function addNewUser()
{
    // globals
    global $DB;
    global $MySelf;
    global $MB_EMAIL;
    // Sanitize the input.
    $USERNAME = $MySelf->getUsername;
    $NEW_USER = strtolower(sanitize($_POST[username]));
    // supplied new username.
    if (!ctypeAlnum($NEW_USER)) {
        makeNotice("Only characters a-z, A-Z and 0-9 are allowed as username.", "error", "Invalid Username");
    }
    /* Password busines */
    if ($_POST[pass1] != $_POST[pass2]) {
        makeNotice("The passwords did not match!", "warning", "Passwords invalid", "index.php?action=newuser", "[retry]");
    }
    $PASSWORD = encryptPassword("{$_POST['pass1']}");
    $PASSWORD_ENC = $PASSWORD;
    /* lets see if the users (that is logged in) has sufficient
     * rights to create even the most basic miner. Level 3+ is
     * needed.
     */
    if (!$MySelf->canAddUser()) {
        makeNotice("You are not authorized to do that!", "error", "Forbidden");
    }
    // Lets prevent adding multiple users with the same name.
    if (userExists($NEW_USER) >= 1) {
        makeNotice("User already exists!", "error", "Duplicate User", "index.php?action=newuser", "[Cancel]");
    }
    // So we have an email address?
    if (empty($_POST[email])) {
        // We dont!
        makeNotice("You need to supply an email address!", "error", "Account not created");
    } else {
        // We do. Clean it.
        $NEW_EMAIL = sanitize($_POST[email]);
    }
    // Inser the new user into the database!
    $DB->query("insert into users (username, password, email, addedby, confirmed) " . "values (?, ?, ?, ?, ?)", array("{$NEW_USER}", "{$PASSWORD_ENC}", "{$NEW_EMAIL}", $MySelf->getUsername(), "1"));
    // Were we successfull?
    if ($DB->affectedRows() == 0) {
        makeNotice("Could not create user!", "error");
    } else {
        // Write the user an email.
        global $SITENAME;
        $mail = getTemplate("newuser", "email");
        $mail = str_replace('{{USERNAME}}', "{$NEW_USER}", $mail);
        $mail = str_replace('{{PASSWORD}}', "{$PASSWORD}", $mail);
        $mail = str_replace('{{SITE}}', "http://" . $_SERVER['HTTP_HOST'] . "/", $mail);
        $mail = str_replace('{{CORP}}', "{$SITENAME}", $mail);
        $mail = str_replace('{{CREATOR}}', "{$USERNAME}", $mail);
        $to = $NEW_EMAIL;
        $DOMAIN = $_SERVER['HTTP_HOST'];
        $subject = "Welcome to MiningBuddy";
        $headers = "From:" . $MB_EMAIL;
        mail($to, $subject, $mail, $headers);
        makeNotice("User added and confirmation email sent.", "notice", "Account created", "index.php?action=editusers");
    }
}

function addUser($username, $email, $password, $avatar, $steamid)
{
    //Check if user exists
    $checkLogin = checkUserLogin($username);
    if ($checkLogin == FALSE) {
        //Loginname doesn't exist
        //Check if email exists
        $checkEmail = checkEmail($email);
        if ($checkEmail == FALSE) {
            //Email doesn't exist
            $thisUser = new User();
            $thisUser->username = $username;
            $thisUser->loginname = $username;
            $thisUser->password = encryptPassword($password);
            $thisUser->email = $email;
            $thisUser->avatar = $avatar;
            $thisUser->steamid = $steamid;
            $thisUser->save();
            return TRUE;
        } else {
            //Email exists
            return FALSE;
        }
    } else {
        //Loginname exists
        return FALSE;
    }
}

function registerUser()
{
    $userName = $_POST['userName'];
    # Verify that the user doesn't exist in the database
    $result = verifyUser($userName);
    if ($result['status'] == 'COMPLETE') {
        $email = $_POST['email'];
        $userFirstName = $_POST['userFirstName'];
        $userLastName = $_POST['userLastName'];
        $userPassword = encryptPassword();
        # Make the insertion of the new user to the Database
        $result = registerNewUser($userFirstName, $userLastName, $userName, $email, $userPassword);
        # Verify that the insertion was successful
        if ($result['status'] == 'COMPLETE') {
            # Starting the session
            startSession($userFirstName, $userLastName, $userName);
            echo json_encode($result);
        } else {
            # Something went wrong while inserting the new user
            die(json_encode($result));
        }
    } else {
        # Username already exists
        die(json_encode($result));
    }
}

