Merge branch 'release' into bug-440

Conflicts:
	includes/account.php

Signed-off-by: Michael Tänzer <neo@nhng.de>

11 files changed, 1646 insertions, 1266 deletions

diff --git a/includes/account.php b/includes/account.php
index c860263..08718c5 100644
--- a/includes/account.php
+++ b/includes/account.php
@@ -17,6 +17,8 @@
 */
 	require_once("../includes/loggedin.php");
 	require_once("../includes/lib/l10n.php");
+	require_once("../includes/lib/check_weak_key.php");
+	require_once("../includes/notary.inc.php");
 
 	loadem("account");
 
@@ -120,9 +122,7 @@ function buildSubjectFromSession() {
 		}
 		$oldid=0;
 		$_REQUEST['email'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['newemail'])));
-		$query = "select * from `email` where `email`='".$_REQUEST['email']."' and `deleted`=0";
-		$res = mysql_query($query);
-		if(mysql_num_rows($res) > 0)
+		if(check_email_exists($_REQUEST['email'])==true)
 		{
 			showheader(_("My CAcert.org Account!"));
 			printf(_("The email address '%s' is already in a different account. Can't continue."), sanitizeHTML($_REQUEST['email']));
@@ -174,9 +174,9 @@ function buildSubjectFromSession() {
 			exit;
 		}
 		$row = mysql_fetch_assoc($res);
-		$body  = sprintf(_("Hi %s,"),$_SESSION['profile']['fname'])."\n";
-		$body .= _("You are receiving this email because you or someone else")."\n";
-		$body .= _("has changed the default email on your account.")."\n\n";
+		$body  = sprintf(_("Hi %s,"),$_SESSION['profile']['fname'])."\n\n";
+		$body .= _("You are receiving this email because you or someone else ".
+				"has changed the default email on your account.")."\n\n";
 
 		$body .= _("Best regards")."\n"._("CAcert.org Support!");
 
@@ -200,8 +200,13 @@ function buildSubjectFromSession() {
 		$delcount = 0;
 		if(array_key_exists('delid',$_REQUEST) && is_array($_REQUEST['delid']))
 		{
+			$deltitle=false;
 			foreach($_REQUEST['delid'] as $id)
 			{
+				if (!$deltitle) {
+					echo _('The following email addresses have been removed:')."<br>\n";
+					$deltitle=true;
+				}
 				$id = intval($id);
 				$query = "select * from `email` where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."' and
 						`email`!='".$_SESSION['profile']['email']."'";
@@ -210,17 +215,7 @@ function buildSubjectFromSession() {
 				{
 					$row = mysql_fetch_assoc($res);
 					echo $row['email']."<br>\n";
-					$query = "select `emailcerts`.`id`
-							from `emaillink`,`emailcerts` where
-							`emailid`='$id' and `emaillink`.`emailcertsid`=`emailcerts`.`id` and
-							`revoked`=0 and UNIX_TIMESTAMP(`expire`)-UNIX_TIMESTAMP() > 0
-							group by `emailcerts`.`id`";
-					$dres = mysql_query($query);
-					while($drow = mysql_fetch_assoc($dres))
-						mysql_query("update `emailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$drow['id']."'");
-
-					$query = "update `email` set `deleted`=NOW() where `id`='$id'";
-					mysql_query($query);
+					account_email_delete($row['id']);
 					$delcount++;
 				}
 			}
@@ -229,11 +224,9 @@ function buildSubjectFromSession() {
 		{
 			echo _("You did not select any email accounts for removal.");
 		}
-		if($delcount > 0)
+		if(0 == $delcount)
 		{
-			echo _("The following accounts have been removed:")."<br>\n";
-		} else {
-			echo _("You failed to select any accounts to be removed, or you attempted to remove the default account. No action was taken.");
+			echo _("You did not select any accounts to be removed, or you attempted to remove the default account. No action was taken.");
 		}
 
 		showfooter();
@@ -242,6 +235,14 @@ function buildSubjectFromSession() {
 
 	if($process != "" && $oldid == 3)
 	{
+		if(!array_key_exists('CCA',$_REQUEST))
+		{
+			showheader(_("My CAcert.org Account!"));
+			echo _("You did not accept the CAcert Community Agreement (CCA), hit the back button and try again.");
+			showfooter();
+			exit;
+		}
+
 		if(!(array_key_exists('addid',$_REQUEST) && is_array($_REQUEST['addid'])) && $_REQUEST['SSO'] != '1')
 		{
 			showheader(_("My CAcert.org Account!"));
@@ -290,6 +291,11 @@ function buildSubjectFromSession() {
 			$_REQUEST['keytype'] = "MS";
 			$csr = clean_csr($_REQUEST['optionalCSR']);
 		}
+		if(trim($_REQUEST['description']) != ""){
+			$_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
+		}else{
+			$_SESSION['_config']['description']= "";
+		}
 	}
 
 	if($oldid == 4)
@@ -366,6 +372,8 @@ function buildSubjectFromSession() {
 				exit;
 			}
 
+			write_user_agreement(intval($_SESSION['profile']['id']), "CCA", "certificate creation", "", 1);
+
 			$query = "insert into emailcerts set
 						`CN`='$defaultemail',
 						`keytype`='NS',
@@ -373,7 +381,8 @@ function buildSubjectFromSession() {
 						`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
 						`codesign`='".intval($_SESSION['_config']['codesign'])."',
 						`disablelogin`='".($_SESSION['_config']['disablelogin']?1:0)."',
-						`rootcert`='".intval($_SESSION['_config']['rootcert'])."'";
+						`rootcert`='".intval($_SESSION['_config']['rootcert'])."',
+						`description`='".$_SESSION['_config']['description']."'";
 			mysql_query($query);
 			$emailid = mysql_insert_id();
 			if(is_array($addys))
@@ -384,15 +393,15 @@ function buildSubjectFromSession() {
 			fputs($fp, $emails);
 			fclose($fp);
 			$challenge=$_SESSION['spkac_hash'];
-                        $res=`openssl spkac -verify -in $CSRname`;
-                        if(!strstr($res,"Challenge String: ".$challenge))
-                        {
-                                $id = $oldid;
-                                showheader(_("My CAcert.org Account!"));
-                                echo _("The challenge-response code of your certificate request did not match. Can't continue with certificaterequest.");
-                                showfooter();
-                                exit;
-                        }
+			$res=`openssl spkac -verify -in $CSRname`;
+			if(!strstr($res,"Challenge String: ".$challenge))
+			{
+				$id = $oldid;
+				showheader(_("My CAcert.org Account!"));
+				echo _("The challenge-response code of your certificate request did not match. Can't continue with certificaterequest.");
+				showfooter();
+				exit;
+			}
 			mysql_query("update `emailcerts` set `csr_name`='$CSRname' where `id`='".intval($emailid)."'");
 		} else if($_REQUEST['keytype'] == "MS" || $_REQUEST['keytype'] == "VI") {
 			if($csr == "")
@@ -417,8 +426,8 @@ function buildSubjectFromSession() {
 			$csrsubject="";
 
 			$user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_SESSION['profile']['id'])."'"));
-                        if(strlen($user['mname']) == 1)
-                                $user['mname'] .= '.';
+			if(strlen($user['mname']) == 1)
+				$user['mname'] .= '.';
 			if($_SESSION['_config']['incname'] <= 0 || $_SESSION['_config']['incname'] > 4)
 				$csrsubject = "/CN=CAcert WoT User";
 			if($_SESSION['_config']['incname'] == 1)
@@ -472,7 +481,9 @@ function buildSubjectFromSession() {
 						`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
 						`subject`='".mysql_real_escape_string($csrsubject)."',
 						`codesign`='".$_SESSION['_config']['codesign']."',
-						`rootcert`='".$_SESSION['_config']['rootcert']."'";
+						`disablelogin`='".($_SESSION['_config']['disablelogin']?1:0)."',
+						`rootcert`='".$_SESSION['_config']['rootcert']."',
+						`description`='".$_SESSION['_config']['description']."'";
 			mysql_query($query);
 			$emailid = mysql_insert_id();
 			if(is_array($addys))
@@ -506,10 +517,10 @@ function buildSubjectFromSession() {
 		csrf_check("adddomain");
 		if(strstr($_REQUEST['newdomain'],"\x00"))
 		{
-                        showheader(_("My CAcert.org Account!"));
-                        echo _("Due to the possibility for nullbyte domain exploits we currently do not allow any domain names with nullbytes.");
-                        showfooter();
-                        exit;
+			showheader(_("My CAcert.org Account!"));
+			echo _("Due to the possibility for nullbyte domain exploits we currently do not allow any domain names with nullbytes.");
+			showfooter();
+			exit;
 		}
 
 		list($newdomain) = explode(" ", $_REQUEST['newdomain'], 2); // Ignore the rest
@@ -671,11 +682,9 @@ function buildSubjectFromSession() {
 				{
 					$row = mysql_fetch_assoc($res);
 					echo $row['domain']."<br>\n";
-					mysql_query("update `domains` set `deleted`=NOW() where `id`='$id'");
-					$dres = mysql_query("select * from `domlink` where `domid`='$id'");
-					while($drow = mysql_fetch_assoc($dres))
-						mysql_query("update `domaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$drow['certid']."' and `revoked`=0 and UNIX_TIMESTAMP(`expire`)-UNIX_TIMESTAMP() > 0");
+					account_domain_delete($row['id']);
 				}
+
 			}
 		}
 		else
@@ -689,11 +698,19 @@ function buildSubjectFromSession() {
 
 	if($process != "" && $oldid == 10)
 	{
+		if(!array_key_exists('CCA',$_REQUEST))
+		{
+			showheader(_("My CAcert.org Account!"));
+			echo _("You did not accept the CAcert Community Agreement (CCA), hit the back button and try again.");
+			showfooter();
+			exit;
+		}
+
 		$CSR = clean_csr($_REQUEST['CSR']);
 		if(strpos($CSR,"---BEGIN")===FALSE)
 		{
-		  // In case the CSR is missing the ---BEGIN lines, add them automatically:
-		  $CSR = "-----BEGIN CERTIFICATE REQUEST-----\n".$CSR."\n-----END CERTIFICATE REQUEST-----\n";
+			// In case the CSR is missing the ---BEGIN lines, add them automatically:
+			$CSR = "-----BEGIN CERTIFICATE REQUEST-----\n".$CSR."\n-----END CERTIFICATE REQUEST-----\n";
 		}
 
 		if (($weakKey = checkWeakKeyCSR($CSR)) !== "")
@@ -704,6 +721,12 @@ function buildSubjectFromSession() {
 			exit;
 		}
 
+		if(trim($_REQUEST['description']) != ""){
+			$_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
+		}else{
+			$_SESSION['_config']['description']= "";
+		}
+
 		$_SESSION['_config']['tmpfname'] = tempnam("/tmp", "id10CSR");
 		$fp = fopen($_SESSION['_config']['tmpfname'], "w");
 		fputs($fp, $CSR);
@@ -772,19 +795,23 @@ function buildSubjectFromSession() {
 		if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
 			$_SESSION['_config']['rootcert'] = 1;
 
+		write_user_agreement(intval($_SESSION['profile']['id']), "CCA", "certificate creation", "", 1);
+
 		if(array_key_exists('0',$_SESSION['_config']['rowid']) && $_SESSION['_config']['rowid']['0'] > 0)
 		{
 			$query = "insert into `domaincerts` set
 						`CN`='".mysql_real_escape_string($_SESSION['_config']['rows']['0'])."',
 						`domid`='".mysql_real_escape_string($_SESSION['_config']['rowid']['0'])."',
 						`created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
-						`rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."'";
+						`rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."',
+						`description`='".$_SESSION['_config']['description']."'";
 		} elseif(array_key_exists('0',$_SESSION['_config']['altid']) && $_SESSION['_config']['altid']['0'] > 0) {
 			$query = "insert into `domaincerts` set
 						`CN`='".mysql_real_escape_string($_SESSION['_config']['altrows']['0'])."',
 						`domid`='".mysql_real_escape_string($_SESSION['_config']['altid']['0'])."',
 						`created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
-						`rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."'";
+						`rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."',
+						`description`='".$_SESSION['_config']['description']."'";
 		} else {
 			showheader(_("My CAcert.org Account!"));
 			echo _("Domain not verified.");
@@ -865,7 +892,8 @@ function buildSubjectFromSession() {
 						`modified`=NOW(),
 						`rootcert`='".$row['rootcert']."',
 						`type`='".$row['type']."',
-						`pkhash`='".$row['pkhash']."'";
+						`pkhash`='".$row['pkhash']."',
+						`description`='".$row['description']."'";
 				mysql_query($query);
 				$newid = mysql_insert_id();
 				$newfile=generatecertpath("csr","server",$newid);
@@ -982,6 +1010,24 @@ function buildSubjectFromSession() {
 		exit;
 	}
 
+	if($oldid == 12 && array_key_exists('change',$_REQUEST) && $_REQUEST['change'] != "")
+	{
+		showheader(_("My CAcert.org Account!"));
+		foreach($_REQUEST as $id => $val)
+		{
+			if(substr($id,0,14)=="check_comment_")
+			{
+				$cid = intval(substr($id,14));
+				$comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
+				mysql_query("update `domaincerts` set `description`='$comment' where `id`='$cid'");
+			}
+		}
+		echo(_("Certificate settings have been changed.")."<br/>\n");
+		showfooter();
+		exit;
+	}
+
+
 	if($oldid == 5 && array_key_exists('renew',$_REQUEST) && $_REQUEST['renew'] != "")
 	{
 		showheader(_("My CAcert.org Account!"));
@@ -1020,7 +1066,8 @@ function buildSubjectFromSession() {
 						`modified`=NOW(),
 						`disablelogin`='".$row['disablelogin']."',
 						`codesign`='".$row['codesign']."',
-						`rootcert`='".$row['rootcert']."'";
+						`rootcert`='".$row['rootcert']."',
+						`description`='".$row['description']."'";
 				mysql_query($query);
 				$newid = mysql_insert_id();
 				$newfile=generatecertpath("csr","client",$newid);
@@ -1119,26 +1166,47 @@ function buildSubjectFromSession() {
 
 	if($oldid == 5 && array_key_exists('change',$_REQUEST) && $_REQUEST['change'] != "")
 	{
-	  showheader(_("My CAcert.org Account!"));
-	  //echo _("Now changing the settings for the following certificates:")."<br>\n";
-	  foreach($_REQUEST as $id => $val)
-	  {
-	    //echo $id."<br/>";
-	    if(substr($id,0,5)=="cert_")
-	    {
-	      $id = intval(substr($id,5));
-	      $dis=(array_key_exists('disablelogin_'.$id,$_REQUEST) && $_REQUEST['disablelogin_'.$id]=="1")?"0":"1";
-	      //echo "$id -> ".$_REQUEST['disablelogin_'.$id]."<br/>\n";
-	      mysql_query("update `emailcerts` set `disablelogin`='$dis' where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'");
-	      //$row = mysql_fetch_assoc($res);
-	    }
-	  }
-	  echo(_("Certificate settings have been changed.")."<br/>\n");
-	  showfooter();
-	  exit;
+		showheader(_("My CAcert.org Account!"));
+		foreach($_REQUEST as $id => $val)
+		{
+			if(substr($id,0,5)=="cert_")
+			{
+				$cid = intval(substr($id,5));
+				$dis=(array_key_exists('disablelogin_'.$cid,$_REQUEST) && $_REQUEST['disablelogin_'.$cid]=="1")?"0":"1";
+				mysql_query("update `emailcerts` set `disablelogin`='$dis' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'");
+			}
+			if(substr($id,0,14)=="check_comment_")
+			{
+				$cid = intval(substr($id,14));
+				if(!empty($_REQUEST['check_comment_'.$cid])) {
+					$comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
+					mysql_query("update `emailcerts` set `description`='$comment' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'");
+				}
+			}
+		}
+		echo(_("Certificate settings have been changed.")."<br/>\n");
+		showfooter();
+		exit;
 	}
 
 
+	if($oldid == 6 && $_REQUEST['certid'] != "")
+	{
+		if(trim($_REQUEST['description']) != ""){
+			$description= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
+		}else{
+			$description= "";
+		}
+
+		if(trim($_REQUEST['disablelogin']) == "1"){
+			$disablelogin = 1;
+		}else{
+			$disablelogin = 0;
+		}
+
+		mysql_query("update `emailcerts` set `disablelogin`='$disablelogin', `description`='$description' where `id`='".$_REQUEST['certid']."' and `memid`='".$_SESSION['profile']['id']."'");
+	}
+
 	if($oldid == 13 && $process != "")
 	{
 		csrf_check("perschange");
@@ -1155,42 +1223,42 @@ function buildSubjectFromSession() {
 		$_SESSION['_config']['user']['A4'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A4']))));
 		$_SESSION['_config']['user']['A5'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A5']))));
 
