hcuAppFeed.prg

<?php
# NOTE 10/09/12 exposed logic bug -- cu set as 2-factor, app passing in MFA answers, then cu set as legacy: appeared to work except that USERKEY was not returned in OFX output.  Some kind of wart related to getting MFA when not expected
# Automatic 1-Way OFX as described in OFX 2.1.1 Specification, Section 16
#
#
# APPID : Identifies partner.  Use OFXRQ for HomeCU app
# APPVER : required according to spec, not used at HomeCU.
# ORG : Client Code
#
# Script supports both SSO access and authenticated access methods.
# request will include either USERKEY (indicating SSO)
# or USERID/USERPASS (indicating authenticated access)
#
# USERID : cu:member
# USERPASS : password for authenticated account
# USERKEY : token for SSO access (replaces both USERID and USERPASS)
# CRED2 : Request date, UTC date/time in YYYYmmddHHMISS format
# CRED3 : hash # APPID USERID CRED2 hashed with assigned key
# DTSTART : Start date, default to 30days past
#           for Odyssey default to yesterday
# DTEND : End date, default to today
#
# NOTE 01/25/18 since AppFeed is specific to Apps we are going to remove need for
#           CRED2 and CRED3. Don't check at login, and the cookie check will validate
#           after authentication.
define( "MAX_PHONES", 5 );

// ** SET HOMECU FLAGS
    $serviceMinimal = true;
    $serviceShowInfo = false;
    $serviceLoadMenu = false;
    $serviceShowMenu = false;

  // ** INCLUDE MAIN GLOBAL SCRIPT -- Handles security / global variable values
  // hcuService will be returning a status object: e.g. ["homecuErrors":{[{"message":"message1"}...{"message":"messageN"}}]
  require_once(dirname(__FILE__) . '/../library/hcuService.i');
  require_once(dirname(__FILE__) . '/../../shared/library/cutrusted.i');
  require_once(dirname(__FILE__) . '/../../shared/library/hcuAppCommon.i');
  require_once(dirname(__FILE__) . '/../library/cu_credentials.i');
  require_once(dirname(__FILE__) . '/../../shared/library/cu_sms.i');
  require_once(dirname(__FILE__) . '/../library/permissions.i');
  require_once(dirname(__FILE__) . '/../library/hcuTransfer.i');
  require_once(dirname(__FILE__) . '/../library/hcuTransferScheduled.i');
  require_once('LogSSO.i');

  $inPost = array();
  $varOk = array(
    "APPID" => array('filter' => FILTER_SANITIZE_STRING),
    "DTSTART" => array('filter' => FILTER_SANITIZE_STRING),
    "DTEND" => array('filter' => FILTER_SANITIZE_STRING),
    "CRED2" => array('filter' => FILTER_SANITIZE_STRING),
    "CRED3" => array('filter' => FILTER_SANITIZE_STRING),
    "USERID" => array('filter' => FILTER_SANITIZE_STRING),
    "USERPASS" => array('filter' => FILTER_SANITIZE_STRING),
    "USERKEY" => array('filter' => FILTER_SANITIZE_STRING),
    "MFAKEY" => array('filter' => FILTER_SANITIZE_STRING),
    "DEVICE_COOKIE" => array('filter' => FILTER_SANITIZE_STRING),
    "MFABUNDLE" => array('filter' => FILTER_SANITIZE_STRING),
    "ORG" => array('filter' => FILTER_SANITIZE_STRING),
    "RQMODE" => array('filter' => FILTER_SANITIZE_STRING),
    "FACCTID" => array('filter' => FILTER_SANITIZE_STRING),
    "TACCTID" => array('filter' => FILTER_SANITIZE_STRING),
    "AMOUNT" => array('filter' => FILTER_SANITIZE_NUMBER_FLOAT, 'options' => array( "flags" => FILTER_FLAG_ALLOW_FRACTION ) ),
    "TRMEMO" => array('filter' => FILTER_SANITIZE_STRING),
    "PASSTO" => array('filter' => FILTER_SANITIZE_STRING),
    "PASSWITH" => array('filter' => FILTER_SANITIZE_STRING),
    "KEYACCTID" => array('filter' => FILTER_SANITIZE_STRING),
    "CFGFLAG" => array('filter' => FILTER_SANITIZE_STRING),
    "UPDAWARE" => array('filter' => FILTER_SANITIZE_NUMBER_INT),
    "USERMENU" => array('filter' => FILTER_SANITIZE_STRING),
    "SENDAS" => array('filter' => FILTER_SANITIZE_STRING),
    "AUTHMODE" => array('filter' => FILTER_SANITIZE_STRING),
    'MFA_' =>  'prefix_s',
    'MFS_' =>  'prefix_s'
  );
# CFGFLAG is to be used to capture the session flag settings as used in Fmsg_tx on the desktop.  Should be used
# currently in TXLIST / TXPOST to control whether or not to query the core for txaccount authority. Not implemented
# completely yet, but added to the Load_HB_ENV function and calls

HCU_ImportVars( $inPost, "", $varOk );
# apptokenkey used only at HCU, not shared.  Used to hash / check our token just to be sure it comes back unchanged.
$apptokenkey = 'Chahriv8pahvahsa';
$encoding='UTF-8';

// This is a global for holding the userkey because each new userkey builds off the old one.
// It is analagous to a cookie.
$gSavedUserkey = "";

try {
# FIX FOR PROD
# must be POST method
if ($_SERVER['REQUEST_METHOD'] != 'POST')
    throw new Exception('Unauthorized Method',2010);# post method required

function trim_item(&$item, $key) {
        $item = trim($item);
}

array_walk_recursive($inPost, 'trim_item');

//$inPost["APPID"] = trim( $inPost["APPID"] );
switch ($inPost['APPID']) {
    case "OFXRQ":
        # iPhone APP
        $client_source_override = 'APP';
        # no ip whitelist for iPhone app
        $appkey = "yuiQu8laLux7bahx";
        # require a minimum version to continue
        $appminver = 1;
        $appdataver = 1;
        break;

    case "OFXAA":
        # Android APP
        $client_source_override = 'ADA';
        # no ip whitelist for Android app
        $appkey = "Gai7Vain2pab5zae";

        # require a minimum version to continue
        $appminver = 1;
        $appdataver = 1;
        break;

    default:
        $HB_ENV['SYSENV']['logger']->info('request: ' . HCU_JsonEncode($_REQUEST));
        $HB_ENV['SYSENV']['logger']->info('inPost: ' . HCU_JsonEncode($inPost));
        throw new Exception("Unauthorized ID",2020); # invalid app id
}
# validate entries
# start date optional, must be valid if provided, default 30 days past
# end date optional, but must be valid if provided, default today
# either USERID/USERPASS or USERKEY is required
# USERID  HomeCU MEMBER for aggregated access
# USERPASS password for aggregated access
# USERKEY required if USERID/USERPASS not given; SSO security token
# CRED2 required, UTC date in YYYYMMDDHHMI format.
#   must be within 30 minutes of actual UTC time as shown on HomeCU servers
# CRED3 hash required, must match calculated hash
#
# As of 01/25/18 no longer requiring CRED2 or CRED3 to act more like the desktop client.

if ( empty($inPost['ORG']) ) {
    throw new Exception("Invalid Credentials",2030); # Missing values
}

$CU = $inPost['ORG'];
$SENDAS = (HCU_array_key_value('SENDAS',$inPost) && in_array(strtoupper($inPost['SENDAS']), array('JSON', 'XML')) ? $inPost['SENDAS'] : 'XML');

if (!empty($inPost['USERKEY'])) {
    # got USERKEY, validate SSO method
    $AUTHMODE = 'SSO';
    $HB_ENV['AuthMode'] = $AUTHMODE;

    # AuthMode=SSO w/Userkey

    // see if original userkey or the session ticket
    $apptokarr = array();
    parse_str(urldecode($inPost['USERKEY']), $apptokarr);

    // see if original UserKey
    if ( isset( $apptokarr["E"] ) && isset( $apptokarr["H"] ) ) {
        $keycheck = CheckUserkey($inPost['ORG'], $inPost['USERKEY'], $apptokenkey);

//      # if no C= value, assume oldstyle userkey
//      # and set member as A= value so hash works
//      # for odyssey A & C are swapped
//      # A is Uid, C is primary account
//      # Get_History call uses cauth as primary account

        # don't want to need this block -
        # if needed, return CAUTH, MEMBER, EXPIRES from CheckUserkey
//        if (is_null($apptokarr['C'])) {
//            $CAUTH = $apptokarr['A'];
//        } else {
//            $CAUTH = $apptokarr['C'];
//        }
        $MEMBER = $apptokarr['A'];

        if ($keycheck['Status']['Message'] !== 'Success') {
            throw new Exception($keycheck['Status']['Message'], $keycheck['Status']['Code']);
        }
    } else {
        $keycheck = CheckSessionUserkey( $HB_ENV, $inPost['USERKEY'] );

        if ($keycheck['Status']['Message'] !== 'Success') {
            throw new Exception($keycheck['Status']['Message'], $keycheck['Status']['Code']);
        }

        $MEMBER = $keycheck["data"]["Cn"];

        // save the userkey for future updates
        $gSavedUserkey = $inPost['USERKEY'];
    }

} else {
    # No USERKEY, default to aggregate AUTH method
    # for Odyssey, USERID will represent a user_name (login id) value
    $AUTHMODE = (empty($inPost['AUTHMODE']) ? "MFA" : $inPost['AUTHMODE']);
    $HB_ENV['AuthMode'] = $AUTHMODE;

//    if (empty($inPost['USERID']) || strlen(trim($inPost['USERPASS'])) < 4) {
    if ( empty(HCU_array_key_value('USERID',$inPost)) ) {
        throw new Exception("Invalid Credentials",2040); #MFQ missing ID
    }
    $MEMBER = $inPost['USERID'];
}

if (!empty($MEMBER) && (preg_match("/[\\\`,\"\s;]/", $MEMBER))) {
        throw new Exception("Invalid Credentials",2041); #Member Bad Characters
}

# set the basics so we can get the rest...
$HB_ENV['Cu'] = $inPost['ORG'];
$cu = $inPost['ORG'];
$SENDAS = (!empty($inPost['SENDAS']) && in_array(strtoupper($inPost['SENDAS']), array('JSON', 'XML')) ? $inPost['SENDAS'] : 'XML');

#replaced with call to LoadCuAdmin() in the top of hcuService.i
//    Check_HomeCU_Status($dbh, $HB_ENV);

$HB_ENV['platform'] = $client_source_override;
$CFGFLAG= HCU_array_key_value('CFGFLAG', $inPost);
/*
 * this line prints the HB_ENV array minus the MC dictionary
 *
 //       $HB_ENV["SYSENV"]["logger"]->info( "\n\n" . print_r(array_diff_key($HB_ENV,array('MC' => 'drop')),true) . "\n\n" );
 */

Load_HB_ENV($dbh, $inPost['ORG'], $MEMBER, $HB_ENV, $CFGFLAG);

if (HCU_array_key_exists('USERKEY', $inPost)) {
    Check_Member_Credentials($HB_ENV, $inPost['USERKEY']);
}

# set these things so they are available from the Global scope for
# throtlpkt functions
$MEMBER=$HB_ENV['Cn'];
$Cu = $HB_ENV['Cu'];
$Cn = $HB_ENV['Cn'];
$CAUTH = 0;
$Clw = $HB_ENV['livewait'];
$Ml = urldecode($HB_ENV['Ml']);

$HB_ENV['allowReadonly'] = true;
if (!hcu_checkOffline($dbh, $HB_ENV)) {
    throw new Exception($HB_ENV['offlineblurb'],15520); # CU is marked offline
    exit;
}
if (empty($HB_ENV['Cn'])) {
//    unset($HB_ENV['MC']);
//    $HB_ENV["SYSENV"]["logger"]->info("Result:\n" . print_r($HB_ENV,true) );

    throw new Exception('Authentication Failed',2003); # invalid Cn
}
if (empty($HB_ENV['Cu'])) {
    throw new Exception('Authentication Failed',2002); # invalid Cu
}

  // initialize this because it is only returned on some paths (i.e. right at sign-on)
  $appEncryptionKey = "";

// Now supporting setting credentials from app,
// so 'Last Chance Login' no longer applies
// leave block, as this might be how we present a billboard for outdated apps
//if ($inPost['UPDAWARE'] == 0 && ($HB_ENV['Ffchg'] == 'Y' || $HB_ENV['Ffreset'] > 0) && $HB_ENV['Ffremain'] == 1) {
//    throw new Exception('Member Last Chance Login - Please log in through the full Home Banking site to reset security credentials.',15503);
//}
  // With Pegaus the credential update / setting is going to be done with ProfileRequire. To make sure
  // a 3100 code is not returned, the apps should set UPDAWARE=2 for Login and MFA process.
if ($AUTHMODE !== "SSO") {
    # now that the HB_ENV array is filled, finish authentication if MFA

    # Why yes, this IS hitting the database a second time to read the same member
    # info we just got for Load_HB_ENV.  But by migrating this way and using same
    # functions as desktop to validate, in the future
    # we can use this instead and float closer to the desktop codeset

    $userrec = GetUserbyName($dbh, $inPost['ORG'], $MEMBER);

    if ( $userrec['lockedacct'] ) {
        throw new Exception('Account Locked', 15502); # locked
    }

    // at this point we can add more information to the HB_ENV environment
    // NOTE: this functionality mimics BankingVerifyCredentials
    $HB_ENV['Ce'] = time() + $HB_ENV['SYSENV']['ticket']['expires'];
    $HB_ENV['Clu'] = (empty($userrec['lastupdate']) ? $MC->msg("Unknown") : urlencode(trim($userrec['lastupdate'])));
    $HB_ENV['Fhdays'] = $userrec['fhdays'];

    // Set the session id.  This will be run only once.
    $HB_ENV["sid"] = strval(time());

    // Initialize the saved user cookie if it hasn't been set yet (now that HB_ENV is complete).
    if ( empty( $gSavedUserkey ) ) {
      $gSavedUserkey = BuildBaseSessionTicket( $HB_ENV );
    }

    switch ($HB_ENV['AuthMode']) {
        case 'MFA':
            // expect USERID, optionally tolerate USERPASS and (MFAKey or DEVICE_COOKIE)
            // DEVICE_COOKIE will be in the form name|content|expire
            #
            # CHECK USERID / USERPASS if given, even if MFAKEY is not given
            # IF EITHER ONE FAILS, SEND HARD FAIL
            #
            # USERID validated by userrec above

            if (HCU_array_key_exists('USERID', $inPost) && HCU_array_key_exists('USERPASS', $inPost)) {
                if ($userrec['rowfound'] == 0 ||
                    !password_verify($inPost['USERPASS'], $userrec['passwd']) ||
                    strlen(trim($inPost['USERPASS'])) < 4) {
                    //    unset($HB_ENV['MC']);
                    //    $HB_ENV["SYSENV"]["logger"]->info("inPost:\n" . print_r($inPost,true) . "\nUserrec:\n" . print_r($userrec,true) );

                    LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_PWD']);

                    # this should log password failure if rowfound == 1
                    throw new Exception('Invalid Username or Password', 15501); # userrec not found or passwd fails
                }

                // At this point the user is authenticated but the next check might cause a response to be return
                // instead of falling through.
            }
            # If no USERPASS or no MFAKEY  or invalid MFAKEY or Member forced to reset, send email prompt
            // NOTE: Currently (10/10/19) allowing an MFAKEY or a DEVICE_COOKIE
            $sendEmailResponse = true;
            if ( HCU_array_key_exists('USERPASS', $inPost) ||
                 $HB_ENV['Ffreset'] != GetUserFlagsValue('MEM_FORCE_RESET') ) {
                // we are just testing the existence of the USERPASS; the actual value is tested later

                // test the (newer) device cookie first
                if ( HCU_array_key_exists('DEVICE_COOKIE', $inPost) &&
                     IsValidAppDeviceCookie($HB_ENV["cu"], HCU_array_key_value('DEVICE_COOKIE', $inPost), $userrec) ) {
                    // all tests pass
                    $sendEmailResponse = false;
                } else if ( HCU_array_key_exists('MFAKEY', $inPost) &&
                            IsValidMFAKey(HCU_array_key_value('MFAKEY', $inPost), $userrec) ) {
                    // all tests pass
                    $sendEmailResponse = false;
                }
            }

            if ( $sendEmailResponse ) {
                # first step, ignore any previous bundle
                # build empty bundle with USERID,
                # add USERPASS and MFAKEY if given
                $mfaBundle = array('mode' => 'MFA', 'USERID' => $inPost['USERID']);
                if (HCU_array_key_exists('USERPASS', $inPost)) {
                    $mfaBundle['USERPASS'] = $inPost['USERPASS'];
                }
                if (HCU_array_key_exists('MFAKEY', $inPost) && $HB_ENV['Ffreset'] != GetUserFlagsValue('MEM_FORCE_RESET')) {
                    $mfaBundle['MFAKEY'] = $inPost['MFAKEY'];
                }
                $mfaBundle['BUILDTIME'] = time();
                $mfaBundle = createBundle($inPost['ORG'], $mfaBundle);
                if (empty($mfaBundle)) {
                    throw new Exception("Authentication Failed Building Credential Package", 15597); # bundle failed
                }
                $HB_ENV['mfaBundle'] = $mfaBundle;
                $reply_arr = EML_prompt($dbh, $HB_ENV);

                // this exits
                send_response( $reply_arr, $SENDAS );
            }
            break;
        case 'EML':
            # expect USERID, MFA_E (EMAIL)
            # validate Email
            $mfaBundle = HCU_array_key_value('MFABUNDLE', $inPost);
            if (empty($mfaBundle)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL']);
                throw new Exception("Authentication Failed Invalid Credential Package", 15599); # bundle failed
            }
            $mfaBundle = openBundle($inPost['ORG'], $mfaBundle);
            if (!checkBundle('EML', $mfaBundle, $inPost)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL']);
                throw new Exception("Authentication Failed Invalid Credential Package", 15599); # bundle failed
            }
            if (!checkBundle('TIME', $mfaBundle, $inPost)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL_TIMEOUT']);
                throw new Exception("Authentication Failed Login Process Took Too Long", 15595); # bundle expired
            }
            # isValidEmail checks for db empty and valid input but... somebody should save this....
            if (!HCU_array_key_value('MFA_E', $inPost) || !isValidEmail(HCU_array_key_value('MFA_E', $inPost), $userrec)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_EMAIL']);
                throw new Exception("Authentication Failed Invalid Email", 15506); # email
            } else {
                $inBundle = $mfaBundle; # might test password again, so save the incoming bundle before we recalculate it
                $mfaBundle['mode'] = 'EML';
                $mfaBundle['MFA_E'] = $inPost['MFA_E'];
                $mfaBundle['BUILDTIME'] = time();
                $mfaBundle = createBundle($inPost['ORG'], $mfaBundle);
                if (empty($mfaBundle)) {
                    throw new Exception("Authentication Failed Building Credential Package", 15597); # bundle failed
                }
                $HB_ENV['mfaBundle'] = $mfaBundle;
                # if sec reset, prompt for password, else send challenge
                if ($HB_ENV['Ffreset'] == GetUserFlagsValue('MEM_FORCE_RESET')) {
                    # if force security reset, skip the MFA steps.
                    # If we have a password and it is valid, fall through as logged in
                    if (!HCU_array_key_value('USERPASS', $inBundle) || !password_verify($inBundle['USERPASS'], $userrec['passwd']) ||
                        strlen(trim($inBundle['USERPASS']) < 4)) {
                        $reply_arr = PWD_prompt($dbh, $HB_ENV);
                        // this exits
                        send_response( $reply_arr, $SENDAS );
                    }
                } else {

                    if (intval($userrec['flagset3'] & GetFlagsetValue('CU3_MFA_AUTHCODE'))) {
                        # using secure access code
                        # send destination list
                        if (trim($userrec['email']) == '') {
                            $HB_ENV['MFA_E'] = $inPost['MFA_E'];
                        }
                        $reply_arr = SAC_destination($dbh, $HB_ENV, $userrec);
                    } else {
                        # using challenge questions
                        $reply_arr = MFQ_send_chall($dbh, $HB_ENV, $MC);
                    }

                    // this exits
                    send_response( $reply_arr, $SENDAS );
                }
            }
            break;
        case 'MFQ':
            # expect USERID, MFA responses as in current challenge questions
            # if valid MFA response check password (send password request?)
            $mfaBundle = HCU_array_key_value('MFABUNDLE', $inPost);
            if (empty($mfaBundle)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL']);
                throw new Exception("Authentication Failed Invalid Credential Package", 15599); # bundle failed
            }
            $mfaBundle = openBundle($inPost['ORG'], $mfaBundle);
            if (!checkBundle('MFQ', $mfaBundle, $inPost)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL']);
                throw new Exception("Authentication Failed Invalid Credential Package", 15599); # bundle failed
            }
            if (!checkBundle('TIME', $mfaBundle, $inPost)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL_TIMEOUT']);
                throw new Exception("Authentication Failed Login Process Took Too Long", 15595); # bundle expired
            }
            if (!(MFQ_defined($inPost) > 0)) {
                throw new Exception('Missing MFQ Parameters', 2040);
            } else {
                # MFQ_defined($inPost) > 0)
                # if (2-factor & not security reset) & MFA_* exists, we have MFA response, validate answers
                list($fail, $failreason) = MFQ_response($dbh, $HB_ENV, $inPost);
                if ($fail == 0) {
                    # challenge succeeded, ask for password
                    $mfaBundle['mode'] = 'MFQ';
                    $mfaBundle['haveMFQ'] = 'MFQ';
                    $mfaBundle['BUILDTIME'] = time();
                    $mfaBundle = createBundle($inPost['ORG'], $mfaBundle);
                    if (empty($mfaBundle)) {
                        throw new Exception("Authentication Failed Building Credential Package", 15597); # bundle failed
                    }
                    $HB_ENV['mfaBundle'] = $mfaBundle;
                    $reply_arr = PWD_prompt($dbh, $HB_ENV);
                    // this exits
                    send_response( $reply_arr, $SENDAS );
                } else {
                    LogFail($dbh, $HB_ENV, $inPost, $failreason, $GLOBALS['MEM_LOGIN_FAILED_QST']);
                    # should this be a fail instead?  W/new method,
                    # only get MFQ response if I asked for it
//                            $reply_arr = MFQ_send_chall($dbh, $HB_ENV, $MC);
                    throw new Exception("Authentication Failed Invalid Challenge", 15506); # email
                }
            }
            break;
        case 'MFS':
            # expect USERID, MFS_Deliver (destination for SAC)
            # if valid destination & email send SAC
            $mfaBundle = HCU_array_key_value('MFABUNDLE', $inPost);
            if (empty($mfaBundle)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL']);
                throw new Exception("Authentication Failed Invalid Credential Package", 15599); # bundle failed
            }
            $mfaBundle = openBundle($inPost['ORG'], $mfaBundle);
            if (!checkBundle('MFS', $mfaBundle, $inPost)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL']);
                throw new Exception("Authentication Failed Invalid Credential Package", 15599); # bundle failed
            }
            if (!checkBundle('TIME', $mfaBundle, $inPost)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL_TIMEOUT']);
                throw new Exception("Authentication Failed Login Process Took Too Long", 15595); # bundle expired
            }
            if (!HCU_array_key_exists('MFS_Deliver', $inPost)) {
                throw new Exception('Missing Parameter Delivery Method', 2040);
            }

            // * generate a new code
            # might need to get Cu & lookup length + ttl
            # but right now just use defaults 6 and 1200
            $authResp = generateAuthcode();
            if (!$authResp['authcode'] || !$authResp['authexpires']) {
                throw new Exception('Generate Access Code Failed', 3050);
            }
            if (!setAuthcode($dbh, $HB_ENV, $HB_ENV['MC'], $userrec, $authResp['authcode'], $authResp['authexpires'])) {
                throw new Exception('Save Access Code Failed', 3050);
            }
            $sendto = str_replace(array("-", "_", "."), array("+", "/", "="), $inPost['MFS_Deliver']);
            if (!sendAuthcode($HB_ENV['dbh'], $HB_ENV, $userrec, $sendto)) {
                throw new Exception('Send Access Code Failed', 3050);
            }
            $mfaBundle['mode'] = 'MFS';
            $mfaBundle['MFS_Deliver'] = $inPost['MFS_Deliver'];
            $mfaBundle['BUILDTIME'] = time();
            $mfaBundle = createBundle($inPost['ORG'], $mfaBundle);
            if (empty($mfaBundle)) {
                throw new Exception("Authentication Failed Building Credential Package", 15597); # bundle failed
            }
            $HB_ENV['mfaBundle'] = $mfaBundle;
            $reply_arr = SAC_prompt($dbh, $HB_ENV);
            // this exits
            send_response( $reply_arr, $SENDAS );
            break;
        case 'MFC':
            $mfaBundle = HCU_array_key_value('MFABUNDLE', $inPost);
            if (empty($mfaBundle)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL']);
                throw new Exception("Authentication Failed Invalid Credential Package", 15599); # bundle failed
            }
            $mfaBundle = openBundle($inPost['ORG'], $mfaBundle);
            if (!checkBundle('MFC', $mfaBundle, $inPost)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL']);
                throw new Exception("Authentication Failed Invalid Credential Package", 15599); # bundle failed
            }
            if (!checkBundle('TIME', $mfaBundle, $inPost)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL_TIMEOUT']);
                throw new Exception("Authentication Failed Login Process Took Too Long", 15595); # bundle expired
            }
            # expect USERID, SAC
            # if valid SAC check password (send password request?)
            if (!HCU_array_key_exists('MFS_Auth', $inPost)) {
                throw new Exception('Missing MFS Parameter', 2040);
            }
            if (!isValidAuthcode($userrec, $inPost['MFS_Auth'])) {
                throw new Exception('Invalid Access Code', 15507);
            }
            $mfaBundle['mode'] = 'MFC';
            $mfaBundle['haveSAC'] = 'SAC';
            $mfaBundle['BUILDTIME'] = time();
            $mfaBundle = createBundle($inPost['ORG'], $mfaBundle);
            if (empty($mfaBundle)) {
                throw new Exception("Authentication Failed Building Credential Package", 15597); # bundle failed
            }
            $HB_ENV['mfaBundle'] = $mfaBundle;
            $reply_arr = PWD_prompt($dbh, $HB_ENV);
            // this exits
            send_response( $reply_arr, $SENDAS );
            break;
        case 'MFP':
            $mfaBundle = HCU_array_key_value('MFABUNDLE', $inPost);
            if (empty($mfaBundle)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL']);
                throw new Exception("Authentication Failed Invalid Credential Package", 15599); # bundle failed
            }
            $mfaBundle = openBundle($inPost['ORG'], $mfaBundle);
            if (!checkBundle('MFP', $mfaBundle, $inPost)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL']);
                throw new Exception("Authentication Failed Invalid Credential Package", 15599); # bundle failed
            }
            if (!checkBundle('TIME', $mfaBundle, $inPost)) {
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_BNDL_TIMEOUT']);
                throw new Exception("Authentication Failed Login Process Took Too Long", 15595); # bundle expired
            }
            # expect USERID, USERPASS
            # if valid send MFAKEY, USERKEY, FULLFEED
            # check USERPASS as password
            if (strlen(trim($inPost['USERPASS'])) < 4 ||
                !password_verify($inPost['USERPASS'], $HB_ENV['password'])) {
                # password failed
                LogFail($dbh, $HB_ENV, $inPost, $GLOBALS['MEM_LOGIN_FAILED_PWD']);
                throw new Exception("Authentication Failed", 15505); # password
            }

            break;
        default:
            throw new Exception("Unknown authentication mode", 2999);
            break;
    }

    // If we get here the user is authenticated either with the initial password being verified, or after
    //  completing the MFA process; any intermediate step in the MFA process would have sent a response
    //  back before this point.

    # logged in - now what?
    LogPass($dbh,$HB_ENV);

    /*
     * Desktop updates userrec and adds audit trail using this code:
     * Consider similar?
     *
     *
     * ALL of this next block will probably go away to mimic desktop
     * Desktop no longer allows blank email, and the security reset
     * should eventually force user to review confidence word and
     * user contact phone numbers once the apps support that update set
     *
     * For now, clear the flags and assume having entered an accurate SAC
     * constitutes resetting security.
     *

            $updateEmail = (trim($userrec['email']) == '' && trim($mfaBundle['MFA_E']) > '');
            $updateSecRes = (intval($HB_ENV['flagset3'] & GetFlagsetValue('CU3_MFA_AUTHCODE')) > 0 && $HB_ENV['Ffreset'] == 2 );

            if ($updateSecRes || $updateEmail) {
              $updTable = array('user' => array(
                            array(
                              "_action" => "update",
                              "user_id" => $HB_ENV['Uid']
                            )
                          )
              );
              if ($updateSecRes) {
                // * CLEAR the MEM_FORCE_RESET bit in userflags
                $valueUserFlag = (int) HCU_array_key_value('userflags', $userrec);
                $valueUserFlag = ~(~$valueUserFlag | GetUserFlagsValue('MEM_FORCE_RESET'));
                $updTable['user'][0]['userflags'] = $valueUserFlag;
                $userrec['freset'] &= ~($GLOBALS['MEM_FORCE_RESET']); # shouldn't this be userrec['freset'] ?
                $HB_ENV['forceupdate'] &= ~((int) 16);
              }
              if ($updateEmail) {
                $HB_ENV['Ml'] = urlencode($mfaBundle['MFA_E']);
                $userrec['email'] = $mfaBundle['MFA_E'];
                $updTable['user'][0]['email'] = trim($mfaBundle['MFA_E']);
              }
              // * Update the records -- ONLY SAVE AUDIT RECORD IF UPDATING EMAIL
              $updateResults = DataUserTableUpdate($dbh, $HB_ENV, $HB_ENV['MC'], $updTable, $userrec['user_id'], 'U_UPD', $HB_ENV['platform'], $HB_ENV['currentscript'], 'U', ($updateSecRes ? "Force Mbr Update / " : "") . ($updateEmail ? "Set Email" : ""), $userrec['user_name'], $mfaBundle['MFA_E'], $HB_ENV['remoteIp'], !$updateEmail);
            }
            $HB_ENV['Ffreset'] = $userrec['freset'];
     */

    #
    # password ok, if Force pwd or verify mail, send upd request or fall thru to send data

    $sendkeys = array('MFAKEY' => MakeMFAKey( $HB_ENV ),
                      'TIMEOUT' => $HB_ENV['AppTimeout'],
                      'menu' => 'REPLACE MENU HERE',            // this is the menu from the appconfig and should be deprecated
                      );

    // if device asking to be remembered, return a device cookie (in parts)
    $pass = array();
    $postVar = array(
      "REMEMBER_DEVICE" => array('filter' => FILTER_SANITIZE_STRING)
    );

    HCU_ImportVars( $pass, "", $postVar );
    if ( strtolower(HCU_array_key_value("REMEMBER_DEVICE", $pass)) == "yes" ) {
        $mfaMode = (intval($userrec['flagset3'] & GetFlagsetValue('CU3_MFA_AUTHCODE')));
        $mfaDate = HCU_array_key_value("mfadate", $userrec);

        $persistsTime = $HB_ENV['SYSENV']['ticket']['persists'];

        $cookieParams = array ( "cu" => $HB_ENV['cu'],
                                "user_name" => $userrec['user_name'],
                                "saved_pass" => $userrec['passwd'],
                                "saved_email" => $userrec['email'],
                                "saved_confidence" => $userrec['confidence'],
                                "mfa_mode" => $mfaMode,
                                "mfa_date" => $mfaDate,
                                "persists_time" => $persistsTime
                              );

        $cookieInfo = CreateDeviceCookie( $cookieParams);

        $sendkeys["DEVICE_COOKIE"] = $cookieInfo["name"] . "|" . $cookieInfo["content"] . "|" . $cookieInfo["expire"];
    }

    # password ok & 2-factor, send upd request if security reset
    if ( $inPost["UPDAWARE"] == 1 ) {
        if ($HB_ENV['forceupdate'] > 0 && $HB_ENV['offline'] == 'N') {
            // return the information now

            // 3100 challenge response after login
            $reply_arr = Return_ReqUpdate($inPost['ORG'], $HB_ENV['Cn'], $HB_ENV['Uid'], $HB_ENV, $sendkeys);
            // this will exit the script
            send_response( $reply_arr, $SENDAS );
        }
    } else if ( $inPost["UPDAWARE"] == 2 ) {
        // check if need to return a cookie to help force user to ProfileRequire
        $l_MbrSettings = Check_Member_Settings($dbh, $HB_ENV, $HB_ENV['MC']);

        if ( $l_MbrSettings['code'] != '000' ) {
            $sendkeys["ENVINFO"] = BuildEnvironmentInfoCookie($HB_ENV, $inPost["UPDAWARE"]);
        }
    }

    // set an encryption key for app to use as needed (so not coded into app)
    $appEncryptionKey = GetPayloadEncryptionKey(32);

} // end if authmode != sso

// Initialize the saved user cookie if it hasn't been set yet (now that HB_ENV is complete).
if ( empty( $gSavedUserkey ) ) {
  $gSavedUserkey = BuildBaseSessionTicket( $HB_ENV );
}

apache_note('user_name', "{$inPost['ORG']}:{$HB_ENV['Uid']}");
//$apptoken = MakeUserkey($inPost['ORG'], $HB_ENV['Cn'], $HB_ENV['Uid']);
$apptoken = MakeSessionUserkey( $HB_ENV );
$dflt_date = date("Ymd", time() - (1 * 24 * 60 * 60)); # odyssey default start date is yesterday
$recent = date("Ymd", time() - (1 * 24 * 60 * 60));

$dflt_end = date("Ymd", time() + (4 * 24 * 60 * 60)); # + 4 days
$DTSTART = (empty($inPost['DTSTART']) ? "$dflt_date" : $inPost['DTSTART']);
$DTEND = (empty($inPost['DTEND']) ? "$dflt_end" : $inPost['DTEND']);
$sqlend = sqlmdy($DTEND);

$PASSWITH = HCU_array_key_value('PASSWITH', $inPost);

/*
 * for testing only - if passwith contains 'MYBAD', send an error
 */
$pass = array();
parse_str($PASSWITH, $pass);
if (array_key_exists('MYBAD', $pass)) {
    $mybad = HCU_array_key_value('MYBAD', $pass);
    $message = "Okey Dokey";

    throw new Exception( $message , $mybad );
}

switch (HCU_array_key_value('RQMODE', $inPost)) {
    case "CookieTest":
//        $myTicket = appTokenCookie($HB_ENV);
          $myTicket = MakeSessionUserkey( $HB_ENV );
//        parse_str($myTicket,$tick);
//        $HB_ENV["SYSENV"]["logger"]->info("Result:\n$myTicket" . print_r($tick,true) );
        $reply_arr = array('appToken' => urlencode($myTicket));
        break;
    case "PASSTHRU":
//        $mycookie = appTokenCookie($HB_ENV);