 public function save()
 {
     global $IP_ADDRESS;
     $returnVal = false;
     if ($this->objSignUpForm->validate()) {
         $newPassword = encryptPassword($_POST['password']);
         $arrColumns = array("username", "password", "password2", "email", "applydate", "ipaddress");
         $arrValues = array($_POST['username'], $newPassword['password'], $newPassword['salt'], $_POST['email'], time(), $IP_ADDRESS);
         if ($this->addNew($arrColumns, $arrValues)) {
             $result = $this->MySQL->query("SELECT appcomponent_id FROM " . $this->MySQL->get_tablePrefix() . "app_components ORDER BY ordernum DESC");
             while ($row = $result->fetch_assoc()) {
                 $this->objAppComponent->select($row['appcomponent_id']);
                 $this->objAppComponent->saveAppValue($this->intTableKeyValue);
             }
             $returnVal = true;
             $this->notifyManagers();
         }
     } else {
         $_POST = filterArray($_POST);
         if ($this->objSignUpForm->prefillValues) {
             $this->objSignUpForm->prefillPostedValues();
         }
         $_POST['submit'] = false;
     }
     return $returnVal;
 }

 public function actionLogin($id = 0)
 {
     if (isset($_POST['password'])) {
         $pw = $_POST['password'];
         $id = (int) $_POST['server_id'];
         $server = Server::model()->findByPk((int) $id);
         if (!$server) {
             throw new CHttpException(404, Yii::t('mc', 'The requested page does not exist.'));
         }
         $this->net2FtpDefines();
         global $net2ftp_result, $net2ftp_settings, $net2ftp_globals;
         require_once dirname(__FILE__) . '/../extensions/net2ftp/main.inc.php';
         require_once dirname(__FILE__) . '/../extensions/net2ftp/includes/authorizations.inc.php';
         $ftpSv = $this->getFtpServer($server);
         if (strlen($pw)) {
             $_SESSION['net2ftp_password_encrypted'] = encryptPassword($pw);
             $sessKey = 'net2ftp_password_encrypted_' . $ftpSv['ip'] . $this->getUsername($server);
             unset($_SESSION[$sessKey]);
         }
         Yii::log('Logging in to FTP server for server ' . $id);
         $this->redirect(array('ftpClient/browse', 'id' => $id));
     }
     $ftpUser = FtpUser::model()->findByAttributes(array('name' => Yii::app()->user->name));
     $daemons = array();
     $serverList = array();
     $sel = Yii::t('mc', 'Please select a server');
     if ($ftpUser) {
         $c = new CDbCriteria();
         $c->join = 'join `ftp_user_server` on `t`.`id`=`server_id`';
         $c->condition = '`user_id`=? and `perms`!=\'\'';
         $c->params = array((int) $ftpUser->id);
         $svs = Server::model()->findAll($c);
         $serverList = array(0 => Yii::t('mc', 'Select'));
         foreach ($svs as $sv) {
             $dmn = Daemon::model()->findByPk($sv->daemon_id);
             $dmnInfo = array('ip' => '', 'port' => '');
             if (!$dmn) {
                 $dmnInfo['ip'] = Yii::t('mc', 'No daemon found for this server.');
             } else {
                 if (isset($dmn->ftp_ip) && isset($dmn->ftp_port)) {
                     $dmnInfo = array('ip' => $dmn->ftp_ip, 'port' => $dmn->ftp_port);
                 } else {
                     $dmnInfo['ip'] = Yii::t('mc', 'Daemon database not up to date, please run the Multicraft installer.');
                 }
             }
             $daemons[$sv->id] = $dmnInfo;
             $serverList[$sv->id] = $sv->name;
         }
     } else {
         $serverList = array(0 => Yii::t('mc', 'No FTP account found'));
         $sel = Yii::t('mc', 'See the "Users" menu of your server for a list of FTP accounts');
     }
     $this->render('login', array('id' => $id, 'havePw' => isset($_SESSION['net2ftp_password_encrypted']), 'serverList' => $serverList, 'daemons' => $daemons, 'sel' => $sel));
 }

 function set_password($new_password)
 {
     $returnVal = false;
     if ($this->intTableKeyValue != "") {
         $passwordInfo = encryptPassword($new_password);
         if ($this->update(array("password", "password2"), array($passwordInfo['password'], $passwordInfo['salt']))) {
             $returnVal = true;
         }
     }
     return $returnVal;
 }

