public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status)
        {
            ValidatePasswordEventArgs args = new ValidatePasswordEventArgs(username, password, true);
            OnValidatingPassword(args);

            if (args.Cancel)
            {
                status = MembershipCreateStatus.InvalidPassword;
                return null;
            }

            if (RequiresUniqueEmail && GetUserNameByEmail(email) != "")
            {
                status = MembershipCreateStatus.DuplicateEmail;
                return null;
            }

            MembershipUser u = GetUser(username, false);
            if (u == null)
            {
                DBAuthRepository _user = new DBAuthRepository();
                _user.CreateUser(username, password, email);
                status = MembershipCreateStatus.Success;

                return GetUser(username, false);
            }
            else
            {
                status = MembershipCreateStatus.DuplicateUserName;
            }
            return null;
        }

        /// <summary>
        /// Processes a request to update the password for a membership user.
        /// </summary>
        /// <param name="username">The user to update the password for.</param>
        /// <param name="oldPassword">The current password for the specified user.</param>
        /// <param name="newPassword">The new password for the specified user.</param>
        /// <returns>
        /// true if the password was updated successfully; otherwise, false.
        /// </returns>
        /// <remarks>
        /// During installation the application will not be configured, if this is the case and the 'default' password 
        /// is stored in the database then we will validate the user - this will allow for an admin password reset if required
        /// </remarks>
        protected override bool PerformChangePassword(string username, string oldPassword, string newPassword)
        {


            if (ApplicationContext.Current.IsConfigured == false && oldPassword == "default"
                || ValidateUser(username, oldPassword))
            {
                var args = new ValidatePasswordEventArgs(username, newPassword, false);
                OnValidatingPassword(args);

                if (args.Cancel)
                {
                    if (args.FailureInformation != null)
                        throw args.FailureInformation;
                    throw new MembershipPasswordException("Change password canceled due to password validation failure.");
                }

                var user = new User(username);
                //encrypt/hash the new one
                string salt;
                var encodedPassword = EncryptOrHashNewPassword(newPassword, out salt);

                //Yes, it's true, this actually makes a db call to set the password
                user.Password = FormatPasswordForStorage(encodedPassword, salt);
                //call this just for fun.
                user.Save();

                return true;    
            }

            return false;

        }

        public MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status, string name, string surname, string telephone, string country)
        {
            var args = new ValidatePasswordEventArgs(username, password, true);
            OnValidatingPassword(args);

            if (args.Cancel)
            {
                status = MembershipCreateStatus.InvalidPassword;
                return null;
            }

            if (RequiresUniqueEmail && GetUserNameByEmail(email) != string.Empty)
            {
                status = MembershipCreateStatus.DuplicateEmail;
                return null;
            }

            var user = GetUser(username, true);

            if (user == null)
            {
                var userObj = new User { Username = username, Password = Assets.Encrypt(password), Email = email, Name = name, Surname = surname, Telephone = telephone };

                new UserDa(databasecontext).Add(userObj);

                status = MembershipCreateStatus.Success;

                return GetUser(username, true);
            }
            status = MembershipCreateStatus.DuplicateUserName;

            return null;
        }

        public override bool ChangePassword(string username, string oldPassword, string newPassword)
        {
            ParameterUtility.CheckParameter(ref username, true, true, true, 0x100, "username");
            ParameterUtility.CheckParameter(ref oldPassword, true, true, false, 0x80, "oldPassword");
            ParameterUtility.CheckParameter(ref newPassword, true, true, false, 0x80, "newPassword");

            if(!this.CheckPassword(username, oldPassword, false))
                return false;

            if(newPassword.Length < this.MinRequiredPasswordLength)
                throw new ArgumentException("Password is shorter than the minimum " + this.MinRequiredPasswordLength, "newPassword");

