echo "<td><input type='text' size='5' name='hi_review_days' maxlength='3' value='{$_SESSION['formdata']['add_servicelevel']['hi_review_days']}' /> {$strDays}</td>";
echo "</tr>\n";
echo "<tr class='shade2'>";
echo "<td>{$strCritical}</td>";
echo "<td><input type='text' size='5' name='crit_initial_response_mins' maxlength='5' value='{$_SESSION['formdata']['add_servicelevel']['crit_initial_response_mins']}' /> {$strMinutes}</td>";
echo "<td><input type='text' size='5' name='crit_prob_determ_mins' maxlength='5' value='{$_SESSION['formdata']['add_servicelevel']['crit_prob_determ_mins']}' /> {$strMinutes}</td>";
echo "<td><input type='text' size='5' name='crit_action_plan_mins' maxlength='5' value='{$_SESSION['formdata']['add_servicelevel']['crit_action_plan_mins']}' /> {$strMinutes}</td>";
echo "<td><input type='text' size='5' name='crit_resolution_days' maxlength='3' value='{$_SESSION['formdata']['add_servicelevel']['crit_resolution_days']}' /> {$strDays}</td>";
echo "<td><input type='text' size='5' name='crit_review_days' maxlength='3' value='{$_SESSION['formdata']['add_servicelevel']['crit_review_days']}' /> {$strDays}</td>";
echo "</tr>\n";
echo "</table>";
echo "<input type='hidden' name='action' value='edit' />";
echo "<p align='center'><input type='submit' value='{$strSave}' /></p>";
echo "</form>";
include APPLICATION_INCPATH . 'htmlfooter.inc.php';
clear_form_data('add_servicelevel');
} elseif ($action == "edit") {
// External variables
$tag = trim(mysql_real_escape_string(strip_tags($_POST['tag'])));
$low_initial_response_mins = mysql_real_escape_string($_POST['low_initial_response_mins']);
$low_prob_determ_mins = mysql_real_escape_string($_POST['low_prob_determ_mins']);
$low_action_plan_mins = mysql_real_escape_string($_POST['low_action_plan_mins']);
$low_resolution_days = mysql_real_escape_string($_POST['low_resolution_days']);
$low_review_days = mysql_real_escape_string($_POST['low_review_days']);
$med_initial_response_mins = mysql_real_escape_string($_POST['med_initial_response_mins']);
$med_prob_determ_mins = mysql_real_escape_string($_POST['med_prob_determ_mins']);
$med_action_plan_mins = mysql_real_escape_string($_POST['med_action_plan_mins']);
$med_resolution_days = mysql_real_escape_string($_POST['med_resolution_days']);
$med_review_days = mysql_real_escape_string($_POST['med_review_days']);
$hi_initial_response_mins = mysql_real_escape_string($_POST['hi_initial_response_mins']);
$hi_prob_determ_mins = mysql_real_escape_string($_POST['hi_prob_determ_mins']);
$addition_errors_string .= user_alert($strAdditionFail, E_USER_WARNING);
}
// Add service
$sql = "INSERT INTO `{$dbService}` (contractid, startdate, enddate, creditamount, unitrate, incidentrate, foc) ";
$sql .= "VALUES ('{$maintid}', '{$startdate}', '{$enddate}', '{$amount}', '{$unitrate}', '{$incidentrate}', '{$foc}')";
mysql_query($sql);
if (mysql_error()) {
trigger_error(mysql_error(), E_USER_ERROR);
}
if (mysql_affected_rows() < 1) {
trigger_error("Insert failed", E_USER_ERROR);
}
$serviceid = mysql_insert_id();
update_contract_balance($maintid, $strNewContract, $amount, $serviceid);
if ($addition_errors == 1) {
// show addition error message
include APPLICATION_INCPATH . 'htmlheader.inc.php';
echo $addition_errors_string;
include APPLICATION_INCPATH . 'htmlfooter.inc.php';
} else {
// show success message
trigger('TRIGGER_NEW_CONTRACT', array('contractid' => $maintid, 'userid' => $sit[2]));
html_redirect("contract_details.php?id={$maintid}");
}