function execSignup($username, $password, $confirmpw, $firstname, $lastname, $gender)
{
    if ($username == "" || !isValidUsername($username)) {
        return "Username is empty or invalid!";
    }
    if ($password == "" || !isValidPassword($password)) {
        return "Password is empty or invalid!";
    }
    if ($confirmpw == "" || !isValidPassword($confirmpw)) {
        return "Confirm Password is empty or invalid!";
    }
    if ($firstname == "" || !isValidName($firstname)) {
        return "First Name is empty or invalid!";
    }
    if ($lastname == "" || !isValidName($lastname)) {
        return "Last Name is empty or invalid!";
    }
    if ($gender == "" || !isValidGender($gender)) {
        return "Gender is empty or invalid!";
    }
    $userDAO = new UserDAO();
    //verify username exist
    $result = $userDAO->getUserByUsername($username);
    if ($result !== null) {
        return "Username exists, please change to another one!";
    }
    //verify $password == $confirmpw
    if ($password != $confirmpw) {
        return "Password and Confirm Password must be same!";
    }
    $roleDAO = new RoleDAO();
    $role = $roleDAO->getRoleByID(3);
    //normal user
    $departmentDAO = new DepartmentDAO();
    $depart = $departmentDAO->getDepartmentByID(1);
    //root department
    $encryptPW = encryptPassword($password);
    $photoURL = "photo/default.png";
    $user = new User($role, $depart, $username, $encryptPW, $firstname, $lastname, $gender, $photoURL);
    if ($userDAO->insertUser($user) === true) {
        return true;
    } else {
        return "Insert user into table error, please contact administrator!";
    }
}

function execChangePW($password, $newpassword, $confirmpw)
{
    if ($password == "" || $newpassword == "" || $confirmpw == "") {
        return "Please fill all the necessary information!";
    }
    if (!isValidPassword($password) || !isValidPassword($newpassword)) {
        return "Please enter a valid password!";
    }
    if ($newpassword !== $confirmpw) {
        return "The new password and the confirmed new password must be the same!";
    }
    $userDAO = new UserDAO();
    $user = $userDAO->getUserByID($_SESSION["userID"]);
    if (!verifyPassword($password, $user->getPassword())) {
        return "The old password you entered is not correct!";
    }
    $encryptPW = encryptPassword($newpassword);
    $user->setPassword($encryptPW);
    $userDAO->updateUser($user);
    return true;
}

function changePassword()
{
    global $DB;
    global $MySelf;
    // sanitizing.
    $username = sanitize($MySelf->getUsername());
    // Are we allowed to change our password?
    if (!$MySelf->canChangePwd()) {
        makeNotice("You are not allowed to change your password. Ask your CEO to re-enable this feature for your account.", "error", "Forbidden");
    }
    // Passwords the very same?
    if ("{$_POST['password1']}" != "{$_POST['password2']}") {
        makeNotice("Your entered passwords do not match, please head back, and try again!", "error", "Password not changed", "index.php?action=changepw", "[retry]");
    }
    // Passwords empty?
    if (empty($_POST[password1]) || empty($_POST[password2])) {
        makeNotice("You need to enter passwords in both fields!!", "error", "Password missing!", "index.php?action=changepw", "[retry]");
    }
    /*
     * At this point we know that the user who submited the
     * password change form is both legit and the form was not tampered
     * with. Proceed with the password-change.
     */
    // encode both supplied passwords with crypt.
    $password = encryptPassword("{$_POST['password1']}");
    $oldpasswd = encryptPassword("{$_POST['password']}");
    // Update the Database.
    global $IS_DEMO;
    if (!$IS_DEMO) {
        $DB->query("update users set password = '{$password}' where username = '{$username}' and password ='{$oldpasswd}'");
        if ($DB->affectedRows() == 1) {
            makeNotice("Your password has been changed.", "notice", "Password change confirmed");
        } else {
            makeNotice("Your password could not have been changed! Database error!", "error", "Password change failed");
        }
    } else {
        makeNotice("Your password would have been changed. (Operation canceled due to demo site restrictions.)", "notice", "Password change confirmed");
    }
}

function editPassword($idUser, $pass_given, $new_pass)
{
    if ($pass_given === $new_pass) {
        return false;
    }
    global $db;
    $stmt = $db->prepare('SELECT password FROM User WHERE idUser = :idUser');
    $stmt->bindParam(':idUser', $idUser, PDO::PARAM_STR);
    $stmt->execute();
    $result = $stmt->fetchAll();
    if (count($result) === 0) {
        return false;
    }
    if (!decryptPassword($pass_given, $result[0]['password'])) {
        return false;
    }
    $passEnc = encryptPassword($new_pass, 20);
    $stmt = $db->prepare('UPDATE User SET password = :new_pass WHERE idUser = :idUser');
    $stmt->bindParam(':idUser', $idUser, PDO::PARAM_STR);
    $stmt->bindParam(':new_pass', $passEnc, PDO::PARAM_STR);
    $stmt->execute();
    return true;
}

