lnappmiruser.i

<?php
/*
 * Ability to log in using MIR credentials (user is not home banking user but
 * is credit union member)
 *
 * The user will initially authenticate using credit union information obtained
 * with a MIR packet. Subsequent logins will be using the password stored in
 * the loan app system. A userlogintype of "N" is used to signify this type of
 * user.
 *
 * A new unique key will be added (email, cu, userlogintype, user_name)
 * It is unique to ensure data integrity.
 *
 * RULES FOR AUTHENTICATING USER
 *
 * There will be a challenge question cookie (machine cookie)
 * There will be an authentciated user cookie (user cookie)
 *
 * Too many failed attempts need to be added to the code, with admin able to
 * unlock
 *
 * 0. If in this function the user is of type "N" so don't bother checking the
 * cuusers table.
 *
 * 1. Get cu code for current session, this must be known
 *
 * 2. Get user login id.
 *
 * 3. Check the existence for cu/user_name/userlogintype='N' in lnappuser
 *    a. If FOUND --
 *      1. Verify the user password
 *        A. If found, insert lnappuser record, with cu, session_account, email
 * userlogintype='H'
 *        B. if NOT found -- return to main screen --- user NOT found
 *    b. if NOT found
 *      1. Gather information for MIR packet test
 *
 * 4. Machine Cookie Validation
 *    a. If machine cookie is found.. Validate that it is correct
 *    b. If machine cookie is NOT found OR is NOT correct
 *      1. Set a random value from the users challenge questsions in the
 *          challenge_quest_id.  This will can be done similar to how it is done
 *          already for loans
 *      2. Show the user the question and force them to answer.
 *        A. On a correct answer, save the Machine Cookie
 *        B. On an incorrect answer, set the failedloginattempts and keep
 * showing the same challenge question.
 *
 * 5. Password Validation -- after a machine cookie is set the password cookie
 *      will now need to be set
 *    a. Show a screen displaying their 'confidence' word and field to enter
 * password
 *      1. Upon submit validate the password.
 *        A. If SUCCESSFUL
 *          I. Create the user cookie and redirect to the Loan Application Main
 * Screen
 *        B. If NOT Successful
 *          I. Increment the failedloginattempts by 1 for this user record in
 * lnappuser
 *          II. Send the user back to the main entry screen with the message:
 * 'Unable to login, password incorrect.'
 *
 *
 * Validation
 *
 * Pieces of the User Cookie
 *
 * FORM VARIABLES
 * $FORM_SHOW -- What option will this form show
 *    challenge -- show the challenge question
 *    passwd    -- show the confidence/password screen
 *    validate  -- show info to validate using MIR packet
 *
*/

  $FORM_SHOW = "";
  $FORM_VALIDATION_ERROR = "";
  $mem_email = "";

  // ** IMPORT FORM VALUES
  $inputVars = array();
  $varOk = array(

  );

  HCU_ImportVars( $inputVars, "", $varOk );

  $userEmail = FILTER_INPUT(INPUT_POST, 'val_email', FILTER_SANITIZE_EMAIL);
  $cuserEmail = FILTER_INPUT(INPUT_POST, 'val_cemail', FILTER_SANITIZE_EMAIL);
  $userSSN = FILTER_INPUT(INPUT_POST, 'val_ssn',FILTER_SANITIZE_STRING);
  $userDOB = FILTER_INPUT(INPUT_POST, 'val_dob',FILTER_SANITIZE_STRING);
  $userPhone = FILTER_INPUT(INPUT_POST, 'val_phone',FILTER_SANITIZE_STRING);
  $form_hbuser = FILTER_INPUT(INPUT_POST, 'hbusername',FILTER_SANITIZE_STRING);

  /*
   * 12/09/2015 - Added logic to be able to log in and not be a home banking
   * user.
   * Need to check if home banking user, and then a CU member (what we call
   * Type "N")
   */

  if(isset($_POST['applogin']) || ($miruser_cookie_user && $DMSAPP_CURRENTUSERID > 0)) {

    // * we are posting from the intro screen
    // * validate the account(user_name) is entered
    if (isset($form_hbuser) || $DMSAPP_CURRENTUSERID > 0 ) {

      if (isset($form_hbuser) && trim($form_hbuser) !== '') {
        // determine if they are already a lnapp user
        $sql = "SELECT *
                FROM {$DB_TABLE_PREFIX}user
                WHERE cu = '$DMSAPP_CURRENTCUCODE'
                  AND userlogintype = 'N'
                  AND session_account = '" . save_text($form_hbuser, 12) . "' ";
        $user_rs = db_query($sql, $dbh);
        $user_row = db_fetch_assoc($user_rs);


        if ( !$user_row ) {
          // Didn't find them in the table, so need to validate to see if they are a MIR user
          if ( $DMSAPP_FETCHMIR ) {
            // add an entry to the table first
            $sql = "INSERT INTO {$DB_TABLE_PREFIX}user
                      (email, cu, failedloginattempts, challenge_quest_id, userlogintype, session_account, confidenceword)
                      VALUES
                      ('', '$DMSAPP_CURRENTCUCODE', 0, -1, 'N', '" . save_text($form_hbuser, 12) . "', '');";
            $sth = db_query($sql,$dbh);

            // read back the entry
            $sql = "SELECT *
                    FROM {$DB_TABLE_PREFIX}user
                    WHERE cu = '$DMSAPP_CURRENTCUCODE'
                      AND userlogintype = 'N'
                      AND session_account = '" . save_text($form_hbuser, 12) . "' ";
            $user_rs = db_query($sql, $dbh);
            $user_row = db_fetch_assoc($user_rs);