clear_form_data('add_contract');
} else {
// show error message if errors
include APPLICATION_INCPATH . 'htmlheader.inc.php';
html_redirect("contract_add.php", FALSE);
}
}
$errors = 0;
// check for blank name
if ($name == '') {
$errors++;
$_SESSION['formerrors']['add_product']['name'] = sprintf($strFieldMustNotBeBlank, $strProduct);
}
if ($vendor == '' or $vendor == "0") {
$errors++;
$_SESSION['formerrors']['add_product']['vendor'] = sprintf($strFieldMustNotBeBlank, $strVendor);
}
// add product if no errors
if ($errors == 0) {
$sql = "INSERT INTO `{$dbProducts}` (name, vendorid, description) VALUES ('{$name}', '{$vendor}', '{$description}')";
$result = mysql_query($sql);
if (mysql_error()) {
trigger_error("MySQL Query Error " . mysql_error(), E_USER_ERROR);
}
if (!$result) {
echo "<p class='error'>" . sprintf($strAddXfailed, $strProduct) . "\n";
} else {
$id = mysql_insert_id();
journal(CFG_LOGGING_NORMAL, 'Product Added', "Product {$id} was added", CFG_JOURNAL_PRODUCTS, $id);
html_redirect("products.php");
}
clear_form_errors('add_product');
clear_form_data('add_product');
} else {
include APPLICATION_INCPATH . 'htmlheader.inc.php';
html_redirect("product_add.php", FALSE);
}
}
$_SESSION['formdata']['role_edit'] = $_REQUEST;
if (empty($rolename)) {
$errors++;
$_SESSION['formerrors']['role_edit']['rolename'] = sprintf($strFieldMustNotBeBlank, $strName);
}
$sql = "SELECT * FROM `{$dbRoles}` WHERE rolename = '{$rolename}' AND id != {$roleid}";
$result = mysql_query($sql);
if (mysql_error()) {
trigger_error("MySQL Query Error " . mysql_error(), E_USER_ERROR);
}
if (mysql_num_rows($result) > 0) {
$errors++;
$_SESSION['formerrors']['role_edit']['duplicaterole'] = "{$strADuplicateAlreadyExists}</p>\n";
}
if ($errors == 0) {
clear_form_data('role_add');
clear_form_errors('role_add');
$sql = "UPDATE `{$dbRoles}` SET rolename = '{$rolename}', description = '{$description}' WHERE id = {$roleid}";
$result = mysql_query($sql);
if (mysql_error()) {
trigger_error("MySQL Query Error " . mysql_error(), E_USER_ERROR);
}
if (mysql_affected_rows() > 0) {
html_redirect("role.php?roleid={$roleid}", TRUE);
} else {
html_redirect($_SESSION['PHP_SELF'], FALSE);
}
} else {
html_redirect($_SESSION['PHP_SELF'], FALSE);
}
}
if (mysql_error()) {
trigger_error("MySQL Query Error " . mysql_error(), E_USER_ERROR);
}
$newuserid = mysql_insert_id();
// Create permissions (set to none)
$sql = "SELECT * FROM `{$dbPermissions}`";
$result = mysql_query($sql);
if (mysql_error()) {
trigger_error("MySQL Query Error " . mysql_error(), E_USER_WARNING);
}
while ($perm = mysql_fetch_object($result)) {
$psql = "INSERT INTO `{$dbUserPermissions}` (userid, permissionid, granted) ";
$psql .= "VALUES ('{$newuserid}', '{$perm->id}', 'false')";
mysql_query($psql);
if (mysql_error()) {
trigger_error("MySQL Query Error " . mysql_error(), E_USER_ERROR);
}
}
if (!$result) {
echo "<p class='error'>{$strAdditionFail}</p>\n";
} else {
setup_user_triggers($newuserid);
trigger('TRIGGER_NEW_USER', array('userid' => $newuserid));
html_redirect("manage_users.php#userid{$newuserid}");
}
clear_form_data('add_user');
clear_form_errors('add_user');
} else {
html_redirect($_SERVER['PHP_SELF'], FALSE);
}
}
}
if ($email == '') {
$errors++;
$_SESSION['formerrors']['add_site']['email'] = user_alert(sprintf($strFieldMustNotBeBlank, "'{$strEmail}'"), E_USER_ERROR);
}
// add site if no errors
if ($errors == 0) {
if ($owner == '') {
$owner = 0;
}
