Skip to content

Commit 9312aac

Browse files
johnnyqjohnnyq
authored
Merge pull request #1112 from itflow-org/portal-contacts-bugfix
Portal contacts
2 parents 9bc1ebd + da1b3b5 commit 9312aac

File tree

2 files changed

+69
-17
lines changed

2 files changed

+69
-17
lines changed

‎portal/contact_edit.php‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,12 @@
2121

2222
$contact_id = intval($_GET['id']);
2323

24-
$sql_contact = mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_email, contact_primary, contact_technical, contact_billing, contact_auth_method FROM contacts WHERE contact_id = $contact_id AND contact_client_id = $session_client_id AND contacts.contact_archived_at IS NULL LIMIT 1");
24+
$sql_contact = mysqli_query(
25+
$mysqli, "SELECT contact_id, contact_name, contact_email, contact_primary, contact_technical, contact_billing, user_auth_method
26+
FROM contacts
27+
LEFT JOIN users ON user_id = contact_user_id
28+
WHERE contact_id = $contact_id AND contact_client_id = $session_client_id AND contacts.contact_archived_at IS NULL LIMIT 1"
29+
);
2530

2631
$row = mysqli_fetch_array($sql_contact);
2732

@@ -32,7 +37,7 @@
3237
$contact_primary = intval($row['contact_primary']);
3338
$contact_technical = intval($row['contact_technical']);
3439
$contact_billing = intval($row['contact_billing']);
35-
$contact_auth_method = nullable_htmlentities($row['contact_auth_method']);
40+
$contact_auth_method = nullable_htmlentities($row['user_auth_method']);
3641
} else {
3742
header("Location: portal_post.php?logout");
3843
exit();

‎portal/portal_post.php‎

Lines changed: 62 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -324,43 +324,90 @@
324324
header('Location: index.php');
325325
}
326326

327-
if (isset($_POST['edit_contact'])) {
328-
$contact_id = intval($_POST['contact_id']);
327+
if (isset($_POST['add_contact'])) {
329328
$contact_name = sanitizeInput($_POST['contact_name']);
330329
$contact_email = sanitizeInput($_POST['contact_email']);
331330
$contact_technical = intval($_POST['contact_technical']);
332331
$contact_billing = intval($_POST['contact_billing']);
333332
$contact_auth_method = sanitizeInput($_POST['contact_auth_method']);
334333

335-
mysqli_query($mysqli, "UPDATE contacts SET contact_name = '$contact_name', contact_email = '$contact_email', contact_billing = $contact_billing, contact_technical = $contact_technical WHERE contact_id = $contact_id AND contact_client_id = $session_client_id AND contact_archived_at IS NULL AND contact_primary = 0");
334+
// Check the email isn't already in use
335+
$sql = mysqli_query($mysqli, "SELECT user_id FROM users WHERE user_email = '$contact_email'");
336+
if ($sql && mysqli_num_rows($sql) > 0) {
337+
$_SESSION['alert_type'] = "danger";
338+
$_SESSION['alert_message'] = "Cannot add contact as that email address is already in use";
339+
header('Location: contact_add.php');
340+
exit();
341+
}
342+
343+
// Create user account with rand password for the contact
344+
$contact_user_id = 0;
345+
if ($contact_name && $contact_email && $contact_auth_method) {
346+
347+
$password_hash = password_hash(randomString(), PASSWORD_DEFAULT);
348+
349+
mysqli_query($mysqli, "INSERT INTO users SET user_name = '$contact_name', user_email = '$contact_email', user_password = '$password_hash', user_auth_method = '$contact_auth_method', user_type = 2");
350+
351+
$contact_user_id = mysqli_insert_id($mysqli);
352+
}
353+
354+
// Create contact record
355+
mysqli_query($mysqli, "INSERT INTO contacts SET contact_name = '$contact_name', contact_email = '$contact_email', contact_billing = $contact_billing, contact_technical = $contact_technical, contact_client_id = $session_client_id, contact_user_id = $contact_user_id");
356+
$contact_id = mysqli_insert_id($mysqli);
336357

