admSecurity.prg

<?php

/**
 * @package AdmUsrMaint.prg.v2 -- Contains all the code to save users through the administration screen and through security screens.
 * This replaces AdmUsrMaint.prg, AdmSecure.prg, AdmSetCfg.prg, AdmSettings.prg, AdmUsrRpt.prg, pwdRules.html
 */

$self = "$menu_link?ft=$ft";

$operation = trim($operation);
$showSQL = $SYSENV["devmode"];

$string = array("filter" => FILTER_SANITIZE_STRING);
$parameters = array("a" => array("tab" => "", "password" => "", "message" => "", "status" => "", "usernames" => ""));
HCU_ImportVars($parameters, "a", array("tab" => $string, "password" => $string, "message" => $string, "status" => $string,
    "usernames" => $string, "authval" => $string, "isSkip" => $string, "page" => $string));
extract($parameters["a"]);

$tab = isset($tab) ? trim($tab) : "";
$password = isset($password) ? trim($password) : "";
$message = isset($message) ? trim($message) : "";
$status = isset($status) ? trim($status) : "";
$usernames = isset($usernames) ? trim($usernames) : "";
$authval = isset($authval) ? trim($authval) : "";
$isSkip = isset($isSkip) ? trim($isSkip) == "Y" : false;
$page = isset($page) ? trim($page) : "";

define( "MUSTDOIT_FT", 31);

if ($operation != "")
{
    try
    {
        switch($operation)
        {
            case "readUserCombined":
                if ($ft == MUSTDOIT_FT)
                    $returnArray = readUserBasicSecurity($dbh, $Cu, $Cn, true);
                else
                    $returnArray = readUserCombinedSecurity($dbh, $Cu, $Cn);
                break;
            case "readUserSetup":
                $returnArray = readUserSetup($dbh, $Cu, $Cn);
                break;
            case "saveUserCombined":
                $is31 = $ft == MUSTDOIT_FT;
                $returnArray = saveUserCombinedSecurity($SYSENV, $dbh, $Cu, $Cn, $is31, $is31 && $isSkip);
                break;
            case "saveUserSetup":
                $returnArray = saveUserSetup($SYSENV, $dbh, $Cu, $Cn);
                break;
            default: $returnArray = array("sql" => array(), "error" => array("Operation not recognized: $operation."), "record" => array());
            break;
        }
    }
    catch(exception $e)
    {
        $returnArray = array("sql" => array(), "error" => array($e->getMessage()));
    }

    header('Content-type: application/json');
    if (!$showSQL)
        unset($returnArray["sql"]);
    print HCU_JsonEncode($returnArray);
}
else
{
    try
    {
        switch($ft)
        {
            case 29:
                if ($password == "")
                    printVerifyPassword($self, "");
                else if (!validatePassword($dbh, $password, $Cu, $Cn))
                    printVerifyPassword($self, "Password is invalid.");
                else
                    printSecurityCombined($self, $ft, $Cn, $Cu, trim($message));
                break;
            case 31:
                printSecurityCombined($self, $ft, $Cn, $Cu);
                break;
            case 35:
                printSecuritySetup($self, $Ffchg == "Y", $Cn, $Cu);
                break;
        }
    }
    catch(exception $e)
    {
        print $e->getMessage();
    }
}

/**
 * validatePassword($dbh, $password, $Cu, $Cn)
 * Validates that the password entered is the same as what is in the database.
 *
 * @param integer $dbh -- database connection
 * @param string $password -- entered password
 * @param string $Cu -- the credit union
 * @param string $Cn -- the logged in user
 *
 * @return true if password equals what is in the database, false otherwise.
 */
function validatePassword($dbh, $password, $Cu, $Cn)
{
    $sql = "select passwd from cuadminusers where user_name= '$Cn' and cu= '$Cu'";
    $sqls[] = $sql;
    $sth = db_query($sql, $dbh);
    if (!$sth)
    {
        return false;
    }

    $row = db_fetch_row($sth);
    $currentPassword = trim($row[0]);

    $password = trim($password);

    $comparison = password_verify($password, $currentPassword);
    return $comparison;
}

function readUserCombinedSecurity($dbh, $cuCode, $loggedInUser)
{
    $results = ReadUser($dbh, $cuCode, $loggedInUser, false, true, true, false, null);
    $results["record"] = $results["record"][0];
    return $results;
}

/**
 * function readUserBasicSecurity($dbh, $cuCode, $loggedInUser)
 * Read user from the first page in "change user security"
 *
 * @param integer $dbh -- the database connection
 * @param string $cuCode -- the credit union code
 * @param string $loggedInUser -- the logged in user
 *
 * @return ReadUser contents
 */
function readUserBasicSecurity($dbh, $cuCode, $loggedInUser)
{
    $results = ReadUser($dbh, $cuCode, $loggedInUser, false, false, false, false, null);
    $results["record"] = $results["record"][0];
    return $results;
}

