lnapphbuser.i

<?php
/*
  * Ability to log in using home banking credentials

 * The user will login using Home Banking (<cucode>user.user_id).  The user_id
 * from the <cucode>user table will be saved to the column banking_user_id.
 * Email from the cuusers table will also be saved to the lnappuser.email field.
 * This email will update each time the user authenticates with their current email address.
 * For the Loan App user
 * -1 will be saved in the banking_user_id field for all entries..
 *
 * A new unique key will be added (email, cu, userlogintype, banking_user_id)
 * It is unique to ensure data integrity.
 *
 *
 * RULES FOR AUTHENTICATING HOME BANKING USER
 *
 * There will be a challenge question cookie (machine cookie)
 * There will be an authentciated user cookie (user cookie)
 *
 * Too many failed attempts need to be added to the code, with admin able to
 * unlock
 *
 * ** MWS 4/2/2018 START
 * ** The following sections may change when we get to them.  The banking user will
 * ** be verified, but the information should always be refer to main <cucode>user
 * ** table instead of keeping a copy here.
 * ** The lnappuser table will store the user_id in the banking_user_id column.
 *
 * 1. Get cu code for current session, this must be known
 *
 * 2. Get user login id: user_name/user_alias (in future)
 *
 * 3. Check the existence for cu/user_name/userlogintype='H' in lnappuser
 *    a. If FOUND --
 *      1. Verify the user exists in cuusers table
 *        cu - cucode AND user_name = user loginid
 *        A. If found, insert lnappuser record, with cu,user_name, email, userlogintype='H'
 *        B. if NOT found -- return to main screen --- user NOT found
 *    b. if NOT found
 *      1. Check the user exists in the cuusers table.  On the following fields:
 *        cu - cucode AND user_name = user loginid
 *        A. If found, insert lnappuser record, with cu,user_name, email, userlogintype='H'
 *        B. if NOT found -- return to main screen --- user NOT found
 *
 * 4. Machine Cookie Validation
 *    a. If machine cookie is found.. Validate that it is correct
 *    b. If machine cookie is NOT found OR is NOT correct
 *      1. Set a random value from the users challenge questsions in the
 *          challenge_quest_id.  This will can be done similar to how it is done
 *          already for loans
 *      2. Show the user the question and force them to answer.
 *        A. On a correct answer, save the Machine Cookie
 *        B. On an incorrect answer, set the failedloginattempts and keep showing
 *            the same challenge question.
 *
 * 5. Password Validation -- after a machine cookie is set the password cookie
 *      will now need to be set
 *    a. Show a screen displaying their 'confidence' word and field to enter password
 *      1. Upon submit validate the password.
 *        A. If SUCCESSFUL
 *          I. Create the user cookie and redirect to the Loan Application Main Screen
 *        B. If NOT Successful
 *          I. Increment the failedloginattempts by 1 for this user record in lnappuser
 *          II. Send the user back to the main entry screen with the message:
 *              'Unable to login, password incorrect.'
 *
 * ** MWS 4/2/2018 END
 *
 * Validation
 *
 * Pieces of the User Cookie
 *
 *
 *
 *
 *
 *
 * FORM VARIABLES
 * $FORM_SHOW -- What option will this form show
 *    challenge -- show the challenge question
 *    passwd    -- show the confidence/password screen
 *
*/

  /*
   * LOAD GET/POST values
   */
  $loadedValues['lnapphbuser'] = Array();
  HCU_ImportVars($loadedValues, "lnapphbuser", array("acct" => HCUFILTER_INPUT_STRING, "applogin" => HCUFILTER_INPUT_STRING, "hbusername" => HCUFILTER_INPUT_STRING, "chksecure" => HCUFILTER_INPUT_STRING));

  $FORM_SHOW = "";

  $banking_user_id = -1;
  $setUserAcct = '';
  /*
   * hbssouser - This code is used WHEN initially logging in from home banking.
   *              the member must have a valid session
   */
  if (hcu_array_key_exists('applogin', $loadedValues['lnapphbuser']) || ($hbuser_cookie_user && $DMSAPP_CURRENTUSERID > 0) || $form_code == 'hbssouser') {

