/plugins/SpecialUserFuncs.php

Large files files are truncated, but you can click here to view the full file

<?php
/**!info**
{
	"Plugin Name"  : "plugin_specialuserfuncs_title",
	"Plugin URI"   : "http://enanocms.org/",
	"Description"  : "plugin_specialuserfuncs_desc",
	"Author"       : "Dan Fuhry",
	"Version"      : "1.1.6",
	"Author URI"   : "http://enanocms.org/"
}
**!*/

/*
 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
 * Copyright (C) 2006-2009 Dan Fuhry
 *
 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
 */
 
global $db, $session, $paths, $template, $plugins; // Common objects

// $plugins->attachHook('session_started', 'SpecialUserFuncs_paths_init();');

function SpecialUserFuncs_paths_init()
{
	register_special_page('Login', 'specialpage_log_in');
	register_special_page('Logout', 'specialpage_log_out');
	register_special_page('Register', 'specialpage_register');
	register_special_page('Preferences', 'specialpage_preferences');
	register_special_page('Contributions', 'specialpage_contributions');
	register_special_page('ChangeStyle', 'specialpage_change_theme');
	register_special_page('ActivateAccount', 'specialpage_activate_account');
	register_special_page('Captcha', 'specialpage_captcha');
	register_special_page('PasswordReset', 'specialpage_password_reset');
	register_special_page('Memberlist', 'specialpage_member_list');
	register_special_page('LangExportJSON', 'specialpage_language_export', false);
	register_special_page('Avatar', 'specialpage_avatar', false);
}

// function names are IMPORTANT!!! The name pattern is: page_<namespace ID>_<page URLname, without namespace>

$__login_status = '';

function page_Special_Login()
{
	global $db, $session, $paths, $template, $plugins; // Common objects
	global $login_result;
	global $lang, $output;
	
	// Determine which level we're going up to
	$level = ( isset($_GET['level']) && in_array($_GET['level'], array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9') ) ) ? intval($_GET['level']) : USER_LEVEL_MEMBER;
	if ( isset($_POST['login']) )
	{
		if ( in_array($_POST['level'], array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9') ) )
		{
			$level = intval($_POST['level']);
		}
	}
	// Don't allow going from guest straight to elevated
	// FIXME do we want to allow this with a CSRF check?
	if ( $level > USER_LEVEL_MEMBER && !$session->user_logged_in )
	{
		$level = USER_LEVEL_MEMBER;
	}
	
	// If we're already at or above this level, redirect to the target page or, if no target
	// specified, back to the main page.
	if ( $level <= USER_LEVEL_MEMBER && $session->user_logged_in )
	{
		if ( $target = $paths->getAllParams() )
		{
			redirect(makeUrl($target), '', '', 0);
		}
		$paths->main_page();
	}
	
	// Lockout aliasing
	$lockout =& $login_result['lockout'];
	
	$output->header();
	echo '<form action="' . makeUrl($paths->nslist['Special'].'Login') . '" method="post" name="loginform" onsubmit="try { return runEncryption(); } catch(e) { console.error(e); };">';
	
	if ( $p = $paths->getAllParams() )
	{
		echo '<input type="hidden" name="return_to" value="' . htmlspecialchars($p) . '" />';
	}
	else if ( isset($_POST['login']) && isset($_POST['return_to']) )
	{
		echo '<input type="hidden" name="return_to" value="' . htmlspecialchars($_POST['return_to']) . '" />';
	}
	
	// determine what the "remember me" checkbox should say
	$session_time = intval(getConfig('session_remember_time', '30'));
	if ( $session_time === 0 )
	{
		// sessions are infinite
		$text_remember = $lang->get('user_login_check_remember_infinite');
	}
	else
	{
		// is the number of days evenly divisible by 7? if so, use weeks
		if ( $session_time % 7 == 0 )
		{
			$session_time = $session_time / 7;
			$unit = 'week';
		}
		else
		{
			$unit = 'day';
		}
		// if it's not equal to 1, pluralize it
		if ( $session_time != 1 )
		{
			$unit .= $lang->get('meta_plural');
		}
		$text_remember = $lang->get('user_login_check_remember', array(
				'session_length' => $session_time,
				'length_units' => $lang->get("etc_unit_$unit")
			));
	}
	
	if ( $error_text = login_get_error($login_result) )
	{
		echo '<div class="error-box-mini">' . htmlspecialchars($error_text) . '</div>';
	}
	
	//
	// START FORM
	//
	?>
		<div class="tblholder">
			<table border="0" style="width: 100%;" cellspacing="1" cellpadding="4">
				<tr>
					<th colspan="3">
						<!-- Table header: "Please enter..." -->
						<?php echo ( $level > USER_LEVEL_MEMBER ) ? $lang->get('user_login_message_short_elev') : $lang->get('user_login_message_short'); ?>
					</th>
				</tr>
				<tr>
					<td colspan="3" class="row1">
						<!-- Introduction text -->
						<?php
						if ( $level <= USER_LEVEL_MEMBER )
							echo '<p>' . $lang->get('user_login_body', array('reg_link' => makeUrlNS('Special', 'Register'))) . '</p>';
						else
							echo '<p>' . $lang->get('user_login_body_elev') . '</p>';
						?>
					</td>
				</tr>
				<tr>
					<!-- Username field -->
					<td class="row2">
						<?php echo $lang->get('user_login_field_username'); ?>:
					</td>
					<td class="row1">
						<input name="username" size="25" type="text" value="<?php echo $session->user_logged_in ? htmlspecialchars($session->username) : ''; ?>" />
					</td>
					<?php if ( $level <= USER_LEVEL_MEMBER ): ?>
					<!-- Forgot password / create account links -->
					<td rowspan="<?php echo ( ( $lockout['active'] && $lockout['policy'] == 'captcha' ) ) ? '4' : '2'; ?>" class="row3">
						<small><?php echo $lang->get('user_login_forgotpass_blurb', array('forgotpass_link' => makeUrlNS('Special', 'PasswordReset'))); ?><br />
						<?php echo $lang->get('user_login_createaccount_blurb', array('reg_link' => makeUrlNS('Special', 'Register'))); ?></small>
					</td>
					<?php endif; ?>
				</tr>
				<tr>
					<!-- Password field -->
					<td class="row2">
						<?php echo $lang->get('user_login_field_password'); ?>:
					</td><td class="row1"><input name="password" size="25" type="password" /></td>
 				</tr>
 				