            int numNonAlphanumericCharacters = newPassword.Where((t, i) => !char.IsLetterOrDigit(newPassword, i)).Count();
            if(numNonAlphanumericCharacters < this.MinRequiredNonAlphanumericCharacters)
            {
                throw new ArgumentException(
                    SR.Password_need_more_non_alpha_numeric_chars_1.WithParameters(this.MinRequiredNonAlphanumericCharacters), "newPassword");
            }

            if(this.PasswordStrengthRegularExpression.Length > 0 && !Regex.IsMatch(newPassword, this.PasswordStrengthRegularExpression))
                throw new ArgumentException(SR.Password_does_not_match_regular_expression.WithParameters(), "newPassword");

            var e = new ValidatePasswordEventArgs(username, newPassword, false);
            this.OnValidatingPassword(e);
            if(e.Cancel)
            {
                if(e.FailureInformation != null)
                    throw e.FailureInformation;
                throw new ArgumentException(SR.Membership_Custom_Password_Validation_Failure.WithParameters(), "newPassword");
            }

            return this.ChangePasswordSafe(username, oldPassword, newPassword);
        }

 protected virtual void OnValidatingPassword(ValidatePasswordEventArgs e)
 {
     if (this._EventHandler != null)
     {
         this._EventHandler(this, e);
     }
 }

        public OnlineStoreMembershipUser CreateUser(string username,
           string password,
           string email,
           string passwordQuestion,
           string passwordAnswer,
           bool isApproved,
           object providerUserKey,
           string contact,
           string phoneNumber,
           AddressDto contactAddress,
           AddressDto deliveryAddress,
           out MembershipCreateStatus status)
        {
            var args = new ValidatePasswordEventArgs(username, password, true);
            OnValidatingPassword(args);
            if (args.Cancel)
            {
                status = MembershipCreateStatus.InvalidPassword;
                return null;
            }
            if (RequiresUniqueEmail && !string.IsNullOrEmpty(GetUserNameByEmail(email)))
            {
                status = MembershipCreateStatus.DuplicateEmail;
                return null;
            }
            var user = GetUser(username, true) as OnlineStoreMembershipUser;
            if (user == null)
            {
                using (var proxy = new UserServiceClient())
                {
                    List<UserDto> userDtos = new List<UserDto>
                    {
                        new UserDto
                        {
                            UserName = username,
                            Password = password,
                            Contact = contact,
                            LastLogonDate = null,
                            RegisteredDate = DateTime.Now,
                            Email = email,
                            IsDisabled = false,
                            PhoneNumber = phoneNumber,
                            ContactAddress = contactAddress,
                            DeliveryAddress = deliveryAddress
                        }
                    };

                    proxy.CreateUsers(userDtos.ToArray());
                }

                status = MembershipCreateStatus.Success;
                return GetUser(username, true) as OnlineStoreMembershipUser;
            }
            else
            {
                status = MembershipCreateStatus.DuplicateUserName;
                return null;
            }
        }

        public override bool ChangePassword(string email, string oldPwd, string newPwd)
        {
            if (!ValidateUser(email, oldPwd))
                return false;

            ValidatePasswordEventArgs args =
              new ValidatePasswordEventArgs(email, newPwd, true);

            OnValidatingPassword(args);

            var salt = GetSaltBytesByEmail(email);

            if (args.Cancel) {
                if (args.FailureInformation != null)
                    throw args.FailureInformation;
                else
                    throw new MembershipPasswordException("Change password canceled due to new password validation failure.");
            }

            if(salt == null) {
                throw new MembershipPasswordException(string.Format("Can not find salt by given email {0}.", email));
            }

            SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings[_connectionString].ConnectionString);
            SqlCommand cmd = new SqlCommand("UPDATE [dbo].[Users] " +
                    " SET HashedPassword = @HashedPassword, LastPasswordChangedAt = @LastPasswordChangedAt" +
                    " WHERE email = @Email", conn);

            cmd.Parameters.AddWithValue("@HashedPassword", EncodePassword(newPwd, salt));
            cmd.Parameters.AddWithValue("@LastPasswordChangedAt", DateTime.Now);
            cmd.Parameters.AddWithValue("@Email",  email);

            int rowsAffected = 0;

            try
            {
                conn.Open();

                rowsAffected = cmd.ExecuteNonQuery();
            }
            catch (SqlException e)
            {
                throw e;
            }
            finally
            {
                conn.Close();
            }

            if (rowsAffected > 0)
            {
                return true;
            }

            return false;
        }

        public override bool ChangePassword(string username, string oldPassword, string newPassword)
        {
            SecUtility.CheckParameter(ref username, true, true, true, 0x100, "username");
            SecUtility.CheckParameter(ref oldPassword, true, true, false, 0x80, "oldPassword");
            SecUtility.CheckParameter(ref newPassword, true, true, false, 0x80, "newPassword");

            if (!CheckPassword(username, oldPassword, false))
            {
                return false;
            }
            if (newPassword.Length < MinRequiredPasswordLength)
            {
                throw new ArgumentException("Password is shorter than the minimum " + MinRequiredPasswordLength,
                                            "newPassword");
            }
            int num3 = 0;
            for (int i = 0; i < newPassword.Length; i++)
            {
                if (!char.IsLetterOrDigit(newPassword, i))
                {
                    num3++;
                }
            }
            if (num3 < MinRequiredNonAlphanumericCharacters)
            {
                throw new ArgumentException(
                    SR.Password_need_more_non_alpha_numeric_chars_1.WithParameters(MinRequiredNonAlphanumericCharacters),
                    "newPassword");
            }
            if ((PasswordStrengthRegularExpression.Length > 0) &&
                !Regex.IsMatch(newPassword, PasswordStrengthRegularExpression))
            {
                throw new ArgumentException(SR.Password_does_not_match_regular_expression.WithParameters(),
                                            "newPassword");
            }
            var e = new ValidatePasswordEventArgs(username, newPassword, false);
            OnValidatingPassword(e);
            if (e.Cancel)
            {
                if (e.FailureInformation != null)
                {
                    throw e.FailureInformation;
                }
                throw new ArgumentException(SR.Membership_Custom_Password_Validation_Failure.WithParameters(),
                                            "newPassword");
            }

            return CheckedChangePassword(username, oldPassword, newPassword);
        }

        /// <summary>
        /// Adds a new membership user to the data source.
        /// </summary>
        /// <returns>
        /// A <see cref="T:System.Web.Security.MembershipUser"/> object populated with the information for the newly created user.
        /// </returns>
        /// <param name="username">The user name for the new user. </param><param name="password">The password for the new user. </param><param name="email">The e-mail address for the new user.</param><param name="passwordQuestion">The password question for the new user.</param><param name="passwordAnswer">The password answer for the new user</param><param name="isApproved">Whether or not the new user is approved to be validated.</param><param name="providerUserKey">The unique identifier from the membership data source for the user.</param><param name="status">A <see cref="T:System.Web.Security.MembershipCreateStatus"/> enumeration value indicating whether the user was created successfully.</param>
        public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status)
        {
            var args = new ValidatePasswordEventArgs(username, password, true);
            OnValidatingPassword(args);

            if (args.Cancel)
            {
                status = MembershipCreateStatus.InvalidPassword;
                return null;
            }

            var userRepository = InstanceFactory.CreateUserInstance();
            var user = userRepository.GetUserNameByEmail(email);
            var userName = (user != null && user.UserName != string.Empty) ? user.UserName : string.Empty;

            if (RequiresUniqueEmail && userName != string.Empty)
            {
                status = MembershipCreateStatus.DuplicateEmail;
                return null;
            }

            var duplicateUser = userRepository.GetUserObjByUserName(username);

