//
// api.php
// IT Club
//
// Copyright (c) 2015, Mr. Gecko's Media (James Coleman)
// All rights reserved.
//
// The main API for managing different sections of the site.
//
if ($_REQUEST['authentication']==$_MGM['apiAuthentication'] && $_MGM['path'][1]=="email") {
$results = databaseQuery("SELECT * FROM members WHERE preferredMethod='Email' OR preferredMethod='Both'");
$members = array();
while ($result = databaseFetchAssoc($results)) {
array_push($members, $result);
}
header("Content-Type: application/json");
echo json_encode($members);
}
if ($_REQUEST['authentication']==$_MGM['apiAuthentication'] && $_MGM['path'][1]=="text") {
$results = databaseQuery("SELECT * FROM members WHERE preferredMethod='Text' OR preferredMethod='Both'");
$members = array();
while ($result = databaseFetchAssoc($results)) {
array_push($members, $result);
}
header("Content-Type: application/json");
echo json_encode($members);
}
if (isset($_MGM['user']) && $_MGM['user']['level']==1 && $_MGM['path'][1]=="settings") {
if ($_MGM['path'][2]=="save") {
$email = (isset($_REQUEST['email']) ? trim($_REQUEST['email']) : "");
$replyToEmail = (isset($_REQUEST['replyToEmail']) ? trim($_REQUEST['replyToEmail']) : "");
setSetting("email", $email);
setSetting("replyToEmail", $replyToEmail);
}
exit();
}
if (isset($_MGM['user']) && $_MGM['user']['level']==1 && $_MGM['path'][1]=="sidebar") {
if ($_MGM['path'][2]=="list") {
$results = databaseQuery("SELECT * FROM `sidebar` ORDER BY `order`");
while ($result = databaseFetchAssoc($results)) {
?>
=htmlspecialchars($result['id'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['title'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['url'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['order'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?>
}
}
if ($_MGM['path'][2]=="update") {
$id = (isset($_REQUEST['id']) ? trim($_REQUEST['id']) : "");
$title = (isset($_REQUEST['title']) ? trim($_REQUEST['title']) : "");
$url = (isset($_REQUEST['url']) ? trim($_REQUEST['url']) : "");
$order = (isset($_REQUEST['order']) ? trim($_REQUEST['order']) : "");
$results = databaseQuery("SELECT * FROM `sidebar` WHERE `id`=%s", $id);
$result = databaseFetchAssoc($results);
if ($result!=NULL) {
databaseQuery("UPDATE `sidebar` SET `title`=%s,`url`=%s,`order`=%s WHERE `id`=%s", $title, $url, $order, $id);
}
}
if ($_MGM['path'][2]=="delete") {
$id = (isset($_REQUEST['id']) ? trim($_REQUEST['id']) : "");
$results = databaseQuery("SELECT * FROM `sidebar` WHERE `id`=%s", $id);
$result = databaseFetchAssoc($results);
if ($result!=NULL) {
databaseQuery("DELETE FROM `sidebar` WHERE `id`=%s", $id);
}
}
if ($_MGM['path'][2]=="add") {
$title = (isset($_REQUEST['title']) ? trim($_REQUEST['title']) : "");
$url = (isset($_REQUEST['url']) ? trim($_REQUEST['url']) : "");
$order = (isset($_REQUEST['order']) ? trim($_REQUEST['order']) : "");
if (!empty($title) && !empty($url)) {
databaseQuery("INSERT INTO `sidebar` (`title`, `url`, `order`) VALUES (%s,%s,%s)", $title, $url, $order);
}
}
exit();
}
if (isset($_MGM['user']) && $_MGM['user']['level']==1 && $_MGM['path'][1]=="users") {
if ($_MGM['path'][2]=="list") {
$results = databaseQuery("SELECT * FROM users");
while ($result = databaseFetchAssoc($results)) {
$level = "Normal";
if ($result['level']==0)
$level = "Disabled";
if ($result['level']==1)
$level = "Administrator";
?>=htmlspecialchars($result['docid'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['email'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =$level?>
}
}
if ($_MGM['path'][2]=="update") {
$id = (isset($_REQUEST['id']) ? trim($_REQUEST['id']) : "");
$email = (isset($_REQUEST['email']) ? trim($_REQUEST['email']) : "");
$password = (isset($_REQUEST['password']) ? trim($_REQUEST['password']) : "");
$level = (isset($_REQUEST['level']) ? trim($_REQUEST['level']) : "");
$results = databaseQuery("SELECT * FROM users WHERE docid=%s", $id);
$result = databaseFetchAssoc($results);
if ($result!=NULL) {
if (empty($email))
$email = $result['email'];
$epassword = $result['password'];
if (!empty($password)) {