 				<?php
 				// CAPTCHA?
 				if ( $lockout['active'] && $lockout['policy'] == 'captcha' )
 				{
 					?>
 					<!-- CAPTCHA -->
 					<tr>
 						<td class="row2" rowspan="2">
 							<?php echo $lang->get('user_login_field_captcha'); ?>:
 							<br />
 						</td>
 						<td class="row1">
 							<input type="hidden" name="captcha_hash" value="<?php echo $lockout['captcha']; ?>" />
 							<input name="captcha_code" size="25" type="text" tabindex="<?php echo ( $level <= USER_LEVEL_MEMBER ) ? '3' : '4'; ?>" />
 						</td>
 					</tr>
 					<tr>
 						<td class="row3">
 							<img src="<?php echo makeUrlNS('Special', 'Captcha/' . $lockout['captcha']) ?>" onclick="this.src=this.src+'/a';" style="cursor: pointer;" />
 						</td>
 					</tr>
 					<?php
 				}
 				
 				// Run hooks
 				$code = $plugins->setHook('login_form_html');
 				foreach ( $code as $cmd )
 				{
 					eval($cmd);
 				}
 				
 				// level-2 only: "Remember me" switch
 				if ( $level <= USER_LEVEL_MEMBER )
 				{
 					?>
 					<tr>
 						<td class="row2">
 							<?php echo $lang->get('user_login_field_remember'); ?>
 						</td>
 						<td class="row1" colspan="2">
 							<label>
 								<input type="checkbox" name="remember" tabindex="3" />
 								<?php echo $text_remember; ?>
 							</label>
 						</td>
 					</tr>
 					
 				<!-- Crypto notice -->
 					<?php
 				}
 				
 				// lol DeMorgan'd
 				$crypto_disable = ( isset($_GET['use_crypt']) && $_GET['use_crypt'] == '0' );
 				
 				// Crypto disable: crypto on, normal login
 				if ( $level <= USER_LEVEL_MEMBER && !$crypto_disable )
 				{
 					echo '<tr>
 						<td class="row3" colspan="3">';
 						
 					$returnpage_link = ( $return = $paths->getAllParams() ) ? '/' . $return : '';
 					$nocrypt_link = makeUrlNS('Special', "Login$returnpage_link", "level=$level&use_crypt=0", true);
 					echo '<p><b>' . $lang->get('user_login_nocrypt_title') . '</b> ' . $lang->get('user_login_nocrypt_body', array('nocrypt_link' => $nocrypt_link)) . '</p>';
 					echo '<p>' . $lang->get('user_login_nocrypt_countrylist') . '</p>';
 					
 					echo '  </td>
 					</tr>';
 				}
 				// Crypto disable: crypto OFF, normal login
 				else if ( $level <= USER_LEVEL_MEMBER && $crypto_disable )
 				{
 					echo '<tr>
 						<td class="row3" colspan="3">';
 						
 					$returnpage_link = ( $return = $paths->getAllParams() ) ? '/' . $return : '';
 					$usecrypt_link = makeUrlNS('Special', "Login$returnpage_link", "level=$level&use_crypt=1", true);
 					echo '<p><b>' . $lang->get('user_login_usecrypt_title') . '</b> ' . $lang->get('user_login_usecrypt_body', array('usecrypt_link' => $usecrypt_link)) . '</p>';
 					echo '<p>' . $lang->get('user_login_usecrypt_countrylist') . '</p>';
 					
 					echo '  </td>
 					</tr>';
 				}
 				// Crypto disable: crypto on, ELEV login
 				else if ( $level > USER_LEVEL_MEMBER && $GLOBALS['dh_supported'] )
 				{
 					echo '<tr>';
 					echo '<td class="row3" colspan="3">';
 					echo '<p>' . $lang->get('user_login_dh_notice') . '</p>';
 					echo '</td>';
 					echo '</tr>';
 				}
 				?>
 				
 				<!-- Submit button -->
 				<tr>
 					<th colspan="3" style="text-align: center" class="subhead">
 						<input type="hidden" name="login" value="true" />
 						<input type="submit" value="<?php echo $lang->get('user_login_btn_log_in'); ?>" />
 					</th>
 				</tr>
			</table>
		</div>
		
			<input type="hidden" name="level" value="<?php echo (string)$level; ?>" />
			<?php if ( $level <= USER_LEVEL_MEMBER ): ?>
			<script type="text/javascript">
				document.forms.loginform.username.focus();
			</script>
			<?php else: ?>
			<script type="text/javascript">
				document.forms.loginform.password.focus();
			</script>
			<?php endif; ?>
			<?php
			echo $session->generate_aes_form();
			
			// Any additional parameters that need to be passed back?
			if ( $p = $paths->getAllParams() )
			{
				// ... only if we have a return_to destination.
				$get_fwd = $_GET;
				unset($get_fwd['do']);
				if ( isset($get_fwd['target_do']) )
				{
					$get_fwd['do'] = $get_fwd['target_do'];
					unset($get_fwd['target_do']);
				}
				if ( isset($get_fwd['level']) )
					unset($get_fwd['level']);
				if ( isset($get_fwd['title']) )
					unset($get_fwd['title']);
				
				if ( !empty($get_fwd) )
				{
					$get_string = htmlspecialchars(enano_json_encode($get_fwd));
					echo '<input type="hidden" name="get_fwd" value="' . $get_string . '" />';
				}
			}
			else if ( isset($_POST['get_fwd']) )
			{
				echo '<input type="hidden" name="get_fwd" value="' . htmlspecialchars($_POST['get_fwd']) . '" />';
			}
			?>
		</form>
		<?php
			if ( !$crypto_disable )
				echo $session->aes_javascript('loginform', 'password');
		?>
	<?php
	$output->footer();
}

function page_Special_Login_preloader() // adding _preloader to the end of the function name calls the function before $session and $paths setup routines are called
{
	global $db, $session, $paths, $template, $plugins; // Common objects
	global $login_result;
	global $lang;
	
	// Are we calling the JSON interface?
	$paths->fullpage = $GLOBALS['urlname'];
	if ( $paths->getParam(0) === 'action.json' )
	{
		if ( !isset($_POST['r']) )
			die('No request.');
		
		$request = $_POST['r'];
		try
		{
			$request = enano_json_decode($request);
		}
		catch ( Exception $e )
		{
			die(enano_json_encode(array(
					'mode' => 'error',
					'error' => 'ERR_JSON_PARSE_FAILED'
				)));
		}
		
		echo enano_json_encode($session->process_login_request($request));
		
		$db->close();
		exit;
	}
	
	// No. Process incoming results from the HTML version.
	if ( isset($_POST['login']) )
	{
		$_POST['password'] = $session->get_aes_post();
		
		$result = $session->process_login_request(array(
				'mode' => 'login_pt',
				'userinfo' => $_POST,
				'level' => $_POST['level'],
				'captcha_hash' => isset($_POST['captcha_hash']) ? $_POST['captcha_hash'] : false,
				'captcha_code' => isset($_POST['captcha_code']) ? $_POST['captcha_code'] : false
			));
		
		if ( $result['mode'] === 'login_success' )
		{
			//
			// LOGIN SUCCESS.
			// Redirect as necessary.
			//
			
