hcuConnect.prg

<?php
/* File: hcuConnect
 * This file will contain the logic to connect to external vendors.
 *
 * Note: to throw an exception, use an error object to get the title and content:
 *        $error["title"] = "title";
 *        $error["content"] = "content";
 *        throw new Exception( json_encode( $error ) );
 */
require_once('cutrusted.i');
require_once('LogSSO.i');
require_once('SSOEncryption.i');
require_once('hcuMIRhandler.i');

// flag to use/not-use openssl based encryption functions for SSOs
$use_openssl_encryption = true;

// ** SET HOMECU FLAGS - no menu, limited branding
$serviceShowInfo = false;
$serviceLoadMenu = false;
$serviceShowMenu = false;

  $serviceAllowReadonly = true;
/*
 * Force logging
 */
//$logSessionData = file_get_contents('php://input');
//$logheaders = apache_request_headers();
//# couldn't call LogSSO because no dbh yet; couldn't pconnect because no dbenv yet
//# couldn't call logger because no HB_ENV yet; and by the time any of those things
//# were present we already redirected to hcuLogin.  So this is ugly, but answered the question
//
//print "Headers: " . print_r($logheaders, true) . "\n\nData: " . print_r($logSessionData,true) . "\n";exit;
/*
 * End Force logging
 */

  // ** INCLUDE MAIN GLOBAL SCRIPT -- Handles security / global variable values
  require_once('hcuService.i');

  /******
   * DEBUG
   */
  $debugMode = true;
  $showurl = false;

  # default, don't include preContent and postContent files
  $usePrePostcontent = false;

  $dms_ok = array('cu' => 'string', 'Flang' => 'string',
         'mode' => 'string', 'debug' => 'digits', 'option' => 'string','vanilla' => 'digits',
         "flavor" => "string", "platform" => "string" );
  dms_import_v2($HB_ENV, "HCUPOST", $dms_ok);
//print_r( $HB_ENV["HCUPOST"] );

/*
 * ** CHECK BAM PERMISSIONS **
 * NOTE: DOES NOT RETURN ON FAILURE
 */
PermCheckBAM($dbh, $HB_ENV, $MC);

try {
  // $mode is actually coming in as a $_GET
  // but get it from the dms_import array so it is sanitized
  $mode = HCU_array_key_value('mode',$HB_ENV['HCUPOST']);
  // and throw an error if it isn't set
if ( empty($mode) ) {
    throw new Exception("Invalid Connection Mode");
}

# 11/22/17 documented interfaces by type in arrays for possible use by the speedbump stuff
# bill pay interfaces
$bpifx = array('ALLIEDPAY_SSO', 'CERTEGY','CHKFREE','IPAY','IPAY_V3','MVANTE','MemberPay','PAYVERIS','PSCUPAY_SSO');
# credit card info interfaces (DREAMPOINTS never implemented)
$ccifx = array('DREAMPOINTS','FIS_EZCARD','GOTOMYCARD','HcuEZCARD','PSCUINFO','PSCU_ACCPT','FISERV_CPS');
# estatement interfaces
# SavvyMoney is only sort-of an estatement -- but I need the $accountToUse to be populated
$esifx = array('BDI','Bit','Digital','LASERTEC_ES','LKCS','ThinkDigital','WebShare','LASERPRINT_ES','IDS_ES','SavvyMo_SSO');
# mortgage info interfaces. DMI & HcuDMI are same except for location of key info
$mtgifx = array('DMI','FICS','HcuDMI');
# MoneyDesktop. both should be merged into MDesk3, but mx has to adjust config for MDesk3
# only MDesk3 ported for Odyssey
$pfmifx = array('MDesk3');
# desktop RDC.
$rdcifx = array('ENSENTA_BRDC','VSHO','VSOFT');
# ach origination MWI_LOANPAY changed to Amplify, but specs are much different
# chk DELUXE_OP check orders
# loan app interfaces. hcuLoanApp is our in-house stuff
$lnappifx = array('MeridianLink','hcuLoanApp', 'CUDIRECT_SSO');

# these SSOs are linked through the history link, not a menu item.
# They expect the member & suffix to be provided on URL, not through speedbump
$skipSpeedBump = array('DMI', 'FIS_EZCARD', 'GOTOMYCARD');

  if ( !in_array($mode, $skipSpeedBump) && in_array($mode,array_merge($bpifx, $esifx, $rdcifx, $lnappifx)) ) {
    /* See if there needs to be a speedbump or only one account to choose from.
     * If return from this include, a variable will be added to $HB_ENV.
     */
    if ( in_array($mode,$bpifx) ) {
      $SPEEDBUMP_FEATURE = "BP";
    } else if ( in_array($mode,$esifx) ) {
      $SPEEDBUMP_FEATURE = "ES";
    } else if ( in_array($mode,$rdcifx) ) {
      $SPEEDBUMP_FEATURE = "RDC";
    } else if ( in_array($mode, $lnappifx) ) {
      $SPEEDBUMP_FEATURE = "LOAN";
    }
    require_once(dirname(__FILE__) . '/../includes/hcuAccountSelector.i');
    $accountToUse = $HB_ENV["selected_account"];

  } else if ( !in_array($mode, $skipSpeedBump) && in_array($mode, $ccifx) ) {
    /*
     * See if the speedbump requires a list of all member accounts the user can view/access.
     * SSO's in the $ccifx list are not limited to eStatements, RDC or BillPay features.
     */
    require_once(dirname(__FILE__) . '/../includes/hcuMemberSelector.i');
    $accountToUse = $HB_ENV["selected_account"];
  } else {
    $accountToUse = "";
  }

  // give a page that does nothing so the other choices can be chosen
  //
  // ** INCLUDE PRE CONTENT SCRIPT
  $viewportAllowed = true;

    // ** INSERT BUSINESS LOGIC FOR THIS FORM
    $Cu = $HB_ENV["Cu"];
    $Cn = $HB_ENV["Cn"]; # remember for Odyssey this is a user_name, not a member account
    $Uid = $HB_ENV["Uid"]; # this is the unique user identifier
    $chome = strtolower($HB_ENV["Cu"]);
    $Flang = $HB_ENV["Flang"];
    $Ml = $HB_ENV["Ml"];
    $Uid = $HB_ENV['Uid'];

    $live = $HB_ENV["live"];

    // not all paths set a web page
    $href = "";

//    $dbh = db_pconnect();


    $sql = "select user_id, email
            from {$Cu}user
            where user_name='$Cn'";

    $sth = db_query($sql, $HB_ENV["dbh"]);
    #$lasterr=db_last_error();
    if (db_num_rows($sth) != 1) {
        throw new Exception("Member Query failed");
    }
    $mbrow = db_fetch_array($sth, 0);

    // Add some member-specific info from the environment variable
    $mbrow["rt"] = HCU_array_key_value('rt', $HB_ENV);
    if (HCU_array_key_value('Ml', $HB_ENV)) {
        $mbrow["email"] = HCU_array_key_value('Ml', $HB_ENV);
    }

    if ( in_array($mode,$bpifx) ) {

      $sql = "SELECT billpayid FROM {$HB_ENV["HCUPOST"]["cu"]}memberacct WHERE accountnumber = '$accountToUse'";

      $sth = db_query($sql, $HB_ENV["dbh"]);
      if (db_num_rows($sth) != 1) {
          throw new Exception("Billpay Query failed");
      }
      $row = db_fetch_array($sth, 0);
      $mbrow["billpayid"] = $row[0];
    } else {
      $mbrow["billpayid"] = "";
    }

    $billpayid = $mbrow["billpayid"];

    $trusted = cutrusted_read($dbh, array('Cu' => $Cu, 'trustedid' => $mode));

    if ($trusted["status"]["Response"] == 'false') {
        throw new Exception("Trusted Third-Party Query Failed.");
    }

    $parms = $trusted["data"];

    $loggingFlag = trim( HCU_array_key_value('hcuLogging', $parms) );
    if ( strlen( $loggingFlag ) > 0 ) {

      $enable = $loggingFlag == -1;

      if ( !$enable ) {
        $loggingFlag = str_replace( " ", "", $loggingFlag );
        $testArray = explode( ",", $loggingFlag );
        $enable = in_array( $HB_ENV["Cn"], $testArray );
      }

      // @todo shouldn't this if/else wrapper be eliminated? If ! $enable above, we set $enable
      if ( $enable ) {
        // these are used inside the plugin to test if logging and info to log.
        $parms["logging"] = "enabled";
        $parms["environment"] = array( "Cu" => $HB_ENV["Cu"],               // credit union
                                       "memberId" => $HB_ENV["Cn"],         // member id
                                       "SSOVendor" => $mode,         // member id
                                       "userIP" => $_SERVER['REMOTE_ADDR'], // user's ip address
                                       "userAgent" => $_SERVER['HTTP_USER_AGENT'], // user's ip address
                                       "platform" => "{$HB_ENV['HCUPOST']['vanilla']}-{$HB_ENV['HCUPOST']['platform']}",
                                       "dbConn" => $dbh );                  // database connection
      } else {
        $parms["logging"] = "";
      }
    }

    $isapp = (integer) in_array(strtoupper(HCU_array_key_value('platform', $HB_ENV['HCUPOST'])), array('APP', 'ADA'));

    if ($mode !== 'VSOFT' && !$isapp  ) {
        $usePrePostcontent = true;
    }

    if ($mode == "PAYVERIS" && $HB_ENV['HCUPOST']['flavor'] == "PVWIDGET" ) {
        $usePrePostcontent = true;
        $serviceShowInfo = true;
    }

    if ($mode == "PAYVERIS" && $HB_ENV['HCUPOST']['flavor'] == "PVUIR" ) {
        // PAYVERIS UIR version will provide all branding and navigation
        // but need the PrePostContent so the styling and divs work later
        $usePrePostcontent = true;
        $serviceShowInfo = ($isapp ? false : true);
    }

    if ( $mode == 'WebShare'  && !$isapp ) {
        $serviceShowInfo = true;
        $serviceLoadMenu = true;
        $serviceShowMenu = true;
    }
    if ( $mode == 'MDesk3' && !$isapp ) { # MDesk3 but not app
        # $usePrePostcontent set in block above, but trying to untangle the spaghetti...
        $usePrePostcontent = true;
        $parms['hcuInfo'] = (integer) HCU_array_key_value('hcuInfo', $parms);
        $parms['hcuMenu'] = (integer) HCU_array_key_value('hcuMenu', $parms);
        $parms['hcuClose'] = (integer) HCU_array_key_value('hcuClose', $parms);
        $serviceShowInfo = ($parms['hcuInfo'] ? true : false);    #login status box upper right
        $serviceLoadMenu = ($parms['hcuMenu'] ? true : false);    # load menu from cu directory
        $serviceShowMenu = ($parms['hcuMenu'] ? true : false);    # display the menu
    }
    if ($mode == "SavvyMo_SSO") {
        $usePrePostcontent = false;
        $serviceShowInfo = false;
    }

    if ($mode == "DMI" || $mode == "HcuDMI") {
        $usePrePostcontent = false;
        $serviceShowInfo = false;
    }

   if ($mode == 'ALLIEDPAY_SSO') {
    /**
     * on alliedpay_sso request, check which platform to determine
     * when to display the menu and login status box.
     *
     * for version odyssey
     *
     * desktop: show status box;
     * mobile web: do not show; vanilla = 1
     * mobile app: do not show; platform = APP
     *
     * for mammoth
     *
     * desktop: show status box;
     * mobile web / mobile app use mobileConnect script instead
     */
    list ($serviceLoadMenu, $serviceShowMenu, $serviceShowInfo) = AlliedSsoServiceFlags();

   }

  if ($usePrePostcontent) {
      // this lets the PreContent still use the banner if called by the apps.
      $preKeepBanner = true;

      require_once('hcuPreContent.i');
  }

  /**** Switch ends line 4620 08/19 **/
  switch ($mode) {

    case "ALLIEDPAY_SSO":

      if (!hcu_checkService($dbh, "ALLIEDPAY")) {
        $omsg = hcu_checkServiceMsg($dbh, "ALLIEDPAY");
        throw new Exception("$omsg");
      }

      if ( $GLOBALS['viewportAllowed'] ) {
        echo '<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">';
      }

      require_once(__DIR__ . '/../library/AlliedPay_API.i');

      // Modifies "$parms" byRef
      apn_config($parms);

      $billpayid = (HCU_array_key_value('billpayid', $mbrow)) ? trim($mbrow['billpayid']) : $HB_ENV['Cn'];

      // This is only loaded from hcuService.i **if live.** If not LIVE devMode should be 1 in
      // trusted details and you should be using  one of the test members configured at the
      // faux fetcher:
      // https://int-apl0.homecu.net/hculive/xenia-homecu-faux.mp
      //
      // NOTE: GetMemberInfo does not work for batch clients, so don't try.
      // the if($live) refers to clients on live interface vs. batch interface,
      // NOT test vs. production
      //
      //   if (! function_exists('GetMemberInfo')) {
      //     require_once(__DIR__ . '/../../shared/library/sAPIAppl.i');
      //   }
        if ($live) {
            $MIR = GetMemberInfo($HB_ENV, ["member" => $accountToUse]);
            if (! isset($MIR['code']) || ($MIR['code'] !== '000')) {
                $code = $MIR['code'] ?? 'no code';
                throw new Exception("No Member Data ($code)");
            }
        } else {
            # batch interface will need to figure out how to get MIR info */
            $MIR["data"] = array();
        }

      if (!HCU_array_key_exists('accountnumber', $MIR['data'])) {
        throw new Exception("No Member Data (account number)");
      }

      //(phone not required) per Allied 8/29/18 let 'em in, phone or not
      // they will get an error if they try P2P w/o phone number
      $reqMIR = [
        'accountnumber' => 1,
        'firstname' => 1,
        'lastname' => 1,
        'address1' => 1,
        'city' => 1,
        'state' => 1,
        'zip' => 1
      ];

      $config = FeatureGateConfig::GetInstance($dbh);
      $MIRGate = new CreditUnionGate(CreditUnionGate::MIR_HANDLER, $config);
      if ($MIRGate->WillPass($HB_ENV['Cu'],['username' => $HB_ENV['Cn']])) {
          $parsedMIR = FormatMIR($MIR['data'], $Ml, $reqMIR, 'Y-m-d', 'shortname', true, 'pass');
      } else {
          $parsedMIR = apn_populateMIR($MIR, $Ml, $reqMIR, 'Y-m-d', 'named', true);
      }
      if (!HCU_array_key_value('response', $parsedMIR['status'])) {
        $message = (HCU_array_key_value('message', $parsedMIR['status'])) ?
                    $parsedMIR['status']['message'] : "Member Info Not Found";
        throw new Exception($message);
      }

      $accounts = apn_selectAccounts($dbh, $HB_ENV['Cu'], $HB_ENV['Cn'], $parms);

      if (!HCU_array_key_value('response', $accounts['status'])) {
        $message = (HCU_array_key_value('message', $accounts['status'])) ?
                    $accounts['status']['message'] : "Failed Retrieving Account list";
        throw new Exception($message);
      }

      $ssoPayload = apn_buildSSOPayload($parms['apnDomain'], $billpayid, $parsedMIR['data'], $accounts['data']);

      if (!HCU_array_key_value('response', $ssoPayload['status'])) {
        $message = (HCU_array_key_value('message', $ssoPayload['status'])) ?
                    $ssoPayload['status']['message'] : "Failed building SSO Request";
        throw new Exception($message);
      }

      $ssoAuthHdr = apn_buildAuthHdr(
        $parms['apnURL'],
        $parms['apnDomain'],
        $parms['apnPubkey'],
        $parms['apnPrivkey'],
        $billpayid
      );

      if (!HCU_array_key_value('response', $ssoAuthHdr['status'])) {
          $message = (HCU_array_key_value('message', $ssoAuthHdr['status'])) ?
                      $ssoAuthHdr['status']['message'] : "Failed building Authorization Header";
          throw new Exception($message);
      }

      $curl_params = [
        'Authorization' => $ssoAuthHdr['data'],
        'Content-Type' => 'Content-Type: application/json'
      ];
      $parms["environment"]["logPoint"] = "AlliedPay SSO";
      $URI = apn_embcurl($parms, $parms['apnURL'], 'POST', $curl_params, $ssoPayload['data']);

      if (HCU_array_key_exists('error', $URI)) {
        $message = HCU_array_key_value('status', $URI['error']) . " " . HCU_array_key_value('message', $URI['error']);
        throw new Exception($message);
      }

      // $URI comes back as
      // { "$id": "1", "Uri": "https://homecu.demo.alliedpayment.com/billpay/sso?IV=Jm2zGzEBYnr6M4QTKyhEOA,,&ssoToken=7kyk40eN1Bt-5WU7nrXE6I82bvAHf1MrF22-2_rawTosKnVX_FDZhQ9_t3l-pWD0jskDRzJO2csIs_l3v2I2_oulUkv0WyCTMBUXU0ZluOlTzHSZewsl7AQHROBDrKdwWbiH2VgUm9jadVMAvBhXBA,,&signature=275F5189631F4AAC9028C0FF8D25BAC5128B2323" }
      $uri = HCU_array_key_value('Uri', $URI);
      if (empty($uri)) {
        throw new Exception('Connection Failed Invalid Link');
      }

      $ua = strtolower($_SERVER['HTTP_USER_AGENT']);
      $divclass = null;
      if (stripos($ua, 'iPhone') !== false || stripos($ua, 'iPod') !== false || stripos($ua, 'iPad') !== false) {
        $divclass = ' class="appledevice"';
      }

      if (
        ! HCU_array_key_value('vanilla',$HB_ENV['HCUPOST']) &&
        ! in_array(strtoupper(HCU_array_key_value('platform',$HB_ENV['HCUPOST'])), ['MBL','APP','ADA'])
      ) {

        $linkText = 'Return to Accounts';
        $linkLoc = "{$HB_ENV['loginpath']}/hcuAccounts.prg?{$HB_ENV['cuquery']}";

        $return_to_accounts =  "
          <button type=\"button\" id=\"showAccounts\" name=\"btnOLB\" style=\"margin:6px\"
            onclick=\"window.location='{$linkLoc}'\" class=\"k-button\">
            <span class=\"fa fa-arrow-left\"></span>&nbsp;{$linkText}
         </button>
        ";
      }

      // load content from $uri
      print <<<EOF

      <script>
        function showPage() {
          var bp = document.getElementById("hcuBPframe"),
          action = '$uri';
          bp.src = action;
        }

        $(window).resize(function() {
          $('#billpay-scroll-wrapper').height($(window).innerHeight() - $('#workspace')[0].offsetTop - 150);
        });

        $(window).load(function() {
          $('#billpay-scroll-wrapper').height($(window).innerHeight() - $('#workspace')[0].offsetTop - 150);
        });
      </script>
      <div id="backToHCU">
        $return_to_accounts
      </div>
      <script>
      $(document).ready(function() {
        showPage('$uri');
      });
      </script>
      <div id="billpay-scroll-wrapper"{$divclass}>
        <iframe id="hcuBPframe" sandbox="allow-pointer-lock allow-popups allow-same-origin allow-top-navigation allow-scripts allow-forms"></iframe>
      </div>
EOF;
        // ALLIED_SSO
        break;

      case "CUDIRECT_SSO":
        /*
         * SSO flow
         * CuDir_config to set parameters
         * populate mir
         * *
         * build sso payload
         * call CuDir_embcurl to get URI
         * redirect to URI
         */
        if (!hcu_checkService($dbh, "CUDIRECT")) {
            $omsg = hcu_checkServiceMsg($dbh, "CUDIRECT");
            throw new Exception("$omsg");
        }

        // as of 5.3, dirname(__FILE__)) no longer required
        // https://www.php.net/manual/en/language.constants.predefined.php#constant.dir
        require_once(__DIR__ . '/../includes/CUDirect_API.i');
        // This is only loaded from hcuService.i **if live.** If not LIVE devMode should be 1 in
        // trusted details and you should be using  one of the test members configured at the
        // faux fetcher:
        // https://int-apl0.homecu.net/hculive/xenia-homecu-faux.mp
        //
        // NOTE: GetMemberInfo does not work for batch clients, so don't try.
        // the if($live) refers to clients on live interface vs. batch interface,
        // NOT test vs. production
        //
        // if (! function_exists('GetMemberInfo')) {
        //   require_once(__DIR__ . '/../../shared/library/sAPIAppl.i');
        // }

        try {
          CuDir_config($parms);

        } catch (Exception $e) {
          throw new Exception("Exception in CUDIRECT_SSO config: {$e->getMessage()}");
        }
        if ($live) {
            $MIR = GetMemberInfo($HB_ENV, ["member" => $accountToUse]);
            if (! isset($MIR['code']) || ($MIR['code'] !== '000')) {
                $code = $MIR['code'] ?? 'no code';
                throw new Exception("No Member Data ($code)");
            }
        } else {
            # batch interface will need to figure out how to get MIR info */
            $MIR["data"] = array();
        }

        if (!HCU_array_key_exists('accountnumber', $MIR['data'])) {
          throw new Exception("No Member Data (account number)");
        }

        $reqMIR = [
            'accountnumber' => 1,
            'firstname'     => 1,
            'lastname'      => 1,
            'address1'      => 1,
            'city'          => 1,
            'state'         => 1,
            'zip'           => 1,
            'dob'           => 1,
            //'phonenumbers'  => 1
        ];

        $config = FeatureGateConfig::GetInstance($dbh);
        $MIRGate = new CreditUnionGate(CreditUnionGate::MIR_HANDLER, $config);
        if ($MIRGate->WillPass($HB_ENV['Cu'],['username' => $HB_ENV['Cn']])) {
            $parsedMIR = FormatMIR($MIR['data'], $Ml, $reqMIR, 'Y-m-d', 'named', true, '');
        } else {
            try {
            $parsedMIR = populateMIR($MIR['data'], $Ml, $reqMIR, 'Y-m-d', 'named', true);

            } catch (Exception $e) {
            throw new Exception("Exception populating MIR: {$e->getMessage()}");
            }
        }

        if (! (HCU_array_key_value('response', $parsedMIR['status']) === true)) {

          $message = (HCU_array_key_value('message', $parsedMIR['status'])) ?
            $parsedMIR['status']['message'] :
            "Member Info Not Found";

          throw new Exception($message);
        }

        $ssoPayload = CuDir_buildSSOPayload(
          $parms['CuDirOrg'],
          $parms['CuDirUser'],
          $parms['CuDirPass'],
          $HB_ENV['Cn'],
          $parsedMIR['data']
        );

        # throw error on failure
        if (!HCU_array_key_value('response', $ssoPayload['status'])) {

          $message = (HCU_array_key_value('message', $ssoPayload['status'])) ?
            $ssoPayload['status']['message'] :
            "Failed building SSO Request";

          throw new Exception($message);
        }

        $URI = CuDir_embcurl(
          $parms,
          $parms['CuDirURL'],
          'POST',
          [
            'Content-Type' => 'Content-Type: text/xml; charset=utf-8;',
          ],
          $ssoPayload['data']
        );

        if (HCU_array_key_exists('error', $URI)) {
            // 07-19, previous one liner throwing notice for __toString()/mixed
            $stat = HCU_array_key_value('status', $URI['error']);
            $msg  = HCU_array_key_value('message', $URI['error']);
            throw new Exception("$stat $msg");

        } else {
            $uri    = HCU_array_key_value('BaseURL', $URI);
            $token  = HCU_array_key_value('Token', $URI);

            if (empty($uri) || empty($token)) {
                throw new Exception('Invalid Link' . print_r($URI, true));
            } else {
              // load content from $uri and redirect
              header('Location: '."$uri?SSOToken=$token&frame=no");
              exit;
            }
        }

          break;

        case "DREAMPOINTS":

        function _saltMine($length) {
            $pool = array_merge(range(0,9), range('a', 'z'),range('A', 'Z'));
            $poolsize = count($pool) - 1;
            $salt = '';

            for($i=0; $i < $length; $i++) {
                $salt .= $pool[mt_rand(0, $poolsize)];
            }
            return $salt;
        }

            if (!hcu_checkService($dbh, "DREAMPOINTS")) {
                $omsg = hcu_checkServiceMsg($dbh, "DREAMPOINTS");
                throw new Exception("$omsg");
            }

            $pilot = HCU_array_key_value('pilot', $parms);
            if ($pilot) {
                $serviceurl = HCU_array_key_value('piloturl',$parms);
                $key = HCU_array_key_value('pilotkey', $parms);
            } else {
                $serviceurl = HCU_array_key_value('produrl', $parms);
                $key = HCU_array_key_value('prodkey', $parms);
            }
            $bnkid = HCU_array_key_value('bnkid', $parms);
# generate a random iv for each call
        $cipher = 'des-ede3-cbc';
        if (!in_array($cipher, openssl_get_cipher_methods())) {
            throw new Exception("Invalid cipher method");
        }

        $ivlen = openssl_cipher_iv_length($cipher);
        $iv = openssl_random_pseudo_bytes($ivlen);
        $iv = _saltMine($ivlen);
            if (empty($serviceurl) || empty($bnkid) || empty($iv) || empty($key)) {
                $msg = "Configuration Error ";
                if (empty($serviceurl)) {
                    $msg .= 'ServiceURL ';
                }
                if (empty($bnkid)) {
                    $msg .= 'bnkid ';
                }
                if (empty($iv) || empty($key)) {
                    $msg .= 'Encrytpion_credentials ';
                }

                throw new Exception($msg);
            }
            if ($live) {
                $MIR = GetMemberInfo($HB_ENV, array("member" => $accountToUse));
            } else {
                # batch interface will need to figure out how to get MIR info */
                $MIR["data"] = array();
            }
            #GetMemberInfo returns array
            # check for status other than 101 and give error
            # currently accepting 101 and 201, but probably shouldn't accept 201

            /* Only using first name / last name
             * check to see if we have enough valid data to make vendor happy
             */
            $reqMIR = array(
                'accountnumber' => 1,
                'lastname' => 1
            );


            $config = FeatureGateConfig::GetInstance($dbh);
            $MIRGate = new CreditUnionGate(CreditUnionGate::MIR_HANDLER, $config);
            if ($MIRGate->WillPass($HB_ENV['Cu'],['username' => $HB_ENV['Cn']])) {
                $parsedMIR = FormatMIR($MIR['data'], $HB_ENV['Ml'], $reqMIR, 'mdY', 'flat', false, '');
            } else {
                $parsedMIR = populateMIR($MIR['data'], $HB_ENV['Ml'], $reqMIR, 'mdY', 'flat', false);
            }
            if (!$parsedMIR['status']['response']) {
                throw new Exception($parsedMIR['status']['message']);
            }
            $msg = '';
            if (empty($parsedMIR["data"]["accountnumber"]) ||
                empty($parsedMIR["data"]["lastname"]) ||
                empty($serviceurl) ||
                empty($parms['bnkid']) ||
                empty($iv) ||
                empty($key)) {
                throw new Exception("Not enough member info for Dreampoints ($msg)");
            }

            $dispname = trim("{$parsedMIR['data']['firstname']} {$parsedMIR['data']['lastname']}");
            $gmstamp = time();
            $salt=_saltMine(12);

/*
 * Turns out the big development roadbloack was....
 * Augeo configured for 16-digit account number, we were passing member number.
 * We can't get 16-digit, they can't get member.
 * We settled on DDA, which appears to be member number zero-padded to 10 digits.
 *
 * This really should come from trusted detail.  Might need a function to get
 * values from db as other trusted integrations do.  For now, use 'UserCodeSize'
 * setting similar to Payveris
 */
            $CodeSize = (integer)HCU_array_key_value('UserCodeSize', $parms);
            if ( $CodeSize > 0) {
                $memUnique = substr(str_repeat('0', $CodeSize) . $accountToUse, (-1 * $CodeSize), $CodeSize);
            } else {
                # default no padding
                $memUnique = $accountToUse;
            }

            $plaintext = "{$memUnique}|{$gmstamp}|{$dispname}|{$salt}";

            $ciphertext = openssl_encrypt($plaintext, $cipher, $key, $options=0, $iv);

            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();                     // the id for this transaction
                $logParms["logPoint"] = "DREAMPOINTS Redirect";      // this action in a readable form
                $dpData = array('BNKID' => $bnkid,
                                'UID' => $ciphertext,
                                'IV' => $iv);

                $logParms["request"] = "cipher $cipher\nplainUID $plaintext\ncurl --request POST --data '" . urldecode(http_build_query($dpData)) . "' '$serviceurl'";               // the request
                $logParms["reply"] = '';                   // the response
                LogSSOActivity($logParms);
            }

                print <<<EOF
  <html>
  <body onload = "javascript:document.SSOform.submit();">
  <form method="post" name="SSOform" action = "{$serviceurl}">
  <input type="hidden" name="BNKID" value="{$bnkid}">
  <input type="hidden" name="UID" value="$ciphertext">
  <input type="hidden" name="IV" value="$iv">
  </form>
  </body>
  </html>
EOF;
            break;
        case "HcuDMI": # same SSO, using key info stored at HomeCU ({cu}extkey table)
        case "DMI":
            # NOTE that DMI does not use the speedbump.  Both accountToUse and
            # loannumber are populated from the loan history settings in home banking.
            # On Mammoth, only the loannumber was set with loannumber=#loan#
            # For Odyssey, add a=#acctid#

            if (!hcu_checkService($dbh, "Dovenmuehle")) {
                $omsg = hcu_checkServiceMsg($dbh, "Dovenmuehle");
                throw new Exception("$omsg");
            }
            /*
             * need to force test mode for certain testers
             */
            $forceTest = 0;
            $testingFlag = str_replace( " ", "", HCU_array_key_value('testers', $parms ));
            $testingArray = explode( ",", $testingFlag );
            $forceTest = in_array( $HB_ENV["Cn"], $testingArray );

            $parms['pilot'] = HCU_array_key_value('pilot', $parms);
            if ($parms['pilot'] || $forceTest ) {
                $parms['GUID'] = HCU_array_key_value('testGUID',$parms);
                $parms['AuthURL'] = HCU_array_key_value('testAuthURL', $parms);
                $parms['SSOURL'] =  HCU_array_key_value('testSSOURL', $parms);
            } else {
                $parms['GUID'] = HCU_array_key_value('prodGUID', $parms);
                $parms['AuthURL'] = HCU_array_key_value('prodAuthURL', $parms);
                $parms['SSOURL'] = HCU_array_key_value('prodSSOURL', $parms);
            }
            // print "<pre>" . print_r($parms,true) . "</pre>"; exit;

            $dms_ok = array('keyloc' => 'string');
            dms_import($dms_ok);

            $Cu = $HB_ENV['Cu'];
            $Cn = $HB_ENV['Cn'];

            if (empty($parms['GUID']) ||
                empty($parms['AuthURL']) || empty($parms['SSOURL']) ||
                !(HCU_array_key_value('hcuCert',$parms)) ||
                !(HCU_array_key_value('hcuKey',$parms)) ||
                empty($Ml) || empty($Cu) ) {
                throw new Exception('Invalid or missing parameters');
            }

            /** Load  Cert file **/
            // ** Get the Cert File Secrets ID from trusted details
            $tdCertFileId = $parms['hcuCert'];

            /**
             *  Retrieve and decrypt the cert file -- use rdccert as return value to limit scope of changes
             */
            $hcuCertFile = GetAwsCertFile($tdCertFileId, HOMECU_ENC_CERT_DIR, HOMECU_DOCK_CERT_DIR);

            // ** Get the Key File Secrets ID from trusted details
            $tdKeyFileId = $parms['hcuKey'];

            /**
             *  Retrieve and decrypt the key file -- use rdccert as return value to limit scope of changes
             */
            $hcuKeyFile = GetAwsCertFile($tdKeyFileId, HOMECU_ENC_CERT_DIR, HOMECU_DOCK_CERT_DIR);