        $now = time();
        $expires = $now + $HB_ENV['SYSENV']['ticket']['expires'];

        $mycookie = "Ctime=$now&Cu={$HB_ENV['Cu']}&Cn={$HB_ENV['Cn']}&Uid={$HB_ENV['Uid']}&Ce=$expires&Ca=&Ffchg={$HB_ENV['Ffchg']}&Ffremain={$HB_ENV['Ffremain']}";
        $mycookie .= "&Fset={$HB_ENV['Fset']}&Fset2=${HB_ENV['Fset2']}&Fset3={$HB_ENV['Fset3']}&Fhdays={$HB_ENV['histdays']}&Flite=0&Clw={$HB_ENV['livewait']}&Clu={$HB_ENV['lastupdate']}";
        $mycookie .= "&Fplog={$HB_ENV['Fplog']}&Fflog={$HB_ENV['Fflog']}&Fmsg_tx={$HB_ENV['Fmsg_tx']}&Ml=" . urlencode(trim($HB_ENV['Ml'])) . "&Flang=$Flang&Ffreset={$HB_ENV['Ffreset']}";

        SetTicket($HB_ENV,"", $apptoken);

        $config = FeatureGateConfig::GetInstance($dbh);
        $logPassthroughTicket = new CreditUnionGate(CreditUnionGate::LOG_PASSTHROUGH_TICKET_FEATURE, $config);
        if ($logPassthroughTicket->WillPass($HB_ENV['Cu'])) {
            $HB_ENV['SYSENV']['logger']->info("[AppFeedPassthrough] appToken=$apptoken;Cn={$HB_ENV['Cn']}");
        }

        switch ($inPost['PASSTO']) {
            # seems extra, but this way we can change stuff at homecu
            # without having to recompile app.
            case "CKIMAGE":
                $PSCRIPT = $HB_ENV['homebankingpath'];
                $PSCRIPT .= "/ImageSOLO.prg";
                $PSCRIPT .= "?cu=${HB_ENV['Cu']}";
                break;
            case "EXTERNAL":
                $PSCRIPT = urldecode($PASSWITH);
                if (stripos($PSCRIPT, 'homecu') !== false) {
                    $delim = (strpos($PSCRIPT, '?') === false ? '?' : '&');
                    $PSCRIPT .= "{$delim}vanilla=1";
                }
                $PASSWITH = '';
                break;
            case "SSO":
                $PSCRIPT = $HB_ENV['homebankingpath'];
                $PSCRIPT .= "/hcuConnect.prg?cu=${HB_ENV['Cu']}&vanilla=1";
                $pass = array();
                parse_str($PASSWITH, $pass);
                foreach ($pass as $key => $value) {
                    if ($key == 'MBRACCT') {
                        if (!empty($value)) {
                            $encryptedAccount = hcu_encrypturl($value, $HB_ENV['historyHash']);
                            $PSCRIPT .= "&account=$encryptedAccount";
                        }
                    } else {
                        $PSCRIPT .= "&$key=$value";
                    }
                }
                    # empty out PASSWITH so it doesn't get added again below
                $PASSWITH = '';
                break;
            default:
                $PSCRIPT = $HB_ENV['homebankingpath'];
                $PSCRIPT .= "/{$inPost['PASSTO']}";
                $PSCRIPT .= "?cu=${HB_ENV['Cu']}";
        }
        if (!empty($PASSWITH))
            $PSCRIPT .= "&" . urldecode($PASSWITH);

        header("Location: $PSCRIPT");
        exit;

        break;
    case "ESTMT_PDF":
        # PERKEY is the period key for the desired statement
        # this could just parse PASSWITH into the environment, but I want to only take the parts I expect -
        $pass = array();
        parse_str($PASSWITH, $pass);
        $stId = $pass['PERKEY'];
        $pAcct = $pass['MBRACCT'];
        # if stId is blank or pAcct is blank throw error
        if (empty($stId) || empty($pAcct)) {
            throw new Exception("Missing eStatement parameters",4050); # ESTMT_PDF
        }

        # Create_PDF_Statement will be responsible for the output
        #ODYSSEY pass $pass['MBRACCT'] for this function
        $pdfinfo = Create_PDF_Statement($stId, $HB_ENV, $MC,$pAcct);

        // if no errors, then exit because Create_PDF_Statement handled the download
        if ( $pdfinfo["status"]["code"] == "0" ) {
          exit;
        } else {
          // if we got here there is an error so get it from the returned info
          $errorMessage = "";
          for ( $i = 0; $i < count( $pdfInfo["errors"] ); $i++ ) {
            if ( $errorMessage != "" ) {
                $errorMessage .= ";";
            }

            $errorMessage .= $pdfInfo["errors"];
          }

          throw new Exception("PDF Download Error: $errorMessage", 4051); # ESTMT_PDF
        }

        break;

    case "NOTICE":
        #$PASSWITH="NOTICE_TYPE=${TYPE}&NOTICE_ID=${ID}&NOTICE_ACTION=${ACTION}&NOTICE_RESP=${ANSWERID}";
        # TYPE indicates notice, survey, mktg message, promo etc
        # ID is the notice id previously sent or 0 if this is a 'get'
        # ACTION is P for post or V to view/get
        # ANSWERID (optional) is the chosen response for survey/mktg message
# this could just parse PASSWITH into HB_ENV['HCUPOST'], but I want to only take the parts I expect -
        $pass = array();
        parse_str($PASSWITH, $pass);

        switch ($pass['NOTICE_ACTION']) {
            case 'P':
                # action P post so set up the HCUPOST array
                if (!empty($pass['NOTICE_ID']))
                    $HB_ENV['HCUPOST']['notice_id'] = $pass['NOTICE_ID'];
                if (!empty($pass['NOTICE_TYPE']))
                    $HB_ENV['HCUPOST']['notice_type'] = $pass['NOTICE_TYPE'];

                $resp_arr = ANS_list($pass);
                $HB_ENV['HCUPOST']['notice_response'] = array();
                foreach ($resp_arr as $key => $value) {
                    #print "key $key value $value <br>";
                    $HB_ENV['HCUPOST']['notice_response'][] = $value;
                }

                $HB_ENV['HCUPOST']['notice_device'] = 'P';
                $HB_ENV['HCUPOST']['notice_msg_show'] = 1;

                $response = Update_NoticeInfo($dbh, $HB_ENV, $MC);
                $xmlResp = '';
                $reply_arr = array();
                # deal with response
                if (count($response['status']['errors']) > 0) {
                    throw new Exception(implode(" ",$response['status']['errors']),15530); # Update_NoticeInfo
                } else {
                    $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken );

                    $reply_arr['NOTICE'] = array();
                    if (HCU_array_item_count('notice_results', $response) > 0) {

                        foreach ($response['notice_results'] as $noticekey => $details) {
                            $reply_arr['NOTICE']['NOTICE_TYPE'] = $details['notice_type'];
                            $reply_arr['NOTICE']['NOTICE_ID'] = $details['notice_id'];
                            $reply_arr['NOTICE']['NOTICE_POPUP'] = $details['notice_popup'];
                            if ($pass['NOTICE_TYPE'] == 'N') {
                                $reply_arr['NOTICE']['NOTICE_DONOTSHOWTEXT'] = htmlentities($details['notice_donotshowtext'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                                $reply_arr['NOTICE']['NOTICE_LINKTARGET'] = $details['notice_linktarget'];
                                $reply_arr['NOTICE']['NOTICE_LINKDISPLAY'] = htmlentities($details['notice_linkdisplay'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                            }
                            $reply_arr['NOTICE']['NOTICE_INTRO'] = htmlentities($details['notice_intro'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                            $reply_arr['NOTICE']['NOTICE_TITLE'] = htmlentities($details['notice_title'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                            $reply_arr['NOTICE']['NOTICE_TEXT'] = htmlentities(CleanWordQuotes($details['notice_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                            $reply_arr['NOTICE']['NOTICE_ANSWERTYPE'] = $details['notice_answertype'];
                            $reply_arr['NOTICE']['NOTICE_ANSWERS'] = array();
                            if (count($details['notice_answers'])) {
                                foreach ($details['notice_answers'] as $anskey => $ansdetl) {
                                    $reply_arr['NOTICE']['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                    'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                    'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE),
                                    'ANSWER_VOTES' => "{$ansdetl['answer_votes']}",
                                    'ANSWER_PCT' => "{$ansdetl['answer_pct']}"));
                                }
                            }

                        }
                    }
                }

                break;

            case 'V':
            case 'G': # gather multiple promos plus one survey/message
                if ($pass['NOTICE_TYPE'] == 'N') {
                    # looks like the last two params are reversed?
                    $response = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', $pass['NOTICE_ID'], 0);
                } else {
                    $response = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', $pass['NOTICE_TYPE']);
                }

                if (count($response['status']['errors']) > 0) {
                    throw new Exception(implode(" ",$response['status']['errors']),15540); # Get_NoticeInfo
                } else {
                    $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken );

                    $reply_arr['NOTICE'] = array();
                    if (count($response['notice'])) {
                        foreach ($response['notice'] as $noticekey => $details) {
                            /*
                             * if no answer list but I have a donotshowtext, send that as an answer
                             */
                            if (!count($details['notice_answers']) && sizeof($details['notice_donotshowtext'])) {
                                $details['notice_answers'][] = array('answer_id' => $details['notice_id'], 'answer_text' => $details['notice_donotshowtext']);
                                $details['notice_answertype'] = 'M';
                            }
                            foreach ($details as $key => $value) {
                                $key = strtoupper($key);
                                switch ($key) {
                                    case "NOTICE_ANSWERS":
                                        $reply_arr['NOTICE']['NOTICE_ANSWERS'] = array();
                                        foreach ($value as $anskey => $ansdetl) {
                                            $reply_arr['NOTICE']['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                            'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                            'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE)));

                                        }
                                        break;
                                    case "NOTICE_TEXT":
                                        if ($pass['NOTICE_TYPE'] != 'N') {
                                            $reply_arr['NOTICE'][$key] = htmlentities(CleanWordQuotes($value), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                                        }
                                        break;
                                    /*
                                     * ignore these
                                     */
                                    case "NOTICE_DONOTSHOWTEXT":
                                    case "NOTICE_MSG_TX":
                                    case "NOTICE_MSG_TX_SHOW":
                                    case "NOTICE_MSG_TX_PERM":
                                    case "NOTICE_SUPPRESSRESPONSE":
                                    case "NOTICE_POSTTARGET":
                                        break;
                                    case "NOTICE_TYPE":
                                    case "NOTICE_ID":
                                    case "NOTICE_POPUP":
                                    case "NOTICE_ANSWERTYPE":
                                    case "NOTICE_LINKTARGET":
                                    case "NOTICE_LINKDISPLAY":
                                    case "NOTICE_INTRO":
                                    case "NOTICE_TITLE":
                                    default:

                                        $reply_arr['NOTICE'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                                }
                            }
                        }
                    }
                }

                break;

            default:
                # unknown notice_action -- ignore?
                throw new Exception("Unknown Notice Mode",15550);
        }

        break;

    case "TXLIST":
        # before we get started, check permissions
        $accessRights = Perm_AccessRights( $dbh, $HB_ENV, array( "feature" => FEATURE_TRANSFERS ) );
        if ( ! HCU_array_key_value('create', $accessRights)) {
            throw new Exception(  $HB_ENV['MC']->msg('Rights not set', HCU_DISPLAY_AS_HTML), 915 );
        }

        $HB_ENV['allowReadonly'] = false;
        if (!hcu_checkOffline($dbh, $HB_ENV)) {
          throw new Exception($HB_ENV['offlineblurb'], 15520); # TXLIST cu not online
        }

        # AppFeed will accept CFGFLAG from app, set it in HB_ENV so it passes to TX_list / TX_post
        # this was to maintain Fmsg_tx session flags w/o html session
        # but didn't want to limit to ONLY Fmsg_tx - might need others in future
        # coding ready for test in OFXRequest but not ready in server functions
        #if cfgflag came in from app, pass it along on TX_list / TX_post call
        # look for updated setting (of cfgflag? or of Fmsg_tx?) on return
        # pass updated setting to app so they can return it again?
        //        $HB_ENV['Fmsg_tx'] = ($HB_ENV['Fmsg_tx'] | $HB_ENV['cfgflag']);
        $txreturn = TX_list($dbh, $HB_ENV);

        if (HCU_array_key_exists("Fmsg_tx", $txreturn['status'])) {
          // ** ONLY update Fmsg_tx if it was updated by TX_list
          $HB_ENV['Fmsg_tx'] = $txreturn['status']['Fmsg_tx'];
        }
        $gSavedUserkey = BuildBaseSessionTicket($HB_ENV);
        $apptoken = MakeSessionUserkey($HB_ENV);

        if ( HCU_array_item_count("errors", $txreturn['status']) > 0 ) {
          throw new Exception(implode(' ', $txreturn['status']['errors']), 15560); # TX_list returns System Unavailable
        } else {
          $fc = 0;
          foreach ($txreturn['acctlist'] as $tx) {
            if ($tx['from'] == 'Y')
              $fc++;
          }

          # FIX FOR PROD - Error checking, anyone?
          # send appropriate status if we can't get a list

          if ($fc == 0) {
            throw new Exception("No Accounts Available", 15570); # TX_list no valid accounts
          } else {
            $reply_arr = array();
            $reply_arr = array('STATUS' => array('CODE' => 0, 'SEVERITY' => 'INFO'),
                'MEMBER' => $HB_ENV['Uid'],
                'USERKEY' => $apptoken,
                'TRMEMOMAX' => $HB_ENV['trmemomaxlen']);

            foreach ($txreturn['acctlist'] as $acctkey => $details) {
              $acct_arr = array();
              $acct_arr['ACCTID'] = $acctkey;
              foreach ($details as $key => $value) {
                $key = strtoupper($key);
                $val = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                $acct_arr[$key] = $val;
              }

              $reply_arr['TXLIST'][]['ACCT'] = $acct_arr;
            }

            # now get the transfer notice, if any
            $txnotice = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', 'transferNotice', 1);

            if (count($txnotice['notice'])) {
              foreach ($txnotice['notice'] as $noticekey => $details) {
                /*
                 * if no answer list but I have a donotshowtext, send that as an answer
                 */
                if (!count($details['notice_answers']) && sizeof($details['notice_donotshowtext'])) {
                  $details['notice_answers'][] = array('answer_id' => $details['notice_id'], 'answer_text' => $details['notice_donotshowtext']);
                  $details['notice_answertype'] = 'M';
                }

                foreach ($details as $key => $value) {
                  $key = strtoupper($key);
                  switch ($key) {
                    case "NOTICE_ANSWERS":
                      $reply_arr['TXLIST']['NOTICE']['NOTICE_ANSWERS'] = array();
                      foreach ($value as $anskey => $ansdetl) {
                        $reply_arr['TXLIST']['NOTICE']['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                    'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                    'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE)));
                      }
                      break;
                    /*
                     * ignore these
                     */
                    case "NOTICE_DONOTSHOWTEXT":
                    case "NOTICE_MSG_TX":
                    case "NOTICE_MSG_TX_SHOW":
                    case "NOTICE_MSG_TX_PERM":
                    case "NOTICE_SUPPRESSRESPONSE":
                    case "NOTICE_POSTTARGET":
                    case "NOTICE_TEXT":
                        break;
                    case "NOTICE_TYPE":
                    case "NOTICE_ID":
                    case "NOTICE_POPUP":
                    case "NOTICE_ANSWERTYPE":
                    case "NOTICE_LINKTARGET":
                    case "NOTICE_LINKDISPLAY":
                    case "NOTICE_INTRO":
                    case "NOTICE_TITLE":
                    default:

                        $reply_arr['TXLIST']['NOTICE'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                  } // end switch
                } // end foreach
              } // end foreach
            } // end if transfer notice

            $allowScheduled = (($HB_ENV['flagset2'] & $GLOBALS['CU2_PROCRECUR']) && PermCheckFeatureScreen($dbh, $HB_ENV, $MC, FEATURE_SCHEDULED_TRANSFERS, '', false));

            if ( $allowScheduled ) {
              $reply_arr["SCHEDULED"]["SCHEDALLOW"] = "yes";

              // get the transfer frequency "continue until" lists
              $transferFrequencyList = TxIntervalList($HB_ENV["MC"]);
              $transferContinueList = TxContinueList($HB_ENV["MC"]);

              // pass the lists to the apps
              if ( count( $transferFrequencyList ) > 0 ) {
                $freqList = array();
                for ( $i = 0; $i < count( $transferFrequencyList ); $i++ ) {
                  $freqList[]["FREQUENCY"] = array( "NAME" => $transferFrequencyList[$i]["value"],
                                                                            "VALUE" => $transferFrequencyList[$i]["text"] );
                }

                $reply_arr["SCHEDULED"]["FREQUENCIES"] = $freqList;
              }

              if ( count( $transferContinueList ) > 0 ) {
                $contList = array();
                for ( $i = 0; $i < count( $transferContinueList ); $i++ ) {
                  $contList[]["CONTINUE"] = array( "NAME" => $transferContinueList[$i]["value"],
                                                                         "VALUE" => $transferContinueList[$i]["text"] );
                }
                $reply_arr["SCHEDULED"]["CONTINUES"] = $contList;
              }

              // get the scheduled transfer terms, if any
              $aryScheduledTerms = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', 'rptTransferTerms');

              $reply_arr['SCHEDULED']['TERMS'] = array();
              if (count($aryScheduledTerms['notice'])) {
                foreach ($aryScheduledTerms['notice'] as $noticekey => $details) {
                  foreach ($details as $key => $value) {
                    $key = strtoupper($key);
                    switch ($key) {
                      case "NOTICE_ANSWERS":

                          $reply_arr['SCHEDULED']['TERMS']['NOTICE_ANSWERS'] = array();
                          foreach ($value as $anskey => $ansdetl) {
                              $reply_arr['SCHEDULED']['TERMS']['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                      'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                      'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE)));
                          }
                          break;
                      /*
                       * ignore these
                       */
                      case "NOTICE_INTRO":
                      case "NOTICE_TITLE":
                      case "NOTICE_DONOTSHOWTEXT":
                      case "NOTICE_MSG_TX":
                      case "NOTICE_MSG_TX_SHOW":
                      case "NOTICE_MSG_TX_PERM":
                      case "NOTICE_SUPPRESSRESPONSE":
                      case "NOTICE_POSTTARGET":
                      case "NOTICE_TEXT":
                          break;
                      case "NOTICE_TYPE":
                      case "NOTICE_ID":
                      case "NOTICE_POPUP":
                      case "NOTICE_ANSWERTYPE":
                      case "NOTICE_LINKTARGET":
                      case "NOTICE_LINKDISPLAY":
                      default:

                          $reply_arr['SCHEDULED']['TERMS'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    } // end switch
                  } // end foreach
                } // end foreach
              } // end if
            } // end if allow scheduled
          } // end else
        } // end else

        break;

    case "TXPOST":
        # before we get started, check permissions
        # but OdyTxPost function checks near the top.... so skip this one?
//        $accessRights = Perm_AccessRights( $dbh, $HB_ENV, array( "feature" => FEATURE_TRANSFER ) );
//        if ( ! HCU_array_key_value('create', $accessRights)) {
//            throw new Exception(  $HB_ENV['MC']->msg('Rights not set', HCU_DISPLAY_AS_HTML), 915 );
//        }

        $HB_ENV['allowReadonly'] = false;
        if (!hcu_checkOffline($dbh, $HB_ENV)) {
            throw new Exception($HB_ENV['offlineblurb'],15520); # TXPOST cu not online
            exit;
        }
        # unencode the email for the txpost call
//        $HB_ENV['Ml'] = urldecode($HB_ENV['Ml']);
# OFXRequest will accept CFGFLAG from app, set it in HB_ENV so it passes to TX_list / TX_post
# this was to maintain Fmsg_tx session flags w/o html session
# but didn't want to limit to ONLY Fmsg_tx - might need others in future
# coding ready for test in OFXRequest but not ready in server functions
#if cfgflag came in from app, pass it along on TX_list / TX_post call
# look for updated setting (of cfgflag? or of Fmsg_tx?) on return
# pass updated setting to app so they can return it again?
//        $HB_ENV['Fmsg_tx'] = ($HB_ENV['Fmsg_tx'] | $HB_ENV['cfgflag']);

//        $txreturn = TX_post($MC, $dbh, $HB_ENV, $inPost['FACCTID'], $inPost['TACCTID'], $inPost['AMOUNT'], $inPost['TRMEMO']);

        // gather the necessary input variables
        $pass = array();
        $postVar = array(
          "FACCTID" => array('filter' => FILTER_SANITIZE_STRING),
          "TACCTID" => array('filter' => FILTER_SANITIZE_STRING),
          "TXFREQ" => array('filter' => FILTER_SANITIZE_STRING),
          "TXSTART" => array('filter' => FILTER_SANITIZE_STRING),
          "TXCONTINUE" => array('filter' => FILTER_SANITIZE_STRING),
          "TXEND" => array('filter' => FILTER_SANITIZE_STRING),
          "AMOUNT" => array('filter' => FILTER_SANITIZE_STRING),
          "TRMEMO" => array('filter' => FILTER_SANITIZE_STRING)
        );

        HCU_ImportVars( $pass, "", $postVar );

        // test the frequency value for existence because that is a new value
        if ( HCU_array_key_exists( "TXFREQ", $pass ) ) {
          $txReturn = TxPostAdvanced( $HB_ENV, $dbh, $pass, $HB_ENV["MC"] );

          if ( HCU_array_item_count('errors',$txReturn['status']) > 0 ) {
              throw new Exception(implode(' ',$txReturn['status']['errors']),15580); # TX_post returns data validation errors
          }

          // here we are successful, so return information as given
          $reply_arr = array( 'STATUS' => array('CODE' => 0,'SEVERITY' => 'INFO'),
                              'DTSERVER' => date('YmdHis'),
                              'MEMBER' => $HB_ENV['Uid'],
                              'USERKEY' => $apptoken );

          // return all the txn info we got
          foreach ($txReturn['txn'] as $key => $value) {
              $key = strtoupper($key);
              $val = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
              $reply_arr['TXPOST'][$key] = $val;
          }

          if ( HCU_array_key_exists( "data_confirm", $txReturn["txn"] ) ) {
            // some apps still expecting this
            $reply_arr['TXPOST']["CONFIRMID"] = $txReturn["txn"]["data_confirm"];
          }
        } else {
          // call the original way and return info the original way
          $txreturn = OdyTxPost( $dbh, $HB_ENV, $pass, $HB_ENV['MC'] );

          if ( HCU_array_item_count('errors',$txreturn['status']) > 0 ) {
              throw new Exception(implode(' ',$txreturn['status']['errors']),15580); # TX_post returns data validation errors
          }

          // here we are successful, so return information as given
          $reply_arr = array( 'STATUS' => array('CODE' => 0,'SEVERITY' => 'INFO'),
                              'DTSERVER' => date('YmdHis'),
                              'MEMBER' => $HB_ENV['Uid'],
                              'USERKEY' => $apptoken );

          $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
              'DTSERVER' => date('YmdHis'),
              'MEMBER' => $HB_ENV['Uid'],
              'USERKEY' => $apptoken );

              foreach ($txreturn['txn'] as $key => $value) {
                  $key = strtoupper($key);
                  $val = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                  $reply_arr['TXPOST'][$key] = $val;
              }

          if ( HCU_array_key_exists( "data_confirm", $txreturn["txn"] ) ) {
            // some apps still expecting this
            $reply_arr['TXPOST']["CONFIRMID"] = $txreturn["txn"]["data_confirm"];
          }
        }

        break;

    case "MEMBERSETTINGS":
        #$PASSWITH contains
        // GETALLOWED=1 for Show Allowed Settings
        //      OR
        // GETSETTINGS=2 for Email
        // GETSETTINGS=4 for Challenge
        // GETSETTINGS=8 for UserAlias
        // GETSETTINGS=16 for Contact Phones (coming soon...)
        // GETSETTINGS values can be combined - 10 would get both email & alias
        #
        $pass = array();
        parse_str($PASSWITH, $pass);

        if (HCU_array_key_value('GETALLOWED',$pass) == '1') {
            $reply_arr = Return_AllowedUpdate($inPost['ORG'], $HB_ENV['Cn'], $HB_ENV['Uid'], $HB_ENV);
        } else {
            $HB_ENV['requpdate'] = ($pass['GETSETTINGS'] & $HB_ENV['allowupdate']); #limit acceptable values based on cu config
            if ($HB_ENV['requpdate'] == 0) {
                throw new Exception('Invalid Settings Request',3125); # unrecognized GETSETTINGS request or not configured
            } else {
                $reply_arr = Return_ReqUpdate($inPost['ORG'], $HB_ENV['Cn'], $HB_ENV['Uid'], $HB_ENV, array());
            }
        }
        break;
    case "CHECKALIAS":
        $pass = array();
        parse_str($PASSWITH, $pass);
        $upd_fields['settings_alias']['username'] = $pass['UALIAS'];
        $upd_fields['settings_alias']['username_confirm'] = $pass['UALIAS'];
        $upd_fields['settings_alias']['username_required'] = ($HB_ENV['alias'] == 'REQUIRE' ? 'Y' : 'N');
        $aryUpdate = Validate_Settings($dbh, $HB_ENV, $upd_fields, $MC);

        if ($aryUpdate['status']['code'] == '000') {
            $reply_arr = Return_ResponseOK($inPost['ORG'], $HB_ENV['Cn'], $HB_ENV['Uid'], 0, "OK Selected Alias is valid and available"); # Selected Alias is valid and available
        } else {
            throw new Exception(implode(' ',$aryUpdate['status']['errors']), 3162); # Selected Alias is not valid or usable
        }
        break;

    case "UPDCRED":
        #$PASSWITH contains name=value pairs for each credential to be updated
# this could just parse PASSWITH into HB_ENV['HCUPOST'], but I want to only take the parts I expect -
        $pass = array();
        parse_str($PASSWITH, $pass);
//$HB_ENV["SYSENV"]["logger"]->info(__LINE__ . " UPDCRED with  " . print_r($pass, true));

        if (HCU_array_key_value('ASKLATER',$pass) == 1) {
            if ($HB_ENV['forceupdate'] > 0 && $HB_ENV['Ffremain'] == 0) {
                throw new Exception('Requested Updates cannot be deferred',3150); # got 'ask later' response w/0 grace logins remaining
            } else {
                $sendkeys = array('USERKEY' => $apptoken,
                        'MFAKEY' => MakeMFAKey( $HB_ENV ),
                        'TIMEOUT' => $HB_ENV['AppTimeout'],
                        'menu' => 'REPLACE MENU HERE');   # after update settings
                $reply_arr = Return_ResponseOK($inPost['ORG'], $HB_ENV['Cn'], $HB_ENV['Uid'], $sendkeys, "OK Updates Deferred");
            }
        } else {
            # process updates
            # start out thinking we won't need a transaction
            $bolSQLTransaction = false;
            $upd_fields=array();

            if (($HB_ENV['allowupdate'] & 4) == 4) {
                # if challenge stuff allowed and provided, set fields to update,
                // CQID_*, CQANS_*, CONFWORD, CURPWD
                if (!empty($pass['CONFWORD'])) {
                    $upd_fields['settings_confidence']['confword'] = $pass['CONFWORD'];
                }
                // ** Challenge Questions / Responses
                // ** loop through the question, just assume they start at 1 and go to the number defined in HB_ENV['cu_chgqst_count']
                $quest_idx = 1;
                while (array_key_exists("CQID_{$quest_idx}", $pass)) {
                    $upd_fields['settings_questions'][] = Array('cqid' => $pass["CQID_{$quest_idx}"], 'display' => $pass["CQANS_{$quest_idx}"]);
                    $quest_idx++;
                }
                if (HCU_array_key_exists('userflags',$HB_ENV) && HCU_array_key_exists('settings_questions',$upd_fields) && ($HB_ENV['forceupdate'] & 4) == 4 ) {
                    // * have some userflags and got some questions, reset the MEM_FORCE_RESET flag

                    $tmpVal = (int) HCU_array_key_value('userflags', $HB_ENV);
                    // ** NEGATE the MEM_FORCE_RESET value
                    $tmpVal = ~(~$tmpVal | GetUserFlagsValue('MEM_FORCE_RESET'));

                    $upd_fields['settings_confidence']['userflags'] = $tmpVal;
//                    $HB_ENV["SYSENV"]["logger"]->info(__LINE__ . " update with  " . print_r($upd_fields,true));
                }

            }
            // if passwd stuff, set fields to update,
            // NEWPWD, CURPWD
            if (trim(HCU_array_key_value('NEWPWD',$pass)) > '') {
                $upd_fields['settings_password']['newpasswd'] = $pass['NEWPWD'];
                $upd_fields['settings_password']['confpasswd'] = $pass['NEWPWD'];
            }
            //      if no error, change pwchange date, clear Ffchange
            //
            // if email stuff, set fields to update,
            // EMAIL, OPTIN
            if (!empty(HCU_array_key_value('EMAIL',$pass))) {
                $upd_fields['settings_email']['email'] = $pass['EMAIL'];
                $upd_fields['settings_email']['egenl'] = $pass['OPTIN'];
                $upd_fields['settings_email']['verify'] = ($HB_ENV['Fverifyml'] == 512 ? 'Y' : 'N');
                $upd_fields['settings_email']['valid'] = 'Y';
            }
            //
            // if alias stuff allowed/required and provided, set fields to update
            // UALIAS, CURPWD
            if (($HB_ENV['allowupdate'] & 8) == 8 && (HCU_array_key_value('UALIAS',$pass)) != '') {
                $upd_fields['settings_alias']['username'] = $pass['UALIAS'];
                $upd_fields['settings_alias']['username_confirm'] = $pass['UALIAS'];
                $upd_fields['settings_alias']['username_required'] = ($HB_ENV['alias'] == 'REQUIRE' ? 'Y' : 'N');
                $bolSQLTransaction = true;
            }
            if (($HB_ENV['allowupdate'] & 16) == 16) {
                # if contact phones allowed and provided, set fields to update,
                // PHONE_*, CONFWORD, CURPWD
                if (!empty($pass['CONFWORD'])) {
                    $upd_fields['settings_confidence']['confword'] = $pass['CONFWORD'];
                }
                // ** Phone numbers
                //  ** posted in like this: PHONE=1112223333|1112223333|
                // update function expects the punctuation
                if (HCU_array_key_exists('PHONE',$pass)) {
                    $phones = explode('|',HCU_array_key_value('PHONE',$pass));
                    # empty array will save empty list (delete pre-existing)
                    $upd_fields['settings_phones']['mobile']=array();

                    # insert punctuation
                    $phidx=0;
                    foreach($phones as $phnum) {
                        if (!empty($phnum) && $phidx <= MAX_PHONES) {
                            $upd_fields['settings_phones']['mobile'][] = format_us_number($phnum);
                            $phidx++;
                        }
                    }
                    if (HCU_array_key_exists('userflags',$HB_ENV) && ($HB_ENV['forceupdate'] & 16) == 16 ) {
                        // * have some userflags and got some phones, reset the MEM_FORCE_RESET flag
                        $tmpVal = (int) HCU_array_key_value('userflags', $HB_ENV);
                        // ** NEGATE the MEM_FORCE_RESET value
                        $tmpVal = ~(~$tmpVal | GetUserFlagsValue('MEM_FORCE_RESET'));
                        $upd_fields['settings_confidence']['userflags'] = $tmpVal;
                    }
                }
            }
            //
# start
            if (trim(HCU_array_key_value('NEWPWD',$pass)) > '') {
                $aryUpdate = Validate_PwdRules($dbh, $HB_ENV, $upd_fields, $MC);

                if ($aryUpdate['status']['code'] != '000') {
                    // return validation errors
                    throw new Exception(implode(' ',$aryUpdate['status']['errors']),3160); # Validate_Settings
                }
            }
            if (!count($upd_fields)) {
                throw new Exception('Nothing found to update',3165); # UPDCRED found nothing to update
            }
            // ** $upd_fields contains the list of fields to update --
            $aryUpdate = Validate_Settings($dbh, $HB_ENV, $upd_fields, $MC);

            if ($aryUpdate['status']['code'] != '000') {
                // return validation errors
                throw new Exception(implode(' ',$aryUpdate['status']['errors']),3160); # Validate_Settings
                #print_r($HB_ENV); print_r($upd_fields); exit;
            } else {
                if (isset($upd_fields['settings_phones']['mobile']) && ($HB_ENV['flagset3'] & GetFlagsetValue('CU3_MFA_AUTHCODE')) ) {
                  // since the security phone number are part of a different table
                  // we must update them separately from the Update_User_Settings function.
                  // only update if we have some phone numbers and the mfa secure access code flag is set
                  $aryUpdate = Update_User_Security($dbh, $HB_ENV, $HB_ENV['MC'], $upd_fields);
                  if ($aryUpdate['status']['code'] != '000') {
                    throw new Exception(implode(' ',$aryUpdate['status']['errors']),3172); # Update_User_Security
                  }
                }
                // ** UPDATE DATA
                $aryUpdate = Update_User_Settings($dbh, $HB_ENV, $MC, $upd_fields, $bolSQLTransaction);

                if ($aryUpdate['status']['code'] != '000') {
                    // return update errors
                    throw new Exception(implode(' ',$aryUpdate['status']['errors']),3170); # Update_Settings
                } else {
                    // * SUCCESSFUL
                    // update HB_ENV and the userrec before building keys
                    $MEMBER = (HCU_array_key_value('UALIAS',$pass) ? HCU_array_key_value('UALIAS',$pass) : $MEMBER);
                    Load_HB_ENV($dbh, $CU, $MEMBER, $HB_ENV, $CFGFLAG=0);
                    $userrec = GetUserbyName($dbh, $inPost['ORG'], $MEMBER);

                    $HB_ENV['Ce'] = time() + $HB_ENV['SYSENV']['ticket']['expires'];
                    $HB_ENV['Clu'] = (empty($userrec['lastupdate']) ? $MC->msg("Unknown") : urlencode(trim($userrec['lastupdate'])));
                    $HB_ENV['Fhdays'] = $userrec['fhdays'];