			// Load our preferences
			$session->start();
			
			// Decode get_add
			$get_add = false;
			if ( isset($_POST['get_fwd']) )
			{
				try
				{
					$get_fwd = enano_json_decode($_POST['get_fwd']);
					$get_add = '';
					foreach ( $get_fwd as $key => $value )
					{
						if ( $key != 'auth' )
							$get_add .= "&{$key}=" . urlencode($value);
					}
					$get_add = ltrim($get_add, '&');
				}
				catch ( Exception $e )
				{
				}
			}
			
			// Going to a user-specified page?
			if ( isset($_POST['return_to']) )
			{
				// yea
				$name = get_page_title($_POST['return_to']);
				$subst = array(
						'username' => $session->username,
						'redir_target' => htmlspecialchars($name)
					);
				redirect( makeUrl($_POST['return_to'], $get_add), $lang->get('user_login_success_title'), $lang->get('user_login_success_body', $subst) );
			}
			else
			{
				// No, redirect them to the main page
				$subst = array(
						'username' => $session->username,
						'redir_target' => $lang->get('user_login_success_body_mainpage')
					);
				redirect( makeUrl(get_main_page(), $get_add), $lang->get('user_login_success_title'), $lang->get('user_login_success_body', $subst) );
			}
		}
		else if ( $result['mode'] === 'login_success_reset' )
		{
			// They logged in with a temporary password; send them to the reset form
			redirect($result['redirect_url'], '', '', 0);
		}
		// Otherwise, the result is likely an error.
		$login_result = $result;
	}
	else
	{
		$login_result = $session->process_login_request(array(
				'mode' => 'getkey'
			));
	}
	
	// This is a bit of a hack. The login form generates AES and DiffieHellman keys on its
	// own, so we need to clean up the ones from the login request API.
	if ( !empty($login_result['crypto']) )
	{
		$session->process_login_request(array(
				'mode' => 'clean_key',
				'key_aes' => $login_result['crypto']['aes_key'],
				'key_dh' => $login_result['crypto']['dh_public_key'],
			));
	}
}

/**
 * Given a Login API response, find the appropriate error text, if any.
 * @param array LoginAPI response
 * @return mixed Error string, or bool(false) if no error.
 */

function login_get_error($response)
{
	global $lang;
	
	if ( !empty($response['lockout']) )
	{
		// set this pluralality thing
		$response['lockout']['plural'] = $response['lockout']['time_rem'] == 1 ? '' : $lang->get('meta_plural');
	}
	
	if ( $response['mode'] == 'initial' )
	{
		// Just showing the box for the first time. If there's an error now, it's based on a preexisting lockout.
		if ( $response['lockout']['active'] )
		{
			return $lang->get('user_err_locked_out_initial_' . $response['lockout']['policy'], $response['lockout']);
		}
		return false;
	}
	else
	{
		// An attempt was made.
		switch($response['mode'])
		{
			case 'login_failure':
				// Generic login user error.
				$error = '';
				if ( ($x = $lang->get($response['error'])) != $response['error'] )
					$error = $x;
				else
					$error = $lang->get('user_err_' . $response['error']);
				if ( $response['lockout']['active'] && $response['lockout']['policy'] == 'lockout' )
				{
					// Lockout enforcement was just activated.
					return $lang->get('user_err_locked_out_initial_' . $response['lockout']['policy'], $response['lockout']);
				}
				else if ( $response['lockout']['policy'] != 'disable' && !$response['lockout']['active'] && $response['lockout']['fails'] > 0 )
				{
					// Lockout is in a warning state.
					$error .= ' ' . $lang->get('user_err_invalid_credentials_' . $response['lockout']['policy'], $response['lockout']);
				}
				return $error;
				break;
			case 'api_error':
				// Error in the API.
				return $lang->get('user_err_login_generic_title') + ': ' + $lang->get('user_' . strtolower($response['error']));
				break;
		}
	}
	
	return is_string($response['error']) ? $response['error'] : false;
}

function page_Special_Logout()
{
	global $db, $session, $paths, $template, $plugins; // Common objects
	global $lang;
	
	if ( !$session->user_logged_in )
		$paths->main_page();
	
	$token = $paths->getParam(0);
	if ( $token !== $session->csrf_token )
	{
		csrf_request_confirm();
	}
	
	$l = $session->logout();
	if ( $l == 'success' )
	{
		$url = makeUrl(get_main_page(), false, true);
		if ( $paths->getParam(1) )
		{
			$pi = explode('/', $paths->getAllParams());
			$pi = implode('/', array_values(array_slice($pi, 1)));
			list($pid, $ns) = RenderMan::strToPageID($pi);
			$perms = $session->fetch_page_acl($pid, $ns);
			if ( $perms->get_permissions('read') )
			{
				$url = makeUrl($pi, false, true);
			}
		}
		redirect($url, $lang->get('user_logout_success_title'), $lang->get('user_logout_success_body'), 3);
	}
	$template->header();
	echo '<h3>' . $lang->get('user_logout_err_title') . '</h3>';
	echo '<p>' . $l . '</p>';
	$template->footer();
}

function page_Special_Register()
{
	global $db, $session, $paths, $template, $plugins; // Common objects
	global $lang;
	
	// block registration except for guests and admins
	if ( $session->user_level < USER_LEVEL_ADMIN && $session->user_logged_in )
	{
		$paths->main_page();
	}
	
	// form field trackers
	$username = '';
	$email = '';
	$realname = '';
	
	$terms = getConfig('register_tou');
	
	if ( getConfig('account_activation') == 'disable' && $session->user_level < USER_LEVEL_ADMIN )
	{
		die_friendly($lang->get('user_reg_err_disabled_title'), '<p>' . $lang->get('user_reg_err_disabled_body') . '</p>');
	}
	// are we locked out from logging in? if so, also lock out registration
	if ( getConfig('lockout_policy') === 'lockout' )
	{
		$ip = $db->escape($_SERVER['REMOTE_ADDR']);
		$threshold = time() - ( 60 * intval(getConfig('lockout_duration')) );
		$limit = intval(getConfig('lockout_threshold'));
		$q = $db->sql_query('SELECT * FROM ' . table_prefix . "lockout WHERE timestamp >= $threshold ORDER BY timestamp DESC;");
		if ( !$q )
			$db->_die();
		if ( $db->numrows() >= $limit )
		{
			$row = $db->fetchrow();
			$db->free_result();
			$time_rem = intval(getConfig('lockout_duration')) - round((time() - $row['timestamp']) / 60);
			die_friendly($lang->get('user_reg_err_disabled_title'), '<p>' . $lang->get('user_reg_err_locked_out', array('time' => $time_rem)) . '</p>');
		}
		$db->free_result();
	}
	if(isset($_POST['submit'])) 
	{
		$_GET['coppa'] = ( isset($_POST['coppa']) ) ? $_POST['coppa'] : 'x';
		