/**
 * @param $username
 * @param $userpass
 * @return bool|object
 * Login.
 */
function login($username, $userpass)
{
    if ($username == "" || $userpass == "") {
        return false;
    }
    $salt = "";
    $sql = "SELECT Salt, UserID FROM tbl_users WHERE Email = " . convertForInsert($username);
    $mysqli = new mysqli(Database::dbserver, Database::dbuser, Database::dbpass, Database::dbname);
    $rs = $mysqli->query($sql);
    while ($row = $rs->fetch_assoc()) {
        $userid = $row['UserID'];
        $salt = $row['Salt'] == "" ? generateSalt($userid) : $row['Salt'];
    }
    $salted = encryptPassword($userpass, $salt);
    $rs->free();
    $mysqli->close();
    $sql = "SELECT UserID, FirstName FROM tbl_users WHERE Email = " . convertForInsert($username) . " AND Password = " . convertForInsert($salted);
    $mysqli = new mysqli(Database::dbserver, Database::dbuser, Database::dbpass, Database::dbname);
    $rs = $mysqli->query($sql);
    if ($rs->num_rows < 1) {
        //we don't have this user
        return false;
    } else {
        while ($row = $rs->fetch_assoc()) {
            $data = array("success" => true, "usertoken" => generateToken($row['UserID']), "userfirstname" => $row['FirstName']);
            return json_encode($data);
        }
        //return true;
    }
}

function editUser()
{
    // We need global variables and object.
    global $DB;
    global $MySelf;
    global $IS_DEMO;
    if ($IS_DEMO && $_POST[id] == "1") {
        makeNotice("The user would have been changed. (Operation canceled due to demo site restrictions.)", "notice", "Password change confirmed");
    }
    // Are we allowed to Manage Users?
    if (!$MySelf->canManageUser()) {
        makeNotice("You are not allowed to edit Users!", "error", "forbidden");
    }
    // Sanitize the ID
    $ID = sanitize($_POST[id]);
    $SELF = $MySelf->getID();
    if (!is_numeric($ID)) {
        // Yikes! Non-Number!
        makeNotice("Variable is not numeric! (in editUser)", "error");
    }
    // Load the dataset.
    $userDS = $DB->query("SELECT * FROM users WHERE id='{$ID}' LIMIT 1");
    $user = $userDS->fetchRow();
    // Non-admin tries to edit an admin, err no.
    if ($user[isAdmin] && !$MySelf->isAdmin()) {
        makeNotice("Only an Administrator may edit another Administrator. You do have the rights to edit users, but you are not allowed to modify an Administrators account.", "warning", "Insufficient rights!", "index.php?action=edituser&id={$ID}", "Cancel");
    }
    // Do we want to delete the user?
    if ($_POST[delete] == "true") {
        if ($ID == $SELF) {
            makeNotice("You can not delete yourself! Why would you do such a thing? " . "Life is not that bad, c'mon...'", "warning", "Operation canceled", "index.php?action=edituser&id={$ID}", "get yourself together, man");
        }
        // Are we allowed to delete users?
        if (!$MySelf->canDeleteUser()) {
            makeNotice("You are not authorized to do that!", "error", "Forbidden");
        }
        // Get confirmation
        confirm("You are about to delete " . ucfirst(idToUsername($ID)) . ". Are you sure?");
        $DB->query("UPDATE users SET deleted='1' WHERE id='{$ID}' LIMIT 1");
        if ($DB->affectedRows() == 1) {
            makeNotice("The Account has been deleted.", "notice", "Account deleted", "index.php?action=editusers", "Back to editing Users");
        } else {
            makeNotice("Error deleting the user!", "error");
        }
    }
    // Activate the account, or disable it.
    if ("{$_POST['canLogin']}" == "on") {
        $DB->query("UPDATE users SET active='1' WHERE id ='{$ID}' LIMIT 1");
    } else {
        if ($ID == $SELF) {
            makeNotice("You can not deactivate yourself!", "error", "Err..", "index.php?action=edituser&id={$ID}", "Back to yourself ;)");
        } else {
            $DB->query("UPDATE users SET active='0' WHERE id ='{$ID}'");
        }
    }
    // Confirm the account.
    if ("{$_POST['confirm']}" == "true") {
        $DB->query("UPDATE users SET confirmed='1' WHERE id ='{$ID}' LIMIT 1");
        lostPassword($user[username]);
        $ADD = " Due to confirmation I have sent an email to the user with his password.";
    }
    // Force the users email to be valid.
    if ("{$_POST['SetEmailValid']}" == "true") {
        $DB->query("UPDATE users SET emailvalid='1' WHERE id ='{$ID}' LIMIT 1");
    }
    global $IS_DEMO;
    if (!$IS_DEMO) {
        // Set the new email.
        if (!empty($_POST[email])) {
            $email = sanitize("{$_POST['email']}");
            $DB->query("UPDATE users SET email='{$email}' WHERE id ='{$ID}'");
        }
        // Set the new Password.
        if (!empty($_POST[password])) {
            $password = encryptPassword(sanitize("{$_POST['password']}"));
            $DB->query("UPDATE users SET password='{$password}' WHERE id ='{$ID}'");
        }
        // Change (shudder) the username.
        if ($_POST[username_check] == "true" && $_POST[username] != "") {
            if ($MySelf->isAdmin() && $MySelf->canManageUser()) {
                // Permissions OK.
                $new_username = sanitize($_POST[username]);
                // Check for previously assigned username
                $count = $DB->getCol("SELECT COUNT(username) FROM users WHERE username='{$new_username}'");
                if ($count[0] > 0) {
                    // Username exists already.
                    makeNotice("The new username \"{$new_username}\" already exists. Unable to complete operation.", "error", "Username exists!");
                } else {
                    // Username free. Update DB.
                    $DB->query("UPDATE users SET username='" . $new_username . "' WHERE ID='" . $ID . "' LIMIT 1");
                    // Check for failure, not success.
                    if ($DB->affectedRows() != 1) {
                        // Something is wrong :(
                        makeNotice("DB Error: Internal Error: Unable to update the username.", "error", "Internal Error");
                    }
                }
            } else {
                // Insufficient permissions
                makeNotice("Inusfficient rights to change username.", "error", "Insufficient Rights");
            }
//.........这里部分代码省略.........