          } else {
            // shouldn't be here
            header("Location: {$self}f=intro&status=10");
            exit;
          }
        }
      } else {
        if ( $DMSAPP_LOGINTYPE == DMSAPP_CONST_MIR_LOGIN ) {
          // no home banking entry to check but get the user_row for later checking
          $sql = "SELECT *
                  FROM {$DB_TABLE_PREFIX}user
                  WHERE cu = '$DMSAPP_CURRENTCUCODE'
                    AND userid = '" . intval($DMSAPP_CURRENTUSERID) . "' ";
          $user_rs = db_query($sql, $dbh);
          $user_row = db_fetch_assoc($user_rs);
        } else {
          // shouldn't be here if not a MIR login
          header("Location: {$self}f=intro&status=999");
          exit;
        }
      }

      // if we don't have a user row we have a problem
      if ( !$user_row ) {
        header("Location: {$self}f=intro&status=999");
        exit;
      }

      // now need to figure out what is next based on:
      //  1. need to validate
      //  2. has challenge questions selected (this should be handled through lnappusermaint)
      //  3. has challenge answer cookie
      if ( !$user_row["pwd"] || !$user_row["email"] ) {
        $FORM_SHOW = "validate";
      } else {
        // make sure login attempts are not exceeded
        if (intval($user_row['failedloginattempts']) >= $DMSAPP_FAILEDLOGINATTEMPTS) {
          header("Location: {$self}f=intro&status=8");
          exit;
        }

        // MIR login type
        $l_device_cookie_name = ReturnDeviceCookieName($DMSAPP_CURRENTCUCODE, DMSAPP_CONST_MIR_LOGIN, trim($user_row['email']), $user_row['userid']);

        $l_CookieVal = sha1($DMSAPP_SECRET_KEY . trim($user_row['pwd']) . trim($user_row['email']) . trim($user_row['confidenceword']) . trim($user_row['session_account']));

        if (isset($_COOKIE[$l_device_cookie_name]) && ($l_CookieVal == $_COOKIE[$l_device_cookie_name])) {
          // ** Send to Password form, the Challenge was successful
          $FORM_SHOW = "passwd";
        } else {
          //** They must first pass the Challenge question
          $FORM_SHOW = "challenge";

          // set up some variables used below
          $member = $user_row["session_account"];
          $mem_email = $user_row["email"];

          // Determine if we have already selected a challenge question

          if ($user_row['challenge_quest_id'] > 0) {
            $select_questid = $user_row['challenge_quest_id'];
          } else {

            // ** NO PREVIOUS CHALLENGE PICK A RANDOM
            // * First pick ONE of the multiple security questions this user
            // * may have
            $sql = "SELECT u_qs.*
                    FROM lnappuser_questselect as u_qs
                    JOIN {$DB_TABLE_PREFIX}user as u on u.userid = u_qs.userid
                    WHERE u.userid = " . intval($user_row['userid']) . "
                    ORDER BY RANDOM() LIMIT 1";
            $qst_rs = db_query($sql, $dbh);
            $qst_row = db_fetch_array($qst_rs);

            $select_questid = $qst_row['questid'];

            if (intval($select_questid) == 0) {
              // no questions set up, so authenticate first and then get questions set up
              $FORM_SHOW = "passwd";
            } else {
              // ** INSERT THE QuestID as the question that must be answered
              $sql = "UPDATE {$DB_TABLE_PREFIX}user
                      SET challenge_quest_id = " . intval($select_questid) . "
                      WHERE userid = " . intval($user_row['userid']);

              if (!$upd_rs = db_query($sql, $dbh)) {
                // ** UNKNOWN ERROR BACK TO INTRO
                header("Location: {$self}f=intro&status=999");
                exit;
              }
            }
          }
        }
      }
    } else {
      // * PROBLEM -- Force back to login screen
      header("Location: {$self}status=4&o=2");
      exit;
    }
  } elseif (isset($_POST['mirconfchallenge'])) {
    /*
     * We should never get a user alias with a MIR user.
     */
    $postUsername = $form_hbuser;

    // ** They are on the challenge question and they just pressed
      // * submit.. need to confirm if the answer is correct.
    // * First get the challenge question
    $sql = "SELECT *
            FROM {$DB_TABLE_PREFIX}user
            WHERE cu = '{$DMSAPP_CURRENTCUCODE}'
              AND userlogintype = 'N'
              AND session_account = '" . save_text($postUsername, 12) . "' ";
    $user_rs = db_query($sql, $dbh);

    if ($user_row = db_fetch_assoc($user_rs)) {

      // * The challenge question
      $sql = "SELECT *
              FROM lnappuser_questselect
              WHERE userid = {$user_row["userid"]}
                AND questid = " . intval($user_row['challenge_quest_id']) . " ";

      $qst_rs = db_query($sql, $dbh);
      $qst_row = db_fetch_assoc($qst_rs);
      // ** NOW VALIDATE if the two options are the same
      if (strtolower(trim($_POST['chg_resp'])) == strtolower(trim($qst_row['user_answer'])) && strtolower(trim($qst_row['user_answer'])) != '') {
        // ** RESET THE challenge_quest_id
        $sql = "UPDATE {$DB_TABLE_PREFIX}user
                SET challenge_quest_id = -1
                WHERE userid = " . intval($user_row['userid']) . " ";
        $exec_rs = db_query($sql, $dbh);

        // ** SET COOKIE
        $user_device_cookiename = ReturnDeviceCookieName($DMSAPP_CURRENTCUCODE, DMSAPP_CONST_MIR_LOGIN, trim($user_row['email']), $user_row['userid']);

