From bfc307edbc08d12662996dafcde50a592ba2e7bd Mon Sep 17 00:00:00 2001
From: Manfred Kindl <kindlm@technikum-wien.at>
Date: Thu, 31 Jan 2019 16:43:19 +0100
Subject: [PATCH] =?UTF-8?q?Vilesci=20Personen=20l=C3=B6schen=20verbessert?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Sicherheitsabfrage vor Löschung
- SQLs hinzugefügt
---
 vilesci/personen/suche.php | 114 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 112 insertions(+), 2 deletions(-)

diff --git a/vilesci/personen/suche.php b/vilesci/personen/suche.php
index b0a174eaa..6d2cf3cde 100644
--- a/vilesci/personen/suche.php
+++ b/vilesci/personen/suche.php
@@ -114,7 +114,9 @@ echo '
 <script>
 	function delPerson(type, info)
 	{
-		if(!confirm("Sind Sie sich sicher?"))
+		if(!confirm("!!!ACHTUNG!!!\nDie Aktion löscht alle Daten der Person im System.\n"
+					+"Das betrifft auch alle PreStudierenden- sowie ggf. MitarbeiterInnen-Daten\n\n"
+					+"Sind Sie sich sicher?"))
 			return;
 
 
@@ -233,13 +235,14 @@ if($searchstr!='')
 		echo $db->db_num_rows($result).' Person(en) gefunden<br><br>';
 		echo '<table>';
 		echo '<tr class="liste" align="center">';
-		echo "<td colspan='5'><b>Person</b></td>";
+		echo "<td colspan='6'><b>Person</b></td>";
 		echo "<td colspan='4'><b>Benutzer</b></td>";
 		echo "<td colspan='4'><b>Mitarbeiter</b></td>";
 		echo "<td colspan='4'><b>Student</b></td>";
 		if($admin){echo "<td><b></b></td>";}
 		echo '</tr>';
 		echo '<tr class="liste" align="center">';
+		echo "<td><b>Person ID</b></td>";
 		echo "<td><b>Nachname</b></td>";
 		echo "<td><b>Vorname</b></td>";
 		echo "<td><b>Gebdatum</b></td>";
@@ -268,6 +271,7 @@ if($searchstr!='')
 				if($row_person = $db->db_fetch_object($result_person))
 				{
 					echo '<tr class="liste1">';
+					echo "<td>$row_person->person_id</td>";
 					echo "<td><a href='personen_details.php?person_id=$row_person->person_id'>$row_person->nachname</a></td>";
 					echo "<td>$row_person->vorname</td>";
 					echo "<td>".($row_person->gebdatum!=''?$datum_obj->convertISODate($row_person->gebdatum):'')."</td>";
@@ -307,6 +311,7 @@ if($searchstr!='')
 								$content.= '<td></td>';
 								$content.= '<td></td>';
 								$content.= '<td></td>';
+								$content.= '<td></td>';
 								$content.= "<td>Mitarbeiter</td>";
 								$content.= "<td><a href='personen_details.php?uid=$row_mitarbeiter->uid'>$row_mitarbeiter->uid</a></td>";
 								$content.= "<td>".($row_mitarbeiter->aktiv=='t'?'Ja':'Nein')."</td>";
@@ -354,6 +359,7 @@ if($searchstr!='')
 								$content.= '<td></td>';
 								$content.= '<td></td>';
 								$content.= '<td></td>';
+								$content.= '<td></td>';
 								$content.= "<td>$student->status_kurzbz</td>";
 								$content.= "<td><a href='personen_details.php?uid=$row_student->uid'>$row_student->uid</a></td>";
 								$content.= "<td>".($row_student->aktiv=='t'?'Ja':'Nein')."</td>";
@@ -1132,6 +1138,15 @@ function casDeletePerson($db, $person_id, $trans=true)
 		if(!$db->db_query($qry))
 			$error = true;
 	}
+	
+	if(!$error)
+	{
+		$qry = '
+			DELETE FROM public.tbl_msg_recipient
+				WHERE person_id='.$db->db_add_param($person_id, FHC_INTEGER);
+		if(!$db->db_query($qry))
+			$error = true;
+	}
 