    // * we are posting from the intro screen
    // * validate the user_name is entered
    if (trim(hcu_array_key_value('hbusername', $loadedValues['lnapphbuser'])) != '' || $DMSAPP_CURRENTUSERID > 0 || $form_code == 'hbssouser') {
      /* MWS 4/2/2018 - PREVENT THIS OPTION */
      if (trim(hcu_array_key_value('hbusername', $loadedValues['lnapphbuser'])) != ''  && FALSE) {

        if (preg_match("/\D/", hcu_array_key_value('hbusername', $loadedValues['lnapphbuser']))) {
          // username contains non-digits
          $userQueryField = "user_alias ilike '" . save_text(hcu_array_key_value('hbusername', $loadedValues['lnapphbuser']), 50) . "' ";
        } else {
          // ** do NOT allow login if the user_alias is set and they are using member number to login
          $userQueryField = "user_name = '" . save_text(hcu_array_key_value('hbusername', $loadedValues['lnapphbuser']), 12) . "' AND rtrim(coalesce(user_alias, '')) = '' ";
        }

        // ** Look up the user in the cuusers table -- from POSTED hbusername
        $sql = "SELECT cu, user_name, email, failedremain, passwd, confidence,
                  user_alias
                FROM cuusers
                WHERE cu = '$DMSAPP_CURRENTCUCODE'
                  AND {$userQueryField} ";

      } elseif ($form_code == 'hbssouser') {

        /*
         * hbssouser
         *
         * This section is used to allow a currently authenticated member log in to the
         * online loan app without having to reenter password information
         *
         */

        /*
         * First - AUTHENTICATE HOME BANKING TOKEN
         *  This is done in cu_credentials
         *  ALWAYS USE CAUTH as the logged in member
         */

        $mbrStatus = Check_Member_Credentials($HB_ENV, HCU_array_key_value("Ticket", $_COOKIE));

        /*
         * mbrStatus
         *  ['result'] {0, 1}
         *      0 - Something is wrong and the member is NOT allowed to continue.
         *          Put them back to the login screen
         *      1 - The home banking credentials were valid (continue)
         *
         */

        if (!$mbrStatus['result']) {

          header("Location: {$self}status=10");
          exit;

        } else {
          $banking_user_id = intval($HB_ENV['Uid']);
          /*
           * Home banking credentials authenticated.. CONTINUE
           */
          // ** Look up the user in the cuusers table
          $sql = "SELECT user_id, group_id, user_name, email, failedremain, passwd, confidence
                  FROM {$DMSAPP_CURRENTCUCODE}user
                  WHERE user_id = {$banking_user_id}; ";

        }

        if (isset($loadedValues['lnapphbuser']['acct'])) {
          $setUserAcct = hcu_decrypturl($loadedValues['lnapphbuser']['acct'], $HB_ENV['historyHash']);
        }


        /*
         * Second - check lnappuser for existence of a record for this member
         */

        /*
         * Third - Create session cookie for online loan app
         */
      } else {
        $sql = '';
        /* PREVENT THIS OPTION MWS 4/2/2018
        // ** Look up the user in the cuusers JOIN lnappuser, from COOKIE userid
        $sql = "SELECT cuusers.cu, cuusers.user_name, cuusers.email, cuusers.failedremain,
                  cuusers.passwd, cuusers.confidence, cuusers.user_alias
                FROM cuusers
                JOIN {$DB_TABLE_PREFIX}user as lnuser on lnuser.user_name = cuusers.user_name
                  AND lnuser.cu = cuusers.cu
                WHERE lnuser.userid = " . intval($DMSAPP_CURRENTUSERID) . "
                  AND lnuser.userlogintype ='" . DMSAPP_CONST_HB_LOGIN . "' ";

        $FORM_VALIDATION_ERROR .= "<li>Your session has expired.  Please confirm your password.</li>";
        */
      }


      $hb_rs = db_query($sql, $dbh);
      $hb_row = db_fetch_assoc($hb_rs);
      if ($hb_row) {

        /**
         * SUCCESSFUL USER
         *
         * * Check how many accounts this user can access
         * * Use a speed bump to select an account if there is more than one.
         * * Save the selected account to the column sessin_account in lnappuser table.
         */