            /** Did the files from trusted detail get created as expected? **/
            if (($hcuCertFile == '' ||  !(is_readable($hcuCertFile))) || ($hcuKeyFile == '' || !(is_readable($hcuKeyFile)))) {

                throw new Exception("Security Files missing or unreadable");
            }
            $keyloc = (isset($keyloc) ? $keyloc : '');
            if (strtoupper($keyloc) == 'EXTERNAL') {
                # I think we lost something on the conversion to Odyssey here
                # looks like accountToUse won't be set until after decrypt and
                # split acctid below. That will need fixed to use external keys

              if (empty($accountToUse) ) {
                throw new Exception('Missing Account Parameter');
              }

              # get dmi account from {$CU}extkey table
              # should only have one mortgage per loannumber, but
              # just in case, limit 1
              $sql = "select parms
                    from {$Cu}extkey where accountnumber='" . prep_save($accountToUse, 12) . "'
                     and accounttype = '" . prep_save($loannumber, 25) . "'
                     and providermode='$mode' limit 1;";
            } else {
              $dms_ok = array('a' => 'string');
              dms_import($dms_ok);

              // a = acctid
              // acctid is the string representation of the sub account
              // D|6680|10|0
              $acctID = HCU_PayloadDecode($Cu, $a);
              $loannumber = $acctID[2];
              $accountToUse = $acctID[1];

              // must restrict to the current user, check if the user
              // actually has access to the loan account that was passed
              // through.
              $sql = "
                SELECT * FROM {$Cu}useraccounts
                WHERE accountnumber = '" . prep_save($accountToUse, 12) . "'
                  AND accounttype = '" . prep_save($loannumber, 25) . "'
                  AND recordtype = 'L'
                  AND user_id = $Uid";
              $sth = db_query($sql, $dbh);
              if (!($sth) || db_num_rows($sth) == 0) {
                throw new Exception('No credit card found.  Please contact the credit union.');
              }

              # get card info from {$CU}loanbalance table
              $sql = "select trim(misc1)
                    from {$Cu}loanbalance where accountnumber='" . prep_save($accountToUse, 12) . "'
                     and loannumber='" . prep_save($loannumber, 25) . "';";
            }

            $sth = db_query($sql, $dbh);
            if (!($sth) || db_num_rows($sth) == 0) {
                throw new Exception('No mortgage loan found.  Please contact the credit union.');
            }
            list($misc1) = db_fetch_array($sth, 0);
            list($dmiloan) = explode(',', $misc1);

            # give error and die if missing values
            if (empty($dmiloan) ) {
                throw new Exception('Empty DMI Loan number');
            }
            $err_msg = "";

            $req = "-d 'loanno=$dmiloan'";
            $req .= " -d 'Rset={$parms['GUID']}'";
            $req .= " -d 'Email=" . urlencode($Ml) . "'";

//            $cmd = "/usr/bin/curl $req  --cert '{$parms['hcuCert']}' --key '{$parms['hcuKey']}' --url '{$parms['AuthURL']}'";
            $cmd = "/usr/bin/curl  --cert '{$hcuCertFile}' --key '{$hcuKeyFile}' --url '{$parms['AuthURL']}?loanno=$dmiloan&Rset={$parms['GUID']}&Email=" . urlencode($Ml) . "'";
#            $dmiauth = getcurl($cmd);
# try POSTFIELDS as array if urlencoded string does not work. Also not sure what CURLOPT_POST ought to be
# Passing an array to CURLOPT_POSTFIELDS will encode the data as multipart/form-data,
# Passing a URL-encoded string will encode the data as application/x-www-form-urlencoded.
            $curlopts = array(
                CURLOPT_RETURNTRANSFER => 1,
                CURLOPT_SSLCERT => "{$hcuCertFile}",
                CURLOPT_SSLKEY => "{$hcuKeyFile}",
                CURLOPT_URL => "{$parms['AuthURL']}?loanno=$dmiloan&Rset={$parms['GUID']}&Email=" . urlencode($Ml));

            $dmiauth = "";
            $ch = curl_init();
            if ($ch) {
                curl_setopt_array($ch, $curlopts);
                $dmiauth = curl_exec($ch);
                curl_close($ch);
            }

            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();                     // the id for this transaction
                $logParms["logPoint"] = "DMI SSO";      // this action in a readable form
                $logParms["request"] = $cmd;                     // the request
                $logParms["reply"] = $dmiauth;                   // the response
                LogSSOActivity($logParms);
            }
# Good Response:
# KEY=B8DE9B1D-4051-4784-8E02-2B55C17B15B7
# Error Response:
# Error=5:Client server IP did not match, access denied

            if (trim($dmiauth) == '' || preg_match("/Error/i", "$dmiauth")) {
                throw new Exception("Connection Failed ( $dmiauth ) ");
            } else {
                # get dmikey out of response
            $dmikey=substr($dmiauth,4);
            if (trim($dmikey) == '' ) {
                throw new Exception("Missing Key ");
            }
            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();                     // the id for this transaction
                $logParms["logPoint"] = "DMI Redirect";      // this action in a readable form
                $logParms["request"] = "SSO w/ key as $dmikey";                     // the request
                $logParms["reply"] = '';                   // the response
                LogSSOActivity($logParms);
            }
                print <<<EOF
  <html>
  <body onload = "javascript:document.SSOform.submit();">
  <form method="post" name="SSOform" action = "{$parms['SSOURL']}">
  <input type="hidden" name="KEY" value="{$dmikey}">
  </form>
  </body>
  </html>
EOF;
            }
            break;
        # begin Odyssey update 6/19/18
######
        case "ENSENTA_BRDC":

            if (!hcu_checkService($dbh, "ENSENTA")) {
                $omsg = hcu_checkServiceMsg($dbh, "ENSENTA");
                throw new Exception("$omsg");
            }
            include_once(dirname(__FILE__) . '/../library/rdcEnsenta.i');
            include_once(dirname(__FILE__) . '/../library/rdcCommon.i');
            # Ensneta_BRDC only works on IE
            # use rt from trusteddetail if there is one, otherwise use the home banking value
            $parms['rt'] = (HCU_array_key_value("rt", $parms) && !preg_match("/\D/",$parms['rt']) ? $parms['rt'] : $HB_ENV['rt']);
            # and complain if it isn't valid
            if (empty($parms['rt']) || preg_match("/\D/",$parms['rt'])) {
                # routing number missing or contains non-digits
                throw new Exception("Routing Number missing or invalid");
            }
            # NOTE this block changed for Odyssey, using code similar to rdcEnsenta.i
            # tried to use rdcEnsenta functions so that we get display description a
            # as configured, and we check permissions / user rights

        if ($parms['HomeCUAuth']) {
            $mbr_rdc = Get_RDCSetting($dbh, $HB_ENV, 'RDCENSENTA', $accountToUse);
            if ($mbr_rdc['status']['code'] != '000') {
                throw new Exception($mbr_rdc['status']['message'], $mbr_rdc['status']['code']);
            }
            $dl = abs( intval( $mbr_rdc['rdcsetting'] ) );

            if ( isset( $parms['HomeCUAuthVal'] ) && strlen( $parms['HomeCUAuthVal'] ) > 0 ) {
                // check to see if current setting is one of the allowed settings
                $authVals = explode( ",", $parms['HomeCUAuthVal'] );
                if ( !in_array( $dl, $authVals ) ) {
                    // treat it as if no setting
                    $dl = 0;
                }
            }

            if (abs(intval($dl)) == 0) {
############# might need a different Get_NoticeInfo form
                    # 'M' device may need to be 'D' desktop instead
                    # but appears to have been working with mobile, so let sleeping dogs lie
                    $HB_Notices_ary = Get_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC'], 'M', "bNoRDC", true);
                    if ($HB_Notices_ary['status']['code'] == '000') {
                        $noticeData = $HB_Notices_ary["notice"][0]["notice_text"];
                    } else {
                        $noticeData = "";
                    }
                    if (strlen($noticeData)) {
                        $message = $noticeData;
                    } else {
                        $message = "Account not permitted for Remote Deposit.  Please contact the Credit Union for more information";
                    }
                    throw new Exception("$message");
            }
        }
            $parms['UAT'] = HCU_array_key_value('UAT',$parms);
            if ($parms['UAT']) {
                $parms['certfile'] = HCU_array_key_value('UATCert', $parms);
                $parms['ssourl'] = HCU_array_key_value('UATsso', $parms);
            } else {
                $parms['certfile'] = HCU_array_key_value('certfile', $parms);
                $parms['ssourl'] = HCU_array_key_value('PRODsso', $parms);
            }
            if (!(is_readable($parms['certfile']))) {
                throw new Exception("Security File missing");
            }
            $gmt = gmdate("Y-m-d H:i:s");

            $parms['Fset2'] = $HB_ENV['Fset2']; # HB_ENV
            $parms['Fset3'] = $HB_ENV['Fset3']; # HB_ENV
            $hculist = RDCGetAccts($dbh, $parms);

            if ($hculist['status']['response'] == 'false') {
                throw new Exception($hculist['status']['message']);
            }

        # got a valid RDC account list

            $err_msg = "";

            $req = "-d rtn={$HB_ENV['rt']}";
            $req .= " -d user_fi_number=$accountToUse";
            $req .= " -d Username=" . urlencode($Cn); # for commercial this should be the user_name. Encoding anticipates non-digit values
            $req .= " -d gmt=" . urlencode($gmt);
            if (!empty($Ml) )
                $req .= " -d email=" . urlencode($Ml);
            $idx=0;
            foreach ($hculist['data'] as $key => $value) {
                $idx++;
                $req .= " -d ADSC$idx=" . urlencode($value['displaydesc']); # hcu description
                $req .= " -d type_name$idx=" . urlencode($value['rdcdesc']); # computed rdcdesc
                $req .= " -d ANUM$idx=" . urlencode($value['suffix']); # computed savingsql / checksql / loansql
                $req .= " -d account_number$idx=" . urlencode($value['suffix']); # hcu member=accounttype [suffix? rdcmember?]
                $req .= " -d ATYP$idx={$value['rdctype']}";                          # calculated rdctype [rdctype]
            }

            $cmd = "/usr/bin/curl $req -E {$parms['certfile']} --url '{$parms['ssourl']}'";

            $ensenta = getcurl($cmd);
            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();                     // the id for this transaction
                $logParms["logPoint"] = "ENSENTA_BRDC SSO";      // this action in a readable form
                $logParms["request"] = $cmd;                     // the request
                $logParms["reply"] = $ensenta;                   // the response
                LogSSOActivity($logParms);
            }


            if (trim($ensenta) == '' || preg_match("/Error=/i", "$ensenta")) {
                throw new Exception("Connection Failed ( $ensenta ) ");
            } else {
                header("Location: $ensenta");
                exit;
            }
            break;

        case "CHKFREE":
#
# 6/20/2018 MRH
# updated some of the MIR processing to call a function
# corrected the path for the include
# needs work for the pop-up Terms-of-Service acceptance
# and functions in CHKFREE.i return string 'true' / 'false' instead of
# actual booleen true / false.  Will need to fix that in the include, and here,
# and possibly in hcuAppFeed.
# Only one CHKFREE client (CVFCU) and they aren't converting yet
# so pushing this one down the list.
#
            require_once(dirname(__FILE__) . '/../library/CHKFREE.i');
            if (!hcu_checkService($dbh, "CHKFREE")) {
                $omsg = hcu_checkServiceMsg($dbh, "CHKFREE");
                throw new Exception("$omsg");
            }
            #
# if member is accepting terms, post that response
            $option = $HB_ENV["HCUPOST"]["option"];


            if ($option == "ACCEPT") {
                $dms_ok = array('cu' => 'string', 'Flang' => 'string',
                    'mode' => 'string', 'debug' => 'digits', 'option' => 'string',
                    'notice_type' => 'string', 'notice_device' => 'string', 'notice_id' => 'string', 'notice_response' => 'array');

                dms_import_v2($HB_ENV, "HCUPOST", $dms_ok);

                $retStatus_ary = Update_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC']);
                # check $retStatus_ary for errors?  Ignore failures anyway?
                #clear the option so it will fall through to show accounts
                $option = '';
            }
#
# see if member has accepted the terms yet...
#
            $noticeInfo = Get_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC'], "D", "ChkFreeSSO_TOS", true);
            if (sizeof($noticeInfo['notice']) && $noticeInfo['notice'][0]['notice_popup'] == 1 && strlen($noticeInfo['notice'][0]['notice_text']) > 0) {
                # showing the popup so set the accept button
                $continueButtonText = $noticeInfo['notice'][0]['notice_positive_caption'];
                $continueButtonText = (trim($continueButtonText) == '' ? $HB_ENV['MC']->msg("Accept") : $continueButtonText);
                // if the button needs to trigger a check of the radio buttons to make sure one selected, it must call CkRadio()
                $continueButton = "<div style=\"margin: 10px; text-align: center;\"><button type='button' class='k-button' name='btnContinue' onClick='javascript:document.formSelectAccount.submit();'>$continueButtonText</button></div>";

                $noticeText = $noticeInfo['notice'][0]['notice_text'] . "$continueButton";

                $inputList = array(
                    array("name" => "mode", "value" => "$mode"),
                    array("name" => "option", "value" => "ACCEPT"),
                    array("name" => "notice_type", "value" => "{$noticeInfo['notice'][0]['notice_type']}"),
                    array("name" => "notice_device", "value" => "D"),
                    array("name" => "notice_id", "value" => "{$noticeInfo['notice'][0]['notice_id']}"),
                );
                if (count($noticeInfo['notice'][0]['notice_answers']) > 0) {
                    foreach ($noticeInfo['notice'][0]['notice_answers'] as $notice_answer_key => $notice_answer_array) {
                        $inputList[] = array("name" => "notice_response[]", "value" => "{$notice_answer_array['answer_id']}");
                    }
                }
                $checkMsg = "Please accept the terms to continue.";
                $radioGroupName = "";
                ShowUserNotice($noticeText, $inputList, $radioGroupName, $checkMsg);

                break;  #
            }
            # Member has seen / accepted terms so format a link to display them on demand
            $pageTtl = "CheckFree Pay Bills Terms";
            $noticeText = $noticeInfo['notice'][0]['notice_text'];

//            $HB_Form_Notices = Return_PopupDisplay($dbh, $HB_ENV, $HB_ENV['MC'], $noticeText, $pageTtl);
# set billpayid as external password -
            $parms['passwith']['billpayid'] = (trim($mbrow['billpayid']) == '' ? $accountToUse : trim($mbrow['billpayid']));
            $parms['passwith']['Token'] = gmdate("U");

            #
            # get HomeCU checking accounts
            # check how many valid checking accounts are available.
            # if no funding, throw the bum out
            #
            $accts = Get_PrimaryChecking($dbh, $HB_ENV);

            if ($accts['status']['code'] != '000') {
                throw new Exception("No Valid Accounts for bill pay service");
            }

            if ($live) {
              $MIR = GetMemberInfo($HB_ENV, array("member" => $accountToUse));
            } else {
                # batch interface will need to figure out how to get MIR info */
                $MIR["data"] = array();
//                $MIR["data"] = array(
//                    'accountnumber' => '000062458',
//                    'lastname' => 'Test',
//                    'firstname' => 'HomeCU',
//                    'email' => 'test@homecu.net',
//                    'ssn' => '123-23-1234',
//                    'dob' => '1950-01-06',
//                    'workphone' => '2083841311',
//                    'address1' => '3380 Americana Terr STE 390',
//                    'city' => 'Boise',
//                    'state' => 'ID',
//                    'zip' => '83706'
//                );
            }
            $reqMIR = array(
                'accountnumber' => 1,
                'firstname' => 1,
                'lastname' => 1,
                'email' => 1,
                'ssn' => 1,
                'dob' => 1,
                'phone' => 1,
                'address1' => 1,
                'city' => 1,
                'state' => 1,
                'zip' => 1
            );

            $parsedMIR = populateMIR($MIR['data'], $Ml, $reqMIR, 'Y-m-d', 'flat', true);
            if (!$parsedMIR['status']['response']) {
                throw new Exception($parsedMIR['status']['message']);
            }
            $parms['MIR'] = $parsedMIR;
            /*
             * getSubscriberInfo
             */

            $enroll = bpsmInfoSub($HB_ENV, $parms);
            if ($enroll['status']['response'] == 'false') {
                throw new Exception("Subscriber Get Info failed (" . print_r($enroll[status]['message'], true) . ")");
            }
            # CheckFree returns error 301 when subscriber (member) is not found
            # try to enroll
            if ($enroll['data']['Result']['ResultInfo']['Code'] == '301') {
                /*
                 *    enroll using Mir & 1st checking account
                 */
                $parms['passwith']['payaccounts'][] = current($accts['dp']); # get first entry
//                        $tfile = fopen ("/tmp/checkfree_sso","a");
//                        fwrite ($tfile, "Size AcctList: " . sizeof($accts['dp']) . "\n" . print_r($accts,true) . "\n");
//                        fwrite ($tfile, "Parms: " . print_r($parms,true) . "\n");
//                        fclose ($tfile);
                $enroll = bpsmEnrollSub($HB_ENV, $parms);

                if ($enroll['status']['response'] == 'false') {
                    throw new Exception("Member Enrollment failed ({$enroll[status]['message']})");
//                    throw new Exception("Member Enrollment failed (enroll returns " . print_r($enroll,true) . ")");
                }
                /*
                 *    for each checking #2 - #n
                 *        addBankAccount
                 */

                if (sizeof($accts['dp']) > 1) {
                    $parms['rt'] = $HB_ENV['rt'];
                    for ($i = 1; $i < sizeof($accts['dp']); $i++) {
                        $acctrow = next($accts['dp']);
                        foreach ($acctrow as $akey => $aval) {
                            $parms["payacct{$akey}"] = $aval;
                        }
                        $parms['acctNumber'] = $acctrow['micraccount'];
                        $parms['acctDescription'] = $acctrow['displaydesc'];
                        $enroll = bpsmAddAcct($HB_ENV, $parms);

//                        $tfile = fopen ("/tmp/checkfree_sso","a");
//                        fwrite ($tfile, "Parms: " . print_r($parms,true) . "\n");
//                        fwrite ($tfile, "Response: " . print_r($response,true) . "\n");
//                        fclose ($tfile);

                        if ($enroll['status']['response'] == 'false') {
                            throw new Exception("Bank Account Add for {$acctrow['description']} failed ({$enroll[status]['message']})");
                        }
                    }
                }
            } else {
                switch ($enroll['data']['Subscriber']['Status']) {
                    case 'Active':
                        /*
                         * if enrolled & active
                         */
                        $enroll = bpsmModifySub($HB_ENV, $parms);
                        if ($enroll['status']['response'] == 'false') {
                            throw new Exception("Subscriber Modify failed ({$enroll[status]['message']})");
                        }
                        break;
                    /*
                     * cu accounts rarely change - just update the subscriber info and leave
                     * it at that.  If we had to sync accounts, this is where we'd do it
                     *    getBankAccounts
                     *    for each HomeCU in getBankAccounts modifyAccount
                     *    for each getBankAccounts not in HomeCU inactivateAccount
                     *    for each HomeCU not in getBankAccounts addAccount
                     */

                    case "Inactive":
                    case "FrozenFraud":
                    case "FrozenOther":
                    case "CancelledFraud":
                    case "CancelledOther":
                    case "Unspecified":
                    default:
                        /*
                         * Account not active and didn't get the 301 Not Found error -
                         *       CU has presumably inactivated account, make 'em call for help
                         */
                        throw new Exception("Service Unavailable<br>Please contact the credit union.<br>(Subscriber status: {$enroll['data']['Subscriber']['Status']})");
//                        throw new Exception("Subscriber Ineligible (" . print_r($enroll,true) . ")");
                        break;
                }
            }

            # otherwise fall through to send login

            if ($parms['pilot'] == 1) {
                $ssourl = $parms['certsso_url'];
                $ssoiv = $parms['certsso_iv'];
                $ssokey = $parms['certsso_key1'];
                $ssokey .= $parms['certsso_key2'];
                $ssokey .= $parms['certsso_key3'];
            } else {
                $ssourl = $parms['prodsso_url'];
                $ssoiv = $parms['prodsso_iv'];
                $ssokey = $parms['prodsso_key1'];
                $ssokey .= $parms['prodsso_key2'];
                $ssokey .= $parms['prodsso_key3'];
            }
            $key = "";
            for ($i = 0; $i < strlen($ssokey); $i+=2) {
                $key .= chr(hexdec(substr($ssokey, $i, 2)));
            }
            $iv = "";
            for ($i = 0; $i < strlen($ssoiv); $i+=2) {
                $iv .= chr(hexdec(substr($ssoiv, $i, 2)));
            }
            $subscriber = substr("000000000{$parms['passwith']['billpayid']}", -9, 9);
            list($msec, $sec) = explode(" ", microtime());
            $floatsec = sprintf("%03d", (float) $msec * 1000);
            $ts = (gmdate("YmdHis")) . $floatsec;
            $digeststr = "ts=$ts&ss={$subscriber}&pw={$parms['billpaypw']}";
            #$digest = base64_encode(sha1("ss={$subscriber}&pw={$parms['billpaypw']}&ts=$ts", true));
            $digest = base64_encode(sha1("$digeststr", true));
            $ticket = "$digeststr&dg=$digest";

            # encrypt ticket
            if($use_openssl_encryption) {
                list($tktvalue, $ticket) = encrypt_ticket_openssl($ticket, $key, $iv);
            } else {
                list($tktvalue, $ticket) = encrypt_ticket_mcrypt($ticket, $key, $iv);
            }

            $href = "$ssourl?rq=getlogin&sp={$parms['SponsorID']}&ticket=$tktvalue&autoresume=y";
#            $tfile = fopen ("/tmp/checkfree_sso","a");
#            fwrite ($tfile, "Ticket: $ticket\nURL: $href\n");
#            fwrite ($tfile,"Key1: {$parms['prodsso_key1']}\n");
#            fwrite ($tfile,"Key2: {$parms['prodsso_key2']}\n");
#            fwrite ($tfile,"Key3: {$parms['prodsso_key3']}\n");
#            fwrite ($tfile, "key: $ssokey\niv: $ssoiv\n");
#            fwrite ($tfile, "Parms: " . print_r($parms, true) . "\n");
#            fclose ($tfile);

            break;
        case "PAYVERIS":
            /*
             * 6/20/2018 MRH
             * Should be able to update MIR packet processing as noted inline below,
             * but leaving it alone for now because PAYVERIS is already working on Odyssey
             * and we have a lot of SSOs that are not
             *
             */
            // NOTE: The flavor PVWIDGET is how navigation is handled:
            //    With PAYVERIS, Payveris delivers navigation; with PVWIDGET, we set up the dashboards.
            // as of January 2018 Payveris always delivers navigation
            // as of June 2019 adding flavor PVUIR for newer Payveris update
# beginning of case "PAYVERIS":
            /*
             * 6/20/2018 MRH
             * update MIR packet processing as noted inline below,
             */
            // NOTE: The flavor PVWIDGET is how navigation is handled:
            //    With PAYVERIS, Payveris delivers navigation; with PVWIDGET, we set up the dashboards.
            // as of January 2018 Payveris always delivers navigation
            require_once('PAYVERIS_API.i');
            if (!hcu_checkService($dbh, "PAYVERIS")) {
                $omsg = hcu_checkServiceMsg($dbh, "PAYVERIS");
                throw new Exception("$omsg");
            }

            if (isset($parms['UserCodeSize']) && $parms['UserCodeSize'] > 0) {
                $billpayid = substr(str_repeat('0', $parms['UserCodeSize']) . $accountToUse, (-1 * $parms['UserCodeSize']), $parms['UserCodeSize']);
            } else {
                # default no padding for backward compatibility
                $billpayid = $accountToUse;
            }
            # set what we pass to the CreateUserSession call
            # if billpayid was defined in memberaccount table, use it
            # otherwise use accountToUse which has been formatted if requested by the trusted detail config
            $parms['passwith']['BillpayId'] = (trim($mbrow['billpayid']) == '' ? $billpayid : trim($mbrow['billpayid']));
            $parms['passwith']['rt'] = (trim($mbrow['rt']) == '' ? $accountToUse : trim($mbrow['rt']));
            $parms['passwith']['Cn'] = $accountToUse;
            $parms['passwith']['Cu'] = $Cu;
            $parms['passwith']['showavailable'] = ($HB_ENV['Fset'] & $CU_SHOWAVAILABLE);
            $parms['passwith']['lastupdate'] = $HB_ENV['lastupdate'];

            #
            # get HomeCU deposit accounts
            # check how many valid accounts are available.
            # if no funding, throw the bum out
            #

            $accts = PV_getHCUAccts($dbh, $parms);

            if ($accts['status']['code'] != '000' ||
                ( HCU_array_key_value('CheckingRequired',$parms) && !( HCU_array_key_value('CheckingAccounts',$accts["status"]) ) ) ){
                throw new Exception("No Valid Accounts for bill pay service");
            }

            if ($live) {
              $MIR = GetMemberInfo($HB_ENV, array("member" => $accountToUse));
            } else {
                # batch interface will need to figure out how to get MIR info */
                $localMir = '{"accountnumber" : "000333",
                            "lastname" : "TheGrouch",
                            "firstname" : "Oscar",
                            "email" : "test@homecu.net",
                            "workphone" : "2083841311",
                            "homephone" : "2083765555",
                            "address1" : "100 Sesame Rd",
                            "city" : "Langhorne",
                            "state" : "PA",
                            "zip" : "19047",
                            "cc" : "USA"}';
                $MIR["data"] = array();
                $MIR["data"] = json_decode($localMir, TRUE);
            }
            $reqMIR = array(
                'accountnumber' => 1,
                'lastname' => 1,
                'firstname' => 1,
                'address1' => 1,
                'city' => 1,
                'state' => 1,
                'zip' => 1,
                'cc' => 1
            );
            $parsedMIR = PV_populateMIR($MIR['data'], $Ml, $reqMIR, 'Y-m-d', 'split', true);
            if (!$parsedMIR['status']['response']) {
                throw new Exception($parsedMIR['status']['message']);
            }

            $parms['MIR'] = $parsedMIR['data'];

# populate $parms['passwith']['Accounts']
            $parms['passwith']['Accounts'] = $accts['dp'];

# fall through to send login

            if ($parms['pilot_sso'] == 1) {
                $parms['serviceurl'] = $parms['piloturl'];
                $parms['APIKey'] = $parms['pilotAPIKey'];
                $parms['ClientCode'] = $parms['pilotClientCode'];
            } else {
                $parms['serviceurl'] = $parms['produrl'];
                $parms['APIKey'] = $parms['prodAPIKey'];
                $parms['ClientCode'] = $parms['prodClientCode'];
            }

# call PV_CreateSession & parse result
            $session = PV_createUserSession($parms);
            if (empty($session['data']['ArtifactId'])) {
                throw new Exception("Connection to Payveris service Failed<br>Could not create session");
            }
            if ($parms['pilot_sso'] == 1) {
                $parms['serviceurl'] = $parms['pilotssourl'];
            } else {
                $parms['serviceurl'] = $parms['prodssourl'];
            }

            // check the flavor to know how to set things up
            $flavor = $HB_ENV['HCUPOST']['flavor'];

            // right now (11/03/17) there is just "flavor=PVWIDGET" or not
            // June 2019 adding flavor=PVUIR for Payveris update to UIR gui

            if ( $flavor == "" ) { # no usage w/o flavor on Odyssey
              $href = "{$parms['serviceurl']}/ShowDashboard?artifactId=" . $session['data']['ArtifactId'];
              # January 2018 Payveris says this sessionType parameter does not work
              # Specs v.6.6 dated April 2019 indicate it does.  Sent email 6/18/19 asking for clarification
              # Dan Caruthers confirms it still doesn't work - documentation is bogus 6/18/2019
//              if ($HB_ENV['HCUPOST']['mblsession']) {
//                  $href .= "&sessionType=mobile";
//              }
            } elseif ($flavor == 'PVUIR' || $flavor == 'PVWIDGET') {

                print <<<EOF
<style>
.payverisNav {
  margin:10px;
}
</style>

                <script type="text/javascript">
                function showPage(target) {
                    var pv = document.getElementById("hcuPVframe"),
                        action = '{$parms['serviceurl']}/' + target + '?artifactId={$session['data']['ArtifactId']}';
                    pv.src = action;
                }
                </script>
EOF;
                print "<script>\n";
                print "$(document).ready(function() {\n";

                print "showPage( 'ShowDashboard' );\n";
                print "});\n";
                print "</script>\n";
                $ua = strtolower($_SERVER['HTTP_USER_AGENT']);
                if (stripos($ua, 'iPhone') !== false || stripos($ua, 'iPod') !== false || stripos($ua, 'iPad') !== false) {
                    $divclass = ' class="appledevice"';
                } else {
                    $divclass = '';
                }
               print '<div id="billpay-scroll-wrapper"' . $divclass . '>';
                if ( !$isapp ) {
               $linkText = 'Return to Accounts';
                print <<<EOF
        <button type='button' id='chooseDashboard' name='btnOLB' style='margin:6px' onclick="window.location='{$HB_ENV['loginpath']}/hcuAccounts.prg?{$HB_ENV['cuquery']}'" class="k-button"><span class="fa fa-arrow-left"></span>&nbsp;{$linkText}</button>
EOF;
                }
               print '<iframe id="hcuPVframe" sandbox="allow-pointer-lock allow-popups allow-same-origin allow-top-navigation allow-scripts allow-forms"></iframe>';
               print '</div>';
            }
# falls through to connect to SSO URL
            break;

        case "SavvyMo_SSO":
            require_once('SavvyMoney.i');
            if (!hcu_checkService($dbh, "SavvyMoney")) {
                $omsg = hcu_checkServiceMsg($dbh, "SavvyMoney");
                throw new Exception("$omsg");
            }
            # call to get redirect URL needs to know if we are mobile
            $parms['platform'] = $HB_ENV['platform'];

# call smo_config to set configuration
            smo_config($dbh, $accountToUse, $mbrow['email'], $parms);

            $parms['MIR'] = smo_getMIR($HB_ENV, $accountToUse, HCU_array_key_value('beta', $parms));

# call smo_getToken to authenticate and get a token
            $authToken = smo_getAuthorization($parms);
            if (HCU_array_key_exists('error', $authToken['token'])) {
                $message = HCU_array_key_value('status', $authToken['token']['error']);
                $message .= " " . HCU_array_key_value('message', $authToken['token']['error']);
                throw new Exception("Connection to SavvyMoney service Failed! $message");
            }

            $smoToken = HCU_array_key_value('authCode', $authToken['token']);
            if (empty($smoToken)) {
                throw new Exception("Connection to SavvyMoney service Failed! No access token");
            }
            $parms['authparms']['smoToken'] = $smoToken;
            $redirect = smo_getRedirect($parms);
            if (HCU_array_key_exists('error', $redirect['redirect'])) {
                $message = HCU_array_key_value('status', $redirect['redirect']['error']);
                $message .= " " . HCU_array_key_value('message', $redirect['redirect']['error']);
                throw new Exception("Connection to SavvyMoney service Failed! $message");
            }
            $parms['authparms']['smoAddress'] = HCU_array_key_value('redirectUrl', $redirect['redirect']);
            $parms['authparms']['accessToken'] = HCU_array_key_value('accessToken', $redirect['redirect']);
            if (empty($parms['authparms']['smoAddress']) || empty($parms['authparms']['accessToken'])) {
                throw new Exception("Connection to SavvyMoney service Failed! No Redirect Info");
            }
            header("Location: {$parms['authparms']['smoAddress']}");

            break;


        case "IPAY_V3":
            /*
             * Mammoth flow is:
             * if ENROLL, handle enrollment
             * else try to log in
             * if response has -100 code (not enrolled), pop up an enrollment message
             * if member confirms, post back with 'ENROLL' form variable
             *
             * For Odyssey, we are dropping the 'confirm enroll' so
             * try to log in
             * if response -100
             * quietly enroll and try the log in again
             */