                    // re-build the cookie with the values that changed
                    $gSavedUserkey = BuildBaseSessionTicket( $HB_ENV );

                    // return 'OK' status
                    $apptoken = MakeSessionUserkey( $HB_ENV );
                    $sendkeys = array('USERKEY' => $apptoken,
                        'MFAKEY' => MakeMFAKey( $HB_ENV ),
                        'TIMEOUT' => $HB_ENV['AppTimeout'],
                        'menu' => 'REPLACE MENU HERE');   # after update settings
                    $reply_arr = Return_ResponseOK($inPost['ORG'], $HB_ENV['Cn'], $HB_ENV['Uid'], $sendkeys, "OK Updates Successful");
                }
            }

# end
        }
        break;
    case "MOBLPAY":
        # before we get started, check permissions
        $accessRights = Perm_AccessRights( $dbh, $HB_ENV, array( "feature" => FEATURE_MOBILE_BILLPAY ) );
        if ( ! HCU_array_key_value('access', $accessRights)) {
            throw new Exception(  $HB_ENV['MC']->msg('Rights not set', HCU_DISPLAY_AS_HTML), 915 );
        }

        $parms = array();
        $parms['Cu'] = $HB_ENV['Cu'];
        $parms['Cn'] = $HB_ENV['Cn'];
        $parms['Uid'] = $HB_ENV['Uid'];

        $pass = array();
        parse_str($PASSWITH, $pass);
        if (!isset($pass['MP_VENDOR']) || !isset($pass['MBRACCT'])) {
            throw new Exception("Missing Mobile Pay parameters",4001);
        }
        switch ($pass['MP_VENDOR']) {
            case 'IPAYMBL':
            case 'IPAYAPP':
            case 'IPAYTEST':
            case 'IPAYBPS':
                if (hcu_checkService($dbh, 'IPAY') !== true) {
                    $omsg = hcu_checkServiceMsg($dbh, "IPAY");
                    throw new Exception("$omsg",999); # MOBLPAY AUTH
                }
                if ($pass['MP_VENDOR'] == 'IPAYBPS') {
                    require_once(dirname(__FILE__) . '/../library/bpCommon.i'); # HCU functions common to all BILL Pay vendors
                    require_once(dirname(__FILE__) . '/../library/IPAYBPS.i');
                } else {
                    require_once(dirname(__FILE__) . '/../library/IPAYMBL.i');
                }
                break;
            case 'CHKFREE':
                if (hcu_checkService($dbh, 'CHKFREE') !== true) {
                    $omsg = hcu_checkServiceMsg($dbh, "CHKFREE");
                    throw new Exception("$omsg",999); # MOBLPAY AUTH
                }
                require_once(dirname(__FILE__) . '/../library/CHKFREE.i');
                break;
            case 'PSCUPAY_API':
                if (hcu_checkService($dbh, 'PSCU') !== true) {
                    $omsg = hcu_checkServiceMsg($dbh, "PSCU");
                    throw new Exception("$omsg",999); # MOBLPAY AUTH
                }
                require_once(dirname(__FILE__) . '/../library/PSCUPAY_API.i');
                break;
            case 'MBLPAY_TEST':
                # HomeCU test stub
                require_once(dirname(__FILE__) . '/../library/MBLPAY_TEST.i');
                break;
            default:
                throw new Exception("Invalid Mobile Pay vendor",4001);
                break;
        }
        $parray['Cu'] = $Cu;
        $parray['trustedid'] = $pass['MP_VENDOR'];
        $trusted = cutd_read($dbh, $parray);
        if ($trusted['status']['Response'] == 'false') {

            throw new Exception("Bill Pay Service not configured",2076); # no trusted vendor rec
        }
        $parms = $trusted['data']["$Cu|{$pass['MP_VENDOR']}"];

        # set up logging here
        $loggingFlag = trim($parms["hcuLogging"]);
        if (strlen($loggingFlag) > 0) {

            $enable = $loggingFlag == -1;

            if (!$enable) {
                $loggingFlag = str_replace(" ", "", $loggingFlag);
                $testArray = explode(",", $loggingFlag);
                $enable = in_array($HB_ENV["Cn"], $testArray);
            }

            if ($enable) {
                // these are used inside the plugin to test if logging and info to log.
                $parms["logging"] = "enabled";
                $parms["environment"] = array("Cu" => $HB_ENV["Cu"], // credit union
                    "memberId" => $HB_ENV["Cn"], // member id
                    "SSOVendor" => $pass['MP_VENDOR'],
                    "userIP" => $_SERVER['REMOTE_ADDR'], // user's ip address
                    "dbConn" => $dbh);                  // database connection
            }
        }

        $billpay = Get_Billpayid($dbh, $HB_ENV, $pass['MP_VENDOR'], $pass['MBRACCT']);
        $parms['BillpayId'] = trim($billpay['billpayid']);
        $parms['passwith'] = $pass;
        switch ($pass['MP_ACTION']) {
            case "MP_AUTH":
                $mblpay = bpAuth($parms);
                # deal with response
#
                if ($mblpay['status']['code'] == '000' && strlen($mblpay["data"]['Token']) > 0) {
                    # good token, return the response
                    $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'MBRACCT' => $pass['MBRACCT'],
                    'USERKEY' => $apptoken );

                    if (is_array($mblpay['data'])) {
                        $reply_arr['MP_AUTH'] = array();
                        foreach ($mblpay['data'] as $key => $value) {
//                        $key = strtoupper($key);
//                        $xmlResp .= "<$key>$value</$key>\n";
                            $reply_arr['MP_AUTH'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                        }
                    }

                } else {
                    // ** If Error messages were included in the array that is returned, then show those errors, if NOT default to feature not set message
                    // ** Show custom errors here - no MobilePay
                    $noticesAry = Get_NoticeInfo($dbh, $HB_ENV, $MC, "M", "mblNoMobilePay", true);

                    if ($noticesAry["status"]["code"] == "000" && $noticesAry["notice"][0]["notice_id"]) {
                        $noticeString = $noticesAry["notice"][0]["notice_text"];
                    } else {
                        $noticeString = $mblpay['status']['message'];
                    }

                    throw new Exception($noticeString,$mblpay['status']['code']); # MOBLPAY AUTH get token failed
                }
                break;

            case "MP_TERMS":
                $mblpay = bpGetTerms($parms);
                # deal with response
                if ($mblpay['status']['response'] == 'false') {
                    throw new Exception($mblpay['status']['message'], $mblpay['status']['code']); # MOBLPAY AUTH
                }

                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                'DTSERVER' => date('YmdHis'),
                'MEMBER' => $HB_ENV['Uid'],
                'USERKEY' => $apptoken,
                'TOKEN' => $pass['Token'] );

                if (is_array($mblpay['data'])) {
                    $reply_arr['MP_TERMS'] = array();
                    foreach ($mblpay['data'] as $key => $value) {
//                        $key = strtoupper($key);
//                        $xmlResp .= "<$key>$value</$key>\n";
                        $reply_arr['MP_TERMS'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    }
                }

                break;
            case "MP_ACCEPT":
                $mblpay = bpAcceptTerms($parms);
                # deal with response
                if ($mblpay['status']['response'] == 'false') {
                    throw new Exception($mblpay['status']['message'], $mblpay['status']['code']); # MOBLPAY AUTH
                }


                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                'DTSERVER' => date('YmdHis'),
                'MEMBER' => $HB_ENV['Uid'],
                'USERKEY' => $apptoken,
                'TOKEN' => $pass['Token'] );

                if (is_array($mblpay['data'])) {
                    $reply_arr['MP_ACCEPT'] = array();
                    foreach ($mblpay['data'] as $key => $value) {
//                        $key = strtoupper($key);
//                        $xmlResp .= "<$key>$value</$key>\n";
                        $reply_arr['MP_ACCEPT'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    }
                }

                break;
            case "MP_ACCTLIST":
                # set Account type for from
                # AcctType = Payment | Transfer
                # Detailed = 'True' | 'False' (may be missing, false)
                $mblfrom = bpSourceAccts($parms);
                # determine payment or transfer, set Account type accordingly
                $mblpay = bpDestAccts($parms);

                # deal with response
                if ($mblfrom['status']['response'] == 'false') {
                    throw new Exception($mblfrom['status']['message'], $mblfrom['status']['code']); # MOBLPAY SourceAccts
                }
                if ($mblpay['status']['response'] == 'false') {
                    throw new Exception($mblpay['status']['message'], $mblpay['status']['code']); # MOBLPAY DestAccts
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken,
                    'TOKEN' => $pass['Token'] );

                if (is_array($mblfrom['data']) || is_array($mblpay['data'])) {
                    $reply_arr['MP_ACCTLIST'] = array();

                    if (is_array($mblfrom['data'])) {
                        $reply_arr['MP_ACCTLIST']['SOURCEACCTS'] = array();
                        foreach ($mblfrom['data'] as $akey => $account) {
                            $acctdet = array();
                            foreach ($account as $key => $value) {
                                if ($key == 'AdditionalInfo') {
                                    $acctdet['AdditionalInfo'] = htmlentities(http_build_query($value));
                                } elseif ($key == 'Name') {
                                    $acctdet['Name'] = htmlentities($value);
                                } else {
                                    // $key = strtoupper($key);
//                                    $xmlResp .= "<$key>$value</$key>\n";
                                    $acctdet[$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                                }
                            }
                            $reply_arr['MP_ACCTLIST']['SOURCEACCTS'][]['Account'] = $acctdet;
                        }
                    }
                    if (is_array($mblpay['data'])) {
                        $reply_arr['MP_ACCTLIST']['DESTACCTS'] = array();
                        foreach ($mblpay['data'] as $akey => $account) {
                            $acctdet = array();
                            foreach ($account as $key => $value) {
                                if ($key == 'AdditionalInfo') {
                                    $acctdet['AdditionalInfo'] = htmlentities(http_build_query($value));
                                } elseif ($key == 'Name') {
                                    $acctdet['Name'] = htmlentities($value);
                                } else {
                                    // $key = strtoupper($key);
//                                    $xmlResp .= "<$key>$value</$key>\n";
                                    $acctdet[$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                                }
                            }
                            $reply_arr['MP_ACCTLIST']['DESTACCTS'][]['Account'] = $acctdet;
                        }
                    }
                }

                break;
            case "MP_GETPAYMENTDATES":
                $mblpay = bpGetPaymentDates($parms);

                # deal with response
                if ($mblpay['status']['response'] == 'false') {
                    throw new Exception($mblpay['status']['message'], $mblpay['status']['code']); # MOBLPAY DATES
                }

                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken,
                    'TOKEN' => $pass['Token'] );

                if (is_array($mblpay['data'])) {
                    $reply_arr['MP_GETPAYMENTDATES'] = array();
                    foreach ($mblpay['data'] as $pkey => $paydate) {
                        switch ($pkey) {
                            case 'RushOptions':
                                if (is_array($paydate)) {
                                    $det_arr = array();
                                    foreach ($paydate as $dateitem) {
                                        if (is_array($dateitem)) {
                                            $det_arr['Option'] = array();
                                            foreach ($dateitem as $key => $value) {
//                                                $xmlResp .= "<$key>$value</$key>\n";
                                                $det_arr['Option'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                                            }
                                        }
                                    }
                                    $reply_arr['MP_GETPAYMENTDATES'][]['RushOptions'] = $det_arr;
                                }
                                break;
                            case 'PaymentDates':
                                if (is_array($paydate)) {
                                    $det_arr = array();
                                    foreach ($paydate as $dateitem) {
                                        if (is_array($dateitem)) {
                                            $det_arr['Date'] = array();
                                            foreach ($dateitem as $key => $value) {
//                                                $xmlResp .= "<$key>$value</$key>\n";
                                                $det_arr['Date'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                                            }
                                        }
                                        $reply_arr['MP_GETPAYMENTDATES'][]['PaymentDates'] = $det_arr;
                                    }
                                }
                                break;
                            default:
                                $reply_arr['MP_GETPAYMENTDATES'][$pkey] = $paydate;
                                break;
                        }
                    }
                }

                break;
            case "MP_HISTORY":
                $mblpay = bpHist($parms);

                # deal with response
                if ($mblpay['status']['response'] == 'false') {
                    throw new Exception($mblpay['status']['message'], $mblpay['status']['code']); # MOBLPAY HIST
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken,
                    'TOKEN' => $pass['Token'] );

                if (is_array($mblpay['data'])) {
                    $reply_arr['MP_HISTORY'] = array();
                    foreach ($mblpay['data'] as $pkey => $payment) {
                        $det_arr = array();
                        foreach ($payment as $key => $value) {
                            if ($key == 'AdditionalInfo') {
                                $det_arr[$key] = htmlentities(http_build_query($value));
                            } else {
                                $det_arr[$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                            }
                        }
                        $reply_arr['MP_HISTORY'][]['Payment'] = $det_arr;
                    }
                }

                break;
            case "MP_GETRUSHOPTIONS":
                $mblpay = bpGetRushOptions($parms);

                # deal with response
                if ($mblpay['status']['response'] == 'false') {
                    throw new Exception($mblpay['status']['message'], $mblpay['status']['code']); # MOBLPAY HIST
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken,
                    'TOKEN' => $pass['Token'] );

                if (is_array($mblpay['data'])) {
                    $reply_arr['MP_GETRUSHOPTIONS'] = array();
                    foreach ($mblpay['data'] as $key => $value) {
                        $reply_arr['MP_GETRUSHOPTIONS'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    }
                }

                break;

            case "MP_SCHEDULED":
                $mblpay = bpSched($parms);

                # deal with response
                if ($mblpay['status']['response'] == 'false') {
                    throw new Exception($mblpay['status']['message'], $mblpay['status']['code']); # MOBLPAY HIST
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken,
                    'TOKEN' => $pass['Token'] );

                if (is_array($mblpay['data'])) {
                    $reply_arr['MP_SCHEDULED'] = array();
                    foreach ($mblpay['data'] as $pkey => $payment) {
                        $det_arr = array();
                        foreach ($payment as $key => $value) {
                            if ($key == 'AdditionalInfo') {
                                $det_arr[$key] = htmlentities(http_build_query($value));
                            } else {
                                $det_arr[$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                            }
                        }
                        $reply_arr['MP_SCHEDULED'][]['Payment'] = $det_arr;
                    }
                }

                break;

            case "MP_PAYMENT":
                $mblpay = bpPmtAdd($parms);

                # deal with response
                if ($mblpay['status']['response'] == 'false') {
                    throw new Exception($mblpay['status']['message'], $mblpay['status']['code']); # MOBLPAY HIST
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken,
                    'TOKEN' => $pass['Token'] );

                if (is_array($mblpay['data'])) {
                    $reply_arr['MP_PAYMENT'] = array();
                    foreach ($mblpay['data'] as $key => $value) {
                        $reply_arr['MP_PAYMENT'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    }
                }

                break;

            case "MP_TRANSFER":
                $mblpay = bpTrnAdd($parms);

                # deal with response
                if ($mblpay['status']['response'] == 'false') {
                    throw new Exception($mblpay['status']['message'], $mblpay['status']['code']); # MOBLPAY HIST
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken,
                    'TOKEN' => $pass['Token'] );

                if (is_array($mblpay['data'])) {
                    $reply_arr['MP_TRANSFER'] = array();
                    foreach ($mblpay['data'] as $key => $value) {
                        $reply_arr['MP_TRANSFER'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    }
                }

                break;

            case "MP_EDITPMT":
                $mblpay = bpPmtEdit($parms);

                # deal with response
                if ($mblpay['status']['response'] == 'false') {
                    throw new Exception($mblpay['status']['message'], $mblpay['status']['code']); # MOBLPAY HIST
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken,
                    'TOKEN' => $pass['Token'] );

                if (is_array($mblpay['data'])) {
                    $reply_arr['MP_EDITPMT'] = array();
                    foreach ($mblpay['data'] as $key => $value) {
                        $reply_arr['MP_EDITPMT'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    }
                }

                break;

            case "MP_STOPPMT":
                $mblpay = bpPmtStop($parms);

                # deal with response
                if ($mblpay['status']['response'] == 'false') {
                    throw new Exception($mblpay['status']['message'], $mblpay['status']['code']); # MOBLPAY HIST
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken,
                    'TOKEN' => $pass['Token'] );

                if (is_array($mblpay['data'])) {
                    $reply_arr['MP_STOPPMT'] = array();
                    foreach ($mblpay['data'] as $key => $value) {
                        $reply_arr['MP_STOPPMT'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    }
                }

                break;

            default:
                # unknown MP_ACTION
                throw new Exception("Unknown MOBLPAY Mode",15550);
                break;
        }
        break;
    case "MESSAGE":
        # before we get started, check permissions
        $accessRights = Perm_AccessRights( $dbh, $HB_ENV, array( "feature" => FEATURE_SECURE_MSG ) );
        if ( ! HCU_array_key_value('access', $accessRights)) {
            throw new Exception(  $HB_ENV['MC']->msg('Rights not set', HCU_DISPLAY_AS_HTML), 915 );
        }


        $pass = array();
        parse_str($PASSWITH, $pass);
        if (!isset($pass['MSG_SERVICE'])) {
            throw new Exception( "Missing Message parameters",4001);
        }
        $HB_ENV['HCUPOST'] = $pass;
        if (HCU_array_key_exists('filter',$pass)) {
            $HB_ENV['HCUPOST']['what'] = HCU_array_key_value('filter',$pass);
        }
        if (HCU_array_key_exists('thread_id',$pass)) {
            $HB_ENV['HCUPOST']['parentid'] = HCU_array_key_value('thread_id',$pass);
        }

        switch ($pass['MSG_SERVICE']) {
            case 'MSGECO':
                # this file has not been converted to Odyssey
                # responses recoded to send response from arrays in
                # new standard format, BUT NOT TESTED YET
                # moving on to login issues instead
                require_once(dirname(__FILE__) . '/../library/msgECO.i');
                break;
            default:
                throw new Exception("Invalid Message Service",4001);
                break;
        }
        switch ($pass['MSG_ACTION']) {
            case "READ_MSGS":
                $msgResp = msgReadMessages($dbh, $HB_ENV);

                # deal with response
                if ($msgResp['code'] !== '000') {
                    throw new Exception($msgResp['homecuErrors'], $msgResp['code']); # MESSAGE READ_MSGS
                }

//                $HB_ENV["SYSENV"]["logger"]->info(__LINE__ . " msgReadMessages returns " . print_r($msgResp,true));

                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken );
                if (is_array($msgResp['homecuData'])) {
                    $reply_arr['READ_MSGS'] = array();
                    foreach ($msgResp['homecuData'] as $key => $value) {
                        if (is_array($value)) {
                            $msg_arr = array();
                            foreach ($value as $mkey => $mvalue) {
                                switch ($mkey) {
                                    case 'subject':
                                        $mvalue = htmlentities($mvalue, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                                        break;
                                }
                                $msg_arr[$mkey] = $mvalue;
                            }
                            $reply_arr['READ_MSGS'][]['MSG'] = $msg_arr;
                        } else {
                            $reply_arr['READ_MSGS'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                        }
                    }
                }

                break;

            case "READ_THREAD":
                $msgResp = msgReadMessageThread($dbh, $HB_ENV);

                # deal with response
                if ($msgResp['code'] !== '000') {
                    throw new Exception($msgResp['homecuErrors'], $msgResp['code']); # MESSAGE READ_THREAD
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken );

                if (is_array($msgResp['homecuData'])) {
                    $reply_arr['READ_THREAD'] = array();
                    foreach ($msgResp['homecuData'] as $key => $value) {
                        if (is_array($value)) {
                            $msg_arr = array();
                            foreach ($value as $mkey => $mvalue) {
                                switch ($mkey) {
                                    case 'subject':
                                    case 'message':
                                        $mvalue = htmlentities($mvalue, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                                        break;
                                }
                                $msg_arr[$mkey] = $mvalue;
                            }
                            $reply_arr['READ_THREAD'][]['MSG'] = $msg_arr;
                        } else {
                            $reply_arr['READ_THREAD'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                        }
                    }
                }

                break;

            case "SEND_MSG":
                $msgResp = msgSendMessage($dbh, $HB_ENV, $MC);

                # deal with response
                if ($msgResp['code'] !== '000') {
                    throw new Exception($msgResp['homecuErrors'], $msgResp['code']); # MESSAGE SEND_MSG
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken );
                # 11/14/17 msgSendMessage return calls msgReadMessages, returning a list of messages
                # (and effectively hiding any read failure as a send failure.) For now, if we got
                # a successful result, assume the send succeeded and ignore the message list
                # returning 'success', as Mammoth did, so apps don't have to change arbitrarily
                $reply_arr['SEND_MSG'] = 'success';

                break;

            case "DEL_THREAD":
                $msgResp = msgDeleteMessageThread($dbh, $HB_ENV);

                # deal with response
                if ($msgResp['code'] !== '000') {
                    throw new Exception($msgResp['homecuErrors'], $msgResp['code']); # MESSAGE DEL_THREAD
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken );
                # 11/14/17 msgDeleteMessageThread return calls msgReadMessages, returning a list of messages
                # (and effectively hiding any read failure as a delete failure.) For now, if we got
                # a successful result, assume the delete succeeded and ignore the message list
                # returning 'success', as Mammoth did, so apps don't have to change arbitrarily
                $reply_arr['DEL_MSG'] = 'success';

                break;

            case "CHECK_MSG":
                $msgResp = msgCheckForMessages($dbh, $HB_ENV);

                # deal with response
                if ($msgResp['code'] !== '000') {
                    throw new Exception($msgResp['homecuErrors'], $msgResp['code']); # MESSAGE READ_MSGS
                }
                $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken );

                if (is_array($msgResp['homecuData'])) {
                    $reply_arr['CHECK_MSG'] = array();
                    foreach ($msgResp['homecuData'] as $key => $value) {
                            $reply_arr['CHECK_MSG'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    }
                }

                break;

            default:
                # unknown MSG_ACTION
                throw new Exception("Unknown MESSAGE Mode",15550);
                break;
        }
        break;

    case "RDCMOBILE":
        # check permissions in plugin function
        require_once(dirname(__FILE__) . '/../library/rdcCommon.i'); # HCU functions common to all RDC vendors


        $pass = array();
        // note! this is an extra decode for all _ACTION settings other than UPLOAD. Because UPLOAD does an
        // extra encode on the app side.  Didn't want to disrupt deployed apps, and extra decode is benign since
        // none of the other PASSWITH values for RDCMOBILE allow special characters.  This will bite us someday...
        // but is expedient today.
        parse_str(urldecode($PASSWITH), $pass);
        if ( !isset($pass['MBRACCT'] )) {
            throw new Exception("Missing RDC parameters",4001);
        }

        // errors will come back as a status code and message
        // success will come back as the structure AppFeed expects
        $result = HandleRDCRequest( $HB_ENV, $pass );
        if ( isset( $result["STATUS"]["CODE"] ) && ( $result["STATUS"]["CODE"] != 0 ) ) {
            throw new Exception($result["STATUS"]["MESSAGE"], $result["STATUS"]["CODE"]);
        }

        // return the result (should work as is returned)
        $reply_arr = array('STATUS' => array('CODE' => 0),
            'DTSERVER' => date('YmdHis'),
            'MEMBER' => $HB_ENV['Uid'],
            'MBRACCT' => $pass['MBRACCT'],
            'USERKEY' => $apptoken,
            "RDC_RESPONSE" => $result["RDC_RESPONSE"] );

        if ( HCU_array_key_exists("DEPOSITID", $result) ) {
            $reply_arr["DEPOSITID"] = $result["DEPOSITID"];
        }

        break;
    case "ESTMT":
        # before we get started, check permissions
        $accessRights = Perm_AccessRights( $dbh, $HB_ENV, array( "feature" => FEATURE_ESTATEMENTS ) );
        if ( ! HCU_array_key_value('access', $accessRights)) {
            throw new Exception(  $HB_ENV['MC']->msg('Rights not set', HCU_DISPLAY_AS_HTML), 915 );
        }

        # PASSWITH ES_UPD=1 indicates app supports estmt_flag setting changes
        #                    response set includes terms & notices
        # PASSWITH ENROLL=START/STOP updates status, and returned response set
        #                            contains status & enrollment block only
        # PASSWITH MBRACCT=select member account

        $pass = array();
        parse_str($PASSWITH, $pass);
        # must indicate member account
        if ( empty($pass['MBRACCT']) ) {
            throw new Exception("Missing eStatement parameters",4050); # ESTMT
        }

        if (isset($pass['ENROLL'])) {
            /*
             * set Cu Cn Ml esProcessMode as START/STOP and if STOP, HCUPOST['stop_reason']
             * then call Post_CUEStmt to change estatement status
             * and Update_NoticeInfo to record
             * errors on the Update_NoticeInfo are ignored - small likelihood
             * returned message set is STATUS & ENROLLMENT only
             */

            $HB_ENV['esProcessMode'] = $pass['ENROLL'];

            if ($pass["ENROLL"] == "STOP") {
                $HB_ENV['HCUPOST']['stop_reason'] = $pass['STOP_REASON'];
            }


            # Post_CUEstmt expects un-encoded $Ml in HB_ENV array
            # app stores it encoded, so decode it before calling the function
            # and then put it back after so nothing else breaks
//            $HB_ENV['Ml'] = urldecode($HB_ENV['Ml']);
            $response = Post_CUEStmt($dbh, $HB_ENV, $MC, $pass['MBRACCT']);
//            $HB_ENV['Ml'] = urlencode($HB_ENV['Ml']);
            if (count($response['status']['errors']) > 0) {
                throw new Exception(implode(' ',$response['status']['errors']),15592); # Post_CUEStmt
            } else {
                if (intval($pass['NOTICE_ID']) > 0) {
                    // build up a response to the notice so the member doesn't see again
                    $HB_ENV["HCUPOST"]["notice_type"] = "C";
                    $HB_ENV["HCUPOST"]["notice_id"] = intval($pass['NOTICE_ID']);
                    $HB_ENV["HCUPOST"]["notice_device"] = "P"; // app
                    $HB_ENV["HCUPOST"]["notice_response"] = array("answer" => 1);    // something non-zero but numeric
                    $HB_ENV["HCUPOST"]["notice_cancel"] = "0";
                    $HB_ENV["HCUPOST"]["notice_accountnumber"] = $pass["MBRACCT"];

                    $response = Update_NoticeInfo($dbh, $HB_ENV, $MC);
                    //                if (count($response['status']['errors']) > 0) {
                    //                    throw new Exception(implode(' ',$response['status']['errors']),15593); # Update_NoticeInfo ES Status change
                    //                }
                }

                $response = Get_Estmt($dbh, $HB_ENV, $MC, $pass['MBRACCT'], 1);
            }
        } else {

            $response = Get_Estmt($dbh, $HB_ENV, $MC, $pass['MBRACCT'] );
        }
        # deal with response
        if (HCU_array_item_count('errors',$response['status']) > 0) {
            throw new Exception(implode(' ',$response['status']['errors']),15590); # Get_Estmt
        } else {
            $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
            'DTSERVER' => date('YmdHis'),
            'MEMBER' => $HB_ENV['Uid'],
            'MBRACCT' => $pass['MBRACCT'],
            'USERKEY' => $apptoken );
            $xmlResp = '';

            foreach ($response['estmt'] as $key => $value) {
                switch (strtolower($key)) {
                    case "enrolled":
                        $enrolled = $value;
                        $key = strtoupper($key);
                        $reply_arr[$key] = $value;
                        break;
                    case "pdflinks":
                        $reply_arr['PDFLINKS'] = array();
                        if (is_array($value)) {
                            foreach ($value as $tag => $tval) {
                                $det_arr = array();
                                foreach ($tval as $tkey => $tkval) {
                                    $tkey = strtoupper($tkey);
                                    $det_arr[$tkey] = $tkval;
                                }
                                $reply_arr['PDFLINKS'][]['PDFLINK'] = $det_arr;
                            }
                        }
                        break;
                    case "toclinks":
                        $reply_arr['TOCLINKS'] = array();
                        if (is_array($value)) {
                            foreach ($value as $tag => $tval) {
                                $det_arr = array();
                                foreach ($tval as $tkey => $tkval) {
                                    $tkey = strtoupper($tkey);
                                    $det_arr[$tkey] = $tkval;
                                }
                                $reply_arr['TOCLINKS'][]['TOCLINK'] = $det_arr;
                            }
                        }
                        break;
                }
            }
# add appropriate messages -
// if ES_UPD use Get_NoticeInfo else use hardcoded values

            if (isset($pass['ES_UPD'])) {
                # set new ENROLLMENT block
                if ($enrolled == "W") {
                    // give message about waiting for first statement and allow to stop
                    $termsMsg = $MC->msg('Statement Not Found') . " " . $MC->msg('Statement Missing') . " " . $MC->msg("Statements Stop");
                    $start = "stop";
                    $termsName = "esTermsStop";
                    $termsTitle = $MC->msg("Stop e-Statements");
                } else if ($enrolled == "Y") {
                    $termsMsg = $MC->msg("Statements Stop");
                    $start = "stop";
                    $termsName = "esTermsStop";
                    $termsTitle = $MC->msg("Stop e-Statements");
                } else {
                    $termsMsg = $MC->msg('Account not set for EStatements') . ". " . $MC->msg('Sign up fast');
                    $start = "start";
                    $termsName = "esTermsStart";
                    $termsTitle = $MC->msg("Start e-Statements");
                }
                $reply_arr['ENROLLMENT'] = array(
                'ENROLLED' => $enrolled,
                'TERMS_TITLE' => $termsTitle,
                'TERMS_MSG' => $termsMsg,
                'TERMS_BTN' =>  $MC->msg('Click Here'));

                $response = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', $termsName);
                // make sure we got the notice
                if ($response['status']['code'] != "000" ||
                    !count($response['notice']) ||
                    count($response['status']['errors']) > 0 ||
                    strlen($response['notice'][0]['notice_text']) == 0) {
                    $response['status']['errors'][] = "Error retrieving Terms of Use";
                    throw new Exception(implode(' ',$response['status']['errors']),15593); # Get_NoticeInfo estatement terms
                } else {
                    if (count($response['notice'])) {
                        foreach ($response['notice'] as $noticekey => $details) {
                            $reply_arr['TERMS'] = array();
                            /*
                             * if no answer list but I have a donotshowtext, send that as an answer
                             */
                            if (!count($details['notice_answers']) && sizeof($details['notice_donotshowtext'])) {
                                $details['notice_answers'][] = array('answer_id' => $details['notice_id'], 'answer_text' => $details['notice_donotshowtext']);
                                $details['notice_answertype'] = 'M';
                            }
                            foreach ($details as $key => $value) {
                                $key = strtoupper($key);
                                switch ($key) {
                                    case "NOTICE_ANSWERS":
                                        $reply_arr['ENROLLMENT']['TERMS']['NOTICE_ANSWERS'] = array();
                                        foreach ($value as $anskey => $ansdetl) {
                                            $reply_arr['ENROLLMENT']['TERMS']['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                                    'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                                    'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE)));
                                        }

                                        break;
                                    /*
                                     * ignore these
                                     */
                                    case "NOTICE_INTRO":
                                    case "NOTICE_TITLE":
                                    case "NOTICE_DONOTSHOWTEXT":
                                    case "NOTICE_MSG_TX":
                                    case "NOTICE_MSG_TX_SHOW":
                                    case "NOTICE_MSG_TX_PERM":
                                    case "NOTICE_SUPPRESSRESPONSE":
                                    case "NOTICE_POSTTARGET":
                                    case "NOTICE_TEXT":
                                        break;
                                    case "NOTICE_TYPE":
                                    case "NOTICE_ID":
                                    case "NOTICE_POPUP":
                                    case "NOTICE_ANSWERTYPE":
                                    case "NOTICE_LINKTARGET":
                                    case "NOTICE_LINKDISPLAY":
                                    default:

                                        $reply_arr['ENROLLMENT']['TERMS'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                                }
                            }
                        }
                    } else {
                        $reply_arr['ENROLLMENT']['TERMS'] = array();
                    }
                }
            } else {
                switch ($response['estmt']['enrolled']) {
                    case 'Y':
                        $reply_arr['MESSAGES'][]['MESSAGE'] = array('MSGHEAD' => 'Discontinuing eStatement Service',
                            'MSGBODY' => 'Please log in through the full Home Banking site to discontinue eStatement service');
                        break;
                    case 'W':
                        $reply_arr['MESSAGES'][]['MESSAGE'] = array('MSGHEAD' => $MC->msg('Statement Not Found'),
                            'MSGBODY' => $MC->msg('Statement Missing'));
                        break;
                    case 'N':
                    default:
                        $reply_arr['MESSAGES'][]['MESSAGE'] = array('MSGHEAD' => 'Enrollment Required',
                            'MSGBODY' => 'Please log in through the full Home Banking site to sign up for eStatement');
                        break;
                }
            }

# now get the estatement notice, if any
            $txnotice = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', 'esNotice', 0);

            if (count($txnotice['notice'])) {
                foreach ($txnotice['notice'] as $noticekey => $details) {
                    /*
                     * if no answer list but I have a donotshowtext, send that as an answer
                     */
                    if (!count($details['notice_answers']) && sizeof($details['notice_donotshowtext'])) {
                        $details['notice_answers'][] = array('answer_id' => $details['notice_id'], 'answer_text' => $details['notice_donotshowtext']);
                        $details['notice_answertype'] = 'M';
                    }

                            foreach ($details as $key => $value) {
                                $key = strtoupper($key);
                                switch ($key) {
                                    case "NOTICE_ANSWERS":
                                        $reply_arr['NOTICE']['NOTICE_ANSWERS'] = array();
                                        foreach ($value as $anskey => $ansdetl) {
                                            $reply_arr['NOTICE']['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                                    'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                                    'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE)));
                                        }

                                        break;

                            /*
                             * ignore these
                             */
                            case "NOTICE_INTRO":
                            case "NOTICE_TITLE":
                            case "NOTICE_DONOTSHOWTEXT":
                            case "NOTICE_MSG_TX":
                            case "NOTICE_MSG_TX_SHOW":
                            case "NOTICE_MSG_TX_PERM":
                            case "NOTICE_SUPPRESSRESPONSE":
                            case "NOTICE_POSTTARGET":
                            case "NOTICE_TEXT":
                                break;
                            case "NOTICE_TYPE":
                            case "NOTICE_ID":
                            case "NOTICE_POPUP":
                            case "NOTICE_ANSWERTYPE":
                            case "NOTICE_LINKTARGET":
                            case "NOTICE_LINKDISPLAY":
                            default:

                                $reply_arr['NOTICE'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                        }
                    }
                }
            } else {
                $reply_arr['NOTICE'] = array();
            }

        }

        break;
    case "GETALERTS":
        $pass = array();
        parse_str($PASSWITH, $pass);
#is cu configured for Alerts?
        if (!Check_AlertsEnabled($dbh, $HB_ENV)) {
            throw new Exception("Alert feature not configured",3180); # no 'Alert from' email set in admin
        }

#list of alert types
        $ary_alerttypes = Get_AlertTypes($MC);
#list of cell phone providers
        $ary_cellproviders = Get_AlertProviders($dbh);
#cuusers.email and most-recently-used cell number for use as default values when defining a new alert
        $ary_dfltmail = Get_AlertDefaultEmail($dbh, $HB_ENV);
        $ary_dfltcell = Get_AlertDefaultCell($dbh, $HB_ENV);
#list of members' accounts eligible for each alert type
//        $ary_acctlist = Get_AlertAccountList($dbh, $HB_ENV['Cu'],$pass['MBRACCT'],$HB_ENV['Uid']);
  # FOR ODYSSEY GET LIST OF ACCOUNT NUMBERS, then Get_AlertAccountList for ea. account
        $ary_acctlist = array();
        $accts = Get_AlertAccountList( $dbh, $HB_ENV );
        for ($i = 0; $i < count($accts['data']); $i++) {
          $ary_acctlist['data'][] = $accts['data'][$i];
        }

#list of currently-defined alerts, if any
        $ary_alertdetails = Get_AlertsDetailed($dbh, $HB_ENV['Cu'],$HB_ENV['Uid'], $HB_ENV['Fset3']);
#alerts terms of use document, if any, and a link to display terms of use on demand
        $ary_alertterms = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', 'alertTerms');

#a status indicating whether or not the member must accept terms before continuing
#any other alerts messages or notices the member should see
        $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
        'DTSERVER' => date('YmdHis'),
        'MEMBER' => $HB_ENV['Uid'],
        'USERKEY' => $apptoken,
        'ALERTSMRY' => array());

        $reply_arr['ALERTSMRY']['ALERTTYPES'] = array();
        foreach ($ary_alerttypes['data'] as $alertarr) {
            $det_arr = array();
            foreach ($alertarr as $key => $value) {
                $key = strtoupper($key);
                $det_arr[$key] = htmlspecialchars($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
            }
            $reply_arr['ALERTSMRY']['ALERTTYPES'][]['ALERTTYPE'] = $det_arr;
        }

        $reply_arr['ALERTSMRY']['CELLPROVIDERS'] = array();
        foreach ($ary_cellproviders['data'] as $cellprovider) {
            $det_arr = array();
            foreach ($cellprovider as $key => $value) {
                $key = strtoupper($key);
                $det_arr[$key] = htmlspecialchars($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
            }
            $reply_arr['ALERTSMRY']['CELLPROVIDERS'][]['CELLPROVIDER'] = $det_arr;
        }
        $reply_arr['ALERTSMRY']['EMAILDFLT'] = htmlspecialchars($ary_dfltmail['data'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
        foreach ($ary_dfltcell['data'] as $key => $value) {
            $key = strtoupper($key);
            $reply_arr['ALERTSMRY']['CELLDFLT'][$key] = htmlspecialchars($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
        }

        $reply_arr['ALERTSMRY']['ACCOUNTS'] = array();
        for ( $i = 0; $i < HCU_array_item_count("data", $ary_acctlist); $i++ ) {
            $acctarr = $ary_acctlist["data"][$i];

            $det_arr = array();
            foreach ($acctarr as $key => $value) {
                $key = strtoupper($key);
                $det_arr[$key] = htmlspecialchars($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
            }
            $reply_arr['ALERTSMRY']['ACCOUNTS'][]['ACCOUNT'] = $det_arr;
        }

        $reply_arr['ALERTSMRY']['ALERTS'] = array();
        foreach ($ary_alertdetails['data'] as $detlarr) {
            $det_arr = array();
            foreach ($detlarr as $key => $value) {
                $key = strtoupper($key);
                $det_arr[$key] = htmlspecialchars($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
            }
            $reply_arr['ALERTSMRY']['ALERTS'][]['ALERT'] = $det_arr;
        }
        $reply_arr['ALERTSMRY']['TERMS'] = array();
        if (count($ary_alertterms['notice'])) {
            foreach ($ary_alertterms['notice'] as $noticekey => $details) {
                foreach ($details as $key => $value) {
                    $key = strtoupper($key);
                    switch ($key) {
                        case "NOTICE_ANSWERS":

                            $reply_arr['ALERTSMRY']['TERMS']['NOTICE_ANSWERS'] = array();
                            foreach ($value as $anskey => $ansdetl) {
                                $reply_arr['ALERTSMRY']['TERMS']['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                        'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                        'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE)));
                            }
                            break;
                        /*
                         * ignore these
                         */
                        case "NOTICE_INTRO":
                        case "NOTICE_TITLE":
                        case "NOTICE_DONOTSHOWTEXT":
                        case "NOTICE_MSG_TX":
                        case "NOTICE_MSG_TX_SHOW":
                        case "NOTICE_MSG_TX_PERM":
                        case "NOTICE_SUPPRESSRESPONSE":
                        case "NOTICE_POSTTARGET":
                        case "NOTICE_TEXT":
                            break;
                        case "NOTICE_TYPE":
                        case "NOTICE_ID":
                        case "NOTICE_POPUP":
                        case "NOTICE_ANSWERTYPE":
                        case "NOTICE_LINKTARGET":
                        case "NOTICE_LINKDISPLAY":
                        default:

                            $reply_arr['ALERTSMRY']['TERMS'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    }
                }
            }
        }
        /*
         * if we need to allow for alert disclosure doc, this is how we'd do it
          #get alerts notice document, if any, and a link to display notice on demand
         */
        $ary_alertnotice = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', 'alertNotice');

        if (count($ary_alertnotice['notice'])) {
            foreach ($ary_alertnotice['notice'] as $noticekey => $details) {
                foreach ($details as $key => $value) {
                    $key = strtoupper($key);
                    switch ($key) {
                        case "NOTICE_ANSWERS":
                            $reply_arr['ALERTSMRY']['NOTICE']['NOTICE_ANSWERS'] = array();
                            foreach ($value as $anskey => $ansdetl) {
                                $reply_arr['ALERTSMRY']['NOTICE']['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                        'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                        'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE)));
                            }

                            break;
                        // ignore these
                        case "NOTICE_INTRO":
                        case "NOTICE_TITLE":
                        case "NOTICE_DONOTSHOWTEXT":
                        case "NOTICE_MSG_TX":
                        case "NOTICE_MSG_TX_SHOW":
                        case "NOTICE_MSG_TX_PERM":
                        case "NOTICE_SUPPRESSRESPONSE":
                        case "NOTICE_POSTTARGET":
                        case "NOTICE_TEXT":
                            break;
                        case "NOTICE_TYPE":
                        case "NOTICE_ID":
                        case "NOTICE_POPUP":
                        case "NOTICE_ANSWERTYPE":
                        case "NOTICE_LINKTARGET":
                        case "NOTICE_LINKDISPLAY":
                        default:

                            $reply_arr['ALERTSMRY']['NOTICE'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    }
                }
            }
        }

        break;

    case "UPDALERT":
        $pass = array();
        parse_str($PASSWITH, $pass);
        $HB_ENV['HCUPOST'] = array(); # start w/ empty array
        $HB_ENV['HCUPOST']['type'] = HCU_array_key_value('TYPE',$pass);
        $HB_ENV['HCUPOST']['notifymsg'] = HCU_array_key_value('NOTIFYMSG',$pass);
        $HB_ENV['HCUPOST']['emailtype'] = HCU_array_key_value('EMAILTYPE',$pass);
        $HB_ENV['HCUPOST']['provider_id'] = HCU_array_key_value('PROVIDER_ID',$pass);
        $HB_ENV['HCUPOST']['notifyto'] = HCU_array_key_value('NOTIFYTO',$pass);
        $HB_ENV['HCUPOST']['id'] = HCU_array_key_value('ALERTID',$pass);
        $HB_ENV['HCUPOST']['mbr_account'] = HCU_array_key_value('MBRACCT',$pass);
        $HB_ENV['HCUPOST']['selacct'] = HCU_array_key_value('SELACCT',$pass);
        $HB_ENV['HCUPOST']['inctransdesc'] = HCU_array_key_value('INCTRANSDESC',$pass);

        switch (strtolower($pass['TYPE'])) {
            case 'bal':
                $HB_ENV['HCUPOST']['notifyamt'] = HCU_array_key_value('NOTIFYAMT',$pass);
                $HB_ENV['HCUPOST']['incbal'] = HCU_array_key_value('INCBAL',$pass);
                $HB_ENV['HCUPOST']['useavailbal'] = HCU_array_key_value('USEAVAILBAL',$pass);
            case 'trans':
                $HB_ENV['HCUPOST']['notifydesc'] = HCU_array_key_value('NOTIFYDESC',$pass);
                $HB_ENV['HCUPOST']['userange'] = HCU_array_key_value('USERANGE',$pass);
                $HB_ENV['HCUPOST']['desc_amtmin'] = HCU_array_key_value('DESC_AMTMIN',$pass);
                $HB_ENV['HCUPOST']['desc_amtmax'] = HCU_array_key_value('DESC_AMTMAX',$pass);
                $HB_ENV['HCUPOST']['incbal'] = HCU_array_key_value('INCBAL',$pass);
                $HB_ENV['HCUPOST']['incamt'] = HCU_array_key_value('INCAMT',$pass);
                $HB_ENV['HCUPOST']['transtype'] = HCU_array_key_value('TRANSTYPE',$pass);
            case 'check':
                $HB_ENV['HCUPOST']['chknum'] = HCU_array_key_value('CHKNUM',$pass);
                $HB_ENV['HCUPOST']['incamt'] = HCU_array_key_value('INCAMT',$pass);
            case 'loan':
                $HB_ENV['HCUPOST']['days_prior'] = HCU_array_key_value('DAYS_PRIOR',$pass);
                break;
            default:
                throw new Exception('Invalid Alert Update Request',3120); # unrecognized Alert type
                break;
        }
        $validalert = Validate_Alert($dbh, $HB_ENV, $MC);
        if ($validalert['code'] != '000') {
            throw new Exception(implode(' ',$validalert['errors']),3212); # failed Validate_Alert
        } else {
            $validalert = Update_Alert($dbh, $HB_ENV, $MC);
            if ($validalert['code'] != '000') {
                throw new Exception(implode(' ',$validalert['errors']),3214); # failed Update_Alert
            } else {
                $sendkeys = array('USERKEY' => $apptoken);
                $reply_arr = Return_ResponseOK($inPost['ORG'], $HB_ENV['Cn'], $HB_ENV['Uid'], $sendkeys, "Alert Update Successful");
            }
        }
        break;
    case "DELALERT":
        $pass = array();
        parse_str($PASSWITH, $pass);
        $HB_ENV['HCUPOST'] = array(); # start w/ empty array
        $HB_ENV['HCUPOST']['type'] = $pass['TYPE'];
        $HB_ENV['HCUPOST']['id'] = $pass['ALERTID'];

        switch (strtolower($pass['TYPE'])) {
            case 'bal':
            case 'trans':
            case 'check':
            case 'loan':
                break;
            default:
                throw new Exception('Invalid Alert Delete Request',3216); # unrecognized Alert type
                break;
        }
        $validalert = Delete_Alert($dbh, $HB_ENV, $MC);
        if ($validalert['code'] != '000') {
            throw new Exception(implode(' ',$validalert['errors']),3218); # failed Delete_Alert
        } else {
            $sendkeys = array('USERKEY' => $apptoken);
            $reply_arr = Return_ResponseOK($inPost['ORG'], $HB_ENV['Cn'], $HB_ENV['Uid'], $sendkeys, "Alert Delete Successful");
        }
        break;
    case "ACTIVITY":
        // User Activity

        // get just the info we want all into one parameter list
        $pass = array();
        $activityVar = array(
          "INITIAL" => array('filter' => FILTER_SANITIZE_NUMBER_INT),
          "PENDING" => array('filter' => FILTER_SANITIZE_NUMBER_INT),
          "PRIOR" => array('filter' => FILTER_SANITIZE_NUMBER_INT),
          "DETAIL" => array('filter' => FILTER_SANITIZE_NUMBER_INT),
          "TXNTYPE" => array('filter' => FILTER_SANITIZE_STRING),
          "SCHEDULED" => array('filter' => FILTER_SANITIZE_STRING),
          "DTSTART" => array('filter' => FILTER_SANITIZE_STRING),
          "DTEND" => array('filter' => FILTER_SANITIZE_STRING),
          "ACTION" => array('filter' => FILTER_SANITIZE_STRING)
        );

        HCU_ImportVars( $pass, "", $activityVar );

        $detail = !isset( $pass["DETAIL"] ) ? 0 : intval($pass["DETAIL"]);
        if ( $detail > 0 ) {
          // allow any indication of scheduled txn to mean the txn is scheduled
          $isScheduled = isset( $pass["SCHEDULED"] ) && strlen( trim( $pass["SCHEDULED"] ) ) > 0;

          // see if doing an action
          $action = isset( $pass["ACTION"] ) ? trim( $pass["ACTION"] ) : "";
          if ( strlen( $action ) > 0 ) {
            $reply_arr = UserActivityAction( $HB_ENV, $detail, $isScheduled, $action );
          } else {
            $reply_arr = GatherUserActivityDetail( $HB_ENV, $detail, $isScheduled );
          }
        } else {
          $reply_arr = GatherUserActivity( $HB_ENV, $pass );
        }

        // add the userkey
        $reply_arr["USERKEY"] = $apptoken;
        break;
    case "EXTACCTS":
        require_once(dirname(__FILE__) . '/../library/hcuExternalAccts.i');

        // check rights
        $permissionInputs = array( "feature" => FEATURE_EXTERNAL_TRANSFERS );
        $return = Perm_AccessRights( $dbh, $HB_ENV, $permissionInputs );
        if ( !$return ) {
          // * Rights NOT set up for user access
          $aryErrors[] = $MC->msg('Rights not set', HCU_DISPLAY_AS_HTML);
          throw new Exception (HCU_JsonEncode($aryErrors));
        }

        // External account management - figure out the action
        $passedVars = array();
        $paramInputs = array(
          "ACTION" => array('filter' => FILTER_SANITIZE_STRING)
        );

        HCU_ImportArray( $passedVars, $_REQUEST, $paramInputs );

        // make an array of the parameters (need to sanitize)
        parse_str($PASSWITH, $pass);

        // add the action to the passed parameters
        $pass["action"] = $passedVars["ACTION"];

        // set this flag in case need terms, which means don't do the action
        $needsTermsAnswered = false;
        $termsInfo = array();
        $noticeInfo = array();

        // other parameters depend on the action
        switch( $passedVars["ACTION"] ) {
          case "get_accounts":
            // check if need terms agreed to
            $aryExtAcctTerms = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', 'extAccountTerms');

            if (count($aryExtAcctTerms['notice'])) {
                foreach ($aryExtAcctTerms['notice'] as $noticekey => $details) {
                    foreach ($details as $key => $value) {
                        $key = strtoupper($key);
                        switch ($key) {
                            case "NOTICE_ANSWERS":

                                $termsInfo["TERMS"]['NOTICE_ANSWERS'] = array();
                                foreach ($value as $anskey => $ansdetl) {
                                    $termsInfo["TERMS"]['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                            'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                            'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE)));
                                }
                                break;
                            /*
                             * ignore these
                             */
                            case "NOTICE_INTRO":
                            case "NOTICE_TITLE":
                            case "NOTICE_DONOTSHOWTEXT":
                            case "NOTICE_MSG_TX":
                            case "NOTICE_MSG_TX_SHOW":
                            case "NOTICE_MSG_TX_PERM":
                            case "NOTICE_SUPPRESSRESPONSE":
                            case "NOTICE_POSTTARGET":
                            case "NOTICE_TEXT":
                                break;
                            case "NOTICE_POPUP":
                            case "NOTICE_TYPE":
                            case "NOTICE_ID":
                            case "NOTICE_ANSWERTYPE":
                            case "NOTICE_LINKTARGET":
                            case "NOTICE_LINKDISPLAY":
                            default:
                                $termsInfo["TERMS"][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                        }
                    }
                }
            }

            // if notice_popup then that means show terms before getting data
            $needsTermsAnswered = $termsInfo["TERMS"]["NOTICE_POPUP"] == 1;

            /*
             * if we need to allow for alert disclosure doc, this is how we'd do it
              #get alerts notice document, if any, and a link to display notice on demand
             */
            $aryExtAcctNotice = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', 'extAccountNotice');

            if (count($aryExtAcctNotice['notice'])) {
                foreach ($aryExtAcctNotice['notice'] as $noticekey => $details) {
                    foreach ($details as $key => $value) {
                        $key = strtoupper($key);
                        switch ($key) {
                            case "NOTICE_ANSWERS":
                                $noticeInfo["NOTICE"]['NOTICE_ANSWERS'] = array();
                                foreach ($value as $anskey => $ansdetl) {
                                    $noticeInfo["NOTICE"]['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                            'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                            'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE)));
                                }

                                break;
                            // ignore these
                            case "NOTICE_INTRO":
                            case "NOTICE_TITLE":
                            case "NOTICE_DONOTSHOWTEXT":
                            case "NOTICE_MSG_TX":
                            case "NOTICE_MSG_TX_SHOW":
                            case "NOTICE_MSG_TX_PERM":
                            case "NOTICE_SUPPRESSRESPONSE":
                            case "NOTICE_POSTTARGET":
                            case "NOTICE_TEXT":
                                break;
                            case "NOTICE_TYPE":
                            case "NOTICE_ID":
                            case "NOTICE_POPUP":
                            case "NOTICE_ANSWERTYPE":
                            case "NOTICE_LINKTARGET":
                            case "NOTICE_LINKDISPLAY":
                            default:
                                $noticeInfo['NOTICE'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                        }
                    }
                }
            }

            $inputFilter = array(
              "action" => array('filter' => FILTER_SANITIZE_STRING),
            );
            break;
          case "add_account":
            // sanitize the inputs
            $inputFilter = array(
              "action" => array('filter' => FILTER_SANITIZE_STRING),
              "display_name" => array("filter" => FILTER_SANITIZE_STRING, 'options' => array('flags' => FILTER_FLAG_NO_ENCODE_QUOTES)),
              "name_on_account" => array("filter" => FILTER_SANITIZE_STRING, 'options' => array('flags' => FILTER_FLAG_NO_ENCODE_QUOTES)),
              "dfi_routing" => array('filter' => FILTER_SANITIZE_NUMBER_INT),
              "dfi_account" => array('filter' => FILTER_SANITIZE_STRING),
              "dfi_account_type" => array('filter' => FILTER_SANITIZE_NUMBER_INT)
            );
            break;
          case "validate_account":
            $inputFilter = array(
              "action" => array('filter' => FILTER_SANITIZE_STRING),
              "micro1" => array('filter' => FILTER_SANITIZE_NUMBER_INT),
              "micro2" => array('filter' => FILTER_SANITIZE_NUMBER_INT),
              "id" => array('filter' => FILTER_SANITIZE_NUMBER_INT)
            );
            // sanitize the inputs
            break;
          case "update_account":
            // sanitize the inputs
            $inputFilter = array(
              "action" => array('filter' => FILTER_SANITIZE_STRING),
              "display_name" => array("filter" => FILTER_SANITIZE_STRING, 'options' => array('flags' => FILTER_FLAG_NO_ENCODE_QUOTES)),
              "name_on_account" => array("filter" => FILTER_SANITIZE_STRING, 'options' => array('flags' => FILTER_FLAG_NO_ENCODE_QUOTES)),
              "id" => array('filter' => FILTER_SANITIZE_NUMBER_INT)
            );
            break;
          case "delete_account":
            // sanitize the inputs
            $inputFilter = array(
              "action" => array('filter' => FILTER_SANITIZE_STRING),
              "id" => array('filter' => FILTER_SANITIZE_NUMBER_INT)
            );
            break;
          default:
            throw new Exception( "Unknown action received: {$passedVars["ACTION"]}", 15511 );
        }

        // note: not returning DTSERVER or MEMBER since there is no reason to
        $reply_arr = array( 'STATUS' => array('CODE' => 0,'SEVERITY' => 'INFO' ),
          'USERKEY' => $apptoken,
          'EXTACCT_RESP' => array() );

        // only get the data if don't need terms answered
        if ( !$needsTermsAnswered ) {
          HCU_ImportArray( $inputVars, $pass, $inputFilter );

          $return = ManageExternalAccount( $HB_ENV, $inputVars );

          // check for an error
          if ( $return["status"]["code"] !== "000" ) {
            // just return a single error
            $returnError = "";
            if ( is_array( $return["status"]["errors"] ) ) {
                for ( $i = 0; $i < count( $return["status"]["errors"] ); $i++ ) {
                    if ( strlen( $returnError ) > 0 ) {
                        $returnError .= " ";
                    }

                    $returnError .= $return["status"]["errors"][$i];
                }
            } else {
                $returnError .= $return["status"]["errors"];
            }
            throw new Exception ($returnError, 15512);
          }

          // return any data based on the action
          switch( $passedVars["ACTION"] ) {
            case "add_account":
              // return the messages as DATA
              $returnMessage = "";
              for ( $i = 0; $i < count( $return["info"] ); $i++ ) {
                  if ( strlen( $returnMessage ) > 0 ) {
                      $returnMessage .= " ";
                  }
                  $returnMessage .= $return["info"][$i];
              }

              $reply_arr["EXTACCT_RESP"]["DATA"]["MESSAGE"] = $returnMessage;

              // the add_account will return the account list, so fall through to get_accounts!!
            case "get_accounts":
              $statusLookup = Get_ExternalTransferStatusLookup( $MC );

              for ( $i = 0; $i < count( $return['data'] ); $i++ ) {
                  $oneAcct = $return["data"][$i];

                  $detail = array();

                  $detail["ID"] = $oneAcct["id"];
                  $detail["DISPLAY_NAME"] = htmlspecialchars($oneAcct["display_name"], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                  $detail["NAME_ON_ACCOUNT"] = htmlspecialchars($oneAcct["name_on_account"], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                  $detail["STATUS"] = $oneAcct["status"];
                  $detail["STATUS_NAME"] = $statusLookup[$oneAcct["status"]];
                  $detail["REMOTEACCOUNT"] = $oneAcct["remoteAccount"];

                  // special handling for the json data
                  $acctInfo = HCU_JsonDecode( $oneAcct["remote_info"] );

                  $type = $acctInfo["rdfi"]["type"] == 10 ? $MC->msg( "ACH Checking" ) : $MC->msg( "ACH Savings" );
                  $detail["ACCOUNTTYPE"] = $type;

                  // verify info depends on status
                  $verifyInfo = "";
                  if ( $oneAcct["status"] == "p" ) {
                      $detail["PENDING_DATE"] = $acctInfo["verify"]["pending_date"];
                      $detail["TRIES"] = $acctInfo["verify"]["tries"];
                  } else {
                      $detail["VERIFIED"] = date( "m/d/Y", $acctInfo["verify"]["verified"] );
                  }

                  $reply_arr['EXTACCT_RESP']['EXTACCTS'][]['ACCT'] = $detail;
              }
              break;
            case "validate_account":
              // it is possible for a validate to not work but return an updated retry count
              $data = array( "ID" => $return["data"]["id"],
                             "STATUS" => $return["data"]["status"],
                             "TRIES" => $return["data"]["tries"],
                             "MESSAGE" => $return["data"]["message"]
                           );
              $reply_arr["EXTACCT_RESP"]["DATA"] = $data;
              break;
            case "update_account":
              // return the updated content
              $data = array( "ID" => $return["data"]["id"],
                             "NAME_ON_ACCOUNT" => $return["data"]["name_on_account"],
                             "DISPLAY_NAME" => $return["data"]["display_name"],
                             "MESSAGE" => $return["info"][0]
                           );
              $reply_arr["EXTACCT_RESP"]["DATA"] = $data;
              break;
            case "delete_account":
              // return the info as a message, since that is what it is
              $data = array( "ID" => $return["data"],
                             "MESSAGE" => $return["info"][0]
                           );
              $reply_arr["EXTACCT_RESP"]["DATA"] = $data;
              break;
          }
        }

        // add any terms
        if ( HCU_array_key_exists( "TERMS", $termsInfo ) && HCU_array_key_value( "NOTICE_ID", $termsInfo["TERMS"] ) > 0 ) {
          $reply_arr["EXTACCT_RESP"]["TERMS"] = $termsInfo["TERMS"];
        }

        // add any notice to the existing array
        if ( HCU_array_key_exists( "NOTICE", $noticeInfo ) && HCU_array_key_value( "NOTICE_ID", $noticeInfo["NOTICE"] ) > 0 ) {
          $reply_arr["EXTACCT_RESP"]["NOTICE"] = $noticeInfo["NOTICE"];
        }

        break;
    case "M2MACCTS":
        require_once(dirname(__FILE__) . '/../library/hcuExternalAccts.i');

        // check rights
        $permissionInputs = array( "feature" => FEATURE_M2M_TRANSFERS );
        $return = Perm_AccessRights( $dbh, $HB_ENV, $permissionInputs );
        if ( !$return ) {
          // * Rights NOT set up for user access
          $aryErrors[] = $MC->msg('Rights not set', HCU_DISPLAY_AS_HTML);
          throw new Exception (HCU_JsonEncode($aryErrors));
        }

        // External account management - figure out the action
        $passedVars = array();
        $paramInputs = array(
          "ACTION" => array('filter' => FILTER_SANITIZE_STRING)
        );

        HCU_ImportArray( $passedVars, $_REQUEST, $paramInputs );

        // make an array of the parameters (need to sanitize)
        parse_str($PASSWITH, $pass);

        // add the action to the passed parameters
        $pass["action"] = $passedVars["ACTION"];

        // set this flag in case need terms, which means don't do the action
        $needsTermsAnswered = false;
        $termsInfo = array();
        $noticeInfo = array();

        // other parameters depend on the action
        switch( $passedVars["ACTION"] ) {
          case "get_m2m_accounts":
            // check if need terms agreed to
            $aryM2MAcctTerms = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', 'm2mAccountTerms');

            if (count($aryM2MAcctTerms['notice'])) {
                foreach ($aryM2MAcctTerms['notice'] as $noticekey => $details) {
                    foreach ($details as $key => $value) {
                        $key = strtoupper($key);
                        switch ($key) {
                            case "NOTICE_ANSWERS":

                                $termsInfo["TERMS"]['NOTICE_ANSWERS'] = array();
                                foreach ($value as $anskey => $ansdetl) {
                                    $termsInfo["TERMS"]['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                            'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                            'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE)));
                                }
                                break;
                            /*
                             * ignore these
                             */
                            case "NOTICE_INTRO":
                            case "NOTICE_TITLE":
                            case "NOTICE_DONOTSHOWTEXT":
                            case "NOTICE_MSG_TX":
                            case "NOTICE_MSG_TX_SHOW":
                            case "NOTICE_MSG_TX_PERM":
                            case "NOTICE_SUPPRESSRESPONSE":
                            case "NOTICE_POSTTARGET":
                            case "NOTICE_TEXT":
                                break;
                            case "NOTICE_POPUP":
                            case "NOTICE_TYPE":
                            case "NOTICE_ID":
                            case "NOTICE_ANSWERTYPE":
                            case "NOTICE_LINKTARGET":
                            case "NOTICE_LINKDISPLAY":
                            default:
                                $termsInfo["TERMS"][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                        }
                    }
                }
            }

            // if notice_popup then that means show terms before getting data
            $needsTermsAnswered = $termsInfo["TERMS"]["NOTICE_POPUP"] == 1;

            /*
             * if we need to allow for alert disclosure doc, this is how we'd do it
              #get alerts notice document, if any, and a link to display notice on demand
             */
            $aryM2MAcctNotice = Get_NoticeInfo($dbh, $HB_ENV, $MC, 'P', 'm2mAccountNotice');

            if (count($aryM2MAcctNotice['notice'])) {
                foreach ($aryM2MAcctNotice['notice'] as $noticekey => $details) {
                    foreach ($details as $key => $value) {
                        $key = strtoupper($key);
                        switch ($key) {
                            case "NOTICE_ANSWERS":
                                $noticeInfo["NOTICE"]['NOTICE_ANSWERS'] = array();
                                foreach ($value as $anskey => $ansdetl) {
                                    $noticeInfo["NOTICE"]['NOTICE_ANSWERS'][] = array('ANSWER' => array(
                                            'ANSWER_ID' => "ANS_{$ansdetl['answer_id']}",
                                            'ANSWER_TEXT' => htmlentities(CleanWordQuotes($ansdetl['answer_text']), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE)));
                                }

                                break;
                            // ignore these
                            case "NOTICE_INTRO":
                            case "NOTICE_TITLE":
                            case "NOTICE_DONOTSHOWTEXT":
                            case "NOTICE_MSG_TX":
                            case "NOTICE_MSG_TX_SHOW":
                            case "NOTICE_MSG_TX_PERM":
                            case "NOTICE_SUPPRESSRESPONSE":
                            case "NOTICE_POSTTARGET":
                            case "NOTICE_TEXT":
                                break;
                            case "NOTICE_TYPE":
                            case "NOTICE_ID":
                            case "NOTICE_POPUP":
                            case "NOTICE_ANSWERTYPE":
                            case "NOTICE_LINKTARGET":
                            case "NOTICE_LINKDISPLAY":
                            default:
                                $noticeInfo['NOTICE'][$key] = htmlentities($value, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                        }
                    }
                }
            }

            $inputFilter = array(
              "action" => array('filter' => FILTER_SANITIZE_STRING),
            );
            break;
          case "add_m2m_account":
            // sanitize the inputs
            $inputFilter = array(
              "action" => array('filter' => FILTER_SANITIZE_STRING),
              "display_name" => array("filter" => FILTER_SANITIZE_STRING, 'options' => array('flags' => FILTER_FLAG_NO_ENCODE_QUOTES)),
              "name_on_account" => array("filter" => FILTER_SANITIZE_STRING, 'options' => array('flags' => FILTER_FLAG_NO_ENCODE_QUOTES)),
              "dfi_account" => array('filter' => FILTER_SANITIZE_STRING),
              "dfi_account_type" => array('filter' => FILTER_SANITIZE_NUMBER_INT)
            );
            break;
          case "update_account":
            // sanitize the inputs
            $inputFilter = array(
              "action" => array('filter' => FILTER_SANITIZE_STRING),
              "display_name" => array("filter" => FILTER_SANITIZE_STRING, 'options' => array('flags' => FILTER_FLAG_NO_ENCODE_QUOTES)),
              "id" => array('filter' => FILTER_SANITIZE_NUMBER_INT)
            );
            break;
          case "delete_account":
            // sanitize the inputs
            $inputFilter = array(
              "action" => array('filter' => FILTER_SANITIZE_STRING),
              "id" => array('filter' => FILTER_SANITIZE_NUMBER_INT)
            );
            break;
          default:
            throw new Exception( "Unknown action received: {$passedVars["ACTION"]}", 15511 );
        }

        // note: not returning DTSERVER or MEMBER since there is no reason to
        $reply_arr = array( 'STATUS' => array('CODE' => 0,'SEVERITY' => 'INFO' ),
          'USERKEY' => $apptoken,
          'M2MACCT_RESP' => array() );

        // only get the data if don't need terms answered
        if ( !$needsTermsAnswered ) {
          HCU_ImportArray( $inputVars, $pass, $inputFilter );

          // this function handles both External and M2M accounts
          $return = ManageExternalAccount( $HB_ENV, $inputVars );

          // check for an error
          if ( $return["status"]["code"] !== "000" ) {
            // just return a single error
            $returnError = "";
            if ( is_array( $return["status"]["errors"] ) ) {
                for ( $i = 0; $i < count( $return["status"]["errors"] ); $i++ ) {
                    if ( strlen( $returnError ) > 0 ) {
                        $returnError .= " ";
                    }

                    $returnError .= $return["status"]["errors"][$i];
                }
            } else {
                $returnError .= $return["status"]["errors"];
            }
            throw new Exception ($returnError, 15512);
          }

          // return any data based on the action
          switch( $passedVars["ACTION"] ) {
            case "add_m2m_account":
              // return the messages as DATA
              $returnMessage = "";
              for ( $i = 0; $i < count( $return["info"] ); $i++ ) {
                  if ( strlen( $returnMessage ) > 0 ) {
                      $returnMessage .= " ";
                  }
                  $returnMessage .= $return["info"][$i];
              }

              $reply_arr["M2MACCT_RESP"]["DATA"]["MESSAGE"] = $returnMessage;

              // the add_account will return the account list, so fall through to get_accounts!!
            case "get_m2m_accounts":
              $statusLookup = Get_ExternalTransferStatusLookup( $MC );

              for ( $i = 0; $i < count( $return['data'] ); $i++ ) {
                  $oneAcct = $return["data"][$i];

                  $detail = array();

                  $detail["ID"] = $oneAcct["id"];
                  $detail["DISPLAY_NAME"] = htmlspecialchars($oneAcct["display_name"], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                  $detail["STATUS"] = $oneAcct["status"];
                  $detail["STATUS_NAME"] = $statusLookup[$oneAcct["status"]];
                  $detail["REMOTEACCOUNT"] = $oneAcct["remoteAccount"];

                  // special handling for the json data
                  $acctInfo = HCU_JsonDecode( $oneAcct["remote_info"] );

                  $type = $acctInfo["rdfi"]["type"] == 10 ? $MC->msg( "ACH Checking" ) : $MC->msg( "ACH Savings" );
                  $detail["ACCOUNTTYPE"] = $type;

                  $detail["VERIFIED"] = date( "m/d/Y", $acctInfo["verify"]["verified"] );

                  $reply_arr['M2MACCT_RESP']['M2MACCTS'][]['ACCT'] = $detail;
              }
              break;
            case "update_account":
              // return the updated content
              $data = array( "ID" => $return["data"]["id"],
                             "DISPLAY_NAME" => $return["data"]["display_name"],
                             "MESSAGE" => $return["info"][0]
                           );
              $reply_arr["M2MACCT_RESP"]["DATA"] = $data;
              break;
            case "delete_account":
              // return the info as a message, since that is what it is
              $data = array( "ID" => $return["data"],
                             "MESSAGE" => $return["info"][0]
                           );
              $reply_arr["M2MACCT_RESP"]["DATA"] = $data;
              break;
          }
        }