            if (user != null && duplicateUser == null && user.UserName == string.Empty)
            {
                var randomCode = RandomStringGenerator.RandomString();

                var userObj = new UserEntity
                                  {
                                      UserID = user.UserID,
                                      UserDisplayName = user.UserDisplayName,
                                      UserName = username,
                                      UserCode = TripleDES.EncryptString(randomCode),
                                      Password = PasswordHelper.GenerateHashedPassword(password, randomCode),
                                      UserEmailAddress = email,
                                      UserActiveStatus = 1
                                  };

                userRepository.UpdateProfile(userObj);

                status = MembershipCreateStatus.Success;

                return GetUser(username, true);
            }
            status = MembershipCreateStatus.DuplicateUserName;

            return null;
        }

        public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion,
            string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status)
        {
            ValidatePasswordEventArgs args =
           new ValidatePasswordEventArgs(username, password, true);
            OnValidatingPassword(args);

            if (args.Cancel)
            {
                status = MembershipCreateStatus.InvalidPassword;
                return null;
            }

            if (RequiresUniqueEmail && !string.IsNullOrEmpty(GetUserNameByEmail(email)))
            {
                status = MembershipCreateStatus.DuplicateEmail;
                return null;
            }

            MembershipUser user = GetUser(username, true);

            if (user == null)
            {
                var userObj = new AppUser();
                userObj.Username = username;
                userObj.Password = GetMD5Hash(password);
                userObj.Email = email;
                userObj.DateCreated = DateTime.UtcNow;
                userObj.LastActivityDate = DateTime.UtcNow;

                entities.AppUsers.Add(userObj);
                entities.SaveChanges();

                status = MembershipCreateStatus.Success;

                return GetUser(username, true);
            }
            else
            {
                status = MembershipCreateStatus.DuplicateUserName;
            }

            return null;
        }

        private static void OnValidatePassword(object sender, ValidatePasswordEventArgs args)
        {
            // Cancel if the password is F0rb!dden
            if (args.Password == "F0rb!dden")
            {
                args.Cancel = true;
                args.FailureInformation = new MembershipPasswordException("The password 'F0rb!dden' is not allowed!");
            }

            // Regex validation or any other type of validation could be done here :)
            // An example regex implementation is commented out below:

            // System.Text.RegularExpressions.Regex r =
            //  new System.Text.RegularExpressions.Regex(...);

            // if (!r.IsMatch(args.Password))
            // {
            //     args.FailureInformation =
            //       new Exception(...);
            //     args.Cancel = true;
            // }
        }

 public bool ChangePassword(string username, string newPwd)
 {
     ValidatePasswordEventArgs args = new ValidatePasswordEventArgs(username, newPwd, true);
       OnValidatingPassword(args);
       if (args.Cancel)
     if (args.FailureInformation != null)
       throw args.FailureInformation;
     else
       throw new MembershipPasswordException("Change password cancelled due to an error during the validation of the password");
       bool result = false;
       try
       {
     var user = repository.GetUserByName(username, pApplicationName);
     if (user != null)
     {
       serviceBus.Send(new ChangeUserPassword(user.Id, EncodePassword(newPwd), DateTime.Now));
       result = true;
     }
       }
       catch (Exception e)
       {
     if (WriteExceptionsToEventLog)
       WriteToEventLog(e, "ChangePassword");
     throw;
       }
       return result;
 }