        // * have the user row
        // * NOW check to see if in lnappuser
        $sql = "SELECT *
                FROM {$DB_TABLE_PREFIX}user
                WHERE cu = '$DMSAPP_CURRENTCUCODE'
                  AND userlogintype in ('H', 'N')
                  AND banking_user_id = {$banking_user_id};";

        $user_rs = db_query($sql, $dbh);

        // ** Banking User ID is set,
          // If the setUserAcct is set, then verify the user has access to the specified account for the purpose of a Loan
        if (!VerifyUserAccountAccessForLoan($HB_ENV, $banking_user_id, $setUserAcct)) {
          $setUserAcct = '';
        }

        if ($user_row = db_fetch_assoc($user_rs)) {

          // ** USER RECORD FOUND..
          // ** CHECK THE LOAN APP FAILED ATTEMPTS
            // * This value increments from ZERO with each failed login
            // * Always respect the failedloginattempts.  If this is maxed out.
            // * then they should not be allowed to continue and will need to use the
            // online loan app admin tool to unlock
          if (intval($user_row['failedloginattempts']) >= $DMSAPP_FAILEDLOGINATTEMPTS) {
            if (intval($select_questid) == 0) {
              header("Location: {$self}f=intro&status=8");
              exit;
            }
          }



          // * IN FACT, update the lnappuser.email and lnappuser.confidenceword
          //   AND force login type to be type "H" even if was type "N" (meaning now a homebanking user)
          $sql = "UPDATE {$DB_TABLE_PREFIX}user
                  SET
                    email = '" . save_text($hb_row['email'], 50) . "',
                    userlogintype = 'H',
                    confidenceword = '" . save_text($hb_row['confidence'], 30) . "',
                    session_account = '" . save_text($setUserAcct, 12) . "'
                  WHERE userid = " . intval($user_row['userid']);

          if (!$exec_rs = db_query($sql, $dbh)) {

            // * PROBLEM -- Force back to login screen -- UNKNOWN why can't update
            header("Location: {$self}status=999");
            exit;
          }
        } else {
          // ** lnappuser NOT FOUND -- INSERT IT
          $sql = "INSERT INTO {$DB_TABLE_PREFIX}user
                    (email, cu, failedloginattempts, challenge_quest_id, userlogintype, banking_user_id, confidenceword, session_account)
                    VALUES
                    ('" . save_text($hb_row['email'], 50) . "', '$DMSAPP_CURRENTCUCODE', 0, -1,
                      'H', {$banking_user_id},
                      '" . save_text($hb_row['confidence'], 30) . "',
                      '" . save_text($setUserAcct, 12) . "');";

          if (!$exec_rs = db_query($sql, $dbh)) {

            // * PROBLEM -- Force back to login screen -- UNKNOWN why can't insert
            header("Location: {$self}status=999");
            exit;
          }
          // * FETCH THE ROW WE JUST INSERTED
          $sql = "SELECT *
                  FROM {$DB_TABLE_PREFIX}user
                  WHERE cu = '$DMSAPP_CURRENTCUCODE'
                    AND userlogintype = 'H'
                    AND banking_user_id = {$banking_user_id}; ";
          $user_rs = db_query($sql, $dbh);

          if (!$user_row = db_fetch_assoc($user_rs)) {

            header("Location: {$self}status=999");
            exit;
          }
        }


        // ** IF WE ARE HERE -- then we have successfully verified cuusers table
            // ** AND we have updated/inserted information into lnappuser
        // ** now we need to determine where to go

        $l_device_cookie_name = ReturnDeviceCookieName($DMSAPP_CURRENTCUCODE, DMSAPP_CONST_HB_LOGIN, trim($hb_row['email']), $user_row['userid']);
        $l_CookieVal = sha1($DMSAPP_SECRET_KEY . trim($user_row['pwd']) . trim($hb_row['email']) . trim($hb_row['confidence']) . trim($hb_row['user_id']));

        if ($form_code != 'hbssouser') {
          if ($l_CookieVal == $_COOKIE[$l_device_cookie_name]) {
            // ** Send to Password form, the Challenge was successful
            $FORM_SHOW = "passwd";
          } else {
            //** They must first pass the Challenge question
            $FORM_SHOW = "challenge";
            // Determine if we have already selected a challenge question

            if ($user_row['challenge_quest_id'] > 0) {
              $select_questid = $user_row['challenge_quest_id'];
            } else {