        // add any terms
        if ( HCU_array_key_exists( "TERMS", $termsInfo ) && HCU_array_key_value( "NOTICE_ID", $termsInfo["TERMS"] ) > 0 ) {
          $reply_arr["M2MACCT_RESP"]["TERMS"] = $termsInfo["TERMS"];
        }

        // add any notice to the existing array
        if ( HCU_array_key_exists( "NOTICE", $noticeInfo ) && HCU_array_key_value( "NOTICE_ID", $noticeInfo["NOTICE"] ) > 0 ) {
          $reply_arr["M2MACCT_RESP"]["NOTICE"] = $noticeInfo["NOTICE"];
        }

        break;
    case "GETLANDING":
        require_once(dirname(__FILE__) . '/../../shared/library/hcuFunctions.i');

        $passedVars = array();
        $paramInputs = array(
          "ACTION" => array('filter' => FILTER_SANITIZE_STRING)
        );

        HCU_ImportArray( $passedVars, $_REQUEST, $paramInputs );

        $action = strtoupper( $passedVars["ACTION"] );

        switch( $action ) {
          case "MENU":
        //   $passedVars = array();
          $paramInputs = array(
            "ID" => array('filter' => FILTER_SANITIZE_NUMBER_INT)
          );
          HCU_ImportArray( $passedVars, $_REQUEST, $paramInputs );
          $landingResult = GetLandingMenuTarget( $HB_ENV, $passedVars["ID"], $apptoken );
            break;

            case "SSO":
            // $passedVars = array();
            $paramInputs = array(
              "URL" => array('filter' => FILTER_SANITIZE_STRING)
            );
            HCU_ImportArray( $passedVars, $_REQUEST, $paramInputs );
            $landingResult = GetLandingURL( $HB_ENV, $passedVars["URL"], $apptoken );
            break;

          default:
            // return nothing by default
            $landingResult = "";
            break;
        }

        // return the payload and the landing name
        // NOTE: urlencode the target because it has HTML entities that cause issues in XML
        $reply_arr = array( 'STATUS' => array('CODE' => 0,'SEVERITY' => 'INFO' ),
          'USERKEY' => $apptoken,
          'TARGET_RESP' => urlencode( $landingResult )
           );

        break;
    case "GETCOMPASS":
        // call on demand to get the compass menu contents and badge counts
//        $menuCompass = GetFakeUserCompassMenu( $HB_ENV );
        $menuCompass = function_exists( "CompassMenuJson" ) ? CompassMenuJson( $HB_ENV, $dbh ) : GetFakeUserCompassMenu( $HB_ENV );
        $reply_arr = array( 'STATUS' => array('CODE' => 0,'SEVERITY' => 'INFO' ),
          'USERKEY' => $apptoken,
          'COMPASS' => $menuCompass,
          'COMPASS_UPDATE_INTERVAL' => 180              // somewhat arbitrarily chosen
           );
        break;
    default:
# gen OFX
#
        $KEYACCTID = HCU_array_key_value('KEYACCTID', $inPost);
        $BALONLY = (HCU_array_key_exists('KEYACCTID', $inPost) ? 0 : 1);
        if (empty($sendkeys)) { $sendkeys=array(); }

        $reply_arr = fullFeed($dbh, $HB_ENV, $DTSTART, $DTEND, $BALONLY, $SENDAS, $KEYACCTID, $recent, $sendkeys);

        break;
    }

    // test to see if being asked for a menu
    $userMenuRequest = strtolower(HCU_array_key_value('USERMENU', $inPost));
    if ( $userMenuRequest != "" ) {
        // add the user menu to the return info
        if ( $userMenuRequest == "full" ) {
            $userMenu = BuildFullUserMenu($dbh, $HB_ENV, 'A');
        } else {
            $userMenu = BuildUserMenu($dbh, $HB_ENV, 'A');
        }
        $reply_arr["usermenu"] = $userMenu;

        // Only do this if the menu is being requested, so it isn't called as often
        // add the user profile update info (returns a JSON string)
        $updateString = GetUserProfileUpdates( $HB_ENV );
        $reply_arr["PROFILE_UPDATES"] = $updateString;
        require_once(dirname(__FILE__) . '/../../shared/library/hcuFunctions.i');

        // Only do this if the menu is being requested, so it isn't called as often
        $count = GetPendingUserActivity($HB_ENV);
        if ( $count > 0 ) {
            $reply_arr["USER_ACTIVITY_PENDING"] = $count;
        }

        // Only do this if the menu is being requested, so it isn't called as often
        // ** Check for the existence of new messages
        $count = ReturnUnreadSecureMsg($HB_ENV["dbh"], $HB_ENV);
        if ( $count > 0 ) {
            $reply_arr["SECURE_MSG_UNREAD"]= $count;
        }
    }

    // see if need to return encryption key
    if ( $appEncryptionKey != "" ) {
        $reply_arr["encrkey"] = $appEncryptionKey;
    }

    // fall through and return the array
} catch (Exception $e) {
    $code = $e->getCode();
    $message = $e->getMessage();

    $reply_arr = array('STATUS' => array('CODE' => $code, 'SEVERITY' => 'ERROR'),
    'MESSAGE'=> array('ERR' => htmlspecialchars($message, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE), 'ERRNO' => 999, 'ERRSTAT' =>'FAIL'));

}

    // no more code will exit after this point because send_response() exits.
    send_response( $reply_arr, $SENDAS );

/**
 *
 * @param string $data XML string to be formatted
 * @return string XML 'pretty' with indents
 */
 function Format_AppFeed($data) {
     /*
      * decided not to use this -- adds unneccessary white space
      * and we want to explore moving to json instead
      */




    $dom = new DOMDocument();

    $dom->preserveWhiteSpace = false;
    $dom->formatOutput = true;

    $dom->loadXML($data);
    $out = $dom->saveXML();

        $out = str_replace('<?xml version="1.0"?>','',$out);

    return ($out);
}

function send_response($reply_arr, $sendas='XML') {

    switch ($sendas) {
        case 'JSON':
            $xmlResp = HCU_JsonEncode($reply_arr);
            header("Content-Type: application/json");
//            header("Content-disposition: inline; filename=\"{$HB_ENV['Cu']}_txns.json\"");
            break;
        case 'XML':
        default:
            $xmlResp = Format_AppFeed(assocArrayToXML($reply_arr,'APPFEED'));
//           $xmlResp = assocArrayToXML($reply_arr,'APPFEED');
            if (HCU_array_item_count('HB_ENV', $GLOBALS) && HCU_array_key_value('Cu',$GLOBALS['HB_ENV'])) {
                $replace = GetAppMenu($GLOBALS['HB_ENV']['Cu'],'appconfig.xml');
                $xmlResp = preg_replace('/<menu>REPLACE MENU HERE<\/menu>/',"<menu>{$replace}</menu>",$xmlResp);
            }

            header("Content-Type: application/x-ofx");
//            header("Content-disposition: inline; filename=\"{$HB_ENV['Cu']}_txns.ofx\"");
            break;
    }
//global $HB_ENV;
//$HB_ENV["SYSENV"]["logger"]->debug( "send_response: " . $xmlResp );

    header("Content-length: " . strlen($xmlResp));
    print $xmlResp;

    exit;
}

function sqlmdy($date) {

    if (strtolower($date) == "now" || strtolower($date) == "today") {
        $date = date("Y-m-d");
    }
    # only allow 0-9 and dash(-) or slash (/)
    # also allow dot (.) for milliseconds
    if (preg_match("/[^0-9\-\/\.]/", $date)) {
        return false;
    }
    if (preg_match("/[-\/]/", $date)) {
        list ($yy, $mm, $dd) = preg_split("/[-\/\.]/", $date);
    } else {
        $yy = substr($date, 0, 4);
        $mm = substr($date, 4, 2);
        $dd = substr($date, 6, 2);
    }
    $mm = sprintf("%02d", intval($mm));
    $dd = sprintf("%02d", intval($dd));
    if (strlen($yy) > 0 && strlen($yy) < 4) {
        $yy = ($yy < 70 ? 2000 + $yy : 1900 + $yy);
    }
    $yy = sprintf("%04d", intval($yy));
    if (checkdate($mm, $dd, $yy)) {
        return "${yy}${mm}${dd}";
    } else {
        return false;
    }
}

function countprint($string) {
    print $string;
    return strlen($string);
}

function clockwatch($tz, $CU, $MEMBER) {
    $localzone = 'US/Mountain';
    $tz = ("$tz" == "" ? "US/Mountain" : $tz);
    if (strpos("$tz", "/") === false)
        $tz = "US/$tz";
    global $dbh;
    $sqlll = "set time zone '$tz';
    select extract(epoch from CURRENT_TIMESTAMP(0)) -
                 extract(epoch from substring(lastlogin,1,19)::timestamp)::integer
                 from cuusers
                 where cu='$CU' and user_name='$MEMBER';";
    $sthcl = db_query($sqlll, $dbh);
    if ($sthcl) {
        list($sincelast) = db_fetch_array($sthcl, 0);
    }
    $sthcl = db_query("set time zone '$localzone'", $dbh);
    return abs($sincelast);
}

function MFQ_send_chall($dbh, $HB_ENV, $MC) {

# sending all questions regardless of '1 random' setting for cu
# updated 9/12 to recognize '1 random' setting
    # use odyssey function

    $MemberChallengeQuestions_ary=GetChallengeQuestions("CHALLENGE", $dbh, $HB_ENV, $MC, $HB_ENV['Cn']);

    $reply_arr = array('STATUS' => array('CODE' =>3000,'SEVERITY' => 'ERROR'),
        'DTSERVER' => date('YmdHis') );

// old path    $reply_arr['MFACHALLENGETRNRS']['MFACHALLENGERS'] = array();
    $reply_arr['MFA'] = array();
    $reply_arr['MFA']['AUTHREQ'] = 'MFQ';
    $reply_arr['MFA']['MFABUNDLE'] = $HB_ENV['mfaBundle'];

//# force 'What email' as first challenge question
//    $itm_arr = array('MFACHALLENGE' => array(
//        'MFAPHRASEID' => 'MFA_E',
//        'MFAPHRASELABEL' => 'What email address is saved with this account?'));
//
//    $reply_arr['MFA'][] = $itm_arr;

# and now add mfa questions, if any were found
    if (count($MemberChallengeQuestions_ary)) {
        foreach ((array) $MemberChallengeQuestions_ary as $chakey => $mfaitem) {
    $itm_arr = array('MFACHALLENGE' => array(
        'MFAPHRASEID' => "MFA_{$mfaitem['cqid']}",
        'MFAPHRASELABEL' => "{$mfaitem['display']}"));

    $reply_arr['MFA'][] = $itm_arr;

        }
    }

    return $reply_arr;
}

/**
 * Compare MFA challenge question responses to the values saved in the database
 *
 * @param resource $dbh database handle
 * @param array $HB_ENV
 * @param array $inPost posted responses
 * @return array fail count, fail reason
 * @throws Exception
 */
function MFQ_response($dbh, $HB_ENV, $inPost) {

    $aryMfaQuest = HCU_JsonDecode($HB_ENV['mfaquest']);
    $mbrMfaQuest = HCU_MFADecode($aryMfaQuest); # from the db

    $fail = 0;
    $failreason = 0;

    $dbcount = $mbrMfaQuest['mfacount']; # how many questions are in the db?
    $mfapost = MFQ_resplist($inPost); # get list of MFA variables in the posted request (skips MFA_E)
    # update from mammoth - gets id and answers in array using Odyssey format
    $mfacount = count($mfapost); # how many MFA_ responses (excluding MFA_E) did we get?
    try {
        if ($mfacount < $dbcount && ($HB_ENV['Fset2'] & $GLOBALS['CU2_RANDOM_CHAL']) == 0) {
            # expected more challenge questions than we got, so fail
            $fail++;
            $failreason = $GLOBALS['MEM_LOGIN_FAILED_QST'];
            throw new Exception(__LINE__ . 'MFA Failed',$failreason);# expected chall ques and got none

        }
        # make sure savemail is set in HB_ENV
        # separate eMail check from challenge questions
        # eMail check now using isValidEmail from cu_credentials
//        if (strtolower($inPost['MFA_E']) !== strtolower($HB_ENV['savemail'])) {
//            $fail++;
//            $failreason = $GLOBALS['MEM_LOGIN_FAILED_EMAIL'];
//            throw new Exception(__LINE__ . 'MFA Failed',$failreason);# email mismatch
//        }
        /*
         * VALIDATE ANSWERS
         * IF savecqid has a value and CU configured for only one answer, then ONLY validate that answer
         *
         * dbcount being greater than one MEANS the aryMfaQuest array contains an 'answers' key, is an array
         * and has at least one value
         */
        /*
         * mfaAnswerIdx is set to the list of questions to validate
         * this should be:
         *  if random, and challenge is set, use challenge
         *  if random and challenge is not set, use the posted response
         *  if not random, use the db list
         */
        $aryMfaAnswers = $mbrMfaQuest['answers']; # stored answers
        if (($HB_ENV['Fset2'] & $GLOBALS['CU2_RANDOM_CHAL'])) {
            if ( $mbrMfaQuest['challenge'] > 0 ) {
            // * Stuck on a challenge question
                $mfaAnswerIdx = Array($mbrMfaQuest['challenge']);
            } else {
            // * Not stuck but still random, just check what they posted
                $mfaAnswerIdx = array_keys($mfapost);
            }
        } else {
            // * Not random, check all questions from db
            $mfaAnswerIdx = array_keys($aryMfaAnswers);
        }

        // ** NOW EVALUATE THE ANSWERS
        # for each id in $mfaAnserIdx
        # intersect should be with posted answer set, not db answer set?

        foreach (array_intersect_key($aryMfaAnswers, array_flip($mfaAnswerIdx)) as $qid => $qanswer) {
            if (strtolower(trim($qanswer)) != strtolower(trim(HCU_array_key_value("MFA_$qid",$inPost)))) {
                $fail++;
                $failreason = $GLOBALS['MEM_LOGIN_FAILED_QST'];

                throw new Exception(__LINE__ . " MFA $qid Failed",$failreason);# chall response mismatch
            }
        }
    } catch (Exception $e) {
      # logging handled at point of call - nothing to do here but fall through?
    }
    return (array($fail, $failreason));
}

function MFQ_resplist($posted) {
    # examines the (sanitized!) array of posted values
    # returns list of MFA_ excluding MFA_E (email)
    $mfalist = array();
    foreach (array_keys($posted) as $rkey) {
        $m = strpos($rkey, 'MFA_');
        if ($m !== FALSE && $m == 0 && $rkey !== 'MFA_E') {
//            $mfalist[] = array('cqid'=>substr($rkey,4),'cqanswer'=>$posted[$rkey]);
            $cqid = substr($rkey,4);
            $mfalist[$cqid] = $posted[$rkey];
        }
    }
    return ($mfalist);
}

function MFQ_defined($posted) {
    # returns a count of MFA_* challenge question responses
    # in (sanitized) array of posted values
    $mfa = 0;
    foreach (array_keys($posted) as $rkey) {
        $m = strpos($rkey, 'MFA_');
        if ($m !== FALSE && $m == 0) {
            $mfa++;
        }
    }
    return ($mfa);
}

function ANS_list($arr) {
    $anslist = array();
    foreach (array_keys($arr) as $rkey) {
        $m = strpos($rkey, 'ANS_');
        if ($m !== FALSE && $m == 0) {
            $anslist[] = substr($rkey, 4);
        }
    }
    return ($anslist);
}

function Return_ResponseOK($CU, $MEMBER, $UID, $SENDKEY, $MESSAGE) {
# was sending <LASTUPDATE>" . $HB_ENV['lastupdate'] . "</LASTUPDATE>
# but it was always empty as HB_ENV is neither passed in nor global
# so took it out
# also a couple of the alert-related calls were using an 'OFXPOST' tag at the top
# but I made them all consistent

    $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO', 'MESSAGE'=> array('INFO' => $MESSAGE)),
            'DTSERVER' => date('YmdHis'),
            'MEMBER' => $UID );

    if (is_array($SENDKEY)) {
        foreach ($SENDKEY as $key => $value) {
            $reply_arr[$key] = $value;
        }
    }

    return $reply_arr;
}

function Return_AllowedUpdate($CU, $MEMBER, $UID, $HB_ENV) {

//    $apptoken = MakeUserkey($CU, $MEMBER, $UID);
    $apptoken = MakeSessionUserkey( $HB_ENV );

    $upd_grace = $HB_ENV['Ffremain'];
    $upd_wait = ($upd_grace == 0 ? "You must update your credentials now." :
            "You must update your credentials within the next $upd_grace login" . ($upd_grace == 1 ? '.' : 's.') );

    $reply_arr = array('STATUS' => array('CODE' =>3110,'SEVERITY' => 'INFO'),
                    'SREQ' => $HB_ENV['forceupdate'],
                    'UREQ' => $HB_ENV['requpdate'],
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $UID,
                    'USERKEY' => $apptoken );

    $reply_arr['ALLOWUPD'] = array();

    if ($HB_ENV['forceupdate'] != 0) {
        $reply_arr['ALLOWUPD']['UPDCANWAIT'] = $upd_grace;
        $reply_arr['ALLOWUPD']['UPDWAITPHRASE']=$upd_wait;
    }
    $reply_arr['ALLOWUPD']['PASSWORD'] = array(
    'ALLOW' => (($HB_ENV['allowupdate'] & 1) ? "YES" : "NO"),
    'REQ' =>  (($HB_ENV['forceupdate'] & 1) ? "YES" : "NO"));
    $reply_arr['ALLOWUPD']['EMAIL'] = array(
    'ALLOW' => (($HB_ENV['allowupdate'] & 2) ? "YES" : "NO"),
    'REQ' =>  (($HB_ENV['forceupdate'] & 2) ? "YES" : "NO"));
    $reply_arr['ALLOWUPD']['CHALLENGE'] = array(
    'ALLOW' => (($HB_ENV['allowupdate'] & 4) ? "YES" : "NO"),
    'REQ' =>  (($HB_ENV['forceupdate'] & 4) ? "YES" : "NO"));
    $reply_arr['ALLOWUPD']['USERALIAS'] = array(
    'ALLOW' => (($HB_ENV['allowupdate'] & 8) ? "YES" : "NO"),
    'REQ' =>  (($HB_ENV['forceupdate'] & 8) ? "YES" : "NO"));
    $reply_arr['ALLOWUPD']['PHONE'] = array(
    'ALLOW' => (($HB_ENV['allowupdate'] & 16) ? "YES" : "NO"),
    'REQ' =>  (($HB_ENV['forceupdate'] & 16) ? "YES" : "NO"));

    return $reply_arr;
}

function Return_ReqUpdate($CU, $MEMBER, $UID, $HB_ENV, $SENDKEY) {
    $dbh = $HB_ENV['dbh'];
    $MC = $HB_ENV['MC'];

//    $apptoken = MakeUserkey($CU, $MEMBER, $UID);
    $apptoken = MakeSessionUserkey( $HB_ENV );

    # forceupdate 1 = reset password
    # forceupdate 4 = reset security w/ challenge questions
    # forceupdate 16 = reset security w/ access codes
    # send updRemember if reset pwd or reset security is set
    $upd_remember = $HB_ENV['forceupdate'] & 21;
    $upd_grace = $HB_ENV['Ffremain'];
    $upd_wait = ($upd_grace == 0 ? "You must update your credentials now." :
            "You must update your credentials within the next $upd_grace login" . ($upd_grace == 1 ? '.' : 's.') );

    $reply_arr = array('STATUS' => array('CODE' =>3100,'SEVERITY' => 'INFO'),
                    'SREQ' => $HB_ENV['forceupdate'],
                    'UREQ' => $HB_ENV['requpdate'],
                    'DTSERVER' => date('YmdHis'),
                    'MEMBER' => $HB_ENV['Uid'],
                    'USERKEY' => $apptoken );

    if (is_array($SENDKEY)) {
        foreach ($SENDKEY as $key => $value) {
            $reply_arr[$key] = $value;
        }
    }

    $reply_arr['REQUIREUPD'] = array();

    if ($HB_ENV['forceupdate'] != 0 && $HB_ENV['requpdate'] == 0) {
        $reply_arr['REQUIREUPD']['UPDCANWAIT'] = $upd_grace;
        $reply_arr['REQUIREUPD']['UPDWAITPHRASE']=$upd_wait;
    }
    if ($upd_remember) {
        $reply_arr['REQUIREUPD']['UPDREMEMBER']='Remember This Device';
    }
    $upd_req = array();

    if ((($HB_ENV['forceupdate'] & 4) == 4 && $HB_ENV['requpdate'] == 0) || ($HB_ENV['requpdate'] & 4) == 4) {
        # 2-factor and either force reset or not enough questions selected yet
        # Security Reset: send master list of challenge questions
        $upd_req = array('UPDPHRASEID' => 'CHALLENGE',
            'UPDCONFLABEL' => 'This confidence word is used to identify and prevent phishing attempts when you access home banking through the web.  It is not used in this app, but you are asked to set it now in case you later access your account through the web.',
            'UPDCONFIDENCE' => htmlentities($HB_ENV['confidence'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE),
            'UPDPHRASECOUNT' => $HB_ENV['cu_chgqst_count']);
        if ($HB_ENV['cu_chgqst_count'] > 0) {
            $upd_req['UPDPHRASELABEL'] = "Please select {$HB_ENV['cu_chgqst_count']} challenge questions";
            $upd_req['UPDCHOICELIST'] = array();
            $questlist = GetChallengeQuestions("DISPLAY", $dbh, $HB_ENV, $MC);
            foreach ($questlist as $QstValue) {
                $upd_req['UPDCHOICELIST'][]['CHOICEITEM'] = array('CQID' => $QstValue['cqid'],
                         'CQTEXT' => htmlentities($QstValue['display'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));
            }
            if (($HB_ENV['requpdate'] & 4) == 4) {
                # 'on-demand' update - send current selected questions/responses
                $upd_req['CURRSELECTED'] = array();
                foreach ($HB_ENV['MFA']['answers'] as $quest_id => $quest_resp) {
                    $upd_req['CURRSELECTED'][]['SELECTEDITEM'] = array('CQID' => $quest_id,
                             'CQRESP' => htmlentities($quest_resp, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));
                }
            }
        }
        $reply_arr['REQUIREUPD'][]['REQUPD'] = $upd_req;
    }

    if ((($HB_ENV['forceupdate'] & 1) == 1 && $HB_ENV['requpdate'] == 0) || ($HB_ENV['requpdate'] & 1) == 1) {
        # Password

      $noticesAry = Get_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC'], "P", "pwdRules", false);
      $hasRules = false;

      if ( $noticesAry["status"]["code"] == "000" && $noticesAry["notice"][0]["notice_id"] ) {
        $hasRules = true;
        $helpdoc = $noticesAry["notice"][0]["notice_linktarget"];
      }
        $pwdRequires = Get_PwdRules($dbh, $HB_ENV);
        $upd_req = array('UPDPHRASEID' => 'PASSWORD',
            'UPDPHRASELABEL' => 'Please select a new password.',
            'PWDRULESLINK' => ($hasRules ? htmlentities($helpdoc, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE) : ''),
            'PWDRULESLABEL' => ($hasRules ? 'I have read the Recommended Password Guidelines' : ''),
            'PWDADVLABEL' => ($hasRules ? 'Recommended Guidelines' : ''));
        foreach ($pwdRequires as $pwdkey => $pwdval) {
            $pwdkey = strtoupper($pwdkey);
            $upd_req['PWDREQUIRES'][$pwdkey] = $pwdval;
        }
//        if ($pwdRequires['spec'] > 0) {
        $pwdSpecChar = Get_PwdSpecialCharacters();
        $upd_req['PWDREQUIRES']['PWDSPECIALCHARS'] = htmlspecialchars($pwdSpecChar, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
//        }

        $reply_arr['REQUIREUPD'][]['REQUPD'] = $upd_req;
    }
    if ((($HB_ENV['forceupdate'] & 6) > 0 && $HB_ENV['requpdate'] == 0) || ($HB_ENV['requpdate'] & 2) == 2) {
        # verify email is set or email is empty,
        # or we are sending the CHALLENGE set so include email with it (apps treat email as extra challenge question)
        $upd_req = array('UPDPHRASEID' => 'EMAIL',
                    'UPDPHRASELABEL' => 'Please provide your email address.',
                    'CURRENTEMAIL' =>  htmlentities($HB_ENV['Ml'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE),
                    'CURRENTOPTIN' => $HB_ENV['egenl_flag'],
                    'OPTIN_PHRASE' => $MC->msg('Yes Email List'));

        $reply_arr['REQUIREUPD'][]['REQUPD'] = $upd_req;
    }

    if ((($HB_ENV['forceupdate'] & 8) == 8 && $HB_ENV['requpdate'] == 0) || ($HB_ENV['requpdate'] & 8) == 8) {
        # user_alias
        $maymust = (($HB_ENV['Fset2'] & $GLOBALS['CU2_ALIAS_REQ']) == $GLOBALS['CU2_ALIAS_REQ'] ? 'must' : 'may');
        $aliaslabel = $MC->combo_msg('Username Set', 0, '#MAYMUST#', "$maymust");
        $upd_req = array('UPDPHRASEID' => 'USERALIAS',
                    'UPDPHRASEREQ' => ($HB_ENV['alias'] == 'NONE' ? 'NO' : $HB_ENV['alias']),
                    'UPDPHRASELABEL' => htmlentities($aliaslabel, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));
        if (($HB_ENV['requpdate'] & 8) == 8) {
            # 'on-demand' update - send current user alias
            $upd_req['CURRENTALIAS'] =  htmlentities($HB_ENV['useralias'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
        }
        $reply_arr['REQUIREUPD'][]['REQUPD'] = $upd_req;
    }
    if ((($HB_ENV['forceupdate'] & 16) == 16 && $HB_ENV['requpdate'] == 0) || ($HB_ENV['requpdate'] & 16) == 16) {

        $upd_req = array('UPDPHRASEID' => 'PHONES',
            'UPDCONFLABEL' => 'This confidence word is used to identify and prevent phishing attempts when you access home banking through the web.  It is not used in this app, but you are asked to set it now in case you later access your account through the web.',
            'UPDCONFIDENCE' => htmlentities($HB_ENV['confidence'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));
        # add array entries for phone numbers
        $upd_req['MOBILE']['MAXLIMIT'] = MAX_PHONES;
        $upd_req['MOBILE']['UPDMBLLABEL'] = $MC->msg('TXT Enabled');
        $phones = GetUserPhones($CU, $UID, $HB_ENV);
        if (is_array($phones['mobile'])) {
            foreach ($phones['mobile'] as $ph => $phnum) {
//                 * strip the punctuation
                $upd_req['MOBILE'][]['PHONE'] = preg_replace('/\D/', '', $phnum);
            }
        }
        $reply_arr['REQUIREUPD'][]['REQUPD'] = $upd_req;
    }

    return $reply_arr;
} // end Return_ReqUpdate

function MakeUserkey($CU, $MEMBER, $CAUTH) {
    global $apptokenkey;
    $appexpires = time() + 900; # 15 minutes
    $apphash = MD5($apptokenkey . MD5(join(':', array($apptokenkey, $appexpires, $CU, $MEMBER, $CAUTH))));
    #   $mytoken="H=$hash&E=$expires&A=$cauth_member&C=$current_member";

    $apptoken = urlencode("H=$apphash&E=$appexpires&A=$MEMBER&C=$CAUTH");
    return $apptoken;
}

function CheckUserkey($CU, $USERKEY, $apptokenkey) {

    try {
    $result = array('Status' => array('Code' =>0, 'Message' => 'Success'));

    $apptokarr = array();
    parse_str(urldecode($USERKEY), $apptokarr);

    if ($apptokarr['E'] < time()) {
        throw new Exception("Invalid Credentials (Expired Token) " .  __LINE__,15510);
    }

    if (is_null($apptokarr['E']) || is_null($apptokarr['A']) || is_null($apptokarr['H'])) {
        throw new Exception("Invalid Credentials (Partial Token) " . __LINE__,15510);
    }
    # if no C= value, assume oldstyle userkey
    # and set member as A= value so hash works
    # for odyssey A & C are swapped
    # A is Uid, C is primary account

    if (is_null($apptokarr['C'])) {
        $CAUTH = $apptokarr['A'];
    } else {
        $CAUTH = $apptokarr['C'];
    }
    $MEMBER = $apptokarr['A'];
    $EXPIRES = $apptokarr['E'];
    $hash = MD5($apptokenkey .
        MD5(join(':', array($apptokenkey, $EXPIRES, $CU, $MEMBER, $CAUTH))));
    if ($apptokarr['H'] != $hash) {
        throw new Exception("Invalid Credentials (Corrupted Token) " . __LINE__,15510);
    }
    } catch (Exception $e) {
        $result = array('Status' => array('Code' => $e->getCode(), 'Message' => 'Failed ' . $e->getMessage()));
    }
    return $result;
} // end CheckUserkey

/* Build a session token for subsequent validation. The session token is the same value
 * the desktop ticket cookie uses.
 */
function MakeSessionUserkey( $pHBEnv ) {
global $gSavedUserkey;

  $now = time();
  $newCtime = $now;
  $newCe = $now + $pHBEnv['SYSENV']['ticket']['expires'];

  $newSet = "Ctime={$newCtime}&Ce={$newCe}";

  return urlencode( BuildSessionTicketStr($pHBEnv, $gSavedUserkey, $newSet ) );
} // end MakeSessionUserkey

/* Check the given session token for validity. The session token has a lot of information
 *  parts, so return that as an array. This is similar to Check_Member_Credentials for the
 *  desktop.
 */
function CheckSessionUserkey( $pHBEnv, $sessionStr ) {
  try {
    $result = array('Status' => array('Code' =>0, 'Message' => 'Success'));

    // See if need another decode because the RDC File Upload comes in encoded.
    // This finds the "Cu=" string that is encoded, which should always be somewhere in the cookie string.
    if ( strpos( $sessionStr, "Cu%3D" ) !== false ) {
        $sessionStr = urldecode( $sessionStr );
    }

    $returnArray = CheckSessionTicket( $pHBEnv, $sessionStr );
    if ( !is_array( $returnArray['result'] ) ) {

      // THE SECURITY VERIFICATION FAILED!
      throw new Exception( "Session Expired", 15510 );
    }

    $result["data"] = $returnArray["result"];
  } catch (Exception $e) {
    $result = array('Status' => array('Code' => $e->getCode(), 'Message' => 'Failed ' . $e->getMessage()));
  }

  return $result;
} // end CheckSessionUserkey

function CleanWordQuotes($instring) {
    /**
      # try to clean up the funky quote characters cut-n-paste from MS Word
     * orignal code had the following converions:
     *     char codes    entity codes
     * �? 212 & 145 to 8216 curly left single quote
     * �? 213 & 146 to 8217 apostrophe, curly right single quote
     * ⤽ 210 & 147 to 8220 curly left double quote
     * ⤝ 211 & 148 to 8221 curly right double quote
     * �? 209 & 151 to 8212 em dash
     * �? 208 & 150 to 8211 en dash
     * �? 201 & 133 to 8230 ellipsis
     *
     * replacing with character codes didn't seem to work
     * android showed the funky 'a' values above instead of expected char
     * maybe due to ISO-8859 vs UTF-8 issues?
     * replaced with simple ascii instead, and that appears to work
     */
    $search = array(
        chr(145),
        chr(146),
        chr(147),
        chr(148),
        chr(151),
        chr(150),
        chr(133),
        "\342\200\234",
        "\342\200\235"
    );

    $replace = array(
        '\'',
        '\'',
        '"',
        '"',
        '-',
        '-',
        '&#8230;',
        '"',
        '"'
    );

    $instring = str_replace($search, $replace, $instring);
    return $instring;
}

function Load_HB_ENV($dbh, $CU, $MEMBER, &$HB_ENV, $CFGFLAG=0) {
    // ** First thing is First Check the username
    $username = trim($MEMBER);
    $live = $HB_ENV['live'];

    # on first (method MFA) login, MEMBER will have username
    # after that, (method SSO) MEMBER will have USERID

//   if ($HB_ENV['AuthMode'] == 'MFQ') {
        # AuthMode=MFQ Multi-factor w/questions
        $qby = "cuuser.user_name ilike '" . prep_save($MEMBER) . "' ";
//    } else {
//        # AuthMode=SSO w/Userkey
//        $qby = "cuuser.user_id = $MEMBER ";
//    }


      // ** QUERY THE USER INFORMATION
      $sqluser = "SELECT cuuser.user_id as user_id, trim(cuuser.user_name) as user_name,
                trim(cuuser.passwd) as password, forcechange, forceremain, failedremain,
                pwchange, trim(email) as email, egenl_flag, trim(confidence) as confidence,
                cuuser.user_id as cuuser_id,
                cuuser.group_id as cuuser_group_id, priorlogin, failedlogin, msg_tx,
                userflags & {$GLOBALS['MEM_FORCE_RESET']}::int4 as mem_force_reset, userflags,
                histdays, gracelimit, trmemomaxlen, cuadmin.tz, mfaquest, primary_account

                  FROM {$CU}user as cuuser
                  JOIN cuadmin on cuadmin.cu = '" . prep_save($CU) . "'
                  WHERE $qby ";

      $mbr_sth = db_query($sqluser, $dbh);
    if (db_num_rows($mbr_sth) == 0) {
        $insflag = 1;
    } else {
        $insflag = 0;
        $drow = db_fetch_array($mbr_sth, 0);