        $setCookieVal = sha1($DMSAPP_SECRET_KEY . trim($user_row['pwd']) . trim($user_row['email']) . trim($user_row['confidenceword']) . trim($user_row['session_account']));

        $pSessionCookie = $_POST["chksecure"] != "Y";

        SetLnappDeviceCookie($HB_ENV, $user_device_cookiename, $setCookieVal, $pSessionCookie);
        // ** Show password screen
        $FORM_SHOW = "passwd";
      } else {
        // * PROBLEM -- Force WRONG ANSWER TO CHALLENGE questions -- back to login screen
        $sql = "UPDATE {$DB_TABLE_PREFIX}user
                SET failedloginattempts = failedloginattempts + 1
                WHERE userid = {$user_row["userid"]}";

        if (!$exec_rs = db_query($sql, $dbh)) {
          // * PROBLEM -- Force back to login screen -- UNKNOWN why can't insert
          header("Location: {$self}status=999");
          exit;
        }

        header("Location: {$self}status=5");
        exit;
      }
    } else {
      // * PROBLEM -- Force back to login screen
      header("Location: {$self}status=999");
      exit;
    }
  } elseif (isset($_POST['hbvalidate'])) {
    // need to validate against a MIR packet

    // make sure MIR validation is enabled
    if ( $DMSAPP_FETCHMIR ) {
      // validate the password
      $mpmsg = "";

      if ($_POST['val_pwd'] <> $_POST['val_conf']) {
        // ** PWD ERROR -- DO NOT MATCH
        $mpmsg .= "&nbsp; The new passwords do not match<br>";
      }

      $passwordNew = $_POST['val_pwd'];
      $passwordConf = $_POST['val_conf'];

      if (key_exists("configPassword", $configOptions)) {
        $pwdRules = json_decode($configOptions['configPassword'], true);
      } else {
        $pwdRules["len"] = 8;
        $pwdRules["upper"] = 1;
        $pwdRules["lower"] = 1;
        $pwdRules["spec"] = 0;
        $pwdRules["digit"] = 1;
      }

      if ( strlen($passwordNew) < $pwdRules["len"] ) {
        $mpmsg .= "&nbsp; Password is too short<br>";
      }
      if ( strlen($passwordNew) > 20 ) {
        $mpmsg .= "&nbsp; Password is too long<br>";
      }
      $numDigitCount = 0;
      $numUpperCharCount = 0;
      $numLowerCharCount = 0;
      $numSpecialCharCount = 0;
      $passSpecial = Get_PwdSpecialCharacters();
      $notAllowedCount = 0;
      for ( $i = 0; $i < strlen( $passwordNew ); $i++ )
      {
        $ch = substr( $passwordNew, $i, 1 );
        if ($ch >= '0' && $ch <= '9') { $numDigitCount++; }
        else if ($ch >= 'A' && $ch <= 'Z') { $numUpperCharCount++; }
        else if ($ch >= 'a' && $ch <= 'z') { $numLowerCharCount++; }
        else if ( $ch != ',' && strpos( $passSpecial, $ch ) >= 0 ) { $numSpecialCharCount++; }
        else { $notAllowedCount++; }
      }
      if ( $pwdRules["upper"] > 0 && $numUpperCharCount < $pwdRules["upper"] )
      {
        $plural = $pwdRules["upper"] > 1 ? 's' : '';
        $mpmsg .= "&nbsp; Need at least {$pwdRules["upper"]} UPPER CASE letter$plural<br>";
      }
      if ( $pwdRules["lower"] > 0 && $numLowerCharCount < $pwdRules["lower"] )
      {
        $plural = $pwdRules["lower"] > 1 ? 's' : '';
        $mpmsg .= "&nbsp; Need at least {$pwdRules["lower"]} lower case letter$plural<br>";
      }
      if ( $pwdRules["spec"] > 0 && $numSpecialCharCount < $pwdRules["spec"] )
      {
        $plural = $pwdRules["spec"] > 1 ? 's' : '';
        $mbmsg .= "&nbsp; Need at least {$pwdRules["spec"]} special character$plural<br>";
      }
      if ( $pwdRules["digit"] > 0 && $numDigitCount < $pwdRules["digit"] )
      {
        $plural = $pwdRules["digit"] > 1 ? 's' : '';
        $mpmsg .= "&nbsp; Need at least {$pwdRules["digit"]} digit$plural<br>";
      }

      if ( $mpmsg === "" ) {
        // validate the inputs
        $msg = "";

        //validate if emails match
        if (trim($userEmail) <> trim($cuserEmail)) {
          // ** EMAIL ERROR -- DO NOT MATCH
          $mpmsg .= "&nbsp; The emails do not match<br>";
        }

        if (trim($form_hbuser) == "") {
          $msg .= "&nbsp; Member number missing<br>";
        } else if (!is_numeric($form_hbuser)) {
          $msg .= "&nbsp; Invalid member number <br>";
        } else {
          $member = $form_hbuser;
        }

        if (trim($userEmail) == "") {
          $msg .= "&nbsp; Email missing <br>";
        } else if (!validateEmail($userEmail)) {
          $msg .= "&nbsp; Email appears invalid <br>";
        }

        if (trim($userSSN) == "") {
          $msg .= "&nbsp; Member last four SSN missing<br>";
        } else if (!is_numeric($userSSN)) {
          $msg .= "&nbsp; Invalid member SSN number <br>";
        }