              // ** NO PREVIOUS CHALLENGE PICK A RANDOM
              // * First pick ONE of the multiple security questions this user
              // * may have
              $sql = "SELECT *
                      FROM cuquestselect as u_qs
                      JOIN {$DB_TABLE_PREFIX}user as u on u.cu = u_qs.cu AND u.user_name = u_qs.accountnumber
                      WHERE u.userid = " . intval($user_row['userid']) . "
                      ORDER BY RANDOM() LIMIT 1";

              $qst_rs = db_query($sql, $dbh);
              $qst_row = db_fetch_array($qst_rs);

              $select_questid = $qst_row['quest_id'];
              // ** INSERT THE QuestID as the question that must be answered
              $sql = "UPDATE {$DB_TABLE_PREFIX}user
                      SET challenge_quest_id = " . intval($select_questid) . "
                      WHERE userid = " . intval($user_row['userid']);

              if (!$upd_rs = db_query($sql, $dbh)) {
                // ** UNKNOWN ERROR BACK TO INTRO

                header("Location: {$self}f=intro&status=999");
                exit;
              }

              if (intval($select_questid) == 0) {
                header("Location: {$self}f=intro&status=7");
                exit;
              }
            }
          }
        } else {

          /*
           * Member is logging in from Home Banking..
           * In THIS CASE we will be setting the cookies for challenge questions and password
           */
          // ** Update the user table -- be sure the loginattempts are cleared
          $sql = "UPDATE {$DB_TABLE_PREFIX}user
                  SET failedloginattempts = 0
                  WHERE userid = " . intval($user_row['userid']) . " ";
          $exec_rs = db_query($sql, $dbh);

          // ** SET DEVICE COOKIE
          $pSessionCookie = hcu_array_key_value('chksecure', $loadedValues['lnapphbuser']) != "Y";
          SetLnappDeviceCookie($HB_ENV, $l_device_cookie_name, $l_CookieVal, $pSessionCookie);

          // ** SET THE PASSWORD COOKIE
          DMSAppSetCookie($HB_ENV, $user_row['userid'], DMSAPP_CONST_HB_LOGIN);

          // if changed from logintype "N" need to let user know to log in with home banking credentials in the future
          $showHBMessage = ( $user_row["userlogintype"] == "N" ) ? "&msg=You are now configured as a Home Banking user so use your Home Banking credentials when logging into the Loan App system in the future." : "";
          header("Location: {$self}f=portal$showHBMessage");
          exit;

        }
      } else {

        // * PROBLEM -- Force back to login screen
        header("Location: {$self}status=4&o=1");
        exit;
      }
    } else {
      // * PROBLEM -- Force back to login screen
      header("Location: {$self}status=4&o=2");
      exit;
    }
  } elseif (isset($_POST['hbconfchallenge'])) {

    /*
     * User Alias Changes
     *   IF the member is using a user alias, the string hbusername will actually
     *      contain the alias, however, the user_name saved in all tables is the
     *      actual member number
     *   So I will first check to see if the hbusername being posted is useralias
     *     then I will lookup in the cuuers table and return the user_name for
     *      processing in the other tables
     *
     */
    if (preg_match("/\D/", hcu_array_key_value('hbusername', $loadedValues['lnapphbuser']))) {
      // Perform a lookup in the cuusers table

      // ** Look up the user in the cuusers table -- from POSTED hbusername
      $sql = "SELECT cu, user_name, email, failedremain, passwd, confidence,
                user_alias
              FROM cuusers
              WHERE cu = '$DMSAPP_CURRENTCUCODE'
                AND user_alias ilike '" . save_text(hcu_array_key_value('hbusername', $loadedValues['lnapphbuser']), 50) . "' ";

      $hb_rs = db_query($sql, $dbh);
      $hb_row = db_fetch_assoc($hb_rs);

      if ($hb_row) {
        // * Have a value
        $postUsername = $hb_row['user_name'];
      }