$sql = "INSERT INTO `{$dbSites}` (name, department, address1, address2, city, county, country, postcode, telephone, fax, email, websiteurl, notes, typeid, owner) ";
$sql .= "VALUES ('{$name}', '{$department}' ,'{$address1}', '{$address2}', '{$city}', '{$county}', '{$country}', '{$postcode}', ";
$sql .= "'{$telephone}', '{$fax}', '{$email}', '{$websiteurl}', '{$notes}', '{$typeid}','{$owner}')";
$result = mysql_query($sql);
if (mysql_error()) {
trigger_error("MySQL Query Error " . mysql_error(), E_USER_ERROR);
}
$id = mysql_insert_id();
// show error message if addition failed
if (!$result) {
echo "<p class='error'>{$strAddSiteFailed}</p>\n";
} else {
clear_form_data('add_site');
clear_form_errors('add_site');
trigger('TRIGGER_NEW_SITE', array('siteid' => $id, 'userid' => $sit[2]));
html_redirect("site_details.php?id={$id}");
}
} else {
html_redirect($_SERVER['PHP_SELF'], FALSE);
}
}
if ($_SESSION['formdata']['add_task']['taskuser'] != '') {
echo user_drop_down('taskuser', $_SESSION['formdata']['add_task']['taskuser'], FALSE);
} else {
echo user_drop_down('taskuser', $sit[2], FALSE);
}
echo help_link('TaskUser') . "</td></tr>";
echo "<tr><th>{$strPrivacy}" . help_link('TaskPrivacy') . "</th>";
echo "<td>";
if ($_SESSION['formdata']['add_task']['distribution'] == 'public') {
echo "<label><input type='radio' name='distribution' checked='checked'";
echo " value='public' /> {$strPublic}</label><br />";
echo "<label><input type='radio' name='distribution' value='private' />";
echo " {$strPrivate} ";
echo icon('private', 16, $strPrivate, "{$strPublic}/{$strPrivate}");
echo "</label></td></tr>";
} else {
echo "<label><input type='radio' name='distribution' value='public' /> {$strPublic}</label><br />";
echo "<label><input type='radio' name='distribution' checked='checked' value='private' /> {$strPrivate} ";
echo icon('private', 16, $strPrivate, "{$strPublic}/{$strPrivate}");
echo "</label></td></tr>";
}
echo "</table>";
echo "<p><input name='submit' type='submit' value='{$strAddTask}' /></p>";
echo "<input type='hidden' name='action' value='addtask' />";
echo "</form>";
//cleanup form vars
clear_form_data('add_task');
clear_form_errors('add_site');
include APPLICATION_INCPATH . 'htmlfooter.inc.php';
}
}
echo "<th>{$strFreeOfCharge}</th>";
echo "<td><input type='checkbox' id='foc' name='foc' value='yes' /> {$strAboveMustBeCompletedToAllowDeductions}</td>";
echo "</tr>\n";
echo "</tbody>\n";
}
// Not sure how applicable daily rate is, INL 4Apr08
// echo "<tr><th>{$strDailyRate}</th>";
// echo "<td>{$CONFIG['currency_symbol']} <input type='text' name='dailyrate' size='5' />";
// echo "</td></tr>";
echo "</table>\n\n";
echo "<input type='hidden' name='contractid' value='{$contractid}' />";
echo "<p><input name='submit' type='submit' value=\"{$strAdd}\" /></p>";
echo "</form>\n";
echo "<p align='center'><a href='contract_details.php?id={$contractid}'>{$strReturnWithoutSaving}</a></p>";
//cleanup form vars
clear_form_data('add_service');
include APPLICATION_INCPATH . 'htmlfooter.inc.php';
} else {
// External variables
$contractid = cleanvar($_POST['contractid']);
$startdate = strtotime($_REQUEST['startdate']);
if ($startdate > 0) {
$startdate = date('Y-m-d', $startdate);
} else {
$startdate = date('Y-m-d', $now);
}
$enddate = strtotime($_REQUEST['enddate']);
if ($enddate > 0) {
$enddate = date('Y-m-d', $enddate);
} else {
$enddate = date('Y-m-d', strtotime($startdate) + 31556926);
// External variables
$name = cleanvar($_REQUEST['name']);
$_SESSION['formdata'] = $_REQUEST;
// Add new
$errors = 0;
