) {
return true; // postpone reading from the filesystem
}
$productions = self::get_user_productions($user_id);
if (empty($productions)) {
@ -879,6 +890,8 @@ class UserManager {
$t_ufo = Database::get_main_table(TABLE_MAIN_USER_FIELD_OPTIONS);
$t_ufv = Database::get_main_table(TABLE_MAIN_USER_FIELD_VALUES);
$fname = Database::escape_string($fname);
if ($user_id != strval(intval($user_id))) return false;
if ($user_id === false) return false;
$fvalues = '';
if (is_array($fvalue)) {
foreach($fvalue as $val) {
@ -980,7 +993,7 @@ class UserManager {
$t_uf = Database :: get_main_table(TABLE_MAIN_USER_FIELD);
$t_ufo = Database :: get_main_table(TABLE_MAIN_USER_FIELD_OPTIONS);
$columns = array('id', 'field_variable', 'field_type', 'field_display_text', 'field_default_value', 'field_order', 'field_filter', 'tms');
$column = intval($column);
$sort_direction = '';
if (in_array(strtoupper($direction), array('ASC', 'DESC'))) {
$sort_direction = strtoupper($direction);
@ -1776,6 +1789,7 @@ class UserManager {
$tbl_session_course_user = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
$user_id = intval($user_id);
$session_id = intval($session_id);
//we filter the courses from the URL
$join_access_url=$where_access_url='';
global $_configuration;
@ -2191,6 +2205,7 @@ class UserManager {
$table_user = Database::get_main_table(TABLE_MAIN_USER);
$title = api_utf8_decode($title);
$content = api_utf8_decode($content);
$email_administrator = Database::escape_string($email_administrator);
//message in inbox
$sql_message_outbox = 'SELECT user_id from '.$table_user.' WHERE email="'.$email_administrator.'" ';
//$num_row_query = Database::num_rows($sql_message_outbox);

22
main/mySpace/access_details.php
Unescape View File

@ -1,25 +1,5 @@
<?php
// $Id:
/*
==============================================================================
Dokeos - elearning and course management software
Copyright (c) 2009 Dokeos SPRL
Copyright (c) 2008 Furio Petrossi
For a full list of contributors, see "credits.txt".
The full license can be read in "license.txt".
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.
See the GNU General Public License for more details.
Contact: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium, info@dokeos.com
==============================================================================
*/
/* For licensing terms, see /dokeos_license.txt */
/**
==============================================================================
* This is the tracking library for Dokeos.

2
main/mySpace/admin.php
Unescape View File

@ -1,5 +1,5 @@
<?php
/* For licensing terms, see /dokeos_license.txt */
/*
* Created on 18 October 2006 by Elixir Interactive http://www.elixir-interactive.com
*/

8
main/mySpace/coaches.php
Unescape View File

@ -1,5 +1,5 @@
<?php
/* For licensing terms, see /dokeos_license.txt */
/*
* Created on 18 October 2006 by Elixir Interactive http://www.elixir-interactive.com
*/
@ -47,7 +47,7 @@ $tbl_track_login = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_
function is_coach() {
global $tbl_session_course;
$sql = "SELECT course_code FROM $tbl_session_course WHERE id_coach='".$_SESSION["_uid"]."'";
$sql = "SELECT course_code FROM $tbl_session_course WHERE id_coach='".intval($_SESSION["_uid"])."'";
$result = Database::query($sql, __FILE__, __LINE__);
if (Database::num_rows($result) > 0) {
return true;
@ -66,7 +66,7 @@ if (isset($_POST['export'])) {
$order_clause = api_sort_by_first_name() ? ' ORDER BY firstname, lastname' : ' ORDER BY lastname, firstname';
}
if (isset($_GET["id_student"])) {
$id_student = $_GET["id_student"];
$id_student = intval($_GET["id_student"]);
$sql_coachs = "SELECT DISTINCT src.id_coach " .
"FROM $tbl_session_rel_course as src, $tbl_session_rel_course_rel_user as srcru " .
"WHERE src.id_coach<>'0' AND src.course_code=srcru.course_code AND srcru.id_user='$id_student' AND srcru.id_session=src.id_session";
@ -78,7 +78,7 @@ if (isset($_GET["id_student"])) {
} else {
$sql_coachs = "SELECT DISTINCT id_coach, $tbl_user.user_id, lastname, firstname
FROM $tbl_user as user, $tbl_session_rel_course as session_rel_course, $tbl_course_user as course_rel_user
WHERE course_rel_user.course_code=session_rel_course.course_code AND course_rel_user.status='1' AND course_rel_user.user_id='".$_SESSION["_uid"]."'
WHERE course_rel_user.course_code=session_rel_course.course_code AND course_rel_user.status='1' AND course_rel_user.user_id='".intval($_SESSION["_uid"])."'
AND session_rel_course.id_coach=user.user_id".$order_clause;
}
}