/**
 * function readUserSetup($dbh, $cuCode, $loggedInUser)
 * Read user for the purpose of the page when user logs in without any challenge questions set.
 *
 * @param integer $dbh -- the database connection
 * @param string $cuCode -- the credit union code
 * @param string $loggedInUser -- the logged in user
 *
 * @return ReadUser contents
 */
function readUserSetup($dbh, $cuCode, $loggedInUser)
{
    $results = ReadUser($dbh, $cuCode, $loggedInUser, false, true, true, false, null);
    $returnArray = array("sql" => $results["sql"], "code" => $results["code"], "error" => $results["error"]);
    $record = $results["record"][0];
    $newRecord = array("confidence" => $record["confidence"], "mfaquest" => $record["mfaquest"], "mfaddl" => $record["mfaddl"], "pwdconfig" => $record["pwdconfig"],
        "email" => $record["email"], "forcechange"=>$record['booleanForceChange'], "forcesecurity"=>$record['booleanForceSecurity']);
    $returnArray["record"] = $newRecord;
    return $returnArray;
}

function saveUserCombinedSecurity($pSysEnv, $dbh, $Cu, $Cn, $is31=false, $isSkip=false)
{
    $string = array("filter" => FILTER_SANITIZE_STRING);
    $array = array("filter" => FILTER_DEFAULT);
    $parameters = array("a" => array("password" => "", "email" => "", "ipAddress" => "", "smsNumber" => "", "phoneProvider" => "", "oldPassword" => "", "remoteAccess" => "",
        "confidence" => "", "questIds" => "", "questResponses" => "", "usersms" => "", "providersms" => "", "ipAddress" => "", "masterIpAddress" => ""));

    HCU_ImportVars($parameters, "a", array("password" => $string, "email" => $string, "ipAddress" => $string, "smsNumber" => $string, "phoneProvider" => $string, "masterIpAddress" => $string,
        "oldPassword" => $string, "remoteAccess" => $string, "confidence" => $string, "questIds" => $array, "questResponses" => $array,
        "usersms" => $string, "providersms" => $string, "ipAddress" => $string));

    $parameters["a"]["emailAddress"] = $parameters["a"]["email"];
    unset($parameters["a"]["email"]);

    $parameters["a"]["phoneProvider"] = $parameters["a"]["providersms"];
    $parameters["a"]["smsNumber"] = $parameters["a"]["usersms"];
    unset($parameters["a"]["providersms"]);
    unset($parameters["a"]["usersms"]);

    $parameters["a"]["chksecure"] = "Y"; // It is implicit when forcing a password change because they have already been given the option to save login information.

    return saveUser($pSysEnv, $dbh, $Cu, $parameters["a"], $Cn, "combined", $is31, $isSkip);
}

/**
 * function saveUserSetup($dbh, $Cu, $Cn)
 * Saves an user from page that occurs when you log in without the challenge questions set up
 *
 * @param array $pSysEnv -- The System Environment variable from main
 *                            with the settings for this environment (production/development)
 * @param integer $dbh -- the database connection
 * @param string $Cu -- the credit union
 * @param string $Cn -- the logged in user
 *
 * @return saveUser contents
 */
function saveUserSetup($pSysEnv, $dbh, $Cu, $Cn)
{
    $Ffchg = HCU_array_key_value("Ffchg", $pSysEnv);
    $Ffchg = $Ffchg === false ? "" : trim($Ffchg);
    $parameters= array("a" => array("confidence" => "", "questIds" => "", "questResponses" => "", "password" => "", "emailAddress" => "", "oldPassword" => "", "chksecure" => "",
        "passwordRequired" => ""));

    $string = array("filter" => FILTER_SANITIZE_STRING);
    $array = array("filter" => FILTER_DEFAULT);
    HCU_ImportVars($parameters, "a", array("confidence" => $string, "questIds" => $array, "questResponses" => $array, "password" => $string,
        "emailAddress" => $string, "oldPassword" => $string, "chksecure" => $string, "passwordRequired" => $string));
    $parameters["a"]["forcechange"] = $Ffchg;

    return saveUser($pSysEnv, $dbh, $Cu, $parameters["a"], $Cn, "setup", true, false, $parameters["a"]["passwordRequired"] == "Y");
}

/**
 * function printValidateSMS()
 * This prints out the validation for phone numbers.
 */
function printValidateSMS()
{ ?>
    validatesms: function(input)
    {
        if (!input.is("[name='smsNumber']"))
            return true;
        if ($(input).val().trim() != "" && !$(input).val().match(/\([0-9]{3}\) [0-9]{3}-[0-9]{4}/))
        {
            $(input).attr("data-validatesms-msg", "Phone number is invalid.");
            return false;
        }
        return true;
    }
<?php }

/**
 * function printMatchOriginalPassword()
 * This prints out the validation that the password and the original password do not match.  The original password doesn't exist on the page.
 * Checking if the original password is correct is done totally on the server side so there is a case where this fires but the original password isn't correct.
 */
function printMatchOriginalPassword()
{ ?>
    matchoriginalpassword: function(input)
    {
        if (!input.is("[name='password']") || $(input).val().trim() == "")
            return true;
        if ($(input).val().trim() == $("[name='oldPassword']").val().trim())
        {
            $(input).attr("data-matchoriginalpassword-msg", "Password cannot be original password.");
            return false;
        }
        return true;
    }
<?php }

/**
 * function printInitRemoteAccess($isMaster)
 * Prints the logic to initialize the remote access controls.
 *
 * @param boolean $isMaster -- if true, then it is the master user.
 */
function printInitRemoteAccess($isMaster)
{ ?>
    function initRemoteAccess(record)
    {
        $("[name='remoteAccess']").click(function() {
            $(this).prop("checked") ? $(".remoteAccessDiv").show() : $(".remoteAccessDiv").hide();
        });

        var smsNumber= $("[name='notifySMS']").kendoMaskedTextBox({
            mask: "(000) 000-0000",
            clearPromptChar: true
        }).data("kendoMaskedTextBox");