    }

    $drow = db_fetch_array($mbr_sth, 0);
    $HB_ENV['Cu'] = $CU;
    $HB_ENV['cu'] = $CU;
    $HB_ENV['chome'] = strtolower($CU);
    $HB_ENV['Uid'] = $drow['user_id'];
    $HB_ENV['Cn'] = $drow['user_name'];
    $HB_ENV['username'] = $drow['user_name'];
    $HB_ENV['user_name'] = $drow['user_name'];
    $HB_ENV['confidence'] = $drow['confidence'];
//    $HB_ENV['Ml'] = urlencode($drow['email']);
    $HB_ENV['Ml'] = $drow['email'];
    $HB_ENV['savemail'] = $drow['email'];
    $HB_ENV['egenl_flag'] = urlencode($drow['egenl_flag']);
    $HB_ENV['password'] = $drow['password'];
    $HB_ENV['userflags'] = $drow['userflags'];
    $HB_ENV['failedremain'] = $drow['failedremain'];
    $HB_ENV['Ffchg'] = $drow['forcechange'];
    $HB_ENV['Ffremain'] = $drow['forceremain'];
    $HB_ENV['dbforceremain'] = $drow['forceremain'];
    $HB_ENV['Ffreset'] = (is_null($drow['mem_force_reset']) ? 0 : $drow['mem_force_reset']);
//    $HB_ENV['Fmsg_tx'] = ($drow['msg_tx'] | $CFGFLAG); # this would add any CFGFLAG passed to msg_tx only
    $HB_ENV['Fmsg_tx'] = (is_null($drow['msg_tx']) ? 0 : $drow['msg_tx']);
    $HB_ENV['cfgflag'] = $CFGFLAG; # set cfgflag if CFGFLAG if passed
    $HB_ENV['Fverifyml'] = ($drow['msg_tx'] & 512);
    # mammoth data calls use Clw; odyssey switched to livewait so define both
    $HB_ENV['Clw'] = ((is_null($HB_ENV['livewait']) || $HB_ENV['livewait'] == 0) ? 300 : $HB_ENV['livewait']);
    $HB_ENV['lastupdate'] = (empty($drow['lastupdate']) ? "Unknown" : urlencode(trim($drow['lastupdate'])));
    $HB_ENV['pwchange'] = (is_null($drow['pwchange']) ? date('Ymd') : $drow['pwchange']);
//    $HB_ENV['employee'] = $drow['employee'];
    $HB_ENV['HCUPOST'] = array(); # set empty parameter array
    if ($HB_ENV['flagset2'] & $GLOBALS['CU2_ALIAS_REQ']) {
        $alias = 'REQUIRE';
    } else {
        $alias = 'ALLOW';
    }
//    } elseif ($HB_ENV['flagset2'] & $GLOBALS['CU2_ALIAS_OK']) {
//        $alias = 'ALLOW';
//    } else {
//        $alias = 'NONE';
//    }
    $HB_ENV['alias'] = $alias; # this shouldn't be needed - oh but it is
                               # alias is always allowed
                               # required means must start with non-digit
    $HB_ENV['Fset'] = $HB_ENV['flagset'];
    $HB_ENV['Fset2'] = $HB_ENV['flagset2'];
    $HB_ENV['Fset3'] = $HB_ENV['flagset3'];

      // * Create the MFA Quest Array (or set empty if Legacy, which shouldn't happen in Odyssey...)
    $HB_ENV['MFA'] = ($HB_ENV['cver'] == 'L' ? array() : HCU_MFADecode(HCU_JsonDecode($drow['mfaquest'])));
    $HB_ENV['mfaquest'] = $drow['mfaquest'];
    $HB_ENV['savecqid'] = $HB_ENV['MFA']['challenge'];
    $HB_ENV['chcount'] = $HB_ENV['MFA']['mfacount'];

    $FORCEUPDATE = 0;
    if ($HB_ENV['Ffchg'] == 'Y') {
        $FORCEUPDATE += 1; #password
    }
    if ($HB_ENV['Fverifyml'] == 512 || $HB_ENV['Ml'] == '') {
        $FORCEUPDATE += 2; # email
    }

    if ( intval($HB_ENV['flagset3'] & $GLOBALS['CU3_MFA_AUTHCODE']) == 0 &&
        ( $HB_ENV['Ffreset'] == 2  || $HB_ENV['chcount'] < $HB_ENV['cu_chgqst_count'] ) ) {
            $FORCEUPDATE += 4; #challenge questions
    }

    if (($HB_ENV['flagset2'] & $GLOBALS['CU2_ALIAS_REQ']) && !Check_Member_UseAlias($HB_ENV['user_name'])) {
        $FORCEUPDATE += 8;
    }

    if ( intval($HB_ENV['flagset3'] & $GLOBALS['CU3_MFA_AUTHCODE']) > 0 && $HB_ENV['Ffreset'] == 2   ) {
            $FORCEUPDATE += 16; #phone numbers
    }

    $HB_ENV['forceupdate'] = $FORCEUPDATE;
    $HB_ENV['allowupdate'] = 11; # password, email, and user_name update always allowed
    $HB_ENV['allowupdate'] += (intval($HB_ENV['flagset3'] & $GLOBALS['CU3_MFA_AUTHCODE']) == 0 ? 4 : 0); # can't update Challenge Questions if SAC in use
    $HB_ENV['allowupdate'] += (intval($HB_ENV['flagset3'] & $GLOBALS['CU3_MFA_AUTHCODE']) == 0 ? 0 : 16); # can only update contact phone if SAC in use
#
    $HB_ENV['requpdate'] = 0; # assume at first this is not a 'getsettings' request

    if ( $HB_ENV['failedremain'] <= 0 ||
        ( ($HB_ENV['forceupdate'] & 29) > 0 && $HB_ENV['Ffremain'] <= 0 )
    ) {

    $HB_ENV['lockedacct'] = 1;
} else {
    $HB_ENV['lockedacct'] = 0;
}

# eventually this will come from a new column in cuadmin
# but for now....
    $HB_ENV['AppTimeout'] = intval($HB_ENV['SYSENV']['ticket']['expires'] * .8);
    $priorLogin = (trim(HCU_array_key_value('priorlogin',$drow))=='' ? 'None' : $drow['priorlogin']);

    $HB_ENV['Fplog'] = ($priorLogin == 'None' ? '' : (strftime("%D %R", mktime(
                    substr($priorLogin, 11, 2), substr($priorLogin, 14, 2), substr($priorLogin, 17, 2), substr($priorLogin, 5, 2), substr($priorLogin, 8, 2), substr($priorLogin, 0, 4)))));
    $failedlogin = (trim(HCU_array_key_value('failedlogin',$drow))=='' ? 'None' : $drow['failedlogin']);
    $HB_ENV['Fflog'] = ($failedlogin == 'None' ? '' : (strftime("%D %R", mktime(
                    substr($failedlogin, 11, 2), substr($failedlogin, 14, 2), substr($failedlogin, 17, 2), substr($failedlogin, 5, 2), substr($failedlogin, 8, 2), substr($failedlogin, 0, 4)))));
    // needed for building up URLs for webviews
    $HB_ENV["cuquery"] = http_build_query( array( "cu" => $CU ) );

    $tz = trim( HCU_array_key_value( "tz", $drow ) );
    $HB_ENV['tz'] = $tz == "" ? "US/Mountain" : ((strpos($tz,"/") === false ) ? "US/$tz" : $tz);
}

function fullFeed($dbh, $HB_ENV, $DTSTART, $DTEND, $BALONLY, $SENDAS, $KEYACCTID, $recent, $SENDKEY) {

try {
# gen OFX
    if (empty($DTSTART) || !sqlmdy($DTSTART)) {
        throw new Exception("Invalid Start Date $DTSTART", 2090);
    } else {
        $sqlstart = sqlmdy($DTSTART);
    }

    if (!empty($DTEND) && !sqlmdy($DTEND)) {
        throw new Exception('Invalid End Date', 2090);
    } else {
        $sqlend = $DTEND;
    }
    $sqlnone = date("Ymd", time() + (24 * 60 * 60)); # tomorrow

    $balances = Get_Balances($dbh, $HB_ENV);

    $expires = mktime(date("H"), date("i"), date("s"), date("m") + 3, date("d"), date("Y"));
//    $apptoken = MakeUserkey($HB_ENV['Cu'], $HB_ENV['username'], $HB_ENV['Uid']);
    $apptoken = MakeSessionUserkey( $HB_ENV );
    $cookiename = Return2FactorName($HB_ENV['Cu'], Get2FactorKeyString(), trim($HB_ENV['Cn']));

    $now = date('YmdHis');

    $postedDate = HCU_array_key_value("lastupdate", $HB_ENV);
    if ( $postedDate != "Unknown" && $postedDate != 1 && strlen( $postedDate ) > 0 ) {
        $cuDateTime = new DateTime( $postedDate );
        $cuDateTime->setTimezone(new DateTimeZone($HB_ENV["tz"]));
        $displayCUTime = $cuDateTime->format("m/d/Y g:ia T");
    } else {
        $displayCUTime = $postedDate;
    }


    // note: $HB_ENV["lastupdate"] is updated in Get_Balances()
    $reply_arr = array('STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'),
        'DTSERVER' => date('YmdHis'),
        'LASTUPDATE' => $displayCUTime,
        'LOGINPRIOR' => $HB_ENV["Fplog"],
        'LOGINFAIL' => $HB_ENV["Fflog"],
        'MEMBER' => $HB_ENV['Uid'],
        'SELECTED_MEMBER' => $HB_ENV['Uid'],
        'USERKEY' => $apptoken,
        'TIMEOUT' => $HB_ENV['AppTimeout']);
    if (HCU_array_key_value('stale',$HB_ENV) == 1) {
        $reply_arr['STALE'] = 'YES';
    }

    if (is_array($SENDKEY)) {
        foreach ($SENDKEY as $key => $value) {
            $reply_arr[$key] = $value;
        }
    }

    $featureaccts = array();
    foreach (array('ES','BP','RDC') as $SPEEDBUMP_FEATURE) {
        $featureaccts[$SPEEDBUMP_FEATURE] = array();
        $accountList = Get_FeatureAccounts( $HB_ENV, $SPEEDBUMP_FEATURE, "A" );
        foreach ($accountList as $acct) {
            // get the account and hash together
            $encryptedAccount = hcu_encrypturl($acct, $HB_ENV['historyHash']);
            $accountInfo = array( "MBRACCT" => $acct, "ACCOUNT" => array( "MBRACCT" => $acct, "ENCRYPTED" => $encryptedAccount ) );
//            $featureaccts[$SPEEDBUMP_FEATURE][]['MBRACCT'] = $acct;
            $featureaccts[$SPEEDBUMP_FEATURE][] = $accountInfo;
        }
    }
    $reply_arr['FEATUREACCTS'] = $featureaccts;

//    $mbracctlist = Get_UserAccounts($dbh, $HB_ENV['Cu'], $HB_ENV['Uid']);
//    $reply_arr['MBRACCTLIST'] = array();
//
//    if(count($mbracctlist['data'])) {
//        foreach ($mbracctlist['data'] as $mbracct) {
//            $reply_arr['MBRACCTLIST'][]['MBRACCT'] = $mbracct;
//        }
//    }

    /*
     * all the conversion tools I have tried convert the raw xml into entity-encoded
     * so this is an ugly hack -- just put this distinctive string in,
     * and replace it with the actual menu text before sending the response
     *
     * this code, and the companion hack in send_response(), will be removed
     * once we can generate an app menu on the server side.
     */
//    if (HCU_array_key_exists('menu',$SENDKEY)) {
//        $reply_arr['menu'] = HCU_array_key_value('menu',$SENDKEY);
//    }

    if (count($balances['dp']) && (empty($KEYACCTID) || (!empty($KEYACCTID) && array_key_exists($KEYACCTID, $balances['dp'])))) {
# for each $balances['dp'] Get_History & print
        foreach ($balances['dp'] as $balkey => $balinfo) {
            if ((!empty($KEYACCTID)) && $balkey != $KEYACCTID) {
                continue;
            }
            // filter out any not allowing view balances
            if ( !HCU_array_key_value('view_balances', $balinfo) ) {
                continue;
            }

            $itm_arr = array();
            $desc = htmlspecialchars($balinfo['description'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
            $displaydesc = htmlspecialchars($balinfo['displaydesc'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
            $atype = ($balinfo['certnumber'] == "0" ? $balinfo['accounttype'] : "{$balinfo['accounttype']}_{$balinfo['certnumber']}");
            $atype = htmlspecialchars(trim($atype), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);

            switch ($balinfo['deposittype']) {
                case "Y":
                    $acttype = "CHECKING";
                    break;
                case "C": # Certificates
                    $acttype = "INVESTMENT";
                    break;
                case "I": # IRA accounts
                    $acttype = "RETIREMENT";
                    break;
                case "N":
                case "S":
                    $acttype = "SAVINGS";
                    break;
                default:
                    $acttype = "";
            }

            $itm_arr['STMTTRNRS'] = array('TRNUID' => 0,
            'STATUS' => array('CODE' =>0,'SEVERITY' => 'INFO'));

            $itm_arr['STMTTRNRS']['STMTRS'] = array('CURDEF' => 'USD',
            'BANKACCTFROM' => array(
            'BANKID' => $HB_ENV['rt'],
            'ACCTID' => $balkey,
            'ACCTTYPE' => $acttype,
            'DESCRIPTION' => $desc));
            if ("$displaydesc" > '') {
                $itm_arr['STMTTRNRS']['STMTRS']['BANKACCTFROM']['DISPLAYDESC'] =$displaydesc;
            }

            if (!$BALONLY) {

                $histXML = dpHistXML($dbh, $HB_ENV, $balkey, $balinfo, $sqlstart, $sqlend, $recent);
                if ($histXML['Status'] !== 'Success') {
                    throw new Exception('DP History Error', 7601); # couldn't get dp history
                } else {
                    $itm_arr['STMTTRNRS']['STMTRS']['BANKTRANLIST'] = $histXML['HISTarr'];
                }
            } else {
                $itm_arr['STMTTRNRS']['STMTRS']['BANKTRANLIST'] = array(
                'DTSTART' => "${sqlnone}000000",
                'DTEND' => "${sqlnone}000000");
            }

            $itm_arr['STMTTRNRS']['STMTRS']['LEDGERBAL'] = array(
                'BALAMT' => $balinfo['currentbal'],
                'DTASOF' =>$now);
            if (($HB_ENV['Fset'] & $GLOBALS['CU_SHOWAVAILABLE']) == $GLOBALS['CU_SHOWAVAILABLE']) {
                $itm_arr['STMTTRNRS']['STMTRS']['AVAILBAL'] = array(
                    'BALAMT' => $balinfo['availablebal'],
                    'DTASOF' =>$now);
            }

            $itm_arr['STMTTRNRS']['STMTRS']['EXTRAINFO'] = array(
                'DTASOF' => $now,
                'KEYACCTID' => $balkey,
                'MBRACCT' => $balinfo['accountnumber'],
                'YTDINTEREST' => $balinfo['ytdinterest'],
                'LYRINTEREST' => $balinfo['lastyrinterest']);
            if ($acttype == "CHECKING") {
                $itm_arr['STMTTRNRS']['STMTRS']['EXTRAINFO']['MICRACCOUNT'] = $balinfo['micraccount'];
            }
            if (($HB_ENV['Fset2'] & $GLOBALS['CU2_SHOWHOLD'])== $GLOBALS['CU2_SHOWHOLD']) {
                $itm_arr['STMTTRNRS']['STMTRS']['EXTRAINFO']['HOLDTOTAL'] = $balinfo['holdtotal'];
            }
            if (($HB_ENV['Fset2'] & $GLOBALS['CU2_SHOWPEND'])== $GLOBALS['CU2_SHOWPEND']) {
                $itm_arr['STMTTRNRS']['STMTRS']['EXTRAINFO']['PENDTOTAL'] = $balinfo['pendtotal'];
            }
            # parse through each key &, if not already loaded into result, push it in there
            foreach ($balinfo as $bkey => $bval) {
                switch ($bkey) {
                    case 'description':
                    case 'displaydesc':
                    case 'certnumber':
                    case 'deposittype':
                    case 'currentbal':
                    case 'availablebal':
                    case 'accountnumber':
                    case 'ytdinterest':
                    case 'lastyrinterest':
                    case 'micraccount':
                    case 'holdtotal':
                    case 'pendtotal':
                        break;
                    default:
                        $upperkey = strtoupper($bkey);
                        $itm_arr['STMTTRNRS']['STMTRS'][$upperkey] = htmlspecialchars($bval, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                        break;
                }
            }
            $reply_arr['BANKMSGSRSV1'][] = $itm_arr;

        }
    }

#
# If CU2_SPEC18, try to get credit card loans
    if (($HB_ENV['Fset2'] & $GLOBALS['CU2_SPEC18']) == $GLOBALS['CU2_SPEC18']) {

        if (HCU_array_key_exists('cc',$balances) && count($balances['cc']) && (empty($KEYACCTID) || (!empty($KEYACCTID) && array_key_exists($KEYACCTID, $balances['cc'])))) {

            foreach ($balances['cc'] as $balkey => $balinfo) {
                if ((!empty($KEYACCTID)) && $balkey != $KEYACCTID) {
                    continue;
                }
                // filter out any not allowing view balances
                if ( !HCU_array_key_value('view_balances', $balinfo) ) {
                    continue;
                }

                $nextduedate = $balinfo['nextduedate'];
                $creditlimit = $balinfo['creditlimit'];

                $desc = $balinfo['description'];
                $desc = htmlspecialchars("$desc", ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                $displaydesc = $balinfo['displaydesc'];
                $displaydesc = htmlspecialchars("$displaydesc", ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                $loan = $balinfo['loan'];
                $balance = $balinfo['currentbal'];
                $creditlimit = $balinfo['creditlimit'];
                $available = $creditlimit - $balance;
                $available = ($available < 0 ? "" : $available);
                $cur_avail = (($HB_ENV['Fset2'] & $GLOBALS['CU2_CALL_CCAVAIL']) == $GLOBALS['CU2_CALL_CCAVAIL'] ?
                            "Call" : $available);


                # open new loan set
            $itm_arr = array();

            $itm_arr['CCSTMTTRNRS']['CCSTMTRS'] = array('CURDEF' => 'USD',
            'CCACCTFROM' => array(
            'ACCTID' => $balkey,
            'DESCRIPTION' => $desc));
            if ("$displaydesc" > '') {
                $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['CCACCTFROM']['DISPLAYDESC'] =$displaydesc;
            }
            if (trim($balinfo['hisinfo']) > '' && strtolower(trim($balinfo['hisinfo'])) != 'homecu') {
                $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['CCACCTFROM']['HISTORYURL'] = urlencode($balinfo['hisinfo']);
            }

            if (!$BALONLY) {
                $histXML = ccHistXML($dbh, $HB_ENV, $balkey, $balinfo, $sqlstart, $sqlend, $recent);
                if ($histXML['Status'] !== 'Success') {
                    throw new Exception('CC History Error', 7602); # couldn't get cc history
                } else {
                $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['BANKTRANLIST'] = $histXML['HISTarr'];
                }
            } else {
                $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['BANKTRANLIST'] = array(
                'DTSTART' => "${sqlnone}000000",
                'DTEND' => "${sqlnone}000000");
            }

            $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['LEDGERBAL'] = array(
                'BALAMT' => $balance,
                'DTASOF' =>$now);
            if ($cur_avail > 0) {
            $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['AVAILBAL'] = array(
                'BALAMT' => $cur_avail,
                'DTASOF' =>$now);
            }
            $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['EXTRAINFO'] = array(
                'DTASOF' => $now,
                'KEYACCTID' => $balkey,
                'MBRACCT' => $balinfo['accountnumber']);

            if ($HB_ENV['live'] && ($HB_ENV['Fset2'] & $GLOBALS['CU2_SHOWCCSB']) == $GLOBALS['CU2_SHOWCCSB'] && ($HB_ENV['Fset2'] & $GLOBALS['CU2_CC18NOINFO']) != $GLOBALS['CU2_CC18NOINFO']) {
                $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['EXTRAINFO']['STMNTBAL'] = HCU_array_key_value('payoff',$balinfo);
            }
            $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['EXTRAINFO']['PAYAMOUNT'] = $balinfo['paymentamount'];

            if (($HB_ENV['Fset'] & $GLOBALS['CU_HIDELOANDATE']) != $GLOBALS['CU_HIDELOANDATE']) {
                $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['EXTRAINFO']['NEXTDUE'] = $nextduedate;
            }
            if (HCU_array_key_exists("interestrate", $balinfo)) {
                $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['EXTRAINFO']['INTERESTRATE'] = $balinfo['interestrate'];
            }
                $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['EXTRAINFO']['CREDITLIMIT'] = $creditlimit;
                $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['EXTRAINFO']['YTDINTEREST'] = $balinfo['ytdinterest'];
                $itm_arr['CCSTMTTRNRS']['CCSTMTRS']['EXTRAINFO']['LYRINTEREST'] = $balinfo['lastyrinterest'];

                            # parse through each key &, if not already loaded into result, push it in there
            foreach ($balinfo as $bkey => $bval) {
                switch ($bkey) {
                    case 'nextduedate':
                    case 'creditlimit':
                    case 'description':
                    case 'displaydesc':
                    case 'loan':
                    case 'currentbal':
                    case 'creditlimit':
                    case 'hisinfo':
                    case 'accountnumber':
                    case 'payoff':
                    case 'paymentamount':
                    case 'interestrate':
                    case 'ytdinterest':
                    case 'lastyrinterest':
                        break;
                    default:
                        $upperkey = strtoupper($bkey);
                        $itm_arr['CCSTMTTRNRS']['CCSTMTRS'][$upperkey] = htmlspecialchars($bval, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                        break;
                }
            }

            $reply_arr['CREDITCARDMSGSRSV1'][] = $itm_arr;

            }
        }
    }

# try to get loans
    if ((HCU_array_item_count("ln", $balances) > 0) && (empty($KEYACCTID) || (!empty($KEYACCTID) && array_key_exists($KEYACCTID, $balances['ln'])))) {

        foreach ($balances['ln'] as $balkey => $balinfo) {
            if ((!empty($KEYACCTID)) && $balkey != $KEYACCTID) {
                continue;
            }
            // filter out any not allowing view balances
            if ( !HCU_array_key_value('view_balances', $balinfo) ) {
                continue;
            }

            $itm_arr = array();

            $balance = $balinfo['currentbal'];
            $loan = $balinfo['loan'];
            $desc = htmlspecialchars($balinfo['description'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
            $displaydesc = htmlspecialchars($balinfo['displaydesc'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
            $payoff = HCU_array_key_value('payoff',$balinfo);
            $nextduedate = $balinfo['nextduedate'];
            $creditlimit = $balinfo['creditlimit'];

            # open new loan set
            $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS'] = array('CURDEF' => 'USD',
            'LOANACCTFROM' => array(
            'LOANACCTID' => $balkey,
            'LOANACCTTYPE' => 'CONSUMER',
            'DESCRIPTION' => $desc));
            if ("$displaydesc" > '') {
                $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS']['LOANACCTFROM']['DISPLAYDESC'] =$displaydesc;
            }
            if (trim($balinfo['hisinfo']) > '' && strtolower(trim($balinfo['hisinfo'])) != 'homecu') {
                $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS']['LOANACCTFROM']['HISTORYURL'] = urlencode($balinfo['hisinfo']);
            }

            if (!$BALONLY) {
                $histXML = lnHistXML($dbh, $HB_ENV, $balkey, $balinfo, $sqlstart, $sqlend, $recent);
                if ($histXML['Status'] !== 'Success') {
                    throw new Exception('LN History Error', 7603); # couldn't get ln history
                } else {
                    $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS']['LOANTRANLIST'] = $histXML['HISTarr'];
                }
            } else {
                $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS']['LOANTRANLIST'] = array(
                'DTSTART' => "${sqlnone}000000",
                'DTEND' => "${sqlnone}000000");
            }
            $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS']['PRINBAL'] = array(
                'BALAMT' => $balance,
                'DTASOF' =>$now);

            $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS']['EXTRAINFO'] = array(
                'DTASOF' => $now,
                'KEYACCTID' => $balkey,
                'MBRACCT' => $balinfo['accountnumber'],
                'PAYOFF' => $payoff,
                'PAYAMOUNT' => $balinfo['paymentamount']);

            if (($HB_ENV['Fset'] & $GLOBALS['CU_HIDELOANDATE']) != $GLOBALS['CU_HIDELOANDATE']) {
                $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS']['EXTRAINFO']['NEXTDUE'] = $nextduedate;
            }

            if (HCU_array_key_exists("interestrate", $balinfo)) {
                $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS']['EXTRAINFO']['INTERESTRATE'] = $balinfo['interestrate'];
            }
            $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS']['EXTRAINFO']['CREDITLIMIT'] = $creditlimit;
            $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS']['EXTRAINFO']['YTDINTEREST'] = $balinfo['ytdinterest'];
            $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS']['EXTRAINFO']['LYRINTEREST'] = $balinfo['lastyrinterest'];

                            # parse through each key &, if not already loaded into result, push it in there
            foreach ($balinfo as $bkey => $bval) {
                switch ($bkey) {
                    case 'nextduedate':
                    case 'creditlimit':
                    case 'description':
                    case 'displaydesc':
                    case 'loan':
                    case 'currentbal':
                    case 'creditlimit':
                    case 'hisinfo':
                    case 'accountnumber':
                    case 'payoff':
                    case 'paymentamount':
                    case 'interestrate':
                    case 'ytdinterest':
                    case 'lastyrinterest':
                        break;
                    default:
                        $upperkey = strtoupper($bkey);
                        $itm_arr['LOANSTMTTRNRS']['LOANSTMTRS'][$upperkey] = htmlspecialchars($bval, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                        break;
                }
            }

            $reply_arr['LOANMSGSRSV1'][] = $itm_arr;

        }
    }
 } catch (Exception $e) {
    $code = $e->getCode();
    $message = $e->getMessage();

    $reply_arr = array('STATUS' => array('CODE' => $code, 'SEVERITY' => 'ERROR'),
    'MESSAGE'=> array('ERR' => htmlspecialchars($message, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE), 'ERRNO' => 999, 'ERRSTAT' =>'FAIL'));
}

//    send_response($reply_arr,$SENDAS);

    return $reply_arr;
} // end fullFeed

function dpHistXML($dbh, $HB_ENV, $balkey, $balinfo, $sqlstart, $sqlend, $recent) {
    try {
        $xmlResp = '';
        $reply_arr = array();
        $history = Get_History($dbh, $HB_ENV, $balkey, $sqlstart, $sqlend);
# opening tags for transaction list
        $reply_arr['DTSTART'] ="${sqlstart}000000";
        $reply_arr['DTEND'] ="${sqlend}235959";

        if ( HCU_array_key_exists( $balkey , $history)) {
            foreach ($history[$balkey] as $tnum => $detl) {
# process the list
                $itm_arr = array();

                $tranamount = $detl['amount'];
                $tranamount = str_replace(",", "", str_replace("$", "", $tranamount));
                $tranamount = sprintf("%.2f", $tranamount);
                $trbal = $detl['balance'];
                $trbal = str_replace(",", "", str_replace("$", "", $trbal));
                $trbal = sprintf("%.2f", $trbal);
                $check = (HCU_array_key_exists( 'checkno' , $detl) ? $detl['checkno'] : 0);
                $trandesc = $detl['description'];
                if ($trandesc < " " && $check != 0) {
                    $trandesc = "CHK";
                }
                $trandesc = (preg_replace("/<BR>/", " ", $trandesc));
                $trandesc = (preg_replace("/&nbsp;/", " ", $trandesc));
                $longdesc = htmlspecialchars($trandesc, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                $shortdesc = substr(htmlspecialchars($trandesc, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE), 0, 31);
                $shortdesc = preg_replace('/&[^;]*$/', '', $shortdesc);
                $shortdesc = (trim($shortdesc) == '' ? '.' : $shortdesc);

                if ($tranamount < 0) {
                    if ($balinfo['deposittype'] == 'Y' and $check != 0) {
                        $trntype = 'CHECK';
                    } else {
                        $trntype = 'DEBIT';
                    }
                } else {
                    $trntype = 'CREDIT';
                }
                $itm_arr['TRNTYPE'] = $trntype;
                $itm_arr['DTPOSTED'] = $detl['date'];
# DTUSER not needed for 211?
                $itm_arr['DTUSER'] = $detl['date'];
                $itm_arr['TRNAMT'] = $tranamount;
                $itm_arr['RUNBAL'] = $trbal;
                $itm_arr['FITID'] = $detl['traceno'];
                if ($balinfo['deposittype'] == 'Y' and $check != 0) {
                    $itm_arr['CHECKNUM'] = $check;
                    if (!empty($detl['ckitem']) && !empty($detl['ckhash'])) {
                        $itm_arr['CKITEM'] = $detl['ckitem'];
                        $itm_arr['CKHASH'] = $detl['ckhash'];
                    }
                }
                $itm_arr['NAME'] = $shortdesc;
                if (strlen($longdesc) > 0) {
                    $itm_arr['MEMO'] = $longdesc;
                }

                // $recent is in yyymmdd format
                $tranDate = preg_replace("/\D/", "", $detl['date'] );
                if ($tranDate < $recent) {
                    $reply_arr[]['STMTTRN']=$itm_arr;
                } else {
                    $reply_arr[]['RECENTTRN']=$itm_arr;
                }
            }
        }
# closing tags for transaction list

        if ($HB_ENV['live'] == 0) {
            $pending = Get_ReqDetails($dbh, $HB_ENV, $balkey);
# Get_ReqDetails returns txdesc  already UTF-encoded.  Problem?
            if ( HCU_array_key_exists( 'acctlist' , $pending) && HCU_array_key_exists( $balkey , $pending['acctlist']) ) {
                foreach ($pending['acctlist'][$balkey] as $tnum => $detl) {
# process the list
                    $itm_arr = array('TRACENO' => $detl['id'],
                        'DTREQUEST' => $detl['postdate'],
                        'TRNAMT' => $detl['amount'],
                        'TRNDESC' =>  htmlspecialchars($detl['txdesc'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));

                    $reply_arr['TXNPENDING'][]['REQUEST']= $itm_arr;
                }
            }
        }

        if (($HB_ENV['Fset2'] & $GLOBALS['CU2_SHOWPEND']) == $GLOBALS['CU2_SHOWPEND']) {
            $pending = Get_PendDetails($dbh, $HB_ENV, $balkey);
            if ( HCU_array_key_exists( $balkey , $pending)) {
                foreach ($pending[$balkey] as $tnum => $detl) {
# process the list
                    $itm_arr = array('TRACENO' => $detl['traceno'],
                        'DTREQUEST' => $detl['postdate'],
                        'TRNAMT' => $detl['amount'],
                        'TRNDESC' =>  htmlspecialchars($detl['description'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));

                    $reply_arr['TXNPENDING'][]['ACHWAREHOUSE'] = $itm_arr;
                }
            }
        }
        if (($HB_ENV['Fset2'] & $GLOBALS['CU2_SHOWHOLD']) == $GLOBALS['CU2_SHOWHOLD']) {
            $pending = Get_HoldDetails($dbh, $HB_ENV, $balkey);
            if ( HCU_array_key_exists( $balkey , $pending)) {
                foreach ($pending[$balkey] as $tnum => $detl) {
# process the list
                    $itm_arr = array('TRACENO' => $detl['traceno'],
                        'DTREQUEST' => $detl['postdate'],
                        'TRNAMT' => $detl['amount'],
                        'TRNDESC' =>  htmlspecialchars($detl['description'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));

                    $reply_arr['TXNPENDING'][]['PREAUTH'] = $itm_arr;
                }
            }
        }
                if (!HCU_array_key_exists('TXNPENDING',$reply_arr)) {
                    $reply_arr['TXNPENDING']=array();
                }

        $result = array('Status' => 'Success', 'HISTarr' => $reply_arr, 'XMLstr' => assocArrayToXML($reply_arr, 'BANKTRANLIST', 0));
    } catch (Exception $e) {
        $result = array('Status' => 'Failed ' . $e->getMessage(), 'HISTarr' => array(), 'XMLstr' => '');
    }
    return $result;
}

function ccHistXML($dbh, $HB_ENV, $balkey, $balinfo, $sqlstart, $sqlend, $recent) {
    try {
        $reply_arr = array();

        $xmlResp = '';
        $incchist = (trim(strtoupper($balinfo['hisinfo'])) == 'HOMECU' ? 1 : 0);

        if ($incchist) {
            $history = Get_History($dbh, $HB_ENV, $balkey, $sqlstart, $sqlend);
            $reply_arr['DTSTART'] ="${sqlstart}000000";
            $reply_arr['DTEND'] ="${sqlend}235959";

            if (count($history[$balkey])) {
                foreach ($history[$balkey] as $tnum => $detl) {

                    $itm_arr = array();

                    $principle = $detl['principal'];
                    $interest = $detl['interest'];

                    if ($principle < 0) {
                        $trntype = "DEBIT";
                    } else {
                        $trntype = "CREDIT";
                    }

                    $totalpay = $detl['totalpay'];
                    $trdesc = $detl['description'];
                    $date = $detl['date'];
                    $traceno = $detl['traceno'];
                    $longdesc = htmlentities($trdesc, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    $shortdesc = substr(htmlentities($trdesc, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE), 0, 31);
                    $shortdesc = preg_replace('/&[^;]*$/', '', $shortdesc);
                    $shortdesc = (trim($shortdesc) == '' ? '.' : $shortdesc);

# transaction data row
                    $itm_arr['TRNTYPE'] = $trntype;
                    $itm_arr['DTPOSTED'] = $detl['date'];
                    $itm_arr['TRNAMT'] = $totalpay;
                    if (($HB_ENV['Fset'] & $GLOBALS['CU_LNBALUNUSABLE']) != $GLOBALS['CU_LNBALUNUSABLE']) {
                        $itm_arr['RUNBAL'] = $detl['balance'];
                    }
                    $itm_arr['FITID'] = $traceno;
                    if (($HB_ENV['Fset'] & $GLOBALS['CU_SHOWLNTXNDESC']) == $GLOBALS['CU_SHOWLNTXNDESC']) {
                        $$itm_arr['NAME'] = $shortdesc;
                        $itm_arr['MEMO'] = $longdesc;
                    }

                    // $recent is in yyymmdd format
                    $tranDate = preg_replace("/\D/", "", $detl['date'] );
                    if ($tranDate < $recent) {
                        $reply_arr[]['STMTTRN']=$itm_arr;
                    } else {
                        $reply_arr[]['RECENTTRN']=$itm_arr;
                    }
                }
            }

            if ($HB_ENV['live'] == 0) {
                $pending = Get_ReqDetails($dbh, $HB_ENV, $balkey);
# Get_ReqDetails returns txdesc  already UTF-encoded.  Problem?
                if (HCU_array_key_exists('acctlist', $pending) && HCU_array_key_exists($balkey, $pending['acctlist'])) {
                    foreach ($pending['acctlist'][$balkey] as $tnum => $detl) {
# process the list
                    $itm_arr = array('TRACENO' => $detl['id'],
                        'DTREQUEST' => $detl['postdate'],
                        'TRNAMT' => $detl['amount'],
                        'TRNDESC' =>  htmlspecialchars($detl['txdesc'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));

                    $reply_arr['TXNPENDING'][]['REQUEST']= $itm_arr;
                }
            }

#
            }
            if (($HB_ENV['Fset2'] & $GLOBALS['CU2_SHOWPEND']) == $GLOBALS['CU2_SHOWPEND']) {
                $pending = Get_PendDetails($dbh, $HB_ENV, $balkey);
                if (count($pending[$balkey])) {
                    foreach ($pending[$balkey] as $tnum => $detl) {
# process the list
                    $itm_arr = array('TRACENO' => $detl['traceno'],
                        'DTREQUEST' => $detl['postdate'],
                        'TRNAMT' => $detl['amount'],
                        'TRNDESC' =>  htmlspecialchars($detl['description'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));