      $dbFieldLen = 50;
    } else {
      // ** NOT USER ALIAS -- SET TO THE POSTED VALUE
      $postUsername = hcu_array_key_value('hbusername', $loadedValues['lnapphbuser']);
      $dbFieldLen = 12;
    }



    // ** They are on the challenge question and they just pressed
      // * submit.. need to confirm if the answer is correct.
    // * First get the challenge question
    $sql = "SELECT *
            FROM {$DB_TABLE_PREFIX}user
            WHERE cu = '{$DMSAPP_CURRENTCUCODE}'
              AND userlogintype = 'H'
              AND user_name = '" . save_text($postUsername, $dbFieldLen) . "' ";
    $user_rs = db_query($sql, $dbh);

    if ($user_row = db_fetch_assoc($user_rs)) {

      // * The challenge question
      $sql = "SELECT *
              FROM cuquestselect
              WHERE cu = '{$DMSAPP_CURRENTCUCODE}'
                AND accountnumber = '" . save_text($postUsername, $dbFieldLen) . "'
                AND quest_id = " . intval($user_row['challenge_quest_id']) . " ";

      $qst_rs = db_query($sql, $dbh);
      $qst_row = db_fetch_assoc($qst_rs);
      // ** NOW VALIDATE if the two options are the same

      if (strtolower(trim($_POST['chg_resp'])) == strtolower(trim($qst_row['answer'])) && strtolower(trim($qst_row['answer'])) != '') {
        // ** SUCCESS -- we next need to pass them on to the password phase

        // ** RESET THE challenge_quest_id
        $sql = "UPDATE {$DB_TABLE_PREFIX}user
                SET challenge_quest_id = -1
                WHERE userid = " . intval($user_row['userid']) . " ";
        $exec_rs = db_query($sql, $dbh);

        // ** SET COOKIE

        $user_device_cookiename = ReturnDeviceCookieName($DMSAPP_CURRENTCUCODE, DMSAPP_CONST_HB_LOGIN, trim($user_row['email']), $user_row['userid']);
        $setCookieVal = sha1($DMSAPP_SECRET_KEY . trim($user_row['pwd']) . trim($user_row['email']) . trim($user_row['confidenceword']) . trim($user_row['user_id']));

        $pSessionCookie = $_POST["chksecure"] != "Y";

        SetLnappDeviceCookie($HB_ENV, $user_device_cookiename, $setCookieVal, $pSessionCookie);

        // ** Show password screen
        $FORM_SHOW = "passwd";
      } else {
        // * PROBLEM -- Force WRONG ANSWER TO CHALLENGE questions -- back to login screen
        $sql = "UPDATE {$DB_TABLE_PREFIX}user
                SET failedloginattempts = failedloginattempts + 1
                WHERE
                  cu = '{$DMSAPP_CURRENTCUCODE}'
                    AND userlogintype = '" . DMSAPP_CONST_HB_LOGIN . "'
                    AND user_name = '" . save_text($postUsername, $dbFieldLen) . "' ";

        if (!$exec_rs = db_query($sql, $dbh)) {
          // * PROBLEM -- Force back to login screen -- UNKNOWN why can't insert
          header("Location: {$self}status=999");
          exit;
        }

        header("Location: {$self}status=5");
        exit;
      }
    } else {

      // * PROBLEM -- Force back to login screen
      header("Location: {$self}status=999");
      exit;
    }
  } elseif (isset($_POST['hbconfpassword'])) {

    if (preg_match("/\D/", hcu_array_key_value('hbusername', $loadedValues['lnapphbuser']))) {
      // username contains non-digits
      $userQueryField = "user_alias ilike '" . save_text(hcu_array_key_value('hbusername', $loadedValues['lnapphbuser']), 50) . "' ";
    } else {
      $userQueryField = "user_name = '" . save_text(hcu_array_key_value('hbusername', $loadedValues['lnapphbuser']), 12) . "' ";
    }

    // ** AUTHENTICATE THE PASSWORD
    $sql = "SELECT cu, user_name, email, failedremain, passwd, confidence
            FROM cuusers
            WHERE cu = '$DMSAPP_CURRENTCUCODE'
              AND {$userQueryField} ";