    }
<?php }

/**
 * function printRemoteAccessTemplate($isMaster)
 * Prints the logic for remote access.
 *
 * @param boolean $isMaster -- if true, then it is the master user.
 */
function printRemoteAccessTemplate($isMaster)
{ ?>
    # if (booleanRemotePrivileges) { #
        <div class="row form-group hcuSpacer">
            <h4 class="h4 hcuSpacerx col-xs-12">Personal Remote Access</h4>
        </div>

        <div class="row hcuSecondary hcuSpacer"><div class="vsgSecondary col-xs-12">
            If accessing HomeCU Admin from an unknown IP address, you will be prompted for an access code the first time you access from that IP address.
            <br>You can get this access code through email and <i>optionally</i> through text message if your SMS information is set.
        </div></div>

            <?php loginPrintInputLine("Notify SMS", "#: smsNumber #", "notifySMS", 0, false, true, "text");
             ?>

    # } #
<?php }

/**
 * function printSecurityBasic($self)
 * Prints out the basic security page
 *
 * @param string $self -- url to this script
 */
function printSecurityCombined($self, $ft, $username="", $cu="")
{
    $isMaster = strtolower($cu) == strtolower($username);
    printCommonStyle(); ?>
    <style>
        <?php printTopCenterCss(450); ?>
    </style>
    <script type="text/javascript">
    //# sourceURL=admSecurity.js
    <?php // Library javascript functions
        getShowWaitFunctions(); ?>

    var challengeData = [];
    var challengeMap = {};
    var previousParameters = null;
    function init()
    {
        $.homecuValidator.setup({formValidate:'form', formStatusField: 'formValidateDiv', homecuCustomRules: {
            <?php printCheckip(); ?>,
            <?php printValidatePassword($ft == MUSTDOIT_FT); ?>,
            <?php printMatchPasswords(); ?>,
            <?php printValidateSMS(); ?>,
            <?php printMatchOriginalPassword(); ?>,
        }});

        <?php printInitPassword();
            printInitChallenge();
        ?>

        var parameters = {};
        <?php if ($ft == MUSTDOIT_FT) { ?>
            parameters.username= "<?php echo $username; ?>";
            parameters.cu= "<?php echo $cu; ?>";
        <?php } ?>
        showWaitWindow();
        $.post("<?php echo $self; ?>&operation=readUserCombined", parameters, function(data) {
            hideWaitWindow();
            if (data.error.length > 0)
                $.homecuValidator.displayMessage(data.error, $.homecuValidator.settings.statusError );
            else
            {
                $("[name='emailAddress']").val(data.record.email);

                <?php if ($ft != MUSTDOIT_FT) { ?>
                    if (data.record.booleanRemotePrivileges) {
                        var remoteTemplate= kendo.template($("#ratTemplate").html());
                        $(".remoteInsertion").html(remoteTemplate(data.record));
                        initRemoteAccess(data.record);
                    } else {
                        $(".remoteInsertion").remove();
                    }

                <?php printAfterReadChallenge(); }

                printAfterReadPassword(); ?>
                previousParameters= savePrevious(true);
            }
        });
        $("#statusSaveBtn,#skipBtn").click(function(e) {
            e.preventDefault();
            $("#formValidateDiv").hide();
            var isSkip = $(this).attr("id").trim() == "skipBtn";

            if (isSkip || $.homecuValidator.validate())
            {
                var saveParameters = {};

                if (!isSkip)
                {
                    var currentParameters = savePrevious(true);

                    for (var prop in currentParameters)
                    {
                        if (!currentParameters.hasOwnProperty(prop))
                            continue;

                        if (previousParameters[prop] === undefined || previousParameters[prop] != currentParameters[prop])
                            saveParameters[prop] = currentParameters[prop];
                    }

                    if (currentParameters.usersms != previousParameters.usersms || currentParameters.providersms != previousParameters.providersms) {
                        <?php // SMS and phone provider are together. ?>
                        saveParameters.usersms = currentParameters.usersms;
                        saveParameters.providersms = currentParameters.providersms == "" ? "NONE" : currentParameters.providersms;
                    }

                    if (saveParameters.questIds != null)
                        saveParameters.questResponses = currentParameters.questResponses;
                    else if (saveParameters.questResponses != null)
                        saveParameters.questIds = currentParameters.questIds;

                }

                saveParameters.username = "<?php echo $username; ?>";
                saveParameters.cu = "<?php echo $cu; ?>";
                saveParameters.isSkip = isSkip ? "Y" : "N";

                showWaitWindow();
                $.post("<?php echo $self; ?>&operation=saveUserCombined", saveParameters, function(data) {
                    hideWaitWindow();
                    <?php if ($ft == MUSTDOIT_FT) { ?>
                    if (data.error.length > 0)
                        $.homecuValidator.displayMessage(data.error, $.homecuValidator.settings.statusError );
                    else {
                        window.location.href= "<?php echo empty($_COOKIE['Tx_aURI']) ? $menu_link : urldecode($_COOKIE['Tx_aURI']); ?>";
                    }
                    <?php } else { ?>
                    $("#formSuccessDiv").hide();
                    $("#formSuccessDiv").empty();
                    if (data.error.length > 0)
                    {
                        $.homecuValidator.displayMessage(data.error, $.homecuValidator.settings.statusError );
                        restorePrevious();
                    }
                    else {
                        $.homecuValidator.displayMessage("Settings were saved successfully!", $.homecuValidator.settings.statusSuccess);
                        savePrevious(false);
                    }

