From 95210ec31276e8a987d2b8101596483d1d869602 Mon Sep 17 00:00:00 2001
From: mattf <mattf@3d104415-ff17-0410-8863-d5cf3c621b8a>
Date: Thu, 10 Jul 2008 04:51:44 +0000
Subject: [PATCH] update to admin_search_lead.php page to search by user,
 list_id and/or status

git-svn-id: svn://192.168.202.10@917 3d104415-ff17-0410-8863-d5cf3c621b8a
---
 .../trunk/www/vicidial/admin_search_lead.php  | 46 +++++++++++++++++--
 1 file changed, 41 insertions(+), 5 deletions(-)

diff --git a/agc_2-X/trunk/www/vicidial/admin_search_lead.php b/agc_2-X/trunk/www/vicidial/admin_search_lead.php
index 555b36ad..b1b6dc91 100644
--- a/agc_2-X/trunk/www/vicidial/admin_search_lead.php
+++ b/agc_2-X/trunk/www/vicidial/admin_search_lead.php
@@ -6,12 +6,15 @@
 # AST GUI database administration search for lead info
 # admin_modify_lead.php
 #
-# this is the administration lead information modifier screen, the administrator just needs to enter the leadID and then they can view and modify the information in the record for that lead
+# this is the administration lead information modifier screen, the administrator 
+# just needs to enter the leadID and then they can view and modify the information
+# in the record for that lead
 #
 # changes:
 # 60620-1055 - Added variable filtering to eliminate SQL injection attack threat
 #            - Added required user/pass to gain access to this page
 #            - Changed results to multi-record
+# 80710-0023 - Added searching by list, user, status
 #
 
 require("dbconnect.php");
@@ -31,6 +34,12 @@ if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
+if (isset($_GET["status"]))				{$status=$_GET["status"];}
+	elseif (isset($_POST["status"]))	{$status=$_POST["status"];}
+if (isset($_GET["user"]))				{$user=$_GET["user"];}
+	elseif (isset($_POST["user"]))		{$user=$_POST["user"];}
+if (isset($_GET["list_id"]))			{$list_id=$_GET["list_id"];}
+	elseif (isset($_POST["list_id"]))	{$list_id=$_POST["list_id"];}
 
 $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
 $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
@@ -102,7 +111,7 @@ $browser = getenv("HTTP_USER_AGENT");
 echo "<a href=\"./admin.php?ADD=100\">VICIDIAL ADMIN</a>: Lead search<BR>\n";
 
 
-if ( (!$vendor_id) and (!$phone)  and (!$lead_id) ) 
+if ( (!$vendor_id) and (!$phone)  and (!$lead_id) and ( (strlen($status)<1) and (strlen($list_id)<1) and (strlen($user)<1) )) 
 	{
 	echo date("l F j, Y G:i:s A");
 	echo "\n<br><br><center>\n";
@@ -110,7 +119,10 @@ if ( (!$vendor_id) and (!$phone)  and (!$lead_id) )
 	echo "<input type=hidden name=DB value=\"$DB\">\n";
 	echo "<b>Please enter a:<br> Vendor ID(vendor lead code): <input type=text name=vendor_id size=10 maxlength=10> or \n";
 	echo "<br><b>a Home Phone Number: <input type=text name=phone size=20 maxlength=16> or\n";
-	echo "<br><b>a lead ID: <input type=text name=lead_id size=10 maxlength=10> <br><br>\n";
+	echo "<br><b>a lead ID: <input type=text name=lead_id size=10 maxlength=10> or\n";
+	echo "<br><b>status: <input type=text name=status size=7 maxlength=6> &nbsp; \n";
+	echo "<b>list ID: <input type=text name=list_id size=15 maxlength=14> &nbsp; \n";
+	echo "<b>user: <input type=text name=user size=15 maxlength=20> <br><br>\n";
 	echo "<input type=submit name=submit value=SUBMIT></b>\n";
 	echo "</form>\n</center>\n";
 	echo "</body></html>\n";
@@ -138,8 +150,32 @@ else
 				}
 			else
 				{
-				print "ERROR: you must search for something! Go back and search for something";
-				exit;
+				if ( (strlen($status)>0) or (strlen($list_id)>0) or (strlen($user)>0) )
+					{
+					$statusSQL = '';
+					$list_idSQL = '';
+					$userSQL = '';
+					if (strlen($status)>0)	
+						{
+						$statusSQL = "status='" . mysql_real_escape_string($status) . "'"; $SQLctA++;
+						}
+					if (strlen($list_id)>0) 
+						{
+						if ($SQLctA > 0) {$andA = 'and';}
+						$list_idSQL = "$andA list_id='" . mysql_real_escape_string($list_id) . "'"; $SQLctB++;
+						}
+					if (strlen($user)>0)	
+						{
+						if ( ($SQLctA > 0) or ($SQLctB > 0) ) {$andB = 'and';}
+						$userSQL = "$andB user='" . mysql_real_escape_string($user) . "'";
+						}
+					$stmt="SELECT * from vicidial_list where $statusSQL $list_idSQL $userSQL order by modify_date desc limit 1000";
+					}
+				else
+					{
+					print "ERROR: you must search for something! Go back and search for something";
+					exit;
+					}
 				}
 			}
 		}