    $hb_rs = db_query($sql, $dbh);
    $hb_row = db_fetch_assoc($hb_rs);

    if ($hb_row) {

      $password = trim($_POST['hbloginpassword']);
      $savepass = $hb_row['passwd'];

      if ($savepass == crypt($password, $savepass)) {
        // ** successful login

        // * Fetch the UserId
        $sql = "SELECT *
                FROM {$DB_TABLE_PREFIX}user
                WHERE cu = '{$DMSAPP_CURRENTCUCODE}'
                  AND userlogintype = '" . DMSAPP_CONST_HB_LOGIN . "'
                  AND user_name = '" . save_text($hb_row['user_name'], 12) . "' ";
        $user_rs = db_query($sql, $dbh);
        if ($user_row = db_fetch_assoc($user_rs)) {

          // ** Update the user table
          $sql = "UPDATE {$DB_TABLE_PREFIX}user
                  SET failedloginattempts = 0
                  WHERE userid = " . intval($user_row['userid']) . " ";
          $exec_rs = db_query($sql, $dbh);

          // ** Create the user cookie
          DMSAppSetCookie($HB_ENV, $user_row['userid'], DMSAPP_CONST_HB_LOGIN);

          header("Location: {$self}f=portal");
          exit;

        } else {
          // ** Unable to find the user
          header("Location: {$self}status=4&o=3");
          exit;
        }
      } else {
        // ** ERROR WRONG PASSWORD
        // ** Increment failed login attempts

        $sql = "UPDATE {$DB_TABLE_PREFIX}user
                SET failedloginattempts = failedloginattempts + 1
                WHERE
                  cu = '{$DMSAPP_CURRENTCUCODE}'
                    AND userlogintype = '" . DMSAPP_CONST_HB_LOGIN . "'
                    AND user_name = '" . save_text($hb_row['user_name'], 12) . "' ";

        if (!$exec_rs = db_query($sql, $dbh)) {
          // * PROBLEM -- Force back to login screen -- UNKNOWN why can't insert
          header("Location: {$self}status=999");
          exit;
        }

        header("Location: {$self}status=6");
        exit;
      }
    } else {
      header("Location: {$self}status=4&o=4");
      exit;
    }
  }

  if (hcu_array_key_exists('hbusername', $loadedValues['lnapphbuser'])) {
    $form_hbuser = disp_text(hcu_array_key_value('hbusername', $loadedValues['lnapphbuser']));
  } elseif (isset($hb_row)) {
    // ** if using the values from hb_row,
      // ** use user_alias IF set, otherwise default to user_name
      // ** this is because we need to keep the check consistent

    $form_hbuser = disp_text(($hb_row['user_alias'] != '' ? $hb_row['user_alias'] : $hb_row['user_name']));

  }

  switch ($FORM_SHOW):
    case "challenge":


      $sql = "SELECT *
              FROM cuquestmaster
              WHERE quest_lang = 'en_US'
                AND quest_id = " . intval($select_questid) . "; ";
      $quest_rs = db_query($sql, $dbh);
      $quest_row = db_fetch_assoc($quest_rs);


      $challenge_quest_text = trim($quest_row['quest_text']);

      print <<< challenge_form
          <div id="summary-container" class="validity-summary-container errors" >
            <p><em>You may not continue. the following errors were encountered:</em></p>
              <ul>
                $FORM_VALIDATION_ERROR
              </ul>
          </div>
          <script language='javascript'>
            <!--
            function whatpub() {
              window.alert('Public computers are found at libraries, schools, Internet cafes, airports, and many other places. You have no control over who uses public computers. Public computers may be running malicious software like keystroke loggers or be on networks that allow others to get your personal information. We strongly suggest you do NOT use a public computer for home banking. If you decide to use one anyway, you should check the box so we do not save a security token to this public computer.');
            }
            // -->
          </script>
          <form id="app_settings" name="app_settings" action="{$self}f=hbuser" method="post">
            <input type="hidden" name="form_set" value="$form_code">
            <input type="hidden" name="loginemail" value="$l_email">
            <div id="">

                <div class='errors'>
                  We do not recognize the device you are using.<br>
                  Please confirm your identity.<br>Please answer the question below to confirm
                  your identity.
                </div>