		if ( $session->user_level < USER_LEVEL_ADMIN )
		{
			$captcharesult = $session->get_captcha($_POST['captchahash']);
			$session->kill_captcha();
		}
		// bypass captcha if logged in (at this point, if logged in, we're admin)
		if ( !$session->user_logged_in && strtolower($captcharesult) != strtolower($_POST['captchacode']) )
		{
			$s = $lang->get('user_reg_err_captcha');
		}
		else
		{
			if ( getConfig('enable_coppa') == '1' && ( !isset($_POST['coppa']) || ( isset($_POST['coppa']) && !in_array($_POST['coppa'], array('yes', 'no')) ) ) )
			{
				$s = 'Invalid COPPA input';
			}
			else if ( !$session->user_logged_in && !empty($terms) && !isset($_POST['tou_agreed']) )
			{
				$s = $lang->get('user_reg_err_accept_tou');
			}
			else
			{
				$coppa = ( isset($_POST['coppa']) && $_POST['coppa'] == 'yes' );
				$s = false;
				
				// decrypt password
				// as with the change pass form, we aren't going to bother checking the confirmation code because if the passwords didn't match
				// and yet the password got encrypted, that means the user screwed with the code, and if the user screwed with the code and thus
				// forgot his password, that's his problem.
				
				if ( $_POST['use_crypt'] == 'yes' )
				{
					$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
					$crypt_key = $session->fetch_public_key($_POST['crypt_key']);
					if ( !$crypt_key )
					{
						$s = $lang->get('user_reg_err_missing_key');
					}
					else
					{
						$data = $_POST['crypt_data'];
						$bin_key = hexdecode($crypt_key);
						//die("Decrypting with params: key $crypt_key, data $data");
						$password = $aes->decrypt($data, $bin_key, ENC_HEX);
					}
				}
				else
				{
					$password = $_POST['password'];
				}
				
				$error =& $s;
				
				/**
 				* Validation of POST data coming from registration. Put an error message in the variable $error to stop registration.
 				* @hook ucp_register_validate
 				*/
				
				$code = $plugins->setHook('ucp_register_validate');
				foreach ( $code as $cmd )
				{
					eval($cmd);
				}
				
				// All things verified, create account
				if ( !$s )
					$s = $session->create_user($_POST['username'], $password, $_POST['email'], $_POST['real_name'], $coppa);
			}
		}
		if($s == 'success' && !$coppa)
		{
			switch(getConfig('account_activation'))
			{
				case "none":
				default:
					$str = $lang->get('user_reg_msg_success_activ_none', array('login_link' => makeUrlNS('Special', 'Login', false, true)));
					break;
				case "user":
					$str = $lang->get('user_reg_msg_success_activ_user');
					break;
				case "admin":
					$str = $lang->get('user_reg_msg_success_activ_admin');
					break;
			}
			die_friendly($lang->get('user_reg_msg_success_title'), '<p>' . $lang->get('user_reg_msg_success_body') . ' ' . $str . '</p>');
		}
		else if ( $s == 'success' && $coppa )
		{
			$str = $lang->get('user_reg_msg_success_activ_coppa');
			die_friendly($lang->get('user_reg_msg_success_title'), '<p>' . $lang->get('user_reg_msg_success_body') . ' ' . $str . '</p>');
		}
		$username = htmlspecialchars($_POST['username']);
		$email    = htmlspecialchars($_POST['email']);
		$realname = htmlspecialchars($_POST['real_name']);
	}
	$template->header();
	echo $lang->get('user_reg_msg_greatercontrol');
	
	if ( getConfig('account_activation') == 'disable' && $session->user_level >= USER_LEVEL_ADMIN )
	{
		echo '<div class="info-box">' . $lang->get('user_reg_msg_admin_forced') . '</div>';
	}
	
	if ( getConfig('enable_coppa') != '1' || ( isset($_GET['coppa']) && in_array($_GET['coppa'], array('yes', 'no')) ) )
	{
		$coppa = ( isset($_GET['coppa']) && $_GET['coppa'] == 'yes' );
		$session->kill_captcha();
		$captchacode = $session->make_captcha();
		
		$pubkey = $session->rijndael_genkey();
		$challenge = $session->dss_rand();
		
		?>
			<h3><?php echo $lang->get('user_reg_msg_table_title'); ?></h3>
			<form name="regform" action="<?php echo makeUrl($paths->page); ?>" method="post" onsubmit="return runEncryption();">
				<div class="tblholder">
					<table border="0" width="100%" cellspacing="1" cellpadding="4">
						<tr><th colspan="3"><?php echo $lang->get('user_reg_msg_table_subtitle'); ?></th></tr>
						
						<?php if(isset($_POST['submit'])) echo '<tr><td colspan="3" class="row2" style="color: red;">'.$s.'</td></tr>'; ?>
						
						<!-- FIELD: Username -->
						<tr>
							<td class="row1" style="width: 50%;">
								<?php echo $lang->get('user_reg_lbl_field_username'); ?>
								<span id="e_username"></span>
							</td>
							<td class="row1" style="width: 50%;">
								<input tabindex="1" type="text" name="username" size="30" value="<?php echo $username; ?>" onkeyup="namegood = false; validateForm(this);" onblur="checkUsername();" />
							</td>
							<td class="row1" style="width: 1px;">
								<img alt="Good/bad icon" src="<?php echo scriptPath; ?>/images/checkbad.png" id="s_username" />
							</td>
						</tr>
						
						<!-- FIELD: Password -->
						<tr>
							<td class="row3" style="width: 50%;" rowspan="<?php echo ( getConfig('pw_strength_enable') == '1' ) ? '3' : '2'; ?>">
								<?php echo $lang->get('user_reg_lbl_field_password'); ?>
								<span id="e_password"></span>
								<?php if ( getConfig('pw_strength_enable') == '1' && getConfig('pw_strength_minimum') > -10 ): ?>
								<small><?php echo $lang->get('user_reg_msg_password_score'); ?></small>
								<?php endif; ?>
							</td>
							<td class="row3" style="width: 50%;">
								<input tabindex="2" type="password" name="password" size="15" onkeyup="<?php if ( getConfig('pw_strength_enable') == '1' ): ?>password_score_field(this); <?php endif; ?>validateForm(this);" /><?php if ( getConfig('pw_strength_enable') == '1' ): ?><span class="password-checker" style="font-weight: bold; color: #aaaaaa;"> Loading...</span><?php endif; ?>
							</td>
							<td rowspan="<?php echo ( getConfig('pw_strength_enable') == '1' ) ? '3' : '2'; ?>" class="row3" style="max-width: 24px;">
								<img alt="Good/bad icon" src="<?php echo scriptPath; ?>/images/checkbad.png" id="s_password" />
							</td>
						</tr>
						