-                if($_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q2'] ||
-                        $_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q3'] ||
-                        $_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q4'] ||
-                        $_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q5'] ||
-                        $_SESSION['_config']['user']['Q2'] == $_SESSION['_config']['user']['Q3'] ||
-                        $_SESSION['_config']['user']['Q2'] == $_SESSION['_config']['user']['Q4'] ||
-                        $_SESSION['_config']['user']['Q2'] == $_SESSION['_config']['user']['Q5'] ||
-                        $_SESSION['_config']['user']['Q3'] == $_SESSION['_config']['user']['Q4'] ||
-                        $_SESSION['_config']['user']['Q3'] == $_SESSION['_config']['user']['Q5'] ||
-                        $_SESSION['_config']['user']['Q4'] == $_SESSION['_config']['user']['Q5'] ||
-                        $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q1'] ||
-                        $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q2'] ||
-                        $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q3'] ||
-                        $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q4'] ||
-                        $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q5'] ||
-                        $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['Q3'] ||
-                        $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['Q4'] ||
-                        $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['Q5'] ||
-                        $_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['Q4'] ||
-                        $_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['Q5'] ||
-                        $_SESSION['_config']['user']['A4'] == $_SESSION['_config']['user']['Q5'] ||
-                        $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A2'] ||
-                        $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A3'] ||
-                        $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A4'] ||
-                        $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A5'] ||
-                        $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['A3'] ||
-                        $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['A4'] ||
-                        $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['A5'] ||
-                        $_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['A4'] ||
-                        $_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['A5'] ||
-                        $_SESSION['_config']['user']['A4'] == $_SESSION['_config']['user']['A5'])
-                {
-                        $_SESSION['_config']['errmsg'] .= _("For your own security you must enter 5 different password questions and answers. You aren't allowed to duplicate questions, set questions as answers or use the question as the answer.")."<br>\n";
-                        $id = $oldid;
+		if($_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q2'] ||
+				$_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q3'] ||
+				$_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q4'] ||
+				$_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q5'] ||
+				$_SESSION['_config']['user']['Q2'] == $_SESSION['_config']['user']['Q3'] ||
+				$_SESSION['_config']['user']['Q2'] == $_SESSION['_config']['user']['Q4'] ||
+				$_SESSION['_config']['user']['Q2'] == $_SESSION['_config']['user']['Q5'] ||
+				$_SESSION['_config']['user']['Q3'] == $_SESSION['_config']['user']['Q4'] ||
+				$_SESSION['_config']['user']['Q3'] == $_SESSION['_config']['user']['Q5'] ||
+				$_SESSION['_config']['user']['Q4'] == $_SESSION['_config']['user']['Q5'] ||
+				$_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q1'] ||
+				$_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q2'] ||
+				$_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q3'] ||
+				$_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q4'] ||
+				$_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q5'] ||
+				$_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['Q3'] ||
+				$_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['Q4'] ||
+				$_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['Q5'] ||
+				$_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['Q4'] ||
+				$_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['Q5'] ||
+				$_SESSION['_config']['user']['A4'] == $_SESSION['_config']['user']['Q5'] ||
+				$_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A2'] ||
+				$_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A3'] ||
+				$_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A4'] ||
+				$_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A5'] ||
+				$_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['A3'] ||
+				$_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['A4'] ||
+				$_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['A5'] ||
+				$_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['A4'] ||
+				$_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['A5'] ||
+				$_SESSION['_config']['user']['A4'] == $_SESSION['_config']['user']['A5'])
+		{
+			$_SESSION['_config']['errmsg'] .= _("For your own security you must enter 5 different password questions and answers. You aren't allowed to duplicate questions, set questions as answers or use the question as the answer.")."<br>\n";
+			$id = $oldid;
 			$oldid=0;
-                }
+		}
 
 		if($_SESSION['_config']['user']['Q1'] == "" || $_SESSION['_config']['user']['Q2'] == "" ||
 			$_SESSION['_config']['user']['Q3'] == "" || $_SESSION['_config']['user']['Q4'] == "" ||
@@ -1333,9 +1401,9 @@ function buildSubjectFromSession() {
 						where `id`='".$_SESSION['profile']['id']."'");
 				echo '<h3>', _("Pass Phrase Changed Successfully"), '</h3>', "\n";
 				echo _("Your Pass Phrase has been updated and your primary email account has been notified of the change.");
-				$body  = sprintf(_("Hi %s,"),$_SESSION['profile']['fname'])."\n";
-				$body .= _("You are receiving this email because you or someone else")."\n";
-				$body .= _("has changed the password on your account.")."\n";
+				$body  = sprintf(_("Hi %s,"),$_SESSION['profile']['fname'])."\n\n";
+				$body .= _("You are receiving this email because you or someone else ".
+						"has changed the password on your account.")."\n\n";
 
 				$body .= _("Best regards")."\n"._("CAcert.org Support!");
 
@@ -1373,6 +1441,13 @@ function buildSubjectFromSession() {
 		}
 		$_SESSION['_config']['name'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['name'])));
 		$_SESSION['_config']['OU'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['OU'])));
+
+
+		if(trim($_REQUEST['description']) != ""){
+			$_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
+		}else{
+			$_SESSION['_config']['description']= "";
+		}
 	}
 
 	if($oldid == 16 && (intval(count($_SESSION['_config']['emails'])) + 0) <= 0)
@@ -1401,6 +1476,12 @@ function buildSubjectFromSession() {
 		if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
 			$_SESSION['_config']['rootcert'] = 1;
 
+		if(trim($_REQUEST['description']) != ""){
+			$_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
+		}else{
+			$_SESSION['_config']['description']= "";
+		}
+
 		if(@count($_SESSION['_config']['emails']) > 0)
 			$id = 17;
 	}
@@ -1447,6 +1528,7 @@ function buildSubjectFromSession() {
 			if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
 				$_SESSION['_config']['rootcert'] = 1;
 
+
 			$emails .= "SPKAC = $spkac";
 			if (($weakKey = checkWeakKeySPKAC($emails)) !== "")
 			{
@@ -1463,7 +1545,8 @@ function buildSubjectFromSession() {
 						`orgid`='".$org['orgid']."',
 						`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
 						`codesign`='".$_SESSION['_config']['codesign']."',
-						`rootcert`='".$_SESSION['_config']['rootcert']."'";
+						`rootcert`='".$_SESSION['_config']['rootcert']."',
+						`description`='".$_SESSION['_config']['description']."'";
 			mysql_query($query);
 			$emailid = mysql_insert_id();
 
@@ -1475,15 +1558,15 @@ function buildSubjectFromSession() {
 			fputs($fp, $emails);
 			fclose($fp);
 			$challenge=$_SESSION['spkac_hash'];
-                        $res=`openssl spkac -verify -in $CSRname`;
-                        if(!strstr($res,"Challenge String: ".$challenge))
-                        {
-                                $id = $oldid;
-                                showheader(_("My CAcert.org Account!"));
-                                echo _("The challenge-response code of your certificate request did not match. Can't continue with certificaterequest.");
-                                showfooter();
-                                exit;
-                        }
+			$res=`openssl spkac -verify -in $CSRname`;
+			if(!strstr($res,"Challenge String: ".$challenge))
+			{
+				$id = $oldid;
+				showheader(_("My CAcert.org Account!"));
+				echo _("The challenge-response code of your certificate request did not match. Can't continue with certificaterequest.");
+				showfooter();
+				exit;
+			}
 			mysql_query("update `orgemailcerts` set `csr_name`='$CSRname' where `id`='$emailid'");
 		} else if($_REQUEST['keytype'] == "MS" || $_REQUEST['keytype']=="VI") {
 			$csr = "-----BEGIN CERTIFICATE REQUEST-----\n".clean_csr($_REQUEST['CSR'])."-----END CERTIFICATE REQUEST-----\n";
@@ -1553,7 +1636,8 @@ function buildSubjectFromSession() {
 						`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
 						`subject`='$csrsubject',
 						`codesign`='".$_SESSION['_config']['codesign']."',
-						`rootcert`='".$_SESSION['_config']['rootcert']."'";
+						`rootcert`='".$_SESSION['_config']['rootcert']."',
+						`description`='".$_SESSION['_config']['description']."'";
 			mysql_query($query);
 			$emailid = mysql_insert_id();
 
@@ -1628,7 +1712,8 @@ function buildSubjectFromSession() {
 						`created`='".$row['created']."',
 						`modified`=NOW(),
 						`codesign`='".$row['codesign']."',
-						`rootcert`='".$row['rootcert']."'";
+						`rootcert`='".$row['rootcert']."',
+						`description`='".$row['description']."'";
 				mysql_query($query);
 				$newid = mysql_insert_id();
 				$newfile=generatecertpath("csr","orgclient",$newid);
@@ -1720,6 +1805,24 @@ function buildSubjectFromSession() {
 		exit;
 	}
 
+	if($oldid == 18 && array_key_exists('change',$_REQUEST) && $_REQUEST['change'] != "")
+	{
+		showheader(_("My CAcert.org Account!"));
+		foreach($_REQUEST as $id => $val)
+		{
+			if(substr($id,0,14)=="check_comment_")
+			{
+				$cid = intval(substr($id,14));
+				$comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
+				mysql_query("update `orgemailcerts` set `description`='$comment' where `id`='$cid'");
+			}
+		}
+		echo(_("Certificate settings have been changed.")."<br/>\n");
+		showfooter();
+		exit;
+	}
+
+
 	if($process != "" && $oldid == 20)
 	{
 		$CSR = clean_csr($_REQUEST['CSR']);
@@ -1733,6 +1836,12 @@ function buildSubjectFromSession() {
 			exit;
 		}
 
+		if(trim($_REQUEST['description']) != ""){
+			$_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
+		}else{
+			$_SESSION['_config']['description']= "";
+		}
+
 		$_SESSION['_config']['tmpfname'] = tempnam("/tmp", "id20CSR");
 		$fp = fopen($_SESSION['_config']['tmpfname'], "w");
 		fputs($fp, $CSR);
@@ -1808,8 +1917,8 @@ function buildSubjectFromSession() {
 			exit;
 		}
 
-                if($_SESSION['_config']['rowid']['0'] > 0)
-                {
+		if($_SESSION['_config']['rowid']['0'] > 0)
+		{
 			$query = "select * from `org`,`orginfo` where
 					`orginfo`.`id`='".$_SESSION['_config']['rowid']['0']."' and
 					`orginfo`.`id`=`org`.`orgid` and
@@ -1843,25 +1952,27 @@ function buildSubjectFromSession() {
 		if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
 			$_SESSION['_config']['rootcert'] = 1;
 
-                if($_SESSION['_config']['rowid']['0'] > 0)
-                {
-                        $query = "insert into `orgdomaincerts` set
-						`CN`='".$_SESSION['_config']['rows']['0']."',
-						`orgid`='".$org['id']."',
-                                                `created`=NOW(),
-						`subject`='$csrsubject',
-						`rootcert`='".$_SESSION['_config']['rootcert']."',
-						`type`='$type'";
-                } else {
-                        $query = "insert into `orgdomaincerts` set
-						`CN`='".$_SESSION['_config']['altrows']['0']."',
-						`orgid`='".$org['id']."',
-                                                `created`=NOW(),
-						`subject`='$csrsubject',
-						`rootcert`='".$_SESSION['_config']['rootcert']."',
-						`type`='$type'";
-                }
-                mysql_query($query);
+		if($_SESSION['_config']['rowid']['0'] > 0)
+		{
+			$query = "insert into `orgdomaincerts` set
+					`CN`='".$_SESSION['_config']['rows']['0']."',
+					`orgid`='".$org['id']."',
+					`created`=NOW(),
+					`subject`='$csrsubject',
+					`rootcert`='".$_SESSION['_config']['rootcert']."',
+					`type`='$type',
+					`description`='".$_SESSION['_config']['description']."'";
+		} else {
+			$query = "insert into `orgdomaincerts` set
+					`CN`='".$_SESSION['_config']['altrows']['0']."',
+					`orgid`='".$org['id']."',
+					`created`=NOW(),
+					`subject`='$csrsubject',
+					`rootcert`='".$_SESSION['_config']['rootcert']."',
+					`type`='$type',
+					`description`='".$_SESSION['_config']['description']."'";
+		}
+		mysql_query($query);
 		$CSRid = mysql_insert_id();
 
 		$CSRname=generatecertpath("csr","orgserver",$CSRid);
@@ -1935,7 +2046,8 @@ function buildSubjectFromSession() {
 						`modified`=NOW(),
 						`subject`='".$row['subject']."',
 						`type`='".$row['type']."',
-						`rootcert`='".$row['rootcert']."'";
+						`rootcert`='".$row['rootcert']."',
+						`description`='".$row['description']."'";
 				mysql_query($query);
 				$newid = mysql_insert_id();
 				//echo "NewID: $newid<br/>\n";
@@ -2036,6 +2148,24 @@ function buildSubjectFromSession() {
 		exit;
 	}
 
+	if($oldid == 22 && array_key_exists('change',$_REQUEST) && $_REQUEST['change'] != "")
+	{
+		showheader(_("My CAcert.org Account!"));
+		foreach($_REQUEST as $id => $val)
+		{
+			if(substr($id,0,14)=="check_comment_")
+			{
+				$cid = intval(substr($id,14));
+				$comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
+				mysql_query("update `orgdomaincerts` set `description`='$comment' where `id`='$cid'");
+			}
+		}
+		echo(_("Certificate settings have been changed.")."<br/>\n");
+		showfooter();
+		exit;
+	}
+
+
 	if(($id == 24 || $oldid == 24 || $id == 25 || $oldid == 25 || $id == 26 || $oldid == 26 ||
 		$id == 27 || $oldid == 27 || $id == 28 || $oldid == 28 || $id == 29 || $oldid == 29 ||
 		$id == 30 || $oldid == 30 || $id == 31 || $oldid == 31) &&
@@ -2133,9 +2263,9 @@ function buildSubjectFromSession() {
 
 	if($oldid == 29 && $process != "")
 	{
-		$domain = mysql_real_escape_string(stripslashes(trim($domainname)));
+		$domain = mysql_real_escape_string(stripslashes(trim($_REQUEST['domainname'])));
 
-		$res1 = mysql_query("select * from `orgdomains` where `domain` like '$domain' and `id`!='".intval($_SESSION['_config']['domid'])."'");
+		$res1 = mysql_query("select * from `orgdomains` where `domain` like '$domain' and `id`!='".intval($domid)."'");
 		$res2 = mysql_query("select * from `domains` where `domain` like '$domain' and `deleted`=0");
 		if(mysql_num_rows($res1) > 0 || mysql_num_rows($res2) > 0)
 		{
@@ -2145,12 +2275,12 @@ function buildSubjectFromSession() {
 		}
 	}
 
-	if(($oldid == 29 || $oldid == 30) && $process != _("Cancel"))
+	if(($oldid == 29 || $oldid == 30) && $process != "")      // _("Cancel") is handled in front of account.php
 	{
 		$query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where
 				`orgdomlink`.`orgdomid`=`orgdomains`.`id` and
 				`orgdomaincerts`.`id`=`orgdomlink`.`orgcertid` and
-				`orgdomains`.`id`='".intval($_SESSION['_config']['domid'])."'";
+				`orgdomains`.`id`='".intval($domid)."'";
 		$res = mysql_query($query);
 		while($row = mysql_fetch_assoc($res))
 			mysql_query("update `orgdomaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$row['id']."'");
@@ -2158,7 +2288,7 @@ function buildSubjectFromSession() {
 		$query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where
 				`orgemaillink`.`domid`=`orgdomains`.`id` and
 				`orgemailcerts`.`id`=`orgemaillink`.`emailcertsid` and
-				`orgdomains`.`id`='".intval($_SESSION['_config']['domid'])."'";
+				`orgdomains`.`id`='".intval($domid)."'";
 		$res = mysql_query($query);
 		while($row = mysql_fetch_assoc($res))
 			mysql_query("update `orgemailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='".intval($row['id'])."'");
@@ -2166,23 +2296,23 @@ function buildSubjectFromSession() {
 
 	if($oldid == 29 && $process != "")
 	{
-		$row = mysql_fetch_assoc(mysql_query("select * from `orgdomains` where `id`='".intval($_SESSION['_config']['domid'])."'"));
-		mysql_query("update `orgdomains` set `domain`='$domain' where `id`='".intval($_SESSION['_config']['domid'])."'");
+		$row = mysql_fetch_assoc(mysql_query("select * from `orgdomains` where `id`='".intval($domid)."'"));
+		mysql_query("update `orgdomains` set `domain`='$domain' where `id`='".intval($domid)."'");
 		showheader(_("My CAcert.org Account!"));
 		printf(_("'%s' has just been successfully updated in the database."), sanitizeHTML($domain));
-		echo "<br><br><a href='account.php?id=26&orgid=".intval($_SESSION['_config']['orgid'])."'>"._("Click here")."</a> "._("to continue.");
+		echo "<br><br><a href='account.php?id=26&orgid=".intval($orgid)."'>"._("Click here")."</a> "._("to continue.");
 		showfooter();
 		exit;
 	}
 
 	if($oldid == 30 && $process != "")
 	{
-		$row = mysql_fetch_assoc(mysql_query("select * from `orgdomains` where `id`='".intval($_SESSION['_config']['domid'])."'"));
+		$row = mysql_fetch_assoc(mysql_query("select * from `orgdomains` where `id`='".intval($domid)."'"));
 		$domain = $row['domain'];
-		mysql_query("delete from `orgdomains` where `id`='".intval($_SESSION['_config']['domid'])."'");
+		mysql_query("delete from `orgdomains` where `id`='".intval($domid)."'");
 		showheader(_("My CAcert.org Account!"));
 		printf(_("'%s' has just been successfully deleted from the database."), sanitizeHTML($domain));
-		echo "<br><br><a href='account.php?id=26&orgid=".intval($_SESSION['_config']['orgid'])."'>"._("Click here")."</a> "._("to continue.");
+		echo "<br><br><a href='account.php?id=26&orgid=".intval($orgid)."'>"._("Click here")."</a> "._("to continue.");
 		showfooter();
 		exit;
 	}
@@ -2234,8 +2364,7 @@ function buildSubjectFromSession() {
 		$orgid = 0;
 	}
 
-	if($id == 32 || $oldid == 32 || $id == 33 || $oldid == 33 || $id == 34 || $oldid == 34 ||
-		$id == 35 || $oldid == 35)
+	if($id == 32 || $oldid == 32 || $id == 33 || $oldid == 33 || $id == 34 || $oldid == 34)
 	{
 		$query = "select * from `org` where `memid`='".intval($_SESSION['profile']['id'])."' and `masteracc`='1'";
 		$_macc = mysql_num_rows(mysql_query($query));
@@ -2248,6 +2377,19 @@ function buildSubjectFromSession() {
 		}
 	}
 
+	if($id == 35 || $oldid == 35)
+	{
+		$query = "select 1 from `org` where `memid`='".intval($_SESSION['profile']['id'])."'";
+		$is_orguser = mysql_num_rows(mysql_query($query));
+		if($_SESSION['profile']['orgadmin'] != 1 && $is_orguser <= 0)
+		{
+			showheader(_("My CAcert.org Account!"));
+			echo _("You don't have access to this area.");
+			showfooter();
+			exit;
+		}
+	}
+
 	if($id == 33 && $_SESSION['profile']['orgadmin'] != 1)
 	{
 		$orgid = intval($_SESSION['_config']['orgid']);
@@ -2277,8 +2419,21 @@ function buildSubjectFromSession() {
 			$_SESSION['_config']['errmsg'] = sprintf(_("Wasn't able to match '%s' against any user in the system"), sanitizeHTML($_REQUEST['email']));
 		} else {
 			$row = mysql_fetch_assoc($res);
-			mysql_query("insert into `org` set `memid`='".intval($row['id'])."', `orgid`='".intval($_SESSION['_config']['orgid'])."',
-					`masteracc`='$masteracc', `OU`='$OU', `comments`='$comments'");
+			if ( !is_assurer(intval($row['id'])) )
+			{
+				$id = $oldid;
+				$oldid=0;
+				$_SESSION['_config']['errmsg'] =
+						_("The user is not an Assurer yet");
+			} else {
+				mysql_query(
+					"insert into `org`
+						set `memid`='".intval($row['id'])."',
+							`orgid`='".intval($_SESSION['_config']['orgid'])."',
+							`masteracc`='$masteracc',
+							`OU`='$OU',
+							`comments`='$comments'");
+			}
 		}
 	}
 
