* fix the bug of when add user and list user.

module/common/lang/zh-cn.php

@@ -103,6 +103,7 @@ $lang->error->int             = array("『%s』应当是数字。", "『%s』应
 $lang->error->float           = "『%s』应当是数字，可以是小数。";
 $lang->error->email           = "『%s』应当为合法的EMAIL。";
 $lang->error->date            = "『%s』应当为合法的日期。";
+$lang->error->account         = "『%s』应当为合法的用户名。";
 
 /* 分页信息。*/
 $lang->pager->noRecord  = "暂时没有记录";

module/dept/model.php

@@ -233,8 +233,9 @@ class deptModel extends model
     /* 获得某一个部门的成员列表。*/
     public function getUsers($deptID)
     {
-        $sql = "SELECT * FROM " . TABLE_USER . " WHERE dept " . helper::dbIN($deptID) . " ORDER BY id";
-        return $this->dbh->query($sql)->fetchAll();
+        $sql = $this->dao->select('*')->from(TABLE_USER);
+        if($deptID) $sql->where('dept')->in($deptID);
+        return $sql->orderBy('id')->fetchAll();
     }
     
     /* 删除一个部门。Todo: 需要修改下级目录的权限，还有对应的需求列表。*/

module/user/control.php

@@ -152,6 +152,7 @@ class user extends control
         if(!empty($_POST))
         {
             $this->user->create($companyID);
+            if(dao::isError()) die(js::error(dao::getError()));
             if($from == 'admin')
             {
                 die(js::locate($this->createLink('admin', 'browseuser', "companyid={$this->app->company->id}"), 'parent'));
@@ -179,7 +180,8 @@ class user extends control
         if(!empty($_POST))
         {
             $this->user->update($userID);
-           if($from == 'admin')
+            if(dao::isError()) die(js::error(dao::getError()));
+            if($from == 'admin')
             {
                 die(js::locate($this->createLink('admin', 'browseuser', "companyid={$this->app->company->id}"), 'parent'));
             }

module/user/model.php

@@ -52,26 +52,34 @@ class userModel extends model
     /* 新增一个用户。*/
     function create($companyID)
     {
-        extract($_POST);
-        $sql = "INSERT INTO " . TABLE_USER . "(account, realname, email, gendar, `join`, password, company, dept) 
-                VALUES('$account', '$realname', '$email', '$gendar', '$join', MD5('$password'), '$companyID', '$dept')";
-        return $this->dbh->query($sql);
+        $user = fixer::input('post')
+            ->add('company', (int)$companyID)
+            ->setDefault('join', '0000-00-00')
+            ->get();
+        $this->dao->insert(TABLE_USER)->data($user)
+            ->autoCheck()
+            ->batchCheck('account, realname, password', 'notempty')
+            ->check('account', 'unique')
+            ->check('account', 'account')
+            ->exec();
     }
 
     /* 更新一个用户。*/
     function update($userID)
     {
-        extract($_POST);
-        if(empty($password))
-        {
-            $password = 'password';
-        }
-        else
-        {
-            $password = "MD5('$password')";
-        }
-        $sql = "UPDATE " . TABLE_USER . " SET account = '$account', realname = '$realname', email = '$email', gendar = '$gendar', `join` = '$join', password = $password, dept = '$dept' WHERE id = '$userID' LIMIT 1";
-        return $this->dbh->exec($sql);
+        $userID = (int)$userID;
+        $user = fixer::input('post')
+            ->setDefault('join', '0000-00-00')
+            ->setIF($this->post->password != '', 'password', md5($this->post->password))
+            ->removeIF($this->post->password == '', 'password')
+            ->get();
+        $this->dao->update(TABLE_USER)->data($user)
+            ->autoCheck()
+            ->batchCheck('account, realname, password', 'notempty')
+            ->check('account', 'unique', "id != '$userID'")
+            ->check('account', 'account')
+            ->where('id')->eq((int)$userID)
+            ->exec();
     }
     
     /* 删除一个用户。*/