            $omsg = 'The bill pay website will be down for maintenance between 9:00AM EST on Saturday, October 4th through 6:00AM EST on Monday, October 6th.  If you still experience bill pay website issues after this timeframe, please call the phone number listed for bill pay related questions.';

            if (!hcu_checkService($dbh, "IPAY")) {
                $omsg = hcu_checkServiceMsg($dbh, "IPAY");
                throw new Exception("$omsg");
            }
            require_once('IPAY_V3.i');

            $ipay_instid = HCU_array_key_value('ipay_instid', $parms);
            $moc = HCU_array_key_value('moc', $parms);
            if ($moc) {
                $ipay_session = HCU_array_key_value('moc_session', $parms);
                $ipay_login = HCU_array_key_value('moc_login', $parms);
                $ipay_key = HCU_array_key_value('moc_key', $parms);
            } else {
                $ipay_session = HCU_array_key_value('prod_session', $parms);
                $ipay_login = HCU_array_key_value('prod_login', $parms);
                $ipay_key = HCU_array_key_value('prod_key', $parms);
            }
            $ipay_iv = HCU_array_key_value('hcu_iv', $parms);

            if (empty($ipay_instid) || empty($ipay_session) ||
                empty($ipay_login) || empty($ipay_key)) {
                throw new Exception($HB_ENV['MC']->msg("Feature Not Set"));
            }


            $billpayid = HCU_array_key_value('billpayid', $mbrow);

            if (trim($billpayid) == '') {
                $billpayid = $accountToUse;
            }

            # if billpayid is less than 2 chars, left pad w/zero
            if (strlen($billpayid) < 2) {
                $billpayid = substr("00$billpayid", -2, 2);
            }
            $rdate = gmdate("Ymd H:i:s");
            $random = gmdate("U");
            list($ipay_token, $iv) = EncryptCredentials("{$ipay_instid};{$rdate}", $ipay_key, $ipay_iv);

            $skip_company = (HCU_array_key_exists('skip_company', $parms) ? $parms['skip_company'] : 0);

            $ipayXML = iPay_getSession($ipay_instid, $ipay_iv, $ipay_session, $ipay_token, $Cu, $billpayid, $skip_company, $parms, $random);

            if (!($ipayXML['status'])) {
                throw new Exception("Login Connection failed ({$ipayXML['code']} {$ipayXML['message']})");
            }

            list ($ipaysuccess, $sessionID, $respcode, $respmsg) = GetReqResponse($ipayXML['message']);

            if ($respcode == '-100') {
            # this was the 'if enroll' block, but now we are just going to enroll without asking
            # if (HCU_array_key_value('option', $HB_ENV["HCUPOST"]) == "ENROLL") {
                # got here with option set to ENROLL
                # get token
                # send enrollment request
                if ($live) {
                    $MIR = GetMemberInfo($HB_ENV, array("member" => $accountToUse));
                    if (! HCU_array_key_exists('code', $MIR) || ($MIR['code'] !== '000')) {
                        throw new Exception("No Member Data (code)");
                    }
                } else {
                    # batch interface will need to figure out how to get MIR info */
                    $MIR["data"] = array();
                    // # testing, dummy up a batch MIR
                    // $MIR['data'] = ['accountnumber' => $accountToUse,
                    // 'firstname' => 'Kevin', 'middlename' => 'O','lastname' => 'Williams',
                    // 'email' => 'youngson@yahoo.com', 'homephone' => '208-555-0228',
                    // 'workphone' => '', 'cellphone' => '', 'fax' => '', 'ssn' => '228-22-8228',
                    // 'address1' => '373 Richland Ave', 'address2' => '',
                    // 'city' => 'Shire', 'state' => 'ID', 'zip' => '83111', 'cc' => 'US',
                    // 'dob' => '1991-02-28', 'class' => 'P'];
                }
                if (!HCU_array_key_exists('accountnumber', $MIR['data'])) {
                    throw new Exception("No Member Data (account number)");
                }
                /**
                 * Moved this code up a little so the code to be feature-gated
                 * is all in one block
                 */

                // make sure the member has at least 1 checking account with a MICR
                // 08-19: Only need MICR if EnrollMICR = 1

                $enrollmicr = (integer) HCU_array_key_value('EnrollMICR', $parms);
                $paymentAccts = iPay_getHCUAccounts($dbh, $HB_ENV, $accountToUse, $enrollmicr);

                if (!$paymentAccts['status']['response']) {
                    throw new Exception($paymentAccts['status']['message']);
                }
                /** end moved block */

                /**
                 * Start Feature Gate block
                 */

                $config = FeatureGateConfig::GetInstance($dbh);
                $MIRGate = new CreditUnionGate(CreditUnionGate::MIR_HANDLER, $config);
                if ($MIRGate->WillPass($HB_ENV['Cu'],['username' => $HB_ENV['Cn']])) {
                    /**
                     * use this new method if feature gate is open
                     */

                    # Moving function parameters into arrays to simplify test-ability
                    #
                    # move ipay settings and config into IPAYcred array
                    # from cutrusted detail [ipay_instid, ipay_iv, ipay_key, enrollmicr] and connection dependencies [ipay_token, random]
                    # move HomeCU settings into HCUcred array
                    # from selected user and account settings [ml, billpayid, micr]
                    #
                    $IPAYcred = ['ipay_instid' => $ipay_instid,
                                'ipay_iv' => $ipay_iv,
                                'ipay_key' => $ipay_key,
                                'ipay_token' => $ipay_token,
                                'random' => $random,
                                'enrollmicr' => $enrollmicr
                                ];
                    $HCUcred =  ['billpayid' => $billpayid,
                                'ml' => $mbrow['email'],
                                'micr' => $paymentAccts['data'][0]['micr']?? null
                                ];

                    $enroll = iPayV3EnrollXML($MIR, $IPAYcred, $HCUcred);

                    if (!$enroll['status']) {
                        throw new Exception($enroll['message']);
                    }
                    $enroll = $enroll['data'];

                } else {

                    /**
                     * use this legacy method if feature gate is closed
                     */
                        # identify the required elements expected in the MIR
                        $reqMIR = array(
                            "accountnumber" => 1,
                            "firstname" => 1,
                            "lastname" => 1,
                            "address1" => 1,
                            "city" => 1,
                            "state" => 1,
                            "zip" => 1
                        );

                        $parsedMIR = populateMIR($MIR['data'], $HB_ENV['Ml'], $reqMIR, 'mdY', 'flat', false);
                        if (!$parsedMIR['status']['response']) {
                            throw new Exception($parsedMIR['status']['message']);
                        }
                        $enroll = iPayEnrollXML($HB_ENV, $MIR, $ipay_instid, $ipay_iv, $ipay_key, $ipay_token, $random, $billpayid, $mbrow['email'], $enrollmicr,  $paymentAccts['data'][0]['micr']?? null);
                }
                /**
                 * End Feature Gate block
                 */

                 /**
                  * check $enroll before we try to use it...
                  */
                 if (empty($enroll)) {
                     throw new Exception('Failed building enrollment request');
                 }

                # only difference between ipay_enroll and ipay_session was the the leading 'm' of messaging and messagehandler was capitalized.  Trying with ipay_sesion to see if that works
                $cmd = "/usr/bin/curl --silent --request POST --data-binary '$enroll' -H 'Content-type: application/xml' '{$ipay_session}'";
//                $ipayXML = getcurl($cmd);
                $ipayHeaders = array();
                $ipayHeaders[] = "Content-type: application/xml";

                $parms["environment"]["logPoint"] = "V3_Enroll";      // this action in a readable form
                $parms["environment"]["request"] = "{$cmd}";                     // the request
                $ipayXML = iPayEmbcurl($enroll, $ipayHeaders, $ipay_session, '', '', '', $parms);
                if (!($ipayXML['status'])) {
                    throw new Exception("Enrollment Connection failed ({$ipayXML['code']} {$ipayXML['message']})");
                }

                list ($ipaysuccess, $respcode, $respmsg) = GetEnrollResponse($ipayXML['message']);

                # if not successfull show error and bail
                if ($ipaysuccess == 'false') {
                    throw new Exception("Member Enrollment failed ($respcode $respmsg)");
                }
                # and try again to login now that we are enrolled
                #}
                $ipayXML = iPay_getSession($ipay_instid, $ipay_iv, $ipay_session, $ipay_token, $Cu, $billpayid, $skip_company, $parms, $random);
                if (!($ipayXML['status'])) {
                    throw new Exception("Login Connection failed ({$ipayXML['code']} {$ipayXML['message']})");
                }

                list ($ipaysuccess, $sessionID, $respcode, $respmsg) = GetReqResponse($ipayXML['message']);
                if ($respcode == '-100') {
                    # if we get a second 'must enroll' response, throw an error.
                throw new Exception("No Bill Pay Token after enroll");
                }

            }
            if ($sessionID == '' || preg_match("/\D/", "$sessionID")) {
                throw new Exception("No Bill Pay Token");
            } else {

                #print "This would login to {$ipay_login}?instid=$ipay_instid<BR>
                #using<br>
                #name='p1' value='$sessionID'<BR>
                #name='op' value='Login'<BR>
                #name='Method' value='Session'"; exit;
                # redirect to login URL
                $stremail = ("{$HB_ENV["Ml"]}" == "" ? "" : "<input type='hidden' name='strEmail' value='{$HB_ENV["Ml"]}'>");
                $request = "Onload post form with action = {$ipay_login}?instid=$ipay_instid\np1=$sessionID\nop=Login\nMethod=Session";
                $request .= "{$HB_ENV["Ml"]}" == "" ? "" : "\nstrEmail={$HB_ENV["Ml"]}\n";

                if ($parms["logging"] == "enabled") {
                    $logParms = $parms["environment"];      // get the environment info passed in
                    $logParms["token"] = '';                // the id used across all communications in session
                    $logParms["txnId"] = time();                     // the id for this transaction
                    $logParms["logPoint"] = "V3 SSO";      // this action in a readable form
                    $logParms["request"] = "$request";                    // the request
                    $logParms["reply"] = '';                   // the response
                    LogSSOActivity($logParms);
                }


                print <<<EOF
  <html>
  <body onload="javascript:document.SSOform.submit();">
  <form method="post" name="SSOform" action="{$ipay_login}?instid=$ipay_instid">
  <input type="hidden" name="p1" value="$sessionID">
  <input type="hidden" name="op" value="Login">
  <input type="hidden" name="Method" value="Session">
  $stremail
  </form>
  </body>
  </html>
EOF;
            }

            break;

        case "PSCUPAY_SSO":
            if (!hcu_checkService($dbh, "PSCU")) {
                $omsg = hcu_checkServiceMsg($dbh, "PSCU");
                throw new Exception("$omsg");
            }

            $continueSignon = true;
            if ($HB_ENV["HCUPOST"]["option"] != 'SPEEDBUMP') {
                $saywhat = Get_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC'], 'D', 'bpPSCUNotice');
//            $p = print_r($saywhat,true);
//            print "Saywhat: $p";exit;
                // Check if speedbump notice exists. Note that the notice_popup field is use to signify if showing it
                // because the text will always be returned.
                if (sizeof($saywhat['notice']) && strlen($saywhat['notice'][0]['notice_text']) > 0 &&
                    $saywhat["notice"][0]["notice_popup"] == 1) {
                    $descTtl = "";
                    $pageTtl = $HB_ENV['MC']->msg("Terms of Use");

                    $pscuNoticeText = "<div style='text-align:left; background-color:white; border-radius:4px; margin: 0px 10px 5px 10px; padding: 5px;'>
                                   <fieldset>
                                     {$saywhat['notice'][0]['notice_text']}
                                   </fieldset>
                                   </div>";

                    $noticeArray = $saywhat["notice"][0];
                    $noticeAnswers = "";
                    $noticeType = ($noticeArray['notice_answertype'] == 'O' ? 'radio' : 'checkbox');
                    if (count($noticeArray['notice_answers']) > 0) {
                        foreach ($noticeArray['notice_answers'] as $notice_answer_key => $notice_answer_array) {
                            $noticeAnswers .="<input type='{$noticeType}' name='notice_response[]' id='response{$notice_answer_array['answer_id']}' value='{$notice_answer_array['answer_id']}'/><label for='response{$notice_answer_array['answer_id']}'>{$notice_answer_array['answer_text']}</label>";
                        }
                    }
                    // note: the notice answers are from the bpPSCUNotice, as that is what is being accepted
                    $noticeAnswers = "<div style='text-align:center'>
                                  <fieldset>
                                    {$noticeAnswers}
                                  </fieldset>
                                  </div>";

                    $cancelButton = "<button type='button' class='k-button' name='btnCancel' onClick='window.close();'>{$HB_ENV['MC']->msg("Cancel")}</button>";
                    $continueButtonText = $noticeArray["notice_positive_caption"];
                    // if the button needs to trigger a check of the radio buttons to make sure one selected, it must call CkRadio()
                    $continueButton = "<button type='submit' class='k-button' name='btnContinue'>$continueButtonText</button>";
                    $buttons = "{$cancelButton} &nbsp; &nbsp; {$continueButton}";

                    // set up the string substitution
                    $noticeSubstitution = array(
                      "#page_title#" => $pageTtl,
                      "#description#" => $descTtl,
                      "#content#" => $pscuNoticeText,
                      "#acceptance#" => $noticeAnswers,
                      "#buttons#" => $buttons
                    );

                    // get any notice text
                    $HB_ENV["noticeStrReplace"] = $noticeSubstitution;
                    $noticeInfo = Get_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC'], 'D', 'ConnectSpeedbump');

                    // make sure we got the notice
                    if ($noticeInfo["status"]["code"] != "000" ||
                        !count($noticeInfo["notice"]) ||
                        strlen($noticeInfo["notice"][0]["notice_text"]) == 0) {
                        throw new Exception("Configuration Error: Custom Content (ConnectSpeedbump)");
                    }

                    $noticeText = $noticeInfo['notice'][0]['notice_text'];

                    $inputList = array(array("name" => "mode", "value" => "$mode"),
                        array("name" => "notice_type", "value" => "{$noticeArray['notice_type']}"),
                        array("name" => "notice_id", "value" => "{$noticeArray['notice_id']}"),
                        array("name" => "notice_device", "value" => "C"),
                        array("name" => "option", "value" => "SPEEDBUMP")
                    );
                    $checkMsg = "";
                    $radioGroupName = "";
                    ShowUserNotice($noticeText, $inputList, $radioGroupName, $checkMsg);
//                Speedbump($saywhat);
                    $continueSignon = false;
                }
            } else {
                $dms_ok = Array("cu" => "string", "Flang" => "string", "notice_type" => "string",
                    "notice_id" => "string", "notice_device" => "string",
                    "notice_response" => "array");

                dms_import_v2($HB_ENV, 'HCUPOST', $dms_ok);

                if (sizeof($HB_ENV['HCUPOST']['notice_response'])) {
                    $retStatus_ary = Update_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC']);
                    # check $retStatus_ary for errors?  Ignore failures anyway?
                }
            }

            if ($continueSignon) {
                $cuid = HCU_array_key_value('cuid', $parms);
                $pilot = HCU_array_key_value('pilot', $parms);
                $rtno = HCU_array_key_value('rtno', $parms);
                $sendbal = HCU_array_key_value('sendbal', $parms); # send account balance to PSCU?
                $sendjoint = HCU_array_key_value('sendjoint', $parms); # send joint accounts (with @ in suffix) to PSCU?
                $sendextended = HCU_array_key_value('sendextended', $parms);
            if ($pilot) {
                    $url = HCU_array_key_value('piloturl', $parms);
                } else {
                    $url = HCU_array_key_value('produrl', $parms);
                }
            if (empty($cuid) || empty($url) || empty($rtno) || empty($accountToUse) ) {
                throw new Exception("Missing Settings");
            }

                if ($sendextended) {

                    if ($live) {
                      $MIR = GetMemberInfo($HB_ENV, array("member" => $accountToUse));
                    } else {
                        # batch interface will need to figure out how to get MIR info */
                        $MIR["data"] = array();

                        # testing only - load mir info from file
                        /*
                          $mirname = "/home/ubuntu/miki/packet.mir.{$Cn}";
                          if (!is_readable($mirname))
                          $mirname = "/home/ubuntu/miki/packet.mir.anon";
                          $packet = file_get_contents($mirname);
                          $status = (preg_match("/<status>\n?(.*)\n?<\/status>/si", $packet, $pktpieces) ? $pktpieces[1] : "");
                          list($mem, $statcode, $statdesc) = explode("\t", $status);

                          preg_match("/<info>\n?(.*)<\/info>/si", $packet, $pktpieces);
                          $info = explode("\n", $pktpieces[1]);
                          $line = $info[0];
                          $line = preg_replace("/ ?\t ?/", "\t", $line);
                          $line = preg_replace("/ $/", "", $line);
                          $line = preg_replace("/\\0/", " ", $line);
                          list($AccountNumber, $FirstName, $MiddleName, $LastName, $Email, $HomePhone, $WorkPhone, $CellPhone, $Fax, $SSN, $Address1, $Address2, $City, $State, $Zip, $CC, $DOB) = explode("\t", $line);

                          $MIR[status][status] = $statcode;
                          $MIR[status][asofdate] = date("D M j Y H:i:s T");
                          $MIR[status][reason] = $statdesc;

                          $MIR["data"]['AccountNumber'] = $AccountNumber;
                          $MIR["data"]['firstname'] = $FirstName;
                          $MIR["data"]['middlename'] = $MiddleName;
                          $MIR["data"]['lastname'] = $LastName;
                          $MIR["data"]['email'] = $Email;
                          $MIR["data"]['homephone'] = $HomePhone;
                          $MIR["data"]['workphone'] = $WorkPhone;
                          $MIR["data"]['cellphone'] = $CellPhone;
                          $MIR["data"]['Fax'] = $Fax;
                          $MIR["data"]['ssn'] = $SSN;
                          $MIR["data"]['address1'] = $Address1;
                          $MIR["data"]['address2'] = $Address2;
                          $MIR["data"]['city'] = $City;
                          $MIR["data"]['state'] = $State;
                          $MIR["data"]['zip'] = $Zip;
                          $MIR["data"]['cc'] = $CC;
                          $MIR["data"]['dob'] = $DOB;
                          print_r( $MIR );
                         *
                         */
                        # end of testing
                    }
                $reqMIR = array(
                    "accountnumber" => 1,
                    "lastname" => 1,
                    "email" => 1,
                    "ssn" => 1,
                    "dob" => 1,
                    "phone" => 1,
                    "zip" => 1
                );

                    $parsedMIR = populateMIR($MIR['data'], $HB_ENV['Ml'], $reqMIR, 'mdY', 'flat', false);
                    if (!$parsedMIR['status']['response']) {
                        throw new Exception($parsedMIR['status']['message']);
                    }
                    $EMAIL = ((empty($parsedMIR['data']['email']) || !validateEmail($parsedMIR['data']['email'])) ? $mbrow['email'] : $parsedMIR['data']['email']);

                } else {

                    $EMAIL = $mbrow[email];
                    $rmlist = array("#", "&", "/", "%", ",", ":", "=", "?", "'");
                    $EMAIL = str_replace($rmlist, "", $EMAIL);

                }
                $paymentAccts = PSCU_getHCUAccounts($dbh, $HB_ENV, $accountToUse, $parms);
                if (!$paymentAccts['status']['response']) {
                    throw new Exception($paymentAccts['status']['message']);
                }

                    $unl = substr("000000000$accountToUse", -9, 9);

                $query = "&RQID=SINGLESIGNON&APPLICATION=PLE&MEMBERTYPE=9&ORGID=$cuid&USERNAMEL=$unl";
                if ($sendextended) {
                    $query .= "&TAXID={$parsedMIR['data']['ssn']}";
                    $query .= "&FIRSTNAME=" . urlencode(substr($parsedMIR["data"]["firstname"],0,32));
                    $query .= "&LASTNAME=" . urlencode(substr($parsedMIR["data"]["lastname"],0,32));
                    $query .= "&DOB={$parsedMIR['data']['dob']}";
                    $query .= "&PHONENUMBER={$parsedMIR['data']['phone']}";
                    $query .= "&ADDRESSLINE1=" . urlencode(substr($parsedMIR["data"]["address1"],0,32));
                    if (trim($MIR["data"]["address2"]) <> '') {
                        $query .= "&ADDRESSLINE2=" . urlencode(substr($parsedMIR["data"]["address2"],0,32));
                    }
                    $query .= "&CITY=" . urlencode(substr($parsedMIR["data"]["city"],0,32));
                    $query .= "&STATE={$parsedMIR["data"]["state"]}";
                    $query .= "&ZIP={$parsedMIR['data']['zip']}";
                    if (empty($parsedMIR["data"]["firstname"])) {
                        $query .= "&MISC1=CV_BUS_TO_NAME";
                    }
                }
                $query .= "&EMAILADDRESS={$EMAIL}";

                $rmlist = array("#", "&", "/", "%", ",", ":", "=", "?", "'");

                foreach ($paymentAccts['data'] as $key => $row ) {
                    if ($key == 7) {
                        break;
                    } # only 7 accounts acceptable at PSCU
                    $qid = $key + 1;
                    $desc = str_replace($rmlist, "", $row['description']);
                    $desc = substr(urlencode($desc), 0, 30);
                    if (substr($desc, 28, 1) == '%' || substr($desc, 29, 1) == '%') {
                        $desc = substr($desc, 0, strrpos($desc, '%'));
                    }

                    $query .= "&BANK_RTN{$qid}=$rtno&ACCOUNTID{$qid}={$row['micr']}&ACCTDESC{$qid}=$desc";
                    //                    urlencode(substr($desc,0,30));
                    if ($sendbal) {
                        # available is currency, should have to trim?
                        $query .= "&BAL{$qid}=" . trim($row['available']);
                    }
                }
#
                $curlopts = array(
                    CURLOPT_RETURNTRANSFER => 1,
                    CURLOPT_SSL_VERIFYPEER => 0,
                    CURLOPT_SSL_VERIFYHOST => 0,
                    CURLOPT_HEADER => 0,
                    CURLOPT_URL => "{$url}{$query}");

                $ch = @curl_init();
                @curl_setopt_array($ch, $curlopts);

                $infosession = @curl_exec($ch);
                $responseIP = curl_getinfo($ch,CURLINFO_PRIMARY_IP);
                if ( $parms["logging"] == "enabled" ) {
                  $logParms = $parms["environment"];                      // get the environment info passed in
                  $logParms["token"] = '';                   // the id used across all communications in session
                  $logParms["txnId"] = time();                            // the id for this transaction
                  $logParms["SSOVendor"] = 'PSCUPAY_SSO';
                  $logParms["logPoint"] = "PSCUPAY SSO";      // this action in a readable form
                  $logParms["request"] = "{$url}{$query}";                     // the request
                  $logParms["reply"] = "$responseIP responded \n$infosession";                         // the response
                  LogSSOActivity( $logParms );
                }

                if (empty($infosession)) {
                    throw new Exception("Connection to PSCU PayLynx service Failed<br>Error: No Response");
                } else {

                    libxml_use_internal_errors(true);
                    $xml = simplexml_load_string($infosession);
                    if (!is_object($xml)) {
                        libxml_clear_errors();
                        throw new Exception("Connection to PSCU PayLynx service Failed<br>Error: XML parse failed");
                    }
                    $xmlx = $xml->xpath("FUNCTIONRS/STATUS/COMPLETION");
                    $pscustat = $xmlx[0];
                    $xmlx = $xml->xpath("FUNCTIONRS/STATUS/COMPLETIONSCRIPT");
                    $pscudesc = $xmlx[0];

                    #       preg_match('/<COMPLETION>(.*)<\/COMPLETION>/',$infosession,$stat);
                    #       $pscustat = $stat[1];
                    #       preg_match('/<COMPLETIONSCRIPT>(.*)<\/COMPLETIONSCRIPT>/',$infosession,$stat);
                    #       $pscudesc = $stat[1];
                    # print "Stat :$pscustat: Desc :$pscudesc:<br>$infosession";
                    if ($pscustat <> '100') {
                        throw new Exception("Connection to PSCU PayLynx service Failed<br>Error: $pscustat $pscudesc");
                    } else {
                        preg_match('/<URL>(.*)<\/URL>/', $infosession, $stat);
                        $href = html_entity_decode($stat[1]);
                    }
                }
            }

            break;
        case "PSCUINFO":
//            # PSCUINFO is obsolete.  Use AccessPoint PSCU_ACCPT instead
//            trusted detail had these parameters:
//            OrgID     3274
//            pilot     0
//            piloturl  https://pilot.epscu.com/servlet/raAppHtml?ServicePageName=com.invisiondev.JServer.xml.pscu.xmlLoginProxy&RQID=FUNCTIONRSURL&APPLICATION=ICC
//            produrl   https://www.epscu.com/servlet/raAppHtml?ServicePageName=com.invisiondev.JServer.xml.pscu.xmlLoginProxy&RQID=FUNCTIONRSURL&APPLICATION=ICC
//            hcuLogging    -1

            if (!hcu_checkService($dbh, "PSCU")) {
                $omsg = hcu_checkServiceMsg($dbh, "PSCU");
                throw new Exception("$omsg");
                exit;
            }
            # PSCU InfoLink Credit Card Info
            $pilot = HCU_array_key_value('pilot', $parms);
            $OrgID = HCU_array_key_value('OrgID', $parms);

            if ($pilot) {
                $url = HCU_array_key_value('piloturl', $parms);
            } else {
                $url = HCU_array_key_value('produrl', $parms);
            }
            if (empty($OrgID) || empty($url) || empty($accountToUse) ) {
                throw new Exception("Missing Settings");
            }

            $infosession = file_get_contents("{$url}&ORGID=$OrgID&USERNAMEL=$accountToUse");

            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];                      // get the environment info passed in
                $logParms["SSOVendor"] = 'PSCU';
                $logParms["logPoint"] = "$mode SSO";   // this action in a readable form
                $logParms["token"] = '';                   // the id used across all communications in session
                $logParms["txnId"] = time();                            // the id for this transaction
                $logParms["request"] = "{$url}&ORGID=$OrgID&USERNAMEL=$accountToUse";    // the request
                $logParms["reply"] = "$infosession";                         // the response
                LogSSOActivity($logParms);
            }

            if ($infosession == '' || preg_match("/^Error/i", "$infosession")) {
                throw new Exception("Connection to PSCU InfoLink service Failed $infosession");
            } else {
                $href = trim($infosession);
            }
            break;

        case "PSCU_ACCPT":
            if (!hcu_checkService($dbh, "PSCU")) {
                $omsg = hcu_checkServiceMsg($dbh, "PSCU");
                throw new Exception("$omsg");
            }

            $pilot = HCU_array_key_value('pilot', $parms);
            $cuid = HCU_array_key_value('cuid', $parms);

            if ($pilot) {
                $svs_url = HCU_array_key_value('piloturl', $parms);
            } else {
                $svs_url = HCU_array_key_value('produrl', $parms);
            }
            if (empty($cuid) || empty($svs_url) || empty($accountToUse) ) {
                throw new Exception("Missing Settings");
            }

          $unl = substr("000000000$accountToUse", -9, 9);

            $query = "-d RQID=FUNCTIONRS -d ORGID=$cuid -d USERNAMEL=$unl";

        $cmd = "/usr/bin/curl --silent --request POST $query '$svs_url'";
            // comment out next line and ........
//        $infosession = getcurl($cmd);

            // .... and enable next block to use embedded curl and enhanced logging
            $query = "RQID=FUNCTIONRS&ORGID=$cuid&USERNAMEL=$unl";

            $curlopts = array(
                CURLOPT_RETURNTRANSFER => 1,
                CURLOPT_SSL_VERIFYPEER => 0,
                CURLOPT_SSL_VERIFYHOST => 0,
                CURLOPT_POST => 1,
                CURLOPT_POSTFIELDS => $query,
                CURLOPT_HEADER => 0,
                CURLOPT_URL => "$svs_url");

            $ch = @curl_init();
            @curl_setopt_array($ch, $curlopts);

            $infosession = @curl_exec($ch);
            $responseIP = curl_getinfo($ch, CURLINFO_PRIMARY_IP);

            if (curl_errno($ch)) {
                $infosession = '';
                $curlerror = curl_error($ch);
            } else {
                $curlerror = '';
            }
            @curl_close($ch);

            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];                      // get the environment info passed in
                $logParms["SSOVendor"] = 'PSCU';
                $logParms["logPoint"] = "$mode SSO";   // this action in a readable form
                $logParms["token"] = '';                   // the id used across all communications in session
                $logParms["txnId"] = time();                            // the id for this transaction
                $logParms["request"] = "$cmd";    // the request
//                $logParms["reply"] = "$responseIP responded \n$infosession";                         // the response
                $logParms["reply"] = "$infosession";                         // the response
                LogSSOActivity($logParms);
            }

            if (empty($infosession)) {
                throw new Exception("Connection to PSCU AccessPoint service Failed $curlerror");
            } else {
                libxml_use_internal_errors(true);
                $xml = simplexml_load_string($infosession);
                if (!is_object($xml)) {
                    libxml_clear_errors();
                    throw new Exception("Connection to PSCU AccessPoint service Failed<br>Error: XML parse failed");
                }
                $xmlx = $xml->xpath("FUNCTIONRS/STATUS/COMPLETION");
                $pscustat = $xmlx[0];
                $xmlx = $xml->xpath("FUNCTIONRS/STATUS/COMPLETIONSCRIPT");
                $pscudesc = $xmlx[0];

                #print "Stat :$pscustat: Desc :$pscudesc:<br>$infosession";
                if ($pscustat <> '100') {
                    $error["content"] = "Connection to PSCU AccessPoint service Failed<br>Error: $pscustat $pscudesc";
                    throw new Exception(json_encode($error));
                } else {
                    preg_match('/<URL>(.*)<\/URL>/', $infosession, $stat);
                    $href = html_entity_decode($stat[1]);
                }
            }

            break;

        case "MemberPay":
            if (!hcu_checkService($dbh, "MemberPay")) {
                $omsg = hcu_checkServiceMsg($dbh, "MemberPay");
                throw new Exception("$omsg");
            }
            $bp_cuid = $parms['CorpID'];
            $bp_secret = $parms['password'];
            $pilot = $parms['pilot'];

            $rt = $HB_ENV['rt'];

            if ("$rt" == "" || preg_match("/\D/", $rt)) {
                throw new Exception($HB_ENV['MC']->msg("Feature Not Set"));
            }

            if ($pilot) {
                $server = $parms["pilotURL"]; // 'https://staging1.memberpay.com/MemberBillPay/SingleSignOn.asmx';
                $mpaysvc = $parms["mpaypilot"]; //"https://staging1.memberpay.com/MemberBillPay/singlesignonrequest.aspx";
            } else {
                $server = $parms["serviceURL"]; // 'https://www.memberpay.com/MemberBillPay/SingleSignOn.asmx';
                $mpaysvc = $parms["mpaysvc"]; // "https://www.memberpay.com/MemberBillPay/singlesignonrequest.aspx";
            }

            $billpayid = $mbrow['billpayid'];
            if (trim($billpayid) == '') {
                $billpayid = $accountToUse;
            }

            $request = "&lt;SSORequest version=\"1.0\"&gt;\n";
            $request .= "&lt;MemberID&gt;{$billpayid}&lt;/MemberID&gt;\n";
            $request .= "&lt;CorpID&gt;{$bp_cuid}&lt;/CorpID&gt;\n";
            $request .= "&lt;RoutingNumber&gt;{$rt}&lt;/RoutingNumber&gt;\n";
            $request .= "&lt;Password&gt;{$bp_secret}&lt;/Password&gt;&lt;/SSORequest&gt;\n";