                    $("[name='oldPassword']").val(null);
                    $("[name='password']").val(null);
                    $("[name='confirm']").val(null);

                    if ($("#deleteAllowedAccess").text().trim() == "Cancel Delete")
                        $("#allowedAccess").remove();

                    saveParameter = {};
                    <?php } ?>
                });
            }

            return false;
        });
    }

    <?php  if ($ft != MUSTDOIT_FT){ printUpdateDDLsChallenge(); printInitRemoteAccess($isMaster); }

    /**
     * function savePrevious()
     * This saves the values so that if the save fails, we can go back.
     */
    ?>
    function savePrevious(doStringify)
    {
        var parameters = {};
        <?php if ($ft != MUSTDOIT_FT) { printSavePreviousChallenge(); } ?>
        var smsControl = $("[name='notifySMS']").data("kendoMaskedTextBox");
        var ipControl = $("#ipAddressGrid").data("kendoGrid");

        parameters.usersms = smsControl == null ? null : smsControl.raw();
        parameters.remoteip = ipControl == null ? null : ipControl.dataSource.data().slice(0);

        parameters.email = $("[name='emailAddress']").val();

        parameters.oldPassword = $("[name='oldPassword']").val();
        parameters.password = $("[name='password']").val();

        if ($("#deleteAllowedAccess").text().trim() == "Cancel Delete")
            parameters.ipAddress = "NONE";


        if (doStringify)
        {
            <?php if ($ft != MUSTDOIT_FT) { ?>
            parameters.questIds = kendo.stringify(questIds);
            parameters.questResponses = kendo.stringify(questResponses);
            <?php } ?>
        }
        else
            $("#form").data("previousRecord", parameters);
        return parameters;
    }

    <?php
    /**
     * function restorePrevious()
     * On a failed save, this will revert the changes.
     */
    ?>
    function restorePrevious()
    {
        var previousRecord = $("#form").data("previousRecord");
        var smsControl = $("[name='smsNumber']").data("kendoMaskedTextBox");
        var ipControl = $("#ipAddressGrid").data("kendoGrid");

        if (smsControl != null)
            smsControl.value(previousRecord.usersms);
        if (ipControl != null)
            ipControl.dataSource.data(previousRecord.remoteip);
        if (providerControl != null)
            providerControl.value(previousRecord.providersms);

        $("[name='emailAddress']").val(previousRecord.email);
        <?php if ($ft != MUSTDOIT_FT) { printRestorePreviousChallenge(); } ?>
    }

    var activeWindows = [];
    $(document).ready(function(){
        init();
        <?php printClickOverlayEvent(); ?>
    });
    </script>
    <?php if ($ft != MUSTDOIT_FT) { ?>
    <script type="text/x-kendo-template" id="ratTemplate">
    <?php printRemoteAccessTemplate($isMaster); ?>
    </script>
<?php }
printShowHelpTemplate(); ?>

    <div class="container-fluid"><div>
    <form id="form" method="post" action="<?php echo $self; ?>" role="form" data-role="validator" novalidate="novalidate">

        <div class="col-xs-12">
            <div id="formValidateDiv" class="k-block k-error-colored formValidateDiv" style="display:none;"></div>
        </div>
            <div class="form-horizontal form-widgets">
                <?php if ($ft != MUSTDOIT_FT) { ?>
                <div class="well well-sm">
                    <?php printHeader("My Contact Info");
                    loginPrintInputLine("Email", "", "emailAddress", 50, true); ?>
                </div>
                <div class="remoteInsertion well well-sm"></div>
                <?php }
                printPasswordTemplate(); ?>
            </div>
            <?php if ($ft != MUSTDOIT_FT) { ?>
            <div class="form-horizontal form-widgets">
                <?php printChallengeTemplate(); ?>
            </div>
            <?php } ?>
          <div class="form-horizontal form-widgets">
            <?php $array= array(array("text" => "Save", "id" => "statusSaveBtn", "primary" => true));
                if ($ft == MUSTDOIT_FT)
                    $array[]= array("text" => "Skip", "id" => "skipBtn");
                printButtons($array);
            ?>
          </div>
        </form>
     </div></div>
<?php }

/**
 * function printAfterReadPassword()
 * I saw an opportunity to not copy four lines of code.  Used in the security basic and security setup screens.
 */
function printAfterReadPassword()
{ ?>

    $("#oldPassword").val(null);
    $("#password").val(null);
    $("#confirm").val(null);

    $.homecuValidator.passwordRules = data.record.pwdconfig;

    var pwdRequirements= [];

