search_users()

Complexity

Conditions	31
Paths	9220

Size

Total Lines	202
Code Lines	128

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
function search_users($needle, $type)
{
    $courseId = isset($_GET['course_id']) ? (int) $_GET['course_id'] : 0;
    $id_session = isset($_GET['id_session']) ? (int) $_GET['id_session'] : 0;

    $tbl_user = Database::get_main_table(TABLE_MAIN_USER);
    $tbl_session_rel_user = Database::get_main_table(TABLE_MAIN_SESSION_USER);
    $tableRelSessionCourseUser = Database::get_main_table(TABLE_MAIN_SESSION_COURSE_USER);

    $xajax_response = new xajaxResponse();
    $return = '';

    if (!empty($needle) && !empty($type)) {
        // Normal behaviour
        if ('any_session' == $type && 'false' == $needle) {
            $type = 'multiple';
            $needle = '';
        }

        $needle = Database::escape_string($needle);
        $order_clause = ' ORDER BY lastname, firstname, username';
        $showOfficialCode = false;

        $orderListByOfficialCode = api_get_setting('display.order_user_list_by_official_code');
        if ('true' === $orderListByOfficialCode) {
            $showOfficialCode = true;
            $order_clause = ' ORDER BY official_code, lastname, firstname, username';
        }

        if (api_is_session_admin()
            && 'true' === api_get_setting('prevent_session_admins_to_manage_all_users')
        ) {
            $order_clause = ' AND user.creator_id = '.api_get_user_id().$order_clause;
        }

        $cond_user_id = '';

        // Only for single & multiple
        if (in_array($type, ['single', 'multiple'])) {
            if (!empty($id_session)) {
                // check id_user from session_rel_user table
                $sql = "
                    SELECT su.user_id
                    FROM $tbl_session_rel_user  su
                    INNER JOIN $tableRelSessionCourseUser sc
                    ON (sc.session_id = su.session_id AND su.user_id = sc.user_id)
                    WHERE
                        sc.c_id = $courseId AND
                        su.session_id = $id_session AND
                        su.relation_type = ".Session::STUDENT;
                $res = Database::query($sql);
                $user_ids = [];
                if (Database::num_rows($res) > 0) {
                    while ($row = Database::fetch_row($res)) {
                        $user_ids[] = (int) $row[0];
                    }
                }
                if (count($user_ids) > 0) {
                    $cond_user_id = ' AND user.id NOT IN('.implode(",", $user_ids).')';
                }
            }
        }

        switch ($type) {
            case 'single':
                // search users where username or firstname or lastname begins likes $needle
                $sql = "
                    SELECT user.id, username, lastname, firstname, official_code
                    FROM $tbl_user user
                    WHERE
                        (
                            username LIKE '$needle%'
                            OR lastname LIKE '$needle%'
                            OR firstname LIKE '$needle%'
                        ) AND
                      user.status <> 6 AND
                      user.status <> ".DRH."
                    $order_clause
                    LIMIT 11
                ";
                break;
            case 'multiple':
                $sql = "
                    SELECT user.id, username, lastname, firstname, official_code
                    FROM $tbl_user user
                    WHERE
                        lastname LIKE '$needle%' AND
                        user.status <> ".DRH." AND
                        user.status <> 6 $cond_user_id
                    $order_clause
                ";
                break;
            case 'any_session':
                $sql = "
                    SELECT DISTINCT user.id, username, lastname, firstname, official_code
                    FROM $tbl_user user
                    LEFT OUTER JOIN $tbl_session_rel_user s
                    ON (s.user_id = user.id)
                    WHERE
                        s.user_id IS NULL AND
                        user.status <> ".DRH." AND
                        user.status <> 6 $cond_user_id
                    $order_clause
                ";
                break;
        }

        if (api_is_multiple_url_enabled()) {

The function api_is_multiple_url_enabled() has been deprecated: Use AccessUrlUtil::isMultiple

            $tbl_user_rel_access_url = Database::get_main_table(TABLE_MAIN_ACCESS_URL_REL_USER);
            $access_url_id = api_get_current_access_url_id();
            if (-1 != $access_url_id) {
                switch ($type) {
                    case 'single':
                        $sql = "
                            SELECT user.id, username, lastname, firstname, official_code
                            FROM $tbl_user user
                            INNER JOIN $tbl_user_rel_access_url url_user
                            ON (url_user.user_id = user.id)
                            WHERE
                                access_url_id = '$access_url_id'
                                AND (
                                    username LIKE '$needle%'
                                    OR lastname LIKE '$needle%'
                                    OR firstname LIKE '$needle%'
                                )
                                AND user.status <> 6
                                AND user.status <> ".DRH."
                            $order_clause LIMIT 11
                        ";
                        break;
                    case 'multiple':
                        $sql = "
                            SELECT user.id, username, lastname, firstname, official_code
                            FROM $tbl_user user
                            INNER JOIN $tbl_user_rel_access_url url_user ON (url_user.user_id=user.id)
                            WHERE
                                access_url_id = $access_url_id
                                AND lastname LIKE '$needle%'
                                AND user.status <> ".DRH."
                                AND user.status <> 6 $cond_user_id
                            $order_clause
                        ";
                        break;
                    case 'any_session':
                        $sql = "
                            SELECT DISTINCT user.id, username, lastname, firstname, official_code
                            FROM $tbl_user user
                            LEFT OUTER JOIN $tbl_session_rel_user s
                                ON (s.user_id = user.id)
                            INNER JOIN $tbl_user_rel_access_url url_user
                                ON (url_user.user_id = user.id)
                            WHERE
                                access_url_id = $access_url_id
                                AND s.user_id IS null
                                AND user.status <> ".DRH."
                                AND user.status <> 6 $cond_user_id
                            $order_clause
                        ";
                        break;
                }
            }
        }

        $rs = Database::query($sql);

The variable $sql does not seem to be defined for all execution paths leading up to this point.

        $i = 0;
        if ('single' == $type) {
            while ($user = Database:: fetch_array($rs)) {
                $i++;
                if ($i <= 10) {
                    $person_name =
                        $user['lastname'].' '.$user['firstname'].' ('.$user['username'].') '.$user['official_code'];
                    if ($showOfficialCode) {
                        $officialCode = !empty($user['official_code']) ? $user['official_code'].' - ' : '? - ';
                        $person_name =
                            $officialCode.$user['lastname'].' '.$user['firstname'].' ('.$user['username'].')';
                    }

                    $return .= '<a href="javascript: void(0);" onclick="javascript: add_user_to_session(\''.$user['id']
                        .'\',\''.$person_name.' '.'\')">'.$person_name.' </a><br />';
                } else {
                    $return .= '...<br />';
                }
            }

            $xajax_response->addAssign('ajax_list_users_single', 'innerHTML', api_utf8_encode($return));
        } else {
            $return .= '<select id="origin_users" name="nosessionUsersList[]" multiple="multiple" size="15" style="width:360px;">';
            while ($user = Database:: fetch_array($rs)) {
                $person_name =
                    $user['lastname'].' '.$user['firstname'].' ('.$user['username'].') '.$user['official_code'];
                if ($showOfficialCode) {
                    $officialCode = !empty($user['official_code']) ? $user['official_code'].' - ' : '? - ';
                    $person_name = $officialCode.$user['lastname'].' '.$user['firstname'].' ('.$user['username'].')';
                }
                $return .= '<option value="'.$user['id'].'">'.$person_name.' </option>';
            }
            $return .= '</select>';
            $xajax_response->addAssign('ajax_list_users_multiple', 'innerHTML', api_utf8_encode($return));
        }
    }

    return $xajax_response;
}