$salt = substr(sha1(rand()),0,12);
$epassword = $salt.hashPassword($password,hex2bin($salt));
}
if ($level=="")
$level = $result['level'];
databaseQuery("UPDATE users SET email=%s,password=%s,level=%s WHERE docid=%s", $email, $epassword, $level, $id);
}
}
if ($_MGM['path'][2]=="create") {
$email = (isset($_REQUEST['email']) ? trim($_REQUEST['email']) : "");
$password = (isset($_REQUEST['password']) ? trim($_REQUEST['password']) : "");
$level = (isset($_REQUEST['level']) ? trim($_REQUEST['level']) : "");
if (!empty($email) && !empty($level)) {
$salt = substr(sha1(rand()),0,12);
$epassword = $salt.hashPassword($password,hex2bin($salt));
databaseQuery("INSERT INTO users (email, password, time, level) VALUES (%s,%s,%s,%s)", $email, $epassword, $_MGM['time'], $level);
}
}
exit();
}
if (isset($_MGM['user']) && $_MGM['path'][1]=="members") {
if ($_MGM['path'][2]=="list") {
$results = databaseQuery("SELECT * FROM members");
while ($result = databaseFetchAssoc($results)) {
?>=htmlspecialchars($result['id'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['name'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['position'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['phone'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['email'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['preferredMethod'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?>
}
}
if ($_MGM['path'][2]=="download") {
function csvQuote($text) {
return "\"".str_replace("\"", "\"\"", $text)."\"";
}
echo "#,Name,Position,Phone,Email,Preferred Method\n";
$results = databaseQuery("SELECT * FROM data");
while ($result = databaseFetchAssoc($results)) {
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Content-Description: File Transfer");
header("Content-Disposition: inline; filename=\"".date("Y m d")." Data.csv\";" );
header("Content-Transfer-Encoding: binary");
header("Content-Type: application/csv");
$shirts = "";
$selectedShirts = json_decode($result['shirts']);
for ($i=0; $i=htmlspecialchars($result['id'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =date("l M j, h:i A", $result['date'])?> =htmlspecialchars($result['location'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> G =$rsvp['going']?> M =$rsvp['maybe']?> R =$rsvp['responses']?> Edit View RSVP RSVP
}
}
if ($_MGM['path'][2]=="add") {
$date = (isset($_REQUEST['date']) ? trim($_REQUEST['date']) : "");
$location = (isset($_REQUEST['location']) ? trim($_REQUEST['location']) : "");
$time = strtotime($date);
if ($time==0) {
echo "Bad date.";
exit();
}
if (!empty($location)) {
databaseQuery("INSERT INTO meetings (date, location) VALUES (%s,%s)", $time, $location);
echo "Successfully Added.";
} else {
echo "Missing Data.";
}
}
if ($_MGM['path'][2]=="save") {
$id = (isset($_REQUEST['id']) ? trim($_REQUEST['id']) : "");
$date = (isset($_REQUEST['date']) ? trim($_REQUEST['date']) : "");
$location = (isset($_REQUEST['location']) ? trim($_REQUEST['location']) : "");
$time = strtotime($date);
if ($time==0) {
echo "Bad date.";
exit();
}
if (!empty($id) && intVal($id)!=0 && !empty($location)) {
databaseQuery("UPDATE meetings SET date=%s,location=%s WHERE id=%s", $time, $location, $id);
echo "Successfully Saved.";
} else {
echo "Missing Data.";
}
}
if (!empty($_MGM['path'][2]) && intVal($_MGM['path'][2])!=0) {
$id = intVal($_MGM['path'][2]);
if ($_MGM['path'][3]=="list") {
$results = databaseQuery("SELECT * FROM rsvp WHERE meeting=%s", $id);
while ($result = databaseFetchAssoc($results)) {
?>=htmlspecialchars($result['id'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =date("m/d/y h:i:s A", $result['date'])?> =htmlspecialchars($result['name'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['contact'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =($result['choice']==0 ? "Going" : ($result['choice']==1 ? "Maybe" : "Not Attending"))?> Going Maybe Not Attending
}
}
if ($_MGM['path'][3]=="going") {
$rsvpID = (isset($_REQUEST['id']) ? trim($_REQUEST['id']) : "");
if (!empty($rsvpID) && intVal($id)!=0) {
databaseQuery("UPDATE rsvp SET choice=0 WHERE id=%s", $rsvpID);