    <?php // set up the messages regarding what is being checked ?>
    var len = Number(data.record.pwdconfig.len);
    var upper = Number(data.record.pwdconfig.upper);
    var lower = Number(data.record.pwdconfig.lower);
    var letter = Number(data.record.pwdconfig.letter);
    var spec = Number(data.record.pwdconfig.spec);
    var digit = Number(data.record.pwdconfig.digit);

    if (len > 0) {
        var text= len + " Character" + (len > 1 ? "s" : "");
        pwdRequirements.push({which: "len", text: text});
    }

    if (upper > 0) {
        var text = upper + " UPPER case letter" + (upper > 1 ? "s" : "");
        pwdRequirements.push({which: "upper", text: text});
    }
    if (lower > 0) {
        var text = lower + " lower case letter" + (lower > 1 ? "s" : "");
        pwdRequirements.push({which: "lower", text: text});
    }
    if (letter > 0) {
        var text = letter + " Letter" + (letter > 1 ? "s" : "");
        pwdRequirements.push({which: "letter", text: text});
    }
    if (spec > 0) {
        var text = spec + " Special character" + (spec > 1 ? "s" : "");
        pwdRequirements.push({which: "spec", text: text});
    }
    if (digit > 0) {
        var text = digit + " Number" + (digit > 1 ? "s" : "");
        pwdRequirements.push({which: "digit", text: text});
    }

    var template= kendo.template($("#passwordRequirementTemplate").html());

    $(".passwordReqInsertion").html(template({pwdRequirements: pwdRequirements}));
<?php }

/**
 * function printInitPassword($alwaysRequired=false)
 * This prints out common initialization for the password.  Used in the security basic and security setup screens.
 *
 * @param boolean $alwaysRequired -- on the security setup, password is required.
 */
function printInitPassword($alwaysRequired=false)
{ ?>
     $("#showHelpLink").click(function() {
        var dialog = $("#showHelpDialog").data("kendoWindow");
        if (dialog == null)
        {
            dialog= $("<div id='showHelpDialog'></div>").appendTo("body").kendoWindow({
                content: {
                    template: kendo.template($("#showHelpTemplate").html())
                },
                modal: true,
                title: "Choosing a Safe Password",
                visible: false,
                resizable: false,
                width: 900,
                height: 550,
                close: function()
                {
                    $("#showHelpChk").prop("checked", true);
                    $("#showHelpChk").blur(); <?php // Force validation to clear ?>
                    activeWindows.pop();
                }
            }).data("kendoWindow");
        }

        dialog.open();
        activeWindows.push(dialog);
        return false;
    });

    <?php // Do it this way because it isn't initialized yet. ?>
    $("body").on("click", "#showHelpOk", function() {
        $("#showHelpDialog").data("kendoWindow").close();
        return false;
    });

    <?php // To mimic hcuProfileRequire, I need to validate on keyup to check the password requirements. ?>
    $("[name='password']").keyup(function() {
        $.homecuValidator.homecuKendoValidator.validateInput($(this));
    });
<?php }

/**
 * function printVerifyPassword($self, $message)
 * Prints out a simple page for entering the user's password again.  Needed before the advanced security page.
 *
 * @param string $self -- the url to this script
 * @param string $message -- the error message.  (empty for no error message.)
 */
function printVerifyPassword($self, $message)
{
    printCommonStyle();
    ?>
    <script type="text/javascript">
        function init()
        {
            $.homecuValidator.setup({formValidate:'form', formStatusField: 'formValidateDiv'});

            <?php if ($message !== null && trim($message) !== ""): ?>
            $.homecuValidator.displayMessage("<?php echo $message; ?>", $.homecuValidator.settings.statusError);
            <?php endif; ?>

            if ($("#formValidateDiv").text().trim() != "")
                $("#formValidateDiv").show();

            $("#continueBtn").click(function() {
                if ($.homecuValidator.validate())
                    $("#form").submit();
                return false;
            });
        }
        $(document).ready(function() {
            init();
        });
    </script>
    <div class="container-fluid"><div>
    <form id="form" method="post" action="<?php echo $self; ?>" role="form" data-role="validator" novalidate="novalidate">
        <div class="col-xs-12">
            <div id="formValidateDiv" class="k-block k-error-colored formValidateDiv"></div>
        </div>
          <div class="form-horizontal form-widgets">
            <?php loginPrintInputLine("Password", "", "password", 255, true, false, "password", "Password is required"); ?>
          </div>
          <div class="form-horizontal form-widgets">
            <?php printButtons(array(array("text" => "Continue", "id" => "continueBtn", "primary" => true))); ?>
          </div>
        </form>
     </div></div>
<?php }

/**
 * function printInitChallenge()
 * print out the initalization of the challenge questions
 */
function printInitChallenge()
{ ?>
    for(var i=1;i <= 3; i++)
    {
        $("#challengeQuestDDL"+i).kendoDropDownList({
            dataSource: {
                data: [],
                schema: {
                    model: {
                        id: "quest_id",
                        fields: {
                            quest_id: {type: "number"},
                            quest_text: {type: "string"},
                            example_text: {type: "string"}
                        }
                    }
                }
            },
            autoBind: true,
            dataTextField: "quest_text",
            dataValueField: "quest_id",
            change: function()
            {
                var dataItem= this.dataItem();
                var index= $(this.element).data("index");
                if (dataItem != null)
                {
                    if (Number(this.value()) != 0)
                    {
                        $("[name=challengeValidate"+index+"]").val(this.value());
                        $("#challengeExample"+index).text("E.g. " + dataItem.example_text);
                    }
                    else
                    {
                        $("[name=challengeValidate"+index+"]").val("");
                        $("#challengeExample"+index).html("&nbsp;"); <?php // Make sure that invalid thingy lines up ?>
                    }
                }
                else
                {
                    $("[name=challengeValidate"+index+"]").val("");
                    $("#challengeExample"+index).html("&nbsp;"); <?php // Make sure that invalid thingy lines up ?>
                }
                updateDDLs();
                $("[name=challengeValidate"+index+"]").blur(); <?php // Trigger validation ?>
            }
        }).data("kendoDropDownList");
    }
<?php }