337358
// Logging
338-
logAction("Contact", "Edit", "Client contact $session_contact_name edited contact $contact_name in the client portal", $session_client_id, $contact_id);
359+
logAction("Contact", "Create", "Client contact $session_contact_name created contact $contact_name in the client portal", $session_client_id, $contact_id);
339360

340-
$_SESSION['alert_message'] = "Contact <strong>$contact_name</strong> updated";
341-
342-
header('Location: contacts.php');
361+
customAction('contact_create', $contact_id);
343362

344-
customAction('contact_update', $contact_id);
363+
$_SESSION['alert_message'] = "Contact $contact_name created";
364+
365+
header('Location: contacts.php');
345366
}
346367

347-
if (isset($_POST['add_contact'])) {
368+
if (isset($_POST['edit_contact'])) {
369+
$contact_id = intval($_POST['contact_id']);
348370
$contact_name = sanitizeInput($_POST['contact_name']);
349371
$contact_email = sanitizeInput($_POST['contact_email']);
350372
$contact_technical = intval($_POST['contact_technical']);
351373
$contact_billing = intval($_POST['contact_billing']);
352374
$contact_auth_method = sanitizeInput($_POST['contact_auth_method']);
353375

354-
mysqli_query($mysqli, "INSERT INTO contacts SET contact_name = '$contact_name', contact_email = '$contact_email', contact_billing = $contact_billing, contact_technical = $contact_technical, contact_client_id = $session_client_id");
376+
// Get the existing contact_user_id - we look it up ourselves so the user can't just overwrite random users
377+
$sql = mysqli_query($mysqli,"SELECT contact_user_id FROM contacts WHERE contact_id = $contact_id AND contact_client_id = $session_client_id");
378+
$row = mysqli_fetch_array($sql);
379+
$contact_user_id = intval($row['contact_user_id']);
380+
381+
// Check the email isn't already in use
382+
$sql = mysqli_query($mysqli, "SELECT user_id FROM users WHERE user_email = '$contact_email' AND user_id != $contact_user_id");
383+
if ($sql && mysqli_num_rows($sql) > 0) {
384+
$_SESSION['alert_type'] = "danger";
385+
$_SESSION['alert_message'] = "Cannot update contact as that email address is already in use";
386+
header('Location: contact_edit.php?id=' . $contact_id);
387+
exit();
388+
}
355389

356-
$contact_id = mysqli_insert_id($mysqli);
390+
// Update Existing User
391+
if ($contact_user_id > 0) {
392+
mysqli_query($mysqli, "UPDATE users SET user_name = '$contact_name', user_email = '$contact_email', user_auth_method = '$contact_auth_method' WHERE user_id = $contact_user_id");
357393

358-
// Logging
359-
logAction("Contact", "Create", "Client contact $session_contact_name created contact $contact_name in the client portal", $session_client_id, $contact_id);
394+
// Else, create New User
395+
} elseif ($contact_user_id == 0 && $contact_name && $contact_email && $contact_auth_method) {
396+
$password_hash = password_hash(randomString(), PASSWORD_DEFAULT);
397+
mysqli_query($mysqli, "INSERT INTO users SET user_name = '$contact_name', user_email = '$contact_email', user_password = '$password_hash', user_auth_method = '$contact_auth_method', user_type = 2");
360398

361-
customAction('contact_create', $contact_id);
399+
$contact_user_id = mysqli_insert_id($mysqli);
400+
}
362401

363-
$_SESSION['alert_message'] = "Contact <strong>$contact_name</strong> created";
402+
// Update contact
403+
mysqli_query($mysqli, "UPDATE contacts SET contact_name = '$contact_name', contact_email = '$contact_email', contact_billing = $contact_billing, contact_technical = $contact_technical, contact_user_id = $contact_user_id WHERE contact_id = $contact_id AND contact_client_id = $session_client_id AND contact_archived_at IS NULL AND contact_primary = 0");
364404

405+
// Logging
406+
logAction("Contact", "Edit", "Client contact $session_contact_name edited contact $contact_name in the client portal", $session_client_id, $contact_id);
407+
408+
$_SESSION['alert_message'] = "Contact $contact_name updated";
409+
365410
header('Location: contacts.php');
411+
412+
customAction('contact_update', $contact_id);
366413
}

0 commit comments

Comments
 (0)