@@ -2402,7 +2557,7 @@ function buildSubjectFromSession() {
 	}
 
 	if($oldid == 54 || ($id == 53 && array_key_exists('action',$_REQUEST) && $_REQUEST['action'] != "") ||
-	             ($id == 54 && array_key_exists('action',$_REQUEST) && $_REQUEST['action'] != "" &&
+			($id == 54 && array_key_exists('action',$_REQUEST) && $_REQUEST['action'] != "" &&
 			$_REQUEST['action'] != "aliases" && $_REQUEST['action'] != "edit" && $_REQUEST['action'] != "add"))
 	{
 		$id = 53;
@@ -2412,7 +2567,7 @@ function buildSubjectFromSession() {
 		$locid = intval(array_key_exists('locid',$_REQUEST)?$_REQUEST['locid']:0);
 		$name = array_key_exists('name',$_REQUEST)?mysql_real_escape_string(strip_tags($_REQUEST['name'])):"";
 		$long = array_key_exists('longitude',$_REQUEST)?ereg_replace("[^-0-9\.]","",$_REQUEST['longitude']):"";
-		$lat =  array_key_exists('latitude', $_REQUEST)?ereg_replace("[^-0-9\.]","",$_REQUEST['latitude']):"";
+		$lat = array_key_exists('latitude', $_REQUEST)?ereg_replace("[^-0-9\.]","",$_REQUEST['latitude']):"";
 		$action = array_key_exists('action',$_REQUEST)?$_REQUEST['action']:"";
 
 		if($locid > 0 && $action == "edit")
@@ -2520,6 +2675,13 @@ function buildSubjectFromSession() {
 		mysql_query($query);
 	}
 
+	if($oldid == 43 && $_REQUEST['action'] == 'revokecert')
+	{
+		$userid = intval($_REQUEST['userid']);
+		revoke_all_private_cert($userid);
+		$id=43;
+	}
+
 	if($oldid == 48 && $_REQUEST['domain'] == "")
 	{
 		$id = $oldid;
@@ -2554,9 +2716,10 @@ function buildSubjectFromSession() {
 			$row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'"));
 			printf(_("The password for %s has been updated successfully in the system."), sanitizeHTML($row['email']));
 
-			$body  = sprintf(_("Hi %s,"),$row['fname'])."\n";
-			$body .= _("You are receiving this email because a CAcert administrator")."\n";
-			$body .= _("has changed the password on your account.")."\n";
+
+			$body  = sprintf(_("Hi %s,"),$row['fname'])."\n\n";
+			$body .= _("You are receiving this email because a CAcert administrator ".
+					"has changed the password on your account.")."\n\n";
 
 			$body .= _("Best regards")."\n"._("CAcert.org Support!");
 
@@ -2669,24 +2832,24 @@ function buildSubjectFromSession() {
 		mysql_query("update `users` set `tverify`='$ver' where `id`='$memid'");
 	}
 
-  if($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0)
-  {
-    csrf_check('admsetassuret');
-    $memid = $_REQUEST['userid'] = intval($_REQUEST['assurer']);
-    $query = "select * from `users` where `id`='$memid'";
-    $row = mysql_fetch_assoc(mysql_query($query));
-    $ver = !$row['assurer'];
-    mysql_query("update `users` set `assurer`='$ver' where `id`='$memid'");
-  }
-
-  if($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0)
-  {
-    $memid = $_REQUEST['userid'] = intval($_REQUEST['assurer_blocked']);
-    $query = "select * from `users` where `id`='$memid'";
-    $row = mysql_fetch_assoc(mysql_query($query));
-    $ver = !$row['assurer_blocked'];
-    mysql_query("update `users` set `assurer_blocked`='$ver' where `id`='$memid'");
-  }
+	if($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0)
+	{
+		csrf_check('admsetassuret');
+		$memid = $_REQUEST['userid'] = intval($_REQUEST['assurer']);
+		$query = "select * from `users` where `id`='$memid'";
+		$row = mysql_fetch_assoc(mysql_query($query));
+		$ver = !$row['assurer'];
+		mysql_query("update `users` set `assurer`='$ver' where `id`='$memid'");
+	}
+
+	if($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0)
+	{
+		$memid = $_REQUEST['userid'] = intval($_REQUEST['assurer_blocked']);
+		$query = "select * from `users` where `id`='$memid'";
+		$row = mysql_fetch_assoc(mysql_query($query));
+		$ver = !$row['assurer_blocked'];
+		mysql_query("update `users` set `assurer_blocked`='$ver' where `id`='$memid'");
+	}
 
 	if($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0)
 	{
@@ -2815,23 +2978,39 @@ function buildSubjectFromSession() {
 	if($oldid == 50 && $process != "")
 	{
 		$_REQUEST['userid'] = intval($_REQUEST['userid']);
-		$res = mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'");
-		if(mysql_num_rows($res) > 0)
-		{
-			$query = "update `domaincerts`,`domains` SET `domaincerts`.`revoked`='1970-01-01 10:00:01'
-					WHERE `domaincerts`.`domid` = `domains`.`id` AND `domains`.`memid`='".intval($_REQUEST['userid'])."'";
-			mysql_query($query);
-			$query = "update `domains` SET `deleted`=NOW() WHERE `domains`.`memid`='".intval($_REQUEST['userid'])."'";
-			mysql_query($query);
-			$query = "update `emailcerts` SET `revoked`='1970-01-01 10:00:01' WHERE `memid`='".intval($_REQUEST['userid'])."'";
-			mysql_query($query);
-			$query = "update `email` SET `deleted`=NOW() WHERE `memid`='".intval($_REQUEST['userid'])."'";
-			mysql_query($query);
-			$query = "delete from `org` WHERE `memid`='".intval($_REQUEST['userid'])."'";
-			mysql_query($query);
-			$query = "update `users` SET `deleted`=NOW() WHERE `id`='".intval($_REQUEST['userid'])."'";
-			mysql_query($query);
+		if (trim($_REQUEST['arbitrationno'])==""){
+			showheader(_("My CAcert.org Account!"));
+			echo _("You did not enter an arbitration number entry.");
+			showfooter();
+			exit;
+		}
+		if ( 1 !== preg_match('/^[a-z]\d{8}\.\d+\.\d+$/i',trim($_REQUEST['arbitrationno'])) ) {
+			showheader(_("My CAcert.org Account!"));
+			printf(_("'%s' is not a valid arbitration number entry."), sanitizeHTML(trim($_REQUEST['arbitrationno'])));
+			showfooter();
+			exit;
+		}
+		if (check_email_exists(trim($_REQUEST['arbitrationno']).'@cacert.org')) {
+			showheader(_("My CAcert.org Account!"));
+			printf(_("The email address '%s' is already in a different account. Can't continue."), sanitizeHTML($_REQUEST['arbitrationno'].'@cacert.org'));
+			showfooter();
+			exit;
+		 }
+		if (check_client_cert_running($_REQUEST['userid'],1) ||
+			check_server_cert_running($_REQUEST['userid'],1) ||
+			check_gpg_cert_running($_REQUEST['userid'],1)) {
+			showheader(_("My CAcert.org Account!"));
+			printf(_("The CCA retention time for at least one certificate is not over. Can't continue."));
+			showfooter();
+			exit;
+		}
+		if (check_is_orgadmin($_REQUEST['userid'],1)) {
+			showheader(_("My CAcert.org Account!"));
+			printf(_("The user is listed as Organisation Administrator. Can't continue."));
+			showfooter();
+			exit;
 		}
+		account_delete($_REQUEST['userid'], trim($_REQUEST['arbitrationno']), $_SESSION['profile']['id']);
 	}
 
 	if(($id == 51 || $id == 52 || $oldid == 52) && $_SESSION['profile']['tverify'] <= 0)
@@ -2954,6 +3133,4 @@ function buildSubjectFromSession() {
 		$_SESSION['_config']['orgid'] = intval($orgid);
 	if(intval($memid) > 0)
 		$_SESSION['_config']['memid'] = intval($memid);
-	if(intval($domid) > 0)
-		$_SESSION['_config']['domid'] = intval($domid);
 ?>
diff --git a/includes/account_stuff.php b/includes/account_stuff.php
index 108bd57..dbebf6a 100644
--- a/includes/account_stuff.php
+++ b/includes/account_stuff.php
@@ -172,7 +172,7 @@ function hideall() {
     </div>
     <div class="relatedLinks">
       <h3 class="pointer" onclick="explode('mydetails')">+ <?=_("My Details")?></h3>
-      <ul class="menu" id="mydetails"><li><a href="account.php?id=13"><?=_("Edit")?></a></li><li><a href="account.php?id=14"><?=_("Change Password")?></a></li><li><a href="account.php?id=41"><?=_("Default Language")?></a></li><li><a href="wot.php?id=8"><?=_("My Listing")?></a></li><li><a href="wot.php?id=13"><?=_("My Location")?></a></li><li><a href="account.php?id=36"><?=_("My Alert Settings")?></a></li><li><a href="wot.php?id=10"><?=_("My Points")?></a></li><?
+      <ul class="menu" id="mydetails"><li><a href="account.php?id=13"><?=_("View/Edit")?></a></li><li><a href="account.php?id=14"><?=_("Change Password")?></a></li><li><a href="account.php?id=41"><?=_("Default Language")?></a></li><li><a href="wot.php?id=8"><?=_("My Listing")?></a></li><li><a href="wot.php?id=13"><?=_("My Location")?></a></li><li><a href="account.php?id=36"><?=_("My Alert Settings")?></a></li><li><a href="wot.php?id=10"><?=_("My Points")?></a></li><?
 	if($_SESSION['profile']['id'] == 1 || $_SESSION['profile']['id'] == 5897)
 		echo "<li><a href='sqldump.php'>SQL Dump</a></li>";
 	?></ul>
@@ -209,7 +209,7 @@ function hideall() {
       <ul class="menu" id="serverorg"><li><a href="account.php?id=20"><?=_("New")?></a></li><li><a href="account.php?id=22"><?=_("View")?></a></li></ul>
     </div>
 <? } ?>
-<? if(mysql_num_rows(mysql_query("select * from `org` where `memid`='".intval($_SESSION['profile']['id'])."' and `masteracc`='1'")) > 0 || $_SESSION['profile']['orgadmin'] == 1) { ?>
+<? if(mysql_num_rows(mysql_query("select * from `org` where `memid`='".intval($_SESSION['profile']['id'])."'")) > 0 || $_SESSION['profile']['orgadmin'] == 1) { ?>
     <div class="relatedLinks">
       <h3 class="pointer" onclick="explode('orgadmin')">+ <?=_("Org Admin")?></h3>
       <ul class="menu" id="orgadmin"><? if($_SESSION['profile']['orgadmin'] == 1) { ?><li><a href="account.php?id=24"><?=_("New Organisation")?></a></li><li><a href="account.php?id=25"><?=_("View Organisations")?></a></li><? } ?><li><a href="account.php?id=35"><?=_("View")?></a></li></ul>
@@ -262,6 +262,7 @@ function hideall() {
       <ul class="menu" id="advertising"><li><a href="advertising.php?id=1"><?=_("New Ad")?></a></li><li><a href="advertising.php?id=0"><?=_("View Ads")?></a></li></ul>
     </div>
 <? } ?>
+    <? include("about_menu.php"); ?>
   </div>
   <div id="content">
     <div class="story">
@@ -280,365 +281,7 @@ function hideall() {
   <div id="siteInfo"><a href="//wiki.cacert.org/FAQ/AboutUs"><?=_("About Us")?></a> | <a href="account.php?id=38"><?=_("Donations")?></a> | <a href="http://wiki.cacert.org/wiki/CAcertIncorporated"><?=_("Association Membership")?></a> |
 	<a href="/policy/PrivacyPolicy.html"><?=_("Privacy Policy")?></a> | <a href="account.php?id=40"><?=_("Contact Us")?></a>
 		| &copy;2002-<?=date("Y")?> <?=_("by CAcert")?></div>
-</div>  
-</body>             
+</div>
+</body>
 </html><?
 	}
-	
-	/**
-	 * Produces a log entry with the error message with log level E_USER_WARN
-	 * and a random ID an returns a message that can be displayed to the user
-	 * including the generated ID
-	 * 
-	 * @param $errormessage string
-	 * 		The error message that should be logged
-	 * @return string containing the generated ID that can be displayed to the
-	 * 		user
-	 */
-	function failWithId($errormessage) {
-		$errorId = rand();
-		trigger_error("$errormessage. ID: $errorId", E_USER_WARNING);
-		return sprintf(_("Something went wrong when processing your request. ".
-				"Please contact %s for help and provide them with the ".
-				"following ID: %d"),
-			"<a href='mailto:support@cacert.org?subject=System%20Error%20-%20".
-				"ID%3A%20$errorId'>support@cacert.org</a>",
-			$errorId);
-	}
-	
-	/**
-	 * Checks whether the given CSR contains a vulnerable key
-	 * 
-	 * @param $csr string
-	 * 		The CSR to be checked
-	 * @param $encoding string [optional]
-	 * 		The encoding the CSR is in (for the "-inform" parameter of OpenSSL,
-	 * 		currently only "PEM" (default) or "DER" allowed)
-	 * @return string containing the reason if the key is considered weak,
-	 * 		empty string otherwise
-	 */
-	function checkWeakKeyCSR($csr, $encoding = "PEM")
-	{
-		// non-PEM-encodings may be binary so don't use echo
-		$descriptorspec = array(
-			0 => array("pipe", "r"), // STDIN for child
-			1 => array("pipe", "w"), // STDOUT for child
-		);
-		$encoding = escapeshellarg($encoding);
-		$proc = proc_open("openssl req -inform $encoding -text -noout",
-			$descriptorspec, $pipes);
-		
-		if (is_resource($proc))
-		{
-			fwrite($pipes[0], $csr);
-			fclose($pipes[0]);
-			
-			$csrText = ""; 
-			while (!feof($pipes[1]))
-			{
-				$csrText .= fread($pipes[1], 8192);
-			}
-			fclose($pipes[1]);
-			
-			if (($status = proc_close($proc)) !== 0 || $csrText === "")
-			{
-				return _("I didn't receive a valid Certificate Request, hit ".
-				"the back button and try again.");
-			}
-		} else {
-			return failWithId("checkWeakKeyCSR(): Failed to start OpenSSL");
-		}
-		
-		
-		return checkWeakKeyText($csrText);
-	}
-	
-	/**
-	 * Checks whether the given X509 certificate contains a vulnerable key
-	 * 
-	 * @param $cert string
-	 * 		The X509 certificate to be checked
-	 * @param $encoding string [optional]
-	 * 		The encoding the certificate is in (for the "-inform" parameter of
-	 * 		OpenSSL, currently only "PEM" (default), "DER" or "NET" allowed)
-	 * @return string containing the reason if the key is considered weak,
-	 * 		empty string otherwise
-	 */
-	function checkWeakKeyX509($cert, $encoding = "PEM")
-	{
-		// non-PEM-encodings may be binary so don't use echo
-		$descriptorspec = array(
-			0 => array("pipe", "r"), // STDIN for child
-			1 => array("pipe", "w"), // STDOUT for child
-		);
-		$encoding = escapeshellarg($encoding);
-		$proc = proc_open("openssl x509 -inform $encoding -text -noout",
-			$descriptorspec, $pipes);
-		
-		if (is_resource($proc))
-		{
-			fwrite($pipes[0], $cert);
-			fclose($pipes[0]);
-			
-			$certText = ""; 
-			while (!feof($pipes[1]))
-			{
-				$certText .= fread($pipes[1], 8192);
-			}
-			fclose($pipes[1]);
-			
-			if (($status = proc_close($proc)) !== 0 || $certText === "")
-			{
-				return _("I didn't receive a valid Certificate Request, hit ".
-				"the back button and try again.");
-			}
-		} else {
-			return failWithId("checkWeakKeyCSR(): Failed to start OpenSSL");
-		}
-		
-		
-		return checkWeakKeyText($certText);
-	}
-	
-	/**
-	 * Checks whether the given SPKAC contains a vulnerable key
-	 * 
-	 * @param $spkac string
-	 * 		The SPKAC to be checked
-	 * @param $spkacname string [optional]
-	 * 		The name of the variable that contains the SPKAC. The default is
-	 * 		"SPKAC"
-	 * @return string containing the reason if the key is considered weak,
-	 * 		empty string otherwise
-	 */
-	function checkWeakKeySPKAC($spkac, $spkacname = "SPKAC")
-	{
-		/* Check for the debian OpenSSL vulnerability */
-		
-		$spkac = escapeshellarg($spkac);
-		$spkacname = escapeshellarg($spkacname);
-		$spkacText = `echo $spkac | openssl spkac -spkac $spkacname`;
-		if ($spkacText === null) {
-			return _("I didn't receive a valid Certificate Request, hit the ".
-				"back button and try again.");
-		}
-		
-		return checkWeakKeyText($spkacText);
-	}
-	
-	/**
-	 * Checks whether the given text representation of a CSR or a SPKAC contains
-	 * a weak key
-	 * 
-	 * @param $text string
-	 * 		The text representation of a key as output by the
-	 * 		"openssl <foo> -text -noout" commands
-	 * @return string containing the reason if the key is considered weak,
-	 * 		empty string otherwise
-	 */
-	function checkWeakKeyText($text)
-	{
-		/* Which public key algorithm? */
-		if (!preg_match('/^\s*Public Key Algorithm: ([^\s]+)$/m', $text,
-				$algorithm))
-		{
-			return failWithId("checkWeakKeyText(): Couldn't extract the ".
-					"public key algorithm used");
-		} else {
-			$algorithm = $algorithm[1];
-		}
-		
-		
-		if ($algorithm === "rsaEncryption")
-		{
-			if (!preg_match('/^\s*RSA Public Key: \((\d+) bit\)$/m', $text,
-					$keysize))
-			{
-				return failWithId("checkWeakKeyText(): Couldn't parse the RSA ".
-						"key size");
-			} else {
-				$keysize = intval($keysize[1]);
-			}
-			
-			if ($keysize < 1024)
-			{
-				return sprintf(_("The keys that you use are very small ".
-						"and therefore insecure. Please generate stronger ".
-						"keys. More information about this issue can be ".
-						"found in %sthe wiki%s"),
-					"<a href='//wiki.cacert.org/WeakKeys#SmallKey'>",
-					"</a>");
-			} elseif ($keysize < 2048) {
-				// not critical but log so we have some statistics about
-				// affected users
-				trigger_error("checkWeakKeyText(): Certificate for small ".
-						"key (< 2048 bit) requested", E_USER_NOTICE);
-			}
-			
-			
-			$debianVuln = checkDebianVulnerability($text, $keysize);
-			if ($debianVuln === true)
-			{
-				return sprintf(_("The keys you use have very likely been ".
-						"generated with a vulnerable version of OpenSSL which ".
-						"was distributed by debian. Please generate new keys. ".
-						"More information about this issue can be found in ".
-						"%sthe wiki%s"),
-					"<a href='//wiki.cacert.org/WeakKeys#DebianVulnerability'>",
-					"</a>");
-			} elseif ($debianVuln === false) {
-				// not vulnerable => do nothing
-			} else {
-				return failWithId("checkWeakKeyText(): Something went wrong in".
-					"checkDebianVulnerability()");
-			}
-			
-			if (!preg_match('/^\s*Exponent: (\d+) \(0x[0-9a-fA-F]+\)$/m', $text,
-					$exponent))
-			{
-				return failWithId("checkWeakKeyText(): Couldn't parse the RSA ".
-						"exponent");
-			} else {
-				$exponent = $exponent[1]; // exponent might be very big =>
-					//handle as string using bc*()  
-				
-				if (bccomp($exponent, "3") === 0)
-				{
-					return sprintf(_("The keys you use might be insecure. ".
-							"Although there is currently no known attack for ".
-							"reasonable encryption schemes, we're being ".
-							"cautious and don't allow certificates for such ".
-							"keys. Please generate stronger keys. More ".
-							"information about this issue can be found in ".
-							"%sthe wiki%s"),
-						"<a href='//wiki.cacert.org/WeakKeys#SmallExponent'>",
-						"</a>");
-				} elseif (!(bccomp($exponent, "65537") >= 0 &&
-						(bccomp($exponent, "100000") === -1 ||
-							// speed things up if way smaller than 2^256
-						bccomp($exponent, bcpow("2", "256")) === -1) )) {
-					// 65537 <= exponent < 2^256 recommended by NIST
-					// not critical but log so we have some statistics about
-					// affected users
-					trigger_error("checkWeakKeyText(): Certificate for ".
-							"unsuitable exponent '$exponent' requested",
-							E_USER_NOTICE);
-				}
-			}
-		}
-		
-		/* No weakness found */
-		return "";
-	}
-	
-	/**
-	 * Reimplement the functionality of the openssl-vulnkey tool
-	 * 
-	 * @param $text string
-	 * 		The text representation of a key as output by the
-	 * 		"openssl <foo> -text -noout" commands
-	 * @param $keysize int [optional]
-	 * 		If the key size is already known it can be provided so it doesn't
-	 * 		have to be parsed again. This also skips the check whether the key
-	 * 		is an RSA key => use wisely
-	 * @return TRUE if key is vulnerable, FALSE otherwise, NULL in case of error
-	 */
-	function checkDebianVulnerability($text, $keysize = 0)
-	{
-		$keysize = intval($keysize);
-		
-		if ($keysize === 0)
-		{
-			/* Which public key algorithm? */
-			if (!preg_match('/^\s*Public Key Algorithm: ([^\s]+)$/m', $text,
-				$algorithm))
-			{
-				trigger_error("checkDebianVulnerability(): Couldn't extract ".
-					"the public key algorithm used", E_USER_WARNING);
-				return null;
-			} else {
-				$algorithm = $algorithm[1];
-			}
-			
-			if ($algorithm !== "rsaEncryption") return false;
-			
-			/* Extract public key size */
-			if (!preg_match('/^\s*RSA Public Key: \((\d+) bit\)$/m', $text,
-				$keysize))
-			{
-				trigger_error("checkDebianVulnerability(): Couldn't parse the ".
-					"RSA key size", E_USER_WARNING);
-				return null;
-			} else {
-				$keysize = intval($keysize[1]);
-			}
-		}
-		
-		// $keysize has been made sure to contain an int
-		$blacklist = "/usr/share/openssl-blacklist/blacklist.RSA-$keysize";
-		if (!(is_file($blacklist) && is_readable($blacklist)))
-		{
-			if (in_array($keysize, array(512, 1024, 2048, 4096)))
-			{
-				trigger_error("checkDebianVulnerability(): Blacklist for ".
-						"$keysize bit keys not accessible. Expected at ".
-						"$blacklist", E_USER_ERROR);
-				return null;
-			}
-			
-			trigger_error("checkDebianVulnerability(): $blacklist is not ".
-				"readable. Unsupported key size?", E_USER_WARNING);
-			return false;
-		}
-		
-		
-		/* Extract RSA modulus */
-		if (!preg_match('/^\s*Modulus \(\d+ bit\):\n'.
-				'((?:\s*[0-9a-f][0-9a-f]:(?:\n)?)+[0-9a-f][0-9a-f])$/m',
-			$text, $modulus))
-		{
-			trigger_error("checkDebianVulnerability(): Couldn't extract the ".
-				"RSA modulus", E_USER_WARNING);
-			return null;
-		} else {
-			$modulus = $modulus[1];
-			// strip whitespace and colon leftovers
-			$modulus = str_replace(array(" ", "\t", "\n", ":"), "", $modulus);
-			
-			// when using "openssl xxx -text" first byte was 00 in all my test
-			// cases but 00 not present in the "openssl xxx -modulus" output
-			if ($modulus[0] === "0" && $modulus[1] === "0")
-			{
-				$modulus = substr($modulus, 2);
-			} else {
-				trigger_error("checkDebianVulnerability(): First byte is not ".
-					"zero", E_USER_NOTICE);
-			}
-			
-			$modulus = strtoupper($modulus);
-		}
-		
-		
-		/* calculate checksum and look it up in the blacklist */
-		$checksum = substr(sha1("Modulus=$modulus\n"), 20);
-		
-		// $checksum and $blacklist should be safe, but just to make sure
-		$checksum = escapeshellarg($checksum);
-		$blacklist = escapeshellarg($blacklist);
-		exec("grep $checksum $blacklist", $dummy, $debianVuln);
-		if ($debianVuln === 0) // grep returned something => it is on the list
-		{
-			return true;
-		} elseif ($debianVuln === 1) { // grep returned nothing
-			return false;
-		} else {
-			trigger_error("checkDebianVulnerability(): Something went wrong ".
-				"when looking up the key with checksum $checksum in the ".
-				"blacklist $blacklist", E_USER_ERROR);
-			return null;
-		}
-		
-		// Should not get here
-		return null;
-	}
-?>
diff --git a/includes/general.php b/includes/general.php
index 4919c84..d89c0e6 100644
--- a/includes/general.php
+++ b/includes/general.php
@@ -15,13 +15,16 @@
     along with this program; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 */
+
+	require_once(dirname(__FILE__)."/lib/general.php");
+
 	session_name("cacert");
 	session_start();
 
