Merge branch 'bug-1138' of https://github.com/INOPIAE/CAcert into bug-1138
[cacert-devel.git] / includes / account.php
index 3039248..a579b7a 100644 (file)
@@ -18,6 +18,7 @@
        require_once("../includes/loggedin.php");
        require_once("../includes/lib/l10n.php");
        require_once("../includes/lib/check_weak_key.php");
+       require_once("../includes/notary.inc.php");
 
        loadem("account");
 
@@ -70,9 +71,7 @@
                }
                $oldid=0;
                $_REQUEST['email'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['newemail'])));
-               $query = "select * from `email` where `email`='".$_REQUEST['email']."' and `deleted`=0";
-               $res = mysql_query($query);
-               if(mysql_num_rows($res) > 0)
+               if(check_email_exists($_REQUEST['email'])==true)
                {
                        showheader(_("My CAcert.org Account!"));
                        printf(_("The email address '%s' is already in a different account. Can't continue."), sanitizeHTML($_REQUEST['email']));
                                {
                                        $row = mysql_fetch_assoc($res);
                                        echo $row['email']."<br>\n";
-                                       $query = "select `emailcerts`.`id`
-                                                       from `emaillink`,`emailcerts` where
-                                                       `emailid`='$id' and `emaillink`.`emailcertsid`=`emailcerts`.`id` and
-                                                       `revoked`=0 and UNIX_TIMESTAMP(`expire`)-UNIX_TIMESTAMP() > 0
-                                                       group by `emailcerts`.`id`";
-                                       $dres = mysql_query($query);
-                                       while($drow = mysql_fetch_assoc($dres))
-                                               mysql_query("update `emailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$drow['id']."'");
-
-                                       $query = "update `email` set `deleted`=NOW() where `id`='$id'";
-                                       mysql_query($query);
+                                       account_email_delete($row['id']);
                                        $delcount++;
                                }
                        }
 
        if($process != "" && $oldid == 3)
        {
+               if(!array_key_exists('CCA',$_REQUEST))
+               {
+                       showheader(_("My CAcert.org Account!"));
+                       echo _("You did not accept the CAcert Community Agreement (CCA), hit the back button and try again.");
+                       showfooter();
+                       exit;
+               }
+
                if(!(array_key_exists('addid',$_REQUEST) && is_array($_REQUEST['addid'])) && $_REQUEST['SSO'] != '1')
                {
                        showheader(_("My CAcert.org Account!"));
                                exit;
                        }
 
+                       write_user_agreement(intval($_SESSION['profile']['id']), "CCA", "certificate creation", "", 1);
+
                        $query = "insert into emailcerts set
                                                `CN`='$defaultemail',
                                                `keytype`='NS',
                                {
                                        $row = mysql_fetch_assoc($res);
                                        echo $row['domain']."<br>\n";
-
-                                       $dres = mysql_query(
-                                               "select `domaincerts`.`id`
-                                                       from `domaincerts`
-                                                       where `domaincerts`.`domid` = '$id'
-                                               union distinct
-                                               select `domaincerts`.`id`
-                                                       from `domaincerts`, `domlink`
-                                                       where `domaincerts`.`id` = `domlink`.`certid`
-                                                       and `domlink`.`domid` = '$id'");
-                                       while($drow = mysql_fetch_assoc($dres))
-                                       {
-                                               mysql_query(
-                                                       "update `domaincerts`
-                                                               set `revoked`='1970-01-01 10:00:01'
-                                                               where `id` = '".$drow['id']."'
-                                                               and `revoked` = 0
-                                                               and UNIX_TIMESTAMP(`expire`) -
-                                                                               UNIX_TIMESTAMP() > 0");
-                                       }
-
-                                       mysql_query(
-                                               "update `domains`
-                                                       set `deleted`=NOW()
-                                                       where `id` = '$id'");
+                                       account_domain_delete($row['id']);
                                }
+
                        }
                }
                else
 
        if($process != "" && $oldid == 10)
        {
+               if(!array_key_exists('CCA',$_REQUEST))
+               {
+                       showheader(_("My CAcert.org Account!"));
+                       echo _("You did not accept the CAcert Community Agreement (CCA), hit the back button and try again.");
+                       showfooter();
+                       exit;
+               }
+
                $CSR = clean_csr($_REQUEST['CSR']);
                if(strpos($CSR,"---BEGIN")===FALSE)
                {
                if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
                        $_SESSION['_config']['rootcert'] = 1;
 