            $soapString = '<?xml version="1.0" encoding="utf-8"?>';
            $soapString .= "\n<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n";
            $soapString .= "<soap:Body>\n";
            $soapString .= "<AuthenticateMember xmlns=\"http://tempuri.org/\">\n";
            $soapString .= "<request>\n" . $request . "</request>\n";
            $soapString .= "</AuthenticateMember>\n";
            $soapString .= "</soap:Body>\n";
            $soapString .= "</soap:Envelope>\n";

            #$cmd="/usr/bin/curl --silent --data-binary '$soapString' -H 'Content-Type: text/xml; charset=utf-8' -H 'SOAPAction: \"http://tempuri.org/AuthenticateMember\"' $server";

            $curlopts = array(
                CURLOPT_RETURNTRANSFER => 1,
                CURLOPT_SSL_VERIFYPEER => 0,
                CURLOPT_SSL_VERIFYHOST => 0,
                CURLOPT_POST => 1,
                CURLOPT_POSTFIELDS => "$soapString",
                CURLOPT_URL => "$server");

            $header = array();
            $header[] = "Content-Type: text/xml; charset=utf-8";
            $header[] = 'SOAPAction: "http://tempuri.org/AuthenticateMember"';

            $response = "";
            $ch = curl_init();
            if ($ch) {
                curl_setopt_array($ch, $curlopts);
                curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
                $response = curl_exec($ch);
                curl_close($ch);
            }

            $mpaystat = "999"; # set a 'connection failed' status first
            $mpaydesc = "Connection Failed"; # set a 'connection failed' status first

            if ($response > '') {
                #print "<pre>$response</pre>";
                #exit;
                $response = html_entity_decode($response);
                preg_match('/<ErrorCode>(.*)<\/ErrorCode>/i', $response, $stat);
                $mpaystat = $stat[1];
                preg_match('/<Description>(.*)<\/Description>/i', $response, $stat);
                $mpaydesc = $stat[1];
            }
            if ($mpaystat == '0') {
                preg_match('/<Token>(.*)<\/Token>/i', $response, $stat);
                $discard = array("{", "}", "-");
                $token = html_entity_decode($stat[1]);
                $href = "{$mpaysvc}?token=$token";
            } else {
                // show the "Not Available" notice
                $title = 'Service Not Available';

                if ($HB_ENV['HCUPOST']['vanilla']) {
                    $cancelButton = '';
                } else {
                    $cancelButton = "<button type='button' class='k-button' name='btnCancel' onClick='window.close();'>{$HB_ENV['MC']->msg("Close Window")}</button>";
                }


                if ($mpaystat == '2') {
                    // use the default custom content which may have instructions on how to sign up
                    $displayMessage = "";
                } else {
                    // some kind of connection error
                    $displayMessage = "Connection to Bill Pay Service Failed. Please try again later or contact the credit union to report this error.<br>Error: $mpaystat $mpaydesc";
                }

                // set up the string substitution
                $noticeSubstitution = array(
                  "#title#" => $title,
                  "#service_name#" => "MemberPay",
                  "#service_type#" => "BillPay",
                  "#vendor_name#" => "",
                  "#display_content#" => $displayMessage,
                  "#close_button#" => $cancelButton
                );

                // get any notice text
                $HB_ENV["noticeStrReplace"] = $noticeSubstitution;
                $noticeInfo = Get_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC'], 'D', 'ConnectNoService');

                // make sure we got the notice
                if ($noticeInfo["status"]["code"] != "000" ||
                    !count($noticeInfo["notice"]) ||
                    strlen($noticeInfo["notice"][0]["notice_text"]) == 0) {
                    throw new Exception("Configuration Error: Custom Content ConnectNoService");
                }

                $noticeText = $noticeInfo['notice'][0]['notice_text'];

                ShowUserNotice($noticeText, array(), "", "");
            }

            break;
        case "FICS":

            # should recode to use embedded curl instead of rolling to
            # command line, but we have not clients as of 6/20/2018
            # so leaving it as is for now.
            #
            // Mortgage Info
            if (!hcu_checkService($dbh, "FICS")) {
                $omsg = hcu_checkServiceMsg($dbh, "FICS");
                throw new Exception("$omsg");
            }

            $APIKey = HCU_array_key_value('APIKey', $parms);
            $FICSidtype = HCU_array_key_value('FICSidtype', $parms);
            switch ($FICSidtype) {
                case 1: #loan number
                    # not implemented -
                    # would have to get info from mir
                    break;
                case 2: # SSN
                    # get mir
                    # set FICSid = mir.ssn
                    break;
                case 3: # CU member account number
                    $FICSid = $accountToUse;
                    break;
                case 4: # misc. id
                    # not implemented -
                    # would have to work w/CU to figure out where to get data
                    # probably something in mir packet
                    break;
                default:
                    # default to member number
                    # Odyssey default to member account selected in SpeedBump
                    $FICSid = $accountToUse;
                    break;
            }
            if (empty($APIKey) || empty($FICSidtype) || empty($FICSid)) {
                throw new Exception("Missing Settings");
            }
            # send login
            //        $request = "{$parms['authurl']}?method=getauthenticationkey&APIKey=$APIKey&ID=$FICSid&TypeId=$FICSidtype";
            //        $FICSXML = file_get_contents($request);

            $ficsreq = "<soapenv:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:web=\"http://webservice\">
     <soapenv:Header/>
     <soapenv:Body>
        <web:getAuthenticationKey soapenv:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">
           <APIKey xsi:type=\"xsd:string\">$APIKey</APIKey>
           <ID xsi:type=\"xsd:string\">$FICSid</ID>
           <TypeID xsi:type=\"xsd:double\">$FICSidtype</TypeID>
        </web:getAuthenticationKey>
     </soapenv:Body>
  </soapenv:Envelope>";

            $cmd = "/usr/bin/curl --silent --data-binary '$ficsreq' -H 'Content-Type: text/xml; charset=utf-8'";
            $cmd .= " -H 'SOAPAction: \"getAuthenticationKey\"' {$parms['authurl']}";

            $FICSXML = getcurl($cmd);
            // $tfile = fopen ("/tmp/fics","w");
            //       fwrite ($tfile, "$cmd\n\n");
            //       fwrite ($tfile, $FICSXML);
            //       fclose ($tfile);
            # need to check first to make sure we got a response
            if (empty($FICSXML)) {
                throw new Exception("Connection to FICS Mortgage Info service Failed");
            }
            $xml = simplexml_load_string($FICSXML);
            if (!is_object($xml)) {
                libxml_clear_errors();
                throw new Exception("Connection to FICS Mortgage Info service Failed<br>Error: XML parse failed");
            }

            $xml->registerXPathNamespace('fics', 'http://webservice');
            $dataresponse = $xml->xpath("//fics:getAuthenticationKeyResponse/getAuthenticationKeyReturn"); #GetAuthenticationKeyReturn?
            $AuthKey = $dataresponse[0][0];
            $loadmsg = $HB_ENV['MC']->msg("Loading Data");
            print <<<EOF
  <html>
  <body onload = "javascript:document.SSOform.submit();">
  <div style='font-size: 28px; text-align:center; padding-left: 40px; padding-right: 40px; padding-top: 40px;'>
  Loading Data..... Please Wait
  </div>
  <form name="SSOform" method="post" action="{$parms['serviceurl']}">
  <input type="hidden" name="AuthenticationKey" value="$AuthKey">
  </form>
  </body>
  </html>
EOF;
            break;
        case "FIS_EZCARD":
        case "HcuEZCARD": #fis_ezcard info maintained locally at HomeCU

            if (!hcu_checkService($dbh, "FIS")) {
                $omsg = hcu_checkServiceMsg($dbh, "FIS");
                throw new Exception("$omsg");
            }
            $clientid = HCU_array_key_value('clientid', $parms);
            $produrl = HCU_array_key_value('fisurl', $parms);
            $pilot = HCU_array_key_value('pilot', $parms);
            /*
             * keys and iv are provided as hex string, convert to binary before using
             */
            if ($pilot) {
                $pub = HCU_array_key_value('pilotpub',$parms);
                $priv = HCU_array_key_value('pilotpriv',$parms);
                $iv = HCU_array_key_value('pilotiv',$parms);
            } else {
                $pub = HCU_array_key_value('pubkey',$parms);
                $priv = HCU_array_key_value('privkey',$parms);
                $iv = HCU_array_key_value('priviv',$parms);
            }
            if ( empty($clientid) || empty($produrl) || empty($pub) ||
                    empty($priv) || empty($iv) ) {
                throw new Exception('Missing EZCard Settings');
            }
            $pubkey = "";
            for ($i = 0; $i < strlen($pub); $i+=2) {
                $pubkey .= chr(hexdec(substr($pub, $i, 2)));
            }
            $privkey = "";
            for ($i = 0; $i < strlen($priv); $i+=2) {
                $privkey .= chr(hexdec(substr($priv, $i, 2)));
            }
            $priviv = "";
            for ($i = 0; $i < strlen($iv); $i+=2) {
                $priviv .= chr(hexdec(substr($iv, $i, 2)));
            }


            //        if ($live) {
            //            $MIR = GetMemberInfo($HB_ENV, array("member" => $accountToUse));

            //        } else {
            //            /* batch interface will need to figure out how to get MIR info */
            //            $MIR["data"] = array();
            //        }

            # NOTE that EZCARD does not use the speedbump.  Required parameters
            # are populated from the loan history settings in home banking.
            #
            # For EXTERNAL keys, set
            # accountToUse=#mbracct# and keyloc=EXTERNAL
            #
            # For keys in the data stream, set
            # accountToUse=#mbracct# and loannumber=#loan#
            #
            #  On Mammoth, only the loannumber was set with loannumber=#loan#
            #  For Odyssey, add a=#acctid#

            $dms_ok = array('keyloc' => 'string');
            dms_import($dms_ok);

            // for EXTERNAL, the accountToUse should be coming from the
            // speedbump account selector
            if (strtoupper($keyloc) == 'EXTERNAL') {
              if (empty($accountToUse) ) {
                  throw new Exception('Missing Account Parameter');
              }
              # get card info from {$CU}extkey table
              # should only be one record, but just in case, limit 1
              $sql = "select parms
                    from {$Cu}extkey where accountnumber='" . prep_save($accountToUse, 12) . "'
                     and providermode='$mode' limit 1;";

              $sth = db_query($sql, $dbh);
              if (!($sth) || db_num_rows($sth) == 0) {
                  throw new Exception('No credit card found.  Please contact the credit union.');
              }
              list($misc1) = db_fetch_array($sth, 0);
              list($card4, $cardsig, $cardtype) = explode(',', $misc1);
            } else {
              $dms_ok = array('a' => 'string');
              dms_import($dms_ok);

              // a = acctid
              // acctid is the string representation of the sub account
              // D|6680|10|0
              $acctID = HCU_PayloadDecode($Cu, $a);
              $loannumber = $acctID[2];
              $accountToUse = $acctID[1];

              // must restrict to the current user, check if the user
              // actually has access to the loan account that was passed
              // through.
              $sql = "
                SELECT * FROM {$Cu}useraccounts
                WHERE accountnumber = '" . prep_save($accountToUse, 12) . "'
                  AND accounttype = '" . prep_save($loannumber, 25) . "'
                  AND recordtype = 'L'
                  AND user_id = $Uid";
              $sth = db_query($sql, $dbh);
              if (!($sth) || db_num_rows($sth) == 0) {
                throw new Exception('No credit card found.  Please contact the credit union.');
              }
              # get card info from {$CU}loanbalance table
              if (empty($loannumber)) {
                  throw new Exception('Missing Loan Account');
              }

              # need to pass loannumber in link
              $sql = "select trim(misc1)
                    from {$Cu}loanbalance where accountnumber='" . prep_save($accountToUse, 12) . "'
                     and loannumber='" . prep_save($loannumber, 25) . "';";

              $sth = db_query($sql, $dbh);
              if (!($sth) || db_num_rows($sth) == 0) {
                  throw new Exception('Invalid Loan Account');
              }
              list($misc1) = db_fetch_array($sth, 0);
              list($card4, $cardsig, $cardtype) = explode(',', $misc1);
            }
            # give error and die if missing values
            if (empty($card4) || empty($cardsig) || empty($cardtype)) {
                throw new Exception('Empty values');
            }

            # Implement PKCS5 / PKCS7 Padding (PKCS7 apparently extends PKCS5, but they
            # are the same for 8-byte blocks)
            # cipher algorithm needs 8-byte blocks, pad data with binary bytes
            # - 01 if you need 1 byte, 02 02 if you need 2 bytes, ...
            # 07 07 07 07 07 07 07 if you need 7 bytes, and if you have a multiple of 8,
            # pad with 8 bytes 08.
            $sv0 = substr('00000000' . strval(rand(1, 99999999)), -8);
            $edate = gmdate('m/d/y H:i:s', time() + 900); # sso expires after 15 minutes
            $salt = base64_encode(openssl_random_pseudo_bytes(6));
            $salt = str_replace(array("+", "/", "="), array("-", "_", "."), $salt);

            $ssoRequest = "<SSORequest AcctLast4=\"${card4}\" AcctSignature=\"${cardsig}\" CardType=\"${cardtype}\" EmailAddress=\"${Ml}\" ExpireDateTime=\"${edate}\" />";

            $clientId = $parms['clientid'];
            // ENCRYPTION
            if($use_openssl_encryption) {
                list($ssoRequest,
                     $innerpkt,
                     $ssoWrap,
                     $outpkt) = encrypt_ezcard_sso($ssoRequest,
                                                   $clientId,
                                                   $privkey,
                                                   $pubkey,
                                                   $priviv,
                                                   $salt);
            } else {
                list($ssoRequest,
                     $innerpkt,
                     $ssoWrap,
                     $outpkt) = encrypt_ezcard_sso_mcrypt($ssoRequest,
                                                          $clientId,
                                                          $privkey,
                                                          $pubkey,
                                                          $priviv,
                                                          $salt);
            }

            $href = "{$produrl}?SSOPacket=$outpkt";
            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();               // the id for this transaction
                $logParms["logPoint"] = "$mode SSO";   // this action in a readable form
                $logParms["request"] = "href: $href \nssoRequest $ssoRequest \nssoWrap $ssoWrap";    // the request
                $logParms["reply"] = "";            // SSO - no response
                LogSSOActivity($logParms);
            }
            break;

        case "GOTOMYCARD":
            # NOTE that GOTOMYCARD does not use the speedbump.  Both accountToUse and
            # loannumber are populated from the loan history settings in home banking.
            # On Mammoth, only the loannumber was set with loannumber=#loan#
            # For Odyssey, add accountToUse and loannumber set with a=#acctid#
            if (!hcu_checkService($dbh, "VANTIV")) {
                $omsg = hcu_checkServiceMsg($dbh, "VANTIV");
                throw new Exception("$omsg");
            }
            $CuNo = HCU_array_key_value('CuNo', $parms);
            $pilot = HCU_array_key_value('pilot', $parms);
            if ($pilot) {
                $gtmcurl = HCU_array_key_value('piloturl', $parms);
                $gtmccert = HCU_array_key_value('pilotcert', $parms);
                $gtmcpass = HCU_array_key_value('pilotpass', $parms);
            } else {
                $gtmcurl = HCU_array_key_value('produrl', $parms);
                $gtmccert = HCU_array_key_value('prodcert', $parms);
                $gtmcpass = HCU_array_key_value('prodpass', $parms);
            }

            $dms_ok = array('keyloc' => 'string', 'a' => 'string');
            dms_import($dms_ok);

            // a = acctid
            // acctid is the string representation of the sub account
            // D|6680|10|0
            $acctID = HCU_PayloadDecode($Cu, $a);
            $loannumber = $acctID[2];
            $accountToUse = $acctID[1];

            // must restrict to the current user, check if the user
            // actually has access to the loan account that was passed
            // through.
            $sql = "
              SELECT * FROM {$Cu}useraccounts
              WHERE accountnumber = '" . prep_save($accountToUse, 12) . "'
                AND accounttype = '" . prep_save($loannumber, 25) . "'
                AND recordtype = 'L'
                AND user_id = $Uid";
            $sth = db_query($sql, $dbh);
            if (!($sth) || db_num_rows($sth) == 0) {
              throw new Exception('No credit card found.  Please contact the credit union.');
            }

            if (isset($keyloc) && strtoupper($keyloc) == 'EXTERNAL') {
                # get card info from {$CU}extkey table
                # should only be one record, but just in case, limit 1
                $sql = "select parms
                      from {$Cu}extkey where accountnumber='" . prep_save($accountToUse, 12) . "'
                       and providermode='$mode' limit 1;";

                $sth = db_query($sql, $dbh);
                if (!($sth) || db_num_rows($sth) == 0) {
                    throw new Exception('No credit card found.  Please contact the credit union.');
                }
                list($misc1) = db_fetch_array($sth, 0);
                list($card4, $cardsig, $cardtype) = explode(',', $misc1);
            } else {
                # get card info from {$CU}loanbalance table
                if (empty($loannumber) || empty($accountToUse) ) {
                    throw new Exception('Invalid Account');
                }

                $sql = "select trim(misc1)
                      from {$Cu}loanbalance where accountnumber='" . prep_save($accountToUse, 12) . "'
                       and loannumber='" . prep_save($loannumber, 25) . "';";
                //     and type='18';";

                $sth = db_query($sql, $dbh);
                if (!($sth) || db_num_rows($sth) == 0) {
                    throw new Exception('No Valid Accounts');
                }
                list($misc1) = db_fetch_array($sth, 0);
                list($card4, $cardsig, $cardtype) = explode(',', $misc1);
            }
            # give error and die if missing values
            if (empty($card4)) {
                throw new Exception('Missing Card Info HomeCU');
            }

            /*
             * build the SSO request
             */
            if (!isset($parms['SavingsNoSize'])) {
                # default to 10 char length for backward compatibility
                $SavingsNo = substr("0000000000$accountToUse",-10,10);
            } elseif (isset($parms['SavingsNoSize']) && $parms['SavingsNoSize'] > 0) {
                $SavingsNo = substr(str_repeat('0', $parms['SavingsNoSize']) . $accountToUse, (-1 * $parms['SavingsNoSize']), $parms['SavingsNoSize']);
            } else {
                $SavingsNo = $accountToUse;
            }

            if ( getenv( "DEVMODE" ) == 1 ) {
                # devmode, send loopback
                $ipaddr = '127.0.0.1';
            } else {
                $ipaddr = $_SERVER['REMOTE_ADDR'];
            }

            $soapString = '<?xml version="1.0" encoding="utf-8"?>';
            $soapString .= "<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:sso=\"https://sso.gotomycard.com/\">
<soap:Body>
      <sso:SSORequest>
         <sso:CuNo>{$parms['CuNo']}</sso:CuNo>
         <sso:UserName>$accountToUse</sso:UserName>
         <sso:IpAddress>$ipaddr</sso:IpAddress>
         <sso:SavingsNo>$SavingsNo</sso:SavingsNo>
         <sso:Ssn></sso:Ssn>
         <sso:AcctNo>$card4</sso:AcctNo>
      </sso:SSORequest>
</soap:Body>
</soap:Envelope>";

            $curlopts = array(
                CURLOPT_RETURNTRANSFER => 1,
                CURLOPT_POST => 1,
                CURLOPT_POSTFIELDS => "$soapString",
                CURLOPT_URL => "$gtmcurl",
                CURLOPT_SSLCERT => "$gtmccert",
                CURLOPT_SSLCERTPASSWD => "$gtmcpass");

            $header = array();
            $header[] = "Content-Type: text/xml; charset=utf-8";
//          $header[] = 'SOAPAction: "SSORequest"';
            $response = "";
            $ch = curl_init();
            if ($ch) {
                curl_setopt_array($ch, $curlopts);
                curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
//curl_setopt($ch, CURLOPT_VERBOSE, true);
//$verbose = fopen('/home/cruisecu/tmp/gtmc_trace.txt', 'a+');
//curl_setopt($ch, CURLOPT_STDERR, $verbose);
                $response = curl_exec($ch);
                $cerrno = curl_errno($ch);
                $cerr = curl_error($ch);
                curl_close($ch);
            }
            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();               // the id for this transaction
                $logParms["logPoint"] = "GOTOMYCARD SSO";   // this action in a readable form
                $logParms["request"] = $soapString;               // the request
                $logParms["reply"] = $response;            // the response
                LogSSOActivity($logParms);
            }

# check for soap fault & throw error
            if ($cerr) {
                throw new Exception("Connection Error $cerrno $cerr");
            }
            if ($response > '') {
                $response = html_entity_decode($response);

                $soapfault = strpos($response, "faultcode");

                if ($soapfault !== FALSE) {
                    preg_match('/<faultcode>(.*)<\/faultcode>/i', $response, $stat);
                    $gtmcfaultcode = $stat[1];
                    preg_match('/<faultstring>(.*)<\/faultstring>/i', $response, $stat);
                    $gtmcfaultstring = $stat[1];
                    throw new Exception("GTMC Connection Fault $gtmcfaultstring");
                } else {
                    preg_match('/<completion>(.*)<\/completion>/i', $response, $stat);
                    $gtmcstat = $stat[1];
                }
            }
            if ($gtmcstat == '0') {
                preg_match('/<url>(.*)<\/url>/i', $response, $stat);
                $href = html_entity_decode($stat[1]);
//                $showurl = 1;
            } else {
                preg_match('/<completionscript>(.*)<\/completionscript>/i', $response, $stat);
                $gtmcstatstring = (empty($stat[1]) ? "GTMC Connection Failed" : $stat[1]);
                throw new Exception("GTMC Error $gtmcstatstring");
            }
            break;

        case "LASERTEC_ES":
            if (!hcu_checkService($dbh, "LASERTEC")) {
                $omsg = hcu_checkServiceMsg($dbh, "LASERTEC");
                throw new Exception("$omsg");
            }
            if (trim($Ml) == '') {
                throw new Exception("Not enough info for remote service (missing email)");
            }

            $UniqueKey = HCU_array_key_value('UniqueKey',$parms);
            $CustID = HCU_array_key_value('CustID',$parms);
            $currdate = gmdate('mdYHis'); # using GMT - OK?
            $currdate = date('mdYHis'); # using GMT - OK?
            //        $Cn='545454'; # test value -- log in worked 10/3/13 MH
            $srcstring = "{$accountToUse}{$currdate}{$Ml}{$UniqueKey}";

            $hash = strtoupper(hash('SHA256', $srcstring, false));

            print <<<EOF
  <html>
  <body onload = "javascript:document.SSOform.submit();">
  <div style='font-size: 28px; text-align:center; padding-left: 40px; padding-right: 40px; padding-top: 40px;'>
  Loading Data..... Please Wait
  </div>
  <form name="SSOform" method="post" action="{$parms['ES_URL']}">
  <input type="hidden" name="CustID" value="$CustID">
  <input type="hidden" name="AccountNumber" value="$accountToUse">
  <input type="hidden" name="Date" value="$currdate">
  <input type="hidden" name="Email" value="$Ml">
  <input type="hidden" name="Hash" value="$hash">
  <input type="hidden" name="UniqueKey" value="$UniqueKey">
  </form>
  </body>
  </html>
EOF;

            break;

        case "IDS_ES":
            if (!hcu_checkService($dbh, "IDS")) {
                $omsg = hcu_checkServiceMsg($dbh, "IDS");
                throw new Exception("$omsg");
            }
            $pilot = HCU_array_key_value('pilot', $parms);
            if ($pilot) {
                $UniqueKey = HCU_array_key_value('pilotKey', $parms);
                $InstID = HCU_array_key_value('pilotInstID', $parms);
                $ES_URL = HCU_array_key_value('pilotURL', $parms);
            } else {
                $UniqueKey = HCU_array_key_value('prodKey', $parms);
                $InstID = HCU_array_key_value('prodInstID', $parms);
                $ES_URL = HCU_array_key_value('prodURL', $parms);
            }

            if (empty($UniqueKey) || empty($InstID) || empty($ES_URL) ) {
                throw new Exception('Missing Settings');
            }

            $currdate = gmdate('mdYHis'); # using GMT - OK?
            $currdate = date('mdYHis'); # using local
            $srcstring = "{$accountToUse}{$currdate}{$Ml}";

            $hash = hash_hmac('sha256', $srcstring, $UniqueKey,false);

            print <<<EOF
  <html>
  <body onload = "javascript:document.SSOform.submit();">
  <div style='font-size: 28px; text-align:center; padding-left: 40px; padding-right: 40px; padding-top: 40px;'>
  Loading Data..... Please Wait
  </div>
  <form name="SSOform" method="post" action="{$ES_URL}" method="POST">
  <input type="hidden" name="institution" value="$InstID">
  <input type="hidden" name="account" value="$accountToUse">
  <input type="hidden" name="timestamp" value="$currdate">
  <input type="hidden" name="timezone" value="MST">
  <input type="hidden" name="hmac" value="$hash">
EOF;
  if (!empty($Ml)) {
    print '<input type="hidden" name="email" value="' . $Ml . '">';
  }
  print <<<EOF
  </form>
  </body>
  </html>
EOF;

            break;
        case "LASERPRINT_ES":
            if (!hcu_checkService($dbh, "LASERPRINTING")) {
                $omsg = hcu_checkServiceMsg($dbh, "LASERPRINTING");
                throw new Exception("$omsg");
            }

            /*
             * These are the entire specs .... but hey, they work!
             *
             * 1) Let's say for example, we want to access account number 12345.
             * 2) Convert the number to 10-digit string without spaces by prefixing it with zeroes. You should get "0000012345".
             * 3) Affix "test" at the beginning and "SALT123" at the end of the string. It should now give you "test0000012345SALT123".
             * 4) Convert the string to MD5 or SHA-256 hash. You should get "7248f8aad297d31a99b13ba8b48283f3" (lower case) if using MD5.
             *      This is the value to assign to the "access" item.
             * 5) Submit the access value to our link using either POST or GET method (we recommend using the POST method because it's more secure)
             *
             * Following the above procedure, the complete URL to access account number 12345 will be
             * https://www.laserprinting.com/asp/mercer_test/test.asp?access=7248f8aad297d31a99b13ba8b48283f3 (using the GET method).
             * Following this link should get you to a page containing the credit union logo, plus a short message telling you which account record is accessed.
             *
             * We can setup dummy accounts for testing if you desire.
             * We then restrict access to your IP address or range.
             * The specification described here is for testing purposes only. We will be changing the main URL and the values described
             * in Step 3 when/if this goes live.
             *
             * Christopher P. Rachal
             * Operations Manager
             * Alpha Omega COM Inc.
             * crachal@laserprinting.com
             * Phone: 318-584-1673
             * Office:  318-227-8065
             * www.laserprinting.com
             */


           /*
            * ...and then they sent new specs:
            * Here's our basic single sign-on specs (converted from MD5 to SHA-256) :

            * The home banking site will be able to connect the users to our e-statements by passing
            * their account number in encrypted form.

            * Here's a sample procedure:

            * The home banking app will have to convert a member's account number to 10-digit string.
            * For example, an account number 1234 becomes 0000001234.
            * Affix "alpha" at the beginning and "OMEGA2000" at the end of the 10-digit string.
            * We should get "alpha0000001234OMEGA2000".
            * Encrypt the string using SHA-256 hash. We should get
                         * "5e82568ed1df607623f739d82bef23d9ddf813fb3efdb0e96f1bb98cc28addbd".
            * Assign the SHA-256 hashed value to a form item named "access" and submit it to our
            * receiving URL using either POST or GET method (we recommend using the POST method).

            * The salt strings described in step #2 above are just for testing purposes and
            * will be changed accordingly for live implementation.
            * The link to our test app is https://www.laserprinting.com/asp/mcnjtfcu/e-stmt.asp.
            * Following the above procedure, a way to connect a user having account number
            * 1234 is by redirecting to this URL:
            * https://www.laserprinting.com/asp/mcnjtfcu/e-stmt.asp?access=5e82568ed1df607623f739d82bef23d9ddf813fb3efdb0e96f1bb98cc28addbd.

            * The link above should take them to a page showing the credit union logo and
            * information on which account number is accessed.
            * If you see a dash (-) under the Account Number column during testing,
            * it means the SHA-256 hash value submitted to our site does not exist or is invalid.
            * A plain message that says "Access Denied" is also an indication of an invalid SHA-256 value
            * submitted to the page.