        if (trim($userDOB) == "") {
          $msg .= "&nbsp; Member date of birth missing<br>";
        } else {
          $parts = explode( "/", $userDOB);
          if (count($parts) != 3 || !is_numeric($parts[0]) || !is_numeric($parts[1]) || !is_numeric($parts[2]) ) {
            $msg .= "&nbsp; Invalid member date of birth <br>";
          }
        }

        if (trim($userPhone) == "") {
          $msg .= "&nbsp; Member phone missing<br>";
        } else {
          $parts = explode( "-", $userPhone);
          if (count($parts) != 3 || !is_numeric($parts[0]) || !is_numeric($parts[1]) || !is_numeric($parts[2]) ) {
            $msg .= "&nbsp; Invalid member phone number <br>";
          }
        }

        if ( $msg == "" ) {

          $memberData = [
            'member' => $member,
            'type' => 'PACKET_REQUEST_MIR'
          ];
          // see if the core can provide a MIR packet
          $MIR = GetMemberInfo($HB_ENV, $memberData);
          $statcode = $MIR["code"];

          if ($statcode == '000') {
            # if response is 000, enter a partial entry into the lnappuser table
            $sql1 = "select * from {$DB_TABLE_PREFIX}user
                    where cu='{$DMSAPP_CURRENTCUCODE}' and session_account ='$member'";
            $sth = db_query($sql1,$dbh);

            if ( db_num_rows($sth) == 0 ) {
              $sql = "INSERT INTO {$DB_TABLE_PREFIX}user
                        (email, cu, failedloginattempts, challenge_quest_id, userlogintype, session_account, confidenceword)
                        VALUES
                        ('" . save_text($userEmail, 50) . "', '$DMSAPP_CURRENTCUCODE', 0, -1,
                          'N', '" . save_text($member, 12) . "', '');";
              $sth = db_query($sql,$dbh);
              if ($sth) {
                db_free_result($sth);
              } else {
                # something went wrong trying to update the database
                $msg .= "&nbsp; Error Occurred updating settings.<br>";
                # should fall through to initial screen w/ message showing
              }
            }

            // now validate the parameters
            $validTests = true;
            $validMsg = '';

            // last 4 of SSN
            $testSSN = substr( $MIR["data"]["ssn"], -4 );
            if ( $validTests && $testSSN != $userSSN ) {
              $validTests = false;
              $validMsg = 'SSN does not match.';
            }

            // birth date - will always come back as mm/dd/yyyy; always get into yyyymmdd format)
            // NOTE: this allows /,-,., and <space> for delimiters
            $validDate = false;
            if ( preg_match( "/^\\d{2}[-\/]\\d{2}[-\/]\\d{4}$/", $MIR["data"]["dob"] ) ) {
              // mm/dd/yyyy
              $testDateParts = explode( "/", $MIR["data"]["dob"]);
              $testDate = $testDateParts[0] . $testDateParts[1] . $testDateParts[2];
              $validDate = true;
            }

            if ($validDate) {
              // member entered date will always be mm/dd/yyyy
              $testDOBParts = explode( "/", $userDOB );
              $testDOB = $testDOBParts[0] . $testDOBParts[1] . $testDOBParts[2];
              if ( $validTests && $testDOB != $testDate ) {
                $validTests = false;
                $validMsg = 'DOB does not match.';
              }
            } else {
              $validTests = false;
              $validMsg = 'DOB is not valid.';
            }

            // email
            $testEmail = trim( $MIR["data"]["email"] );
            if ( $validTests && strcasecmp( $userEmail, $testEmail ) != 0 ) {
              // NOTE: Not requiring email as part of validation because it is often wrong or missing on core system
              //   but we still require it because it is used for Home Banking
              // $validTests = false;
            }

            // custom1 = numeric portion of address - only test if exists
            /*
            if ( strlen( $custom1 ) > 0 ) {
              $test4 = preg_replace("/[^0-9]/", '', $MIR["info"]["Address1"]);
              if ( $validTests && $test4 != $custom1 ) {
                $validTests = false;
              }
            }
            */

            // home phone number (but still check cell if home phone fails) - only test if exists
            if ( strlen( $userPhone ) > 0 ) {
              $testPhone_1 = preg_replace("/[^0-9]/", '', $MIR["data"]["homephone"]);
              $testPhone = preg_replace("/[^0-9]/", '', $userPhone);
              if ( $validTests ) {
                if ( $testPhone_1 != $testPhone ) {
                  // test the cell phone, too, just in case
                  $testPhone_2 = preg_replace("/[^0-9]/", '', $MIR["data"]["cellphone"]);
                  if ( $testPhone_2 != $testPhone ) {
                    $validTests = false;
                    $validMsg = 'Phone number does not match.';
                  }
                }
              }
            }

            if ( $validTests ) {
              // if response is 000, enter a partial entry into the lnappuser table
              $sql1 = "select * from {$DB_TABLE_PREFIX}user
                      where cu='{$DMSAPP_CURRENTCUCODE}' and session_account ='$member'";
              $sth = db_query($sql1,$dbh);

              // add the password
              // $pwdCrypt = crypt( $passwordNew );
              $pwdCrypt = password_hash($passwordNew, PASSWORD_DEFAULT);

              if ( db_num_rows($sth) == 0 ) {
                $sql = "INSERT INTO {$DB_TABLE_PREFIX}user
                          (email, pwd, cu, failedloginattempts, challenge_quest_id, userlogintype, session_account, confidenceword)
                          VALUES
                          ('" . save_text($userEmail, 50) . "', '$pwdCrypt', '$DMSAPP_CURRENTCUCODE', 0, -1,
                            'N', '" . save_text($member, 12) . "', '');";
              } else {
                $sql = "UPDATE {$DB_TABLE_PREFIX}user
                        SET failedloginattempts = 0,
                            email = '" . save_text($userEmail, 50) . "',
                            pwd = '$pwdCrypt'
                        WHERE session_account = '$member' ";
              }