						<!-- FIELD: Password confirmation -->
						<tr>
							<td class="row3" style="width: 50%;">
								<input tabindex="3" type="password" name="password_confirm" size="15" onkeyup="validateForm(this);" /> <small><?php echo $lang->get('user_reg_lbl_field_password_confirm'); ?></small>
							</td>
						</tr>
						
						<!-- FIELD: Password strength meter -->
						
						<?php if ( getConfig('pw_strength_enable') == '1' ): ?>
						<tr>
							<td class="row3" style="width: 50%;">
								<div id="pwmeter"></div>
							</td>
						</tr>
						<?php endif; ?>
						
						<!-- FIELD: E-mail address -->
						<tr>
							<td class="row1" style="width: 50%;">
								<?php
									if ( $coppa )
									{
										echo $lang->get('user_reg_lbl_field_email_coppa');
									}
									else
									{
										echo $lang->get('user_reg_lbl_field_email');
									}
								?>
								<?php
									if ( ( $x = getConfig('account_activation') ) == 'user' )
									{
										echo '<br /><small>' . $lang->get('user_reg_msg_email_activuser') . '</small>';
									}
								?>
							</td>
							<td class="row1" style="width: 50%;">
								<input tabindex="4" type="text" name="email" size="30" value="<?php echo $email; ?>" onkeyup="validateForm(this);" />
							</td>
							<td class="row1" style="max-width: 24px;">
								<img alt="Good/bad icon" src="<?php echo scriptPath; ?>/images/checkbad.png" id="s_email" />
							</td>
						</tr>
						
						<!-- FIELD: Real name -->
						<tr>
							<td class="row3" style="width: 50%;">
								<?php echo $lang->get('user_reg_lbl_field_realname'); ?><br />
								<small><?php echo $lang->get('user_reg_msg_realname_optional'); ?></small>
							</td>
							<td class="row3" style="width: 50%;">
								<input tabindex="5" type="text" name="real_name" size="30" value="<?php echo $realname; ?>" />
							</td>
							<td class="row3" style="max-width: 24px;">
							</td>
						</tr>
						
						<?php
						/**
 						* Allows adding fields to the user registration form. Form is built with Enano tables, 3 columns. (Rightmost can be left empty or if you're using Javascript validation an image you can update with your own Javascript code)
 						* @hook ucp_register_form
 						*/
						
						$code = $plugins->setHook('ucp_register_form');
						foreach ( $code as $cmd )
						{
							eval($cmd);
						}
						?>
						
						<!-- FIELD: CAPTCHA image -->
						<?php
						if ( !$session->user_logged_in ):
						?>
						<tr>
							<td class="row1" style="width: 50%;" rowspan="2">
								<?php echo $lang->get('user_reg_lbl_field_captcha'); ?><br />
								<small>
									<?php echo $lang->get('user_reg_msg_captcha_pleaseenter', array('regen_flags' => 'href="#" onclick="regenCaptcha(); return false;"')); ?><br />
									<br />
									<?php echo $lang->get('user_reg_msg_captcha_blind'); ?>
								</small>
							</td>
							<td class="row1">
								<img id="captchaimg" alt="CAPTCHA image" src="<?php echo makeUrlNS('Special', 'Captcha/'.$captchacode); ?>" style="cursor: pointer;" onclick="regenCaptcha(); return false;" />
							</td>
							<td class="row1">
								<img alt="Good/bad icon" src="<?php echo scriptPath; ?>/images/checkbad.png" id="s_captcha" />
							</td>
						</tr>
						
						<!-- FIELD: CAPTCHA input field -->
						<tr>
							<td class="row1" colspan="2">
								<?php echo $lang->get('user_reg_lbl_field_captcha_code'); ?>
								<input tabindex="6" name="captchacode" type="text" size="10" onkeyup="validateCaptcha(this);" />
								<img id="captchaajax" width="16" height="16" src="<?php echo cdnPath; ?>/images/spacer.gif" />
								<input type="hidden" name="captchahash" value="<?php echo $captchacode; ?>" />
							</td>
						</tr>
						
						<!-- FIELD: TOU -->
						
						<?php
						if ( !empty($terms) ):
						?>
						
						<tr>
							<td class="row1" colspan="3">
								<?php
								echo $lang->get('user_reg_msg_please_read_tou');
								?>
							</td>
						</tr>
						
						<tr>
							<td class="row3" colspan="3">
								<div style="border: 1px solid #000000; height: 75px; width: 60%; clip: rect(0px,auto,auto,0px); overflow: auto; background-color: #FFF; margin: 0 auto; padding: 4px;">
									<?php
									echo RenderMan::render($terms);
									?>
								</div>
								<p style="text-align: center;">
									<label>
										<input tabindex="7" type="checkbox" name="tou_agreed" />
										<b><?php echo $lang->get('user_reg_lbl_field_tou'); ?></b>
									</label>
								</p>
							</td>
						</tr>
						
						<?php
						endif; // !empty($terms)
						endif; // $session->user_logged_in
						?>
						
						<!-- FIELD: submit button -->
						<tr>
							<th class="subhead" colspan="3" style="text-align: center;">
								<input tabindex="8" type="submit" name="submit" value="<?php echo $lang->get('user_reg_btn_create_account'); ?>" />
							</td>
						</tr>
						
					</table>
				</div>
				<?php
					$val = ( $coppa ) ? 'yes' : 'no';
					echo '<input type="hidden" name="coppa" value="' . $val . '" />';
				?>
				<input type="hidden" name="challenge_data" value="<?php echo $challenge; ?>" />
				<input type="hidden" name="use_crypt" value="no" />
				<input type="hidden" name="crypt_key" value="<?php echo $pubkey; ?>" />
				<input type="hidden" name="crypt_data" value="" />
			<script type="text/javascript">
				// ENCRYPTION CODE
				function runEncryption()
				{
					var frm = document.forms.regform;
					if ( frm.password.value.length < 1 )
						return true;
					pass1 = frm.password.value;
					pass2 = frm.password_confirm.value;
					if ( pass1 != pass2 )
					{
						alert($lang.get('user_reg_err_alert_password_nomatch'));
						return false;
					}
					if ( pass1.length < 6 && pass1.length > 0 )
					{
						alert($lang.get('user_reg_err_alert_password_tooshort'));
						return false;
					}
					if(aes_self_test())
					{
						frm.use_crypt.value = 'yes';
						var cryptkey = frm.crypt_key.value;
						frm.crypt_key.value = hex_md5(cryptkey);
						cryptkey = hexToByteArray(cryptkey);
						if(!cryptkey || ( ( typeof cryptkey == 'string' || typeof cryptkey == 'object' ) ) && cryptkey.length != keySizeInBits / 8 )
						{
							frm.submit.disabled = true;
							len = ( typeof cryptkey == 'string' || typeof cryptkey == 'object' ) ? '\nLen: '+cryptkey.length : '';
							alert('The key is messed up\nType: '+typeof(cryptkey)+len);
						}
						pass = frm.password.value;
						pass = stringToByteArray(pass);
						cryptstring = rijndaelEncrypt(pass, cryptkey, 'ECB');
						if(!cryptstring)
						{
							return false;
						}
						cryptstring = byteArrayToHex(cryptstring);
						frm.crypt_data.value = cryptstring;
						frm.password.value = "";
						frm.password_confirm.value = "";
					}
					return true;
				}
				</script>
			</form>
			<!-- Don't optimize this script, it fails when compressed -->
			<enano:no-opt>
				<script type="text/javascript">
					// <![CDATA[
					var namegood = false;
					function validateForm(field)
					{
						if ( typeof(field) != 'object' )
						{
							field = {
								name: '_nil',
								value: '_nil'
							}
						}
						// wait until $lang is initted
						if ( typeof($lang) != 'object' )
						{
							setTimeout('validateForm();', 200);
							return false;
						}
						var frm = document.forms.regform;
						failed = false;
						