 	if(!$error)
 	{
@@ -1141,6 +1156,15 @@ function casDeletePerson($db, $person_id, $trans=true)
 		if(!$db->db_query($qry))
 			$error = true;
 	}
+	
+	if(!$error)
+	{
+		$qry = '
+			DELETE FROM public.tbl_msg_status
+				WHERE person_id='.$db->db_add_param($person_id, FHC_INTEGER);
+		if(!$db->db_query($qry))
+			$error = true;
+	}
 
 	if(!$error)
 	{
@@ -1150,6 +1174,15 @@ function casDeletePerson($db, $person_id, $trans=true)
 		if(!$db->db_query($qry))
 			$error = true;
 	}
+	
+	if(!$error)
+	{
+		$qry = '
+			DELETE FROM public.tbl_adresse
+				WHERE person_id='.$db->db_add_param($person_id, FHC_INTEGER);
+		if(!$db->db_query($qry))
+			$error = true;
+	}
 
 	if(!$error)
 	{
@@ -1159,6 +1192,24 @@ function casDeletePerson($db, $person_id, $trans=true)
 		if(!$db->db_query($qry))
 			$error = true;
 	}
+	
+	if(!$error)
+	{
+		$qry = '
+			DELETE FROM public.tbl_akte
+				WHERE person_id='.$db->db_add_param($person_id, FHC_INTEGER);
+		if(!$db->db_query($qry))
+			$error = true;
+	}
+	
+	if(!$error)
+	{
+		$qry = '
+			DELETE FROM public.tbl_preincoming
+				WHERE person_id='.$db->db_add_param($person_id, FHC_INTEGER);
+		if(!$db->db_query($qry))
+			$error = true;
+	}
 
 	if(!$error)
 	{
@@ -1261,6 +1312,24 @@ function casDeletePerson($db, $person_id, $trans=true)
 		if(!$db->db_query($qry))
 			$error = true;
 	}
+	
+	if(!$error)
+	{
+		$qry = '
+			DELETE FROM system.tbl_person_lock
+				WHERE person_id='.$db->db_add_param($person_id, FHC_INTEGER);
+		if(!$db->db_query($qry))
+			$error = true;
+	}
+	
+	if(!$error)
+	{
+		$qry = '
+			DELETE FROM system.tbl_log
+				WHERE person_id='.$db->db_add_param($person_id, FHC_INTEGER);
+		if(!$db->db_query($qry))
+			$error = true;
+	}
 
 	if(!$error)
 	{
@@ -1478,6 +1547,20 @@ function casDeletePerson($db, $person_id, $trans=true)
 		if(!$db->db_query($qry))
 			$error = true;
 	}
+	
+	if(!$error)
+	{
+		$qry = '
+			WITH deleted_rows AS (
+				DELETE FROM public.tbl_notizzuordnung
+				WHERE person_id='.$db->db_add_param($person_id, FHC_INTEGER).'
+				RETURNING notiz_id
+			)
+			DELETE FROM public.tbl_notiz
+				WHERE notiz_id IN (SELECT notiz_id FROM deleted_rows)';
+		if(!$db->db_query($qry))
+			$error = true;
+	}
 
 	if(!$error)
 	{
@@ -1558,6 +1641,33 @@ function casDeletePerson($db, $person_id, $trans=true)
 			}
 		}
 	}
+	
+	if(!$error)
+	{
+		$queryPs = '
+			SELECT tbl_prestudent.prestudent_id FROM tbl_prestudent
+			WHERE person_id = ' . $db->db_add_param($person_id, FHC_INTEGER).'
+		';
+		$resultPs = $db->db_query($queryPs);
+		if(!$resultPs)
+		{
+			$error = true;
+		}
+		else
+		{
+			while($row = $db->db_fetch_object($resultPs))
+			{
+				if(!$error)
+				{
+					if(!casDeletePrestudent($db, $row->prestudent_id, false))
+					{
+						$error = true;
+					}
+				}
+				else { break; }
+			}
+		}
+	}
 
 	/*
 	 * delete all mitarbeiter entries