        /// <summary>
        /// This function is for creating a new user.
        /// </summary>
        /// <param name="username"></param>
        /// <param name="password"></param>
        /// <param name="email">Ignored</param>
        /// <param name="passwordQuestion">Ignored</param>
        /// <param name="passwordAnswer">Ignored</param>
        /// <param name="isApproved">Ignored</param>
        /// <param name="providerUserKey">Ignored</param>
        /// <param name="status">
        /// <para>
        /// Can return InvalidUserName, DuplicateUserName, InvalidPassword or Success
        /// </para>
        /// </param>
        /// <returns>User object when <paramref name="status"/> = Success; null otherwise. </returns>
        /// <remarks>
        /// <para>
        /// The user is always created with an expired password. The default profile is assigned to the user. CONNECT THROUGH rights are given to the proxy user.
        /// </para>
        /// <para>
        /// The logged in user must have the rights to crete User. Following is the script.
        /// </para>
        /// <code>
        /// <![CDATA[
        /// GRANT CREATE USER TO <user-name> 
        /// ]]>
        /// </code>
        /// </remarks>
        public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer,
            bool isApproved, object providerUserKey, out MembershipCreateStatus status)
        {
            if (string.IsNullOrWhiteSpace(username))
            {
                throw new ArgumentNullException("username");
            }
            if (string.IsNullOrWhiteSpace(password))
            {
                throw new ArgumentNullException("password");
            }
            var e = new ValidatePasswordEventArgs(username, password, true);
            OnValidatingPassword(e);
            if (e.Cancel)
            {
                // App decided to cancel user creation
                status = MembershipCreateStatus.InvalidPassword;
                return null;
            }

            if (HttpContext.Current == null || string.IsNullOrWhiteSpace(HttpContext.Current.User.Identity.Name))
            {
                throw new MembershipCreateUserException("You must be logged in with proper credentials to create a user");
            }

            EnsureDefaultProfile();
            //var builder = new OracleConnectionStringBuilder(_connectionString);

            using (var db = new OracleDatastore(HttpContext.Current.Trace))
            {
                db.CreateConnection(_connectionString, HttpContext.Current.User.Identity.Name);
                try
                {
                    var sqlQuery = string.Format("CREATE USER {0} IDENTIFIED BY \"{1}\" PROFILE {2} PASSWORD EXPIRE", username, password, _visibleProfiles[0]);
                    db.ExecuteNonQuery(sqlQuery, null);
                    foreach (var proxy in _proxyUsers)
                    {
                        sqlQuery = string.Format("ALTER USER {0} GRANT CONNECT THROUGH {1}", username, proxy);
                        db.ExecuteNonQuery(sqlQuery, null);
                    }
                    status = MembershipCreateStatus.Success;
                    // GetUser gets too much information, so we are using FindUserByName.
                    //return GetUser(username, false);
                    int totalRecords;
                    return FindUsersByName(username, 0, 100, out totalRecords).Cast<MembershipUser>().First();
                }
                catch (OracleDataStoreException ex)
                {
                    switch (ex.OracleErrorNumber)
                    {
                        case 1935:
                        //1935: missing user or role name (comes when passing null username). Not expected as we are already checking the passed user.
                        case 922:
                            //922: Missing or invalid option (comes when password contains special chars or whitespace)
                            throw new MembershipCreateUserException("User name or password is invalid", ex);

                        case 1031:
                            //1031: insufficient privileges
                            throw new MembershipCreateUserException("You do not have sufficient privileges for creating users.", ex);

                        case 1920:
                            //1920: user name 'user-name' conflicts with another user
                            throw new MembershipCreateUserException(string.Format("User {0} already exists", username));
                        case 28003:
                            // ORA-28003: password verification for the specified password failed
                            throw new MembershipCreateUserException(ex.Message, ex);

                        default:
                            throw;
                    }
                }
//.........这里部分代码省略.........