                    $reply_arr['TXNPENDING'][]['ACHWAREHOUSE'] = $itm_arr;

                    }
                }
            }
            if (($HB_ENV['Fset2'] & $GLOBALS['CU2_SHOWHOLD']) == $GLOBALS['CU2_SHOWHOLD']) {
                $pending = Get_HoldDetails($dbh, $HB_ENV, $balkey);
                if (count($pending[$balkey])) {
                    foreach ($pending[$balkey] as $tnum => $detl) {
# process the list
                    $itm_arr = array('TRACENO' => $detl['traceno'],
                        'DTREQUEST' => $detl['postdate'],
                        'TRNAMT' => $detl['amount'],
                        'TRNDESC' =>  htmlspecialchars($detl['description'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));

                    $reply_arr['TXNPENDING'][]['PREAUTH'] = $itm_arr;

                    }
                }
            }
            if (!HCU_array_key_exists('TXNPENDING',$reply_arr)) {
                $reply_arr['TXNPENDING']=array();
            }

        }
        $result = array('Status' => 'Success', 'HISTarr' => $reply_arr, 'XMLstr' => assocArrayToXML($reply_arr, 'CREDITCARDTRANLIST', 0));
    } catch (Exception $e) {
        $result = array('Status' => 'Failed ' . $e->getMessage(), 'HISTarr' => array(), 'XMLstr' => '');
    }
    return $result;
}

function lnHistXML($dbh, $HB_ENV, $balkey, $balinfo, $sqlstart, $sqlend, $recent) {
    try {
        $reply_arr = array();

        $xmlResp = '';
        $history = Get_History($dbh, $HB_ENV, $balkey, $sqlstart, $sqlend);

        $reply_arr['DTSTART'] = "${sqlstart}000000";
        $reply_arr['DTEND'] = "${sqlend}235959";

        if (HCU_array_key_exists($balkey, $history)) {
            foreach ($history[$balkey] as $tnum => $detl) {
                $itm_arr = array();

                $principle = $detl['principal'];
                $interest = $detl['interest'];
                $totalpay = $detl['totalpay'];
                $traceno = $detl['traceno'];
                $trdesc = $detl['description'];

                if ($principle < 0) {
                    $trntype = "PAYMENT";
                } else {
                    $trntype = "ADVANCE";
                }

                $longdesc = htmlentities($trdesc, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                $shortdesc = substr(htmlentities($trdesc, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE), 0, 31);
                $shortdesc = preg_replace('/&[^;]*$/', '', $shortdesc);
                $shortdesc = (trim($shortdesc) == '' ? '.' : $shortdesc);

# transaction data row

                $itm_arr['LOANTRNTYPE'] = $trntype;
                $itm_arr['DTPOSTED'] = $detl['date'];
                if (($HB_ENV['Fset'] & $GLOBALS['CU_SHOWLNTXNSPLIT']) == $GLOBALS['CU_SHOWLNTXNSPLIT']) {
                    $itm_arr['TRNAMT'] = $totalpay;
                    $itm_arr['PRINAMT'] = $principle;
                    $itm_arr['INTAMT'] = $interest;
                } else {
                    $itm_arr['TRNAMT'] = $principle;
                }
                if (($HB_ENV['Fset'] & $GLOBALS['CU_LNBALUNUSABLE']) != $GLOBALS['CU_LNBALUNUSABLE']) {
                    $itm_arr['RUNBAL'] = $detl['balance'];
                }
                $itm_arr['FITID'] = $traceno;
                if (($HB_ENV['Fset'] & $GLOBALS['CU_SHOWLNTXNDESC']) == $GLOBALS['CU_SHOWLNTXNDESC']) {
                    $itm_arr['NAME'] = $shortdesc;
                    $itm_arr['MEMO'] = $longdesc;
                }

                // $recent is in yyymmdd format
                $tranDate = preg_replace("/\D/", "", $detl['date'] );
                if ($tranDate < $recent) {
                    $reply_arr[]['LOANSTMTTRN']=$itm_arr;
                } else {
                    $reply_arr[]['RECENTTRN']=$itm_arr;
                }
            }
        }

        if ($HB_ENV['live'] == 0) {
            $pending = Get_ReqDetails($dbh, $HB_ENV, $balkey);

# Get_ReqDetails returns txdesc  already UTF-encoded.  Problem?
            if (HCU_array_key_exists('acctlist', $pending) && HCU_array_key_exists($balkey, $pending['acctlist'])) {
                foreach ($pending['acctlist'][$balkey] as $tnum => $detl) {
# process the list
                    $itm_arr = array('TRACENO' => $detl['id'],
                        'DTREQUEST' => $detl['postdate'],
                        'TRNAMT' => $detl['amount'],
                        'TRNDESC' => htmlspecialchars($detl['txdesc'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));

                    $reply_arr['TXNPENDING'][]['REQUEST'] = $itm_arr;
                }
            }
        }

        if (($HB_ENV['Fset2'] & $GLOBALS['CU2_SHOWPEND']) == $GLOBALS['CU2_SHOWPEND']) {
            $pending = Get_PendDetails($dbh, $HB_ENV, $balkey);
            if (HCU_array_key_exists($balkey, $pending)) {
                foreach ($pending[$balkey] as $tnum => $detl) {
                    $itm_arr = array('TRACENO' => $detl['traceno'],
                        'DTREQUEST' => $detl['postdate'],
                        'TRNAMT' => $detl['amount'],
                        'TRNDESC' => htmlspecialchars($detl['txdesc'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));

                    $reply_arr['TXNPENDING'][]['ACHWAREHOUSE'] = $itm_arr;

                }
            }
        }
        if (($HB_ENV['Fset2'] & $GLOBALS['CU2_SHOWHOLD']) == $GLOBALS['CU2_SHOWHOLD']) {
            $pending = Get_HoldDetails($dbh, $HB_ENV, $balkey);
            if (HCU_array_key_exists($balkey, $pending)) {
                foreach ($pending[$balkey] as $tnum => $detl) {
                    $itm_arr = array('TRACENO' => $detl['traceno'],
                        'DTREQUEST' => $detl['postdate'],
                        'TRNAMT' => $detl['amount'],
                        'TRNDESC' => htmlspecialchars($detl['txdesc'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE));

                    $reply_arr[]['PREAUTH']['REQUEST'] = $itm_arr;
                }
            }
        }

        if (!HCU_array_key_exists('TXNPENDING',$reply_arr)) {
            $reply_arr['TXNPENDING']=array();
        }


        $result = array('Status' => 'Success', 'HISTarr' => $reply_arr, 'XMLstr' => assocArrayToXML($reply_arr, 'LOANTRANLIST', 0));
    } catch (Exception $e) {
        $result = array('Status' => 'Failed ' . $e->getMessage(), 'HISTarr' => array(), 'XMLstr' => '');
    }
    return $result;
}

/**
 * Change an associative array to an XML string.
 *
 * @param array $ar associative array of items to be transformed to XML
 * @param string $base root xml tag to use
 *
 * @return string  XML result string
 */
function assocArrayToXML($ar, $base='APPFEED')
{
    $xml = new SimpleXMLElement("<$base></$base>");

    $f = create_function('$f,$c,$a','
            foreach($a as $k=>$v) {
                if(is_array($v)) {
                    if (is_numeric($k)) {
                        $f($f,$c,$v);
                    } else {
                        $ch=$c->addChild($k);
                        $f($f,$ch,$v);
                    }
                } else {
                    $c->addChild($k,htmlentities($v, ENT_NOQUOTES | ENT_XML1, "UTF-8", FALSE));
                }
            }');
    $f($f,$xml,$ar);

    $return = $xml->asXML();

    $return = str_replace('<?xml version="1.0"?>','',$return);

    return $return;
}

/*
 * This function calls FetchMenuArray which will return the list of menu
 * items that the user has rights to access. It then converts the returned
 * array information into the menu structure the apps expect. A later function
 * will convert it to xml.
 */
function BuildUserMenu($dbh, $pHBEnv, $Platform='A') {

    $menuArray = FetchMenuArray( $pHBEnv, "A" );

    // need to conver the menu array into XML
    $userMenu = _BuildMenuStructure( $pHBEnv, $menuArray );

    return $userMenu;
} // end BuildUserMenu

/*
 * This function calls FetchMenuArray which will return the list of menu
 * items that the user has rights to access. It then converts the returned
 * array information into the menu structure the apps expect. A later function
 * will convert it to xml.
 * NOTE: This function returns the information so the menu can look like the
 *       desktop menu.
 */
function BuildFullUserMenu($dbh, $pHBEnv, $Platform='A') {

    $menuArray = FetchMenuArray( $pHBEnv, "A" );

    // return the full menu
    $userMenu = _BuildFullMenuStructure( $pHBEnv, $menuArray );

    return $userMenu;
} // end BuildFullUserMenu

// Build the menu structure the apps will use. The menu items need to
// be in display order so the resultant XML is also in order.
function _BuildMenuStructure( $pHBEnv, $pMenuArray ) {
  $returnMenuStructure = array();

  // Headers elements start a tag and then call routine to build children.
  // Stand-alone elements build a tag.
  for ( $i = 0; $i < count ( $pMenuArray ); $i++ ) {
    $menuElement = $pMenuArray[$i];

    $thisEntry = array();
    if ( $menuElement["menu_item_type"] == "H" ) {
        $groupDisplayName = HCU_array_key_value( "menu_display_name_en_US", $menuElement );
        $groupDisplayOrder = HCU_array_key_value( "menu_display_order", $menuElement );

        // get the menu id to find the children
        $menuItemId = HCU_array_key_value( 'menu_item_id', $menuElement );

        $childMenuItems = _BuildChildMenu( $pHBEnv, $menuElement["menu_children"], $menuItemId );

        // build the "child" features
        $childList = array();
        for ( $c = 0; $c < count( $childMenuItems ); $c++ ) {
            $childList[]= array( "feature" => $childMenuItems[$c] );
        }
// need to build an array of feature => $childMenuItems[x]
// and put all into an array pointing to thisEntry
        $groupEntry = array( "dispname" => $groupDisplayName,
                             "disporder" => $groupDisplayOrder,
                             $childList );

        $thisEntry = array( "group" => $groupEntry );
    } else if ( $menuElement["menu_item_type"] == "S" ) {
        // stand-alone menu item (not in a group) with no children

        // get the feature code
        $menuFeatureCode = HCU_array_key_value( 'menu_feature_code', $menuElement );
        $desktopScript = HCU_array_key_value( 'menu_script', $menuElement );

        $featureCode = _GetAppMenuFeatureCode( $menuFeatureCode, $desktopScript );

        if ( $featureCode == "unknown" ) {
            // don't pass along the unknowns
            continue;
        }

        // transate target to new window
        $target = HCU_array_key_value( 'menu_target', $menuElement ) == 1 ? "browser" : "webview";

        $menuItem = array(
            "featurecode" => $featureCode,
            "menuname" => HCU_array_key_value( 'menu_display_name_en_US', $menuElement ),
            "menuid" => HCU_array_key_value( 'menu_item_id', $menuElement ),
            "disporder" => HCU_array_key_value( 'menu_display_order', $menuElement ),
            "icon" => HCU_array_key_value( 'menu_icon_name', $menuElement ),
            "extraparam" => urlencode( HCU_array_key_value( 'menu_extra_param', $menuElement ) ),
            "addcu" => HCU_array_key_value( 'menu_add_cu', $menuElement ),
            "target" => $target );

        // special handling for certain features
        if ( $featureCode == "sso" ) {
            $menuItem["ssourl"] = urlencode( HCU_array_key_value( 'menu_script', $menuElement ) );
        }

        $thisEntry = array( "feature" => $menuItem );
    }

    // add the entry to the return structure
    $returnMenuStructure[] = $thisEntry;
  }

  return $returnMenuStructure;
} // end _BuildMenuStructure


// Build the menu structure the apps will use for the full menu. The menu
// items need to be in display order so the resultant XML is also in order.
// The resultant structure needs to be correctly formatted in the XML returned
// to the app (so it might look a little weird).
function _BuildFullMenuStructure( $pHBEnv, $pMenuArray ) {
  $returnMenuStructure = array();

  // Headers elements start a tag and then call routine to build children.
  // Stand-alone elements build a tag.
  for ( $i = 0; $i < count ( $pMenuArray ); $i++ ) {
    $menuElement = $pMenuArray[$i];

    // remove some info that shouldn't be returned
    unset($menuElement["menu_display_name_en_US"]);
    unset($menuElement["menu_display_name_es_US"]);
    unset($menuElement["menu_display_name_pl_US"]);
    // there is a new element, menu_new_window
    unset($menuElement["menu_target"]);

    // do some encoding
    $menuElement["menu_display_name"] = urlencode($menuElement["menu_display_name"]);
    $menuElement["menu_extra_param"] = urlencode($menuElement["menu_extra_param"]);

    $thisEntry = array();
    if ( $menuElement["menu_item_type"] == "H" ) {
        // remove some info that shouldn't be returned
        unset($menuElement["menu_feature_code"]);
        unset($menuElement["menu_parent_id"]);
        unset($menuElement["menu_script"]);
        unset($menuElement["menu_extra_param"]);
        unset($menuElement["menu_add_cu"]);

        // get the menu id to find the children
        $parentItemId = HCU_array_key_value( 'menu_item_id', $menuElement );

        $childMenuItems = array();
        $childMenuArray = $menuElement["menu_children"];
        for ( $c = 0; $c < count( $childMenuArray ); $c++ ) {
            $childItem = $childMenuArray[$c];

            // remove some info that shouldn't be returned
            unset($childItem["menu_display_name_en_US"]);
            unset($childItem["menu_display_name_es_US"]);
            unset($childItem["menu_display_name_pl_US"]);
            // there is a new element, menu_new_window
            unset($childItem["menu_target"]);

            // do some encoding
            $childItem["menu_display_name"] = urlencode($childMenuArray[$c]["menu_display_name"]);
            $childItem["menu_extra_param"] = urlencode($childMenuArray[$c]["menu_extra_param"]);

            // add to the new array
            $childMenuItems[]["feature"] = $childItem;
        }

        // replace the original so the changes we just did are present in what is being returned
        $menuElement["menu_children"] = $childMenuItems;

        $thisEntry = array( "group" => $menuElement );
    } else if ( $menuElement["menu_item_type"] == "S" ) {
        // stand-alone menu item (not in a group) with no children
        $thisEntry = array( "feature" => $menuElement );
    }

    // add the entry to the return structure
    $returnMenuStructure[] = $thisEntry;
  }

  return $returnMenuStructure;
} // end _BuildFullMenuStructure

// Build an array of feature menu items that are in the group identified by the
// parent id. This routine only handled menu item types of "D" (detail).
function _BuildChildMenu( $pHBEnv, $pMenuArray, $pParentId ) {

    // loop through the menu gathering the children of the given parent id
    $childMenuItems = array();
    for ( $i = 0; $i < count( $pMenuArray ); $i++ ) {
        $menuItem = $pMenuArray[$i];

        $menuItemType = HCU_array_key_value( 'menu_item_type', $menuItem );
        $menuParentId = HCU_array_key_value( 'menu_parent_id', $menuItem );

        if ( $menuItemType != "D" || $menuParentId != $pParentId ) {
            continue;
        }

        // get the feature code
        $menuFeatureCode = HCU_array_key_value( 'menu_feature_code', $menuItem );
        $desktopScript = HCU_array_key_value( 'menu_script', $menuItem );

        $featureCode = _GetAppMenuFeatureCode( $menuFeatureCode, $desktopScript );

        if ( $featureCode == "unknown" ) {
            // don't pass along the unknowns
            continue;
        }

        // transate target to new window
        $target = HCU_array_key_value( 'menu_target', $menuItem ) == 1 ? "browser" : "webview";

        $childItem = array(
            "featurecode" => $featureCode,
            "menuname" => HCU_array_key_value( 'menu_display_name_en_US', $menuItem ),
            "menuid" => HCU_array_key_value( 'menu_item_id', $menuItem ),
            "disporder" => HCU_array_key_value( 'menu_display_order', $menuItem ),
            "icon" => HCU_array_key_value( 'menu_icon_name', $menuItem ),
            "extraparam" => urlencode( HCU_array_key_value( 'menu_extra_param', $menuItem ) ),
            "addcu" => HCU_array_key_value( 'menu_add_cu', $menuItem ),
            "target" => $target );

        // special handling for certain features
        if ( $featureCode == "sso" || $featureCode == "sso-estmt" ||
             $featureCode == "sso-mrdc" || $featureCode == "sso-mbillpay" ||
             $featureCode == "sso-pfm" || $featureCode == "sso-loanapp" ) {
            $childItem["ssourl"] = urlencode( HCU_array_key_value( 'menu_script', $menuItem ) );

            // determine the sso type based on the feature code extension
            $parts = explode( "-", $featureCode );
            $type = count( $parts ) > 1 ? $parts[1] : "";
            $childItem["ssotype"] = $type;

            // make them all "sso"
            $childItem["featurecode"] = "sso";
        }

        $childMenuItems[] = $childItem;
    }

    return $childMenuItems;
} // end _BuildChildMenu

// Determine the feature code based on the menu feature code and the desktop filename.
// The Menu Feature Code is what the whole system uses for features; the Desktop Filename
// is the script file called on the desktop. The return value is the code the app uses.
// NOTE: SSOs use different feature codes to help differentiate the type of sso.
function _GetAppMenuFeatureCode( $pMenuFeatureCode, $pDesktopScript ) {
  $appFeatureCode = "unknown";

  switch ( strtoupper( $pMenuFeatureCode ) ) {
    case "ACHCOL":
        // note: ach partner maintenance is implied with either
        $appFeatureCode = "achcol";
        break;
    case "ACHPMT":
        // note: ach partner maintenance is implied with either
        $appFeatureCode = "achpmt";
        break;
    case "ACHPYRL":
        // not handled at this point
        break;
    case "ALERT":
        $appFeatureCode = "alerts";
        break;
    case "BASIC":
        // there are a lot of choices here that distill down to a few choices
        switch( $pDesktopScript ) {
            case "hcuAccounts.prg":
                // NOTE: History is implied with balances on the app
                $appFeatureCode = "balances";
                break;
            case "hcuForms.prg":
                $appFeatureCode = "forms";
                break;
            case "hcuProfilePwd.prg":
            case "hcuProfileSecurity.prg":
            case "hcuProfileDesc.prg":
            case "hcuProfileAlias.prg":
            case "hcuProfileEmail.prg":
                $appFeatureCode = "settings";
                break;
            case "hcuDisclosures.prg":
            case "hcuHistory.prg":
                // not handled at this point
                break;
            default:
                // at this point assume an SSO was selected
                $appFeatureCode = "sso";
                break;
            }
        break;
    case "ESTMT":
        if ( $pDesktopScript == "hcuStatement.prg" ) {
          $appFeatureCode = "estatements";
        } else {
          // at this point assume an SSO was selected
          $appFeatureCode = "sso-estmt";
        }
        break;
    case "MBILLPAY":
        if ( $pDesktopScript == "hcuMobilePay.prg" ) {
          $appFeatureCode = "mobilepay";
        } else {
          // at this point assume an SSO was selected
          $appFeatureCode = "sso-mbillpay";
        }
        break;
    case "MRDC":
        if ( $pDesktopScript == "hcuConnect.prg" ) {
          // at this point assume an SSO was selected
          $appFeatureCode = "sso-mrdc";
        } else {
          // otherwise, it is a native plug-in
          $appFeatureCode = "mrdc";
        }
        break;
    case "PFM":
        $appFeatureCode = "sso-pfm";
        break;
    case "ONLINEAPP":
        $appFeatureCode = "sso-loanapp";
        break;
    case "SECUREMSG":
        $appFeatureCode = "messages";
        break;
    case "STOP":
        break;
    case "TRN":
        if ( $pDesktopScript == "hcuTransfer.prg" ) {
            $appFeatureCode = "transfers";
        } else if ( $pDesktopScript == "hcuUserActivity.prg" ) {
            $appFeatureCode = "activity";
        }
        break;
    case "TRNEXT":
        $appFeatureCode = "tranext";
        break;
    case "TRNM2M":
        $appFeatureCode = "tranm2m";
        break;
    case "TRNSCHED":
        $appFeatureCode = "transched";
        break;
    case "TRNWIRE":
        $appFeatureCode = "tranwire";
        break;
    case "BILLPAY":
    case "SMS":
    case "RDC":
        // these are not mobile features
        break;
  }

  return $appFeatureCode;

} // _GetAppMenuFeatureCode

function MakeMFAKey($HB_ENV) {

    $mfaExpires = date("Ymd", time() + (94 * 86400)); # 94 days

    $mbrMfaQuest = HCU_MFADecode(HCU_JsonDecode($HB_ENV['mfaquest']));
    $mfaMode = (intval($HB_ENV['Fset3'] & GetFlagsetValue('CU3_MFA_AUTHCODE')));
    // if we set a date here, would have to update userrec to store it
    // $mfadate = (empty($mbrMfaQuest['mfadate']) ? date("Ymd") : $mbrMfaQuest['mfadate']);
    $mfadate = HCU_array_key_exists("mfadate", $mbrMfaQuest) ? $mbrMfaQuest['mfadate'] : "";
    $MFAKey = hash_hmac('sha384',GetDeviceCookieContentString(),trim($HB_ENV['password']) . trim(strtolower($HB_ENV['savemail'])) . trim(strtolower($HB_ENV['confidence'])) . $mfaMode . $mfadate);

    return "{$mfaExpires}{$MFAKey}";
}

function IsValidMFAKey($mfaKey, $userrec) {
    $today = date("Ymd");

    $mfaExpires = substr($mfaKey,0,8);
    $mfaHash = substr($mfaKey,8);

    $mfaMode = (intval($userrec['flagset3'] & GetFlagsetValue('CU3_MFA_AUTHCODE')));
    $mfadate = HCU_array_key_exists("mfadate", $userrec) ? $userrec['mfadate'] : "";
    $cookiecontent = hash_hmac('sha384',GetDeviceCookieContentString(),trim($userrec['passwd']) . trim(strtolower($userrec['email'])) . trim(strtolower($userrec['confidence']))
      . $mfaMode . $mfadate);
    if ($cookiecontent == $mfaHash && $mfaExpires > $today) {
        $return_val = true;
    } else {
        $return_val = false;
    }
    return $return_val;
}

/* Test if the given device cookie is valid. It will be in the form
 * name|content|expire where expire is an epoch. First check the expiration
 * and then that the name and value match.
 */
function IsValidAppDeviceCookie($cu, $deviceCookie, $userrec) {
    $success = false;

    // first check the basics - expiration, existence
    $deviceCookieParts = explode("|", $deviceCookie);
    if ( $deviceCookieParts[2] < time() ||
         empty( $deviceCookieParts[0] ) ||
         empty( $deviceCookieParts[1] ) ) {
        return false;
    }

    $mfaMode = (intval($userrec['flagset3'] & GetFlagsetValue('CU3_MFA_AUTHCODE')));
    $mfaDate = HCU_array_key_value("mfadate", $userrec);

    $cookieParams = array ( "cu" => trim($cu),
                            "user_name" => $userrec['user_name'],
                            "saved_pass" => $userrec['passwd'],
                            "saved_email" => $userrec['email'],
                            "saved_confidence" => $userrec['confidence'],
                            "mfa_mode" => $mfaMode,
                            "mfa_date" => $mfaDate,
                            "persists_time" => 0        // are not actually creating a cookie for use
                          );

    $cookieInfo = CreateDeviceCookie( $cookieParams);

    if ( ($cookieInfo["name"] == $deviceCookieParts[0]) &&
         ($cookieInfo["content"] == $deviceCookieParts[1]) ) {
        $success = true;
    } else {
        $success = false;
    }

    return $success;
}

function LogFail($dbh, $HB_ENV, $inPost, $failbit) {
    $updstat = UpdateMemberFailedLogin($dbh, $HB_ENV['cu'], $HB_ENV['user_name'], $failbit);
    $p_meta = array('UA' => $_SERVER['HTTP_USER_AGENT']);
    $p_hbenv = array('Cu' => $inPost['ORG'], 'Uid' => $HB_ENV['Uid'], 'user_name' => $HB_ENV['user_name']);
    TrackUserLogin($dbh, $p_hbenv, $HB_ENV['platform'], $failbit, $_SERVER['REMOTE_ADDR'], $p_meta);
}

function LogPass($dbh, &$HB_ENV){
        # if not online, set the logtrack parameters to NOT decrement the remaining logins
    $must = ($HB_ENV['offline'] != 'N' || ($HB_ENV['forceupdate'] & 29) == 0 ? 'N' : 'Y');
    $tomorrow = date('Y-m-d', mktime(0, 0, 0, date("m"), date("d") + 1, date("Y")));
    $pchange = ($HB_ENV['offline'] != 'N' ? $tomorrow : $HB_ENV['pwchange']);
    $adjust = ($must == 'Y' ? 1 : 0);
    # and fix the corresponding value in HB_ENV
    $HB_ENV['Ffremain']-=$adjust;
    // The challenge key must be reset to 0 for SUCCESSFUL LOGINS
    // and the sac code and expiration must be reset empty for SUCCESSFUL LOGINS
    $HB_ENV['MFA']['challenge'] = 0;
    $HB_ENV['MFA']['authcode']='';
    $HB_ENV['MFA']['authexpires']='';

//    $GLOBALS['HB_ENV']['SYSENV']['logger']->info("UpdateMemberLoginTrack(dbh, {$HB_ENV['cu']}, {$HB_ENV['user_name']}, $must, $pchange, {$HB_ENV['platform']}, {$HB_ENV['MFA']});");
    $updstat = UpdateMemberLoginTrack($dbh, $HB_ENV['cu'], $HB_ENV['user_name'], $must, $pchange, $HB_ENV['platform'], $HB_ENV['MFA']);
    $p_meta = array('UA' => $_SERVER['HTTP_USER_AGENT']);
    TrackUserLogin($dbh, $HB_ENV, $HB_ENV['platform'], 0, $_SERVER['REMOTE_ADDR'], $p_meta);

}
function SAC_destination($dbh, $HB_ENV, $userrec) {
    $reply_arr = array('STATUS' => array('CODE' =>3000,'SEVERITY' => 'ERROR'),
        'DTSERVER' => date('YmdHis') );

    $MemberContacts_ary = GetUserContacts($dbh, $HB_ENV, $userrec);
    $reply_arr['MFA']['AUTHREQ'] = 'MFS';
    $reply_arr['MFA']['MFABUNDLE'] = $HB_ENV['mfaBundle'];
    $reply_arr['MFA']['EMLLABEL'] = $HB_ENV['MC']->msg('Email to', HCU_DISPLAY_AS_HTML);
    if (is_array($MemberContacts_ary['EMAIL']) && sizeof($MemberContacts_ary['EMAIL'])) {
        foreach ($MemberContacts_ary['EMAIL'] as $ckey => $cval) {
            $ckey = str_replace(array("+", "/", "="), array("-", "_", "."), $ckey);
            $reply_arr['MFA']['EMLLIST'][]['EMAIL']= array('eSelect'=>$ckey, 'eDisplay' =>$cval);
        }
    }
    if (is_array($MemberContacts_ary['SMS']) && sizeof($MemberContacts_ary['SMS'])) {
        $reply_arr['MFA']['SMSLABEL'] = $HB_ENV['MC']->msg('Text to', HCU_DISPLAY_AS_HTML);
        foreach ($MemberContacts_ary['SMS'] as $ckey => $cval) {
            $ckey = str_replace(array("+", "/", "="), array("-", "_", "."), $ckey);
            $reply_arr['MFA']['SMSLIST'][]['SMS']= array('eSelect'=>$ckey, 'eDisplay' =>$cval);
        }
    }

    $reply_arr['MFA']['haveSAC'] = HCU_array_key_value('GotIt', $MemberContacts_ary );

    return $reply_arr;
}

function PWD_prompt($dbh, $HB_ENV) {
    $reply_arr = array('STATUS' => array('CODE' =>3000,'SEVERITY' => 'ERROR'),
        'DTSERVER' => date('YmdHis') );

    # needs to send
    #   'forgot password' link
    #   confidence word

    $reply_arr['MFA']['AUTHREQ'] = 'MFP';
    $reply_arr['MFA']['MFABUNDLE'] = $HB_ENV['mfaBundle'];
    $reply_arr['MFA']['PROMPT'] = $HB_ENV['MC']->msg('Login Enter Password');
    $reply_arr['MFA']['CONFIDENCE'] = $HB_ENV['confidence'];

    if ($HB_ENV['flagset'] & $GLOBALS['CU_MEMRESET']){
        $reply_arr['MFA']['FORGOTLINK'] = $HB_ENV['loginpath'] . '/hcuResetPwd.prg?' . $HB_ENV['cuquery'];
        $reply_arr['MFA']['FORGOTLABEL'] = $HB_ENV['MC']->msg('Forgot your password');
    }

    return $reply_arr;
}

function EML_prompt($dbh, $HB_ENV) {
    $reply_arr = array('STATUS' => array('CODE' =>3000,'SEVERITY' => 'ERROR'),
        'DTSERVER' => date('YmdHis') );
    $reply_arr['MFA']['AUTHREQ'] = 'EML';
    $reply_arr['MFA']['MFABUNDLE'] = $HB_ENV['mfaBundle'];
    $reply_arr['MFA']['PROMPT'] = $HB_ENV['MC']->msg('Confirm Email Address');

    return $reply_arr;
}
function SAC_prompt($dbh, $HB_ENV) {
    $reply_arr = array('STATUS' => array('CODE' =>3000,'SEVERITY' => 'ERROR'),
        'DTSERVER' => date('YmdHis') );
    $reply_arr['MFA']['AUTHREQ'] = 'MFC';
    $reply_arr['MFA']['MFABUNDLE'] = $HB_ENV['mfaBundle'];
    $reply_arr['MFA']['PROMPT'] = $HB_ENV['MC']->msg('Enter Access Code');

    return $reply_arr;
}
function checkBundle($mode, $mfaBundle, $inPost) {

    switch ($mode) {
        case 'TIME':
        # special case to check the bundle age
        $built = HCU_array_key_value('BUILDTIME', $mfaBundle);
        if ( empty($built) || (time() - $built) > 900 ) {
            $returnBundle = false;
        } else {
            $returnBundle = true;
        }
            break;
        case 'EML':
        # previous mode is MFA,
        # bundle contains USERID
        # Add MFA_E

        if ( HCU_array_key_value('mode', $mfaBundle) !== 'MFA' ||
             HCU_array_key_value('USERID',$mfaBundle) !== HCU_array_key_value('USERID',$inPost) ) {
                    $returnBundle = false;
                } else {
                    $returnBundle = true;
                }
            break;
        case 'MFQ':
        case 'MFS':
        # previous mode is EML
        # bundle contains USERID, MFA_E
        # Add MFQ completion marker
        if ( (HCU_array_key_value('mode', $mfaBundle) !== 'EML' && HCU_array_key_value('mode', $mfaBundle) !== 'MFS') ||
             HCU_array_key_value('USERID',$mfaBundle) !== HCU_array_key_value('USERID',$inPost) ||
             !HCU_array_key_exists('MFA_E',$mfaBundle) ) {
                    $returnBundle = false;
                } else {
                    $returnBundle = true;
                }
            break;
        case 'MFC':
        # previous mode is MFS, or maybe EML if they already had a code
        # bundle contains USERID, MFA_E, MFS_Deliver
        # Add SAC completion marker
        if ( (HCU_array_key_value('mode', $mfaBundle) !== 'MFS' && HCU_array_key_value('mode', $mfaBundle) !== 'EML' ) ||
             HCU_array_key_value('USERID',$mfaBundle) !== HCU_array_key_value('USERID',$inPost) ||
            !HCU_array_key_exists('MFA_E',$mfaBundle) ||
            (HCU_array_key_value('mode', $mfaBundle) == 'MFS' && !HCU_array_key_exists('MFS_Deliver',$mfaBundle)) ) {
                    $returnBundle = false;
                } else {
                    $returnBundle = true;
                }
            break;
        case 'MFP':
        # previous mode is MFQ or MFC or EML or MFA
        # bundle contains USERID, MFA_E,
        # and either MFQ marker or SAC marker
        if (
            !((HCU_array_key_value('mode', $mfaBundle) === 'MFQ' && HCU_array_key_exists('haveMFQ',$mfaBundle)) ||
            (HCU_array_key_value('mode', $mfaBundle) === 'MFC' && HCU_array_key_exists('haveSAC',$mfaBundle)) ||
            HCU_array_key_value('mode', $mfaBundle) === 'EML' || HCU_array_key_value('mode', $mfaBundle) === 'MFA')
            || HCU_array_key_value('USERID',$mfaBundle) !== HCU_array_key_value('USERID',$inPost) ||
            !HCU_array_key_exists('MFA_E',$mfaBundle)
                ) {

//        if ( (HCU_array_key_value('mode', $mfaBundle) !== 'MFQ' && HCU_array_key_value('mode', $mfaBundle) !== 'MFC' ) ||
//             HCU_array_key_value('USERID',$mfaBundle) !== HCU_array_key_value('USERID',$inPost) ||
//            !HCU_array_key_exists('MFA_E',$mfaBundle) ||
//             (!HCU_array_key_exists('haveSAC',$mfaBundle) && !HCU_array_key_exists('haveMFQ',$mfaBundle) ) ) {
                    $returnBundle = false;
                } else {
                    $returnBundle = true;
                }
            break;
        default:
            # unexpected $mode - throw error
            $returnBundle = false;
            break;
    }
 return $returnBundle;
}
function createBundle($Cu, $mfaBundle) {
    try {
        $mfaBundle = HCU_PayloadEncode($Cu,$mfaBundle);
        $mfaBundle = str_replace(array("+", "/", "="), array("-", "_", "."), $mfaBundle);
    } catch (Exception $e) {
        $mfaBundle='';
    }

    return $mfaBundle;
}
function openBundle($Cu, $mfaBundle) {
    try {

        $mfaBundle = str_replace(array("-", "_", "."), array("+", "/", "="), $mfaBundle);
        $mfaBundle = HCU_PayloadDecode($Cu, $mfaBundle);