            * The app is currently setup to accept the following test accounts as valid:
            * - 2267009
            * - 10207355
            * Let us know when you are ready to test live member statements and we will have it enabled.
            */

            $pilot = HCU_array_key_value('pilot', $parms);
            if ($pilot) {
                $ES_Pre = HCU_array_key_value('pilotPre', $parms);
                $ES_After = HCU_array_key_value('pilotAfter', $parms);
                $ES_PadLen = HCU_array_key_value('pilotPadLen', $parms);
                $ES_URL = HCU_array_key_value('pilotURL', $parms);
            } else {
                $ES_Pre = HCU_array_key_value('prodPre', $parms);
                $ES_After = HCU_array_key_value('prodAfter', $parms);
                $ES_PadLen = HCU_array_key_value('prodPadLen', $parms);
                $ES_URL = HCU_array_key_value('prodURL', $parms);
            }

            $srcstring = trim($ES_Pre) . str_pad($accountToUse,$ES_PadLen,"0",STR_PAD_LEFT) . trim($ES_After);
//            $access=md5($srcstring); # first specs used MD5
            $access=hash('sha256',$srcstring);

            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();                     // the id for this transaction
                $logParms["logPoint"] = "LASERPRINT_ES Redirect";      // this action in a readable form
                $logParms["request"] = "SSO $ES_URL w/ src $srcstring and access $access";                     // the request
                $logParms["reply"] = '';                   // the response
                LogSSOActivity($logParms);
            }

            print <<<EOF
  <html>
  <body onload = "javascript:document.SSOform.submit();">
  <div style='font-size: 28px; text-align:center; padding-left: 40px; padding-right: 40px; padding-top: 40px;'>
  Loading Data..... Please Wait
  </div>
  <form name="SSOform" method="post" action="{$ES_URL}" method="POST">
  <input type="hidden" name="access" value="$access">
  </form>
  </body>
  </html>
EOF;

            break;

        case "MWI_LOANPAY":
            if (!hcu_checkService($dbh, "MWI")) {
                $omsg = hcu_checkServiceMsg($dbh, "MWI");
                throw new Exception("$omsg");
            }

            if ($HB_ENV["HCUPOST"]["option"] == 'SELECTACCT') {
                $dms_ok = Array("selacct" => "string");

                dms_import_v2($HB_ENV, "HCUPOST", $dms_ok);

                if (!sizeof($HB_ENV["HCUPOST"]["selacct"])) {
                    # error if no selacct?
                }
                #
                list($loanACH, $paymentdue) = explode('|', $HB_ENV["HCUPOST"]["selacct"]);
                $Pilot = $parms['Pilot'];
                $URL = ($Pilot == 0 ? $parms['ProdUrl'] : $parms['PilotUrl']);
                $AccessNumber = $parms['AccessNumber'];
                $SecurityKey = $parms['SecurityKey'];
                $Password = $parms['Password'];
                $salt = $parms['salt'];
                $PaymentIndicator = $parms['PaymentIndicator'];
                $PaymentFunction = '1';
                $PaymentAmount = $paymentdue;
                $BillingID = "$Cn";
                $CreditAcctNumber = $loanACH;
                /*
                 * Per Jeff Dean 2/14/14 ignore the specs and send
                 *  BillingID as the ACH value
                 *  InternalID as member number
                 *  CreditAcctNumber blank
                 */
                $BillingID = "$loanACH";
                $CreditAcctNumber = '';
                $InternalID = "$Cn";

                $srcstring = "{$SecurityKey}|{$PaymentFunction}|{$PaymentAmount}|{$PaymentIndicator}|{$AccessNumber}|{$BillingID}|{$Password}";


                # set test values
                //        $SecurityKey='jaywilson';
                //        $PaymentFunction='1';         # payment function is always 6 according to specs, but sample uses 1
                //        $PaymentAmount='1018.40';
                //        $PaymentIndicator='3';
                //        $AccessNumber='3001';
                //        $BillingID='337764-000-2';
                //        $CreditAcctNumber = '200337764';
                //        $Password='jay1234';
                //
    //        $srcstring = "jaywilson|1|1018.40|3|3001|337764-000-2|jay1234";

                $hash = hash_hmac('sha256', $srcstring, $salt, false);
                $request = "<?xml version=\"1.0\" encoding=\"utf-8\"?>";
                $request .= "\n<PaymentRequest>
                <AuthInfo\n AccessNumber=\"$AccessNumber\"
                SecurityKey=\"$SecurityKey\"
                Password=\"$Password\"
                PaymentFunction=\"$PaymentFunction\"
                PaymentIndicator=\"$PaymentIndicator\"";
                /*
                 * Magic Wrighter can't get the email to work
                 * triggers 500 internal server error no matter how
                 * I send it.  Tried CustEMail, CustEmail,
                 * single quotes, double quotes,
                 * url-encoded, plain, with @ escaped as \@
                 * can't find a combo that works
                 * So per Jeff Dean 2/13/14
                 * members will have to enter email on Magic Wrighter side
                 */

                //        if (!empty($Ml)) {
                ////            $request .= "\nCustEmail=\"" . urlencode($Ml) . "\"\n";
                //            $request .= "\nCustEmail=\"$Ml\"\n";
                //        }
                $request .= "/>\n";
                $request .= "\n<PaymentInfo\n BillingID=\"$BillingID\"
                InternalID=\"$InternalID\"
                PaymentAmount=\"$PaymentAmount\"
                VerificationHash=\"$hash\"/>
                    </PaymentRequest>";
            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();               // the id for this transaction
                $logParms["logPoint"] = "MWI_LOANPAY SSO";   // this action in a readable form
                $logParms["request"] = "SRCSTRING $srcstring \nPOST $URL \nPaymentRequest = $request";               // the request
                $logParms["reply"] = '';            // no response - this is a redirect
                LogSSOActivity($logParms);
            }

                print <<<EOF
  <html>
  <body onload = "javascript:document.SSOform.submit();">
  <div style='font-size: 28px; text-align:center; padding-left: 40px; padding-right: 40px; padding-top: 40px;'>
  Loading Data..... Please Wait
  </div>
  <form name="SSOform" method="post" action="{$URL}">
  <input type="hidden" name="PaymentRequest" value='$request'>
  </form>
  </body>
  </html>
EOF;
            } else {

                # get the list of valid transfer accounts
                $aryTxlist = TX_list($dbh, $HB_ENV);
                setFmsgTxCookie($HB_ENV, $aryTxlist);

                if ($aryTxlist['status']['code'] != '000') {
                    throw new Exception("No eligible loans");
                }
                $arySelectList = array();
                foreach ($aryTxlist['acctlist'] as $acctkey => $details) {
                    if ($details['acctclass'] == 'L' && $details['to'] == 'Y') {
                        if ($parms['sendjoint'] || (!$parms['sendjoint'] && $details['trust'] == 'primary')) {
                            $arySelectList[$acctkey]['display'] = $details['description'] . '  (' . $HB_ENV['MC']->msg('Payment') . ': ' . $details['paymentdue'] . ')';

                            if (sizeof($parms['ACHfmt'])) {
                                $loanACH = Set_ACH($parms['ACHfmt'], $details['suffix'], $details['member']);
                            } else {
                                # pretty stupid default, but probably need to set something...
                                $loanACH = $details['member'] . $details['suffix'];
                            }
                            $arySelectList[$acctkey]['getvalue'] = trim($loanACH) . '|' . $details['paymentdue'];
                        }
                    }
                }

                if (!sizeof($arySelectList)) {
                    throw new Exception("No eligible loans");
                }

                // set up the list of account choices
                $selectAccountString = "";
                $count = count($arySelectList);
                if ($count > 0) {
                    $idx = 1;
                    $checked = $count == 1 ? "checked" : "";
                    foreach ($arySelectList as $acct_key => $acct_array) {
                        $selectAccountString .="<input type='radio' name='selacct' id='response{$idx}' {$checked} value='{$acct_array['getvalue']}'/><label style='padding: 10px;' for='response{$idx}'>{$acct_array['display']}</label><br>";
                        $idx++;
                    }
                }

                $cancelButton = "<button type='button' class='k-button' name='btnCancel' onClick='window.close();'>{$HB_ENV['MC']->msg("Cancel")}</button>";
                $continueButtonText = "Continue";
                // if the button needs to trigger a check of the radio buttons to make sure one selected, it must call CkRadio()
                $continueButton = "<button type='button' class='k-button' name='btnContinue' onClick='javascript:CkRadio();return false;'>$continueButtonText</button>";
                $buttons = "{$cancelButton} &nbsp; &nbsp; {$continueButton}";

                $descTtl = "";
                $pageTtl = '<p><span style="font-size: medium; font-family: arial,helvetica,sans-serif;"><strong>Please select the loan you wish to pay:</strong></span></p>';
                $acceptance = ""; // not needed for this form

                $noticeSubstitution = array(
                  "#page_title#" => $pageTtl,
                  "#description#" => $descTtl,
                  "#content#" => $selectAccountString,
                  "#acceptance#" => $acceptance,
                  "#buttons#" => $buttons
                );

                /*
                 * present a list of eligible loans, showing description & paymentdue
                 * render as radio (select one only).
                 */
                // get any notice text
                $HB_ENV["noticeStrReplace"] = $noticeSubstitution;
                $noticeInfo = Get_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC'], 'D', 'ConnectSpeedbump');

                // make sure we got the notice
                if ($noticeInfo["status"]["code"] != "000" ||
                    !count($noticeInfo["notice"]) ||
                    strlen($noticeInfo["notice"][0]["notice_text"]) == 0) {
                    throw new Exception("Configuration Error: Custom Content (ConnectSpeedbump)");
                }

                $noticeText = $noticeInfo['notice'][0]['notice_text'];

                $inputList = array(array("name" => "mode", "value" => "$mode"),
                    array("name" => "option", "value" => "SELECTACCT")
                );
                $checkMsg = "";
                $radioGroupName = "selacct";
                ShowUserNotice($noticeText, $inputList, $radioGroupName, $checkMsg);
            }
            break;
        case "Bit":
            if (!hcu_checkService($dbh, "Bit")) {
                $omsg = hcu_checkServiceMsg($dbh, "Bit");
                throw new Exception("$omsg");
            }

            $cuid = HCU_array_key_value("CustID", $parms);
            $bitkey = HCU_array_key_value("BitKey", $parms);
            $biturl = HCU_array_key_value("BitURL", $parms);
            if (empty($cuid) || empty($bitkey) || empty($biturl) ) {
                throw new Exception("Missing Bit Configuration Settings");
            }
            # if we want to charge for BIT access, check eStatement status here
            # throw error if eStatement is not set - or present terms of service
            # and require agreement

            $key = "";
            for ($i = 0; $i < strlen($bitkey); $i+=2) {
                $key .= chr(hexdec(substr($bitkey, $i, 2)));
            }

            $date = gmdate("Ymd");
            $ustr = $cuid . $accountToUse . $date;
            $mac = hash_hmac('MD5', $ustr, $key);

            $href = "$biturl?FI=$cuid&Account=$accountToUse&ProviderID=2&Email=$Ml&MAC=$mac";

            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();               // the id for this transaction
                $logParms["logPoint"] = "Bit SSO";   // this action in a readable form
                $logParms["request"] = $href;               // the request
                $logParms["reply"] = '';
                LogSSOActivity($logParms);
            }

            break;

        case "CERTEGY":
            if (!hcu_checkService($dbh, "CERTEGY")) {
                $omsg = hcu_checkServiceMsg($dbh, "CERTEGY");
                throw new Exception("$omsg");
            }
            // CERTEGY will post back to this address (the address we provide). Look for the parameters.
            $dms_ok = array('STATUS' => 'string', 'DISPLAYMESSAGE' => 'string');
            dms_import_v2($HB_ENV, "HCUPOST", $dms_ok);
            $DISPLAYMESSAGE = HCU_array_key_value("DISPLAYMESSAGE",$HB_ENV["HCUPOST"]);
            $STATUS = HCU_array_key_value("STATUS", $HB_ENV["HCUPOST"]);
            /*
              if ($pilot == 1) {
              $key = 'pO_cI0m&asoagia4lec#uHI8';  # NEW test key as of 10/25/2010
              $certegyURL = "https://bp01.premierbillpay.com/servlet/tpservlet";
              $ACCOUNT = "10006"; # enrolled";
              $ACCOUNT = "9874002"; # not enrolled
              $FIID = '0006'; #TEST
              } else {
              $key = '8Pqb@NZ&!JH%g89Fql0m12P$';  # one key for DMS
              # this is the new URL to be effective 3/2/11:
              # Effective for all 3 clients: CCCU, RIVER, SIACU
              #
              $certegyURL = "https://sso-redirector.ezbills.com/mvsso/servlet/tpservlet";
              #$certegyURL="https://bp04.internet-ebanking.com/servlet/tpservlet";
              $ACCOUNT = (trim($billpayid) == '' ? $Cn : $billpayid);
              $FIID = $bp_cuid; #CU Institution ID assigned per CU
              }
             */
            $pilot = HCU_array_key_value("pilot",$parms);
            if ($pilot == 1) {
                $key = HCU_array_key_value("pilotKey",$parms);
                $certegyURL = HCU_array_key_value("pilotURL", $parms);
            } else {
                $key = HCU_array_key_value("certegyKey", $parms);
                $certegyURL = HCU_array_key_value("certegyURL", $parms);
            }
            $FIID = HCU_array_key_value("FIID", $parms);
            $ACCOUNT = HCU_array_key_value("ACCOUNT", $parms);

            if (empty($ACCOUNT) ) {
                $ACCOUNT = (trim($billpayid) == '' ? $accountToUse : $billpayid);
            }
            if (empty($key) || empty($certegyURL) || empty($FIID) || empty($ACCOUNT) ) {
                throw new Exception("Missing Certegy Settings");
            }

            // ENCRYPTION
            if($use_openssl_encryption) {
                list($dm_token, $ACCOUNT) = encrypt_certegy_openssl($ACCOUNT, $key);
            } else {
                list($dm_token, $ACCOUNT) = encrypt_certegy_account_mcrypt($ACCOUNT, $key);
            }

            $DATA = strtoupper(bin2hex($dm_token));
            $authurl = urlencode("https://" . $_SERVER['SERVER_NAME']
                . $_SERVER['PHP_SELF'] . "?cu=$Cu&mode=CERTEGY");
            if (trim($STATUS) > "") {
                switch ($STATUS) {

                    case 8:
                        # member tried to log in but is not enrolled - send them to the enrollment
                        # as of 3/22/11 just give member a 'you must enroll' message, no redirect
                        #$href="{$certegyURL}?transactiontype=EnrollmentMaintActionBean&ACTIVITY_TYPE=GOTOEDIT&CHGMODE=A&USERID=$DATA&FIID=$FIID&AUTHENTICATIONURL=$authurl&LOGOFFURL=$authurl";
                        #break;
                        #
//                      $fragfile = "/home/$chome/public_html/nobillpayfrag";
//                      $fragext = (trim("$Flang") == "en_US" ? "" : "_" . substr($Flang, 0, strpos($Flang, "_")) );
//                      $fragfile .= ($fragext > "" && is_readable("{$fragfile}{$fragext}.html") ? "$fragext.html" : ".html");
                        #
                      $DISPLAYMESSAGE = 'You must enroll before using this service. Please contact your credit union for assistance';

                    case 0:
                        if (strtoupper($DISPLAYMESSAGE) == 'USER_SIGNOFF') {
                            $DISPLAYMESSAGE = 'Bill Pay Session Ended';
                        } else if (strtoupper($DISPLAYMESSAGE) == 'INACTIVITY_TIMEOUT' ||
                            strtoupper($DISPLAYMESSAGE) == 'SESSION_TIMEOUT') {
                            $DISPLAYMESSAGE = 'Bill Pay Session Timed Out';
                        }
                    default:
                        # CERTEGY returned a message other than 'not enrolled'.
                        # show the message we got and bail out.
// Need custom content file
                        // show the "Not Available" notice

                        $DISPLAYMESSAGE = (trim($DISPLAYMESSAGE) == '' ? 'Unable to contact Fidelity Bill Pay service' : $DISPLAYMESSAGE);
                        $title = $HB_ENV['MC']->msg('Unable to Log In');

                        $cancelButton = "<button type='button' class='k-button' name='btnCancel' onClick='window.close();'>{$HB_ENV['MC']->msg("Close Window")}</button>";

                        // set up the string substitution
                        $noticeSubstitution = array(
                          "#title#" => $title,
                          "#service_name#" => "Fidelity Bill Pay",
                          "#service_type#" => "BillPay",
                          "#vendor_name#" => "",
                          "#display_content#" => $DISPLAYMESSAGE,
                          "#close_button#" => $cancelButton
                        );

                        // get any notice text
                        $HB_ENV["noticeStrReplace"] = $noticeSubstitution;
                        $noticeInfo = Get_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC'], 'D', 'ConnectNoService');

                        // make sure we got the notice
                        if ($noticeInfo["status"]["code"] != "000" ||
                            !count($noticeInfo["notice"]) ||
                            strlen($noticeInfo["notice"][0]["notice_text"]) == 0) {
                            throw new Exception("Configuration Error: Custom Content (ConnectNoService)");
                        }

                        $noticeText = $noticeInfo['notice'][0]['notice_text'];

                        ShowUserNotice($noticeText, array(), "", "");
                        break;
                }
            } else {
//$showurl = 1;
                # try to log in
                #                   $href="https://bp01.premierbillpay.com/servlet/tpservlet?transactiontype=UserInqAuthActionBean&USERID=$DATA&FIID=$FIID&AUTHENTICATIONURL=$authurl&LOGOFFURL=$authurl";
                //            $href = "{$certegyURL}?transactiontype=UserInqAuthActionBean&USERID=$DATA&FIID=$FIID&AUTHENTICATIONURL=$authurl&LOGOFFURL=$authurl";
                $href = "{$certegyURL}?transactiontype=UserInqAuthActionBean&USERID=$DATA&FIID=$FIID&AUTHENTICATIONURL=$authurl";
            }
            break;
        case "LKCS":
            if (!hcu_checkService($dbh, "LKCS")) {
                $omsg = hcu_checkServiceMsg($dbh, "LKCS");
                throw new Exception("$omsg");
            }
            /*
              switch ($Cu) {
              case "CCU":
              # Century Credit Union
              #$showurl=1;
              $clid = "47"; // client ID
              $aduser = "ssoadmin"; // admin user
              $pwd = "H0n32sz862fn"; // admin password
              break;
              }
             */
            $clid = HCU_array_key_value("ClientID", $parms);
            $aduser = HCU_array_key_value("AdminUser", $parms);
            $pwd = HCU_array_key_value("AdminPwd", $parms);
            $url = HCU_array_key_value("Url", $parms);

            if (empty($clid) || empty($adusr) || empty($pwd) || empty($url) ) {
                throw new Exception("Missing Settings");
            }
//          $url = "https://secure.estatements.net/rpweb.dll/GetUserSession";
            $data = http_build_query(
                array('clid' => $clid, 'adminuser' => $aduser, 'password' => $pwd, 'account' => $Cn,), '', '&');
            $cURL_call = curl_init($url); // create a cURL object
            curl_setopt($cURL_call, CURLOPT_SSL_VERIFYPEER, false);
            curl_setopt($cURL_call, CURLOPT_POST, 1); // use cURL to send data as POST
            curl_setopt($cURL_call, CURLOPT_HEADER, false); // don't include header
            curl_setopt($cURL_call, CURLOPT_POSTFIELDS, $data); // the fields to POST
            curl_setopt($cURL_call, CURLOPT_RETURNTRANSFER, 1); // store return value
            $href = curl_exec($cURL_call); // make the request
            if (preg_match('/^URL=/', $href)) {
                $href = preg_replace('/^URL=/', '', $href);
            } else {
                $error["title"] = "Connection to eStatement service Failed";
                $error["content"] = "Please try again later or contact the credit union to report this error.<br>$href";
                # not sure this is a good way to handle the error, but as of 6/19/2018 no clients using this SSO
                # so probably good enough until we have a client
                throw new Exception(json_encode($error));
            }
            break;
        case "MVANTE":
            if (!hcu_checkService($dbh, "MVANTE")) {
                $omsg = hcu_checkServiceMsg($dbh, "MVANTE");
                throw new Exception("$omsg");
            }

            // get the trusted vendor configuration

            $brand_id = HCU_array_key_value("BrandID", $parms);
            $passwd = HCU_array_key_value("bp_secret", $parms);
            $pilot = HCU_array_key_value("pilot", $parms);

            // The appropriate billpayid for the user will be used if testing or production.
            if ($pilot) {
                $server = HCU_array_key_value("TestURL", $parms);
            } else {
                $server = HCU_array_key_value("ServerURL", $parms);
            }
            # this really should come from the trusted detail
            # but as of 6/19/2018 no clients, so
            # I'll leave it alone until we get a client
            $certfile = "/home/{$chome}/sslforms/mv_{$chome}.pem";

            if ($brand_id == "" || $passwd == "" || !(is_readable($certfile))) {
                $error["title"] = $HB_ENV['MC']->msg('Feature Unavailable');
                $error["content"] = $HB_ENV['MC']->msg('Feature Not Set');
                throw new Exception(json_encode($error));
            }

            /*
              switch ($Cu) {
              case "ESACU":
              $pilot = 0;
              # esacu switching to IPAY 12/3/13
              # set MVANTE variables here so IPAY variables
              # can be set in Monitor.
              $brand_id='l8t';
              $passwd='esa!cu!bp';
              break;
              case "TELCOPLUS":
              $pilot = 0;
              break;
              }
             */
            $billpayid = $mbrow['billpayid'];

            if (trim($billpayid) == '') {
                $billpayid = $accountToUse;
            }

            /*
              // The Trusted Vendor Detail will use the appropriate billpayid for the user and serverURL for the server
              // if testing or production.
              if ( $pilot ) {
              # testing
              # uses test server, uses $user instead of $Cn
              #$user='baduser11';
              $user = 'esacu01'; #ESACU
              $user = 'test12'; #TELCOPLUS
              # Metavante changes the test server periodically
              #$server="https://secuat1.readiness.metavante.com/csp/RemoteServlet";
              #$server="https://secuat2.readiness.metavante.com/csp/RemoteServlet";
              $server = "https://secbpmuat2.readiness.metavante.com/csp/RemoteServlet";
              # this was the original test certificate.
              #$certfile="/usr/miki/metavante.pem";
              $qstring = "?opcode=memberlogin&bid=$brand_id&slid=$billpayid";
              #$cmd="/usr/bin/curl --silent  -H 'Content-Type: text/xml'  '{$server}{$qstring}'";
              $cmd = "/usr/bin/curl --silent  -k -H 'Content-Type: text/xml' -E $certfile:$passwd '{$server}{$qstring}'";
              } else {
              //$server = "https://secbpm3.metavante.com/csp/RemoteServlet";
              $server = $parms["ServerURL"];
              $qstring = "?opcode=memberlogin&bid=$brand_id&slid=$billpayid";
              $cmd = "/usr/bin/curl --silent -k -H 'Content-Type: text/xml' -E $certfile:$passwd '{$server}{$qstring}'";
              }
             *
             */

            $qstring = "?opcode=memberlogin&bid=$brand_id&slid=$billpayid";
            $cmd = "/usr/bin/curl --silent -k -H 'Content-Type: text/xml' -E $certfile:$passwd '{$server}{$qstring}'";

#print "<pre>$cmd</pre>";
            # this should be embedded curl, but no clients as of 6/19/18 so moving on...
            $response = getcurl($cmd);

            if ("$response" > '') {
#if ($pilot) { print htmlentities($response); exit; }
                if (!(is_numeric($response)) && !(preg_match("/Error/i", "$response"))) {
# response isn't just an error code
# and it doesn't contain an error message
                    print "$response";
                    exit;
                } elseif (!(preg_match("/-4/", "$response"))) {

# response doesn't have a '-4 User not found' error embedded

                    $title = $HB_ENV['MC']->msg('Unable to Log In');
                    $message = $HB_ENV['MC']->msg('Unable to Log In') . "<br>" . $HB_ENV['MC']->msg('Please try again later');
//                      $fragfile = '';
                } else {
                    # Error -4 indicates not enrolled -- show the 'you need to sign up' page
                    $title = 'Enrollment Required';
                    $message = $HB_ENV['MC']->msg('Need Metavante');
//                      $fragfile = "/home/$chome/public_html/nobillpayfrag";
//                      $fragext = (trim("$Flang") == "en_US" ? "" : "_" . substr($Flang, 0, strpos($Flang, "_")) );
//                      $fragfile .= ($fragext > "" && is_readable("{$fragfile}{$fragext}.html") ? "$fragext.html" : ".html");
                }

                $cancelButton = "<button type='button' class='k-button' name='btnCancel' onClick='window.close();'>{$HB_ENV['MC']->msg("Close Window")}</button>";

                // set up the string substitution
                $noticeSubstitution = array(
                  "#title#" => $title,
                  "#service_name#" => "Metavante",
                  "#service_type#" => "BillPay",
                  "#vendor_name#" => "",
                  "#display_content#" => $message,
                  "#close_button#" => $cancelButton
                );

                // get any notice text
                $HB_ENV["noticeStrReplace"] = $noticeSubstitution;
                $noticeInfo = Get_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC'], 'D', 'ConnectNoService');

                // make sure we got the notice
                if ($noticeInfo["status"]["code"] != "000" ||
                    !count($noticeInfo["notice"]) ||
                    strlen($noticeInfo["notice"][0]["notice_text"]) == 0) {
                    throw new Exception("Configuration Error: Custom Content (ConnectNoService)");
                }

                $noticeText = $noticeInfo['notice'][0]['notice_text'];

                ShowUserNotice($noticeText, array(), "", "");
            } else {
                # something went wrong -- couldn't open pipe
                $error["title"] = $HB_ENV['MC']->msg('Unable to Log In');
                $error["content"] = $HB_ENV['MC']->msg('Please try again later');
                throw new Exception(json_encode($error));
            }
            break;
        case "IPAY":
            if (!hcu_checkService($dbh, "IPAY")) {
                $omsg = hcu_checkServiceMsg($dbh, "IPAY");
                throw new Exception("$omsg");
            }
            #$bp_cuid = "34261";
            #$Cn = "1001641340";
            #$Cn = "550716762";
            #$bp_secret='test34261';
            #$key = substr(hash('SHA1','test34261',TRUE),0,16);
            // get the vendor settings
            $bp_cuid = HCU_array_key_value("bp_cuid", $parms);
            $bp_secret = HCU_array_key_value("bp_secret", $parms);

            if ($bp_secret == "" || $bp_cuid == "") {
                throw new Exception($HB_ENV['MC']->msg("Feature Not Set"));
            }

            $moc = HCU_array_key_value("moc", $parms);
            if ($moc == 0) {
                $serviceURL = HCU_array_key_value("serviceurl", $parms);
                $tokenURL = HCU_array_key_value("tokenurl", $parms);
            } else {
                $serviceURL = HCU_array_key_value("mocservice", $parms);
                $tokenURL = HCU_array_key_value("moctoken", $parms);
            }
            if (empty($serviceURL) || empty($tokenURL)) {
                throw new Exception($HB_ENV['MC']->msg("Feature Not Set"));
                }

            $billpayid = $mbrow["billpayid"];

            // use member id if no billpay-specific id
            if (trim($billpayid) == '') {
                $billpayid = $accountToUse;
            }

            $key = substr(hash('SHA1', $bp_secret, TRUE), 0, 16);

            // ENCRYPTION
            if($use_openssl_encryption) {
                list($ipay_token, $billpayid) = encrypt_billpay_openssl($billpayid, $key);
            } else {
                list($ipay_token, $billpayid) = encrypt_billpay_mcrypt($billpayid, $key);
            }

            #$ipay_session = @file_get_contents("https://www.billpaysite.com/request.asp?instid=$bp_cuid&p1=$ipay_token&op=Session&format=Text");
            // get the session token
            $ipay_url = "$tokenURL?instid=$bp_cuid&p1=$ipay_token&op=Session&format=Text";

            $cmd = "/usr/bin/curl --silent  -H 'Content-Type: text/xml' '$ipay_url'";

            $ipay_session = getcurl($cmd);

            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = $ipay_token;                // the id used across all communications in session
                $logParms["txnId"] = time();               // the id for this transaction
                $logParms["logPoint"] = "IPAY get session";   // this action in a readable form
                $logParms["request"] = $cmd;               // the request
                $logParms["reply"] = $ipay_session;            // the response
                LogSSOActivity($logParms);
            }

            $ipay_session = trim(strip_tags($ipay_session));

            if ($ipay_session == '' || preg_match("/\D/", "$ipay_session")) {
                $error["title"] = "Connection to iPay Bill Pay service Failed";
                $error["content"] = "Please try again later or contact the credit union to report this error.<br>$ipay_session";
                throw new Exception(json_encode($error));
            } else {
                $stremail = ("{$HB_ENV["Ml"]}" == "" ? "" : "<input type='hidden' name='strEmail' value='{$HB_ENV["Ml"]}'>");

                if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();                     // the id for this transaction
                $logParms["logPoint"] = "IPAY Redirect";      // this action in a readable form
                $logParms["request"] = "<form method=\"post\" name=\"SSOform\" action = \"$serviceURL?instid=$bp_cuid\">
  <input type=\"hidden\" name=\"p1\" value=\"$ipay_session\">
  <input type=\"hidden\" name=\"op\" value=\"Login\">
  <input type=\"hidden\" name=\"Method\" value=\"Session\">
  $stremail
  </form>";                     // the request
                $logParms["reply"] = '';                   // the response
                LogSSOActivity($logParms);
            }

                print <<<EOF
  <html>
  <body onload = "javascript:document.SSOform.submit();">
  <form method="post" name="SSOform" action = "$serviceURL?instid=$bp_cuid">
  <input type="hidden" name="p1" value="$ipay_session">
  <input type="hidden" name="op" value="Login">
  <input type="hidden" name="Method" value="Session">
  $stremail
  </form>
  <div style='font-size: 28px; text-align:center; padding-left: 40px; padding-right: 40px; padding-top: 40px;'>
  Loading Data..... Please Wait
  </div>
  </body>
  </html>
EOF;
            }

            break;
        case "MDesk3":
            require_once('MDesk_API.i');
            require_once('hcuAuthShared.i');

            if (!hcu_checkService($dbh, "MDESK")) {
                $omsg = hcu_checkServiceMsg($dbh, "MDESK");
                throw new Exception("$omsg");
            }
            # previous check looks for all MDesk services down at server level
            # now look for MDesk service down for this particular client
            if (HCU_array_key_value('mxSvsDown',$parms)) {
                $omsg = (HCU_array_key_value('mxDownMsg',$parms) ? $parms['mxDownMsg'] : 'Service temporarily unavailable. Please try again later');
                throw new Exception("$omsg");
            }
            $dms_ok = array('mblsession' => 'digits');
            dms_import($dms_ok);

            # mdTokenKey used to hash Mx user key
            $mdtokenkey = HCU_array_key_value('mdTokenKey', $parms);

            if (empty($mdtokenkey)) {
                throw new Exception("Client misconfigured for remote Mx access", 912); # missing trusted detail parms (keys)
            }

            # default to production mode
            $testing = ( HCU_array_key_exists('testing', $parms) ? HCU_array_key_value('testing', $parms) : 0 );

            if ($testing) {
                # sharekey used by trusted vendor for hashing
                $mdkey = HCU_array_key_value('mdTestKey', $parms);
                $mdAPI_key = HCU_array_key_value('testAPIKey', $parms);
                $mdData_URL = HCU_array_key_value('testServerURL', $parms);
                $mdSso_URL = HCU_array_key_value('testSSOURL', $parms);
                $mdWidget_URL = HCU_array_key_value('testWidgetURL', $parms);
                $client_key_TTL = ( HCU_array_key_exists('mdTokenTTL', $parms) ? HCU_array_key_value('mdTokenTTL', $parms) : 86400 );
        } else {
                # sharekey used by trusted vendor for hashing
                $mdkey = HCU_array_key_value('mdShareKey', $parms);
                $mdAPI_key = HCU_array_key_value('APIKey', $parms);
                $mdData_URL = HCU_array_key_value('ServerURL', $parms);
                $mdSso_URL = HCU_array_key_value('SSOURL', $parms);
                $mdWidget_URL = HCU_array_key_value('WidgetURL', $parms);
                $client_key_TTL = ( HCU_array_key_exists('mdTokenTTL', $parms) ? HCU_array_key_value('mdTokenTTL', $parms) : 1800 );
            }

            if ( empty($mdkey) || empty($mdAPI_key) || empty($mdData_URL) || empty($mdSso_URL) || empty($mdWidget_URL) )   {
                throw new Exception("Client misconfigured for remote access", 903); # missing trusted detail parms (URL &/or API key)
            }

            $mdexpires = time() + $client_key_TTL;

            // build the timer token to be stored in Mx database
# $Uid has the Odyssey Uid;
# $Cn has the Odyssey user_name;
# $accountToUse has the selected speedbump account

//    $HB_ENV["SYSENV"]["logger"]->info( "HB_ENV: " . print_r(array_diff_key($HB_ENV,array('MC' => 'drop', 'FeatureAccessList' => 'drop', 'SYSENV' => 'drop')),true) );
    # HB_ENV is built without the pwchange date - so go get our own copy of it
//            $pw_ary = GetPWChange($dbh, $Cu, $HB_ENV['Cn']);
//            if (!HCU_array_key_value('rowfound', $pw_ary)) {
//                throw new Exception("Invalid Member retrieving PWChange");
//            }
            $userrec = GetUserbyName($dbh, $Cu, $Cn);
            if (! HCU_array_key_value('rowfound', $userrec)) {
                throw new Exception("Invalid User");
            }
            $mxtoken = MakeV94Dkey($Cu, $Cn, $userrec, $client_key_TTL, $mdtokenkey, 'S');
            $mxUpdated = mdesk_sync($mdData_URL, $mdAPI_key, $Cu, $Uid, $Cn, $Ml, $mxtoken, $parms);
            if (HCU_array_key_value('code', $mxUpdated) > 0 ) {
                $status = HCU_array_key_value('status', $mxUpdated);
                $code = HCU_array_key_value('code', $mxUpdated);
                throw new Exception("Error ({$status} {$code}). Unable to connect to MoneyDesktop.  Please contact the credit union");
            }

            # if mobile, get mobile_master_widget and set up w/ mobile-friendly
            # branding logo and div size

            # use 'platform' variable instead of mblsession as parameter, just for consistency
            $isapp = (integer) in_array(strtoupper(HCU_array_key_value('platform', $HB_ENV['HCUPOST'])), array('APP', 'ADA'));
            if ($isapp) {
                $widget = "mobile_master_widget";
            } else {
                $widget = "master_widget";
                $buttonText = $HB_ENV['MC']->msg("Return To Home Banking");
                $buttonClick = ($parms['hcuClose'] ? 'window.close();' : 'document.location="hcuAccounts.prg?cu=' . $Cu . '";');

                $mdbrand = "MDtoolbar_logo_md.png";
                if (is_readable("/home/$chome/public_html/$mdbrand")) {
                    $mdsrc = "/fi/$chome/$mdbrand";
                } else {
                    $mdsrc = "https://d1kryjpwpzirc7.cloudfront.net/homecu/images/MDtoolbar_logo_md.png";
                }
            }