        /// <summary>
        /// The password change will succeed only if the old password is valid.
        /// </summary>
        /// <param name="username"></param>
        /// <param name="oldPassword"></param>
        /// <param name="newPassword"></param>
        /// <returns>true if password successfully changed. false if the old password is invalid</returns>
        /// <remarks>
        /// Any data base exception encountered will be propagated to the caller.
        /// Sharad 15 Feb 2012: Supported voluntary changes of passwords. Earlier only expired passwords could be changed.
        /// Sharad 21 Feb 2012: Raising ValidatingPassword event
        /// </remarks>
        public override bool ChangePassword(string username, string oldPassword, string newPassword)
        {
            if (string.IsNullOrWhiteSpace(username))
            {
                throw new ArgumentNullException("username");
            }
            if (string.IsNullOrWhiteSpace(oldPassword))
            {
                throw new ArgumentNullException("oldPassword");
            }
            if (string.IsNullOrWhiteSpace(newPassword))
            {
                throw new ArgumentNullException("newPassword");
            }
            var e = new ValidatePasswordEventArgs(username, newPassword, true);
            OnValidatingPassword(e);
            if (e.Cancel)
            {
                // App decided to cancel user creation
                return false;
            }
            var builder = new OracleConnectionStringBuilder(_connectionString)
                              {
                                  UserID = username,
                                  Password = oldPassword,
                                  Pooling = false,
                                  ProxyUserId = string.Empty,
                                  ProxyPassword = string.Empty
                              };
            // Try to login as passed user with old password to ensure that the old password is valid
            using (var db = new OracleDatastore(HttpContext.Current.Trace))
            {
                var msg = string.Format("Opening connection to {0} for user {1}",
                                          builder.DataSource, builder.UserID);
                Trace.WriteLine(msg, "OracleMembershipProvider");
                db.CreateConnection(builder.ConnectionString, builder.UserID);
                Trace.WriteLine(msg, "Opening connection with old password");
                try
                {
                    db.Connection.Open();
                }
                catch (OracleException ex)
                {
                    switch (ex.Number)
                    {
                        case 1017:
                            // Invalid user name password
                            Trace.TraceWarning("Invalid password specified for user {0}", username);
                            return false;

                        case 28001:
                            // If we are using ODP.NET, we can change the password now
                            // This will only work if the user's password has expired
                            Trace.WriteLine(msg, "Password expired error oracle exception encountered");
                            db.Connection.OpenWithNewPassword(newPassword);
                            return true;

                        default:
                            throw;
                    }
                }

                // If we get here, the old password was valid. Now we will change the password
                //REPLACE is used to remove exception ORA-28221
                Trace.WriteLine(msg, "Executing ALTER USER with new password");
                var query = string.Format("ALTER USER {0} IDENTIFIED BY \"{1}\" REPLACE \"{2}\"", username, newPassword, oldPassword);
                db.ExecuteNonQuery(query, null);

            }
            return true;
        }

        //////////////////////////////////////////////////////////////////////
        //////////////////////////////////////////////////////////////////////
        //////////////////////////////////////////////////////////////////////

        public override string ResetPassword( string username, string passwordAnswer )
        {
            if ( !EnablePasswordReset )
            {
                throw new NotSupportedException( SR.GetString(SR.Not_configured_to_support_password_resets)  );
            }

            SecUtility.CheckParameter( ref username, true, true, true, 256, "username" );

            string salt;
            int passwordFormat;
            string passwdFromDB;
            int status;
            int failedPasswordAttemptCount;
            int failedPasswordAnswerAttemptCount;
            bool isApproved;
            DateTime lastLoginDate, lastActivityDate;

            GetPasswordWithFormat(username, false, out status, out passwdFromDB, out passwordFormat, out salt, out failedPasswordAttemptCount,
                                  out failedPasswordAnswerAttemptCount, out isApproved, out lastLoginDate, out lastActivityDate);
            if (status != 0)
            {
                if (IsStatusDueToBadPassword(status))
                {
                    throw new MembershipPasswordException(GetExceptionText(status));
                }
                else
                {
                    throw new ProviderException(GetExceptionText(status));
                }
            }

            string encodedPasswordAnswer;
            if( passwordAnswer != null )
            {
                passwordAnswer = passwordAnswer.Trim();
            }
            if (!string.IsNullOrEmpty(passwordAnswer))
                encodedPasswordAnswer = EncodePassword(passwordAnswer.ToLower(CultureInfo.InvariantCulture), passwordFormat, salt);
            else
                encodedPasswordAnswer = passwordAnswer;
            SecUtility.CheckParameter(ref encodedPasswordAnswer, RequiresQuestionAndAnswer, RequiresQuestionAndAnswer, false, 128, "passwordAnswer");
            string newPassword  = GeneratePassword();