    } catch (Exception $e) {
        $mfaBundle=array();
    }
    return $mfaBundle;
}
/* This is the original OdyTxPost that works with existing apps. At some point it can go away but
 * need to wait until most apps are updated to do that.
 */
function OdyTxPost ($dbh, $HB_ENV, $inPost, $MC) {
  try {
    $errorMessage = array();

    // first need to check input, make sure we have something to post
    // inPost should contain FACCTID TACCTID AMOUNT & optional TRMEMO
    // these are needed in a variety of places so get them now
    $sourceParts = isset( $inPost['FACCTID'] ) ? explode( "|", $inPost['FACCTID'] ) : array(); // eg "D|1103|10|0
    $destParts = isset( $inPost['TACCTID'] ) ? explode( "|", $inPost['TACCTID'] ) : array();

    // check if feature is regular, external, or M2M transfer
    if ( (isset( $sourceParts[0] ) && $sourceParts[0] === "X") ||
         (isset( $destParts[0] ) && $destParts[0] === "X") ) {
      $transferFeatureCode = FEATURE_EXTERNAL_TRANSFERS;
    } else if ( isset( $destParts[0] ) && $destParts[0] === "M" ) {
      $transferFeatureCode = FEATURE_M2M_TRANSFERS;
    } else {
      $transferFeatureCode = FEATURE_TRANSFERS;
    }
    # UGLY hidden dependency... SubmitTransfer function expects this in
    # the post array so load it here.
    $HB_ENV['HCUPOST']['feature_code'] = $transferFeatureCode;

    $permissionInputs = array( "feature" => $transferFeatureCode );

    // check if user has create rights
    $accessRights = Perm_AccessRights( $dbh, $HB_ENV, $permissionInputs );
    if ( !HCU_array_key_value( "create", $accessRights ) ) {
      $errorMessage[] = $MC->msg('Rights not set', HCU_DISPLAY_AS_HTML);
      throw new Exception ( HCU_JsonEncode($errorMessage) );
    }

    // get some allowed amounts for client-side validation
    $permissionInputs = array( "feature" => $transferFeatureCode );
    $limits = Perm_GetValidationLimits( $dbh, $HB_ENV, $permissionInputs );

    if ( $limits === false ) {
      // error occurred - assume count of zero
      $allowedAmount = 0;
    } else {
      $allowedAmount = floatval( $limits["amount_per_transaction"] );
    }

    /*
     * apps currently support only immediate transfers to previously defined
     * accounts.  Trying to maintain the structure here for future growth,
     * but most of these don't apply at this time. October '17
     */

    $txData = array('txFrequency' => "OneTime",
                    'txFromMember' => $sourceParts[1],
                    'txFromSuffix' => $inPost['FACCTID'],
                    'txFromType' => "",
                    'txToMember' => $destParts[1],
                    'txToSuffix' => $inPost['TACCTID'],
                    'txToType' => "",
                    'txToMisc1' => "",
                    'txMemAccount' => null,
                    'txMemName' => null,
                    'txMemType' => null,
                    'txCode' => null, # this needs to get set here, somehow?
                    'txAmount' => HCU_array_key_value('AMOUNT',$inPost),
                    'txMemo' => HCU_array_key_value('TRMEMO',$inPost),
                    'txFrequencyCount' => 0,
                    'txContinue' => null,
                    'txDateStart' => date("m/d/Y"),
                    'txDateEnd' => null,
                    'txStatus' => null,
                    'txPmtComment' => null,
                    'txDeposit' => null,
                    'txId' => 0,
                    'txOption' => "Immediate",
                    "feature_code" => $HB_ENV["HCUPOST"]["feature_code"]);

    // ** CHECK
    // ** - recurring transfers are allowed
    $txRecurringAllowed = (($HB_ENV['flagset2'] & GetFlagsetValue("CU2_PROCRECUR")) === GetFlagsetValue("CU2_PROCRECUR"));
    // ** - is payment or transfer
    $txIsPayment = ($destParts[0] == 'O' && substr( $destParts[2], 0, 1 ) === "P");

    // ** CHECK
    // ** - Immediate
    // ** - recurring not supported from apps, not addressed here at this time
    if (!$txRecurringAllowed || $txData['txOption'] === "Immediate") {

//      $HB_ENV["SYSENV"]["logger"]->info(__LINE__ . " ready to validate");

      // ** VALIDATE - data was sanitized already
      $txValidateTransfer = ValidateTransfer( $HB_ENV, $dbh, $MC, $txData );

      if ( $txValidateTransfer['status']['code'] !== "000" ) {

        for ( $i = 0; $i < count( $txValidateTransfer["status"]["errors"] ); $i++ ) {
          $errorMessage[] = $txValidateTransfer["status"]["errors"][$i]["message"];
        }

        throw new Exception ( HCU_JsonEncode($errorMessage) );
      }


//      $htmlTransferAmount = $inPost['AMOUNT'];
      # should be validated amount, not the raw inPost value
      $htmlTransferAmount = HCU_array_key_value('txAmount',$txValidateTransfer['data']);

      if ( $htmlTransferAmount > $allowedAmount ) {
        // error occurred - cannot allow operation - just say there was a limit error
        $errorMessage[] =$MC->msg('Perm Limit - Request over authorized limit', HCU_DISPLAY_AS_HTML);
        throw new Exception ( HCU_JsonEncode($errorMessage) );
      }

      // get some allowed amounts for validation
      $permissionInputs = array( "feature" => $transferFeatureCode );
      $permissionInputs["amount"] = $htmlTransferAmount;
      # these should probably come from the validated results,
      # but ValidateTransfer is transforming some of the data
      # and may be confusing acctid (delimited string with several values)
      # with the account number/account suffix.
      $permissionInputs["account"] = $sourceParts[1];
      $permissionInputs["accounttype"] = $sourceParts[2];

      $return = Perm_CheckLimits( $dbh, $HB_ENV, $permissionInputs );
      if ( !$return || ($return["status"]["code"] !== "000") ) {
        // error occurred - cannot allow operation - just say there was a limit error
        $errorMessage[] = Perm_GetLimitErrDesc($MC, $return["status"]["code"]);
        throw new Exception ( HCU_JsonEncode($errorMessage) );
      }

      // ** Use the results from ValidateTransfer and pass into SubmitTransfer
      $submitTransferResult = SubmitTransfer( $dbh, $HB_ENV, $MC, $txValidateTransfer['data'], $aryTransferResults );


      if ( $submitTransferResult === false  ) {
        // error occurred - cannot allow operation
        $errorMessage[] = $MC->msg("Transfer Error", HCU_DISPLAY_AS_HTML);
      }
//$HB_ENV["SYSENV"]["logger"]->info(__LINE__ . " aryTransferResults " . print_r($aryTransferResults,true) . " submitTransferResult " . print_r($submitTransferResult,true));

      // see if the recording returned any errors
      if ( $aryTransferResults["status"]["code"] != "000" ) {
        if ( count( $submitTransferResult["status"]["errors"] ) > 0 ) {
          for ( $i = 0; $i < count( $submitTransferResult["status"]["errors"] ); $i++ ) {
            $errorMessage[] = $submitTransferResult["status"]["errors"][$i];
          }
        }
      }

      // check if either of the two possible ways to return errors happened
      if ( count( $errorMessage ) > 0 ) {
        if ($txData['txFrequency'] != 'OneTime') {
          // ** If we have an error from the POST routine AND the member tried to add
          // * a repeating, just mention that here..
          $errorMessage[] = $MC->msg("Repeating transfer not saved", HCU_DISPLAY_AS_RAW);
        }

        throw new Exception ( HCU_JsonEncode($errorMessage) );
      }
      // transfer record saved, hang on to the results
      $retStatus_ary['txn'] = $aryTransferResults['txn'];

      // now see if confirmation not required
      $confirmationRequired = Perm_CheckConfirmReq($dbh, $HB_ENV, $permissionInputs);
      if (!$confirmationRequired) {
        // since can self-approve do that now (returning TX_Post data)
        $entryId = $aryTransferResults["txn"]["trans_id"];    // result from SubmitTransfer

        if ( !ApproveTransfer( $dbh, $HB_ENV, $MC, $entryId, $aryApprovalResults ) ) {
          $errorMessage[] = $MC->msg("Trans approval failure", HCU_DISPLAY_AS_HTML);
          throw new Exception ( HCU_JsonEncode($errorMessage) );
        }

        // for internal transfers, if it was self-approved it can be processed right away
        if ( $transferFeatureCode == FEATURE_TRANSFERS ||
             $transferFeatureCode == FEATURE_M2M_TRANSFERS ) {
          // * TRADITIONAL TRANSFER
          if ( !ProcessTransfer( $dbh, $HB_ENV, $MC, $entryId, $aryProcessResults ) ) {
            $errorMessage[] = $MC->msg("Trans processing failure", HCU_DISPLAY_AS_HTML);

            if ( count( $aryProcessResults["status"]["errors"] ) > 0 ) {
              for ( $i = 0; $i < count( $aryProcessResults["status"]["errors"] ); $i++ ) {
                $errorMessage[] = $aryProcessResults["status"]["errors"][$i];
              }
            }
            throw new Exception ( HCU_JsonEncode($errorMessage) );
          }
        }

        $retStatus_ary['txn']['status'] = $MC->msg("Transfer posted", HCU_DISPLAY_AS_RAW);
      } else {
        // return message about awaiting approval, and just enough data for confirmation
        $retStatus_ary['txn']['status'] = $MC->msg("Transfer submitted for confirmation", HCU_DISPLAY_AS_RAW);
      }

      // ** Successful transfer -- Need to return information..
      $retStatus_ary['status']['code']='0';
      $retStatus_ary['status']['severity']='INFO';
    }
  } catch(Exception $ex)
  {
    $retStatus_ary['status']['code']='999';
    $retStatus_ary['status']['severity']='ERROR';
    $retStatus_ary['status']['errors'] = HCU_JsonDecode( $ex->getMessage());
    $retStatus_ary['txn'] = array();
  }
return $retStatus_ary;
}


/* This is the new routine to post regular or scheduled transfers to the server core code. It uses
 * the new PerformTransfer functionality that is shared for all platforms and can handle scheduled
 * or immediate transfers.
 */
function TxPostAdvanced( $pHBEnv, $pDbh, $inPost, $pMC) {
  $retStatusAry = Array(
    'status' => Array('code'=>'000', 'errors' => Array()),
    'data' => '',
    'info' => ''
  );

  try {
    $errorMessage = array();

    // first need to check input, make sure we have something to post
    // inPost should contain FACCTID TACCTID AMOUNT & optional TRMEMO
    // these are needed in a variety of places so get them now
    $sourceParts = isset( $inPost['FACCTID'] ) ? explode( "|", $inPost['FACCTID'] ) : array(); // eg "D|1103|10|0
    $destParts = isset( $inPost['TACCTID'] ) ? explode( "|", $inPost['TACCTID'] ) : array();

    // check if feature is regular, external, or M2M transfer
    if ( (isset( $sourceParts[0] ) && $sourceParts[0] === "X") ||
         (isset( $destParts[0] ) && $destParts[0] === "X") ) {
      $transferFeatureCode = FEATURE_EXTERNAL_TRANSFERS;
    } else if ( isset( $destParts[0] ) && $destParts[0] === "M" ) {
      $transferFeatureCode = FEATURE_M2M_TRANSFERS;
    } else {
      $transferFeatureCode = FEATURE_TRANSFERS;
    }
    # UGLY hidden dependency... SubmitTransfer function expects this in
    # the post array so load it here.
    $pHBEnv['HCUPOST']['feature_code'] = $transferFeatureCode;

    $permissionInputs = array( "feature" => $transferFeatureCode );

    // check if user has create rights
    $accessRights = Perm_AccessRights( $pDbh, $pHBEnv, $permissionInputs );
    if ( !HCU_array_key_value( "create", $accessRights ) ) {
      $errorMessage[] = $pMC->msg('Rights not set', HCU_DISPLAY_AS_HTML);
      throw new Exception ( HCU_JsonEncode($errorMessage) );
    }

    // get some allowed amounts for client-side validation
    $permissionInputs = array( "feature" => $transferFeatureCode );
    $limits = Perm_GetValidationLimits( $pDbh, $pHBEnv, $permissionInputs );

    if ( $limits === false ) {
      // error occurred - assume count of zero
      $allowedAmount = 0;
    } else {
      $allowedAmount = floatval( $limits["amount_per_transaction"] );
    }

    // make sure we have a date
    $txDateStart = trim( HCU_array_key_value( "TXSTART", $inPost ) );
    if ( strlen( $txDateStart ) == 0 ) {
      $txDateStart = date("m/d/Y");
    }

    /*
     * Set up call to submit the transfer to the core routine.
     */
    $txData = array('txFrequency' => HCU_array_key_value('TXFREQ',$inPost),
                    'txFromMember' => $sourceParts[1],
                    'txFromSuffix' => $inPost['FACCTID'],
                    'txToMember' => $destParts[1],
                    'txToSuffix' => $inPost['TACCTID'],
                    'txToMisc1' => "",
                    'txMemAccount' => null,
                    'txMemName' => null,
                    'txMemType' => null,
                    'txCode' => null, # this needs to get set here, somehow?
                    'txAmount' => HCU_array_key_value('AMOUNT',$inPost),
                    'txMemo' => HCU_array_key_value('TRMEMO',$inPost),
                    'txContinue' => HCU_array_key_value('TXCONTINUE',$inPost),
                    'txDateStart' => $txDateStart,
                    'txDateEnd' => HCU_array_key_value('TXEND',$inPost),
                    'txStatus' => null,
                    'txPmtComment' => null,   // not used on apps (for secure payment form)
                    'txId' => 0,              // new transaction being posted does not have an id yet
                    "feature_code" => $transferFeatureCode      // save the feature code for use elsewhere
                    );

    // PerformTransfer does all the transactional work, so we just need to return what it returns
    $aryTransferResults = PerformTransfer( $pHBEnv, $txData, $pHBEnv["MC"] );

    if ( $aryTransferResults["status"]["code"] != "000" ) {
      if ( is_array( $aryTransferResults["status"]["errors"] ) ) {
        for ( $i = 0; $i < count( $aryTransferResults["status"]["errors"] ); $i++ ) {
          //need to handle both an array and/or a string being inside the "errors" element
          if ( is_array( $aryTransferResults["status"]["errors"][$i] ) ) {
            $errorMessage[] = $aryTransferResults["status"]["errors"][$i]["message"];
          } else {
            $errorMessage[] = $aryTransferResults["status"]["errors"][$i];
          }
        }
      } else {
        $errorMessage[] = $aryTransferResults["status"]["errors"];
      }
    }

    // check if either of the two possible ways to return errors happened
    if ( count( $errorMessage ) > 0 ) {
      if ($txData['txFrequency'] != 'OneTime') {
        // ** If we have an error from the POST routine AND the member tried to add
        // * a repeating, just mention that here..
        $errorMessage[] = $pMC->msg("Repeating transfer not saved", HCU_DISPLAY_AS_RAW);
      }

      throw new Exception ( HCU_JsonEncode($errorMessage) );
    }

    // ** Successful transfer -- Need to return information..
    $retStatusAry['status']['code']='0';
    $retStatusAry['status']['severity']='INFO';

    // the call to PerformTransfer will either return scheduled transfer info OR immediate transfer info, but not both.

    if ( HCU_array_key_exists( "repeat", $aryTransferResults["data"] ) && !is_array($aryTransferResults["data"]["repeat"])) {
      // scheduled tranfer data returns a message that doesn't quite work so use a different one
      $retStatusAry["txn"]["status"] = $pMC->msg( "Scheduled transfer was saved", HCU_DISPLAY_AS_RAW );
    } else {
      // regular transfer
      if ( HCU_array_key_exists( "txn", $aryTransferResults["data"] ) ) {
        $retStatusAry["txn"] = $aryTransferResults["data"]["txn"];
      }

      if ( HCU_array_key_exists( "posted", $aryTransferResults["data"] ) ) {
        $retStatusAry["txn"]["status"] = $aryTransferResults["data"]["posted"];
      } else {
        $retStatusAry["txn"]["status"] = $pMC->msg("Transfer posted", HCU_DISPLAY_AS_RAW);
      }
    }
  } catch(Exception $ex) {
    $retStatusAry['status']['code']='999';
    $retStatusAry['status']['severity']='ERROR';
    $retStatusAry['status']['errors'] = HCU_JsonDecode( $ex->getMessage());
    $retStatusAry['txn'] = array();
  }

  return $retStatusAry;
} // end TxPostAdvanced

/**
 * GetUserPhones
 * retrieve {cu}usercontact phone numbers for the
 * selected member
 *
 * @param string $CU current cu code
 * @param integer $Uid user id
 * @param array $HB_ENV home banking settings (uses dbh)
 * @return array ['mobile'] list of current phone numbers
 * empty array if no phone numbers found
 * array['errors'] if error occurs
 */
function GetUserPhones($CU, $UID, $HB_ENV) {

    $dbh = $HB_ENV['dbh'];
 try {
        // get current list of phone numbers
    $aryPhones = array();
    $sql = "
      SELECT phones
      FROM {$CU}usercontact c
      LEFT JOIN {$CU}user u
        ON u.contact = c.contact_id
      WHERE u.user_id = {$UID}";
    $sqlRs = db_query($sql, $dbh);
    if (!$sqlRs) {
        throw new Exception("Error reading phone numbers");
    }
  $aryPhones = db_fetch_assoc($sqlRs, 0);
  if ($aryPhones['phones'] === null) {
    $aryPhones = array(
      "mobile" => array()
    );
  } else {
    $aryPhones = HCU_JsonDecode($aryPhones['phones']);
  }

} catch (Exception $e) {
    $aryPhones['errors'] = $e->getMessage();
}
return $aryPhones;
}
function format_us_number($phone) {
  $numbers_only = preg_replace("/[^\d]/", "", $phone);
  return preg_replace("/^1?(\d{3})(\d{3})(\d{4})$/", "$1-$2-$3", $numbers_only);
}
//function slurpCurl($url, $postdata, $postcookie, $posthdrs) {
// /* called with
//        $myTicket = appTokenCookie($HB_ENV);
//        $reqUrl = "http://localhost/banking/hcuExternalAccts.data?cu={$HB_ENV['cu']}";
//        $reqParams = json_encode(array('action' => "get_m2m_accounts"));
//        $result = slurpCurl($reqUrl, $reqParams, "Ticket=$myTicket",array());
//        $reply_arr = json_decode($result,true);
// */
//    $curlopts = array(
//        CURLOPT_RETURNTRANSFER => 1,
//        CURLOPT_SSL_VERIFYPEER => 0,
//        CURLOPT_SSL_VERIFYHOST => 0,
//        CURLOPT_HEADER => 0,
//        CURLOPT_POST => 1,
//        CURLOPT_POSTFIELDS => "$postdata",
//        CURLOPT_URL => "$url");
//
//    $ch = @curl_init();
//    @curl_setopt_array($ch, $curlopts);
//    if (!empty($postcookie)) {
//        curl_setopt($ch, CURLOPT_COOKIE, $postcookie);
//    }
//    if (is_array($posthdrs) && count($posthdrs)) {
//        curl_setopt($ch, CURLOPT_HTTPHEADER, $posthdrs);
//    }
//curl_setopt($ch, CURLOPT_VERBOSE, true);
//$verbose = fopen('/home/scrubcu/tmp/ajax_trace.txt', 'a+');
//curl_setopt($ch, CURLOPT_STDERR, $verbose);
//
//    $response = @curl_exec($ch);
//    $respHTTP = curl_getinfo($ch,CURLINFO_HTTP_CODE);
//    if ($respHTTP  > 400 && $respHTTP < 600 ) {
//        # HTTP Response 4xx client error or 5xx server error
//        $response = "HCUERROR: Connection Failed HTTP Error $respHTTP";
//    } elseif (curl_errno($ch)) {
//        # Bad! Don't hide the error, return the curl error if it occurred.
//        $response = "HCUERROR: Connection Failed " . curl_error($ch);
//    }
//
//    @curl_close($ch);
//    return $response;
//}
function appTokenCookie ($HB_ENV) {
    $now = time();
    $expires = $now + $HB_ENV['SYSENV']['ticket']['expires'];

    $mycookie = "Ctime=$now"
                . "&Ce=$expires"
                . "&Cu={$HB_ENV['Cu']}"
                . "&Cn={$HB_ENV['Cn']}"
                . "&Uid={$HB_ENV['Uid']}"
                . "&Clw={$HB_ENV['livewait']}"
                . "&Clu={$HB_ENV['lastupdate']}"
                . "&Fplog={$HB_ENV['Fplog']}"
                . "&Fflog={$HB_ENV['Fflog']}"
                . "&Ffchg={$HB_ENV['Ffchg']}"
                . "&Ffreset={$HB_ENV['Ffreset']}"
                . "&Ffremain={$HB_ENV['Ffremain']}"
                . "&Fmsg_tx={$HB_ENV['Fmsg_tx']}"
                . "&Fset={$HB_ENV['Fset']}"
                . "&Fset2={$HB_ENV['Fset2']}"
                . "&Fset3={$HB_ENV['Fset3']}"
                . "&Fhdays={$HB_ENV['histdays']}"
                . "&Ml=" . urlencode(trim($HB_ENV['Ml']))
                . "&Ca=";
    // ** Check for testmenu param -- add it to cookie if set
    if (intval(HCU_array_key_value('testmenu', $HB_ENV['HCUPOST'])) == 1) {
      $mycookie .= "&testmenu=1";
    }
    $returnTicket = SetTicket($HB_ENV,"", $mycookie);
return $returnTicket;
}

/**
 * GatherUserActivity
 * Call the function to gather the requested user activity data. This does not
 * get the detail.
 *
 * @param array $pHBEnv         - Home banking settings
 * @param array $pPass          - The passed in parameters
 * @return array of information to return to app
 */
function GatherUserActivity( $pHBEnv, $pPass ) {
  require_once(dirname(__FILE__) . '/../library/hcuUserActivity.i');

  // return the standard header block
  $replyArr = array( 'STATUS' => array('CODE' => 0,'SEVERITY' => 'INFO') );

  // add some fields
  $replyArr["DTSERVER"] = date('YmdHis');
  $replyArr["MEMBER"] = $pHBEnv['Uid'];

  try {
    // make the parameter keynames consistent
    $params = array_change_key_case( $pPass, CASE_LOWER );

    // these needs to be here for other tests
    $params["detail"] = !isset( $params["detail"] ) ? 0 : intval($params["detail"]);
    $params["prior"] = !isset( $params["prior"] ) ? 0 : 1;
    $params["pending"] = !isset( $params["pending"] ) ? 0 : 1;
    // this can be "all" or true/1
    $params["scheduled"] = !isset( $params["scheduled"] ) ? "" : strtolower($params["scheduled"]);

    // make sure we have parameter for all possible variables
    $paramsToPassOn = array();

    // initialize anything we might be returning
    $resultMeta = null;
    $resultPending = null;
    $resultScheduled = null;
    $resultPrior = null;

    $paramsToPassOn["action"] = !isset( $params["action"] ) ? "" : $params["action"];

    // apps will never filter on type
    $paramsToPassOn["filter"]["type"] = "";

    // see if user wants the meta data (actions, featuers, statuses)
    if ( isset( $params["initial"] ) && $params["initial"] == 1 ) {
      $resultMeta = GetUserActivityMetaData( $pHBEnv );

      // check for errors
      if ( $resultMeta["code"] != "000" ) {
        throw new Exception( "User activity: " . $resultMeta["error"], 15552 );
      }
    }

    if ( $params["pending"] == 1 ) {
      $resultPending = GetUserActivity( $pHBEnv, "pending", $paramsToPassOn );

      // check for errors
      if ( $resultPending["code"] != "000" ) {
        throw new Exception( "User activity: " . $resultPending["error"], 15554 );
      }
    }

    if ( $params["scheduled"] == "all" ) {
      $paramsToPassOn["filter"]["scheduled"] = "all";

      $resultScheduled = GetUserActivity( $pHBEnv, "scheduled", $paramsToPassOn );

      // check for errors
      if ( $resultScheduled["code"] != "000" ) {
        throw new Exception( "User activity: " . $resultScheduled["error"], 15551 );
      }
    } else if ( $params["scheduled"] != "" ) {
      // initially, want just next 30 days of scheduled
      $initialScheduledFilter = array( "filter" => array( "start" => date( "Ymd" ),
                                                          "end" => date( "Ymd", time() + 30 * 24 * 60 * 60 ) ) );
      $resultScheduled = GetUserActivity( $pHBEnv, "scheduled", $initialScheduledFilter );

      // check for errors
      if ( $resultScheduled["code"] != "000" ) {
        throw new Exception( "User activity: " . $resultScheduled["error"], 15555 );
      }
    }

    // see if prior data
    if ( $params["prior"] == 1 ) {
      // if missing dtend then use today
      if ( !isset( $params["dtend"] ) || ($params["dtend"] == "") ) {
        $dateEnd = date( "Y-m-d" );
      } else {
        $dateEnd = $params["dtend"];
      }

      // if missing dtstart then use 30 days ago
      if ( !isset( $params["dtstart"] ) || ($params["dtstart"] == "") ) {
        $dateStart = date( "Y-m-d", time() - 30 * 24 * 60 * 60 );
      } else {
        $dateStart = $params["dtstart"];
      }

      // test that start is before end
      $testStart = strtotime( $dateStart );
      $testEnd = strtotime( $dateEnd );
      if ( $testStart > $testEnd ) {
        throw new Exception( "User activity prior date start need to be <= date end", 15553 );
      }

      $paramsToPassOn["filter"]["start"] = $dateStart;
      $paramsToPassOn["filter"]["end"] = $dateEnd;

      $resultPrior = GetUserActivity( $pHBEnv, "prior", $paramsToPassOn );

      // check for errors
      if ( $resultPrior["code"] != "000" ) {
        throw new Exception( "User activity: " . $resultPrior["error"], 15556 );
      }

      // add to the reply the start and end date that was used
      $resultPrior["data"]["dtstart"] = date( "Y-m-d", strtotime( $dateStart ) );
      $resultPrior["data"]["dtend"] = date( "Y-m-d", strtotime( $dateEnd ) );
    }

    // return the data - everything that was collected
    $replyArr["ACTIVITY"] = array();

    if ( $resultMeta != null ) {
      $replyArr["ACTIVITY"]["meta"] = $resultMeta["data"];
    }

    // make sure data is ready to be returned
    if ( $resultPending != null && is_array($resultPending['data']) ) {
      array_walk_recursive( $resultPending['data'], 'MakeHTMLEntities' );

      $replyArr['ACTIVITY']["pending"] = $resultPending['data'];
    }

    if ( $resultScheduled != null && is_array($resultScheduled['data']) ) {
      array_walk_recursive( $resultScheduled['data'], 'MakeHTMLEntities' );

      $replyArr['ACTIVITY']["scheduled"] = $resultScheduled['data'];
    }

    if ( $resultPrior != null && is_array($resultPrior['data']) ) {
      array_walk_recursive( $resultPrior['data'], 'MakeHTMLEntities' );

      $replyArr['ACTIVITY']["prior"] = $resultPrior['data'];
    }

    // we are successful at this point

  } catch( Exception $e ) {
    $code = $e->getCode();
    $message = $e->getMessage();

    // return an error header block
    $replyArr["STATUS"] = array('CODE' =>$code,'SEVERITY' => 'ERROR');
    $replyArr["MESSAGE"] = array( "ERR" => $message );
  }

  return $replyArr;
} // end GatherUserActivity

/**
 * GatherUserActivityDetail
 * Call the function to gather the requested user activity data detail.
 *
 * @param array $pHBEnv         - Home banking settings
 * @param int $pDetailId        - The detail id to get
 * @param boolean $pIsScheduled - The type of txn getting detail for is a scheuled txn
 * @return array of information to return to app
 */
function GatherUserActivityDetail( $pHBEnv, $pDetailId, $pIsScheduled ) {
  require_once(dirname(__FILE__) . '/../library/hcuUserActivity.i');

  // return the standard header block
  $replyArr = array( 'STATUS' => array('CODE' => 0,'SEVERITY' => 'INFO') );

  // add some fields
  $replyArr["DTSERVER"] = date('YmdHis');
  $replyArr["MEMBER"] = $pHBEnv['Uid'];

  try {
    $resultDetail = GetActivityDetail( $pHBEnv, $pDetailId, $pIsScheduled );

    // return the data - everything that was collected
    $replyArr["ACTIVITY"] = array();

    if ( $resultDetail != null && is_array($resultDetail['data']) ) {
      array_walk_recursive( $resultDetail['data'], 'MakeHTMLEntities' );
    }


    $replyArr['ACTIVITY']["details"] = $resultDetail['data'];

    // we are successful at this point

  } catch( Exception $e ) {
    $code = $e->getCode();
    $message = $e->getMessage();

    // return an error header block
    $replyArr["STATUS"] = array('CODE' =>$code,'SEVERITY' => 'ERROR');
    $replyArr["MESSAGE"] = array( "ERR" => $message );
  }

  return $replyArr;
} // end GatherUserActivityDetail

/**
 * UserActivityAction
 * Call the function to gather the requested user activity data detail.
 *
 * @param array $pHBEnv         - Home banking settings
 * @param int $pDetailId        - The detail id to act upon
 * @param boolean $pIsScheduled - The type of txn acting upon is a scheuled txn
 * @param string $pAction       - The specific action
 * @return array of information to return to app
 */
function UserActivityAction( $pHBEnv, $pDetailId, $pIsScheduled, $pAction ) {
  require_once(dirname(__FILE__) . '/../library/hcuUserActivity.i');

  // return the standard header block
  $replyArr = array( 'STATUS' => array('CODE' => 0,'SEVERITY' => 'INFO') );

  // add some fields
  $replyArr["DTSERVER"] = date('YmdHis');
  $replyArr["MEMBER"] = $pHBEnv['Uid'];

  try {
    // this call will return result detail
    $resultDetail = DoActivityAction( $pHBEnv, $pDetailId, $pIsScheduled, $pAction );

    if ( $resultDetail["code"] != "000" ) {
      // pass along the error
      throw new Exception($resultDetail["error"]);
    }

    // add a message to the reply (the action would have been successful to get to this point)
    $message = "";
    if ( $pAction == "approve" ) {
      if ( isset( $resultDetail["data"]["confirm"] ) && strlen( $resultDetail["data"]["confirm"] ) > 0 ) {
        $message = $pHBEnv["MC"]->msg("Transaction Sent", HCU_DISPLAY_AS_RAW) .
                   "\n\n" .
                   $pHBEnv["MC"]->msg("Confirmation", HCU_DISPLAY_AS_RAW) . ": " . $resultDetail["data"]["confirm"];
      } else {
        $message = $pHBEnv["MC"]->msg("record approved", HCU_DISPLAY_AS_RAW);
      }
    } else if ( $pAction == "decline" ) {
      $message = $pHBEnv["MC"]->msg("record declined", HCU_DISPLAY_AS_RAW);
    } else if ( $pAction == "cancel" ) {
      $message = $pHBEnv["MC"]->msg("record cancelled", HCU_DISPLAY_AS_RAW);
    } else {
      $message = "Unknown action received: $pAction";
    }

    $resultDetail["data"]["message"] = $message;

    // return the data - everything that was collected
    $replyArr["ACTIVITY"] = array();

    if ( $resultDetail != null && is_array($resultDetail['data']) ) {
      array_walk_recursive( $resultDetail['data'], 'MakeHTMLEntities' );
    }

    $replyArr['ACTIVITY'] = $resultDetail['data'];

    // we are successful at this point

  } catch( Exception $e ) {
    $code = $e->getCode();
    $message = $e->getMessage();

    // return an error header block
    $code = $code > 0 ? $code : "999";
    $replyArr["STATUS"] = array('CODE' =>$code,'SEVERITY' => 'ERROR');
    $replyArr["MESSAGE"] = array( "ERR" => $message );
  }

  return $replyArr;
}

// Get any pending user activity and return the count of what this user can approve.
// This is copied from hcuPreContent.i.
function GetPendingUserActivity( $pHBEnv ) {
    $ucTransactionsCount = 0;

    $ucTransactions = ReturnUnconfirmedTransactions($pHBEnv['dbh'], $pHBEnv);
    if (is_array($ucTransactions)) {
      foreach ($ucTransactions as $key => $value) {
        $canConfirm = Perm_AccessRights($pHBEnv['dbh'], $pHBEnv, array("feature" => $value['feature_code']));
        if ($canConfirm['confirm']) {
          $ucTransactionsCount ++;
        }
      }
    }

    return $ucTransactionsCount;
}  // end GetPendingUserActivity

// Temporary until the actual function is developed.
function GetFakeUserCompassMenu( $pHBEnv ) {
    $fakeData = <<< ENDOFFAKEDATA
{ "logout":{
    "display":"Sign Out",
    "icon":"power-off",
    "action":"exit"
  },
  "activity":{
    "display":"User Activity",
    "icon":"bell",
    "count":"2",
    "menuid":"33",
    "script":"hcuUserActivity.prg",
    "action":"menu"
  },
  "messages":{
    "display":"Secure Messages",
    "icon":"comments",
    "count":"0",
    "menuid":"47",
    "script":"hcuSecureMail.prg",
    "action":"menu"
  },
  "status": {
    "display":"Status",
    "icon":"tasks",
    "count":"1",
    "endpoint":"http://10.100.10.76:8000/banking/hcuAccountStatus.prg?cu=SCRUBCU",
    "action":"popup"
  },
  "user": {
    "display":"User Info",
    "icon":"user",
    "count":"2",
    "action":"popup",
    "password": {
      "title": "Password update required!",
      "message": "Login expires after 20 more uses.",
      "icon": "exclamation",
      "level": "warning",
      "link": "Update Now",
      "script":"hcuProfilePwd.prg",
      "menuid":"52",
      "action":"menu"
    },
    "email": {
      "title": "Your current email",
      "message": "person@example.com",
      "icon": "envelope",
      "level": "info",
      "link": "Update Now",
      "script":"hcuProfileEmail.prg",
      "menuid":"53",
      "action":"menu"
    },
    "security": {
      "title": "Security credentials update required!",
      "message": "Login expires after 1 more use.",
      "icon": "exclamation-triangle",
      "level": "error",
      "link": "Update Now",
      "script":"hcuProfileSecurity.prg",
      "menuid":"54",
      "action":"menu"
    }
  }
}
ENDOFFAKEDATA;

    return $fakeData;
}

// This is a callback function used to make htmlentities from strings in arrays to be returned to the
//  caller. It is used when XML or JSON will be returned.
function MakeHTMLEntities( &$item, $key ) {
            $item = htmlentities( $item, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE );
        }