--- loncom/lonsql	2007/09/12 20:29:13	1.89
+++ loncom/lonsql	2019/04/24 01:44:38	1.98
@@ -3,7 +3,7 @@
 # The LearningOnline Network
 # lonsql - LON TCP-MySQL-Server Daemon for handling database requests.
 #
-# $Id: lonsql,v 1.89 2007/09/12 20:29:13 raeburn Exp $
+# $Id: lonsql,v 1.98 2019/04/24 01:44:38 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -95,8 +95,6 @@ the database.
 
 =head1 Internals
 
-=over 4
-
 =cut
 
 use strict;
@@ -121,6 +119,8 @@ use GDBM_File;
 
 =pod
 
+=over 4
+
 =item Global Variables
 
 =over 4
@@ -231,15 +231,15 @@ unless ($dbh = DBI->connect("DBI:mysql:l
     my $emailto="$perlvar{'lonAdmEMail'},$perlvar{'lonSysEMail'}";
     my $subj="LON: $perlvar{'lonHostID'} Cannot connect to database!";
     system("echo 'Cannot connect to MySQL database!' |".
-           " mailto $emailto -s '$subj' > /dev/null");
+           " mail -s '$subj' $emailto > /dev/null");
 
-    open(SMP,'>/home/httpd/html/lon-status/mysql.txt');
+    open(SMP,">$perlvar{'lonDocRoot'}/lon-status/mysql.txt");
     print SMP 'time='.time.'&mysql=defunct'."\n";
     close(SMP);
 
     exit 1;
 } else {
-    unlink('/home/httpd/html/lon-status/mysql.txt');
+    unlink("$perlvar{'lonDocRoot'}/lon-status/mysql.txt");
     $dbh->disconnect;
 }
 
@@ -447,7 +447,7 @@ sub make_new_child {
                     ($arg2 =~ /\%\%/)) {
                     ($srchby,$srchtype) =
                         map {&unescape($_);} (split(/\%\%/,$arg2));
-                    my $srchterm = &unescape($arg3);
+                    $srchterm = &unescape($arg3);
                 } else {
                     ($srchby,$srchtype,$srchterm) =
                         map {&unescape($_);} ($arg1,$arg2,$arg3);
@@ -458,6 +458,8 @@ sub make_new_child {
 		$result = &do_inst_dir_search($searchdomain,$arg1,$arg2,$arg3);
             } elsif ($query eq 'getinstuser') {
                 $result = &get_inst_user($searchdomain,$arg1,$arg2);
+            } elsif ($query eq 'getmultinstusers') {
+                $result = &get_multiple_instusers($searchdomain,$arg3);
             } elsif ($query eq 'prepare activity log') {
                 my ($cid,$domain) = map {&unescape($_);} ($arg1,$arg2);
                 &logthis('preparing activity log tables for '.$cid);
@@ -488,8 +490,9 @@ sub make_new_child {
                 $userdata{'domain'} = $udom;
                 $result = &allusers_table_update($query,$uname,$udom,\%userdata);
             } else {
+                # Sanity checking of $query needed.
                 # Do an sql query
-                $result = &do_sql_query($query,$arg1,$arg2,$searchdomain);
+                $result = &do_sql_query($query,$arg1,$arg2,$arg3,$searchdomain);
             }
             # result does not need to be escaped because it has already been
             # escaped.
@@ -537,15 +540,23 @@ sub do_user_search {
         }
     } else {
         my %srchfield = (
+                          uname_ci => 'username collate latin1_general_ci',
                           uname    => 'username',
                           lastname => 'lastname',
+                          email    => 'permanentemail',
                         );
-        if ($srchtype eq 'exact') {
-            $query .= $srchfield{$srchby}.' = '.$dbh->quote($srchterm);
-        } elsif ($srchtype eq 'begins') {
-             $query .= $srchfield{$srchby}.' LIKE '.$dbh->quote($srchterm.'%');
+        if (exists($srchfield{$srchby})) {
+            if ($srchtype eq 'exact') {
+                $query .= $srchfield{$srchby}.' = '.$dbh->quote($srchterm);
+            } elsif ($srchtype eq 'begins') {
+                $query .= $srchfield{$srchby}.' LIKE '.$dbh->quote($srchterm.'%');
+            } else {
+                $query .= $srchfield{$srchby}.' LIKE '.$dbh->quote('%'.$srchterm.'%');
+            }
         } else {
-             $query .= $srchfield{$srchby}.' LIKE '.$dbh->quote('%'.$srchterm.'%');
+            &logthis('<font color="blue">'.
+                     'WARNING: Invalid srchby: '.$srchby.'</font>');  
+            return $result;
         }
     }
     $query .= ") ORDER BY username ";
@@ -620,6 +631,34 @@ sub get_inst_user {
     return $response;
 }
 
+sub get_multiple_instusers {
+    my ($domain,$data) = @_;
+    my ($type,$users) = split(/=/,$data,2);
+    my $requested = &Apache::lonnet::thaw_unescape($users);
+    my $response;
+    if (ref($requested) eq 'HASH') {
+        my (%instusers,%instids,$result);
+        eval {
+            local($SIG{__DIE__})='DEFAULT';
+            $result=&localenroll::get_multusersinfo($domain,$type,$requested,\%instusers,
+                                                    \%instids);
+        };
+        if ($@) {
+            $response = 'error';
+        } elsif ($result eq 'ok') {
+            $response = $result;
+            if (keys(%instusers)) {
+                $response .= '='.&Apache::lonnet::freeze_escape(\%instusers);
+            }
+        } elsif ($result eq 'unavailable') {
+            $response = $result;
+        }
+    } else {
+        $response = 'invalid';
+    }
+    return $response;
+}
+
 ########################################################
 ########################################################
 
@@ -651,12 +690,30 @@ sub process_file {
 }
 
 sub do_sql_query {
-    my ($query,$custom,$customshow,$searchdomain) = @_;
+    my ($query,$custom,$customshow,$domainstr,$searchdomain) = @_;
 
 #
 # limit to searchdomain if given and table is metadata
 #
-    if (($searchdomain) && ($query=~/FROM metadata/)) {
+    if ($domainstr && ($query=~/FROM metadata/)) {
+        my $havingstr;
+        $domainstr = &unescape($domainstr); 
+        if ($domainstr =~ /,/) {
+            foreach my $dom (split(/,/,$domainstr)) {
+                if ($dom =~ /^$LONCAPA::domain_re$/) {
+                    $havingstr .= 'domain="'.$dom.'" OR ';
+                }
+            }
+            $havingstr =~ s/ OR $//;
+        } else {
+            if ($domainstr =~ /^$LONCAPA::domain_re$/) {
+                $havingstr = 'domain="'.$domainstr.'"';
+            }
+        }
+        if ($havingstr) {
+            $query.=' HAVING ('.$havingstr.')';
+        }
+    } elsif (($searchdomain) && ($query=~/FROM metadata/)) {
 	$query.=' HAVING (domain="'.$searchdomain.'")';
     }
 #    &logthis('doing query ('.$searchdomain.')'.$query);