1
main/mySpace/course.php
Unescape View File

@ -1,4 +1,5 @@
<?php
/* For licensing terms, see /dokeos_license.txt */
/*
* Created on 28 juil. 2006 by Elixir Interactive http://www.elixir-interactive.com
*/

38
main/mySpace/myStudents.php
Unescape View File

@ -206,7 +206,7 @@ $course_quiz_answer = 'quiz_answer';
$course_student_publication = Database :: get_course_table(TABLE_STUDENT_PUBLICATION);
if (isset ($_GET["user_id"]) && $_GET["user_id"] != "") {
$user_id = (int) $_GET["user_id"];
$user_id = intval($_GET['user_id']);
} else {
$user_id = $_user['user_id'];
}
@ -329,9 +329,7 @@ if (!empty ($_GET['student'])) {
<a name="infosStudent"></a>
<table width="100%" border="0" >
<tr>
<?php
<?php
$image_array = UserManager :: get_user_picture_path_by_id($info_user['user_id'], 'web', false, true);
echo '<td class="borderRight" width="10%" valign="top">';
@ -351,12 +349,9 @@ if (!empty ($_GET['student'])) {
} else {
echo '<input type="image" ' . $img_attributes . ' onclick="javascript: return show_image(\'' . $url_big_image . '\',\'' . $big_image_width . '\',\'' . $big_image_height . '\');"/>';
}
echo '</td>';
?>
<td width="40%" valign="top">
<table width="100%" class="data_table">
<tr>
<th>
@ -509,10 +504,10 @@ if (!empty ($_GET['student'])) {
$tbl_session_course_user = Database :: get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
$sql = 'SELECT id_session
FROM ' . $tbl_session_course_user . ' session_course_user
WHERE session_course_user.id_user = ' . intval($info_user['user_id']) . '
AND session_course_user.course_code = "' . Database :: escape_string($course_code_info) . '"
ORDER BY id_session DESC';
FROM ' . $tbl_session_course_user . ' session_course_user
WHERE session_course_user.id_user = ' . intval($info_user['user_id']) . '
AND session_course_user.course_code = "' . Database :: escape_string($course_code_info) . '"
ORDER BY id_session DESC';
$rs = Database::query($sql, __FILE__, __LINE__);
$num_row = Database :: num_rows($rs);
if ($num_row > 0) {
@ -520,15 +515,15 @@ if (!empty ($_GET['student'])) {
if ($le_session_id > 0) {
// get session name and coach of the session
$sql = 'SELECT name, id_coach FROM ' . $tbl_session . '
WHERE id=' . $le_session_id;
WHERE id=' . $le_session_id;
$rs = Database::query($sql, __FILE__, __LINE__);
$session_name = Database :: result($rs, 0, 'name');
$session_coach_id = intval(Database :: result($rs, 0, 'id_coach'));
// get coach of the course in the session
$sql = 'SELECT id_coach FROM ' . $tbl_session_course . '
WHERE id_session=' . $le_session_id . '
AND course_code = "' . Database :: escape_string($_GET['course']) . '"';
WHERE id_session=' . $le_session_id . '
AND course_code = "' . Database :: escape_string($_GET['course']) . '"';
$rs = Database::query($sql, __FILE__, __LINE__);
$session_course_coach_id = intval(Database :: result($rs, 0, 0));
@ -636,9 +631,8 @@ if (!empty ($_GET['student'])) {
$tbl_stats_attempts = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_ATTEMPT);
$tbl_quiz_questions = Database :: get_course_table(TABLE_QUIZ_QUESTION, $info_course['db_name']);
$sql_learnpath = "SELECT lp.name,lp.id
FROM $t_lp AS lp ORDER BY lp.name ASC
";
$sql_learnpath = " SELECT lp.name,lp.id
FROM $t_lp AS lp ORDER BY lp.name ASC";
$result_learnpath = Database::query($sql_learnpath, __FILE__, __LINE__);
@ -945,11 +939,11 @@ if (!empty ($_GET['student'])) {
$csv_content[] = array ();
$nb_assignments = Tracking :: count_student_assignments($info_user['user_id'], $info_course['code']);
$messages = Tracking :: count_student_messages($info_user['user_id'], $info_course['code']);
$links = Tracking :: count_student_visited_links($info_user['user_id'], $info_course['code']);
$documents = Tracking :: count_student_downloaded_documents($info_user['user_id'], $info_course['code']);
$chat_last_connection = Tracking :: chat_last_connection($info_user['user_id'], $info_course['code']);
$nb_assignments = Tracking :: count_student_assignments($info_user['user_id'], $info_course['code']);
$messages = Tracking :: count_student_messages($info_user['user_id'], $info_course['code']);
$links = Tracking :: count_student_visited_links($info_user['user_id'], $info_course['code']);
$documents = Tracking :: count_student_downloaded_documents($info_user['user_id'], $info_course['code']);
$chat_last_connection = Tracking :: chat_last_connection($info_user['user_id'], $info_course['code']);
$csv_content[] = array (
get_lang('Student_publication'),