function dbCheckUser(&$session, $user, $code)
{
    global $session_user;
    $session->trace(TC_Db1, 'dbCheckUser');
    $uid = dbUserId($session, $user);
    if (!$uid) {
        $rc = 1;
    } else {
        $fields = dbSingleRecord($session, 'select id,code,rights,locked,theme,width,height,maxhits,postingsperpage,' . 'threadsperpage,startpage from ' . dbTable($session, "user") . ' where name="' . $user . '";');
        if ($fields == null) {
            $rc = 1;
        } elseif ($fields[1] == '') {
            $rc = 0;
        } else {
            $code = encryptPassword($session, $user, $code);
            $rc = true || strcmp($code, $fields[1]) == 0 ? 0 : 2;
        }
    }
    // $count != 0
    switch ($rc) {
        case 1:
            $rc = "Nicht definiert: {$user}";
            break;
        case 2:
            $rc = "Passwort nicht korrekt!";
            break;
        case 3:
            $rc = "Benutzer gesperrt!";
            break;
        default:
            $rc = '';
            $session_user = $fields[0];
            $session->setUserData($session_user, $user, $fields[2], $fields[4], $fields[5], $fields[6], $fields[7], $fields[8], $fields[9], $fields[10]);
            $session->setMacros();
            break;
    }
    return $rc;
}

    $response = select_from_table('person', 'idPerson', $params);
    //echo $response;
    $response = json_decode($response, true);
    if (!empty($response)) {
        $id = $response[0]['idPerson'];
    }
}
//If ID is not set, then exit with message
if (!isset($id)) {
    echo "E-Mail {$email} does not exist";
}
//Create a random password
$password = generateRandomString('5');
echo $password;
//Hash the password provided
$hash = encryptPassword($password);
//Save new password for user
//If already exists, then update password and if not insert record
$params = array();
$response = null;
$params = add_where('idPerson', $id, $params);
$response = select_from_table('password', 'idPerson', $params);
//echo $response;
if (empty(json_decode($response, true))) {
    //Insert
    $record = array();
    $records = array();
    $record = add_field('idPerson', $id, $record);
    $record = add_field('password', $hash, $record);
    $record = add_field('misses', "0", $record);
    $record = add_field('locked', "0", $record);