            ValidatePasswordEventArgs e = new ValidatePasswordEventArgs( username, newPassword, false );
            OnValidatingPassword( e );

            if( e.Cancel )
            {
                if( e.FailureInformation != null )
                {
                    throw e.FailureInformation;
                }
                else
                {
                    throw new ProviderException( SR.GetString(SR.Membership_Custom_Password_Validation_Failure)  );
                }
            }


            try
            {
                SqlConnectionHolder holder = null;
                try {
                    holder = SqlConnectionHelper.GetConnection( _sqlConnectionString, true );
                    CheckSchemaVersion( holder.Connection );

                    SqlCommand    cmd     = new SqlCommand("dbo.aspnet_Membership_ResetPassword", holder.Connection);
                    string        errText;

                    cmd.CommandTimeout = CommandTimeout;
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.Parameters.Add(CreateInputParam("@ApplicationName", SqlDbType.NVarChar, ApplicationName));
                    cmd.Parameters.Add(CreateInputParam("@UserName", SqlDbType.NVarChar, username));
                    cmd.Parameters.Add(CreateInputParam("@NewPassword", SqlDbType.NVarChar, EncodePassword(newPassword, (int) passwordFormat, salt)));
                    cmd.Parameters.Add(CreateInputParam("@MaxInvalidPasswordAttempts", SqlDbType.Int, MaxInvalidPasswordAttempts ) );
                    cmd.Parameters.Add(CreateInputParam("@PasswordAttemptWindow", SqlDbType.Int, PasswordAttemptWindow ) );
                    cmd.Parameters.Add(CreateInputParam("@PasswordSalt", SqlDbType.NVarChar, salt));
                    cmd.Parameters.Add(CreateInputParam("@PasswordFormat", SqlDbType.Int, (int)passwordFormat));
                    cmd.Parameters.Add(CreateInputParam("@CurrentTimeUtc", SqlDbType.DateTime, DateTime.UtcNow));
                    if (RequiresQuestionAndAnswer) {
                        cmd.Parameters.Add(CreateInputParam("@PasswordAnswer", SqlDbType.NVarChar, encodedPasswordAnswer));
                    }

                    SqlParameter p = new SqlParameter("@ReturnValue", SqlDbType.Int);
                    p.Direction = ParameterDirection.ReturnValue;
                    cmd.Parameters.Add(p);

                    cmd.ExecuteNonQuery();

                    status = ( ( p.Value != null ) ? ( ( int )p.Value ) : -1 );

                    if ( status != 0 )
                    {
                        errText = GetExceptionText( status );

//.........这里部分代码省略.........

        //////////////////////////////////////////////////////////////////////
        //////////////////////////////////////////////////////////////////////
        //////////////////////////////////////////////////////////////////////

        public override bool ChangePassword(string username, string oldPassword, string newPassword)
        {
            SecUtility.CheckParameter( ref username, true, true, true, 256, "username" );
            SecUtility.CheckParameter( ref oldPassword, true, true, false, 128, "oldPassword" );
            SecUtility.CheckParameter( ref newPassword, true, true, false, 128, "newPassword" );

            string salt = null;
            int passwordFormat;
            //string passwdFromDB;
            int status;
            //int failedPasswordAttemptCount;
            //int failedPasswordAnswerAttemptCount;
            //bool isApproved;

            if (!CheckPassword( username, oldPassword, false, false, out salt, out passwordFormat))
            {
               return false;
            }