7
main/mySpace/progression.php
Unescape View File

@ -1,5 +1,5 @@
<?php
/* For licensing terms, see /dokeos_license.txt */
/*
* Created on 28 juil. 2006 by Elixir Interactive http://www.elixir-interactive.com
*/
@ -33,10 +33,7 @@ $tbl_track_exercice = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_EX
MAIN CODE
===============================================================================
*/
$sql_course = "SELECT title,code
FROM $tbl_course as course
ORDER BY title ASC";
$sql_course = "SELECT title,code FROM $tbl_course as course ORDER BY title ASC";
$result_course = Database::query($sql_course, __FILE__, __LINE__);
if (Database::num_rows($result_course) > 0) {

27
main/mySpace/session.php
Unescape View File

@ -1,26 +1,5 @@
<?php
/*
==============================================================================
Dokeos - elearning and course management software
Copyright (c) 2008 Dokeos SPRL
Copyright (c) various contributors
For a full list of contributors, see "credits.txt".
The full license can be read in "license.txt".
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.
See the GNU General Public License for more details.
Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium
Mail: info@dokeos.com
==============================================================================
*/
/* For licensing terms, see /dokeos_license.txt */
/*
* Created on 28 juil. 2006 by Elixir Interactive http://www.elixir-interactive.com
* Somes fixes by Julio Montoya
@ -93,7 +72,7 @@ function rsort_sessions($a, $b) {
*/
if (isset($_GET['id_coach']) && $_GET['id_coach'] != '') {
$id_coach = $_GET['id_coach'];
$id_coach = intval($_GET['id_coach']);
} else {
$id_coach = $_user['user_id'];
}
@ -133,7 +112,7 @@ if ($nb_sessions > 0) {
}
if (isset($_GET['id_coach']) && $_GET['id_coach'] != '') {
$row[] = '<a href="student.php?id_session='.$session['id'].'&id_coach='.$_GET['id_coach'].'"><img src="'.api_get_path(WEB_IMG_PATH).'2rightarrow.gif" border="0" /></a>';
$row[] = '<a href="student.php?id_session='.$session['id'].'&id_coach='.intval($_GET['id_coach']).'"><img src="'.api_get_path(WEB_IMG_PATH).'2rightarrow.gif" border="0" /></a>';
} else {
$row[] = '<a href="course.php?id_session='.$session['id'].'"><img src="'.api_get_path(WEB_IMG_PATH).'2rightarrow.gif" border="0" /></a>';
}

2
main/mySpace/student.php
Unescape View File

@ -1,5 +1,5 @@
<?php
/* For licensing terms, see /dokeos_license.txt */
/*
* Created on 28 juil. 2006 by Elixir Interactive http://www.elixir-interactive.com
*/

4
main/mySpace/teachers.php
Unescape View File

@ -1,5 +1,5 @@
<?php
/* For licensing terms, see /dokeos_license.txt */
/*
* Created on 18 October 2006 by Elixir Interactive http://www.elixir-interactive.com
*/
@ -44,7 +44,7 @@ $sort_by_first_name = api_sort_by_first_name();
$order_clause = $sort_by_first_name ? ' ORDER BY firstname, lastname' : ' ORDER BY lastname, firstname';
if (isset($_GET["teacher_id"]) && $_GET["teacher_id"] != 0) {
$teacher_id = $_GET["teacher_id"];
$teacher_id = intval($_GET["teacher_id"]);
$sql_formateurs = "SELECT user_id,lastname,firstname,email
FROM $tbl_user
WHERE user_id='$teacher_id'".$order_clause;