// check for blank name
if ($name == '') {
$errors++;
$_SESSION['formerrors']['name'] = user_alert(sprintf($strFieldMustNotBeBlank, "'{$strVendorName}'"), E_USER_ERROR);
}
// add product if no errors
if ($errors == 0) {
$sql = "INSERT INTO `{$dbVendors}` (name) VALUES ('{$name}')";
$result = mysql_query($sql);
if (mysql_error()) {
trigger_error("MySQL Query Error " . mysql_error(), E_USER_ERROR);
}
if (!$result) {
echo "<p class='error'>{$strAdditionFail}</p>\n";
} else {
$id = mysql_insert_id();
journal(CFG_LOGGING_DEBUG, 'Vendor Added', "Vendor {$id} was added", CFG_JOURNAL_DEBUG, $id);
html_redirect("products.php");
}
clear_form_data('add_vendor');
clear_form_errors('add_vendor');
} else {
include APPLICATION_INCPATH . 'htmlheader.inc.php';
html_redirect($_SERVER['PHP_SELF'], FALSE);
}
}
// External variables
$name = cleanvar($_REQUEST['name']);
$type = cleanvar($_REQUEST['type']);
$trackurl = cleanvar($_REQUEST['trackurl']);
$homeurl = cleanvar($_REQUEST['homeurl']);
$title = cleanvar($_REQUEST['title']);
$emaildomain = cleanvar($_REQUEST['emaildomain']);
$_SESSION['formdata']['add_escalation_path'] = $_REQUEST;
$errors = 0;
if (empty($name)) {
$errors++;
$_SESSION['formerrors']['add_escalation_path']['name'] = user_alert(sprintf($strFieldMustNotBeBlank, "'{$strName}'"), E_USER_ERROR);
}
if ($errors == 0) {
$sql = "INSERT INTO `{$dbEscalationPaths}` (name,track_url,home_url,url_title,email_domain) VALUES ";
$sql .= " ('{$name}','{$trackurl}','{$homeurl}','{$title}','{$emaildomain}')";
$result = mysql_query($sql);
if (mysql_error()) {
trigger_error(mysql_error(), E_USER_ERROR);
}
if (!$result) {
$_SESSION['formerrors']['add_escalation_path']['error'] = "{$strError}: {$strFailed}";
} else {
html_redirect("escalation_paths.php");
}
clear_form_errors('add_escalation_path');
clear_form_data('add_escalation_path');
} else {
html_redirect("escalation_path_add.php", FALSE);
}
}
/**
* Procceses a new contact
*
* @author Kieran Hogg
*/
function process_add_contact($mode = 'internal')
{
global $now, $CONFIG, $dbContacts, $sit;
// Add new contact
// External variables
$siteid = mysql_real_escape_string($_REQUEST['siteid']);
$email = strtolower(cleanvar($_REQUEST['email']));
$dataprotection_email = mysql_real_escape_string($_REQUEST['dataprotection_email']);
$dataprotection_phone = mysql_real_escape_string($_REQUEST['dataprotection_phone']);
$dataprotection_address = mysql_real_escape_string($_REQUEST['dataprotection_address']);
$username = cleanvar($_REQUEST['username']);
$courtesytitle = cleanvar($_REQUEST['courtesytitle']);
$forenames = cleanvar($_REQUEST['forenames']);
$surname = cleanvar($_REQUEST['surname']);
$jobtitle = cleanvar($_REQUEST['jobtitle']);
$address1 = cleanvar($_REQUEST['address1']);
$address2 = cleanvar($_REQUEST['address2']);
$city = cleanvar($_REQUEST['city']);
$county = cleanvar($_REQUEST['county']);
if (!empty($address1)) {
$country = cleanvar($_REQUEST['country']);
} else {
$country = '';
}
$postcode = cleanvar($_REQUEST['postcode']);
$phone = cleanvar($_REQUEST['phone']);
$mobile = cleanvar($_REQUEST['mobile']);
$fax = cleanvar($_REQUEST['fax']);
$department = cleanvar($_REQUEST['department']);
$notes = cleanvar($_REQUEST['notes']);
$returnpage = cleanvar($_REQUEST['return']);
$_SESSION['formdata']['add_contact'] = $_REQUEST;
$errors = 0;
// check for blank name
if ($surname == '') {
$errors++;
$_SESSION['formerrors']['add_contact']['surname'] = $GLOBALS['strMustEnterSurname'];
}
// check for blank site