            if( newPassword.Length < MinRequiredPasswordLength )
            {
                throw new ArgumentException(SR.GetString(SR.Password_too_short,
                              "newPassword",
                              MinRequiredPasswordLength.ToString(CultureInfo.InvariantCulture)));
            }

            int count = 0;

            for( int i = 0; i < newPassword.Length; i++ )
            {
                if( !char.IsLetterOrDigit( newPassword, i ) )
                {
                    count++;
                }
            }

            if( count < MinRequiredNonAlphanumericCharacters )
            {
                throw new ArgumentException(SR.GetString(SR.Password_need_more_non_alpha_numeric_chars,
                              "newPassword",
                              MinRequiredNonAlphanumericCharacters.ToString(CultureInfo.InvariantCulture)));
            }

            if( PasswordStrengthRegularExpression.Length > 0 )
            {
                if( !RegexUtil.IsMatch( newPassword, PasswordStrengthRegularExpression, RegexOptions.None, _passwordStrengthRegexTimeout ) )
                {
                    throw new ArgumentException(SR.GetString(SR.Password_does_not_match_regular_expression,
                                                             "newPassword"));
                }
            }

            string pass = EncodePassword(newPassword, (int)passwordFormat, salt);
            if ( pass.Length > 128 )
            {
                throw new ArgumentException(SR.GetString(SR.Membership_password_too_long), "newPassword");
            }

            ValidatePasswordEventArgs e = new ValidatePasswordEventArgs( username, newPassword, false );
            OnValidatingPassword( e );

            if( e.Cancel )
            {
                if( e.FailureInformation != null )
                {
                    throw e.FailureInformation;
                }
                else
                {
                    throw new ArgumentException( SR.GetString(SR.Membership_Custom_Password_Validation_Failure) , "newPassword");
                }
            }


            try {
                SqlConnectionHolder holder = null;
                try {
                    holder = SqlConnectionHelper.GetConnection( _sqlConnectionString, true );
                    CheckSchemaVersion( holder.Connection );

                    SqlCommand  cmd = new SqlCommand( "dbo.aspnet_Membership_SetPassword", holder.Connection );

                    cmd.CommandTimeout = CommandTimeout;
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.Parameters.Add(CreateInputParam("@ApplicationName", SqlDbType.NVarChar, ApplicationName));
                    cmd.Parameters.Add(CreateInputParam("@UserName", SqlDbType.NVarChar, username));
                    cmd.Parameters.Add(CreateInputParam("@NewPassword", SqlDbType.NVarChar, pass));
                    cmd.Parameters.Add(CreateInputParam("@PasswordSalt", SqlDbType.NVarChar, salt));
                    cmd.Parameters.Add(CreateInputParam("@PasswordFormat", SqlDbType.Int, passwordFormat));
                    cmd.Parameters.Add(CreateInputParam("@CurrentTimeUtc", SqlDbType.DateTime, DateTime.UtcNow));

                    SqlParameter p = new SqlParameter("@ReturnValue", SqlDbType.Int);
                    p.Direction = ParameterDirection.ReturnValue;
                    cmd.Parameters.Add(p);

                    cmd.ExecuteNonQuery();
//.........这里部分代码省略.........

//.........这里部分代码省略.........
            }

            if( password.Length < MinRequiredPasswordLength )
            {
                status = MembershipCreateStatus.InvalidPassword;
                return null;
            }

            int count = 0;

            for( int i = 0; i < password.Length; i++ )
            {
                if( !char.IsLetterOrDigit( password, i ) )
                {
                    count++;
                }
            }

            if( count < MinRequiredNonAlphanumericCharacters )
            {
                status = MembershipCreateStatus.InvalidPassword;
                return null;
            }

            if( PasswordStrengthRegularExpression.Length > 0 )
            {
                if( !RegexUtil.IsMatch( password, PasswordStrengthRegularExpression, RegexOptions.None, _passwordStrengthRegexTimeout ) )
                {
                    s