              $sth = db_query($sql,$dbh);
              if ($sth) {
                db_free_result($sth);
                // at this point we have authenticated and set up a password; now do the challenge questions
                // Do this by setting up a form and submitting it so it looks like we came in from existing logic
                $FORM_SHOW = "set_challenge";
              } else {
                # something went wrong trying to update the database
                $msg .= "Error Occurred updating settings.<br>";
                # should fall through to initial screen w/ message showing

                $FORM_SHOW = "validate";
              }
            } else {
              $msg .= "&nbsp; Authentication Failed: " . $validMsg ."<br>";

              $sql = "UPDATE {$DB_TABLE_PREFIX}user
                      SET failedloginattempts = failedloginattempts + 1
                      WHERE userid = " . intval($member) . " ";
              $sth = db_query($sql,$dbh);

              $FORM_VALIDATION_ERROR = $msg;
              $FORM_SHOW = "validate";
            }
          } else {
            // status response was something other than 101
            $msg .= "&nbsp; Unable to activate account.<br>";

            // don't give any detailed info as to what failed
            if ($statcode == '001') {
              $msg .= "&nbsp; Authentication Failed.<br>";
            }

        // fall through to print screen with error
        // print "$sql\n";
            $FORM_VALIDATION_ERROR = $msg;
            $FORM_SHOW = "validate";
          }
        } else {
          $FORM_VALIDATION_ERROR = $msg;
          $FORM_SHOW = "validate";
        }
      } else {
        $FORM_VALIDATION_ERROR = $mpmsg;
        $FORM_SHOW = "validate";
      }
    } else {
      // * PROBLEM -- Force back to login screen
      header("Location: {$self}status=999");
      exit;
    }

  } elseif (isset($_POST['mirconfpassword'])) {
    // first check what type of user this may be
    $sql = "SELECT *
            FROM {$DB_TABLE_PREFIX}user
            WHERE cu = '{$DMSAPP_CURRENTCUCODE}'
              AND session_account = '" . save_text($form_hbuser, 12) . "' ";
    $user_rs = db_query($sql, $dbh);

    if ($user_row = db_fetch_assoc($user_rs)) {
      if ( $user_row["userlogintype"] == "N" ) {
        // ** AUTHENTICATE THE PASSWORD
        $password = trim($_POST['hbloginpassword']);
        $savepass = $user_row['pwd'];

        if ($savepass == crypt($password, $savepass)) {
          // ** successful login

          // ** Update the user table
          $sql = "UPDATE {$DB_TABLE_PREFIX}user
                  SET failedloginattempts = 0
                  WHERE userid = " . intval($user_row['userid']) . " ";
          $exec_rs = db_query($sql, $dbh);

          // ** Create the user cookie
          DMSAppSetCookie($HB_ENV, $user_row['userid'], DMSAPP_CONST_MIR_LOGIN);

          // see if have challenge questions or confidence word set up yet
          if ( $user_row["confidenceword"] == "" ) {
            // Do this by setting up a form and submitting it so it looks like we came in from existing logic
            $FORM_SHOW = "set_challenge";
            $member = $user_row["session_account"];
          } else {
            // See if the challenge questions have been set up or not
            $sql = "SELECT count(*) as count
                    FROM lnappuser_questselect
                    WHERE userid = " . intval($user_row['userid']);
            $qst_rs = db_query($sql, $dbh);
            $qst_row = db_fetch_assoc($qst_rs);

            if ( !$qst_row["count"]) {
              $FORM_SHOW = "set_challenge";
              $member = $user_row["session_account"];
            } else {
              header("Location: {$self}f=portal");
              exit;
            }
          }
        } else {
          // ** ERROR WRONG PASSWORD
          // ** Increment failed login attempts

          $sql = "UPDATE {$DB_TABLE_PREFIX}user
                  SET failedloginattempts = failedloginattempts + 1
                  WHERE userid = " . intval($user_row['userid']) . " ";

          if (!$exec_rs = db_query($sql, $dbh)) {
            // * PROBLEM -- Force back to login screen -- UNKNOWN why can't insert
            header("Location: {$self}status=999");
            exit;
          }

          header("Location: {$self}status=6");
          exit;
        }

      } else {
        // shouldn't be here if a MIR user
        header("Location: {$self}status=999");
        exit;
      }
    } else {
      // ** Unable to find the user
      header("Location: {$self}status=4&o=3");
      exit;
    }
  }

  if (isset($form_hbuser)) {
    $form_hbuser = disp_text($form_hbuser);
  } elseif (isset($hb_row)) {
    // ** if using the values from hb_row,
      // ** use user_alias IF set, otherwise default to user_name
      // ** this is because we need to keep the check consistent

    $form_hbuser = disp_text(($hb_row['user_alias'] != '' ? $hb_row['user_alias'] : $hb_row['session_account']));

  }


  switch ($FORM_SHOW):
    case "challenge":

      // ** First Check to see if device is NOT SET
      $form_pwd_script = "
      <script>
        " . ($FORM_VALIDATION_ERROR != "" ? "$('#summary-container').css('display', 'inline-block');" : "") . "
      </script> ";

      $sql = "SELECT *
              FROM cuquestmaster
              WHERE quest_lang = 'en_US'
                AND quest_id = " . intval($select_questid) . "; ";
      $quest_rs = db_query($sql, $dbh);
      $quest_row = db_fetch_assoc($quest_rs);