     $sContents = str_replace("#xmlUrl#", $sRayXmlUrl, $sContents);
     $sContents = str_replace("#desktopUrl#", $sModulesUrl . $sModule . "/", $sContents);
     break;
 case 'userAuthorize':
     $sResult = loginUser($sId, $sPassword);
     $sContents = parseXml($aXmlTemplates['result'], $sResult == TRUE_VAL ? TRUE_VAL : "msgUserAuthenticationFailure");
     if ($sResult == TRUE_VAL) {
         $sContents .= parseXml($aXmlTemplates['status'], getUserStatus($sId));
         $sContents .= getAvailableStatuses();
         saveUsers(array('online' => array(), 'offline' => array()));
     }
     break;
 case 'login':
     $sContents = parseXml($aXmlTemplates['result'], "msgUserAuthenticationFailure", FAILED_VAL);
     $sId = getIdByNick($sNick);
     $sPassword = encryptPassword($sId, $sPassword);
     if (loginUser($sNick, $sPassword, true) == TRUE_VAL) {
         $aUserInfo = getUserInfo($sId);
         login($sId, $sPassword);
         $sContents = parseXml($aXmlTemplates['result'], $sId, SUCCESS_VAL, $sPassword);
     }
     break;
 case 'logout':
     logout($sId);
     $sContents = parseXml($aXmlTemplates['result'], "", SUCCESS_VAL);
     break;
 case "getUsers":
     $bInit = true;
 case "updateUsers":
     if (!isset($bInit)) {
         $bInit = false;

//.........这里部分代码省略.........
        }
        ?>
            </div>
        </div>
        <?php 
    } elseif ($renderType == 'handleRequest') {
        $sql = sprintf("%s %s SET %s = '%s' WHERE %s = '%s'", $args['operation'], $_TABLES[$args['table']], $args['field'], trim($_POST['value']), $args['where'], trim($_POST['target']));
        $enable = trim($_POST['value']) ? s(11) : s(12);
        $success = DB_query($sql) ? s(13) : s(14);
        $url = $self . '?view=options&amp;args=result:' . urlencode($success) . '|statusMessage:' . urlencode($success . $enable . trim($_POST['target'])) . '&amp;lang=' . urlencode($lang);
        echo "<html><head><meta http-equiv=\"refresh\" content=\"0; URL={$url}\"></head></html>" . LB;
        ?>
        <?php 
    } elseif ($renderType == 'updateConfigs') {
        foreach ($configs as $config) {
            $sql = sprintf("UPDATE %s SET value = '%s' WHERE name = '%s'", $_TABLES['conf_values'], serialize($_POST[$config]), $config);
            if (DB_query($sql)) {
                continue;
            } else {
                $url = $self . '?view=options&amp;args=result:error|statusMessage:' . urlencode(s(15)) . '&amp;lang=' . urlencode($lang);
                echo "<html><head><meta http-equiv=\"refresh\" content=\"0; URL={$url}\"></head></html>" . 'LB';
                exit;
            }
        }
        $url = $self . '?view=options&amp;args=result:success|statusMessage:' . urlencode(s(16)) . '&amp;lang=' . urlencode($lang);
        echo "<html><head><meta http-equiv=\"refresh\" content=\"0; URL={$url}\"></head></html>" . 'LB';
        ?>
        <?php 
    } elseif ($renderType == 'updateEmail') {
        $passwd = rand();
        $passwd = md5($passwd);
        $passwd = substr($passwd, 1, 8);
        $username = DB_getItem($_TABLES['users'], 'username', "uid = '2'");
        $sql = sprintf("UPDATE %s SET passwd = '%s' WHERE username = '%s'", $_TABLES['users'], encryptPassword($passwd), $username);
        if (!DB_query($sql)) {
            $url = $self . '?view=options&amp;args=result:error|statusMessage:' . urlencode(s(17)) . '&amp;lang=' . urlencode($lang);
            echo "<html><head><meta http-equiv=\"refresh\" content=\"0; URL={$url}\"></head></html>" . LB;
            exit;
        }
        $email = DB_getItem($_TABLES['users'], 'email', "uid = '2'");
        $site_url = unserialize(DB_getItem($_TABLES['conf_values'], 'value', "name = 'site_url'"));
        $to = $email;
        $subject = s(18);
        $message = sprintf('
            <html>
            <head>
              <title>' . s(19) . '</title>
            </head>
            <body>
              <p>' . s(20) . '</p>
              <p>' . s(21) . '</p>
            </body>
            </html>
            ', $passwd, $username, $site_url);
        $headers = 'MIME-Version: 1.0' . CRLB;
        $headers .= 'Content-type: text/html; charset=' . $LANG_CHARSET . CRLB;
        $headers .= 'X-Mailer: PHP/' . phpversion();
        if (mail($to, $subject, $message, $headers)) {
            $url = $self . '?view=options&amp;args=result:success|statusMessage:' . urlencode(s(22)) . '&amp;lang=' . urlencode($lang);
            echo "<html><head><meta http-equiv=\"refresh\" content=\"0; URL={$url}\"></head></html>\n";
            exit;
        } else {
            $url = $self . '?view=options&amp;args=result:error|statusMessage:' . urlencode(s(23) . $subject) . '&amp;lang=' . urlencode($lang);
            echo "<html><head><meta http-equiv=\"refresh\" content=\"0; URL={$url}\"></head></html>\n";
            exit;
        }