    # get widget address from response
    $resparr = mdesk_getURL($mdSso_URL, $mdAPI_key, $Cu, $Uid, $widget, $parms);
    if (isset($resparr['error'])) {
        throw new Exception("Error ({$resparr['error']['message']}). Unable to retrieve URL for MoneyDesktop.  Please contact the credit union");
    }

# Configure menu so that mobile & app have $mblsession set, desktop does not
    if ($isapp) {
        $href = $resparr['url']['url'];
    } else {
        $login_url = $resparr['url']['url'];

        if (!$parms['hcuMenu']) {

            print <<<EOF
            <image src='$mdsrc' border=0>
            <button type='button' class='k-button' name='btnClose' onClick='$buttonClick'>{$buttonText}</button>
EOF;
        }
//        <div class='md-widget' style='margin: 0' data-width="850" data-height="650" data-url="{$login_url}">
                print <<<EOF
        <script type="text/javascript" src="{$mdWidget_URL}"></script>
        <div class='md-widget' style='margin: 0' data-url="{$login_url}">
        </div>
EOF;

    // so won't redirect
    $href = "";
    }
    break;

    case "VSOFT":

        # no clients on either VSOFT or VSHO as of June 2018
        # NOT UPGRADED FOR ODYSSEY YET
        #
        # If we get a client, this will take some work
        #
        # changes Sept '14 to re-activate VSOFT hybrid SSO
        //(calls 3rd party app, which must already be installed)
        // changes moved to new mobileConnect script instead
        // because hcuConnect calls upgrade code for speedbump, login timeout, etc
        // and that doesn't fit well in the mobile framework.  Easier to
        // call mobile code than to tweak upgrade code for this one thing
        // left VSOFT mobile code here because it is intertwined with VSHO
        // MH 9/11/14

        // In the queries that follow for VSHO, $Cn is used to select the account number.
        // $Cn is the username which is not always an account number so the queries will
        // fail. The queries must be updated to use the user_id ($Uid) value instead of $Cn.
        // MGHandy: 9/5/18.
        case "VSHO":
            if (!hcu_checkService($dbh, 'VSOFT')) {
                $omsg = hcu_checkServiceMsg($dbh, "VSOFT");
                throw new Exception("$omsg");
            }
            # VSoft mobile -- activates App
            $ua = strtolower($_SERVER['HTTP_USER_AGENT']);
            if (stripos($ua, 'android') === false && stripos($ua, 'iPhone') === false && stripos($ua, 'iPod') === false && stripos($ua, 'iPad') === false) {
                # not android and not iphone/ipod/ipad - no service
                throw new Exception("Feature Unavailable<BR>This feature is not supported on the device you are using");
            }
            # using cuusers.depositlimit to indicate Vsoft profile id
            $sql = "SELECT coalesce(depositlimit,0) FROM cuusers
                  WHERE cu ='$Cu' and user_name='$Cn'";
            $img_rs = db_query($sql, $dbh);

            list($pro) = db_fetch_row($img_rs, 0);
            if ($pro == 0) {
                $message = "Account not permitted for Remote Deposit.  Please contact the Credit Union for more information";
                throw new Exception($message);
            }

            $pro = sprintf("%d", intval($pro));

            # set defaults first, override by CU if needed
            $pilot = $parms["pilot"]; # pilot = 1 for test mode
//          $rtxn = $parms["rtxn"]; # deposit, loan pmt, credit card pmt
            $rtxn = ( sizeof($parms['rtxn']) == 0 ?
                    array('AT' => 1, 'LP' => 1, 'CP' => 1) :
                    json_decode($parms['rtxn'], TRUE) );
            $balwhere = $parms["balwhere"];
            $lnwhere = $parms["lnwhere"];
            $vs_id = $parms["vs_id"];
            $callbackurl = $parms["callbackurl"];  // for VSOFT
            $vsoftapp = $parms["vsoftapp"];
            $vsoftkey = $parms["vsoftkey"];
            /*
              switch ($Cu) {
              case "ACCLAIM":
              $rtxn=array("AT"=>1); # list of remote dep tran codes cu supports
              # use balwhere and lnwhere to adjust sql selection / limit chosen accts
              # ACCLAIM get open checking accounts only
              $balwhere=" and deposittype='Y' ";
              $lnwhere="";
              # institution ID provided by Vsoft
              $vs_id='142';
              $callbackurl='http://www.acclaimfcu.org/';
              #$tmode="test";
              break;
              }
             */
# fetch transactions types

            $sql = "select ht.trancode, trim(t.trandesc),trim(ht.cudesc),t.specialproc
                    from cutrans t, cuhavetrans ht where ht.cu='$Cu'
                    and ht.trancode = t.trancode\n";

            $sth = db_query($sql, $dbh);

            $txncodes = array();
            for ($row = 0; list($code, $desc, $cudesc, $spec) = db_fetch_array($sth, $row); $row++) {
                $txncodes{$code} = array($desc, $spec, $cudesc);
            }
            db_free_result($sth);

            $sql = "";
            $verb = "";

            # find out how many valid accounts the member has:

            if ($txncodes{"AT"} && $rtxn{"AT"}) {
                # $txncodes is configured list @HomeCU - $rtxn is allowed list for remote vendor
                $sql = "SELECT description, trim(accounttype),
                    case when upper(deposittype)='N' then '3'
                    when upper(deposittype)='Y' then '1' end as rdctype,
                    trim(micraccount) as micraccount
                    FROM {$Cu}accountbalance
                    WHERE accountnumber = '$Cn' $balwhere ";

                $verb = " UNION ";
            }
            # VSOFT only allows rdc to DDA, GL, SAVINGS, or MONEY MARKET - probably not loans
            # but left this older code in just in case service upgrades in the future MH 9/5/14
            if ($txncodes{"LP"} && $rtxn{"LP"}) {

                $sql .= "$verb
                    SELECT description, trim(loannumber), '2', null
                    FROM {$Cu}loanbalance
                    WHERE accountnumber = '$Cn'
                    AND currentbalance >0 $lnwhere ";
                if (($Fset2 & $CU2_SPEC18) == $CU2_SPEC18) {
                    $sql .= " and (type <> '18' or type is null) ";
                    if ($rtxn{"CP"}) {
                        $sql .= "UNION
                    SELECT description, trim(loannumber), '2', null
                    FROM {$Cu}loanbalance
                    WHERE accountnumber = '$Cn'
                    AND type = '18' $lnwhere ";
                        if (($Fset2 & $CU2_CC18SHOWZERO) != $CU2_CC18SHOWZERO) {
                            $sql .= " and currentbalance > 0 ";
                        }
                    }
                }
            }

            $acct_rs = db_query($sql, $dbh);

            if (db_num_rows($acct_rs) == 0) {
                #print_r($rtxn);
                throw new Exception("No valid accounts found");
            }

            #
            # if more than one checking account found, let member select account
            # (even though VSHO would accept list, Joe says make 'em pick so it is
            # consistent w/ the VSOFT (mobile) SSO)
            # format $vsoft location string based on query results & fire off the vsoft app
            #
          # InstID will be assigned by vsoft
            # ProfileId is $pro (cuusers.depositlimit formatted integer)
            # AccountNumber is micraccount
            # UserId is $Cn
            # Email is $Ml
            # AccountType is 1 (DDA)
            # Description is accountbalance.description trimmed to 50 char & urlencoded
            # using rawurlencode instead of urlencode so that space becomes %20, not +

            $dms_ok = array('selacct' => 'string');
            dms_import_v2($HB_ENV, "HCUPOST", $dms_ok);
            $selacct = $HB_ENV["HCUPOST"]["selacct"];

            #
            $option = $HB_ENV["HCUPOST"]["option"];

            if ($option == "") {
                $err_msg = "";

                if (db_num_rows($acct_rs) > 1) {
                    $descTtl = "Select an account for remote deposit";
                    $pageTtl = "Online Remote Deposit";

                    // set up the list of account choices
                    $arySelectList = array();
                    for ($row = 0; list($desc, $atype, $rdctype, $micr) = db_fetch_array($acct_rs, $row); $row++) {
                        $displaydesc = rawurlencode(substr($desc, 0, 50) . " - $atype");
                        $udesc = rawurlencode(substr($desc, 0, 50));
                        $tokn = sha1("{$mode}{$Cn}{$atype}{$Cu}{$rdctype}{$micr}{$udesc}obl1vi0u5");
                        $value = "$rdctype|$atype|$micr|$udesc|$tokn";

                        $arySelectList[] = array("get_value" => $value,
                            "display" => rawurldecode($displaydesc));
                    }

                    $selectAccountString = "";
                    $count = count($arySelectList);
                    if ($count > 0) {
                        $idx = 1;
                        $checked = $count == 1 ? "checked" : "";
                        foreach ($arySelectList as $acct_key => $acct_array) {
                            $selectAccountString .="<input type='radio' name='selacct' id='response{$idx}' {$checked} value='{$acct_array['get_value']}'/><label style='padding: 10px;' for='response{$idx}'>{$acct_array['display']}</label><br>";
                            $idx++;
                        }
                    }

                    $cancelButton = "<button type='button' class='k-button' name='btnCancel' onClick='window.close();'>{$HB_ENV['MC']->msg("Cancel")}</button>";
                    $continueButtonText = $HB_ENV['MC']->msg("Continue");
                    // if the button needs to trigger a check of the radio buttons to make sure one selected, it must call CkRadio()
                    $continueButton = "<button type='button' class='k-button' name='btnContinue' onClick='javascript:CkRadio();return false;'>$continueButtonText</button>";
                    $buttons = "{$cancelButton} &nbsp; &nbsp; {$continueButton}";

                    // set up the string substitution
                    $acceptance = ""; // not needed for this form

                    $noticeSubstitution = array(
                      "#page_title#" => $pageTtl,
                      "#description#" => $descTtl,
                      "#content#" => $selectAccountString,
                      "#acceptance#" => $acceptance,
                      "#buttons#" => $buttons
                    );

                    // get any notice text
                    $HB_ENV["noticeStrReplace"] = $noticeSubstitution;
                    $noticeInfo = Get_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC'], 'D', 'ConnectSpeedbump');

                    // make sure we got the notice
                    if ($noticeInfo["status"]["code"] != "000" ||
                        !count($noticeInfo["notice"]) ||
                        strlen($noticeInfo["notice"][0]["notice_text"]) == 0) {
                        throw new Exception("Configuration Error: Custom Content (ConnectSpeedbump)");
                    }

                    $noticeText = $noticeInfo['notice'][0]['notice_text'];

                    $inputList = array(array("name" => "mode", "value" => "$mode"),
                        array("name" => "option", "value" => "DEPOSIT")
                    );
                    $checkMsg = "Please choose an account before continuing.";
                    $radioGroupName = "selacct";
                    ShowUserNotice($noticeText, $inputList, $radioGroupName, $checkMsg);

                    break;  # if more than one account stop after printing screen.
                    # if only one, allow to fall through for DEPOSIT option
                } else {
                    list($desc, $atype, $rdctype, $micr) = db_fetch_row($acct_rs, 0);
                    $udesc = rawurlencode(substr($desc, 0, 50));
                    $tokn = sha1("{$mode}{$Cn}{$atype}{$Cu}{$rdctype}{$micr}{$udesc}obl1vi0u5");
                    $selacct = "$rdctype|$atype|$micr|$udesc|$tokn";
                    $option = "DEPOSIT";
                }
            }

            if ($option == "DEPOSIT") {
                list($rdctype, $atype, $micr, $udesc, $tokn) = explode("|", $selacct);
                if ($selacct == "" ||
                    $tokn <> sha1("{$mode}{$Cn}{$atype}{$Cu}{$rdctype}{$micr}{$udesc}obl1vi0u5")) {
                    throw new Exception("Invalid Account Selected");
                }


                if ($mode == 'VSOFT') {
                    $ua = strtolower($_SERVER['HTTP_USER_AGENT']);
                    if (stripos($ua, 'iPhone') !== false || stripos($ua, 'iPod') !== false || stripos($ua, 'iPad') !== false || stripos($ua, 'android') !== false) {

                        $vsoftqry = "userid=$Cn&instid=$vs_id&profileid=$pro&accountdesc=";
                        $vsoftqry .= rawurldecode($udesc);
                        $vsoftqry .= "&accounttype=$rdctype";
                        $vsoftqry .= (trim($Ml) == '' ? "" : "&email=" . trim($Ml));
                        $vsoftqry .= "&accountnumber=" . ("$micr" == "" ? $Cn : $micr);
                        $vsoftqry .= ("$callbackurl" == "" ? "" : "&callbackurl=$callbackurl");

                        $vsoftkey = $parms["vsoftkey"];

                        // ENCRYPTION
                        if($use_openssl_encryption) {
                            list($vsoftenc, $vsoftqry) = encrypt_vsoftquery_openssl($vsoftqry, $vsoftkey);
                        } else {
                            list($vsoftenc, $vsoftqry) = encrypt_vsoftquery_mcrypt($vsoftqry, $vsoftkey);
                        }

                    } else {
                        # not android and not iphone/ipod/ipad - no service
                        # checked above so should never get here, but just in case....
                        throw new Exception("This feature is not supported on the device you are using");
                    }

                    #   print "header('Location: $vsoft');";
                    print <<<EOF
  <div style='font-size: 28px; text-align:center; padding-left: 40px; padding-right: 40px; padding-top: 40px;'>
  Please wait  - Calling App"
  </div>
        <script>
        {
        location.replace("{$vsoftapp}?$vsoftenc");
        }
        </script>
EOF;

                    exit;
                }

                if ($mode == 'VSHO') {
                    /*
                     * NOTE: VSHO has not been tested yet. This code was ported from RemoteDep where it wasn't tested there either.
                     */
                    # this option not tested yet 10/4/2012
                    # figure out how to build hash
                    # per Jim Bray 12/4/12 No Hash
                    #$hash='';
                    # build $parms array containing info for XML
                    #$VSHOhost="demo1.vsoftcorp.com";
                    $parms['InstId'] = $vs_id;
                    $parms['UserId'] = $Cn;
                    $parms['ProfileId'] = $pro;
                    $parms['UserName'] = '';
                    $parms['email'] = trim($Ml);
                    $parms['AccountNumber'] = ("$micr" == "" ? $Cn : $micr);
                    $parms['AccountType'] = $rdctype;
                    $parms['AccountDesc'] = $udesc;
                    $parms['AccountStatus'] = '';
                    #$parms['Hash']=$hash;
                    # format XML for Soap call, post SOAP and get response
                    $vsho = VSHO_XML($parms, $VSHOhost);
                    if (empty($vsho['sessionId'])) {
                        $msg = "Could not open Remote Deposit Service ";
                        if (!empty($vsho['errorMessage'])) {
                            $msg .= "(error: {$vsho['errorMessage']})";
                        }
                        NoService($msg);
                    } else {
                        # redirect to VSHO URL
                        # value from documentation
                        #$vshourl="https://{$VSHOhost}/HomeOffice/HomeOffice.aspx?SessionId="
                        # value from Jim Bray 12/4/12
                        $vshourl = "https://scbctest.creditunionimages.com/homeoffice/HomeOfficeService.asmx?SessionId=";
                        $vshourl .= urlencode($vsho['sessionId']);
                        print <<<EOF
  <div style='font-size: 28px; text-align:center; padding-left: 40px; padding-right: 40px; padding-top: 40px;'>
  Please wait  - contacting Remote Deposit Service
  </div>
        <script>
        {
        location.replace("$vshourl");
        }
        </script>
EOF;
                        exit;
                    }
                }
            }

            // so won't redirect
            $href = "";
            break;
        case "Digital":
            /*
             * Updated specs 3/27/2014.  Appears encryption/decryption works, no accounts to test
             * with until Electel gets up and running a little.
             * Code added 3/18/14 based on specs provided June 2013.
             * crypted value matches example exactly using test values, but remote side still
             * responds 'SSO: The parameter string is incorrect or could not be decrypted'.  Might just be
             * that test value for date is very old, but even with current date gets error.
             * Not sure why, but waiting for new client to sign contract before contacting vendor to debug
             *
             * 3/18/14 MH
             *
             */
            if (!hcu_checkService($dbh, "Digital")) {
                $omsg = hcu_checkServiceMsg($dbh, "Digital");
                throw new Exception("$omsg");
                exit;
            }
            $pilot = HCU_array_key_value('pilot',$parms);
            if ($pilot == 1) {
                $serviceurl = HCU_array_key_value('piloturl',$parms);
                $servicepass = HCU_array_key_value('pilotpass',$parms);
                $servicekey = HCU_array_key_value('pilotkey',$parms);
            } else {
                $serviceurl = HCU_array_key_value('produrl',$parms);
                $servicepass = HCU_array_key_value('prodpass',$parms);
                $servicekey = HCU_array_key_value('prodkey',$parms);
            }
            $CustID = HCU_array_key_value('CustID',$parms);
            $ACCOUNT = $accountToUse;
            if (empty($serviceurl) || empty($servicepass) || empty($servicekey) ||
                    empty($CustID) || empty($ACCOUNT)) {
                throw new Exception("Missing Parameters");
            }
            $currdate = gmdate('YmdHi'); # using GMT
            $GMT = 1; # notify digital that we are using GMT


            $srcstring = "ACCOUNT={$ACCOUNT}&TIMESTAMP={$currdate}&CID={$CustID}&PASS={$servicepass}&GMT={$GMT}";

            // ENCRYPTION
            if($use_openssl_encryption) {
                list($dm_token, $srcstring) = encrypt_digital_openssl($srcstring, $servicekey);
            } else {
                list($dm_token, $srcstring) = encrypt_digital_mcrypt($srcstring, $servicekey);
            }

            $DATA = "";
            for ($i = 0; $i < strlen($dm_token); $i++) {
                $DATA .= substr('00' . dechex(ord(substr($dm_token, $i, 1))), -2);
            }
            $DATA = strtoupper($DATA);

            $href = "{$serviceurl}?C=$CustID&DATA=$DATA";

            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();               // the id for this transaction
                $logParms["logPoint"] = "Digital ES SSO";   // this action in a readable form
                $logParms["request"] = $href;               // the request
                $logParms["reply"] = '';            // the response
                LogSSOActivity($logParms);
            }

            break;
        case "BDI":
            /*
             * E-Statement SSO for Prospectors FCU
             * 12/20/16 MH
             *
             */
            if (!hcu_checkService($dbh, "BDI")) {
                $omsg = hcu_checkServiceMsg($dbh, "BDI");
                throw new Exception("$omsg");
                exit;
            }
            $pilot = HCU_array_key_value('pilot',$parms);
            if ($pilot == 1) {
                $serviceurl = HCU_array_key_value('pilotURL',$parms);
                $servicekey = HCU_array_key_value('pilotKEY',$parms);
            } else {
                $serviceurl = HCU_array_key_value('prodURL',$parms);
                $servicekey = HCU_array_key_value('prodKEY',$parms);
            }
            $VendorID = HCU_array_key_value('VendorID', $parms);
            $serviceurl = str_replace("#FIID#",$parms['FIID'],$serviceurl);
            $servicekey = base64_decode($servicekey);

            # use a random IV instead?
            $method = 'AES-256-CBC';
            $ivlen = openssl_cipher_iv_length($method);
            $IV = openssl_random_pseudo_bytes ( $ivlen );
//            $IV = base64_decode($parms['IV']);
            $Member = $accountToUse;
            $tStamp = gmdate('U');

            # test values
//          $servicekey=base64_decode("hsZoZqQGt3wpdgqJKkRaluZ3FG+2IDZYTSx0eVctJ0c=");
//          $IV = base64_decode('3P2XNcPLMMw9l+KkbAKX3g==');
//          $Member="0000012345";
//          $tStamp = '1482201149';
//  $serviceurl = 'https://estmt.businessdatainc.com/ProspectorsFCU/SSOLogonRequest.do?VID=HomeCU&Number=0000012345&Name=&Emails=test+user@yahoo.com&T=1482201149&IV=3P2XNcPLMMw9l+KkbAKX3g==&SKEY=ppQCy5HCuBb77u//iw6B8AQTpmm7AGtMTZH9xz6qm0s='
//  $serviceurl = "https://estmt.businessdatainc.com/{$FIID}/SSOLogonRequest.do?VID=$VendorID";
//  $servicepass='R$ax&He0'; # didn't need this - only used to secure the zip file containing credentials
//  $servicekey="hsZoZqQGt3wpdgqJKkRaluZ3FG+2IDZYTSx0eVctJ0c=";

            $srcstring = "{$Member}{$tStamp}";
//            $srcstring = "00000123451482201149";

    $method = 'AES-256-CBC';
    # openssl appears to do it's own padding
//    $ivlen = openssl_cipher_iv_length($method);
//    $pad = $ivlen - (strlen($srcstring) % $ivlen);
//    $srcssl = ($srcstring . str_repeat(chr($pad),$pad));
# if manually paddding, use OPENSSL_ZERO_PADDING flag on encrypt,
# otherwise adds another full block of pad characters

    $SKEY = (openssl_encrypt($srcstring,$method,$servicekey,0,$IV));

//    $emsg='';
//    while ($msg = openssl_error_string())
//        $emsg .=  $msg . "<br />\n";

            $href = "{$serviceurl}?VID={$VendorID}&Number={$Member}&Emails=";
            $href .= urlencode($Ml);
            $href .= "&T={$tStamp}&IV=";
            $href .= urlencode(base64_encode($IV));
            $href .= "&SKEY=";
            $href .= urlencode($SKEY);

//            if ($emsg != '') {
//                $showurl = 1;
//                $href .= "<br>$emsg";
//            }

            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();               // the id for this transaction
                $logParms["logPoint"] = "BDI SSO";   // this action in a readable form
                $logParms["request"] = $href;               // the request
                while ($msg = openssl_error_string())
                    $logParms["request"] .=  "<br />\n$msg";
                $logParms["reply"] = '';            // the response
                LogSSOActivity($logParms);
            }

            break;


        case "DELUXE_OP":
            if (!hcu_checkService($dbh, "Deluxe")) {
                $omsg = hcu_checkServiceMsg($dbh, "Deluxe");
                throw new Exception("$omsg");
            }

            if ($HB_ENV["HCUPOST"]["option"] == 'SELECTACCT') {
                $dms_ok = Array("sendmicr" => "string");

                dms_import_v2($HB_ENV, "HCUPOST", $dms_ok);

                if (!sizeof($HB_ENV["HCUPOST"]["sendmicr"])) {
                    throw new Exception("No Account Selected");
                }
                #
                list($rt, $micr, $tokn, $rtype) = explode("|", $HB_ENV['HCUPOST']['sendmicr']);
                if ("{$HB_ENV['HCUPOST']['sendmicr']}" == "" ||
                    $tokn <> sha1("${mode}${Cn}${rt}${micr}${Cu}obl1vi0u5")) {
                    throw new Exception("Invalid Account Selected");
                }

                $pilot = $parms['pilot'];
                $HCUserv = urlencode($parms['HCUserv']);
                $HCUpass = urlencode($parms['HCUpass']);
                $certfile = $parms['certfile'];
                $passwd = $parms['passwd'];
                if ($pilot) {
                    $server = $parms['pilotserver'];
                } else {
                    $server = $parms['prodserver'];
                }
                if ("$passwd" == "") {
                    throw new Exception($HB_ENV['MC']->msg('Feature Not Set'));
                    exit;
                }
                if (empty($HCUserv) || empty($passwd) || empty($certfile) || !(is_readable($certfile)) || empty($server)) {
                    throw new Exception("Missing Parameters");
                }

                list($gyr, $gmo, $gda, $ghr, $gmin) = explode(",", gmdate("Y,n,j,G,i"));
                $gyr = $gyr - 1900;
                $gmo = $gmo - 1;
                $gmin = intval($gmin);

                switch ($Cu) {
                    case "TEST":
                        $pgmname = "";
                        break;

                    case "TCCU":
                        # TCCU passes BILLING_CODE 'U' and PROFILE_NUMBER '00002'for suffix 84
                        # update to OrderPoint - send <ProgramName>UNLIMITED CHECKING</ProgramName> for suffix 84
                        if ($rtype == '84') {
                            $pgmname = "UNLIMITED CHECKING";
                        } else {
                            $pgmname = "";
                        }
                        break;
                    default:
                        $pgmname = "";
                        break;
                }
                $xml = '<?xml version="1.0" encoding="UTF-8"?><Deluxe Version="7.0">';
                $xml .= "<DeluxePort><ChkOrdAddRq><RqUID>$HCUserv</RqUID><ChkOrdInfo><DepAcctId><AcctId>$micr</AcctId><AcctType>DDA</AcctType>";
                $xml .= "<BankInfo><BankIdType>ABA</BankIdType><BankId>$rt</BankId></BankInfo><Program><ProgramName>$pgmname</ProgramName></Program>";
                $xml .= "</DepAcctId></ChkOrdInfo></ChkOrdAddRq></DeluxePort></Deluxe>";

                /*
                 * Deluxe Orderpoint is not really expecting xml data as xml, they are expecting
                 * a form variable NAMED xml_data containing url-encoded xml string.
                 * Deluxe returns a web page, we use curl to capture the headers, then strip out
                 * a url and token from the location redirect, and also the LTPAToken from a set-cookie.
                 */
                $cmd = "/usr/bin/curl -i --silent --data 'xml_data=$xml' --data 'app=orderpoint' -E $certfile:$passwd '$server'";

#print "<pre>$cmd</pre>";exit;
                $fd = popen("$cmd", "r");
                if ($fd) {
                    do {
                        $data = @fread($fd, 8192);
                        if (strlen($data) == 0) {
                            break;
                        }
                        $response .= $data;
                    } while (true);

                    pclose($fd);

                    if ($parms["logging"] == "enabled") {
                        $logParms = $parms["environment"];      // get the environment info passed in
                        $logParms["token"] = '';                // the id used across all communications in session
                        $logParms["txnId"] = time();               // the id for this transaction
                        $logParms["logPoint"] = "DELUXE_OP SSO";   // this action in a readable form
                        $logParms["request"] = $cmd;               // the request
                        $logParms["reply"] = $response;            // the response
                        LogSSOActivity($logParms);
                    }

                    /*
                     * Deluxe no longer returns an error.  You just get a redirect page whether everything worked... or not.
                     * left the code in just in case they fix that some day
                     */

                    if (!("$response" > '') || strtoupper(trim($response)) == "ERROR") {
                        throw new Exception("Deluxe Connection Failed ($response)");
                    } else {
                        $dHEAD = preg_split('/\r\n|\n|\r/', $response, NULL, PREG_SPLIT_NO_EMPTY);
                        foreach ($dHEAD as $fparm) {
                            if (substr(strtoupper($fparm), 0, 9) == 'LOCATION:')
                                $dLOC = substr($fparm, 10);

                            if (substr(strtoupper($fparm), 0, 21) == 'SET-COOKIE: LTPATOKEN') {
                                $dLtpa = substr($fparm, 22);
                                $dLtpa = substr($dLtpa, 0, strpos($dLtpa, ';'));
                            }
                        }
                        list($dURL, $dTOKEN) = explode("?", $dLOC, 2);
                        $dPARMS = explode("&", rtrim($dTOKEN));
                        $formopts = "";
                        foreach ($dPARMS as $ptokn) {
                            list($dNAME, $dVAL) = explode("=", $ptokn, 2);
                            $formopts .= "<input type='hidden' name='$dNAME' value='$dVAL'>\n";
                        }
                        $formopts .= "<input type='hidden' name='LtpaToken' value='$dLtpa'>\n";
                        $response = rtrim($response);
                        print <<<EOF
<html>
<head>
<title>
Internet Check Ordering
</title>
<script language="JavaScript">
function submitToDeluxe()
{
document.redirectionForm.action="$dURL";
document.redirectionForm.submit();
}
</script>
</head>
<body onLoad="submitToDeluxe()">
<form name="redirectionForm" method="POST">
$formopts
</form>
</body>
</html>
EOF;
                    }
                } else {
# something went wrong -- couldn't open pipe to DELUXE
                    throw new Exception("Deluxe Connection Failed");
                }
            } else {

                # get the list of valid checking accounts

                $acctlist = array();

                if (empty($mbrow['rt']) || preg_match("/\D/", $mbrow['rt'])) {
                    throw new Exception('Missing parameters');
                }


# find out how many valid primary checking accounts the member has:
                $sql = "
                  SELECT
                    ab.description,
                    TRIM(ab.accountnumber),
                    TRIM(ab.accounttype),
                    TRIM(ab.micraccount),
                    ab.certnumber,
                    TRIM(ua.display_name)
                  FROM ${Cu}accountbalance ab
                  LEFT JOIN ${Cu}useraccounts ua
                    ON ab.accountnumber = ua.accountnumber
                    AND ab.accounttype = ua.accounttype
                    AND ab.certnumber = ua.certnumber
                  WHERE ua.user_id = $Uid
                    AND UPPER(ab.deposittype) = 'Y'
                    AND ab.accounttype not like '%@%' ";
                if (isset($parms['sqlwhere'])) {
                    $sql .= " {$parms['sqlwhere']} ";
                }

                $acct_rs = db_query($sql, $dbh);

                if (db_num_rows($acct_rs) > 0) {
                    $rt = $mbrow['rt'];
                    # now see if there is an override micr for each account, but only if for the current $rt
                    # (no check orders for outdated rt)
                    # checked the table 9/24/15 no null or empty rt so this should work
                    for ($row = 0; list($desc, $anumber, $atype, $ab_micr, $cert, $disp) = db_fetch_array($acct_rs, $row); $row++) {
                        $om_sql = "
                          SELECT TRIM(rt), TRIM(micraccount)
                          FROM cuovermicr
                          WHERE cu='$Cu'
                            AND accountnumber='$anumber'
                            AND accounttype='$atype'
                            AND rt = '$rt'
                          ORDER BY startcheck DESC LIMIT 1;";

                        $om_rs = db_query($om_sql, $dbh);
                        if (db_num_rows($om_rs) == 1) {
                            list($om_rt, $om_micr) = db_fetch_array($om_rs, 0);
                            if (isset($parms['micrsize']) && $parms['micrsize'] > 0) {
                                $micr = substr(str_repeat('0', $parms['micrsize']) . $om_micr, (-1 * $parms['micrsize']), $parms['micrsize']);
                            } else {
                                $micr = $om_micr;
                            }
                        } else {
                            if (trim($ab_micr) != '') {
                                if (isset($parms['micrsize']) && $parms['micrsize'] > 0) {
                                    $micr = substr(str_repeat('0', $parms['micrsize']) . $ab_micr, (-1 * $parms['micrsize']), $parms['micrsize']);
                                } else {
                                    $micr = $ab_micr;
                                }
                            }
                        }

                        if (trim($micr) != '') {
                            $tokn = sha1("${mode}${Cn}${rt}${micr}${Cu}obl1vi0u5");
                            $acctlistDesc = getAccountDescription($dbh, $HB_ENV['Cu'], $anumber, $desc, $atype, $disp, $HB_ENV['Fset3'], $cert);

                            // On Mammoth, the users were not allowed to have multiple account access
                            // preventing some accounts from being shown because the $acctlist key was
                            // only the account type. When multiple sub-accounts had the same account type
                            // the data from  the previous account would be over written.