-	session_register("_config");
-	session_register("profile");
-	session_register("signup");
-	session_register("lostpw");
+//	session_register("_config");
+//	session_register("profile");
+//	session_register("signup");
+//	session_register("lostpw");
 //	if($_SESSION['profile']['id'] > 0)
 //		session_regenerate_id();
 
@@ -215,7 +218,8 @@
 
 		//echo "Points due to name matches: $points<br/>";
 
-		$do = `grep '$pwd' /usr/share/dict/american-english`;
+		$shellpwd = escapeshellarg($pwd);
+		$do = `grep $shellpwd /usr/share/dict/american-english`;
 		if($do)
 			$points--;
 
@@ -487,10 +491,6 @@
 				return(0);
 		}
 
-		if($points >= 300)
-			return(200);
-		if($points >= 200)
-			return(150);
 		if($points >= 150)
 			return(35);
 		if($points >= 140)
@@ -536,17 +536,22 @@
 		$myemail = mysql_real_escape_string($email);
 		if(preg_match("/^([a-zA-Z0-9])+([a-zA-Z0-9\+\._-])*@([a-zA-Z0-9_-])+([a-zA-Z0-9\._-]+)+$/" , $email))
 		{
-			list($username,$domain)=split('@',$email);
+			list($username,$domain)=explode('@',$email,2);
 			$dom = escapeshellarg($domain);
 			$line = trim(`dig +short MX $dom 2>&1`);
 #echo $email."-$dom-$line-\n";
 #echo `dig +short mx heise.de 2>&1`."-<br>\n";
 
 			$list = explode("\n", $line);
-			foreach($list as $row)
-				list($pri, $mxhosts[]) = explode(" ", substr(trim($row), 0, -1));
+			foreach($list as $row) {
+				if(!strstr($row, " ")) {
+					continue;
+				}
+				list($pri, $mxhosts[]) = explode(" ", trim($row), 2);
+			}
 			$mxhosts[] = $domain;
-#print_r($mxhosts); die;
+			array_walk($mxhosts, function(&$mx) { $mx = trim($mx, '.'); } );
+
 			foreach($mxhosts as $key => $domain)
 			{
 				$fp = @fsockopen($domain,25,$errno,$errstr,5);
@@ -728,37 +733,7 @@
 		return($text);
 	}
 	
-	// returns 0 if $userID is an Assurer
-	// Otherwise :
-	//	 Bit 0 is always set
-	//	 Bit 1 is set if 100 Assurance Points are not reached
-	//	 Bit 2 is set if Assurer Test is missing
-	//	 Bit 3 is set if the user is not allowed to be an Assurer (assurer_blocked > 0)
-	function get_assurer_status($userID)
-	{
-		$Result = 0;
-		$query = mysql_query('SELECT * FROM `cats_passed` AS `tp`, `cats_variant` AS `cv` '.
-			'  WHERE `tp`.`variant_id` = `cv`.`id` AND `cv`.`type_id` = 1 AND `tp`.`user_id` = \''.(int)intval($userID).'\'');
-		if(mysql_num_rows($query) < 1)
-		{
-			$Result |= 5;
-		}
-		
-		$query = mysql_query('SELECT SUM(`points`) AS `points` FROM `notary` AS `n` WHERE `n`.`to` = \''.(int)intval($userID).'\' AND `n`.`expire` < now()');
-		$row = mysql_fetch_assoc($query);
-		if ($row['points'] < 100) {
-			$Result |= 3;
-		}
-		
-		$query = mysql_query('SELECT `assurer_blocked` FROM `users` WHERE `id` = \''.(int)intval($userID).'\'');
-		$row = mysql_fetch_assoc($query);
-		if ($row['assurer_blocked'] > 0) {
-			$Result |= 9;
-		}
-		
-		return $Result;
-	}
-	
+
 	// returns text message to be shown to the user given the result of is_no_assurer
 	function no_assurer_text($Status)
 	{
@@ -827,4 +802,5 @@
 		return $res;
 	}
 
+
 ?>
diff --git a/includes/keygen.php b/includes/keygen.php
new file mode 100644
index 0000000..2713a81
--- /dev/null
+++ b/includes/keygen.php
@@ -0,0 +1,128 @@
+<? /*
+    LibreSSL - CAcert web application
+    Copyright (C) 2004-2011  CAcert Inc.
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; version 2 of the License.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+if (array_key_exists('HTTP_USER_AGENT',$_SERVER) && strstr($_SERVER['HTTP_USER_AGENT'], "MSIE")) { ?>
+
+	<noscript>
+		<p><?=_('You have to enable JavaScript to generate certificates in the browser.')?></p>
+		<p><?=_('If you don\'t want to do that for any reason, you can use '.
+			'manually created certificate requests instead.')?></p>
+	</noscript>
+
+	<div id="noActiveX" style="color:red">
+		<p><?=_('Could not initialize ActiveX object required for certificate generation.')?></p>
+		<p><?=_('You have to enable ActiveX for this to work. On Windows Vista, Windows 7 and '.
+			'later versions you have to add this website to the list of trusted sites '.
+			'in the internet settings.')?></p>
+		<p><?php
+			printf(_('Go to "Extras -> Internet Options -> Security -> Trusted '.
+				'Websites", click on "Custom Level", set "ActiveX control '.
+				'elements that are not marked as safe initialized on start in '.
+				'scripts" to "Confirm" and click "OK". Now click "Sites", add '.
+				'"%s" and "%s" to your list of trusted sites and make the '.
+				'changes come into effect by clicking "Close" and "OK".'),
+				'https://'.$_SESSION['_config']['normalhostname'],
+				'https://'.$_SESSION['_config']['securehostname'])?>
+		</p>
+	</div>
+
+	<form method="post" style="display:none" action="account.php"
+			id="CertReqForm">
+		<input type="hidden" name="oldid" value="<?=intval($id)?>" />
+		<input type="hidden" id="CSR" name="CSR" />
+		<input type="hidden" name="keytype" value="MS" />
+
+		<p><?=_('Security level')?>:
+			<select id="SecurityLevel">
+				<option value="high" selected="selected"><?=_('High')?></option>
+				<option value="medium"><?=_('Medium')?></option>
+				<option value="custom"><?=_('Custom')?>&hellip;</option>
+			</select>
+		</p>
+
+		<fieldset id="customSettings" style="display:none">
+			<legend><?=_('Custom Parameters')?></legend>
+
+			<p><?=_('Cryptography Provider')?>:
+				<select id="CspProvider"></select>
+			</p>
+			<p><?=_('Algorithm')?>: <select id="algorithm"></select></p>
+			<p><?=_('Keysize')?>:
+				<input id="keySize" type="number" />
+				<?=_('Minimum Size')?>: <span id="keySizeMin"></span>,
+				<?=_('Maximum Size')?>: <span id="keySizeMax"></span>,
+				<?php
+				// TRANSLATORS: this specifies the step between two valid key
+				// sizes. E.g. if the step is 512 and the minimum is 1024 and
+				// the maximum is 2048, then only 1024, 1536 and 2048 bits may
+				// be specified as key size.
+				echo _('Step')?>: <span id="keySizeStep"></span></p>
+			<p style="color:red"><?php
+				printf(_('Please note that RSA key sizes smaller than %d bit '.
+					'will not be accepted by CAcert.'),
+					2048)?>
+			</p>
+		</fieldset>
+
+		<p><input type="submit" id="GenReq" name="GenReq" value="<?=_('Create Certificate')?>" /></p>
+		<p id="generatingKeyNotice" style="display:none">
+			<?=_('Generating your key. Please wait')?>&hellip;</p>
+	</form>
+
+	<!-- Error messages used in the JavaScript. Defined here so they can be
+	translated without passing the JavaScript code through PHP -->
+	<p id="createRequestErrorChooseAlgorithm" style="display:none">
+		<?=_('Could not generate certificate request. Probably you need to '.
+			'choose a different algorithm.')?>
+	</p>
+	<p id="createRequestErrorConfirmDialogue" style="display:none">
+		<?=_('Could not generate certificate request. Please confirm the '.
+			'dialogue if you are asked if you want to generate the key.')?>
+	</p>
+	<p id="createRequestErrorConnectDevice" style="display:none">
+		<?=_('Could not generate certificate request. Please make sure the '.
+			'cryptography device (e.g. the smartcard) is connected.')?>
+	</p>
+	<p id="createRequestError" style="display:none">
+		<?=_('Could not generate certificate request.')?>
+	</p>
+	<p id="invalidKeySizeError" style="display:none">
+		<?=_('You have specified an invalid key size')?>
+	</p>
+	<p id="unsupportedPlatformError" style="display:none">
+		<?=_('Could not initialize the cryptographic module for your '.
+			'platform. Currently we support Microsoft Windows XP, Vista '.
+			'and 7. If you\'re using one of these platforms and see this '.
+			'error message anyway you might have to enable ActiveX as '.
+			'described in the red explanation text and accept loading of '.
+			'the module.')?>
+	</p>
+
+	<script type="text/javascript" src="keygenIE.js"></script>
+
+<? } else { ?>
+	<p>
+		<form method="post" action="account.php">
+			<input type="hidden" name="keytype" value="NS">
+			<?=_("Keysize:")?> <keygen name="SPKAC" challenge="<? $_SESSION['spkac_hash']=make_hash(); echo $_SESSION['spkac_hash']; ?>">
+
+			<input type="submit" name="submit" value="<?=_("Create Certificate Request")?>">
+			<input type="hidden" name="oldid" value="<?=intval($id)?>">
+		</form>
+	</p>
+<? }
diff --git a/includes/lib/account.php b/includes/lib/account.php
index f7a24fa..e311668 100644
--- a/includes/lib/account.php
+++ b/includes/lib/account.php
@@ -17,32 +17,79 @@
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 */
 