      $challenge_quest_text = trim($quest_row['quest_text']);

print <<< challenge_form
      <div class="container-fluid">
        <div class="row">
          <div class="lnapp-form-section lnapp-summary-wrap col-xs-12 col-md-offset-3 col-md-6">
            <div id="summary-container" class="validity-summary-container errors" >
              <div class="alert alert-danger">
                <p><em>You may not continue. the following errors were encountered:</em></p>
                  <ul>
                    $FORM_VALIDATION_ERROR
                  </ul>
              </div>
          </div>
        </div>
      </div>

      <form id="app_settings" name="app_settings" action="{$self}f=miruser" method="post">
      <input type="hidden" name="form_set" value="$form_code">
      <input type="hidden" name="loginemail" value="$mem_email">
      <input type="hidden" name="hbusername" value="$form_hbuser">

      <div class="row">
      <div class="col-xs-12 col-md-offset-3 col-md-6">

        <div class="alert alert-warning" role="alert">
          <strong>We do not recognize the device you are using.</strong><br>
          Please answer the question below to confirm your identity.
        </div>

        <div class="panel panel-default">
          <div class="panel-heading">
            <h2 class="panel-title">Challenge Question</h2>
          </div>
          <div class="panel-body">
            <div class="form-horizontal">
              <div class="form-group">
                <label class='col-xs-12' for="chg_resp">$challenge_quest_text</label>
                <div class="col-xs-12">
                  <input id="chg_resp" class="form-control" name="chg_resp" type="text" size="30" maxlength="100" class="text-input" />
                </div>
              </div>

              <div class="form-group">
              <div class="col-xs-12">
                <div class="radio">
                  <label>
                    <input type='radio' id='chksecureY' name='chksecure' value='Y' checked/>
                    Yes, remember it
                  </label>
                  <br/>
                  <small>
                    <em>
                      For your convenience, we will not require additional authentication when you log in from this device.
                      We may occasionally require additional authentication to make sure you still want the system to recognize this device.
                    </em>
                  </small>
                </div>
              </div>
              <div class="col-xs-12">
                <div class="radio">
                  <label>
                    <input type='radio' id='chksecureN' name='chksecure' value='N' />
                    No, do not remember it
                  </label>
                  <br/>
                  <small>
                    <em>
                      We will continue to require additional authentication whenever you log in from this device.
                    </em>
                  </small>
                </div>
              </div>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div>
  <div class="row">
    <div class="col-xs-12 col-md-offset-3 col-md-6">

      <input type="hidden" name="mirconfchallenge" value="Confirm Answer">
      <a class="k-button k-primary" href="#" id='linkFormPost' label='Submit'><span>Confirm Answer</span></a>


    </div>
  </div>


            $form_pwd_script
            <script type="text/javascript">
              $(document).ready(function() {

                \$('#app_settings').bind("keydown", function(event) {
                  // track enter key
                  var keycode = (event.keyCode ? event.keyCode : (event.which ? event.which : event.charCode));
                  if (keycode == 13) { // keycode for enter key
                     // force the 'Enter Key' to implicitly click the Update button
                     \$('#app_settings').submit();
                     return false;
                  } else  {
                     return true;
                  }
                }); // end of function

                \$('#linkFormPost').click(function() {
                  \$("#app_settings").submit();
                });
                $('#chg_resp').focus();
              }); // end of document ready
            </script>

          </form>
          </div>

challenge_form;

      break;
    case "validate":
      // this path is to gather info that can be validated against a MIR packet

      // build up the password requirements message
      if (key_exists("configPassword", $configOptions)) {
        $pwdRules = json_decode($configOptions['configPassword'], true);
      } else {
        $pwdRules["len"] = 8;
        $pwdRules["upper"] = 1;
        $pwdRules["lower"] = 1;
        $pwdRules["spec"] = 0;
        $pwdRules["digit"] = 1;
      }

      $passwordRequirements = "";
      $passwordRequirements .= "&bull; At least {$pwdRules["len"]} characters<br>";
      if ( $pwdRules["upper"] > 0 ) {
        $plural = $pwdRules["upper"] > 1 ? "s" : "";
        $passwordRequirements .= "&bull; At least {$pwdRules["upper"]} UPPER CASE character$plural<br>";
      }
      if ( $pwdRules["lower"] > 0 ) {
        $plural = $pwdRules["lower"] > 1 ? "s" : "";
        $passwordRequirements .= "&bull; At least {$pwdRules["lower"]} lower case character$plural<br>";
      }
      if ( $pwdRules["spec"] > 0 ) {
        $specialCharList = Get_PwdSpecialCharacters();
        $plural = $pwdRules["spec"] > 1 ? "s" : "";
        $passwordRequirements .= "&bull; At least {$pwdRules["spec"]} special character$plural ($specialCharList)<br>";
      }
      if ( $pwdRules["digit"] > 0 ) {
        $plural = $pwdRules["digit"] > 1 ? "s" : "";
        $passwordRequirements .= "&bull; At least {$pwdRules["digit"]} digit$plural<br>";
      }

      print <<< validate_form
      <style>
        .alert {display: inline-block; float:none}
        .btn {display: inline-block !important; min-width: 200px !important}
        @media only screen and (max-width: 479px) {
          .btn {
            width: -webkit-fill-available;
            margin-bottom: 5px;
          }
        }
      </style>
          <div class="container-fluid">
            <div class="row">
              <div class="lnapp-form-section lnapp-summary-wrap col-xs-12 col-md-offset-3 col-md-6">
                <div id="summary-container" class="validity-summary-container errors" >
                  <div class="alert alert-danger">
                    <p><em>You may not continue. the following errors were encountered:</em></p>
                      <ul>
                        $FORM_VALIDATION_ERROR
                      </ul>
                  </div>
                </div>
              </div>
            </div>