if ($siteid == '') {
$errors++;
$_SESSION['formerrors']['add_contact']['siteid'] = $GLOBALS['strMustSelectCustomerSite'];
}
// check for blank email
if ($email == '' or $email == 'none' or $email == 'n/a') {
$errors++;
$_SESSION['formerrors']['add_contact']['email'] = $GLOBALS['strMustEnterEmail'];
}
if ($siteid == 0 or $siteid == '') {
$errors++;
$_SESSION['formerrors']['add_contact']['siteid'] = $GLOBALS['strMustSelectSite'];
}
// Check this is not a duplicate
$sql = "SELECT id FROM `{$dbContacts}` WHERE email='{$email}' AND LCASE(surname)=LCASE('{$surname}') LIMIT 1";
$result = mysql_query($sql);
if (mysql_num_rows($result) >= 1) {
$errors++;
$_SESSION['formerrors']['add_contact']['duplicate'] = $GLOBALS['strContactRecordExists'];
}
// add contact if no errors
if ($errors == 0) {
if (!empty($dataprotection_email)) {
$dataprotection_email = 'Yes';
} else {
$dataprotection_email = 'No';
}
if (!empty($dataprotection_phone)) {
$dataprotection_phone = 'Yes';
} else {
$dataprotection_phone = 'No';
}
if (!empty($dataprotection_address)) {
$dataprotection_address = 'Yes';
} else {
$dataprotection_address = 'No';
}
// generate username and password
$username = strtolower(substr($surname, 0, strcspn($surname, " ")));
$prepassword = generate_password();
$password = md5($prepassword);
$sql = "INSERT INTO `{$dbContacts}` (username, password, courtesytitle, forenames, surname, jobtitle, ";
$sql .= "siteid, address1, address2, city, county, country, postcode, email, phone, mobile, fax, ";
$sql .= "department, notes, dataprotection_email, dataprotection_phone, dataprotection_address, ";
$sql .= "timestamp_added, timestamp_modified) ";
$sql .= "VALUES ('{$username}', '{$password}', '{$courtesytitle}', '{$forenames}', '{$surname}', '{$jobtitle}', ";
$sql .= "'{$siteid}', '{$address1}', '{$address2}', '{$city}', '{$county}', '{$country}', '{$postcode}', '{$email}', ";
$sql .= "'{$phone}', '{$mobile}', '{$fax}', '{$department}', '{$notes}', '{$dataprotection_email}', ";
$sql .= "'{$dataprotection_phone}', '{$dataprotection_address}', '{$now}', '{$now}')";
$result = mysql_query($sql);
if (mysql_error()) {
trigger_error("MySQL Query Error " . mysql_error(), E_USER_ERROR);
}
// concatenate username with insert id to make unique
$newid = mysql_insert_id();
$username = $username . $newid;
$sql = "UPDATE `{$dbContacts}` SET username='******' WHERE id='{$newid}'";
$result = mysql_query($sql);
if (mysql_error()) {
trigger_error("MySQL Query Error " . mysql_error(), E_USER_ERROR);
}
if (!$result) {
if ($mode == 'internal') {
html_redirect("contact_add.php", FALSE);
} else {
html_redirect("addcontact.php", FALSE);
}
} else {
clear_form_data('add_contact');
clear_form_errors('add_contact');
$sql = "SELECT username, password FROM `{$dbContacts}` WHERE id={$newid}";
$result = mysql_query($sql);
if (mysql_error()) {
trigger_error("MySQL Query Error " . mysql_error(), E_USER_WARNING);
} else {
if ($CONFIG['portal'] and $_POST['emaildetails'] == 'on') {
trigger('TRIGGER_NEW_CONTACT', array('contactid' => $newid, 'prepassword' => $prepassword, 'userid' => $sit[2]));
}
if ($returnpage == 'addincident') {
html_redirect("incident_add.php?action=findcontact&contactid={$newid}");
exit;
} elseif ($mode == 'internal') {
html_redirect("contact_details.php?id={$newid}");
exit;
} else {
html_redirect("contactdetails.php?id={$newid}");
exit;
}
}
}
} else {
if ($mode == 'internal') {
html_redirect('contact_add.php', FALSE);
} else {
html_redirect('addcontact.php', FALSE);
}
}
}