-function fix_assurer_flag($userID)
+/**
+ * Function to recalculate the cached Assurer status
+ * 
+ * @param int $userID
+ * 	if the user ID is not given the flag will be recalculated for all users
+ * 
+ * @return bool
+ * 	false if there was an error on fixing the flag. This does NOT return the
+ * 	new value of the flag
+ */
+function fix_assurer_flag($userID = NULL)
 {
-	// Update Assurer-Flag on users table if 100 points.
-	// Should the number of points be SUM(points) or SUM(awarded)?
-	$query = mysql_query('UPDATE `users` AS `u` SET `assurer` = 1 WHERE '.
-		'`u`.`id` = \''.(int)intval($userID).'\' AND '.
-		'EXISTS(SELECT 1 FROM `cats_passed` AS `cp`, `cats_variant` AS `cv` '.
-			'WHERE `cp`.`variant_id` = `cv`.`id` AND `cv`.`type_id` = 1 AND '.
-			'`cp`.`user_id` = `u`.`id`) AND '.
-		'(SELECT SUM(`points`) FROM `notary` AS `n` WHERE `n`.`to` = `u`.`id` '.
-			'AND (`n`.`expire` > now() OR `n`.`expire` IS NULL)) >= 100');
-	// Challenge has been passed and non-expired points >= 100
+	// Update Assurer-Flag on users table if 100 points and CATS passed.
+	// 
+	// We may have some performance issues here if no userID is given
+	// there are ~150k assurances and ~220k users currently
+	// but the exists-clause on cats_passed should be a good filter
+	$sql = '
+		UPDATE `users` AS `u` SET `assurer` = 1
+		WHERE '.(
+					($userID === NULL) ?
+					'`u`.`assurer` = 0' :
+					'`u`.`id` = \''.intval($userID).'\''
+				).'
+			AND EXISTS(
+				SELECT 1 FROM `cats_passed` AS `cp`, `cats_variant` AS `cv`
+				WHERE `cp`.`variant_id` = `cv`.`id`
+					AND `cv`.`type_id` = 1
+					AND `cp`.`user_id` = `u`.`id`
+			) 
+			AND (
+				SELECT SUM(`points`) FROM `notary` AS `n`
+				WHERE `n`.`to` = `u`.`id`
+					AND (`n`.`expire` > now()
+					OR `n`.`expire` IS NULL)
+			) >= 100';
 	
+	$query = mysql_query($sql);
 	if (!$query) {
 		return false;
 	}
- 
+	// Challenge has been passed and non-expired points >= 100
+	
 	// Reset flag if requirements are not met
-	$query = mysql_query('UPDATE `users` AS `u` SET `assurer` = 0 WHERE '.
-		'`u`.`id` = \''.(int)intval($userID).'\' AND '.
-		'(NOT EXISTS(SELECT 1 FROM `cats_passed` AS `cp`, `cats_variant` AS '.
-			'`cv` WHERE `cp`.`variant_id` = `cv`.`id` AND `cv`.`type_id` = 1 '.
-			'AND `cp`.`user_id` = `u`.`id`) OR '.
-		'(SELECT SUM(`points`) FROM `notary` AS `n` WHERE `n`.`to` = `u`.`id` '.
-			'AND (`n`.`expire` > now() OR `n`.`expire` IS NULL)) < 100)');
+	//
+	// Also a bit performance critical but assurer flag is only set on
+	// ~5k accounts
+	$sql = '
+		UPDATE `users` AS `u` SET `assurer` = 0
+		WHERE '.(
+					($userID === NULL) ?
+					'`u`.`assurer` <> 0' :
+					'`u`.`id` = \''.intval($userID).'\''
+				).'
+			AND (
+				NOT EXISTS(
+					SELECT 1 FROM `cats_passed` AS `cp`,
+						`cats_variant` AS `cv`
+					WHERE `cp`.`variant_id` = `cv`.`id`
+						AND `cv`.`type_id` = 1
+						AND `cp`.`user_id` = `u`.`id`
+				)
+				OR (
+					SELECT SUM(`points`) FROM `notary` AS `n`
+					WHERE `n`.`to` = `u`.`id`
+						AND (
+							`n`.`expire` > now()
+							OR `n`.`expire` IS NULL
+						)
+				) < 100
+			)';
 	
+	$query = mysql_query($sql);
 	if (!$query) {
 		return false;
 	}
diff --git a/includes/lib/check_weak_key.php b/includes/lib/check_weak_key.php
new file mode 100644
index 0000000..217b885
--- /dev/null
+++ b/includes/lib/check_weak_key.php
@@ -0,0 +1,318 @@
+<?php /*
+    LibreSSL - CAcert web application
+    Copyright (C) 2004-2011  CAcert Inc.
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; version 2 of the License.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+// failWithId()
+require_once 'general.php';
+
+
+/**
+* Checks whether the given CSR contains a vulnerable key
+*
+* @param $csr string
+* 		The CSR to be checked
+* @param $encoding string [optional]
+* 		The encoding the CSR is in (for the "-inform" parameter of OpenSSL,
+* 		currently only "PEM" (default) or "DER" allowed)
+* @return string containing the reason if the key is considered weak,
+* 		empty string otherwise
+*/
+function checkWeakKeyCSR($csr, $encoding = "PEM")
+{
+	$encoding = escapeshellarg($encoding);
+	$status = runCommand("openssl req -inform $encoding -text -noout",
+	                     $csr, $csrText);
+	if ($status === true) {
+		return failWithId("checkWeakKeyCSR(): Failed to start OpenSSL");
+	}
+	
+	if ($status !== 0 || $csrText === "") {
+		return _("I didn't receive a valid Certificate Request. Hit ".
+			"the back button and try again.");
+	}
+	
+	return checkWeakKeyText($csrText);
+}
+
+/**
+ * Checks whether the given X509 certificate contains a vulnerable key
+ *
+ * @param $cert string
+ * 		The X509 certificate to be checked
+ * @param $encoding string [optional]
+ * 		The encoding the certificate is in (for the "-inform" parameter of
+ * 		OpenSSL, currently only "PEM" (default), "DER" or "NET" allowed)
+ * @return string containing the reason if the key is considered weak,
+ * 		empty string otherwise
+ */
+function checkWeakKeyX509($cert, $encoding = "PEM")
+{
+	$encoding = escapeshellarg($encoding);
+	$status = runCommand("openssl x509 -inform $encoding -text -noout",
+	                     $cert, $certText);
+	if ($status === true) {
+		return failWithId("checkWeakKeyX509(): Failed to start OpenSSL");
+	}
+	
+	if ($status !== 0 || $certText === "") {
+		return _("I didn't receive a valid Certificate Request. Hit ".
+			"the back button and try again.");
+	}
+	
+	return checkWeakKeyText($certText);
+}
+
+/**
+ * Checks whether the given SPKAC contains a vulnerable key
+ *
+ * @param $spkac string
+ * 		The SPKAC to be checked
+ * @param $spkacname string [optional]
+ * 		The name of the variable that contains the SPKAC. The default is
+ * 		"SPKAC"
+ * @return string containing the reason if the key is considered weak,
+ * 		empty string otherwise
+ */
+function checkWeakKeySPKAC($spkac, $spkacname = "SPKAC")
+{
+	$spkacname = escapeshellarg($spkacname);
+	$status = runCommand("openssl spkac -spkac $spkacname", $spkac, $spkacText);
+	if ($status === true) {
+		return failWithId("checkWeakKeySPKAC(): Failed to start OpenSSL");
+	}
+	
+	if ($status !== 0 || $spkacText === "") {
+		return _("I didn't receive a valid Certificate Request. Hit the ".
+			"back button and try again.");
+	}
+	
+	return checkWeakKeyText($spkacText);
+}
+
+/**
+ * Checks whether the given text representation of a CSR or a SPKAC contains
+ * a weak key
+ *
+ * @param $text string
+ * 		The text representation of a key as output by the
+ * 		"openssl <foo> -text -noout" commands
+ * @return string containing the reason if the key is considered weak,
+ * 		empty string otherwise
+ */
+function checkWeakKeyText($text)
+{
+	/* Which public key algorithm? */
+	if (!preg_match('/^\s*Public Key Algorithm: ([^\s]+)$/m', $text,
+	$algorithm))
+	{
+		return failWithId("checkWeakKeyText(): Couldn't extract the ".
+					"public key algorithm used.\nData:\n$text");
+	} else {
+		$algorithm = $algorithm[1];
+	}
+
+
+	if ($algorithm === "rsaEncryption")
+	{
+		if (!preg_match('/^\s*RSA Public Key: \((\d+) bit\)$/m', $text,
+		$keysize))
+		{
+			return failWithId("checkWeakKeyText(): Couldn't parse the RSA ".
+						"key size.\nData:\n$text");
+		} else {
+			$keysize = intval($keysize[1]);
+		}
+			
+		if ($keysize < 2048)
+		{
+			return sprintf(_("The keys that you use are very small ".
+						"and therefore insecure. Please generate stronger ".
+						"keys. More information about this issue can be ".
+						"found in %sthe wiki%s"),
+					"<a href='//wiki.cacert.org/WeakKeys#SmallKey'>",
+					"</a>");
+		}
+			
+			
+		$debianVuln = checkDebianVulnerability($text, $keysize);
+		if ($debianVuln === true)
+		{
+			return sprintf(_("The keys you use have very likely been ".
+						"generated with a vulnerable version of OpenSSL which ".
+						"was distributed by debian. Please generate new keys. ".
+						"More information about this issue can be found in ".
+						"%sthe wiki%s"),
+					"<a href='//wiki.cacert.org/WeakKeys#DebianVulnerability'>",
+					"</a>");
+		} elseif ($debianVuln === false) {
+			// not vulnerable => do nothing
+		} else {
+			return failWithId("checkWeakKeyText(): Something went wrong in".
+					"checkDebianVulnerability().\nKeysize: $keysize\n".
+					"Data:\n$text");
+		}
+			
+		if (!preg_match('/^\s*Exponent: (\d+) \(0x[0-9a-fA-F]+\)$/m', $text,
+		$exponent))
+		{
+			return failWithId("checkWeakKeyText(): Couldn't parse the RSA ".
+						"exponent.\nData:\n$text");
+		} else {
+			$exponent = $exponent[1]; // exponent might be very big =>
+			//handle as string using bc*()
+
+			if (bccomp($exponent, "3") === 0)
+			{
+				return sprintf(_("The keys you use might be insecure. ".
+							"Although there is currently no known attack for ".
+							"reasonable encryption schemes, we're being ".
+							"cautious and don't allow certificates for such ".
+							"keys. Please generate stronger keys. More ".
+							"information about this issue can be found in ".
+							"%sthe wiki%s"),
+						"<a href='//wiki.cacert.org/WeakKeys#SmallExponent'>",
+						"</a>");
+			} elseif (!(bccomp($exponent, "65537") >= 0 &&
+			(bccomp($exponent, "100000") === -1 ||
+			// speed things up if way smaller than 2^256
+			bccomp($exponent, bcpow("2", "256")) === -1) )) {
+				// 65537 <= exponent < 2^256 recommended by NIST
+				// not critical but log so we have some statistics about
+				// affected users
+				trigger_error("checkWeakKeyText(): Certificate for ".
+							"unsuitable exponent '$exponent' requested",
+				E_USER_NOTICE);
+			}
+		}
+	}
+
+	/* No weakness found */
+	return "";
+}
+
+/**
+ * Reimplement the functionality of the openssl-vulnkey tool
+ *
+ * @param $text string
+ * 		The text representation of a key as output by the
+ * 		"openssl <foo> -text -noout" commands
+ * @param $keysize int [optional]
+ * 		If the key size is already known it can be provided so it doesn't
+ * 		have to be parsed again. This also skips the check whether the key
+ * 		is an RSA key => use wisely
+ * @return TRUE if key is vulnerable, FALSE otherwise, NULL in case of error
+ */
+function checkDebianVulnerability($text, $keysize = 0)
+{
+	$keysize = intval($keysize);
+
+	if ($keysize === 0)
+	{
+		/* Which public key algorithm? */
+		if (!preg_match('/^\s*Public Key Algorithm: ([^\s]+)$/m', $text,
+		$algorithm))
+		{
+			trigger_error("checkDebianVulnerability(): Couldn't extract ".
+					"the public key algorithm used.\nData:\n$text",
+					E_USER_WARNING);
+			return null;
+		} else {
+			$algorithm = $algorithm[1];
+		}
+			
+		if ($algorithm !== "rsaEncryption") return false;
+			
+		/* Extract public key size */
+		if (!preg_match('/^\s*RSA Public Key: \((\d+) bit\)$/m', $text,
+		$keysize))
+		{
+			trigger_error("checkDebianVulnerability(): Couldn't parse the ".
+					"RSA key size.\nData:\n$text", E_USER_WARNING);
+			return null;
+		} else {
+			$keysize = intval($keysize[1]);
+		}
+	}
+
+	// $keysize has been made sure to contain an int
+	$blacklist = "/usr/share/openssl-blacklist/blacklist.RSA-$keysize";
+	if (!(is_file($blacklist) && is_readable($blacklist)))
+	{
+		if (in_array($keysize, array(512, 1024, 2048, 4096)))
+		{
+			trigger_error("checkDebianVulnerability(): Blacklist for ".
+						"$keysize bit keys not accessible. Expected at ".
+						"$blacklist", E_USER_ERROR);
+			return null;
+		}
+			
+		trigger_error("checkDebianVulnerability(): $blacklist is not ".
+				"readable. Unsupported key size?", E_USER_WARNING);
+		return false;
+	}
+
+
+	/* Extract RSA modulus */
+	if (!preg_match('/^\s*Modulus \(\d+ bit\):\n'.
+				'((?:\s*[0-9a-f][0-9a-f]:(?:\n)?)+[0-9a-f][0-9a-f])$/m',
+	$text, $modulus))
+	{
+		trigger_error("checkDebianVulnerability(): Couldn't extract the ".
+				"RSA modulus.\nData:\n$text", E_USER_WARNING);
+		return null;
+	} else {
+		$modulus = $modulus[1];
+		// strip whitespace and colon leftovers
+		$modulus = str_replace(array(" ", "\t", "\n", ":"), "", $modulus);
+			
+		// when using "openssl xxx -text" first byte was 00 in all my test
+		// cases but 00 not present in the "openssl xxx -modulus" output
+		if ($modulus[0] === "0" && $modulus[1] === "0")
+		{
+			$modulus = substr($modulus, 2);
+		} else {
+			trigger_error("checkDebianVulnerability(): First byte is not ".
+					"zero", E_USER_NOTICE);
+		}
+			
+		$modulus = strtoupper($modulus);
+	}
+
+
+	/* calculate checksum and look it up in the blacklist */
+	$checksum = substr(sha1("Modulus=$modulus\n"), 20);
+
+	// $checksum and $blacklist should be safe, but just to make sure
+	$checksum = escapeshellarg($checksum);
+	$blacklist = escapeshellarg($blacklist);
+	$debianVuln = runCommand("grep $checksum $blacklist");
+	if ($debianVuln === 0) // grep returned something => it is on the list
+	{
+		return true;
+	} elseif ($debianVuln === 1) {
+		// grep returned nothing
+		return false;
+	} else {
+		trigger_error("checkDebianVulnerability(): Something went wrong ".
+				"when looking up the key with checksum $checksum in the ".
+				"blacklist $blacklist", E_USER_ERROR);
+		return null;
+	}
+
+	// Should not get here
+	return null;
+}
diff --git a/includes/lib/general.php b/includes/lib/general.php
index 25d2561..85b132d 100644
--- a/includes/lib/general.php
+++ b/includes/lib/general.php
@@ -47,4 +47,117 @@ function get_user_id_from_cert($serial, $issuer_cn)
 	return -1;
 }
 
-?>
+/**
+ * Produces a log entry with the error message with log level E_USER_WARN
+ * and a random ID an returns a message that can be displayed to the user
+ * including the generated ID
+ *
+ * @param $errormessage string
+ * 		The error message that should be logged
+ * @return string containing the generated ID that can be displayed to the
+ * 		user
+ */
+function failWithId($errormessage) {
+	$errorId = rand();
+	trigger_error("$errormessage. ID: $errorId", E_USER_WARNING);
+	return sprintf(_("Something went wrong when processing your request. ".
+				"Please contact %s for help and provide them with the ".
+				"following ID: %d"),
+			"<a href='mailto:support@cacert.org?subject=System%20Error%20-%20".
+				"ID%3A%20$errorId'>support@cacert.org</a>",
+	$errorId);
+}
+
+
+/**
+ * Runs a command on the shell and return it's exit code and output
+ * 
+ * @param string $command
+ * 		The command to run. Make sure that you escapeshellarg() any non-constant
+ * 		parts as this is executed on a shell!
+ * @param string|bool $input
+ * 		The input that is passed to the command via STDIN, if true the real
+ * 		STDIN is passed through
+ * @param string|bool $output
+ * 		The output the command wrote to STDOUT (this is passed as reference),
+ * 		if true the output will be written to the real STDOUT. Output is ignored
+ * 		by default
+ * @param string|bool $errors
+ * 		The output the command wrote to STDERR (this is passed as reference),
+ * 		if true (default) the output will be written to the real STDERR
+ * 
+ * @return int|bool
+ * 		The exit code of the command, true if the execution of the command
+ * 		failed (true because then
+ * 		<code>if (runCommand('echo "foo"')) handle_error();</code> will work)
+ */
+function runCommand($command, $input = "", &$output = null, &$errors = true) {
+	$descriptorspec = array();
+	
+	if ($input !== true) {
+		$descriptorspec[0] = array("pipe", "r"); // STDIN for child
+	}
+	
+	if ($output !== true) {
+		$descriptorspec[1] = array("pipe", "w"); // STDOUT for child
+	}
+	
+	if ($errors !== true) {
+		$descriptorspec[2] = array("pipe", "w"); // STDERR for child
+	}
+	
+	$proc = proc_open($command, $descriptorspec, $pipes);
+	
+	if (is_resource($proc))
+	{
+		if ($input !== true) {
+			fwrite($pipes[0], $input);
+			fclose($pipes[0]);
+		}
+		
+		if ($output !== true) {
+			$output = stream_get_contents($pipes[1]);
+		}
+		
+		if ($errors !== true) {
+			$errors = stream_get_contents($pipes[2]);
+		}
+		
+		return proc_close($proc);
+		
+	} else {
+		return true;
+	}
+}
+
+  	// returns 0 if $userID is an Assurer
+	// Otherwise :
+	//	 Bit 0 is always set
+	//	 Bit 1 is set if 100 Assurance Points are not reached
+	//	 Bit 2 is set if Assurer Test is missing
+	//	 Bit 3 is set if the user is not allowed to be an Assurer (assurer_blocked > 0)
+	function get_assurer_status($userID)
+	{
+		$Result = 0;
+		$query = mysql_query('SELECT * FROM `cats_passed` AS `tp`, `cats_variant` AS `cv` '.
+			'  WHERE `tp`.`variant_id` = `cv`.`id` AND `cv`.`type_id` = 1 AND `tp`.`user_id` = \''.(int)intval($userID).'\'');
+		if(mysql_num_rows($query) < 1)
+		{
+			$Result |= 5;
+		}
+		
+		$query = mysql_query('SELECT SUM(`points`) AS `points` FROM `notary` AS `n` WHERE `n`.`to` = \''.(int)intval($userID).'\' AND `n`.`expire` < now()');
+		$row = mysql_fetch_assoc($query);
+		if ($row['points'] < 100) {
+			$Result |= 3;
+		}
+		
+		$query = mysql_query('SELECT `assurer_blocked` FROM `users` WHERE `id` = \''.(int)intval($userID).'\'');
+		$row = mysql_fetch_assoc($query);
+		if ($row['assurer_blocked'] > 0) {
+			$Result |= 9;
+		}
+		
+		return $Result;
+	}
+	
\ No newline at end of file
diff --git a/includes/loggedin.php b/includes/loggedin.php
index 5734fad..4f9b8e8 100644
--- a/includes/loggedin.php
+++ b/includes/loggedin.php
@@ -18,20 +18,29 @@
 
 	include_once("../includes/lib/general.php");
 	require_once("../includes/lib/l10n.php");
+	include_once("../includes/mysql.php");
+
+	if(!isset($_SESSION['profile']) || !is_array($_SESSION['profile'])) {
+		$_SESSION['profile'] = array( 'id' => 0, 'loggedin' => 0 );
+	}
+	if(!isset($_SESSION['profile']['id']) || !isset($_SESSION['profile']['loggedin'])) {
+		$_SESSION['profile']['id'] = 0;
+		$_SESSION['profile']['loggedin'] = 0;
+	}
 
 	if($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] && $_SESSION['profile']['id'] > 0 && $_SESSION['profile']['loggedin'] != 0)
 	{
 		$uid = $_SESSION['profile']['id'];
 		$_SESSION['profile']['loggedin'] = 0;
 		$_SESSION['profile'] = "";
-		foreach($_SESSION as $key)
+		foreach($_SESSION as $key => $value)
 		{
-			if($key == '_config')
+			if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5))
 				continue;
 			if(is_int($key) || is_string($key))
 		                unset($_SESSION[$key]);
-	                unset($$key);
-        	        session_unregister($key);
+		        unset($$key);
+		        //session_unregister($key);
 		}
 