25
main/mySpace/user_import.php
Unescape View File

@ -97,11 +97,12 @@ function check_user_in_array($usernames, $user_array) {
function user_available_in_session($username, $course_list, $id_session) {
$table_user = Database::get_main_table(TABLE_MAIN_USER);
$tbl_session_rel_course_rel_user = Database::get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
$id_session = intval($id_session);
$username = Database::escape_string($username);
foreach($course_list as $enreg_course) {
$sql_select = "SELECT u.user_id FROM $tbl_session_rel_course_rel_user rel INNER JOIN $table_user u
on (rel.id_user=u.user_id)
WHERE rel.id_session='$id_session' AND u.status='5' AND u.username ='$username' AND rel.course_code='$enreg_course'";
$sql_select = " SELECT u.user_id FROM $tbl_session_rel_course_rel_user rel INNER JOIN $table_user u
ON (rel.id_user=u.user_id)
WHERE rel.id_session='$id_session' AND u.status='5' AND u.username ='$username' AND rel.course_code='$enreg_course'";
$rs = Database::query($sql_select, __FILE__, __LINE__);
if (Database::num_rows($rs) > 0) {
return Database::result($rs, 0, 0);
@ -170,7 +171,7 @@ function get_user_creator($users, $course_list, $id_session) {
// database table definition
$table_user = Database::get_main_table(TABLE_MAIN_USER);
$tbl_session_rel_course_rel_user = Database::get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
$username = $user['UserName'];
$username = Database::escape_string($user['UserName']);
//echo "<br>";
$sql = "SELECT creator_id FROM $table_user WHERE username='$username' ";
@ -245,6 +246,7 @@ function save_data($users, $course_list, $id_session) {
$tbl_session_rel_course_rel_user = Database::get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
$tbl_session_rel_user = Database::get_main_table(TABLE_MAIN_SESSION_USER);
$id_session = intval($id_session);
$sendMail = $_POST['sendMail'] ? 1 : 0;
// Adding users to the platform.
@ -270,8 +272,9 @@ function save_data($users, $course_list, $id_session) {
foreach ($course_list as $enreg_course) {
$nbr_users = 0;
$new_users = array();
$enreg_course = Database::escape_string($enreg_course);
foreach ($users as $index => $user) {
$userid = $user['id'];
$userid = intval($user['id']);
$sql = "INSERT IGNORE INTO $tbl_session_rel_course_rel_user(id_session,course_code,id_user) VALUES('$id_session','$enreg_course','$userid')";
$course_session = array('course' => $enreg_course, 'added' => 1);
//$user['added_at_session'] = $course_session;
@ -472,9 +475,9 @@ api_block_anonymous_users();
$interbreadcrumb[] = array ('url' => 'index.php', 'name' => get_lang('MySpace'));
$id_session = '';
if (isset($_GET['id_session']) && $_GET['id_session'] != '') {
$id_session = Security::remove_XSS($_GET['id_session']);
$id_session = intval($_GET['id_session']);
$interbreadcrumb[] = array ('url' => 'session.php', 'name' => get_lang('Sessions'));
$interbreadcrumb[] = array ('url' => 'course.php?id_session='.$_GET['id_session'].'', 'name' => get_lang('Course'));
$interbreadcrumb[] = array ('url' => 'course.php?id_session='.$id_session.'', 'name' => get_lang('Course'));
}
// Set this option to true to enforce strict purification for usenames.
@ -491,7 +494,7 @@ if (!api_is_coach()) {
if (api_get_setting('add_users_by_coach') == 'true') {
if (!api_is_platform_admin()) {
if (isset($_REQUEST['id_session'])) {
$id_session = $_REQUEST['id_session'];
$id_session = intval($_REQUEST['id_session']);
$sql = 'SELECT id_coach FROM '.Database :: get_main_table(TABLE_MAIN_SESSION).' WHERE id='.$id_session;
$rs = Database::query($sql, __FILE__, __LINE__);
if (Database::result($rs, 0, 0) != $_user['user_id']) {
@ -509,7 +512,7 @@ set_time_limit(0);
if ($_POST['formSent'] && $_FILES['import_file']['size'] !== 0) {
$file_type = $_POST['file_type'];
$id_session = $_POST['id_session'];
$id_session = intval($_POST['id_session']);
if ($file_type == 'csv') {
$users = parse_csv_data($_FILES['import_file']['tmp_name']);
} else {
@ -617,4 +620,4 @@ $form->display();
FOOTER
==============================================================================
*/
Display :: display_footer();
Display :: display_footer();
Write Preview
Loading…
Cancel
Save