/**
 * function printRestorePreviousChallenge()
 * prints out the contents of the restorePrevious function.  For the advanced security page, it is just this.  For the setup page, there is a little bit more code.
 */
function printRestorePreviousChallenge($fromAdmUser=false)
{ ?>
    $("[name='confidenceWord']").val(previousRecord.confidence);

    for(var i=0; i < 3; i++)
    {
        var index= i+1;
        $("#challengeQuestDDL"+index).data("kendoDropDownList").value(previousRecord.questIds[i]);
        $("[name=challengeResponse"+index+"]").val(previousRecord.questResponses[i]);
    }
    updateDDLs();
<?php }

/**
 * function printAfterReadChallenge()
 * prints out the code after a read for the challenge page.
 */
function printAfterReadChallenge($dontFillValues=false)
{
    if (!$dontFillValues) { ?>
    $("[name='confidenceWord']").val(data.record.confidence);
    <?php } ?>

    var thisData = data.record.mfaddl;
    thisData.splice(0,0, {quest_id: 0, quest_text: "", example_text: "", used: -1});
    challengeData = thisData;
    challengeMap[0] = 0;
    var length = data.record.mfaquest.length;
    for(var i=0; i < 3; i++)
    {
        var index = i+1;
        var ddl = $("#challengeQuestDDL"+index).data("kendoDropDownList");
        ddl.dataSource.data(challengeData);

        <?php if (!$dontFillValues) { ?>
        var thisRecord = data.record.mfaquest[i];
        if (thisRecord != null)
        {
            $("[name=challengeResponse"+index+"]").val(thisRecord.answer);
            $("[name=challengeValidate"+index+"]").val(thisRecord.quest_id);
            ddl.value(thisRecord.quest_id);
        }
        <?php } ?>
    }
    savePrevious(false);
    updateDDLs();
<?php }

/**
 * function printSavePreviousChallenge()
 * prints out the contents of the savePrevious function for the challenge page.
 */
function printSavePreviousChallenge($fromAdmUser=false)
{
    if (!$fromAdmUser) { ?>
    var parameters = {};
    <?php } ?>
    var questIds = [];
    var questResponses = [];
    $(".challengeValidate").each(function() {
        questIds.push(Number($(this).val()));
    });
    $(".challengeResponse").each(function() {
        questResponses.push($(this).val());
    });
    parameters.confidence = $("[name='confidenceWord']").val();
    parameters.questIds = questIds;
    parameters.questResponses = questResponses;
<?php }

/**
 * function printUpdateDDLsChallenge()
 * prints out the updateDDLs function which updates the data of each challenge question ddl to not contain the questions in the other challenge questions.
 */
function printUpdateDDLsChallenge()
{ ?>
    function updateDDLs()
    {
        var check= [];
        $(".challengeValidate").each(function() {
            check.push($(this).val());
        });
        for(var j=0; j < 3; j++)
        {
            var index= j+1;
            var thisCheck= check.slice(0);
            thisCheck.splice(j,1);

            $("#challengeQuestDDL"+index).data("kendoDropDownList").dataSource.data($.grep(challengeData, function(n,i) {
                return thisCheck.indexOf(n.quest_id) == -1;
            }));
        }
    }
<?php }

/**
 * function printSecuritySetup($self, $showPassword=false)
 * prints out the page for setting up security.  It is a hybrid of the security pages.  Thus there is a lot of additional functions to take advantage of shared functions versus copy and paste.
 *
 * @param string $self -- the url of this script
 * @param boolean $showPassword -- if $fChange is set, then the password part of the template will be included.  Otherwise, it will not be printed.
 */
function printSecuritySetup($self, $showPassword=false, $username, $cu)
{
    printCommonStyle(); ?>
    <style>
        .k-notification-wrap {
            white-space: normal !important;
        }

        .hcu-login-block {
            max-width: 307px;
        }
    </style>
    <script type="text/javascript">
        <?php // Library javascript functions
        getShowWaitFunctions(); ?>

        var challengeData = [];
        var challengeMap = {};
        var saveParameter = {};
        function init()
        {
            $("#login-entry").data("previousRecord", {});
            $.homecuValidator.setup({formValidate:'login-entry', formStatusField: 'formValidateDiv', homecuCustomRules: {
                <?php if ($showPassword) { printValidatePassword(true); ?>,
                <?php printMatchPasswords(); ?>,<?php } ?>
                <?php printValidateSMS(); ?>,
                <?php printMatchOriginalPassword(); ?>
            }});

            <?php printInitPassword(true); ?>
            <?php printInitChallenge(); ?>

            <?php loginPrintPublicNote(); ?>

            $("#submitBtn").click(function() {
                if ($.homecuValidator.validate())
                {
                    var parameters = savePrevious(true);
                    parameters.cu = "<?php echo $cu; ?>";
                    parameters.username = "<?php echo $username; ?>";
                    parameters.passwordRequired = "<?php echo $showPassword ? 'Y' : 'N';?>";

                    showWaitWindow();
                    $.post("<?php echo $self; ?>&operation=saveUserSetup", parameters, function(data) {
                        hideWaitWindow();
                        if (data.error.length > 0)
                        {
                            $.homecuValidator.displayMessage(data.error, $.homecuValidator.settings.statusError );
                            restorePrevious();
                        }
                        else
                            window.location.href= "<?php echo urldecode($_COOKIE['Tx_aURI']); ?>";