 		$_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$uid'"));
@@ -50,14 +59,14 @@
 		{
 			$_SESSION['profile']['loggedin'] = 0;
 			$_SESSION['profile'] = "";
-			foreach($_SESSION as $key)
+			foreach($_SESSION as $key => $value)
 			{
-				if($key == '_config')
+				if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5))
 					continue;
 				if(is_int($key) || is_string($key))
 			                unset($_SESSION[$key]);
-                		unset($$key);
-       			        session_unregister($key);
+			        unset($$key);
+			        //session_unregister($key);
 			}
 
 			$_SESSION['profile'] = mysql_fetch_assoc(mysql_query(
@@ -69,16 +78,16 @@
 		} else {
 			$_SESSION['profile']['loggedin'] = 0;
 			$_SESSION['profile'] = "";
-			foreach($_SESSION as $key)
+			foreach($_SESSION as $key => $value)
 			{
-				if($key == '_config')
+				if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5))
 					continue;
-		                unset($_SESSION[$key]);
-	                	unset($$key);
-        		        session_unregister($key);
+			        unset($_SESSION[$key]);
+			        unset($$key);
+			        //session_unregister($key);
 			}
 
-			unset($_SESSION['_config']['oldlocation']);
+			$_SESSION['_config']['oldlocation'] = '';
 
 			foreach($_GET as $key => $val)
 			{
@@ -127,9 +136,9 @@
 		$_SESSION['profile'] = "";
 		foreach($_SESSION as $key => $value)
 		{
-	                unset($_SESSION[$key]);
-	                unset($$key);
-        	        session_unregister($key);
+		        unset($_SESSION[$key]);
+		        unset($$key);
+		        //session_unregister($key);
 		}
 
 		header("location: https://".$normalhost."/index.php");
@@ -138,11 +147,11 @@
 
 	if($_SESSION['profile']['loggedin'] < 1)
 	{
-		unset($_SESSION['_config']['oldlocation']);
+		$_SESSION['_config']['oldlocation'] = '';
 
 		foreach($_REQUEST as $key => $val)
 		{
-			if($_SESSION['_config']['oldlocation'])
+			if('' != $_SESSION['_config']['oldlocation'])
 				$_SESSION['_config']['oldlocation'] .= "&";
 
 			$key = str_replace(array("\n", "\r"), '', $key);
diff --git a/includes/mysql.php.sample b/includes/mysql.php.sample
index ff5cfc3..10185fc 100644
--- a/includes/mysql.php.sample
+++ b/includes/mysql.php.sample
@@ -28,7 +28,7 @@
 
 	function sendmail($to, $subject, $message, $from, $replyto = "", $toname = "", $fromname = "", $errorsto = "returns@cacert.org", $extra="")
 	{
-		$lines = explode('\n', $message);
+		$lines = explode("\n", $message);
 		$message = "";
 		foreach($lines as $line)
 		{
@@ -64,7 +64,8 @@
 		fputs($smtp, "DATA\r\n");
 		$InputBuffer = fgets($smtp, 1024);
 		fputs($smtp, "X-Mailer: CAcert.org Website\r\n");
-		fputs($smtp, "X-OriginatingIP: ".$_SERVER["REMOTE_ADDR"]."\r\n");
+		if (array_key_exists("REMOTE_ADDR", $_SERVER))
+			fputs($smtp, "X-OriginatingIP: ".$_SERVER["REMOTE_ADDR"]."\r\n");
 		fputs($smtp, "Sender: $errorsto\r\n");
 		fputs($smtp, "Errors-To: $errorsto\r\n");
 		if($replyto != "")
diff --git a/includes/notary.inc.php b/includes/notary.inc.php
index cc0e0eb..1f0ec92 100644
--- a/includes/notary.inc.php
+++ b/includes/notary.inc.php
@@ -14,7 +14,7 @@
     You should have received a copy of the GNU General Public License
     along with this program; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
-*/ 
+*/
 
 	function query_init ($query)
 	{
@@ -41,6 +41,15 @@
 		return intval($row['list']);
 	}
 
+	function get_number_of_ttpassurances ($userid)
+	{
+		$res = query_init ("SELECT count(*) AS `list` FROM `notary`
+			WHERE (`method`='Trusted Third Parties' or `method`='TTP-Assisted') AND `to`='".intval($userid)."' ");
+		$row = query_getnextrow($res);
+
+		return intval($row['list']);
+	}
+
 	function get_number_of_assurees ($userid)
 	{
 		$res = query_init ("SELECT count(*) AS `list` FROM `notary`
@@ -52,8 +61,8 @@
 
 	function get_top_assurer_position ($no_of_assurances)
 	{
-		$res = query_init ("SELECT count(*) AS `list` FROM `notary` 
-			WHERE `method` = 'Face to Face Meeting' 
+		$res = query_init ("SELECT count(*) AS `list` FROM `notary`
+			WHERE `method` = 'Face to Face Meeting'
 			GROUP BY `from` HAVING count(*) > '".intval($no_of_assurances)."'");
 		return intval(query_get_number_of_rows($res)+1);
 	}
@@ -83,7 +92,7 @@
 		$res = query_init ("select count(*) as number,points,awarded,method from notary where `from`='".intval($userid)."' group by points,awarded,method");
 		return $res;
 	}
-	
+
 	function get_received_assurances_summary ($userid)
 	{
 		$res = query_init ("select count(*) as number,points,awarded,method from notary where `to`='".intval($userid)."' group by points,awarded,method");
@@ -106,7 +115,7 @@
 
 	function calc_experience ($row,&$points,&$experience,&$sum_experience,&$revoked)
 	{
-                $apoints = max($row['points'],$row['awarded']);
+		$apoints = max($row['points'], $row['awarded']);
 		$points += $apoints;
 		$experience = "&nbsp;";
 		$revoked = false;				# to be coded later (after DB-upgrade)
@@ -129,7 +138,7 @@
 			$awarded = 100;
 		}
 		else
-			$experience = 0;	
+			$experience = 0;
 
 		switch ($row['method'])
 		{
@@ -192,15 +201,15 @@
 
 ?>
 <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
-    <tr>
-    	<td class="title"><?=_("Assurer Ranking")?></td>
-    </tr>
-    <tr>
-	<td class="DataTD"><?=sprintf(_("You have made %s assurances which ranks you as the #%s top assurer."), intval($num_of_assurances), intval($rank_of_assurer) )?></td>
-    </tr>
-    <tr>
-	<td class="DataTD"><?=sprintf(_("You have received %s assurances which ranks you as the #%s top assuree."), intval($num_of_assurees), intval($rank_of_assuree) )?></td>
-    </tr>
+	<tr>
+		<td class="title"><?=_("Assurer Ranking")?></td>
+	</tr>
+	<tr>
+		<td class="DataTD"><?=sprintf(_("You have made %s assurances which ranks you as the #%s top assurer."), intval($num_of_assurances), intval($rank_of_assurer) )?></td>
+	</tr>
+	<tr>
+		<td class="DataTD"><?=sprintf(_("You have received %s assurances which ranks you as the #%s top assuree."), intval($num_of_assurees), intval($rank_of_assuree) )?></td>
+	</tr>
 </table>
 <br/>
 <?
@@ -210,65 +219,68 @@
 	{
 ?>
 <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
-    <tr>
+	<tr>
 <?
 	if ($support == "1")
 	{
 ?>
-    	<td colspan="10" class="title"><?=$title?></td>
+		<td colspan="10" class="title"><?=$title?></td>
 <?
 	} else {
 ?>
-    	<td colspan="7" class="title"><?=$title?></td>
-<?	}
+		<td colspan="7" class="title"><?=$title?></td>
+<?
+	}
 ?>
-    </tr>
-    <tr>
-    	<td class="DataTD"><strong><?=_("ID")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Date")?></strong></td>
+	</tr>
+	<tr>
+		<td class="DataTD"><strong><?=_("ID")?></strong></td>
+		<td class="DataTD"><strong><?=_("Date")?></strong></td>
 <?
 	if ($support == "1")
 	{
 ?>
-    	<td class="DataTD"><strong><?=_("When")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Email")?></strong></td>
-<?	} ?>
-    	<td class="DataTD"><strong><?=_("Who")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Points")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Location")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Method")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Experience Points")?></strong></td>
+		<td class="DataTD"><strong><?=_("When")?></strong></td>
+		<td class="DataTD"><strong><?=_("Email")?></strong></td>
+<?
+	}
+?>
+		<td class="DataTD"><strong><?=_("Who")?></strong></td>
+		<td class="DataTD"><strong><?=_("Points")?></strong></td>
+		<td class="DataTD"><strong><?=_("Location")?></strong></td>
+		<td class="DataTD"><strong><?=_("Method")?></strong></td>
+		<td class="DataTD"><strong><?=_("Experience Points")?></strong></td>
 <?
 	if ($support == "1")
 	{
 ?>
-	<td class="DataTD"><strong><?=_("Revoke")?></strong></td>
+		<td class="DataTD"><strong><?=_("Revoke")?></strong></td>
 <?
 	}
 ?>
-    </tr>
+	</tr>
 <?
 	}
 
 	function output_assurances_footer($points_txt,$points,$experience_txt,$sumexperience,$support)
 	{
 ?>
-    <tr>
-    	<td class="DataTD" colspan="5"><strong><?=$points_txt?>:</strong></td>
-    	<td class="DataTD"><?=$points?></td>
-    	<td class="DataTD">&nbsp;</td>
-    	<td class="DataTD"><strong><?=$experience_txt?>:</strong></td>
-    	<td class="DataTD"><?=$sumexperience?></td>
+	<tr>
+		<td<?=($support == "1")?' colspan="5"':' colspan="3"'?> class="DataTD"><strong><?=$points_txt?>:</strong></td>
+		<td class="DataTD"><?=$points?></td>
+		<td class="DataTD">&nbsp;</td>
+		<td class="DataTD"><strong><?=$experience_txt?>:</strong></td>
+		<td class="DataTD"><?=$sumexperience?></td>
 <?
 	if ($support == "1")
 	{
 ?>
-    	<td class="DataTD">&nbsp;</td>
+		<td class="DataTD">&nbsp;</td>
 <?
 	}
 ?>
 
-    </tr>
+	</tr>
 </table>
 <br/>
 <?
@@ -277,52 +289,54 @@
 	function output_assurances_row($assuranceid,$date,$when,$email,$name,$awarded,$points,$location,$method,$experience,$userid,$support,$revoked)
 	{
 
-	$tdstyle="";
-	$emopen="";
-	$emclose="";
+		$tdstyle="";
+		$emopen="";
+		$emclose="";
 
-	if ($awarded == $points)
-	{
-		if ($awarded == "0")
+		if ($awarded == $points)
 		{
-			if ($when < "2006-09-01")
+			if ($awarded == "0")
 			{
-				$tdstyle="style='background-color: #ffff80'";
-				$emopen="<em>";
-				$emclose="</em>";
+				if ($when < "2006-09-01")
+				{
+					$tdstyle="style='background-color: #ffff80'";
+					$emopen="<em>";
+					$emclose="</em>";
+				}
 			}
 		}
-	}
 ?>
-    <tr>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$assuranceid?><?=$emclose?></td>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$date?><?=$emclose?></td>
+	<tr>
+		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$assuranceid?><?=$emclose?></td>
+		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$date?><?=$emclose?></td>
 <?
-	if ($support == "1")
-	{
+		if ($support == "1")
+		{
 ?>
 		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$when?><?=$emclose?></td>
 		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$email?><?=$emclose?></td>
-<?	} 
+<?
+		}
 ?>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$name?><?=$emclose?></td>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$awarded?><?=$emclose?></td>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$location?><?=$emclose?></td>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$method?><?=$emclose?></td>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$experience?><?=$emclose?></td>
+		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$name?><?=$emclose?></td>
+		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$awarded?><?=$emclose?></td>
+		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$location?><?=$emclose?></td>
+		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$method?><?=$emclose?></td>
+		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$experience?><?=$emclose?></td>
 <?
-	if ($support == "1")
-	{
-		if ($revoked == true)
+		if ($support == "1")
 		{
+			if ($revoked == true)
+			{
 ?>
-			<td class="DataTD" <?=$tdstyle?>>&nbsp;</td>
-<?		} else {
+		<td class="DataTD" <?=$tdstyle?>>&nbsp;</td>
+<?
+			} else {
 ?>
-			<td class="DataTD" <?=$tdstyle?>><?=$emopen?><a href="account.php?id=43&amp;userid=<?=intval($userid)?>&amp;assurance=<?=intval($assuranceid)?>&amp;csrf=<?=make_csrf('admdelassurance')?>" onclick="return confirm('<?=_("Are you sure you want to revoke this assurance?")?>');"><?=_("Revoke")?></a><?=$emclose?></td>
+		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><a href="account.php?id=43&amp;userid=<?=intval($userid)?>&amp;assurance=<?=intval($assuranceid)?>&amp;csrf=<?=make_csrf('admdelassurance')?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),$assuranceid)?>');"><?=_("Revoke")?></a><?=$emclose?></td>
 <?
+			}
 		}
-	}
 ?>
     </tr>
 <?
@@ -332,14 +346,14 @@
 	{
 ?>
 <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
-    <tr>
-	<td colspan="4" class="title"><?=_("Summary of your Points")?></td>
-    </tr>
-    <tr>
-	<td class="DataTD"><strong><?=_("Description")?></strong></td>
-	<td class="DataTD"><strong><?=_("Points")?></strong></td>
-	<td class="DataTD"><strong><?=_("Countable Points")?></strong></td>
-	<td class="DataTD"><strong><?=_("Remark")?></strong></td>
+	<tr>
+		<td colspan="4" class="title"><?=_("Summary of your Points")?></td>
+	</tr>
+	<tr>
+		<td class="DataTD"><strong><?=_("Description")?></strong></td>
+		<td class="DataTD"><strong><?=_("Points")?></strong></td>
+		<td class="DataTD"><strong><?=_("Countable Points")?></strong></td>
+		<td class="DataTD"><strong><?=_("Remark")?></strong></td>
     </tr>
 <?
 	}
@@ -355,12 +369,12 @@
 	function output_summary_row($title,$points,$points_countable,$remark)
 	{
 ?>
-    <tr>
-	<td class="DataTD"><strong><?=$title?></strong></td>
-	<td class="DataTD"><?=$points?></td>
-	<td class="DataTD"><?=$points_countable?></td>
-	<td class="DataTD"><?=$remark?></td>
-    </tr>
+	<tr>
+		<td class="DataTD"><strong><?=$title?></strong></td>
+		<td class="DataTD"><?=$points?></td>
+		<td class="DataTD"><?=$points_countable?></td>
+		<td class="DataTD"><?=$remark?></td>
+	</tr>
 <?
 	}
 
@@ -374,7 +388,7 @@
 		$res = get_given_assurances(intval($userid));
 		while($row = mysql_fetch_assoc($res))
 		{
-			$fromuser = get_user (intval($row['to'])); 
+			$fromuser = get_user (intval($row['to']));
 			$apoints = calc_experience ($row,$points,$experience,$sum_experience,$revoked);
 			$name = show_user_link ($fromuser['fname']." ".$fromuser['lname'],intval($row['to']));
 			$email = show_email_link ($fromuser['email'],intval($row['to']));
@@ -430,6 +444,8 @@
 				break;
 			case 'Unknown':			 // to be revoked in the future? limit to max 50 pts?
 			case 'Trusted Third Parties':	     // to be revoked in the future? limit to max 35 pts?
+			case 'TTP-Assisted':	     // TTP assurances, limit to 35
+			case 'TOPUP':	     // TOPUP to be delevoped in the future, limit to 30
 			case '':				// to be revoked in the future? limit to max 50 pts?
 			case 'Face to Face Meeting':	    // normal assurances, limit to 35/50 pts in the future?
 				break;
@@ -575,14 +591,14 @@
 		return $issue_points;
 	}
 
-	function output_given_assurances($userid,$support)
+	function output_given_assurances($userid,$support=0)
 	{
 		output_assurances_header(_("Assurance Points You Issued"),$support);
 		output_given_assurances_content($userid,$points,$sum_experience,$support);
 		output_assurances_footer(_("Total Points Issued"),$points,_("Total Experience Points"),$sum_experience,$support);
 	}
 
