//Should generate an email someone is poking around
echo '';
}
}
if (isset($_REQUEST['btn-approve']) and isset($_REQUEST['hash'])) {
$hash = mysqli_real_escape_string($mysqli, $_REQUEST['hash']);
if ($userrow['userlevel'] > 2) {
// OK to approve
$query = "UPDATE requests SET status = 1 WHERE hash = '" . $hash . "'";
//echo '<br><br><br>' . $query . '<br>';
$mysqli->query($query);
$query = "SELECT levels.*, requests.requesterid FROM levels INNER JOIN requests ON levels.id = requests.achievementid WHERE requests.hash = '{$hash}'";
//echo '<br><br><br>' . $query . '<br>';
$result = $mysqli->query($query);
$row = $result->fetch_assoc();
addachievement($mysqli, $row['achievementid'], $row['level'], $row['requesterid']);
echo '<h3><BR><BR>All Done!</h3><a href="./home.php">Go Back</a>';
exit;
} else {
//Should generate an email someone is poking around
echo '';
}
}
if (isset($_REQUEST['btn-deny']) and isset($_REQUEST['hash'])) {
$hash = mysqli_real_escape_string($mysqli, $_REQUEST['hash']);
//Decide what to put into Comment
$comment = trim(mysqli_real_escape_string($mysqli, $_REQUEST['comment']));
$deny_select = trim(mysqli_real_escape_string($mysqli, $_REQUEST['deny_select']));
if ($comment == '') {
$query = "SELECT * FROM verdicts WHERE id = {$deny_select}";
$result = $mysqli->query($query);
//echo 'Emailing: ' . $row['username'] . '<BR>';
$userrow['reviewername'] = $row['username'];
if (email_message('Achievement Review Request', $row['onid'] . '@oregonstate.edu', create_message('./emails/committee.eml', $userrow)) == 0) {
// It worked
$query = "INSERT INTO reviews (requestid, reviewer, emaileddate) VALUES ({$requestid}, " . $row['id'] . ", NOW())";
$mysqli->query($query);
}
}
}
}
}
if (isset($_REQUEST['btn-give'])) {
$achievement = mysqli_real_escape_string($mysqli, $_REQUEST['giveachievement']);
$level = mysqli_real_escape_string($mysqli, $_REQUEST['givelevel']);
$employeeid = mysqli_real_escape_string($mysqli, $_REQUEST['employee']);
addachievement($mysqli, $achievement, $level, $employeeid);
}
if (isset($_REQUEST['btn-endorse'])) {
//This is to be reworked/removed soon
$achievement = $_REQUEST['achievement'];
$empRes = $mysqli->query("SELECT * FROM users WHERE id=" . $_REQUEST['employee']);
$empRow = $empRes->fetch_array(MYSQLI_ASSOC);
$empAch = array();
$empAch = unserialize($empRow['achievements']);
$empid = $empRow['id'];
$userid = $userrow['id'];
$levelRes = $mysqli->query("SELECT * FROM levels WHERE achievementid='{$achievement}' && level='{$level}'");
$levelRow = $levelRes->fetch_array(MYSQLI_ASSOC);
for ($i = 0; $i < count($empAch); $i++) {
for ($y = 0; $y < count($achievements); $y++) {
if ($empAch[$i] == $achievements[$y]) {