          <form id="app_settings" name="app_settings" action="{$self}f=miruser" method="post">
            <input type="hidden" name="form_set" value="$form_code">
            <input type="hidden" name="hbusername" value="$form_hbuser">

            <div class="row">
              <div class="col-xs-12 col-md-offset-3 col-md-6">
                <div class="alert alert-warning" role="alert">
                  <strong>We have not found a record of you using the loan application before.</strong><br>
                  Please confirm your identity by entering the information below.
                </div>

                <div class="panel panel-default">
                  <div class="panel-heading">
                    <h2 class="panel-title">Member Information</h2>
                  </div>
                  <div class="panel-body">
                    <div class="form-horizontal">
                      <div class="form-group">
                        <label class='col-xs-12' for="val_member">Member Account Number</label>
                        <div class="col-xs-12">
                          <input id="val_member" name="val_member" type="text" size="30" maxlength="100" class="form-control" value="$form_hbuser" disabled />
                        </div>
                      </div>
                      <div class="form-group">
                        <label class='col-xs-12' for="val_email">Email Address</label>
                        <div class="col-xs-12">
                          <input id="val_email" name="val_email" type="email" size="30" maxlength="100" class="form-control emails email k-textbox hcu-all-100"
                          value="{$userEmail}" />
                        </div>
                      </div>
                      <div class="form-group">
                        <label class='col-xs-12' for="val_cemail">Confirm Email Address</label>
                        <div class="col-xs-12">
                          <input id="val_cemail" name="val_cemail" type="email" size="30" maxlength="100" class="form-control emailconf emails k-textbox hcu-all-100" value="$cuserEmail" />
                        </div>
                      </div>
                      <div class="form-group">
                        <label class='col-xs-12' for="val_ssn">Last 4 of SSN</label>
                        <div class="col-xs-12">
                          <input id="val_ssn" name="val_ssn" type="text" size="30" maxlength="4" class="form-control k-textbox hcu-all-100"
                          value="{$userSSN}" />
                        </div>
                      </div>
                      <div class="form-group">
                        <label class='col-xs-12' for="val_dob">Birth Date</label>
                        <div class="col-xs-12">
                          <input id="val_dob" name="val_dob" type="text" size="30" maxlength="10" class="form-control k-textbox hcu-all-100"
                          value="{$userDOB}" placeholder="mm/dd/yyyy" />
                        </div>
                      </div>
                      <div class="form-group">
                        <label class='col-xs-12' for="val_phone">Home Phone</label>
                        <div class="col-xs-12">
                          <input id="val_phone" name="val_phone" type="tel" size="30" maxlength="12" class="form-control k-textbox hcu-all-100"
                          value="{$userPhone}" placeholder="555-555-5555" />
                        </div>
                      </div>
                      <div class="row">
                        <div class="col-xs-12 col-sm-6">
                          <div class="form-group">
                            <label class='col-xs-12' for="val_pwd">Password</label>
                            <div class="col-xs-12">
                              <input id="val_pwd" name="val_pwd" type="password" size="30" maxlength="20" class="form-control password passwords k-textbox hcu-all-100" value="" placeholder="Enter Password" />
                            </div>
                          </div>
                          <div class="form-group">
                            <label class='col-xs-12' for="val_conf">Confirm Password</label>
                            <div class="col-xs-12">
                              <input id="val_conf" name="val_conf" type="password" size="30" maxlength="20" class="form-control passwords passwordconf k-textbox hcu-all-100" value="" placeholder="Confirm Password" />
                            </div>
                          </div>
                        </div>
                        <div class="col-xs-12 col-sm-6">
                          <div class="alert alert-info">
                            <label class='col-xs-12' for="pwdreq"
                            style="color:red;">Password Requirements</label>
                            <div class="col-xs-12">
                              <span id="pwdreq">$passwordRequirements</span>
                            </div>
                          </div>
                        </div>
                      </div>
                      <div class="row">
                        <div class="col-xs-12 col-sm-12">
                          <input type="hidden" name="hbvalidate" value="Submit">
                          <button class="btn btn-primary" id="linkFormPost" type="submit">Confirm Membership</button>
                          <a class="btn btn-primary" href="{$self}" role="button">Back</a>
                        </div>
                      </div>
                  </div>
                </div>
            </div>
            <script type="text/javascript">
              $(document).ready(function() {

                \$('#app_settings').bind("keydown", function(event) {
                  // track enter key
                  var keycode = (event.keyCode ? event.keyCode : (event.which ? event.which : event.charCode));
                  if (keycode == 13) { // keycode for enter key
                     // force the 'Enter Key' to implicitly click the Update button
                     \$('#app_settings').submit();
                     return false;
                  } else  {
                     return true;
                  }
                }); // end of function


                $('#chg_resp').focus();

              }); // end of document ready
            </script>

          </form>

validate_form;
       if ($FORM_VALIDATION_ERROR != '') {
         print "<script language='javascript'>$('#summary-container').css('display', 'inline-block');</script>";
       }

      break;
    case "set_challenge":
      ?>
        <form id="newlogin" name="newlogin" method="post" action="<?php echo $self; ?>f=newmiruser">
        <input type="hidden" name="f" value="newmiruser">
        <input type="hidden" name="member" value="<?php echo $member ?>">
        </form>
        <script type="text/javascript">
          $(document).ready(function() {
            $('#newlogin').submit();
          });
        </script>

      <?php
      break;
    case "passwd":