-	function output_received_assurances($userid,$support)
+	function output_received_assurances($userid,$support=0)
 	{
 		output_assurances_header(_("Your Assurance Points"),$support);
 		output_received_assurances_content($userid,$points,$sum_experience,$support);
@@ -602,4 +618,495 @@
 	<p>[ <a href='javascript:history.go(-1)'><?=_("Go Back")?></a> ]</p>
 <?
 	}
+
+	//functions to do with recording user agreements
+	/**
+	 * write_user_agreement()
+	 * writes a new record to the table user_agreement
+	 *
+	 * @param mixed $memid
+	 * @param mixed $document
+	 * @param mixed $method
+	 * @param mixed $comment
+	 * @param integer $active
+	 * @param integer $secmemid
+	 * @return
+	 */
+	function write_user_agreement($memid, $document, $method, $comment, $active=1, $secmemid=0){
+	// write a new record to the table user_agreement
+		$query="insert into `user_agreements` set `memid`=".intval($memid).", `secmemid`=".intval($secmemid).
+			",`document`='".mysql_real_escape_string($document)."',`date`=NOW(), `active`=".intval($active).",`method`='".mysql_real_escape_string($method)."',`comment`='".mysql_real_escape_string($comment)."'" ;
+		$res = mysql_query($query);
+	}
+
+	function get_user_agreement_status($memid, $type="CCA"){
+	//returns 0 - no user agreement, 1- at least one entry
+		$query="SELECT u.`document` FROM `user_agreements` u
+			WHERE u.`document` = '".$type."' AND (u.`memid`=".$memid." or u.`secmemid`=".$memid.")" ;
+		$res = mysql_query($query);
+		if(mysql_num_rows($res) <=0){
+			return 0;
+		}else{
+			return 1;
+		}
+	}
+
+	function get_first_user_agreement($memid, $active=1, $type="CCA"){
+	//returns an array (`document`,`date`,`method`, `comment`,`active`)
+		if($active==1){
+			$filter="u.`memid`=".$memid;
+		}else{
+			$filter="u.`secmemid`=".$memid;
+		}
+		$query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM `user_agreements` u
+			WHERE u.`document` = '".$type."' AND ".$filter."
+			ORDER BY u.`date` Limit 1;";
+		$res = mysql_query($query);
+		if(mysql_num_rows($res) >0){
+			$row = mysql_fetch_assoc($res);
+			$rec['document']= $row['document'];
+			$rec['date']= $row['date'];
+			$rec['method']= $row['method'];
+			$rec['comment']= $row['comment'];
+			$rec['active']= $row['active'];
+		}else{
+			$rec=array();
+		}
+		return $rec;
+	}
+
+	function get_last_user_agreement($memid, $type="CCA"){
+	//returns an array (`document`,`date`,`method`, `comment`,`active`)
+		$query="(SELECT u.`document`, u.`date`, u.`method`, u.`comment`, 1 as `active` FROM user_agreements u WHERE u.`document` = '".$type."' AND (u.`memid`=".$memid." ) order by `date` desc limit 1)
+			union
+			(SELECT u.`document`, u.`date`, u.`method`, u.`comment`, 0 as `active` FROM user_agreements u WHERE u.`document` = '".$type."' AND ( u.`secmemid`=".$memid.")) order by `date` desc limit 1" ;
+		$res = mysql_query($query);
+		if(mysql_num_rows($res) >0){
+			$row = mysql_fetch_assoc($res);
+			$rec['document']= $row['document'];
+			$rec['date']= $row['date'];
+			$rec['method']= $row['method'];
+			$rec['comment']= $row['comment'];
+			$rec['active']= $row['active'];
+		}else{
+			$rec=array();
+		}
+		return $rec;
+	}
+
+	function delete_user_agreement($memid, $type="CCA"){
+	//deletes all entries to an user for the given type of user agreements
+		mysql_query("delete from `user_agreements` where `memid`='".$memid."'");
+		mysql_query("delete from `user_agreements` where `secmemid`='".$memid."'");
+	}
+
+	// functions for 6.php (assure somebody)
+
+	function AssureHead($confirmation,$checkname)
+	{
+?>
+<form method="post" action="wot.php">
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper" width="600">
+	<tr>
+		<td colspan="2" class="title"><?=$confirmation?></td>
+	</tr>
+	<tr>
+		<td class="DataTD" colspan="2" align="left"><?=$checkname?></td>
+	</tr>
+<?
+	}
+
+	function AssureTextLine($field1,$field2)
+	{
+?>
+	<tr>
+		<td class="DataTD"><?=$field1.(empty($field1)?'':':')?></td>
+		<td class="DataTD"><?=$field2?></td>
+	</tr>
+<?
+	}
+
+	function AssureBoxLine($type,$text,$checked)
+	{
+?>
+	<tr>
+		<td class="DataTD"><input type="checkbox" name="<?=$type?>" value="1" <?=$checked?"checked":""?>></td>
+		<td class="DataTD"><?=$text?></td>
+	</tr>
+<?
+	}
+
+	function AssureMethodLine($text,$methods,$remark)
+	{
+		if (count($methods) != 1) {
+?>
+	<tr>
+		<td class="DataTD"><?=$text.(empty($text)?'':':')?></td>
+		<td class="DataTD">
+			<select name="method">
+<?
+			foreach($methods as $val) {
+?>
+				<option value="<?=$val?>"><?=$val?></option>
+<?
+			}
 ?>
+			</select>
+			<br />
+			<?=$remark?>
+		</td>
+	</tr>
+<?
+		} else {
+?>
+	<input type="hidden" name="<?=$val?>" value="<?=$methods[0]?>" />
+<?
+		}
+	}
+
+	function AssureInboxLine($type,$field,$value,$description)
+	{
+?>
+	<tr>
+		<td class="DataTD"><?=$field.(empty($field)?'':':')?></td>
+		<td class="DataTD"><input type="text" name="<?=$type?>" value="<?=$value?>"><?=$description?></td>
+	</tr>
+<?
+	}
+
+	function AssureFoot($oldid,$confirm)
+	{
+?>
+	<tr>
+		<td class="DataTD" colspan="2">
+			<input type="submit" name="process" value="<?=$confirm?>" />
+			<input type="submit" name="cancel" value="<?=_("Cancel")?>" />
+		</td>
+	</tr>
+</table>
+<input type="hidden" name="pagehash" value="<?=$_SESSION['_config']['wothash']?>" />
+<input type="hidden" name="oldid" value="<?=$oldid?>" />
+</form>
+<?
+	}
+
+	function account_email_delete($mailid){
+	//deletes an email entry from an acount
+	//revolkes all certifcates for that email address
+	//called from www/account.php if($process != "" && $oldid == 2)
+	//called from www/diputes.php if($type == "reallyemail") / if($action == "accept")
+	//called from account_delete
+		$mailid = intval($mailid);
+		revoke_all_client_cert($mailid);
+		$query = "update `email` set `deleted`=NOW() where `id`='$mailid'";
+		mysql_query($query);
+	}
+
+	function account_domain_delete($domainid){
+	//deletes an domain entry from an acount
+	//revolkes all certifcates for that domain address
+	//called from www/account.php if($process != "" && $oldid == 9)
+	//called from www/diputes.php if($type == "reallydomain") / if($action == "accept")
+	//called from account_delete
+		$domainid = intval($domainid);
+		revoke_all_server_cert($domainid);
+		mysql_query(
+			"update `domains`
+			set `deleted`=NOW()
+			where `id` = '$domainid'");
+	}
+
+	function account_delete($id, $arbno, $adminid){
+	//deletes an account following the deleted account routnie V3
+	// called from www/account.php if($oldid == 50 && $process != "")
+	//change password
+		$id = intval($id);
+		$arbno = mysql_real_escape_string($arbno);
+		$adminid = intval($adminid);
+		$pool = 'abcdefghijklmnopqrstuvwxyz';
+		$pool .= '0123456789!()§';
+		$pool .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+		srand ((double)microtime()*1000000);
+		$password="";
+		for($index = 0; $index < 30; $index++)
+		{
+			$password .= substr($pool,(rand()%(strlen ($pool))), 1);
+		}
+		mysql_query("update `users` set `password`=sha1('".$password."') where `id`='".$id."'");
+
+	//create new mail for arbitration number
+		$query = "insert into `email` set `email`='".$arbno."@cacert.org',`memid`='".$id."',`created`=NOW(),`modified`=NOW(), `attempts`=-1";
+		mysql_query($query);
+		$emailid = mysql_insert_id();
+
+	//set new mail as default
+		$query = "update `users` set `email`='".$arbno."@cacert.org' where `id`='".$id."'";
+		mysql_query($query);
+
+	//delete all other email address
+		$query = "select `id` from `email` where `memid`='".$id."' and `id`!='".$emailid."'" ;
+		$res=mysql_query($query);
+		while($row = mysql_fetch_assoc($res)){
+			account_email_delete($row['id']);
+		}
+
+	//delete all domains
+		$query = "select `id` from `domains` where `memid`='".$id."'";
+		$res=mysql_query($query);
+		while($row = mysql_fetch_assoc($res)){
+			account_domain_delete($row['id']);
+		}
+
+	//clear alert settings
+		mysql_query(
+			"update `alerts` set
+				`general`='0',
+				`country`='0',
+				`regional`='0',
+				`radius`='0'
+			where `memid`='$id'");
+
+	//set default location
+		$query = "update `users` set `locid`='2256755', `regid`='243', `ccid`='12' where `id`='".$id."'";
+		mysql_query($query);
+
+	//clear listings
+		$query = "update `users` set `listme`=' ',`contactinfo`=' ' where `id`='".$id."'";
+		mysql_query($query);
+
+	//set lanuage to default
+		//set default language
+		mysql_query("update `users` set `language`='en_AU' where `id`='".$id."'");
+		//delete secondary langugaes
+		mysql_query("delete from `addlang` where `userid`='".$id."'");
+
+	//change secret questions
+		for($i=1;$i<=5;$i++){
+			$q="";
+			$a="";
+			for($index = 0; $index < 30; $index++)
+			{
+				$q .= substr($pool,(rand()%(strlen ($pool))), 1);
+				$a .= substr($pool,(rand()%(strlen ($pool))), 1);
+			}
+			$query = "update `users` set `Q$i`='$q', `A$i`='$a' where `id`='".$id."'";
+			mysql_query($query);
+		}
+
+	//change personal information to arbitration number and DOB=1900-01-01
+		$query = "select `fname`,`mname`,`lname`,`suffix`,`dob` from `users` where `id`='$userid'";
+		$details = mysql_fetch_assoc(mysql_query($query));
+		$query = "insert into `adminlog` set `when`=NOW(),`old-lname`='${details['lname']}',`old-dob`='${details['dob']}',
+			`new-lname`='$arbno',`new-dob`='1900-01-01',`uid`='$id',`adminid`='".$adminid."'";
+		mysql_query($query);
+		$query = "update `users` set `fname`='".$arbno."',
+			`mname`='".$arbno."',
+			`lname`='".$arbno."',
+			`suffix`='".$arbno."',
+			`dob`='1900-01-01'
+			where `id`='".$id."'";
+		mysql_query($query);
+
+	//clear all admin and board flags
+		mysql_query(
+			"update `users` set
+				`assurer`='0',
+				`assurer_blocked`='0',
+				`codesign`='0',
+				`orgadmin`='0',
+				`ttpadmin`='0',
+				`locadmin`='0',
+				`admin`='0',
+				`adadmin`='0',
+				`tverify`='0',
+				`board`='0'
+			where `id`='$id'");
+
+	//block account
+		mysql_query("update `users` set `locked`='1' where `id`='$id'");  //, `deleted`=Now()
+	}
+
+
+	function check_email_exists($email){
+	// called from includes/account.php if($process != "" && $oldid == 1)
+	// called from includes/account.php	if($oldid == 50 && $process != "")
+		$email = mysql_real_escape_string($email);
+		$query = "select 1 from `email` where `email`='$email' and `deleted`=0";
+		$res = mysql_query($query);
+		return mysql_num_rows($res) > 0;
+	}
+
+	function check_gpg_cert_running($uid,$cca=0){
+		//if $cca =0 if just expired, =1 if CCA retention +3 month should be obeyed
+		// called from includes/account.php	if($oldid == 50 && $process != "")
+		$uid = intval($uid);
+		if (0==$cca) {
+			$query = "select 1 from `gpg` where `memid`='$uid' and `expire`>NOW()";
+		}else{
+			$query = "select 1 from `gpg` where `memid`='$uid' and `expire`>(NOW()-90*86400)";
+		}
+		$res = mysql_query($query);
+		return mysql_num_rows($res) > 0;
+	}
+
+	function check_client_cert_running($uid,$cca=0){
+		//if $cca =0 if just expired, =1 if CCA retention +3 month should be obeyed
+		// called from includes/account.php	if($oldid == 50 && $process != "")
+		$uid = intval($uid);
+		if (0==$cca) {
+			$query1 = "select 1 from `emailcerts` where `memid`='$uid' and `expire`>NOW() and `revoked`<`created`";
+			$query2 = "select 1 from `emailcerts` where `memid`='$uid' and `revoked`>NOW()";
+		}else{
+			$query1 = "select 1 from `emailcerts` where `memid`='$uid' and `expire`>(NOW()-90*86400)  and `revoked`<`created`";
+			$query2 = "select 1 from `emailcerts` where `memid`='$uid' and `revoked`>(NOW()-90*86400)";
+		}
+		$res = mysql_query($query1);
+		$r1 = mysql_num_rows($res)>0;
+		$res = mysql_query($query2);
+		$r2 = mysql_num_rows($res)>0;
+		return !!($r1 || $r2);
+	}
+
+	function check_server_cert_running($uid,$cca=0){
+		//if $cca =0 if just expired, =1 if CCA retention +3 month should be obeyed
+		// called from includes/account.php	if($oldid == 50 && $process != "")
+		$uid = intval($uid);
+		if (0==$cca) {
+			$query1 = "
+				select 1 from `domaincerts` join `domains`
+					on `domaincerts`.`domid` = `domains`.`id`
+				where `domains`.`memid` = '$uid'
+					and `domaincerts`.`expire` > NOW()
+					and `domaincerts`.`revoked` < `domaincerts`.`created`";
+			$query2 = "
+				select 1 from `domaincerts` join `domains`
+					on `domaincerts`.`domid` = `domains`.`id`
+				where `domains`.`memid` = '$uid'
+					and `revoked`>NOW()";
+		}else{
+			$query1 = "
+				select 1 from `domaincerts` join `domains`
+					on `domaincerts`.`domid` = `domains`.`id`
+				where `domains`.`memid` = '$uid'
+					and `expire`>(NOW()-90*86400)
+					and `revoked`<`created`";
+			$query2 = "
+				select 1 from `domaincerts` join `domains`
+					on `domaincerts`.`domid` = `domains`.`id`
+				where `domains`.`memid` = '$uid'
+					and `revoked`>(NOW()-90*86400)";
+		}
+		$res = mysql_query($query1);
+		$r1 = mysql_num_rows($res)>0;
+		$res = mysql_query($query2);
+		$r2 = mysql_num_rows($res)>0;
+		return !!($r1 || $r2);
+	}
+
+	function check_is_orgadmin($uid){
+		// called from includes/account.php	if($oldid == 50 && $process != "")
+		$uid = intval($uid);
+		$query = "select 1 from `org` where `memid`='$uid' and `deleted`=0";
+		$res = mysql_query($query);
+		return mysql_num_rows($res) > 0;
+	}
+
+
+	// revokation of certificates
+	function revoke_all_client_cert($mailid){
+		//revokes all client certificates for an email address
+		$mailid = intval($mailid);
+		$query = "select `emailcerts`.`id`
+			from `emaillink`,`emailcerts` where
+			`emaillink`.`emailid`='$mailid' and `emaillink`.`emailcertsid`=`emailcerts`.`id` and `emailcerts`.`revoked`=0
+			group by `emailcerts`.`id`";
+		$dres = mysql_query($query);
+		while($drow = mysql_fetch_assoc($dres)){
+			mysql_query("update `emailcerts` set `revoked`='1970-01-01 10:00:01', `disablelogin`=1 where `id`='".$drow['id']."'");
+		}
+	}
+
+	function revoke_all_server_cert($domainid){
+		//revokes all server certs for an domain
+		$domainid = intval($domainid);
+		$query =
+			"select `domaincerts`.`id`
+				from `domaincerts`
+				where `domaincerts`.`domid` = '$domainid'
+			union distinct
+			select `domaincerts`.`id`
+				from `domaincerts`, `domlink`
+				where `domaincerts`.`id` = `domlink`.`certid`
+				and `domlink`.`domid` = '$domainid'";
+		$dres = mysql_query($query);
+		while($drow = mysql_fetch_assoc($dres))
+		{
+			mysql_query(
+			"update `domaincerts`
+				set `revoked`='1970-01-01 10:00:01'
+				where `id` = '".$drow['id']."'
+				and `revoked` = 0");
+		}
+	}
+
+	function revoke_all_private_cert($uid){
+		//revokes all certificates linked to a personal accounts
+		//gpg revokation needs to be added to a later point
+		$uid=intval($uid);
+		$query = "select `id` from `email` where `memid`='".$uid."'";
+		$res=mysql_query($query);
+		while($row = mysql_fetch_assoc($res)){
+			revoke_all_client_cert($row['id']);
+		}
+
+
+		$query = "select `id` from `domains` where `memid`='".$uid."'";
+		$res=mysql_query($query);
+		while($row = mysql_fetch_assoc($res)){
+			revoke_all_server_cert($row['id']);
+		}
+	}
+
+	/**
+	 * check_date_format()
+	 * checks if the date is entered in the right date format YYYY-MM-DD and
+	 * if the date is after the 1st January of the given year
+	 *
+	 * @param mixed $date
+	 * @param integer $year
+	 * @return
+	 */
+	function check_date_format($date, $year=2000){
+		if (!strpos($date,'-')) {
+			return FALSE;
+		}
+		$arr=explode('-',$date);
+
+		if ((count($arr)!=3)) {
+			return FALSE;
+		}
+		if (intval($arr[0])<=$year) {
+			return FALSE;
+		}
+		if (intval($arr[1])>12 or intval($arr[1])<=0) {
+			return FALSE;
+		}
+		if (intval($arr[2])>31 or intval($arr[2])<=0) {
+			return FALSE;
+		}
+
+		return checkdate( intval($arr[1]), intval($arr[2]), intval($arr[0]));
+
+	}
+
+	/**
+	 * check_date_difference()
+	 * returns false if the date is larger then today + time diffrence
+	 *
+	 * @param mixed $date
+	 * @param integer $diff
+	 * @return
+	 */
+	function check_date_difference($date, $diff=1){
+		return (strtotime($date)<=time()+$diff*86400);
+	}
diff --git a/includes/wot.inc.php b/includes/wot.inc.php
deleted file mode 100644
index 884b97f..0000000
--- a/includes/wot.inc.php
+++ /dev/null
@@ -1,539 +0,0 @@
-<? /*
-    LibreSSL - CAcert web application
-    Copyright (C) 2004-2011  CAcert Inc.
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; version 2 of the License.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
-*/ 
-
-	function query_init ($query)
-	{
-		return mysql_query($query);
