<?php
/*
When having a close token survey (token table exist)
you can create a token on the fly by giving as parameters sid and token                                                         lines  43- 49
In addition if someone has already complete a survey  he can review his answers an d correct them          lines  55- 61
 
Just put this script in limesurveys  root directory
Example:
 
http://localhost/limesurvey185plus-build7253-20090708/newtoken.php?sid=27644&newtest=Y&token=123456789012345678901234567890123456
 
Prerequisites:
1.  Anonymous answers?                            No       (This survey is NOT anonymous.)
2.  Enable Token-based answers persistence?       Yes
3.  Switch to closed-acces mode
4.  Use cookies?                                  No
 
*/
// Security Checked: POST, GET, SESSION, REQUEST, returnglobal, DB   
 
require_once(dirname(__FILE__).'/classes/core/startup.php');
require_once(dirname(__FILE__).'/config-defaults.php');
require_once(dirname(__FILE__).'/common.php');
require_once(dirname(__FILE__).'/classes/core/language.php');
@ini_set('session.gc_maxlifetime', $sessionlifetime);
 
$loadname=returnglobal('loadname');
$loadpass=returnglobal('loadpass');
$scid=returnglobal('scid');
$thisstep=returnglobal('thisstep');
$move=sanitize_paranoid_string(returnglobal('move'));
$clienttoken=trim(sanitize_xss_string(strip_tags(returnglobal('token'))));      
if (!isset($thisstep)) {$thisstep = "";}
 
 
if (!isset($surveyid)) {$surveyid=returnglobal('sid');}
else {
		//This next line ensures that the $surveyid value is never anything but a number.
		$surveyid=sanitize_int($surveyid);
	 }
 
// get variables from address bar
if (isset($_GET['sid'])) { $sid = $_GET['sid']; }
if (isset($_GET['myname'])) { $myname=urldecode($_GET['myname']); }
if (isset($_GET['token'])) { $token = $_GET['token']; }
//if (isset($_GET['token'])) { $token = $_GET['token']; }
if (isset($_GET['lang'])) { $lang = $_GET['lang']; }
 
$name = explode("|", $myname);
 
 
// short things are better
$tokentable = $dbprefix."tokens_".$sid;
$location = $rooturl;
$location .= '?sid='.$sid;
//$location .= '?=gr&newtest=Y'; // Problem? What is gr?
$location .= '&token='.$token; // Problem last page??
$location .= '&newtest=Y';
 
$iscompleted=mysql_query("SELECT `completed` FROM ". $tokentable. " WHERE token= '".$token."'");
$completed = mysql_num_rows($iscompleted);
 
if ($completed==0)                         //   there is no token so create one and procced to the survey
	{
	$wri = "INSERT INTO ".$tokentable." (firstname,lastname,email,language,sent,token) VALUES ('".$name[0]."','".$name[1]."',' ','".$lang." ','Y','".$token."')";
	mysql_query($wri) or die("Query error: ". mysql_error());
	header('Location:'.$location);
	// header('Location:'.$HTTP_REFERER.'?failed=1');
	}
 
else                                       //   Token exists
	{
	$fullycompleted =mysql_result($iscompleted,0,0);
 
	if ($fullycompleted="Y")               //    Survyey Is Completed So start editing the answers
		{
			$wri = "Update ".$tokentable." set completed = 'N' where token ='".$token."'";
			mysql_query($wri) or die("Query error: ". mysql_error());
			header('Location:'.$location);
			// header('Location:'.$HTTP_REFERER.'?failed=1');
		}
 
	if ($fullycompleted="N")               //    Survyey is not  Completed So procced
		{
			header('Location:'.$location);
		}
 
	}
 
?>

if (isset($_GET['newtest']) && $_GET['newtest'] = "Y") 
    {
        unset($_GET['token']);
    }

elseif ($column =='lastpage' && isset($_GET['token']))

elseif ($column =='lastpage' && (isset($_GET['token'])||(isset($_GET['newtest']) && ($_GET['newtest']=='Y'))

if (isset($_GET['newtest']) && $_GET['newtest'] == "Y") 
    {
        unset($_GET['token']);
    }