						// Username
						if(!namegood && ( field.name == 'username' || field.name == '_nil' ) ) 
						{
							//if(frm.username.value.match(/^([A-z0-9 \!@\-\(\)]+){2,}$/ig))
							var regex = new RegExp('^([^<>&\?]+){2,}$', 'ig');
							if ( frm.username.value.match(regex) )
							{
								document.getElementById('s_username').src='<?php echo scriptPath; ?>/images/checkunk.png';
								document.getElementById('e_username').innerHTML = '&nbsp;';
							} else {
								failed = true;
								document.getElementById('s_username').src='<?php echo scriptPath; ?>/images/checkbad.png';
								document.getElementById('e_username').innerHTML = '<br /><small>' + $lang.get('user_reg_err_username_invalid') + '</small>';
							}
						}
						if ( document.getElementById('b_username') )
						{
							document.getElementById('b_username').innerHTML = '';
							if(hex_md5(frm.real_name.value) == '5a397df72678128cf0e8147a2befd5f1')
							{
								document.getElementById('b_username').innerHTML = '<br /><br />Hey...I know you!<br /><img alt="" src="http://upload.wikimedia.org/wikipedia/commons/thumb/7/7f/Bill_Gates_2004_cr.jpg/220px-Bill_Gates_2004_cr.jpg" />';
							}
						}
						
						// Password
						if ( field.name == 'password' || field.name == 'password_confirm' || field.name == '_nil' )
						{
							if(frm.password.value.match(/^(.+){6,}$/ig) && frm.password_confirm.value.match(/^(.+){6,}$/ig) && frm.password.value == frm.password_confirm.value )
							{
								document.getElementById('s_password').src='<?php echo scriptPath; ?>/images/check.png';
								document.getElementById('e_password').innerHTML = '<br /><small>' + $lang.get('user_reg_err_password_good') + '</small>';
							} else {
								failed = true;
								if(frm.password.value.length < 6)
								{
									document.getElementById('e_password').innerHTML = '<br /><small>' + $lang.get('user_reg_msg_password_length') + '</small>';
								}
								else if(frm.password.value != frm.password_confirm.value)
								{
									document.getElementById('e_password').innerHTML = '<br /><small>' + $lang.get('user_reg_msg_password_needmatch') + '</small>';
								}
								else
								{
									document.getElementById('e_password').innerHTML = '';
								}
								document.getElementById('s_password').src='<?php echo scriptPath; ?>/images/checkbad.png';
							}
						}
						
						// E-mail address
						
						// workaround for idiot jEdit bug
						if ( validateEmail(frm.email.value) && ( field.name == 'email' || field.name == '_nil' ) )
						{
							document.getElementById('s_email').src='<?php echo scriptPath; ?>/images/check.png';
						} else {
							failed = true;
							document.getElementById('s_email').src='<?php echo scriptPath; ?>/images/checkbad.png';
						}
						if(failed)
						{
							frm.submit.disabled = 'disabled';
						} else {
							frm.submit.disabled = false;
						}
					}
					function checkUsername()
					{
						var frm = document.forms.regform;
						
						if(!namegood)
						{
							var regex = new RegExp('^([^<>&\?]+){2,}$', 'ig');
							if ( frm.username.value.match(regex) )
							{
								document.getElementById('s_username').src='<?php echo scriptPath; ?>/images/checkunk.png';
								document.getElementById('e_username').innerHTML = '&nbsp;';
							} else {
								document.getElementById('s_username').src='<?php echo scriptPath; ?>/images/checkbad.png';
								document.getElementById('e_username').innerHTML = '<br /><small>' + $lang.get('user_reg_err_username_invalid') + '</small>';
								return false;
							}
						}
						
						document.getElementById('e_username').innerHTML = '<br /><small><b>' + $lang.get('user_reg_msg_username_checking') + '</b></small>';
						ajaxGet('<?php echo scriptPath; ?>/ajax.php?title=null&_mode=checkusername&name='+escape(frm.username.value), function() {
							if ( ajax.readyState == 4 && ajax.status == 200 )
								if(ajax.responseText == 'good')
								{
									document.getElementById('s_username').src='<?php echo scriptPath; ?>/images/check.png';
									document.getElementById('e_username').innerHTML = '<br /><small><b>' + $lang.get('user_reg_msg_username_available') + '</b></small>';
									namegood = true;
								} else if(ajax.responseText == 'bad') {
									document.getElementById('s_username').src='<?php echo scriptPath; ?>/images/checkbad.png';
									document.getElementById('e_username').innerHTML = '<br /><small><b>' + $lang.get('user_reg_msg_username_unavailable') + '</b></small>';
									namegood = false;
								} else {
									document.getElementById('e_username').innerHTML = ajax.responseText;
								}
						});
					}
					function regenCaptcha()
					{
						var frm = document.forms.regform;
						document.getElementById('captchaimg').src = '<?php echo makeUrlNS("Special", "Captcha/$captchacode"); ?>/'+Math.floor(Math.random() * 100000);
						frm.captchacode.value = '';
						return false;
					}
					function validateCaptcha(input)
					{
						var frm = document.forms.regform;
						if ( input.value.length < 7 )
						{
							return false;
						}
						var valid_field = document.getElementById('s_captcha');
						var loader_img = document.getElementById('captchaajax');
						loader_img.src = cdnPath + '/images/loading.gif';
						ajaxGet(makeUrlNS('Special', 'Captcha/' + frm.captchahash.value + '/validate=' + input.value), function(ajax)
							{
								if ( ajax.readyState == 4 && ajax.status == 200 )
								{
									var response = String(ajax.responseText + '');
									if ( !check_json_response(response) )
									{
										handle_invalid_json(response);
										return false;
									}
									response = parseJSON(response);
									if ( response.valid )
									{
										loader_img.src = cdnPath + '/images/spacer.gif';
										valid_field.src = cdnPath + '/images/check.png';
									}
									else
									{
										valid_field.src = cdnPath + '/images/checkbad.png';
										regenCaptcha();
										document.getElementById('captchaimg').onload = function()
										{
											document.getElementById('captchaajax').src = cdnPath + '/images/spacer.gif';
											input.focus();
										};
										input.value = '';
									}
								}
							});
					}
					addOnloadHook(function()
						{
							<?php if ( getConfig('pw_strength_enable') == '1' ): ?>
							var frm = document.forms.regform;
							load_component('pwstrength');
							password_score_field(frm.password);
							<?php endif; ?>
							load_component('crypto');
							validateForm();
							setTimeout('checkUsername();', 1000);
						});
					// ]]>
				</script>
			</enano:no-opt>
		<?php
	}
	else
	{
		$year = intval( enano_date('Y') );
		$year = $year - 13;
		$month = enano_date('F');
		$day = enano_date('d');
		