              <div class="expandedform">
                <fieldset class='clearfix'>
                  <legend>Challenge Question</legend>
                  <div class='row'><label class='wide' for="chg_resp">$challenge_quest_text</label>
                  <input id="chg_resp" name="chg_resp" type="text" size="30" maxlength="100" class="text-input"/></div>

                  <div class='row'><label for='chksecureY'>This is my Personal or Business Computer<br>&nbsp;(Save security token on this computer)</label>
                    <input type='radio' id='chksecureY' name='chksecure' value='Y' checked/></div>
                  <div class='row'><label for='chksecureN'>This is a <a onClick='whatpub();'>Public Computer</a><br>&nbsp;(DO NOT Save security token on this computer)</label>
                    <input type='radio' id='chksecureN' name='chksecure' value='N' /></div>
                </fieldset>
              </div>
              <label class="submit">
                <input type="hidden" name="hbconfchallenge" value="Confirm Answer">
                <input type="hidden" name="hbusername" value="$form_hbuser">
                <a class="ovalbutton_blue navleft" href="#" style="margin-left: 6px" id='linkFormPost' label='Submit'><span>Confirm Answer</span></a>

              </label>
            </div>
            $form_pwd_script
            <script type="text/javascript">
              $(document).ready(function() {

                \$('#app_settings').bind("keydown", function(event) {
                  // track enter key
                  var keycode = (event.keyCode ? event.keyCode : (event.which ? event.which : event.charCode));
                  if (keycode == 13) { // keycode for enter key
                     // force the 'Enter Key' to implicitly click the Update button
                     \$('#app_settings').submit();
                     return false;
                  } else  {
                     return true;
                  }
                }); // end of function

                \$('#linkFormPost').click(function() {
                  \$("#app_settings").submit();
                });
                $('#chg_resp').focus();
              }); // end of document ready
            </script>

          </form>

challenge_form;


      break;
    case "passwd":

        $print_confword = "<label class='wide' for='chg_resp'>Confidence Word:</label><span class='bold'>" . disp_text($user_row['confidenceword']) . "</span></div>";
        print <<< password_form
            <div id="summary-container" class="validity-summary-container errors" >
              <p><em>You may not continue. the following errors were encountered:</em></p>
              <ul>
                $FORM_VALIDATION_ERROR
              </ul>
            </div>
            <form id="app_settings" name="app_settings" action="{$self}f=hbuser" method="post">
              <input type="hidden" name="form_set" value="$form_code">
              <input type="hidden" name="loginemail" value="$l_email">


              <div>
                <div class="expandedform">
                  <fieldset class='clearfix'>
                    <legend>Enter Password</legend>
                    <div class='row'>$print_confword
                    <label class='wide' for="hbloginpassword">Password:</label>
                    <input id="hbloginpassword" name="hbloginpassword" type="password" size="10" maxlength="15" class="text-input"/></div>
                  </fieldset>
                </div>
                <label class="submit">
                  <input type="hidden" name="hbconfpassword" value="Login">
                  <input type="hidden" name="hbusername" value="$form_hbuser">
                  <a class="ovalbutton_blue navleft" href="#" style="margin-left: 6px" id='linkFormPost' label='Submit'><span>Login</span></a>
                </label>
              </div>
              $form_pwd_script
              <script type="text/javascript">
                $(document).ready(function() {

                  \$('#app_settings').bind("keydown", function(event) {
                    // track enter key
                    var keycode = (event.keyCode ? event.keyCode : (event.which ? event.which : event.charCode));
                    if (keycode == 13) { // keycode for enter key
                       // force the 'Enter Key' to implicitly click the Update button
                       \$('#app_settings').submit();
                       return false;
                    } else  {
                       return true;
                    }
                  }); // end of function

                  \$('#linkFormPost').click(function() {
                    \$("#app_settings").submit();
                  });

                  $('#hbloginpassword').focus();
                }); // end of document ready
              </script>
            </form>

password_form;
        if ($FORM_VALIDATION_ERROR != '') {
         print "<script language='javascript'>$('#summary-container').css('display', 'inline-block');</script>";
       }


      break;
  endswitch;