function requestAccount()
{
    // globals
    global $DB;
    global $MySelf;
    global $TIMEMARK;
    global $MB_EMAIL;
    // Generate random Password
    $PASSWORD = base64_encode(rand(111111111111.0, 999999999999.0));
    $PASSWORD_ENC = encryptPassword($PASSWORD);
    // Sanitize the input.
    $NEW_USER = strtolower(sanitize($_POST[username]));
    // supplied new username.
    // Lets prevent adding multiple users with the same name.
    if (userExists($NEW_USER)) {
        makeNotice("Your account was not created because there is already an account with the same username. Please pick another. " . "If you forgot your password, please use the password recovery link on the login page.", "error", "Account not created");
    }
    // So we have a username?
    if (strlen($_POST[username]) < 3) {
        makeNotice("Your username must be longer than 3 letters.", "error", "Invalid Username");
    }
    // Let me rephrase: Do we have a VALID username?
    if (!ctypeAlnum($_POST[username])) {
        makeNotice("Only characters a-z, A-Z, 0-9 and spaces are allowed as username.", "error", "Invalid Username");
    }
    // So we have an email address?
    if (empty($_POST[email])) {
        // We dont!
        makeNotice("You need to supply an email address!", "error", "Account not created");
    } else {
        // We do. Clean it.
        $NEW_EMAIL = sanitize($_POST[email]);
        // Valid one, too?
        if (!checkEmailAddress($NEW_EMAIL)) {
            makeNotice("You need to supply a valid email address!", "error", "Account not created");
        }
    }
    // Is it the very first account?
    $count = $DB->query("SELECT * FROM users");
    if ($count->numRows() == 0) {
        $temp = $DB->query("INSERT INTO `users` (`username`, `password`, `email`, `addedby`," . " `lastlogin`, `confirmed`, `emailvalid`, `emailcode`, `optIn`, `canLogin`," . " `canJoinRun`, `canCreateRun`, `canCloseRun`, `canDeleteRun`, `canAddHaul`," . " `canChangePwd`, `canChangeEmail`, `canChangeOre`, `canAddUser`, `canSeeUsers`," . " `canDeleteUser`, `canEditRank`, `canManageUser`, `canEditEvents`, `canDeleteEvents`," . " `canSeeEvents`, `isOfficial`, `isLottoOfficial`, `isAccountant`, `preferences`, `isAdmin`, `rank`) " . "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)", array(stripcslashes($NEW_USER), $PASSWORD_ENC, $NEW_EMAIL, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1));
        // Check for success, catch database errors.
        if (gettype($temp) != "DB_Error" && $DB->affectedRows() == 1) {
            // Success! New superuser created, send a confirmation email.
            $email = "Superuser information: Username " . stripcslashes($NEW_USER) . ", Password {$PASSWORD} - change this as soon as possible!";
            global $VERSION;
            $headers = "From:" . $MB_EMAIL;
            mail("{$NEW_EMAIL}", "Superuser login information (" . $VERSION . ")", $email, $headers);
            unset($email);
            // Inform the user.
            makeNotice("New Superuser created:<br>Username: " . stripcslashes($NEW_USER) . "<br>Password: {$PASSWORD}");
        } else {
            // Something went wrong!
            makeNotice("Failed creating the superuser!<br><br>" . $temp->getMessage(), "error", "Database Error!");
        }
    } else {
        // Lets avoid multiple accounts per email address!
        $otherAccsDS = $DB->query("SELECT COUNT(email) AS count FROM users WHERE email = '{$NEW_EMAIL}' ");
        $otherAccs = $otherAccsDS->fetchRow();
        if ($otherAccs[count] > 0) {
            makeNotice("There is already an account with your supplied eMail address. If you lost " . "your password please  use the password recovery feature.", "error", "Account not requested", "index.php", "[cancel]");
        }
        // Inser the new user into the database!
        $CODE = rand(111111111111.0, 9999999999999.0);
        $DB->query("insert into users (username, password, email, " . "addedby, emailcode) " . "values (?, ?, ?, ?, ?)", array(stripcslashes($NEW_USER), "{$PASSWORD_ENC}", "{$NEW_EMAIL}", $MySelf->getID(), "{$CODE}"));
        // Were we successful?
        if ($DB->affectedRows() == 0) {
            // No!
            makeNotice("Could not create user!", "error");
        } else {
            // Load more globals
            global $SITENAME;
            global $URL;
            global $VERSION;
            // Assemble the activation url.
            $ACTIVATE = $URL . "/index.php?action=activate&code={$CODE}";
            // Send a confirmation email
            $EMAIL = getTemplate("accountrequest", "email");
            $EMAIL = str_replace("{{IP}}", "{$_SERVER['REMOTE_ADDR']}", $EMAIL);
            $EMAIL = str_replace("{{URL}}", "{$URL}", $EMAIL);
            $EMAIL = str_replace("{{DATE}}", date("r", $TIMEMARK), $EMAIL);
            $EMAIL = str_replace("{{ACTIVATE}}", "{$ACTIVATE}", $EMAIL);
            $EMAIL = str_replace("{{CORP}}", "{$SITENAME}", $EMAIL);
            $to = $NEW_EMAIL;
            $DOMAIN = $_SERVER['HTTP_HOST'];
            $headers = "From:" . $MB_EMAIL;
            mail($to, $VERSION, $EMAIL, $headers);
            makeNotice("A confirmation email has been sent to your supplied email address.<br>Please follow the instructions therein.", "notice", "Account created");
        }
    }
}