                        <?php if ($showPassword) { ?>$("[name='oldPassword']").val(null);
                        $("[name='password']").val(null);
                        $("[name='confirm']").val(null);<?php } ?>
                        saveParameter= {};
                    });
                }
                return false;
            });

            showWaitWindow();
            var parameters= {cu: "<?php echo $cu; ?>", username: "<?php echo $username; ?>"};
            $.post("<?php echo $self; ?>&operation=readUserSetup", parameters, function(data) {
                hideWaitWindow();
                if (data.error.length > 0)
                    $.homecuValidator.displayMessage(data.error, $.homecuValidator.settings.statusError );
                else
                {
                    <?php printAfterReadChallenge(true); ?>
                    <?php if ($showPassword)
                        printAfterReadPassword();
                    ?>
                    $("[name='email']").val(data.record.email);
                }
            });
        }

        <?php printUpdateDDLsChallenge(); ?>

        function restorePrevious()
        {
            var previousRecord = $("#login-entry").data("previousRecord");
            <?php printRestorePreviousChallenge(); ?>
            $("[name='email']").val(previousRecord.email);
            $("[name='confidenceWord']").val(previousRecord.confidence);

            <?php if ($showPassword) { ?>
            $("[name='oldPassword']").val(null);
            $("[name='password']").val(null);
            <?php } ?>
        }

        function savePrevious(doStringify)
        {
            var parameters = {};
            <?php printSavePreviousChallenge(); ?>
            parameters.emailAddress = $("[name='email']").val();
            parameters.chksecure = $("[name='chksecure']:checked").val();
            parameters.confidence = $("[name='confidenceWord']").val();

            <?php if ($showPassword) { ?>
            parameters.oldPassword = $("[name='oldPassword']").val();
            parameters.password = $("[name='password']").val();
            <?php } ?>

            if (doStringify)
            {
                parameters.questIds = kendo.stringify(questIds);
                parameters.questResponses = kendo.stringify(questResponses);
            }
            else
            {
                $("#login-entry").data("previousRecord", parameters);
            }
            return parameters;
        }

        $(document).ready(function() {
            init();
        });
    </script>
    <?php printShowHelpTemplate(); ?>

    <div class="container-fluid"><div>
    <form id="login-entry" method="post" role="form" data-role="validator" novalidate="novalidate">
        <div id="formValidateDiv" class="homecu-formStatus k-block k-error-colored formValidateDiv" style="display:none;"></div>
          <div class="well well-sm ">
            <div class="form-horizontal form-widgets">
            <?php if ($showPassword)
                printPasswordTemplate();
            printChallengeTemplate($showPassword);
            loginPrintInputLine("Please enter email", "", "email", 50, true, true, "text", "Email is required"); ?>
            </div>
          </div>
          <div class="form-horizontal form-widgets">
                <?php loginPrintButtons(false, false); ?>
          </div>
          <?php loginPrintSaveToken(); ?>
       </div>
    </form>
    </div></div>
<?php }

/**
 * function printPasswordTemplate()
 * prints out the shared password template in security basic and setup
 */
function printPasswordTemplate()
{ ?>
    <div class="well well-sm">
        <?php printPasswordRequirementTemplate ();
        printHeader("Password");
        ?>
        <div class="form-group hcuSpacer">
            <label class="col-xs-12 col-md-8">Please Read&nbsp;</label>
            <div class="col-xs-12 col-md-8">
                <a href="#" id="showHelpLink">The Recommended Password Guidelines</a> &nbsp;<input type="checkbox" id="showHelpChk" name='showHelp'>
            </div>
        </div>
        <div class="row form-group">
            <label class="col-xs-12 col-md-8">Original Password&nbsp;</label>
            <div class="col-xs-12 col-md-8">
                <input name="oldPassword" class="hcu-all-100 k-input k-textbox" type="password" maxlength="255">
            </div>
        </div>
        <div class="row form-group">
            <div class="col-xs-12 col-md-8">
                <div class="col-xs-12 col-md-6 hcu-no-padding">
                    <div class="col-xs-12 hcu-no-padding hcuSpacer">
                        <label class="col-xs-12 extendPasswordToFit">New Password&nbsp;</label>
                        <div class="col-xs-12 extendPasswordToFit">
                            <input name="password" class="hcu-all-100 k-input k-textbox matchPasswords" type="password" maxlength="255">
                        </div>
                    </div>

                    <div class="col-xs-12 hcu-no-padding hcuSpacer">
                        <label class="col-xs-12 extendPasswordToFit">Confirm&nbsp;</label>
                        <div class="col-xs-12 extendPasswordToFit">
                            <input name="confirm" class="hcu-all-100 k-input k-textbox matchPasswords" type="password" maxlength="255">
                        </div>
                    </div>
                </div>
                <div class="col-xs-12 col-md-6 passwordReqInsertion"></div>
            </div>
        </div>
    </div>
 <?php }