		$yo13_date = "$month $day, $year";
		$link_coppa_yes = makeUrlNS('Special', 'Register', 'coppa=yes', true);
		$link_coppa_no  = makeUrlNS('Special', 'Register', 'coppa=no',  true);
		
		// COPPA enabled, ask age
		echo '<div class="tblholder">';
		echo '<table border="0" cellspacing="1" cellpadding="4">';
		echo '<tr>
						<td class="row1">
							' . $lang->get('user_reg_coppa_title') . '
						</td>
					</tr>
					<tr>
						<td class="row3">
							<a href="' . $link_coppa_no  . '">' . $lang->get('user_reg_coppa_link_atleast13', array( 'yo13_date' => $yo13_date )) . '</a><br />
							<a href="' . $link_coppa_yes . '">' . $lang->get('user_reg_coppa_link_not13', array( 'yo13_date' => $yo13_date )) . '</a>
						</td>
					</tr>';
		echo '</table>';
		echo '</div>';
	}
	$template->footer();
}

function page_Special_Contributions()
{
	global $db, $session, $paths, $template, $plugins; // Common objects
	global $lang;
	
	// This is a vast improvement over the old Special:Contributions in 1.0.x.
	
	$template->header();
	$user = $paths->getParam();
	if ( !$user && isset($_GET['user']) )
	{
		$user = $_GET['user'];
	}
	else if ( !$user && !isset($_GET['user']) )
	{
		echo '<p>' . $lang->get('userfuncs_contribs_err_no_user') . '</p>';
		$template->footer();
		return;
	}
	
	$url = makeUrlNS("Special", "Log/user={$user}");
	redirect($url, '', '', 0);
}

function page_Special_ChangeStyle()
{
	global $db, $session, $paths, $template, $plugins; // Common objects
	global $lang;
	
	if ( !$session->user_logged_in )
	{
		die_friendly('Access denied', '<p>You must be logged in to change your style. Spoofer.</p>');
	}
	if(isset($_POST['theme']) && isset($_POST['style']) && isset($_POST['return_to']))
	{
		if ( !preg_match('/^([a-z0-9_-]+)$/i', $_POST['theme']) )
			die('Hacking attempt');
		if ( !preg_match('/^([a-z0-9_-]+)$/i', $_POST['style']) )
			die('Hacking attempt');
		$d = ENANO_ROOT . '/themes/' . $_POST['theme'];
		$f = ENANO_ROOT . '/themes/' . $_POST['theme'] . '/css/' . $_POST['style'] . '.css';
		if ( !file_exists($d) || !is_dir($d) )
		{
			die('The directory "'.$d.'" does not exist.');
		}
		if ( !file_exists($f) )
		{
			die('The file "'.$f.'" does not exist.');
		}
		$d = $db->escape($_POST['theme']);
		$f = $db->escape($_POST['style']);
		$q = 'UPDATE '.table_prefix.'users SET theme=\''.$d.'\',style=\''.$f.'\' WHERE username=\''.$session->username.'\'';
		if ( !$db->sql_query($q) )
		{
			$db->_die('Your theme/style preferences were not updated.');
		}
		else
		{
			redirect(makeUrl($_POST['return_to']), $lang->get('userfuncs_changetheme_success_title'), $lang->get('userfuncs_changetheme_success_body'), 3);
		}
	}
	else
	{
		$template->header();
			$ret = ( isset($_POST['return_to']) ) ? $_POST['return_to'] : $paths->getParam(0);
			if ( !$ret )
			{
				$ret = get_main_page();
			}
			?>
				<form action="<?php echo makeUrl($paths->page); ?>" method="post">
					<?php if ( !isset($_POST['themeselected']) ) { ?>
						<h3><?php echo $lang->get('userfuncs_changetheme_heading_theme'); ?></h3>
						<p>
							<select name="theme">
 							<?php
								foreach ( $template->theme_list as $t )
								{
									if ( $t['enabled'] )
									{
										echo '<option value="'.$t['theme_id'].'"';
										if ( $t['theme_id'] == $session->theme )
										{
											echo ' selected="selected"';
										}
										echo '>' . htmlspecialchars($t['theme_name']) . '</option>';
									}
								}
 							?>
							</select>
						</p>
						<p><input type="hidden" name="return_to" value="<?php echo htmlspecialchars($ret); ?>" />
 							<input type="submit" name="themeselected" value="<?php echo $lang->get('userfuncs_changetheme_btn_continue'); ?>" /></p>
					<?php } else { 
						$theme = $_POST['theme'];
						if ( !preg_match('/^([0-9A-z_-]+)$/i', $theme ) )
							die('Hacking attempt');
						?>
						<h3><?php echo $lang->get('userfuncs_changetheme_heading_style'); ?></h3>
						<p>
							<select name="style">
								<?php
									$dir = './themes/'.$theme.'/css/';
									$list = Array();
									// Open a known directory, and proceed to read its contents
									if (is_dir($dir)) {
										if ($dh = opendir($dir)) {
											while (($file = readdir($dh)) !== false) {
												if(preg_match('#^(.*?)\.css$#is', $file) && $file != '_printable.css') {
													$list[] = substr($file, 0, strlen($file)-4);
												}
											}
											closedir($dh);
										}
									} else die($dir.' is not a dir');
									foreach ( $list as $l )
									{
										echo '<option value="'.$l.'">'.ucfirst($l).'</option>';
									}
								?>
							</select>
						</p>
						<p><input type="hidden" name="return_to" value="<?php echo htmlspecialchars($ret); ?>" />
 							<input type="hidden" name="theme" value="<?php echo htmlspecialchars($theme); ?>" />
 							<input type="submit" name="allclear" value="<?php echo $lang->get('userfuncs_changetheme_btn_allclear'); ?>" /></p>
					<?php } ?>
				</form>
			<?php
		$template->footer();
	}
}

function page_Special_ActivateAccount()
{
	global $db, $session, $paths, $template, $plugins; // Common objects
	global $lang;
	