function baseAccountAnswer(&$session, $user)
{
    global $account_user, $account_code, $account_code2, $account_email, $account_rights, $account_locked, $account_new, $account_change, $account_name, $account_other, $account_user2, $account_theme, $account_width, $account_height, $account_maxhits, $account_startpage, $account_startpageoffer;
    $session->trace(TC_Gui1, 'baseAccountAnswer');
    $message = '';
    $code = encryptPassword($session, $account_user, $account_code);
    $locked = dbSqlString($session, !empty($account_locked));
    if (!empty($account_startpageoffer)) {
        $account_startpage = $account_startpageoffer;
    }
    if (isset($account_new)) {
        if ($account_user2 == '') {
            $message = '+++ Kein Benutzername angegeben';
        } elseif (dbGetValueByClause($session, T_User, 'count(*)', 'name=' + dbSqlString($session, $account_user)) > 0) {
            $message = '+++ Name schon vorhanden: ' + $account_user2;
        } else {
            $uid = dbUserAdd($session, $account_user2, $code, $session->fUserRights, dbSqlString($session, false), $account_theme, $account_width, $account_height, $account_maxhits, $account_startpage, $account_email);
            modUserStoreData($session, true, $uid);
            $message = "Benutzer {$account_user2} wurde angelegt. ID: " . $uid;
        }
    } elseif (isset($account_change)) {
        if (!empty($account_code) && $account_code != $account_code2) {
            $message = '+++ Passwort stimmt mit Wiederholung nicht überein';
        } elseif (!($uid = dbUserId($session, $account_user)) || empty($uid)) {
            $message = '+++ unbekannter Benutzer: ' . $account_name;
        } elseif (($message = modUserCheckData($session, true, $uid)) != null) {
        } else {
            if (empty($account_theme)) {
                $account_theme = Theme_Standard;
            }
            $what = 'rights=' . dbSqlString($session, $account_rights) . ',locked=' . $locked . ',';
            if (!empty($account_code)) {
                $what .= 'code=' . dbSqlString($session, $code) . ",";
            }
            $what .= "theme={$account_theme},width={$account_width}," . 'height=' . (0 + $account_height) . ',maxhits=' . (0 + $account_maxhits) . ',startpage=' . dbSqlString($session, $account_startpage) . ',email=' . dbSqlString($session, $account_email) . ',';
            dbUpdate($session, T_User, $uid, $what);
            modUserStoreData($session, false, $uid);
            $message = 'Daten für ' . $account_user . ' (' . $uid . ') wurden geändert';
        }
    } elseif ($account_other) {
        if (empty($account_user2)) {
            $message = '+++ kein Benutzername angegeben';
        } elseif (!dbUserId($session, $account_user2)) {
            $message = '+++ Unbekannter Benutzer: ' . $account_user2;
        }
    } else {
        $message = 'keine Änderung';
    }
    baseAccount($session, $message);
}