        // ** First Check to see if device is NOT SET
        $form_pwd_script = "
        <script>
          " . ($FORM_VALIDATION_ERROR != "" ? "$('#summary-container').css('display', 'inline-block');" : "") . "
        </script> ";

        if (isset($user_row["confidenceword"])) {
          $confWord = "" . disp_text($user_row['confidenceword']);
        } else {
          $confWord = "&lt;Not Set&gt;";
        }

        $print_confword = "<label class='col-xs-12' for='chg_resp'>Confidence Word:</label><div class='col-xs-12'><input id='chg_resp' class='form-control' name='chg_resp' type='text' size='30' maxlength='100' class='text-input' value='$confWord' disabled/></div>";

        print <<< password_form

        <div class="container-fluid">
        <div class="row">
          <div class="lnapp-form-section lnapp-summary-wrap col-xs-12 col-md-offset-3 col-md-6">
            <div id="summary-container" class="validity-summary-container errors" >
              <div class="alert alert-danger">
                <p><em>You may not continue. the following errors were encountered:</em></p>
                  <ul>
                    $FORM_VALIDATION_ERROR
                  </ul>
              </div>
          </div>
        </div>
        </div>

        <form id="app_settings" name="app_settings" action="{$self}f=miruser" method="post">
          <input type="hidden" name="form_set" value="miruser">

          <div class="row">
          <div class="col-xs-12 col-md-offset-3 col-md-6">

            <div class="panel panel-default">
              <div class="panel-heading">
                <h2 class="panel-title">Enter Password</h2>
              </div>

              <div class="panel-body">
                <div class="form-horizontal">
                  <div class="form-group">
                    $print_confword
                  </div>
                  <div class="form-group">
                    <label class='col-xs-12' for="hbloginpassword">Password:</label>
                    <div class="col-xs-12">
                      <input id="hbloginpassword" name="hbloginpassword" type="password" size="30" maxlength="100" class="form-control"/>
                    </div>
                  </div>

                  <div class="row">
                    <div class="col-xs-12 col-sm-6">
                      <input type="hidden" name="mirconfpassword" value="Login">
                      <input type="hidden" name="hbusername" value="$form_hbuser">
                      <a class="k-button k-primary" href="#" id='linkFormPost' label='Submit'><span>Login</span></a>
                    </div>
                  </div>

                  $form_pwd_script
                  <script type="text/javascript">
                  $(document).ready(function() {

                    \$('#app_settings').bind("keydown", function(event) {
                    // track enter key
                    var keycode = (event.keyCode ? event.keyCode : (event.which ? event.which : event.charCode));
                    if (keycode == 13) { // keycode for enter key
                       // force the 'Enter Key' to implicitly click the Update button
                       \$('#app_settings').submit();
                       return false;
                    } else  {
                       return true;
                    }
                  }); // end of function

                  \$('#linkFormPost').click(function() {
                    \$("#app_settings").submit();
                  });

                  $('#hbloginpassword').focus();
                  }); // end of document ready
                  </script>

                </div>
              </div>
            </div>
          </div>
        </div>
      </form>

password_form;
        if ($FORM_VALIDATION_ERROR != '') {
         print "<script language='javascript'>$('#summary-container').css('display', 'inline-block');</script>";
       }


      break;
  endswitch;
?>

<script type="text/javascript">

    $.validity.setup({ outputMode:"summary" });
    $.validity.setup({ defaultFieldName:"This Field" });

  $(function() {

    $("#app_settings").validity(function() {

      $('input.email')
        .require('Email is required')
        .match('email', '#{field} must be formatted as an email.')

      $('input.emailconf')
        .require('Email confirmation is required')
        .match('email', '#{field} must be formatted as an email.')

      $('input.emails')
        .equal("Email fields do not match.");

        $('input.password')
          .require('Password is required');

        $('input.passwordconf')
          .require('Password confirmation is required');

        $('input.passwords')
          .equal("Password fields do not match.");

        // check the password requirements
        var newPassword = $("#val_pwd").val();
        $("#val_pwd").minLength(<?php echo $pwdRules["len"] ?>, "Password too short.");
        if ( <?php echo $pwdRules["digit"] ?> > 0 ) {
          var test = newPassword;
          if ( test.replace(/[^0-9]/g,"").length < <?php echo $pwdRules["digit"] ?> ) {
            $("#val_pwd").assert(false, "Not enough digits in password.");
          }
        }

        if ( <?php echo $pwdRules["upper"] ?> > 0 ) {
          var test = newPassword;
          if ( test.replace(/[^A-Z]/g,"").length < <?php echo $pwdRules["upper"] ?> ) {
            $("#val_pwd").assert(false, "Not enough upper-case characters in password.");
          }
        }

        if ( <?php echo $pwdRules["lower"] ?> > 0 ) {
          var test = newPassword;
          if ( test.replace(/[^a-z]/g,"").length < <?php echo $pwdRules["lower"] ?> ) {
            $("#val_pwd").assert(false, "Not enough lower-case characters in password.");
          }
        }

      $('input#val_ssn')
        .require('Last 4 of SSN is required')
        .match('number', 'Last 4 of SSN must be a number.');

      $('input#val_dob')
        .require('DOB is required')
        .match('date', 'DOB must be formatted as an mm/dd/yyyy.');

      $('input#val_phone')
        .require('Phone number is required')
        .match(/^[1-9]\d{2}-\d{3}-\d{4}$/, 'Phone number must be formatted as 555-555-5555.');

    });

    <?php print ($FORM_VALIDATION_ERROR != "" ? "$('#summary-container').css('display', 'inline-block');" : ""); ?>

  });
</script>