engelsystem/includes/pages/user_myshifts.php

<?php

/**
 * @return string
 */
function myshifts_title()
{
    return _("My shifts");
}

/**
 * Zeigt die Schichten an, die ein Benutzer belegt
 *
 * @return string
 */
function user_myshifts()
{
    global $last_unsubscribe;
    global $user, $privileges;

    if (
        isset($_REQUEST['id'])
        && in_array("user_shifts_admin", $privileges)
        && preg_match("/^[0-9]{1,}$/", $_REQUEST['id'])
        && sql_num_query("SELECT * FROM `User` WHERE `UID`='" . sql_escape($_REQUEST['id']) . "'") > 0
    ) {
        $user_id = $_REQUEST['id'];
    } else {
        $user_id = $user['UID'];
    }

    list($shifts_user) = sql_select("SELECT * FROM `User` WHERE `UID`='" . sql_escape($user_id) . "' LIMIT 1");

    if (isset($_REQUEST['reset'])) {
        if ($_REQUEST['reset'] == "ack") {
            User_reset_api_key($user);
            success(_("Key changed."));
            redirect(page_link_to('users') . '&action=view&user_id=' . $shifts_user['UID']);
        }
        return page_with_title(_("Reset API key"), [
            error(
                _("If you reset the key, the url to your iCal- and JSON-export and your atom feed changes! You have to update it in every application using one of these exports."),
                true
            ),
            button(page_link_to('user_myshifts') . '&reset=ack', _("Continue"), 'btn-danger')
        ]);
    } elseif (isset($_REQUEST['edit']) && preg_match("/^[0-9]*$/", $_REQUEST['edit'])) {
        $user_id = $_REQUEST['edit'];
        $shift = sql_select("SELECT
        `ShiftEntry`.`freeloaded`,
        `ShiftEntry`.`freeload_comment`,
        `ShiftEntry`.`Comment`,
        `ShiftEntry`.`UID`,
        `ShiftTypes`.`name`,
        `Shifts`.*,
        `Room`.`Name`,
        `AngelTypes`.`name` AS `angel_type`
        FROM `ShiftEntry`
        JOIN `AngelTypes` ON (`ShiftEntry`.`TID` = `AngelTypes`.`id`)
        JOIN `Shifts` ON (`ShiftEntry`.`SID` = `Shifts`.`SID`)
        JOIN `ShiftTypes` ON (`ShiftTypes`.`id` = `Shifts`.`shifttype_id`)
        JOIN `Room` ON (`Shifts`.`RID` = `Room`.`RID`)
        WHERE `ShiftEntry`.`id`='" . sql_escape($user_id) . "'
        AND `UID`='" . sql_escape($shifts_user['UID']) . "' LIMIT 1");
        if (count($shift) > 0) {
            $shift = $shift[0];
            $freeloaded = $shift['freeloaded'];
            $freeload_comment = $shift['freeload_comment'];

            if (isset($_REQUEST['submit'])) {
                $valid = true;
                if (in_array("user_shifts_admin", $privileges)) {
                    $freeloaded = isset($_REQUEST['freeloaded']);
                    $freeload_comment = strip_request_item_nl('freeload_comment');
                    if ($freeloaded && $freeload_comment == '') {
                        $valid = false;
                        error(_("Please enter a freeload comment!"));
                    }
                }

                $comment = strip_request_item_nl('comment');
                $user_source = User($shift['UID']);

                if ($valid) {
                    $result = ShiftEntry_update([
                        'id'               => $user_id,
                        'Comment'          => $comment,
                        'freeloaded'       => $freeloaded,
                        'freeload_comment' => $freeload_comment
                    ]);
                    if ($result === false) {
                        engelsystem_error('Unable to update shift entry.');
                    }

                    engelsystem_log(
                        "Updated " . User_Nick_render($user_source) . "'s shift " . $shift['name']
                        . " from " . date("Y-m-d H:i", $shift['start'])
                        . " to " . date("Y-m-d H:i", $shift['end'])
                        . " with comment " . $comment
                        . ". Freeloaded: " . ($freeloaded ? "YES Comment: " . $freeload_comment : "NO")
                    );
                    success(_("Shift saved."));
                    redirect(page_link_to('users') . '&action=view&user_id=' . $shifts_user['UID']);
                }
            }

            return ShiftEntry_edit_view(
                User_Nick_render($shifts_user),
                date("Y-m-d H:i", $shift['start']) . ', ' . shift_length($shift),
                $shift['Name'],
                $shift['name'],
                $shift['angel_type'],
                $shift['Comment'],
                $shift['freeloaded'],
                $shift['freeload_comment'],
                in_array("user_shifts_admin", $privileges)
            );
        } else {
            redirect(page_link_to('user_myshifts'));
        }
    } elseif (isset($_REQUEST['cancel']) && preg_match("/^[0-9]*$/", $_REQUEST['cancel'])) {
        $user_id = $_REQUEST['cancel'];
        $shift = sql_select("
        SELECT *
        FROM `Shifts` 
        INNER JOIN `ShiftEntry` USING (`SID`) 
        WHERE `ShiftEntry`.`id`='" . sql_escape($user_id) . "' AND `UID`='" . sql_escape($shifts_user['UID']) . "'");
        if (count($shift) > 0) {
            $shift = $shift[0];
            if (($shift['start'] > time() + $last_unsubscribe * 3600) || in_array('user_shifts_admin', $privileges)) {
                $result = ShiftEntry_delete($user_id);
                if ($result === false) {
                    engelsystem_error('Unable to delete shift entry.');
                }
                $room = Room($shift['RID']);
                $angeltype = AngelType($shift['TID']);
                $shifttype = ShiftType($shift['shifttype_id']);

                engelsystem_log(
                    "Deleted own shift: " . $shifttype['name']
                    . " at " . $room['Name']
                    . " from " . date("Y-m-d H:i", $shift['start'])
                    . " to " . date("Y-m-d H:i", $shift['end'])
                    . " as " . $angeltype['name']
                );
                success(_("Shift canceled."));
            } else {
                error(_("It's too late to sign yourself off the shift. If neccessary, ask the dispatcher to do so."));
            }
        } else {
            redirect(user_link($shifts_user));
        }
    }

    redirect(page_link_to('users') . '&action=view&user_id=' . $shifts_user['UID']);
    return '';
}