                            // We use the account number and account type now to make the acctlist key more
                            // unique to avoid overwritten data.
                            $acctlistKey = "$anumber|$atype|$cert";
                            $acctlist[$acctlistKey]['display'] = $acctlistDesc . ": {$rt} {$micr}";
                            $acctlist[$acctlistKey]['getvalue'] = "$rt|$micr|$tokn|$atype";
                        }
                    }
                }
                if (!sizeof($acctlist)) {
                    throw new Exception("No valid checking accounts found");
                }
                $descTtl = '<div style="text-align: center;" class="k-header">Verify the routing numbers on the bottom of your check match the information shown for your account.</div>
<div style="text-align: center;"><span style="text-decoration: underline;">If the information does not match please contact the Credit Union to order checks.</span></div>';
                $pageTtl = "Please select an account to Order Checks";

                // set up the list of account choices
                $selectAccountString = "";
                $count = count($acctlist);
                if ($count > 0) {
                    $idx = 1;
                    $checked = $count == 1 ? "checked" : "";
                    foreach ($acctlist as $acct_key => $acct_array) {
                        $selectAccountString .="<input type='radio' name='sendmicr' id='response{$idx}' {$checked} value='{$acct_array['getvalue']}'/><label style='padding: 10px;' for='response{$idx}'>{$acct_array['display']}</label><br>";
                        $idx++;
                    }
                }

                $selectAccountString .= '
                  <p style="margin: 10px 0px 10px 0px; text-align: left;"></p>
                  <p style="margin: 10px 0px 10px 0px; text-align: left; display: inline-block;">See example below for help finding the routing information on your check.<br />
                  <br /><img src="https://d1kryjpwpzirc7.cloudfront.net/homecu/images/odyssey/micr.gif" border="0" /></p>';

                $cancelButton = "<button type='button' class='k-button' name='btnCancel' onClick='window.close();'>{$HB_ENV['MC']->msg("Cancel")}</button>";
                $continueButtonText = "Continue";
                // if the button needs to trigger a check of the radio buttons to make sure one selected, it must call CkRadio()
                $continueButton = "<button type='button' class='k-button' name='btnContinue' onClick='javascript:CkRadio();return false;'>$continueButtonText</button>";
                $buttons = "{$cancelButton} &nbsp; &nbsp; {$continueButton}";

                // set up the string substitution
                $acceptance = ""; // not needed for this form

                $noticeSubstitution = array(
                  "#page_title#" => $pageTtl,
                  "#description#" => $descTtl,
                  "#content#" => $selectAccountString,
                  "#acceptance#" => $acceptance,
                  "#buttons#" => $buttons
                );

                /*
                 * present a list of eligible checking accounts and descriptions
                 * render as radio (select one only).
                 */
                // get any notice text
                $HB_ENV["noticeStrReplace"] = $noticeSubstitution;
                $noticeInfo = Get_NoticeInfo($dbh, $HB_ENV, $HB_ENV['MC'], 'D', 'ConnectSpeedbump');

                // make sure we got the notice
                if ($noticeInfo["status"]["code"] != "000" ||
                    !count($noticeInfo["notice"]) ||
                    strlen($noticeInfo["notice"][0]["notice_text"]) == 0) {
                    throw new Exception("Configuration Error: Custom Content (ConnectSpeedbump)");
                }

                $noticeText = $noticeInfo['notice'][0]['notice_text'];

                $inputList = array(array("name" => "mode", "value" => "$mode"),
                    array("name" => "option", "value" => "SELECTACCT")
                );
                $checkMsg = "Please choose the checking account to use.";
                $radioGroupName = "sendmicr";
                ShowUserNotice($noticeText, $inputList, $radioGroupName, $checkMsg);
            }
            break;
        case "ThinkDigital":
            if (!hcu_checkService($dbh, "ThinkDigital")) {
                $omsg = hcu_checkServiceMsg($dbh, "ThinkDigital");
                throw new Exception("$omsg");
            }
            $test = HCU_array_key_value('test', $parms);
            if ($test == 0) {
                $serviceInst = HCU_array_key_value("TestInstID", $parms);
                $serviceKey = HCU_array_key_value("TestKey", $parms);
                $serviceUrl = HCU_array_key_value("TestURL", $parms);
            } else {
                $serviceInst = HCU_array_key_value("ProdInstID", $parms);
                $serviceKey = HCU_array_key_value("ProdKey", $parms);
                $serviceUrl = HCU_array_key_value("ProdURL", $parms);
            }
            $serviceReqid = HCU_array_key_value("ReqID", $parms);

            if (empty($serviceInst) || empty($serviceKey) || empty($serviceUrl) ||
                    empty($serviceReqid) ) {
                throw new Exception("Missing Settings");
            }
//          # for testing use 3376
//          $Cn = '3376';
# key is plain string, not hex
//          $key = "";
//          for ($i = 0; $i < strlen($serviceKey); $i+=2) {
//              $key .= chr(hexdec(substr($serviceKey, $i, 2)));
//          }

            $date = gmdate("Ymd");
            $ustr = $serviceInst . $accountToUse . $serviceReqid . $date;
            $mac = hash_hmac('MD5', $ustr, $serviceKey);

            $href = "$serviceUrl?InstID=$serviceInst&ReqID=$serviceReqid&Account=$accountToUse&MAC=$mac";

            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();               // the id for this transaction
                $logParms["logPoint"] = "ThinkDigital SSO";   // this action in a readable form
                $logParms["request"] = $href;               // the request
                $logParms["reply"] = '';            // the response
                LogSSOActivity($logParms);
            }

            break;

        case "hcuLoanApp":
          /**
           * 9/6/2018
           * Expanding hcuLoanApp to work for both desktop and mobile apps
           * Desktop **
           *   This will use the speed bump code to select an account prior to
           *   redirecting to the eforms/AppMain.prg
           *   The cookie is already created for this instance.
           *
           * Mobile App **
           *   This method does not have a banking cookie in the local browser,
           *   but it should already have the account selected.  In order for the
           *   SSO handshake with the loan system we will need to first create
           *   a cookie to the browser then redirect to the URL
           */
            #
            # not updated yet
            # need Odyssey method for stale & expires
            # look for Odyssey method of building cookie
            #
            /*
             *  NOTE at the top of Mammoth hcuConnect this block of code is used
             * to do a different type of credential check.  This or something similar
             * will be needed on Odyssey as well.  Be sure to address that, and
             * the Validate_Userkey function when updating the hcuLoanApp block
             *
             *
                } else if ($_REQUEST['mode'] == 'hcuLoanApp') {
                  $serviceSkipCredentials = true;
                  $serviceSkipSecurity = true;
                  if (!empty($_REQUEST['USERKEY']) && !empty($_REQUEST['cu'])) {
                    $tokenOK = Validate_Userkey($_REQUEST['cu'], $_REQUEST['USERKEY']);
                    if (!$tokenOK['status']['response']) {
                      throw new Exception('Unauthorized Access ' . $tokenOK['status']['message']);
                    } else {
                      $serviceSkipCredentials = true;
                      $serviceSkipSecurity = true;

                      $HB_ENV['cu'] = $_REQUEST['cu'];
                      $MEMBER = $tokenOK['status']['member'];
                      $CAUTH = $tokenOK['status']['cauth'];
                    }
                  }
*/
          if (!hcu_checkService($dbh, "hcuLoanApp")) {
            $omsg = hcu_checkServiceMsg($dbh, "hcuLoanApp");
            throw new Exception("$omsg");
            exit;
          }

          /**
           * ** CREATE BANKING COOKIE **
           * ** MOBILE APP ONLY
           */
          if (false && "MOBILE APP ONLY") {
            // we need to build a cookie for the loan app to authenticate with
            $now = time();
            $stale = $now + $GLOBALS['staleafter'];
            $expires = $now + $GLOBALS['TicketExpires'];

            $mycookie = "Ctime=$now&Cu=${HB_ENV['Cu']}&Cn=${HB_ENV['Cn']}&Ce=$expires&Cauth=${CAUTH}&Ffchg=${HB_ENV['Ffchg']}&Ffremain=${HB_ENV['Ffremain']}&Fset=${HB_ENV['Fset']}&Fset2=${HB_ENV['Fset2']}&Fset3=${HB_ENV['Fset3']}&Fhdays=${HB_ENV['Fhdays']}&Flite=0&Clw=${HB_ENV['Clw']}&Clu=${HB_ENV['Clu']}&Fplog=${HB_ENV['Fplog']}&Fflog=${HB_ENV['Fflog']}&Fmsg_tx=${HB_ENV['Fmsg_tx']}&Ml=${HB_ENV['Ml']}&Flang=$Flang&Ffreset=${HB_ENV['Ffreset']}";

            SetTicket("", $mycookie);
          }
          /**
           *  ** REDIRECT TO LOAN SYSTEM **
           */

          /** * CREATE SELECTED ACCOUNT HASH * **/
          $encryptedAccount = hcu_encrypturl( $accountToUse, $HB_ENV['historyHash'] );

          /** * CREATE URL * **/
          // get the url
          $serviceurl = $parms['URL'];

          // get the app id
          $appID = urlencode($parms['lnAppId']);

          // put them together
          $href = "{$serviceurl}&id={$appID}&cu=$Cu&acct=$encryptedAccount";

          if ($parms["hcuLogging"] == "enabled") {
            $logParms = $parms["environment"];        // get the environment info passed in
            $logParms["token"] = '';                  // the id used across all communications in session
            $logParms["txnId"] = time();              // the id for this transaction
            $logParms["logPoint"] = "HCU Loan App";   // this action in a readable form
            $logParms["request"] = $href;             // the request
            $logParms["reply"] = '';
            LogSSOActivity($logParms);
          }
          // ** Clean output buffer
          ob_clean();
          header("Location: $href");
          exit;
          break;

        case "FISERV_CPS":
            if (!hcu_checkService($dbh, "FISERV")) {
                $omsg = hcu_checkServiceMsg($dbh, "FISERV");
                throw new Exception("$omsg");
            }
            $pilot = HCU_array_key_value('pilot', $parms);
            if ($pilot) {
                $fsOrg = HCU_array_key_value('pilotOrgid', $parms);
                $fsLogo = HCU_array_key_value('pilotCuLogo', $parms);
                $fsURL = HCU_array_key_value('piloturl', $parms);
                $fsCert = HCU_array_key_value('pilotcert', $parms);
                $fsPass = HCU_array_key_value('pilotpass', $parms);
            } else {
                $fsOrg = HCU_array_key_value('prodOrgid', $parms);
                $fsLogo = HCU_array_key_value('prodCuLogo', $parms);
                $fsURL = HCU_array_key_value('produrl', $parms);
                $fsCert = HCU_array_key_value('prodcert', $parms);
                $fsPass = HCU_array_key_value('prodpass', $parms);
            }

            $fsOrg = (empty($fsOrg) ? '000' : sprintf('%3d',intval($fsOrg)));
            $fsLogo = (empty($fsLogo) ? '000' : sprintf('%3d',intval($fsLogo)));
            $fsMember = $fsOrg . $fsLogo . substr("0000000000000$accountToUse",-13,13);

            if(empty($fsURL) || empty($fsCert) || empty($fsPass) ) {
                throw new Exception('Missing Settings');
            }

//            $fsAuth = "$fsURL?ReqType=ME&memberID=$fsMember&email=" . urlencode($Ml);
//            $fsAuth = "$fsURL?ReqType=ME&memberID=$fsMember&email=$Ml";

            $fsData = array('ReqType'=>'ME',
              'memberID'=>$fsMember,
              'email'=>$Ml);

            $response = "";
            $ch = curl_init();

            $curlopts = array(
                CURLOPT_RETURNTRANSFER => 1,
                CURLOPT_POST => 1,
                CURLOPT_URL => $fsURL,
                CURLOPT_SSLCERT => $fsCert);
            if ($ch) {
                curl_setopt_array($ch, $curlopts);
                if (!empty($fsPass) ) {
                    curl_setopt($ch, CURLOPT_SSLCERTPASSWD, $fsPass);
                }
                curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($fsData));

                $response = curl_exec($ch);
                $respHTTP = curl_getinfo($ch, CURLINFO_HTTP_CODE);
                $respCURL = curl_errno($ch);
                curl_close($ch);
            }
            if ($parms["logging"] == "enabled") {
                $logParms = $parms["environment"];      // get the environment info passed in
                $logParms["token"] = '';                // the id used across all communications in session
                $logParms["txnId"] = time();               // the id for this transaction
                $logParms["logPoint"] = "FiservCPS Auth";   // this action in a readable form
                $logParms["request"] = "curl --request POST --data '" . http_build_query($fsData) . " -E '{$fsCert}" . (empty($fsPass) ? "'" : ":{$fsPass}'") . " '$fsURL'";               // the request
                $logParms["reply"] = $response;            // the response
                LogSSOActivity($logParms);
            }

    if ($respCURL) {
        throw new Exception("HCUERROR: Connection Failed (cURL $respCURL)");
    } elseif ($respHTTP > 400) {
         throw new Exception("HCUERROR: (http $respHTTP)" . (empty($response) ? '' : " $response"));
    } elseif (!isset($response) || $response == '')  {
        throw new Exception("HCUERROR: Empty Response (http $respHTTP)");
    } elseif (stripos($response,"ERROR_TEXT")) {
        # check return for error, show DE_ERROR_TEXT
        $respERR = stristr($response, "DE_ERROR_TEXT");
        throw new Exception("HCUERROR: (fiserv $respERR)");
    } else {
        # got a valid url -
        $href = $response;
    }

        break;

        case "MeridianLink":

            /*
             * API credentials as provided by Meridian Link
             * links go to a page that shows the apiUser and apiPassword
             * seem to be missing the SSO domain,
             * unless the domain showing is what to use?
             *
             * also, that lender code gets passed on the url.
             * not sure that will work out well.

DEMO
https://demo.loanspq.com/partners/SecureHtmlPageViewer.aspx?id=7190a699-6020-4c51-a277-8fa2412bdc11
Link expires: 3/29/2017 8:06:57 AM

LIVE
https://cs.loanspq.com/partners/SecureHtmlPageViewer.aspx?id=e5cf9fdc-83c6-4957-879f-265d759ba2a9
Link expires: 3/29/2017 8:06:57 AM

Lender Code: LoneStarCU?N7q?º€m?ÂÓ8??=Á÷ù}?[?w?ÁÕ?¢w?µ???À?
             *
             */

            # this needs to have a function to run curl, catch errors
            # first call is to get consumer resource url
            # next need to get SSO Token
            # third, redirect with token.
            if (!hcu_checkService($dbh, "MeridianLink")) {
                $omsg = hcu_checkServiceMsg($dbh, "MeridianLink");
                throw new Exception("$omsg");
            }
            $pilot = HCU_array_key_value('pilot', $parms);
            if ($pilot) {
                $apiUser = HCU_array_key_value('pilotUser', $parms);
                $apiPass = HCU_array_key_value('pilotPass', $parms);
                $mlURL = HCU_array_key_value('piloturl', $parms);
                $mlLender = HCU_array_key_value('pilotlender', $parms);
                $ssoURL = HCU_array_key_value('pilotsso', $parms);
            } else {
                $apiUser = HCU_array_key_value('prodUser', $parms);
                $apiPass = HCU_array_key_value('prodPass', $parms);
                $mlURL = HCU_array_key_value('produrl', $parms);
                $mlLender = HCU_array_key_value('prodlender', $parms);
                $ssoURL = HCU_array_key_value('prodsso', $parms);
            }

            if (empty($apiUser) || empty($apiPass) || empty($mlURL) ||
                empty($mlLender) || empty($ssoURL) ) {
                throw new Exception('Missing Settings');
            }

//            $getConsumerResource = "https://$mlURL/services/resources.ashx/fis/$mlLender/consumers?MemberNumber=$Cn";
            $getConsumerResource = "$mlURL?MemberNumber=$accountToUse";
            $curlopts = array(
                CURLOPT_RETURNTRANSFER => 1,
                CURLOPT_URL => "$getConsumerResource",
                CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
                CURLOPT_USERPWD => "{$apiUser}:{$apiPass}");
            $parms['mlcall'] = 'GetConsumerResource';

            $response = merlink_embcurl($parms, $curlopts, '');
            if ($response['Status'] == 'Fail') {
                throw new Exception("{$response['Error']}");
            }
            # got a valid consumer resource url
            # next need to get SSO Token
            $curlopts[CURLOPT_URL] = ($response['MLinkDATA'] . '/ssotoken');
            $parms['mlcall'] = 'GetSSOToken';
            $response = merlink_embcurl($parms, $curlopts, '');
            if ($response['Status'] == 'Fail') {
                throw new Exception("{$response['Error']}");
            }
            # got a valid SSO Token
            # make sure the Token is not empty, and redirect
            $ssoToken = $response['MLinkDATA'];
            if (empty($ssoToken)) {
                throw new Exception("Meridian Link got Empty Token");
            }
#
# does $Ml need url_decoded?  Submitting the form should encode it, will that be double?
#
                print <<<EOF
  <html>
  <body onload = "javascript:document.SSOform.submit();">
  <form method="post" name="SSOform" action = "{$ssoURL}">
  <input type="hidden" name="SSOToken" value="{$ssoToken}">
  <input type="hidden" name="Email" value="$Ml">
  </form>
  </body>
  </html>
EOF;

        break;

        case "WebShare":

# generate a sha hash for member & timestamp  using secret key
# open iframe / div to load URL containing hash

            if (!hcu_checkService($dbh, "WebShare")) {
                $omsg = hcu_checkServiceMsg($dbh, "WebShare");
                throw new Exception("$omsg");
            }
            $pilot = HCU_array_key_value('pilot', $parms);
            if ($pilot) {
                $wsURL = HCU_array_key_value('piloturl', $parms);
                $wsKey = HCU_array_key_value('pilotkey', $parms);
            } else {
                $wsURL = HCU_array_key_value('produrl', $parms);
                $wsKey = HCU_array_key_value('prodkey', $parms);
            }
            if (empty($wsURL) || empty($wsKey) ) {
                throw new Exception("Missing Settings");
            }
            /*
             * date format is important! because it is used to hash
             * format used for hashing must be 'Y-m-d\TH:i:s\Z'
             * format passed on URL may vary, but represents same point in time
             *
             * example on page 4 uses
             *  gmdate('n/j/Y h:i:s A');  * 3/7/2015 12:28:41 AM
             * but code examples on page 6 use
             *  gmdate('Y-m-d H:i:s P'); * 2017-02-10 18:30:48 +00:00
             * and referenced RFC3339 would use
             *  gmdate ('Y-m-d\TH:i:sP') * 2017-02-17T22:49:16+00:00
             * but Bluepoint uses a literal 'Z' instead of offset, so...
             *  gmdate('Y-m-d\TH:i:s\Z') * 2017-02-17T22:49:16Z
             *
             */

// for testing only
//            $Cn = '22797624';
//            $Cn = '999999';

            $rfcdate = gmdate('Y-m-d\TH:i:s\Z');
            $reqdate = rawurlencode($rfcdate);
            $rfc = $accountToUse . $rfcdate . $wsKey; #'L0n3$tarw3B';
            $hash = base64url_encode(openssl_digest($rfc,'sha512', true));

            $dataURL = "{$wsURL}/?m={$accountToUse}&t={$reqdate}&h=$hash";

    if ($parms["logging"] == "enabled") {
        $logParms = $parms["environment"];      // get the environment info passed in
        $logParms["token"] = "";                // the id used across all communications in session
        $logParms["txnId"] = time();               // the id for this transaction
        $logParms["logPoint"] = "WebShare";   // this action in a readable form
        $logParms["request"] = "{$accountToUse}{$reqdate}{$wsKey}\n$dataURL";               // the request
        $logParms["reply"] = '';            // the response
        LogSSOActivity($logParms);
    }
            // for testing only
//            $dataURL = 'https://webshare.lonestarcu.org/Bluepoint.ECM.WebShare/#/?m=32364061&t=12%2F30%2F2016%205:31:28%20PM&h=JZwywUBSU1NjpBtV1Hy6jaJ0dX-BdJcPudHGOs1vRhAeoVVnAAI1hmLQ-rLXJzjVKtOMofl4MQ9IoBURpGiXfw';
//             if we need to load a logo...
//            $mdbrand = "MDtoolbar_logo_md.png";
//            if (is_readable("/home/$chome/public_html/$mdbrand")) {
//                $mdsrc = "/fi/$chome/$mdbrand";
//            } else {
//                $mdsrc = "/IMAGES/$mdbrand";
//            }

//             if we need a button to close the window
//            $buttonText = $MC->msg("Return To Home Banking");

            print <<<EOF
              <div style="margin: 0;">
                <iframe src="$dataURL" width='100%' height='500'></iframe>
                </div>
EOF;

            // so won't redirect
            $href = "";
            break;
            default:
                # none of the connection modes matched, throw an error
                throw new Exception("Invalid Connection Mode");
                break;
    }

    /**** I BELIEVE this is the end of the switch. ****/

    if ($href != '') {
      if ($showurl) {
          print "Location: $href <br>";
      } else {
          print <<<EOF
  <div style='font-size: 28px; text-align:center; padding-left: 40px; padding-right: 40px; padding-top: 40px;'>
  Loading Data..... Please Wait
  </div>
        <script>
        {
        location.replace("$href");
        }
        </script>
EOF;
      }
    }

  } catch (Exception $ex) {
    //Return error message
    $thisPageErrors = $ex->getMessage();
//    $thisPageErrors = "(" . $ex->getline() . ") " . $ex->getMessage();
    $errorObject = json_decode($thisPageErrors);

    $serviceErrorTitle = "";
    if ( $errorObject ) {
      $serviceErrorMsg = strlen( $errorObject->content ) > 0 ? $errorObject->content : $thisPageErrors;

      if ( strlen( $errorObject->title ) ) {
        $serviceErrorTitle = $errorObject->title;
      }
    } else {
      $serviceErrorMsg = $thisPageErrors;
    }


    // * Include the Error page and finish
    // 916 includes 'close window' button
    // 915 does not
    if ($serviceShowMenu || $HB_ENV['HCUPOST']['vanilla']) {
        $serviceErrorCode = '915';
    } else {
        $serviceErrorCode = '916';
    }


    require_once('hcuErrorPage.i');
  }

  if ($usePrePostcontent) {
    require_once('hcuPostContent.i');
  }


/**
 * Helper for switch ALLIED_SSO
 * @return array
 */
function AlliedSsoServiceFlags() {

  $apVanilla = '';
  $apPlatform = '';

  if (isset($_REQUEST['vanilla']) && (trim($_REQUEST['vanilla']) == 1)) {
    $apVanilla = 1;
  }

  if (
    isset($_REQUEST['platform'])  &&
    (
      (strtoupper(trim($_REQUEST['platform'])) == 'APP') ||
      (strtoupper(trim($_REQUEST['platform'])) == 'ADA')
    )
  ) {
    $apPlatform = 'APP';
  }

  if (($apVanilla == 1) || ($apPlatform == 'APP')) {
    // $service load menu, service show menu, service show info
      return [false, false, false];
  }

  // $service load menu, service show menu, service show info
  return [false, false, true];

}

function NoService($whynot) {
/*
    global $HB_ENV;
    cu_header($HB_ENV['MC']->msg('Feature Unavailable'));
    print "<CENTER><BR><TABLE BORDER=0 CELLSPACING=0 WIDTH=90%>
  <tr><td CLASS=bar align=center>" . $HB_ENV['MC']->msg('Feature Unavailable') . "<br></td></tr>
  <tr><td CLASS='usu' align=center>$whynot<br></td></tr>
  <tr><td CLASS='usu' align='center'><br>&nbsp;<form>
<script language=\"JavaScript\"><!--
if (window.close)
    document.write('<input type=\"button\" value=\"" .
            $HB_ENV['MC']->js_msg('Close Window') .
            "\" onClick=\"window.close()\">');
//--></script>
              </form>&nbsp;</td></tr></table>";
 *
 */
  throw new Exception( $whynot );
}

/**
 *  expects $saywhat as array returned from Get_NoticeInfo
 * displays notice_text with notice_answers
 * posts back to self with option=SPEEDBUMP, which causes Update_NoticeInfo call
 **/
function Speedbump($saywhat) {
    global $mode;
    global $Flang;

    foreach ($saywhat['notice'] as $noticekey => $noticearray) {
        // There should only be one
        if ($noticearray['notice_type'] == 'C') {
            $notice_answers = "";
            $notice_type = ($noticearray['notice_answertype'] == 'O' ? 'radio' : 'checkbox');
            if (count($noticearray['notice_answers']) > 0) {
                foreach ($noticearray['notice_answers'] as $notice_answer_key => $notice_answer_array) {
                    $notice_answers .="<input type='{$notice_type}' name='notice_response[]' id='response{$notice_answer_array['answer_id']}' value='{$notice_answer_array['answer_id']}'/><label for='response{$notice_answer_array['answer_id']}'>{$notice_answer_array['answer_text']}</label>";
                }
            }
            $notice_answers = "<div style='text-align:center'>
                              <fieldset>
                                {$notice_answers}
                              </fieldset>
                           </div>";
            $notice_donotshow = '';
            $notice_votebutton = "<input type='button' name='btnCancel' value='Cancel' onClick='window.close();'>";
            $notice_votebutton .= "<input type='submit' name='btnContinue' value='Continue'>";
            print <<< CONTENTS
          <div class='hdrl' >
            <div style='padding:10px'>
              {$noticearray['notice_text']}
            </div>

            <form id='formTransferNotice{$noticekey}' action="{$_SERVER['PHP_SELF']}?{$_SERVER['QUERY_STRING']}" method="post">
              <input type='hidden' name='btnClose' value='1'>
              <input type='hidden' name='option' value='SPEEDBUMP'><BR>
              <input type='hidden' name='mode' value='$mode'><BR>
              <input type='hidden' name='notice_type' value='{$noticearray['notice_type']}'>
              <input type='hidden' name='notice_id' value='{$noticearray['notice_id']}'>
              <input type='hidden' name='notice_device' value='C'>
              {$notice_answers}
              {$notice_donotshow}
              <div align='center' class=''>
                <fieldset>
                  {$notice_votebutton}
                </fieldset>
              </div>
            </form>
          </div>

CONTENTS;

//          <form id='formTransferNotice{$noticekey}' method='post' action='{$_SERVER['PHP_SELF']}?cu=$Cu&mode=$mode&Flang=$Flang&option=SPEEDBUMP'>
            break;
        }
    }
}
/**
 * expect arySelectList array
 * ['acctlist'][$acctkey]['display'] = label to be displayed for each account in acctlist array
 * ['acctlist'][$acctkey]['getvalue'] = value to be returned when this account is selected
 * ['message_text'] = screen prompt to be displayed, also used as nag message if nothing is selected
 *
 * may need to adjust to allow for header_text, footer_text?
 *
 * screen includes heading using 'message_text'
 * screen includes radio group 'selacct' with radio button for each account in 'acctlist'
 * screen includes Cancel button to close window
 * screen includes Continue button to post back to self with selected radio item, option=SELACCT,
 * mode=[requesting mode], query string = requesting query string

**/

function SelectData($arySelectList) {
    global $mode;
    global $Flang;
    global $HB_ENV;

    $select_accounts = "";
    $continue_button = "<input type='button' name='btnCancel' value='" . $HB_ENV['MC']->msg('Cancel') . "' onClick='window.close();'>";
    $continue_button .= "&nbsp;&nbsp;&nbsp;&nbsp;";
    $continue_button .= "<input type='submit' id='btnContinue' name='btnContinue' value='" . $HB_ENV['MC']->msg('Continue') . "' onClick='javascript:CkRadio();return false;'>";
    if (count($arySelectList['acctlist']) > 0) {
        $idx = 1;
        foreach ($arySelectList['acctlist'] as $acct_key => $acct_array) {
            $select_accounts .="<input type='radio' name='selacct' id='response{$idx}' value='{$acct_array['getvalue']}'/><label for='response{$idx}'>{$acct_array['display']}</label><br>";
            $idx++;
        }
    }
    $select_accounts = "<div style='text-align:left; padding:15px'>
                                {$select_accounts}
                           </div>";
// be aware that the mustmsg defined below may be overwritten in the MWI_Pagetop fragment
    print <<< CONTENTS
   <script>
       var mustmsg='Please choose the loan you wish to pay';
   </script>
          <div class='hdrl' >
            <div style='padding:3px'>
              {$arySelectList['notice'][0]['notice_text']}
            </div>

       <form name='formSelectAccount' id='formSelectAccount' action="{$_SERVER['PHP_SELF']}?{$_SERVER['QUERY_STRING']}" method="post">
          <input type='hidden' name='option' value='SELECTACCT'><BR>
              <input type='hidden' name='mode' value='$mode'>
          <fieldset>
              {$select_accounts}
              <div align='center' class=''>
                {$continue_button}
              </div>
         </fieldset>
       </form>
       <script>

            function CkRadio() {
              var somethingChecked = false;
              var radioGroup = document.formSelectAccount.selacct;
              if ( radioGroup.length ) {
                for (i = 0; i < radioGroup.length; i++) {
                    if (radioGroup[i].checked) {
                        somethingChecked = true;
                    }
                }
              } else if ( radioGroup.checked ) {
                somethingChecked = true;
              }
              if (!somethingChecked) {
                  window.alert(mustmsg);
                  return false;
              } else {
                  document.formSelectAccount.submit();
              }
            }
       </script>

     </div>

CONTENTS;
}

/* This is a generic function that will show something to the user and ask for their input. The notice text is
 *  already set up prior to calling. If there is an input list, that is the form variables to be passed on. The
 *  radio button group is the name of the radio buttons for verifying one has been selected and if not the
 *  checkMsg is shown. If no radio button group, then no check is done. Any buttons are passed in as part of the
 *  notice text.
 * Generally this is used to select an account before continuing, or to show a failure with custom content.
 */
function ShowUserNotice($noticeText,  $inputList, $radioButtonGroup, $checkMsg) {
    // Change some styles in case user is viewing from a mobile device since some 3rd party solutions are
    // only available to mobile users and the Mobile Web doesn't have a native interface to them (e.g. VSOFT).
    if ( $GLOBALS['viewportAllowed'] ) {
        print '<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />';
    }

    print <<< CONTENTS
    <style>
@media only screen and (max-width: 767px) {
  body { min-width: 100px; }
  #main { min-width: 100px; }
  #submenu { display: none; }
  #content div { font-size: large; }
  #content button { display: block; width: 100%; }
  #topbar { margin-top:80px; }
}
    </style>
    <script>
        var mustmsg='$checkMsg';
    </script>
    <form name='formSelectAccount' id='formSelectAccount' action="{$_SERVER['PHP_SELF']}?{$_SERVER['QUERY_STRING']}" method="post">
CONTENTS;

    // add the input name/value pairs that get sent with the form POST
    for ( $i = 0; $i < count( $inputList ); $i++ ) {
      print "<input type='hidden' name='{$inputList[$i]["name"]}' value='{$inputList[$i]["value"]}'>\n";
    }

    // add the text, buttons, and check function
    print <<< CONTENTS
      {$noticeText}
    </form>
CONTENTS;

    // only need this function if there is a radio button group
    if ( $radioButtonGroup ) {
      print <<< CONTENTS
      <script>
        function CkRadio() {
          var somethingChecked = false;
          var radioGroup = document.formSelectAccount.{$radioButtonGroup};
          if ( radioGroup.length ) {
            for (i = 0; i < radioGroup.length; i++) {
                if (radioGroup[i].checked) {
                    somethingChecked = true;
                }
            }
          } else if ( radioGroup.checked ) {
            somethingChecked = true;
          }
          if (!somethingChecked) {
              window.alert(mustmsg);
              return false;
          } else {
              document.formSelectAccount.submit();
          }
        }
      </script>
CONTENTS;
    }
}


/**
 * @param array $HB_ENV @todo this is an unused variable, already too many params
 * @param array $MIR
 * @param string $ipay_instid
 * @param string $ipay_iv
 * @param string $ipay_key
 * @param string $ipay_token
 * @param string $random
 * @param string $billpayid
 * @param string $ml
 * @param null|int $enrollmicr
 * @param int $micr
 * @return string
 * @throws Exception
 */
function iPayEnrollXML($HB_ENV, $MIR, $ipay_instid, $ipay_iv, $ipay_key, $ipay_token, $random, $billpayid, $ml, $enrollmicr = null, $micr = 0) {