	$user = $paths->getParam(0);
	if ( !$user )
	{
		die_friendly($lang->get('userfuncs_activate_err_badlink_title'), '<p>' . $lang->get('userfuncs_activate_err_badlink_body') . '</p>');
	}
	$user = str_replace('_', ' ', dirtify_page_id($user));
	$key = $paths->getParam(1);
	if ( !$key )
	{
		die_friendly($lang->get('userfuncs_activate_err_badlink_title'), '<p>' . $lang->get('userfuncs_activate_err_badlink_body') . '</p>');
	}
	$s = $session->activate_account(str_replace('_', ' ', $user), $key);
	if ( $s )
	{
		die_friendly($lang->get('userfuncs_activate_success_title'), '<p>' . $lang->get('userfuncs_activate_success_body') . '</p>');
	}
	else
	{
		die_friendly($lang->get('userfuncs_activate_err_badlink_title'), '<p>' . $lang->get('userfuncs_activate_err_bad_key') . '</p>');
	}
}

function page_Special_Captcha()
{
	global $db, $session, $paths, $template, $plugins; // Common objects
	if ( $paths->getParam(0) == 'make' )
	{
		$session->kill_captcha();
		echo $session->make_captcha();
		return;
	}
	
	$hash = $paths->getParam(0);
	if ( !$hash || !preg_match('#^([0-9a-f]*){32,40}$#i', $hash) )
	{
		$paths->main_page();
	}
	
	if ( $validate_code = $paths->getParam(1) )
	{
		if ( preg_match('/^validate=(.+)$/', $validate_code, $match) )
		{
			header('Content-type: text/javascript');
			$code = $session->get_captcha($hash, true);
			$valid = strtolower($code) === strtolower($match[1]);
			if ( !$valid )
			{
				$session->make_captcha(7, $hash);
			}
			echo enano_json_encode(array(
				'valid' => $valid
				));
			exit;
		}
	}

	$session->make_captcha(7, $hash);
	$code = $session->generate_captcha_code();
	// Avoid letting our captchas end up on failblog.org
	// BTW, the last one was a real-life encounter: http://img822.imageshack.us/img822/3851/murderg.png
	foreach ( array('shit', 'cock', 'fuck', 'nazi', 'cunt', 'clit', 'pussy', 'penis', 'piss', 'tits', 'murder') as $word )
	{
		if ( stristr($code, $word) )
		{
			// but don't put too much effort into this (will only correct this once)
			// I mean, face it. If it generates one of those words twice in a row, either the local root has had
			// way too much fun with his /dev/random, or this server is just plain gutter-minded.
			$code = $session->generate_captcha_code();
			break;
		}
	}
	$q = $db->sql_query('UPDATE ' . table_prefix . "captcha SET code = '$code' WHERE session_id = '$hash';");
	if ( !$q )
		$db->_die();
	
	require ( ENANO_ROOT.'/includes/captcha.php' );
	try
	{
		$captcha = captcha_object($hash, 'freecap');
	}
	catch ( Exception $e )
	{
		die("CAPTCHA engine returned a hard exception");
	}
	// $captcha->debug = true;
	$captcha->make_image();
	
	exit;
}

function page_Special_PasswordReset()
{
	global $db, $session, $paths, $template, $plugins; // Common objects
	global $lang;
	
	$template->header();
	if($paths->getParam(0) == 'stage2')
	{
		require_once(ENANO_ROOT . '/includes/math.php');
		require_once(ENANO_ROOT . '/includes/diffiehellman.php');
		
		$user_id = intval($paths->getParam(1));
		$encpass = $paths->getParam(2);
		if ( $user_id < 2 )
		{
			echo '<p>Hacking attempt</p>';
			$template->footer();
			return false;
		}
		if(!preg_match('#^([a-f0-9]+)$#i', $encpass))
		{
			echo '<p>Hacking attempt</p>';
			$template->footer();
			return false;
		}
		
		$q = $db->sql_query('SELECT username,temp_password_time,temp_password,password_salt FROM '.table_prefix.'users WHERE user_id='.$user_id.';');
		if($db->numrows() < 1)
		{
			echo '<p>Invalid credentials</p>';
			$template->footer();
			return false;
		}
		$row = $db->fetchrow();
		$db->free_result();
		
		$temp_pass = $session->pk_decrypt($encpass);
		$temp_hmac = hmac_sha1($temp_pass, $row['password_salt']);
		
		if ( $temp_hmac !== $row['temp_password'] )
		{
			echo '<p>Invalid credentials</p>';
			$template->footer();
			return false;
		}
		
		if ( ( intval($row['temp_password_time']) + ( 3600 * 24 ) ) < time() )
		{
			echo '<p>' . $lang->get('userfuncs_passreset_err_pass_expired', array('reset_url' => makeUrlNS('Special', 'PasswordReset'))) . '</p>';
			$template->footer();
			return false;
		}
		
		if ( isset($_POST['do_stage2']) )
		{
			$data = $session->get_aes_post('pass');
			
			if(empty($data))
			{
				echo 'ERROR: Sanity check failed!';
				$template->footer();
				return false;
			}
			if ( strlen($data) < 6 )
			{
				echo '<p>' . $lang->get('userfuncs_passreset_err_too_short') . '</p>';
				$template->footer();
				return false;
			}
			if ( $_POST['use_crypt'] == 'no' )
			{
				if ( $_POST['pass'] !== $_POST['pass_confirm'] )
				{
					echo '<p>' . $lang->get('userfuncs_passreset_err_no_match') . '</p>';
					$template->footer();
					return false;
				}
			}
			if ( getConfig('pw_strength_enable') == 1 )
			{
				$min_score = intval(getConfig('pw_strength_minimum'));
				$inp_score = password_score($data);
				if ( $inp_score < $min_score )
				{
					$url = makeUrl($paths->fullpage);
					echo "<p>" . $lang->get('userfuncs_passreset_err_failed_score', array('inp_score' => $inp_score, 'url' => $url)) . "</p>";
					$template->footer();
					return false;
				}
			}
			
			$session->set_password($user_id, $data);
			
			$q = $db->sql_query('UPDATE '.table_prefix.'users SET temp_password=\'\',temp_password_time=0 WHERE user_id = '.$user_id.';');
			
			if($q)
			{
				$session->login_without_crypto($row['username'], $data);
				echo '<p>' . $lang->get('userfuncs_passreset_stage2_success', array('url_mainpage' => makeUrl(get_main_page()))) . '</p>';
			}
			else
			{
				echo $db->get_error();
			}
			
			$template->foo…