-	}
-
-	function query_getnextrow ($res)
-	{
-		$row1 = mysql_fetch_assoc($res);
-		return $row1;
-	}
-
-	function query_get_number_of_rows ($resultset)
-	{
-		return intval(mysql_num_rows($resultset));
-	}
-
-	function get_number_of_assurances ($userid)
-	{
-		$res = query_init ("SELECT count(*) AS `list` FROM `notary`
-		     	WHERE `method` = 'Face to Face Meeting' AND `from`='".intval($userid)."' ");
-		$row = query_getnextrow($res);
-
-		return intval($row['list']);
-	}
-
-	function get_number_of_assurees ($userid)
-	{
-		$res = query_init ("SELECT count(*) AS `list` FROM `notary`
-			WHERE `method` = 'Face to Face Meeting' AND `to`='".intval($userid)."' ");
-		$row = query_getnextrow($res);
-
-		return intval($row['list']);
-	}
-
-	function get_top_assurer_position ($no_of_assurances)
-	{
-		$res = query_init ("SELECT count(*) AS `list` FROM `notary` 
-			WHERE `method` = 'Face to Face Meeting' 
-			GROUP BY `from` HAVING count(*) > '".intval($no_of_assurances)."'");
-		return intval(query_get_number_of_rows($res)+1);
-	}
-
-	function get_top_assuree_position ($no_of_assurees)
-	{
-		$res = query_init ("SELECT count(*) AS `list` FROM `notary`
-			WHERE `method` = 'Face to Face Meeting'
-			GROUP BY `to` HAVING count(*) > '".intval($no_of_assurees)."'");
-		return intval(query_get_number_of_rows($res)+1);
-	}
-
-	function get_given_assurances ($userid)
-	{
-		$res = query_init ("select * from `notary` where `from`='".intval($userid)."' and `from` != `to` order by `id` asc");
-		return $res;
-	}
-
-	function get_received_assurances ($userid)
-	{
-		$res = query_init ("select * from `notary` where `to`='".intval($userid)."' and `from` != `to` order by `id` asc ");
-		return $res;
-	}
-
-	function get_given_assurances_summary ($userid)
-	{
-		$res = query_init ("select count(*) as number,points,awarded,method from notary where `from`='".intval($userid)."' group by points,awarded,method");
-		return $res;
-	}
-	
-	function get_received_assurances_summary ($userid)
-	{
-		$res = query_init ("select count(*) as number,points,awarded,method from notary where `to`='".intval($userid)."' group by points,awarded,method");
-		return $res;
-	}
-
-	function get_user ($userid)
-	{
-		$res = query_init ("select * from `users` where `id`='".intval($userid)."'");
-		return mysql_fetch_assoc($res);
-	}
-
-	function get_cats_state ($userid)
-	{
-
-		$res = query_init ("select * from `cats_passed` inner join `cats_variant` on `cats_passed`.`variant_id` = `cats_variant`.`id` and `cats_variant`.`type_id` = 1
-			WHERE `cats_passed`.`user_id` = '".intval($userid)."'");
-		return mysql_num_rows($res);
-	}
-
-	function calc_experience ($row,&$points,&$experience,&$sum_experience)
-	{
-		$apoints = max($row['points'], $row['awarded']);
-
-		$points += $apoints;
-
-		$experience = "&nbsp;";
-		if ($row['method'] == "Face to Face Meeting")
-		{
-			$sum_experience = $sum_experience +2;
-			$experience = "2";
-		}
-		return $apoints;
-	}
-
-	function calc_assurances ($row,&$points,&$experience,&$sumexperience,&$awarded)
-	{
-		$awarded = calc_points($row);
-
-		if ($awarded > 100)
-		{
-			$experience = $awarded - 100;		// needs to be fixed in the future (limit 50 pts and/or no experience if pts > 100)
-			$awarded = 100;
-		}
-		else
-			$experience = 0;	
-
-		switch ($row['method'])
-		{
-			case 'Thawte Points Transfer':
-			case 'CT Magazine - Germany':
-			case 'Temporary Increase':	      // Current usage of 'Temporary Increase' may break audit aspects, needs to be reimplemented
-				$awarded=sprintf("<strong style='color: red'>%s</strong>",_("Revoked"));
-				$experience=0;
-				break;
-			default:
-				$points += $awarded;
-		}
-		$sumexperience = $sumexperience + $experience;
-	}
-
-
-	function show_user_link ($name,$userid)
-	{
-		$name = trim($name);
-		if($name == "")
-		{
-			if ($userid == 0)
-				$name = _("System");
-			else
-				$name = _("Deleted account");
-		}
-		else
-			$name = "<a href='wot.php?id=9&amp;userid=".intval($userid)."'>$name</a>";
-		return $name;
-	}
-
-	function get_assurer_ranking($userid,&$num_of_assurances,&$rank_of_assurer)
-	{
-		$num_of_assurances = get_number_of_assurances (intval($userid));
-		$rank_of_assurer = get_top_assurer_position($num_of_assurances);
-	}
-
-	function get_assuree_ranking($userid,&$num_of_assurees,&$rank_of_assuree)
-	{
-		$num_of_assurees = get_number_of_assurees (intval($userid));
-		$rank_of_assuree = get_top_assuree_position($num_of_assurees);
-	}
-
-
-// ************* html table definitions ******************
-
-	function output_ranking($userid)
-	{
-		get_assurer_ranking($userid,$num_of_assurances,$rank_of_assurer);
-		get_assuree_ranking($userid,$num_of_assurees,$rank_of_assuree);
-
-?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
-    <tr>
-    	<td class="title"><?=_("Assurer Ranking")?></td>
-    </tr>
-    <tr>
-	<td class="DataTD"><?=sprintf(_("You have made %s assurances which ranks you as the #%s top assurer."), intval($num_of_assurances), intval($rank_of_assurer) )?></td>
-    </tr>
-    <tr>
-	<td class="DataTD"><?=sprintf(_("You have received %s assurances which ranks you as the #%s top assuree."), intval($num_of_assurees), intval($rank_of_assuree) )?></td>
-    </tr>
-</table>
-<br/>
-<?
-	}
-
-	function output_assurances_header($title)
-	{
-?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
-    <tr>
-    	<td colspan="7" class="title"><?=$title?></td>
-    </tr>
-    <tr>
-    	<td class="DataTD"><strong><?=_("ID")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Date")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Who")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Points")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Location")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Method")?></strong></td>
-    	<td class="DataTD"><strong><?=_("Experience Points")?></strong></td>
-    </tr>
-<?
-	}
-
-	function output_assurances_footer($points_txt,$points,$experience_txt,$sumexperience)
-	{
-?>
-    <tr>
-    	<td class="DataTD" colspan="3"><strong><?=$points_txt?>:</strong></td>
-    	<td class="DataTD"><?=$points?></td>
-    	<td class="DataTD">&nbsp;</td>
-    	<td class="DataTD"><strong><?=$experience_txt?>:</strong></td>
-    	<td class="DataTD"><?=$sumexperience?></td>
-    </tr>
-</table>
-<br/>
-<?
-	}
-
-	function output_assurances_row($assuranceid,$date,$when,$name,$awarded,$points,$location,$method,$experience)
-	{
-
-	$tdstyle="";
-	$emopen="";
-	$emclose="";
-
-	if ($awarded == $points)
-	{
-		if ($awarded == "0")
-		{
-			if ($when < "2006-09-01")
-			{
-				$tdstyle="style='background-color: #ffff80'";
-				$emopen="<em>";
-				$emclose="</em>";
-			}
-		}
-	}
-
-?>
-    <tr>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$assuranceid?><?=$emclose?></td>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$date?><?=$emclose?></td>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$name?><?=$emclose?></td>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$awarded?><?=$emclose?></td>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$location?><?=$emclose?></td>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$method?><?=$emclose?></td>
-	<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$experience?><?=$emclose?></td>
-    </tr>
-<?
-	}
-
-	function output_summary_header()
-	{
-?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
-    <tr>
-	<td colspan="4" class="title"><?=_("Summary of your Points")?></td>
-    </tr>
-    <tr>
-	<td class="DataTD"><strong><?=_("Description")?></strong></td>
-	<td class="DataTD"><strong><?=_("Points")?></strong></td>
-	<td class="DataTD"><strong><?=_("Countable Points")?></strong></td>
-	<td class="DataTD"><strong><?=_("Remark")?></strong></td>
-    </tr>
-<?
-	}
-
-	function output_summary_footer()
-	{
-?>
-</table>
-<br/>
-<?
-	}
-
-	function output_summary_row($title,$points,$points_countable,$remark)
-	{
-?>
-    <tr>
-	<td class="DataTD"><strong><?=$title?></strong></td>
-	<td class="DataTD"><?=$points?></td>
-	<td class="DataTD"><?=$points_countable?></td>
-	<td class="DataTD"><?=$remark?></td>
-    </tr>
-<?
-	}
-
-
-// ************* output given assurances ******************
-
-	function output_given_assurances_content($userid,&$points,&$sum_experience)
-	{
-		$points = 0;
-		$sumexperience = 0;
-		$res = get_given_assurances(intval($userid));
-		while($row = mysql_fetch_assoc($res))
-		{
-			$fromuser = get_user (intval($row['to'])); 
-			$apoints = calc_experience ($row,$points,$experience,$sum_experience);
-			$name = show_user_link ($fromuser['fname']." ".$fromuser['lname'],intval($row['to']));
-			output_assurances_row (intval($row['id']),$row['date'],$row['when'],$name,$apoints,intval($row['points']),$row['location'],$row['method']==""?"":_(sprintf("%s", $row['method'])),$experience);
-		}
-	}
-
-// ************* output received assurances ******************
-
-	function output_received_assurances_content($userid,&$points,&$sum_experience)
-	{
-		$points = 0;
-		$sumexperience = 0;
-		$res = get_received_assurances(intval($userid));
-		while($row = mysql_fetch_assoc($res))
-		{
-			$fromuser = get_user (intval($row['from']));
-			calc_assurances ($row,$points,$experience,$sum_experience,$awarded);
-			$name = show_user_link ($fromuser['fname']." ".$fromuser['lname'],intval($row['from']));
-			output_assurances_row (intval($row['id']),$row['date'],$row['when'],$name,$awarded,intval($row['points']),$row['location'],$row['method']==""?"":_(sprintf("%s", $row['method'])),$experience);
-		}
-	}
-
-// ************* output summary table ******************
-
-	function check_date_limit ($userid,$age)
-	{
-		$dob = date("Y-m-d", mktime(0,0,0,date("m"),date("d"),date("Y")-$age));
-		$res = query_init ("select id from `users` where `id`='".$userid."' and `dob` < '$dob'");
-		return intval(query_get_number_of_rows($res));
-	}
-
-	function calc_points($row)
-	{
-		$awarded = intval($row['awarded']);
-		if ($awarded == "")
-			$awarded = 0;
-		if (intval($row['points']) < $awarded)
-			$points = $awarded;      // if 'sum of added points' > 100, awarded shows correct value
-		else
-			$points = intval($row['points']);       // on very old assurances, awarded is '0' instead of correct value
-		switch ($row['method'])
-		{
-			case 'Thawte Points Transfer':	  // revoke all Thawte-points     (as per arbitration)
-			case 'CT Magazine - Germany':	   // revoke c't		   (only one test-entry)
-			case 'Temporary Increase':	      // revoke 'temporary increase'  (Current usage breaks audit aspects, needs to be reimplemented)
-				$points = 0;
-				break;
-			case 'Administrative Increase':	 // ignore AI with 2 points or less (historical for experiance points, now other calculation)
-				if ($points <= 2)	       // maybe limit to 35/50 pts in the future?
-					$points = 0;
-				break;
-			case 'Unknown':			 // to be revoked in the future? limit to max 50 pts?
-			case 'Trusted Third Parties':	     // to be revoked in the future? limit to max 35 pts?
-			case '':				// to be revoked in the future? limit to max 50 pts?
-			case 'Face to Face Meeting':	    // normal assurances, limit to 35/50 pts in the future?
-				break;
-			default:				// should never happen ... ;-)
-				$points = 0;
-		}
-		if ($points < 0)				// ignore negative points (bug needs to be fixed)
-			$points = 0;
-		return $points;
-	}
-
-	function max_points($userid)
-	{
-		return output_summary_content ($userid,0);
-	}
-
-	function output_summary_content($userid,$display_output)
-	{
-		$sum_points = 0;
-		$sum_experience = 0;
-		$sum_experience_other = 0;
-		$max_points = 100;
-		$max_experience = 50;
-
-		$experience_limit_reached_txt = _("Limit reached");
-
-		if (check_date_limit($userid,18) != 1)
-		{
-			$max_experience = 10;
-			$experience_limit_reached_txt = _("Limit given by PoJAM reached");
-		}
-		if (check_date_limit($userid,14) != 1)
-		{
-			$max_experience = 0;
-			$experience_limit_reached_txt = _("Limit given by PoJAM reached");
-		}
-
-		$res = get_received_assurances_summary($userid);
-		while($row = mysql_fetch_assoc($res))
-		{
-			$points = calc_points ($row);
-
-			if ($points > $max_points)			// limit to 100 points, above is experience (needs to be fixed)
-			{
-				$sum_experience_other = $sum_experience_other+($points-$max_points)*intval($row['number']);
-				$points = $max_points;
-			}
-			$sum_points += $points*intval($row['number']);
-		}
-
-		$res = get_given_assurances_summary($userid);
-		while($row = mysql_fetch_assoc($res))
-		{
-			switch ($row['method'])
-			{
-				case 'Face to Face Meeting':	 		// count Face to Face only
-					$sum_experience += 2*intval($row['number']);
-					break;
-			}
-
-		}
-
-		if ($sum_points > $max_points)
-			{
-			$sum_points_countable = $max_points;
-			$remark_points = _("Limit reached");
-			}
-		else
-			{
-			$sum_points_countable = $sum_points;
-			$remark_points = "&nbsp;";
-			}
-		if ($sum_experience > $max_experience)
-			{
-			$sum_experience_countable = $max_experience;
-			$remark_experience = $experience_limit_reached_txt;
-			}
-		else
-			{
-			$sum_experience_countable = $sum_experience;
-			$remark_experience = "&nbsp;";
-			}
-
-		if ($sum_experience_countable + $sum_experience_other > $max_experience)
-			{
-			$sum_experience_other_countable = $max_experience-$sum_experience_countable;
-			$remark_experience_other = $experience_limit_reached_txt;
-			}
-		else
-			{
-			$sum_experience_other_countable = $sum_experience_other;
-			$remark_experience_other = "&nbsp;";
-			}
-
-		if ($sum_points_countable < $max_points)
-			{
-			if ($sum_experience_countable != 0)
-				$remark_experience = _("Points on hold due to less assurance points");
-			$sum_experience_countable = 0;
-			if ($sum_experience_other_countable != 0)
-				$remark_experience_other = _("Points on hold due to less assurance points");
-			$sum_experience_other_countable = 0;
-			}
-
-		$issue_points = 0;
-		$cats_test_passed = get_cats_state ($userid);
-		if ($cats_test_passed == 0)
-		{
-			$issue_points_txt = "<strong style='color: red'>"._("You have to pass the CAcert Assurer Challenge (CATS-Test) to be an Assurer")."</strong>";
-			if ($sum_points_countable < $max_points)
-			{
-				$issue_points_txt = "<strong style='color: red'>";
-				$issue_points_txt .= sprintf(_("You need %s assurance points and the passed CATS-Test to be an Assurer"), intval($max_points));
-				$issue_points_txt .= "</strong>";
-			}
-		}
-		else
-		{
-			$experience_total = $sum_experience_countable+$sum_experience_other_countable;
-			$issue_points_txt = "";
-			if ($sum_points_countable == $max_points)
-				$issue_points = 10;
-			if ($experience_total >= 10)
-				$issue_points = 15;
-			if ($experience_total >= 20)
-				$issue_points = 20;
-			if ($experience_total >= 30)
-				$issue_points = 25;
-			if ($experience_total >= 40)
-				$issue_points = 30;
-			if ($experience_total >= 50)
-				$issue_points = 35;
-			if ($issue_points != 0)
-				$issue_points_txt = sprintf(_("You may issue up to %s points"),$issue_points);
-		}
-		if ($display_output)
-		{
-			output_summary_row (_("Assurance Points you received"),$sum_points,$sum_points_countable,$remark_points);
-			output_summary_row (_("Total Experience Points by Assurance"),$sum_experience,$sum_experience_countable,$remark_experience);
-			output_summary_row (_("Total Experience Points (other ways)"),$sum_experience_other,$sum_experience_other_countable,$remark_experience_other);
-			output_summary_row (_("Total Points"),"&nbsp;",$sum_points_countable + $sum_experience_countable + $sum_experience_other_countable,$issue_points_txt);
-		}
-		return $issue_points;
-	}
-
-	function output_given_assurances($userid)
-	{
-		output_assurances_header(_("Assurance Points You Issued"));
-		output_given_assurances_content($userid,$points,$sum_experience);
-		output_assurances_footer(_("Total Points Issued"),$points,_("Total Experience Points"),$sum_experience);
-	}
-
-	function output_received_assurances($userid)
-	{
-		output_assurances_header(_("Your Assurance Points"));
-		output_received_assurances_content($userid,$points,$sum_experience);
-		output_assurances_footer(_("Total Assurance Points"),$points,_("Total Experience Points"),$sum_experience);
-	}
-
-	function output_summary($userid)
-	{
-		output_summary_header();
-		output_summary_content($userid,1);
-		output_summary_footer();
-	}
-
-	function output_end_of_page()
-	{
-?>
-	<p>[ <a href='javascript:history.go(-1)'><?=_("Go Back")?></a> ]</p>
-<?
-	}
-?>