+               write_user_agreement(intval($_SESSION['profile']['id']), "CCA", "certificate creation", "", 1);
+
                if(array_key_exists('0',$_SESSION['_config']['rowid']) && $_SESSION['_config']['rowid']['0'] > 0)
                {
                        $query = "insert into `domaincerts` set
                        {
                                $cid = intval(substr($id,14));
                                $comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
-                               mysql_query("update `domaincerts` set `description`='$comment' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'");
+                               mysql_query("update `domaincerts` set `description`='$comment' where `id`='$cid'");
                        }
                }
                echo(_("Certificate settings have been changed.")."<br/>\n");
                        $description= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
                }else{
                        $description= "";
-       }
+               }
 
-       if(trim($_REQUEST['disablelogin']) == "1"){
-               $disablelogin = 1;
-       }else{
-               $disablelogin = 0;
-       }
+               if(trim($_REQUEST['disablelogin']) == "1"){
+                       $disablelogin = 1;
+               }else{
+                       $disablelogin = 0;
+               }
 
-       mysql_query("update `emailcerts` set `disablelogin`='$disablelogin', `description`='$description' where `id`='".$_REQUEST['certid']."' and `memid`='".$_SESSION['profile']['id']."'");
+               mysql_query("update `emailcerts` set `disablelogin`='$disablelogin', `description`='$description' where `id`='".$_REQUEST['certid']."' and `memid`='".$_SESSION['profile']['id']."'");
+       }
 
- }
        if($oldid == 13 && $process != "")
        {
                csrf_check("perschange");
                        if(substr($id,0,14)=="check_comment_")
                        {
                                $cid = intval(substr($id,14));
-                               if(!empty($_REQUEST['check_comment_'.$cid])) {
-                                       $comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
-                                       mysql_query("update `orgemailcerts` set `description`='$comment' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'");
-                               }
+                               $comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
+                               mysql_query("update `orgemailcerts` set `description`='$comment' where `id`='$cid'");
                        }
                }
                echo(_("Certificate settings have been changed.")."<br/>\n");
                        if(substr($id,0,14)=="check_comment_")
                        {
                                $cid = intval(substr($id,14));
-                               if(!empty($_REQUEST['check_comment_'.$cid])) {
-                                       $comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
-                                       mysql_query("update `orgdomaincerts` set `description`='$comment' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'");
-                               }
+                               $comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
+                               mysql_query("update `orgdomaincerts` set `description`='$comment' where `id`='$cid'");
                        }
                }
                echo(_("Certificate settings have been changed.")."<br/>\n");
                $oldid=0;
        }
 
-       if($oldid == 43 && $_REQUEST['action'] == "updatedob")
+       if($oldid == 43 && $_REQUEST['action'] == "updatedob" && $ticketvalidation==TRUE)
        {
                $id = 43;
                $oldid=0;
                $month = intval($_REQUEST['month']);
                $year = intval($_REQUEST['year']);
                $userid = intval($_REQUEST['userid']);
-               $query = "select `fname`,`mname`,`lname`,`suffix`,`dob` from `users` where `id`='$userid'";
-               $details = mysql_fetch_assoc(mysql_query($query));
-               $query = "insert into `adminlog` set `when`=NOW(),`old-lname`='${details['lname']}',`old-dob`='${details['dob']}',
-                               `new-lname`='$lname',`new-dob`='$year-$month-$day',`uid`='$userid',`adminid`='".$_SESSION['profile']['id']."'";
-               mysql_query($query);
                $query = "update `users` set `fname`='$fname',`mname`='$mname',`lname`='$lname',`suffix`='$suffix',`dob`='$year-$month-$day' where `id`='$userid'";
                mysql_query($query);
+               write_se_log($userid,$_SESSION[''], $_SESSION['profile']['id'],'AD Name/DOB Change',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
+       }
+
+       if($oldid == 43 && $_REQUEST['action'] == 'revokecert')
+       {
+               $userid = intval($_REQUEST['userid']);
+               revoke_all_private_cert($userid);
+               $id=43;
        }
 
        if($oldid == 48 && $_REQUEST['domain'] == "")
                        $_REQUEST['email'] = $row['email'];
        }
 