    $Email = (empty($MIR["data"]["email"]) ? $ml : $MIR["data"]["email"]);

    $msg = '';
    if (empty($MIR["data"]["accountnumber"])) {
        $msg .= 'AccountNumber ';
    }
    if (empty($MIR["data"]["firstname"])) {
        $msg .= 'FirstName ';
    }
    if (empty($MIR["data"]["lastname"])) {
        $msg .= 'LastName ';
    }
    if (empty($Email)) {
        $msg .= 'Email ';
    }
    if (empty($MIR["data"]["address1"])) {
        $msg .= 'Address1 ';
    }
    if (empty($MIR["data"]["city"])) {
        $msg .= 'City ';
    }
    if (empty($MIR["data"]["state"])) {
        $msg .= 'State ';
    }
    if (empty($MIR["data"]["zip"])) {
        $msg .= 'Zip ';
    }
#
    if (empty($MIR["data"]["accountnumber"]) ||
            empty($MIR["data"]["firstname"]) ||
            empty($MIR["data"]["lastname"]) ||
            empty($Email) ||
            empty($MIR["data"]["address1"]) ||
            empty($MIR["data"]["city"]) ||
            empty($MIR["data"]["state"]) ||
            empty($MIR["data"]["zip"])) {
        throw new Exception("Not enough info to enroll ($msg)");
    }
    # try to enroll
    # generate a new authtoken and random, encrypt the ssn, try to enroll
#   $rdate=gmdate("Ymd H:i:s");
#   $random=gmdate("U");
#   list($ipay_token,$iv)=EncryptCredentials("{$ipay_instid};{$rdate}",$ipay_key,$ipay_iv);
    if (!empty($MIR["data"]["ssn"])) {
        list($EncryptedSSN, $iv) = EncryptCredentials("{$MIR["data"]["ssn"]}", $ipay_key, $ipay_iv);
    }

    if (strtotime($MIR["data"]["dob"])) {
        $DOB = date('Y-m-d', strtotime($MIR["data"]["dob"]));
    } else {
        $DOB = '';
    }

    $enroll = "<Message>\n";
    $enroll .= "<InstitutionID>$ipay_instid</InstitutionID>\n";
    $enroll .= "<Security>\n";
    $enroll .= "<IV>$ipay_iv</IV>\n";
    $enroll .= "<AuthToken>$ipay_token</AuthToken>\n";
    $enroll .= "</Security>\n";
    $enroll .= "<MessageRequest>\n";
    $enroll .= "<RequestID>$random</RequestID>\n";
    $enroll .= "<SubscriberCreate>\n";
    $enroll .= "<Info>\n";
    $enroll .= "<UserID>$billpayid</UserID>\n";
    $enroll .= "<UserType>2</UserType>\n";
    $enroll .= "</Info>\n";
    $enroll .= "<Data>\n";
    $enroll .= "<Subscriber>\n";
    $enroll .= "<FIAdminApproval>0</FIAdminApproval>\n";
    $enroll .= "<LoginID>$billpayid</LoginID>\n";
# values from the MIR packet
    $enroll .= "<FirstName>{$MIR["data"]["firstname"]}</FirstName>\n";
    if (isset($MIR["data"]["middlename"])) {
        $enroll .= "<MiddleName>{$MIR["data"]["middlename"]}</MiddleName>\n";
    }
    $enroll .= "<LastName>{$MIR["data"]["lastname"]}</LastName>\n";
    $enroll .= "<Email>$Email</Email>\n";
    if (isset($MIR["data"]["homephone"])) {
        $enroll .= "<HomePhone>{$MIR["data"]["homephone"]}</HomePhone>\n";
    }
    if (isset($MIR["data"]["workphone"])) {
        $enroll .= "<WorkPhone>{$MIR["data"]["workphone"]}</WorkPhone>\n";
    }
    if (isset($MIR["data"]["fax"])) {
        $enroll .= "<Fax>{$MIR["data"]["fax"]}</Fax>\n";
    }
    $enroll .= "<SSN>$EncryptedSSN</SSN>\n";

    if ($enrollmicr) {
        $enroll .= "<AccountNumber>{$micr}</AccountNumber>\n";
    } else {
        $enroll .= "<AccountNumber>{$MIR['data']['accountnumber']}</AccountNumber>\n";
    }


    $enroll .= "<AccountType>1</AccountType>\n";
    $enroll .= "<Address1>{$MIR["data"]["address1"]}</Address1>\n";
    if (isset($MIR["data"]["address2"])) {
        $enroll .= "<Address2>{$MIR["data"]["address2"]}</Address2>\n";
    }
    $enroll .= "<City>{$MIR["data"]["city"]}</City>\n";
    $enroll .= "<State>{$MIR["data"]["state"]}</State>\n";
    $enroll .= "<Zip>{$MIR["data"]["zip"]}</Zip>\n";
    if ($DOB <> "") {
        $enroll .= "<DateOfBirth>$DOB</DateOfBirth>\n";
    }
# end of MIR values
    $enroll .= "</Subscriber>\n";
    $enroll .= "</Data>\n";
    $enroll .= "</SubscriberCreate>\n";
    $enroll .= "</MessageRequest>\n";
    $enroll .= "</Message>\n";

    return $enroll;
}

function GetReqXML($ipay_instid, $ipay_iv, $ipay_token, $random, $Cu, $billpayid, $skip_company=0) {
    $request = "<Message>\n";
    $request .= "<InstitutionID>$ipay_instid</InstitutionID>\n";
    $request .= "<Security>\n";
    $request .= "<IV>$ipay_iv</IV>\n";
    $request .= "<AuthToken>$ipay_token</AuthToken>\n";
    $request .= "</Security>\n";
    $request .= "<MessageRequest>\n";
    $request .= "<RequestID>$random</RequestID>\n";
    $request .= "<Session>\n";
    $request .= "<Info />\n";
    $request .= "<Data>\n";
    $request .= "<Subscriber>\n";
    if (!$skip_company) {
        $request .= "<CompanyID>$Cu</CompanyID>\n";
    }
    $request .= "<LoginID>$billpayid</LoginID>\n";
    $request .= "</Subscriber>\n";
    $request .= "</Data>\n";
    $request .= "</Session>\n";
    $request .= "</MessageRequest>\n";
    $request .= "</Message>\n";

    return $request;
}

function GetReqResponse($ipayXML) {
    libxml_use_internal_errors(true);
    $ipayresp = simplexml_load_string($ipayXML);
    if ($ipayresp === false) {
        $ipaysuccess = NULL;
        $sessionID = NULL;
        $respcode = NULL;
        $respmsg = 'XML parse response failed ' . __LINE__;

        // $errors = libxml_get_errors();
        // foreach ($errors as $error) {
        //     $respmsg .= " " . $error->message;
        // }
        // libxml_clear_errors();

    } else {
        $XMLsuccess = $ipayresp->xpath("MessageRequest/Session/Response/ProcessStatus/Successful");
        $ipaysuccess = (HCU_array_key_exists(0,$XMLsuccess) ? (string) $XMLsuccess[0] : NULL);

        $XMLsessionid = $ipayresp->xpath("MessageRequest/Session/Response/Data/SessionID");
        $sessionID = (HCU_array_key_exists(0,$XMLsessionid) ? (string) $XMLsessionid[0] : NULL);

        $XMLcode = $ipayresp->xpath("MessageRequest/Session/Response/ProcessStatus/Error/Code");
        $respcode = (HCU_array_key_exists(0,$XMLcode) ? (string) $XMLcode[0] : NULL);

        $XMLmsg = $ipayresp->xpath("MessageRequest/Session/Response/ProcessStatus/Error/Message");
        $respmsg = (HCU_array_key_exists(0,$XMLmsg) ? (string) $XMLmsg[0] : NULL);
    }
    return array($ipaysuccess, $sessionID, $respcode, $respmsg);
}

/**
 * @param type $ipayXML
 * @return type
 */
function GetEnrollResponse($ipayXML) {
    libxml_use_internal_errors(true);
    $ipayresp = simplexml_load_string($ipayXML);
    if ($ipayresp === false) {
        $ipaysuccess = NULL;
        $respcode = NULL;
        $respmsg = 'XML parse response failed ' . __LINE__;

        // $errors = libxml_get_errors();
        // foreach ($errors as $error) {
        //     $respmsg .= " " . $error->message;
        // }
        // libxml_clear_errors();

    } else {

        $XMLsuccess = $ipayresp->xpath("MessageRequest/SubscriberCreate/Response/ProcessStatus/Successful");
        $ipaysuccess = (HCU_array_key_exists(0,$XMLsuccess) ? (string) $XMLsuccess[0] : NULL);

        $XMLcode = $ipayresp->xpath("MessageRequest/SubscriberCreate/Response/ProcessStatus/Error/Code");
        $respcode = (HCU_array_key_exists(0,$XMLcode) ? (string) $XMLcode[0] : NULL);

        $XMLmsg = $ipayresp->xpath("MessageRequest/SubscriberCreate/Response/ProcessStatus/Error/Message");
        $respmsg = (HCU_array_key_exists(0,$XMLmsg) ? (string) $XMLmsg[0] : NULL);
    }

    return array($ipaysuccess, $respcode, $respmsg);
}

function Set_ACH($achfmt,$suffix,$member) {
    if (strpos($suffix, "@")) {
        list($jtype, $jacct) = explode("@", $suffix);
    } else {
        $jtype = $suffix;
        $jacct = $member;
    }

//    $loanACH = eval($achfmt);
    eval("\$loanACH=$achfmt;");

    return $loanACH;
}

function VSHO_XML ($parms, $VSHOhost) {
#POST /HomeOfficeSvc/HomeOfficeService.asmx HTTP/1.1
#Host: demo1.vsoftcorp.com
#Content-Type: text/xml; charset=utf-8
#Content-Length: length
#SOAPAction: "http://homeoffice.vsoftcorp.com/VSHOSetCustomerInfo"

$soapString = '<?xml version="1.0" encoding="utf-8"?>';
$soapString .= "\n<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">";
$soapString .= "<soap:Body>
<VSHOSetCustomerInfo xmlns=\"http://homeoffice.vsoftcorp.com/\">
<customerInfo>
<InstId>{$parms['InstId']}</InstId>
<UserId>{$parms['UserId']}</UserId>
<ProfileId>{$parms['ProfileId']}</ProfileId>
<UserName>{$parms['UserName']}</UserName>
<Email>{$parms['email']}</Email>
<Accounts>
<VSHOAccountInfo>
<AccountNumber>{$parms['AccountNumber']}</AccountNumber>
<AccountType>{$parms['AccountType']}</AccountType>
<AccountDesc>{$parms['AccountDesc']}</AccountDesc>
<AccountStatus>{$parms['AccountStatus']}</AccountStatus>
<AccountPin>{$parms['AccountPin']}</AccountPin>
</VSHOAccountInfo>
</Accounts>
<Hash>{$parms['Hash']}</Hash>
</customerInfo>
</VSHOSetCustomerInfo>
</soap:Body>
</soap:Envelope>";

    $cmd="/usr/bin/curl --silent --data-binary '$soapString' -H 'Content-Type: text/xml; charset=utf-8' -H 'SOAPAction: \"http://homeoffice.vsoftcorp.com/VSHOSetCustomerInfo\"' $VSHOhost";
print $cmd;
    $resparr=array();
    $vshoXML=getcurl($cmd);
print "<br>After: $vshoXML";
    $VSHOresp = simplexml_load_string($vshoXML);

    $XMLresparr = $VSHOresp->xpath("VSHOSetCustomerInfoResponse");

    return $XMLresparr;

}
/**
 * strip slashes and dashes and non-digits from phone numbers
 * and zip code and tax id; rearrange DOB into mmddyyyy
 * then check to see if we have enough valid data to
 * satisfy the request
 *
 * 07-19 Add named back in for CUDIRECT_SSO.
 *
 * @param array $MIR mir packet info from core or local load
 * @param string $Ml homebanking email to use if mir.email is empty
 * @param array $reqMIR required items can't be empty in mir
 * @param string $datefmt format to use for DOB
 * @param string $phones 'flat' or 'split'
 *  'flat' = fill ['PHONE'] with first non-null of HomePhone, CellPhone, WorkPhone
 *  'split' = split each phone # into sub-array of optional [Area], required [Pre] & [Num]
 *  'named' = 07-19 re-added for CUDIRECT_SSO
 *
 * @param boolean $noEmpty unset empty mir values
 * @return array
 * @throws Exception
 */
function populateMIR($MIR, $Ml, $reqMIR, $datefmt = 'Y-m-d', $phones = 'flat', $noEmpty = false) {
    try {
/*
//$mirFields = Array(
//    "accountnumber",
//    "firstname",
//    "middlename",
//    "lastname",
//    "email",
//    "homephone",
//    "workphone",
//    "cellphone",
//    "fax",
//    "ssn",
//    "address1",
//    "address2",
//    "city",
//    "state",
//    "zip",
//    "cc",
//    "dob",
//    "class"
//  );
         *
         */
        /* strip slashes and dashes and non-digits from phone numbers
         * and zip code and tax id; rearrange DOB into mmddyyyy
         * then check to see if we have enough valid data to
         * satisfy the request
         */
        if ($phones == 'flat') {
            $MIR['phone'] = preg_replace('/\D/', '', $MIR['homephone']);
            if (trim($MIR['phone']) == '') {
                $MIR['phone'] = preg_replace('/\D/', '', $MIR['cellphone']);
            }
            if (trim($MIR['phone']) == '') {
                $MIR['phone'] = preg_replace('/\D/', '', $MIR['workphone']);
            }
        } elseif ($phones == 'split') {
            $MIR['homephone'] = preg_replace('/\D/', '', $MIR['homephone']);
            switch (strlen($MIR['homephone'])) {
                case 10:
                    $MIR['homephone'] = array('area' => substr($MIR['homephone'], 0, 3),
                        'pre' => substr($MIR['homephone'], 3, 3),
                        'num' => substr($MIR['homephone'], 6, 4));
                    break;
                case 7:
                    $MIR['homephone'] = array('pre' => substr($MIR['homephone'], 3, 3),
                        'num' => substr($MIR['homephone'], 6, 4));
                    break;
                default:
                    unset($MIR['homephone']);
                    break;
            }
            $MIR['cellphone'] = preg_replace('/\D/', '', $MIR['cellphone']);
            switch (strlen($MIR['cellphone'])) {
                case 10:
                    $MIR['cellphone'] = array('area' => substr($MIR['cellphone'], 0, 3),
                        'pre' => substr($MIR['cellphone'], 3, 3),
                        'num' => substr($MIR['cellphone'], 6, 4));
                    break;
                case 7:
                    $MIR['cellphone'] = array('pre' => substr($MIR['cellphone'], 3, 3),
                        'num' => substr($MIR['cellphone'], 6, 4));
                    break;
                default:
                    unset($MIR['cellphone']);
                    break;
            }
            $MIR['workphone'] = preg_replace('/\D/', '', $MIR['workphone']);
            switch (strlen($MIR['workphone'])) {
                case 10:
                    $MIR['workphone'] = array('area' => substr($MIR['workphone'], 0, 3),
                        'pre' => substr($MIR['workphone'], 3, 3),
                        'num' => substr($MIR['workphone'], 6, 4));
                    break;
                case 7:
                    $MIR['workphone'] = array('pre' => substr($MIR['workphone'], 3, 3),
                        'num' => substr($MIR['workphone'], 6, 4));
                    break;
                default:
                    unset($MIR['workphone']);
                    break;
            }
        } elseif ($phones == 'named') {

          $phone_formats = [
            'homephone' => 'Home',
            'cellphone' => 'Cell',
            'workphone' => 'Work'
          ];

          $MIR['phonenumbers'] = [];

          foreach ($phone_formats as $format => $name) {

            $MIR[$format] = preg_replace('/\D/', '', $MIR[$format]);
            switch (strlen($MIR[$format])) {
              case 10:
              case 7:
                $MIR['phonenumbers'][] = [
                  'number' => format_phone($MIR[$format]),
                  'name' => $name
                ];
                break;

              default:
                unset($MIR[$format]);
                break;
            }
          }
        }

        // 08-19, implemented from CUDIRECT_SSO in mammoth, see comments. All
        // calls to this function from other SSO's have been tested.
        $MIR['dob'] = format_date(HCU_array_key_value('dob', $MIR), $datefmt);

        $rmlist = array(' ', '-');
        $MIR['ssn'] = str_replace($rmlist, '', $MIR['ssn']);

        $MIR['zip'] = str_replace($rmlist, '', $MIR['zip']);
        if (strlen($MIR['zip']) < 5) {
            unset($MIR['zip']);
        }

        $rmlist = array("#", "&", "/", "%", ",", ":", "=", "?", "'");

        $EMAIL = (empty($MIR['email']) ? $Ml : $MIR['email']);
        $MIR['email'] = str_replace($rmlist, "", $EMAIL);
        $MIR['firstname'] = str_replace($rmlist, "", $MIR['firstname']);
        $MIR['middlename'] = str_replace($rmlist, "", $MIR['middlename']);
        $MIR['lastname'] = str_replace($rmlist, "", $MIR['lastname']);
        $MIR['address1'] = str_replace($rmlist, "", $MIR['address1']);
        $MIR['address2'] = str_replace($rmlist, "", $MIR['address2']);
        $MIR['city'] = str_replace($rmlist, "", $MIR['city']);
        $MIR['state'] = str_replace($rmlist, "", $MIR['state']);
        $MIR['accountnumber'] = str_replace($rmlist, "", $MIR['accountnumber']);
        # default country code to US.  Assume CU will specify for other countries
        if (trim($MIR['cc']) == '') {
            $MIR['cc'] = 'US';
        }

        $MIR['class'] = str_replace($rmlist, "", $MIR['class']);
        if (trim($MIR['class']) == '') {
            $MIR['class'] = 'P'; # default to personal account
        }

        if ($noEmpty) {
            if (trim($MIR['email']) == false) {
                unset($MIR['email']);
            }
            if (trim($MIR['firstname']) == false) {
                unset($MIR['firstname']);
            }
            if (trim($MIR['middlename']) == false) {
                unset($MIR['middlename']);
            }
            if (trim($MIR['lastname']) == false) {
                unset($MIR['lastname']);
            }
            if (trim($MIR['address1']) == false) {
                unset($MIR['address1']);
            }
            if (trim($MIR['address2']) == false) {
                unset($MIR['address2']);
            }
            if (trim($MIR['city']) == false) {
                unset($MIR['city']);
            }
            if (trim($MIR['state']) == false) {
                unset($MIR['state']);
            }
            if (trim($MIR['accountnumber']) == false) {
                unset($MIR['accountnumber']);
            }
            if (trim($MIR['dob']) == false) {
                unset($MIR['dob']);
            }
            if (trim($MIR['zip']) == false) {
                unset($MIR['zip']);
            }
        }

        $missing = array_diff_key($reqMIR, $MIR);
        if (sizeof($missing)) {
//                throw new Exception("Incomplete Member Info (" . join(", ",array_keys($missing)) . ") mir gets " . print_r($MIR,true));
            throw new Exception("Incomplete Member Info (" . join(", ", array_keys($missing)) . ")");
        }
        $return['status']['response'] = true;
        $return['status']['message'] = 'Success';
        $return['data'] = $MIR;
    } catch (Exception $e) {
        $return['status']['response'] = false;
        $return['status']['message'] = $e->getMessage();
//        $return['status']['message'] = "(" . $e->getline() . ") " . $e->getMessage();
        $return['data'] = array();
    }
    return $return;
}

function Validate_Userkey($CU, $USERKEY) {

    try {
        $return = array();
        $apptokenkey = 'Chahriv8pahvahsa';

        if (empty($CU)) {
            throw new Exception('Userkey invalid - Missing Cu Parameter');
        }
        if (empty($USERKEY)) {
            throw new Exception('Userkey invalid - Missing Userkey Parameter');
        }
        # $mytoken="H=$hash&E=$expires&A=$member";
        # 11/6/14 to support switch accounts
        # $mytoken="H=$hash&E=$expires&A=$cauth_member&C=$current_member";

        $apptokarr = array();
        parse_str(urldecode($USERKEY), $apptokarr);

        if ($apptokarr['E'] < time()) {
            $resdesc = "Session Timed Out";
            throw new Exception($resdesc);
        }

        if (is_null($apptokarr['E']) || is_null($apptokarr['A']) || is_null($apptokarr['H'])) {
            $resdesc = "Partial Token";
            throw new Exception($resdesc);
        }
        # if no C= value, assume oldstyle userkey
        # and set member as A= value so hash works
        if (is_null($apptokarr['C'])) {
            $MEMBER = $apptokarr['A'];
        } else {
            $MEMBER = $apptokarr['C'];
        }
        $CAUTH = $apptokarr['A'];
        $EXPIRES = $apptokarr['E'];
        $hash = MD5($apptokenkey .
            MD5(join(':', array($apptokenkey, $EXPIRES, $CU, $MEMBER, $CAUTH))));
        if ($apptokarr['H'] != $hash) {
            $resdesc = "Corrupted Token" . print_r($apptokarr, true);
            throw new Exception($resdesc);
        }

        $return['status']['response'] = true;
        $return['status']['message'] = "Success";
        $return['status']['member'] = $MEMBER;
        $return['status']['cauth'] = $CAUTH;
    } catch (Exception $e) {
        $return[status][response] = false;
        $return[status][message] = $e->getMessage();
    }
    return $return;
}


function iPayEmbcurl($soapString, $soapHeaders, $soapServer, $soapCertfile='', $soapKeyfile='', $soapCACert='', $parms) {
//        CURLOPT_SSL_VERIFYHOST => 0,
//        CURLOPT_VERBOSE => 1,
//        CURLOPT_STDERR => '/tmp/chkfreetrace',
//        CURLINFO_HEADER_OUT => 1,

    $curlopts = array(
        CURLOPT_SSL_VERIFYPEER => 0,
        CURLOPT_RETURNTRANSFER => 1,
        CURLOPT_HEADER => 0,
        CURLOPT_POST => 1,
        CURLOPT_POSTFIELDS => "$soapString",
        CURLOPT_URL => "$soapServer");
    if (!empty($soapCertfile)) {
        $curlopts[CURLOPT_SSLCERT] = "$soapCertfile";
    }
    if (!empty($soapKeyfile)) {
        $curlopts[CURLOPT_SSLKEY] = "$soapKeyfile";
    }
    if (!empty($soapCACert)) {
        $curlopts[CURLOPT_CAINFO] = "$soapCACert";
    }

    $ch = @curl_init();
    @curl_setopt_array($ch, $curlopts);
    @curl_setopt($ch, CURLOPT_HTTPHEADER, $soapHeaders);

    $respERR = '';
    $return = '';
    $response = curl_exec($ch);
    $respHTTP = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $respCURL = curl_errno($ch);

    if ($respCURL) {
        # Bad! Don't hide the error, return the curl error if it occurred.
        $respERR = "HCUERROR: Connection Failed cURL $respCURL";
        $return = array("status" => false, "code" => "hcuC{$respCURL}", "message" => "$respERR");
    } elseif ($respHTTP > 400 && $respHTTP < 600) {
        # HTTP Response 4xx client error or 5xx server error
        $respERR = "HCUERROR: Connection Failed HTTP $respHTTP ";
        $return = array("status" => false, "code" => $respHTTP, "message" => "$respERR");
    } elseif (!isset($response) || empty($response) ) {
        $return = array("status" => false, "code" => $respHTTP, "message" => "Empty Response");
    } else {
        $return = array("status" => true, "code" => 0, "message" => $response);
    }

    if ($parms["logging"] == "enabled") {
        $logParms = $parms["environment"];      // get the environment info passed in
        $logParms["token"] = '';                // the id used across all communications in session
        // logPoint is set before calling curl function.
        // Overriding it here hides needed detail, makes support difficult
        // $logParms['logPoint'] = 'Ipay Embed Curl';
        $logParms["txnId"] = time();                     // the id for this transaction
        $logParms["reply"] = json_encode($return);                   // the response
        LogSSOActivity($logParms);
    }

    curl_close($ch);
    return $return;
}

/**
 * 08-19: Only require MICR account if EnrollMICR flag is set to 1
 * @param resource object $dbh
 * @param array $HB_ENV
 * @param string $accountToUse
 * @param int $enrollmicr from trusted detail property EnrollMICR 0|1
 * @return array
 */
function iPay_getHCUAccounts($dbh, $HB_ENV, $accountToUse, $enrollmicr = 0) {

    try {
        $sql = "select trim(accountnumber) as accountnumber,
                    trim(accounttype) as accounttype,
                    certnumber as cert,
                    trim(description) as description,
                    trim(micraccount) as micr
              from  {$HB_ENV['Cu']}accountbalance
              where accountnumber='$accountToUse' and deposittype='Y'
                    and accounttype not like '%@%'";

        if ($enrollmicr > 0) {
           $sql .= " and trim(micraccount) > ''";
        }

        # Run the sql and see if we got anything

        $sthdp = db_query($sql, $dbh);
        $rows = db_num_rows($sthdp);

        if ($rows == 0) {
            throw new Exception("No Valid Accounts for bill pay service");
        }
        $reply['status']['response'] = true;
        $reply['status']['message'] = "{$rows} Payment Account(s) Found";
        $reply['data'] = db_fetch_all($sthdp);
    } catch (Exception $e) {
        $reply['status']['response'] = false;
        $reply['status']['message'] = $e->getMessage();
        $reply['data'] = array();
    }

    return $reply;
}

/**
 * @param string $ipay_instid
 * @param string $ipay_iv
 * @param string $ipay_session
 * @param string $ipay_token
 * @param string $Cu
 * @param string $billpayid
 * @param int $skip_company
 * @param array $parms
 * @param string $random
 * @return array|string
 */
function iPay_getSession($ipay_instid, $ipay_iv, $ipay_session, $ipay_token, $Cu, $billpayid, $skip_company, $parms, $random) {

            # send login
            $request = GetReqXML($ipay_instid, $ipay_iv, $ipay_token, $random, $Cu, $billpayid, $skip_company);

            $cmd = "/usr/bin/curl --silent --request POST --data-binary '$request' -H 'Content-type: application/xml' '{$ipay_session}'";
//            $ipayXML = getcurl($cmd);

            $ipayHeaders = [];
            $ipayHeaders[] = "Content-type: application/xml";

            $parms["environment"]["logPoint"] = "V3_Login";      // this action in a readable form
            $parms["environment"]["request"] = "{$cmd}";                     // the request
            $ipayXML = iPayEmbcurl($request, $ipayHeaders, $ipay_session, '', '', '', $parms);

            return $ipayXML;
}

function PSCU_getHCUAccounts($dbh, $HB_ENV, $accountToUse, $parms) {
    try {
        $acctsql = (HCU_array_key_value('acctsql', $parms) ? $parms['acctsql'] : "trim(micraccount)" );
        $sendjoint = (HCU_array_key_value('sendjoint', $parms) ? '' : "and accounttype not like '%@%' " );

        $sql = "select $acctsql as micr, trim(description) as description, available
                from {$HB_ENV['Cu']}accountbalance where accountnumber='$accountToUse'
                 and deposittype='Y' $sendjoint order by accounttype;";
        $sthdp = db_query($sql, $dbh);
        $rows = db_num_rows($sthdp);
        if (!($sthdp) || $rows == 0) {
            throw new Exception($HB_ENV['MC']->msg('No Valid Accounts'));
        }

        $reply['status']['response'] = true;
        $reply['status']['message'] = "{$rows} Payment Account(s) Found";
        $reply['data'] = db_fetch_all($sthdp);
    } catch (Exception $e) {
        $reply['status']['response'] = false;
        $reply['status']['message'] = $e->getMessage();
        $reply['data'] = array();
    }
    return $reply;
}
function merlink_embcurl($parms, $reqOpts, $reqData='') {

    # parms is the array from trusted vendor, including logging status
    # reqOpts is the array of curl options to set
    # reqData is post data

    $ch = @curl_init();
    if ($ch) {
        curl_setopt_array($ch, $reqOpts);
        if (strlen($reqData) > 0) {
            curl_setopt($ch, CURLOPT_POSTFIELDS, $reqData);
        }
        $response = curl_exec($ch);
        $respHTTP = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        $respCURL = curl_errno($ch);
        curl_close($ch);
    }

    if ($parms["logging"] == "enabled") {
        $logParms = $parms["environment"];      // get the environment info passed in
        $logParms["token"] = '';                // the id used across all communications in session
        $logParms["txnId"] = time();               // the id for this transaction
        $logParms["logPoint"] = "MLink getConsumerResource";   // this action in a readable form
        $logParms["logPoint"] = $parms['mlcall'];

        $logParms["request"] = "curl ";               // the request


        if (isset($reqOpts[CURLOPT_CUSTOMREQUEST]) && $reqOpts[CURLOPT_CUSTOMREQUEST] != 'GET') {
            $logParms["request"] .=  "-X {$reqOpts[CURLOPT_CUSTOMREQUEST]} ";
        }
        if (isset($reqOpts[CURLOPT_USERPWD])) {
            $logParms["request"] .=  "-u '{$reqOpts[CURLOPT_USERPWD]}' ";
        }

        $logParms["request"] .= "'{$reqOpts[CURLOPT_URL]}' ";               // the request
//        $logParms["request"] .= print_r($reqOpts,true);
        if (strlen($reqData) > 0) {
            $logParms["request"] .= "-d '$reqData' ";               // the request
        }
        $logParms["reply"] = $response;            // the response
//        $logParms["reply"] .= "HTTP $respHTTP  CURL $respCURL";            // the response
        LogSSOActivity($logParms);
    }
    $return = array();
    if ($respCURL) {
        $return['Status']='Fail';
        $return['Error']="ERROR: Connection Failed (cURL $respCURL)";
    # service responds with HTTP 200 when successful
    } elseif ($respHTTP != 200) {
        $return['Status']='Fail';
        $return['Error']="ERROR: (http $respHTTP)";
        if (!empty($response))  {
            $return['Error'] .= " $response";
        }
    } elseif (!isset($response) || $response == '') {
        $return['Status']='Fail';
        $return['Error']="ERROR: Empty Response (http $respHTTP)";
    } else {
        # got a valid url -
        $return['Status']='Success';
        $return['MLinkDATA']=$response;
    }

    return $return;

}
function base64url_encode($data) {
    #implements Base64 w/URL & Filename Safe Alphabet per RFC 4648
    # no padding
  return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
}

function base64url_decode($data) {
    # implements Base64 w/URL & Filename Safe Alphabet per RFC 4648
    # no padding
  return base64_decode(str_pad(strtr($data, '-_', '+/'), strlen($data) % 4, '=', STR_PAD_RIGHT));
}


/**
 * sanitizing phone before calling this function, but just in case ...
 * @param $phone
 * @return string
 */
function format_phone($phone) {

  $phone = preg_replace("/[^0-9]/", "", $phone);
  $length = strlen($phone);

  switch($length) {
    case 7:
      return preg_replace("/([0-9]{3})([0-9]{4})/", "$1-$2", $phone);

    case 10:
      return preg_replace("/([0-9]{3})([0-9]{3})([0-9]{4})/", "$1-$2-$3", $phone);

    default:
      return $phone;
  }
}


/**
 * A DOB value in the mir packet of all zeros passed the 'not empty' test and
 * then blew up at CuDirect.  Using a very old minimum date, and  current time
 * as max date.  Kind of a wide filter, but at least make sure the value passed
 * to CuDirect will be a valid date string
 * Eliminated else and variable set, guard pattern.
 *
 * @param string $dob
 * @param string $datefmt
 * @return string formatted date
 */
function format_date($dob, $datefmt = 'Y-m-d') {

  $mindate  = strtotime('1901-12-31');
  $maxdate  = time();
  $st       = strtotime($dob);

  if (strtotime($dob) && $st > $mindate && $st < $maxdate) {
    return date($datefmt, $st);
  }

  return '';
}