/**
 * function printChallengeTemplate($separator=false)
 * prints out the shared challenge question template in security advanced and setup
 *
 * @param boolean $separator -- if true, there is now hr on the top and bottom.
 */
function printChallengeTemplate($separator=false)
{ ?>
    <div class="well well-sm">
        <?php loginPrintInputLine("Confidence Word", "", "confidenceWord", 20, true, true, false, "Confidence Word is required");
        printHeader("Challenge Questions");

        for($i=0; $i < 3; $i++)
        {
            $plusOne= $i+1; ?>
        <input type="hidden" name="challengeValidate<?php echo $plusOne; ?>" class="challengeValidate" required data-required-msg="Challenge Question <?php echo $plusOne; ?> is required">
        <div class="form-group hcuSpacer">
            <label class="col-xs-12 col-md-8">Question <?php echo $plusOne; ?>&nbsp;</label>
            <div class="col-xs-12 col-md-8">
                <div id="challengeQuestDDL<?php echo $plusOne; ?>" data-index="<?php echo $plusOne; ?>" class="challengeQuestDDL hcu-all-100"></div>
            </div>
            <div class="col-xs-1 col-sm-1 col-lg-1">
              <span data-for='challengeValidate<?php echo $plusOne; ?>' class='k-invalid-msg'></span>
            </div>
        </div>
        <?php loginPrintInputLine("Response $plusOne", "", "challengeResponse$plusOne", 0, true, false, "text", "Challenge Response $plusOne is required", "challengeResponse");
        } ?>
    </div>
 <?php }

 /**
  * function printCommonStyle()
  * prints out styling common to a majority of the pages.
  */
 function printCommonStyle()
 { ?>
    <style>
        .grid_12 {
            margin-bottom: 5px;
        }

        /* Give same styling as if type="text" */
        input[type="email"], input[type="password"] {
            border-style: solid;
            border-width: 1px;
            font-family: inherit;
            font-size: 100%;
        }

        #showHelpDialog {
            text-align: left;
        }

        #login-entry {
            margin-left: auto;
            margin-right: auto;
        }

        .extendPasswordToFit {
            padding-left: 0;
        }

        @media (max-width: 991px) {
            .extendPasswordToFit {
                padding-right: 0;
            }
        }
    </style>
 <?php }

 /**
  * function printShowHelpTemplate()
  * prints out the template from pwdRules.html
  */
 function printShowHelpTemplate()
 { ?>
    <script type="text/x-kendo-template" id="showHelpTemplate">
        <p>In General, a password should be a long as possible, while still being EASY ENOUGH TO REMEMBER without writing it down.</p>
        <p>One way to do this is create a password based on an easy-to-remember phrase. For example, the phrase might be: "This Is One Way I Remember My Password"
        and the password could be: "Ti1wIrmp". </p>
        <p>Use a different password for every system:  Take the above example a step further and include the site name it in your password somehow:
        "This Is One Way I Remember My Internet Banking Password" and the result would be "Ti1wirmibp".  Take it a step further and include the number of letters in the site name
        somewhere in the password: (e.g. 4 for ebay, 8 for facebook, 6 for paypal, etc.)</p>
        <p><B>NOTE: Do not use examples given here as your password!</b></p>
        <p>The password <b>SHOULD NOT</b> be:
            <ul>
                <li>A derivative of the login account</li>
                <li>A word found in a dictionary (English or foreign)</li>
                <li>A dictionary word spelled backwards</li>
                <li>A dictionary word (forward or backwards) preceded and/or followed by any other single character (e.g., secret1, 1secret, secret?, secret!)</li>
                <li>A dictionary word (forward or backwards) using common numeric replacements for letters (e.g., 3 for e, 1 for the letter L, 9 for g, etc)</li>
                <li>A password easily guessed by a friend or family member:
                    <ul>
                        <li>Names of family, friends, pets, coworkers, etc.</li>
                        <li>Birthdays and other personal information such as addresses and phone numbers.</li>
                        </li>
                    </ul>
                <li>Word or number patterns like Abcd1234, qwerty, asdfjkl, 1233454321, etc.</li>
            </ul>
        </p>
        <p>For general password safety, you should:
            <ul>
                <li>Keep your password safe.  Never write it down, store it online, or email it.</li>
                <li>Change ALL your passwords any time you suspect any of your online accounts have been compromised or tampered with.</li>
                <li>Run current anti-virus, anti-spyware, anti-malware AND keep your computer operating system up-to-date.  </li>
                <li>Limit the amount of personal information you post on sites like twitter, myspace and facebook.
                All your followers and friends or others with access to the same list could easily use this information for hacking attempts.</li>
                <li>Be especially careful with your email password.  In fact, your email account should be the most protected account you have.  If a hacker has access to your email account,
                he can reset your password at ebay, paypal, amazon, etc.  Also, email (pop3, smtp, imap) should be run under SSL especially if you use public wifi.
                You should not use public wifi unless you are running a personal firewall on your computer.</li>
            </ul>
        </p>
        <p><a href="\\#" class="k-button" id="showHelpOk">Okay</a>
    </script>
 <?php }

/**
 * function printAdmUsrMaintLabelBlock($labelArray)
 * Prints out a label block
 *
 * @param array $labelArray -- the label block to display
 */
function printAdmUsrMaintLabelBlock($labelArray)
{ ?>
  <div class="row form-group col-xs-12"><div class="k-block col-xs-12">
    <?php foreach($labelArray as $label => $value) { ?>
      <div class="col-xs-12 col-sm-6 hcuSpacer">
        <label class="col-xs-12"><?php echo $label; ?>&nbsp;</label>
        <div class="col-xs-12 admIndent"><?php echo trim(str_replace('\\', '\\\\', $value)); ?></div>
      </div>
    <?php } ?>
  </div></div>
<?php }