} else {
echo "Missing Data.";
}
}
if ($_MGM['path'][3]=="maybe") {
$rsvpID = (isset($_REQUEST['id']) ? trim($_REQUEST['id']) : "");
if (!empty($rsvpID) && intVal($id)!=0) {
databaseQuery("UPDATE rsvp SET choice=1 WHERE id=%s", $rsvpID);
} else {
echo "Missing Data.";
}
}
if ($_MGM['path'][3]=="not_attending") {
$rsvpID = (isset($_REQUEST['id']) ? trim($_REQUEST['id']) : "");
if (!empty($rsvpID) && intVal($rsvpID)!=0) {
databaseQuery("UPDATE rsvp SET choice=3 WHERE id=%s", $rsvpID);
} else {
echo "Missing Data.";
}
}
}
}
if (isset($_MGM['user']) && $_MGM['path'][1]=="announcements") {
if ($_MGM['path'][2]=="list") {
$results = databaseQuery("SELECT *,(SELECT email FROM users WHERE user=docid) AS email FROM announcements");
while ($result = databaseFetchAssoc($results)) {
?>=htmlspecialchars($result['id'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['email'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =htmlspecialchars($result['subject'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =str_replace("\n"," ",htmlspecialchars($result['message'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true))?> =htmlspecialchars($result['sms'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =date("m/d/y h:i:s A", $result['date'])?>
}
}
if ($_MGM['path'][2]=="send") {
$subject = (isset($_REQUEST['subject']) ? trim($_REQUEST['subject']) : "");
$message = (isset($_REQUEST['message']) ? trim($_REQUEST['message']) : "");
$smsmessage = (isset($_REQUEST['smsmessage']) ? trim($_REQUEST['smsmessage']) : "");
if (strlen($smsmessage)>160) {
echo "SMS Message it too long.";
exit();
}
if ((!empty($subject) && !empty($message)) || !empty($smsmessage)) {
databaseQuery("INSERT INTO announcements (user, subject, message, sms, date) VALUES (%s,%s,%s,%s,%s)", $_MGM['user']['docid'], $subject, $message, $smsmessage, $_MGM['time']);
$email = getSetting("email");
$replyToEmail = getSetting("replyToEmail");
if (!empty($subject) && !empty($message)) {
$headers = "From: ".$email."\r\n";
$headers .= "Reply-to: ".$replyToEmail."\r\n";
$results = databaseQuery("SELECT * FROM members WHERE preferredMethod='Email' OR preferredMethod='Both'");
$oneSuccessful = false;
while ($result = databaseFetchAssoc($results)) {
$address = $result['email'];
if (mail($address, $subject, $message, $headers)) {
$oneSuccessful = true;
}
}
if ($oneSuccessful) {
echo "Successfully Sent.";
} else {
echo "Failure sending email.";
}
}
if (!empty($smsmessage)) {
echo "SMS not implemented.";
}
} else {
echo "Missing Data.";
}
}
}
if ($_MGM['path'][1]=="rsvp") {
if ($_MGM['path'][2]=="list") {
$results = databaseQuery("SELECT * FROM meetings WHERE date>=%d", $_MGM['time']);
while ($result = databaseFetchAssoc($results)) {
?>=htmlspecialchars($result['id'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?> =date("l M j, h:i A", $result['date'])?> =htmlspecialchars($result['location'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?>
}
}
if (!empty($_MGM['path'][2]) && intVal($_MGM['path'][2])!=0) {
$id = intVal($_MGM['path'][2]);
if ($_MGM['path'][3]=="submit") {
$name = (isset($_REQUEST['name']) ? trim($_REQUEST['name']) : "");
$contact = (isset($_REQUEST['contact']) ? trim($_REQUEST['contact']) : "");
$choice = (isset($_REQUEST['choice']) ? trim($_REQUEST['choice']) : "");
if ((empty($choice) && $choice!=0) || empty($name)) {
?>Missing fields.
exit();
}
if (!filter_var($contact, FILTER_VALIDATE_EMAIL)) {
$contact = preg_replace("/[^0-9]/", "", $contact);
if (strlen($contact)==7) {
$contact = "256".$contact;
} else if (strlen($contact)!=10) {
?>Invalid contact info.
exit();
}
}
$rsvps = databaseQuery("SELECT * FROM rsvp WHERE meeting=%s AND contact=%s", $id, $contact);
$rsvp = databaseFetchAssoc($rsvps);
if ($rsvp!=NULL) {
databaseQuery("UPDATE rsvp SET choice=%s WHERE meeting=%s AND contact=%s", $choice, $id, $contact);
?>Your RSVP was updated.
} else {
databaseQuery("INSERT INTO rsvp (meeting,name,contact,choice,date) VALUES (%s,%s,%s,%s,%s)", $id, $name, $contact, $choice, $_MGM['time']);
?>Your RSVP was submitted.
}
}
}
}
exit();
?>