-       if($oldid == 44)
+       if($oldid == 44 && $ticketvalidation==TRUE)
        {
                showheader(_("My CAcert.org Account!"));
                if(intval($_REQUEST['userid']) <= 0)
 
                        sendmail($row['email'], "[CAcert.org] "._("Password Update Notification"), $body,
                                                "support@cacert.org", "", "", "CAcert Support");
-
+                       write_se_log(intval($_REQUEST['userid']), $_SESSION['profile']['id'],'AD reset password',$ticketno);
                }
                showfooter();
                exit;
+       }else{
+               $_SESSION['ticketmsg']='No password reset taken. Ticket number is missing!';
        }
 
+
        if($process != "" && $oldid == 45)
        {
                $CSR = clean_csr($CSR);
                }
        }
 
-       if($id == 43 && array_key_exists('tverify',$_REQUEST) && $_REQUEST['tverify'] > 0)
+       /* presently not needed
+       if($id == 43 && array_key_exists('tverify',$_REQUEST) && $_REQUEST['tverify'] > 0 && $ticketvalidation==TRUE)
        {
                $memid = $_REQUEST['userid'] = intval($_REQUEST['tverify']);
                $query = "select * from `users` where `id`='$memid'";
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['tverify'];
                mysql_query("update `users` set `tverify`='$ver' where `id`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change tverify status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
-
-       if($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0)
+ */
+       if($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0 && $ticketvalidation==TRUE)
        {
                csrf_check('admsetassuret');
                $memid = $_REQUEST['userid'] = intval($_REQUEST['assurer']);
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['assurer'];
                mysql_query("update `users` set `assurer`='$ver' where `id`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change assurer staus',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0)
+       if($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0 && $ticketvalidation==TRUE)
        {
                $memid = $_REQUEST['userid'] = intval($_REQUEST['assurer_blocked']);
                $query = "select * from `users` where `id`='$memid'";
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['assurer_blocked'];
                mysql_query("update `users` set `assurer_blocked`='$ver' where `id`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change assurer blocked status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0)
+       if($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0 && $ticketvalidation==TRUE)
        {
                csrf_check('admactlock');
                $memid = $_REQUEST['userid'] = intval($_REQUEST['locked']);
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['locked'];
                mysql_query("update `users` set `locked`='$ver' where `id`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change locked status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] > 0)
+       if($id == 43 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] > 0 && $ticketvalidation==TRUE)
        {
                csrf_check('admcodesign');
                $memid = $_REQUEST['userid'] = intval($_REQUEST['codesign']);
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['codesign'];
                mysql_query("update `users` set `codesign`='$ver' where `id`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change codesign status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('orgadmin',$_REQUEST) && $_REQUEST['orgadmin'] > 0)
+       if($id == 43 && array_key_exists('orgadmin',$_REQUEST) && $_REQUEST['orgadmin'] > 0 && $ticketvalidation==TRUE)
        {
                csrf_check('admorgadmin');
                $memid = $_REQUEST['userid'] = intval($_REQUEST['orgadmin']);
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['orgadmin'];
                mysql_query("update `users` set `orgadmin`='$ver' where `id`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change org assuer status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('ttpadmin',$_REQUEST) && $_REQUEST['ttpadmin'] > 0)
+       if($id == 43 && array_key_exists('ttpadmin',$_REQUEST) && $_REQUEST['ttpadmin'] > 0 && $ticketvalidation==TRUE)
        {
                csrf_check('admttpadmin');
                $memid = $_REQUEST['userid'] = intval($_REQUEST['ttpadmin']);
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['ttpadmin'];
                mysql_query("update `users` set `ttpadmin`='$ver' where `id`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change ttp admin status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('adadmin',$_REQUEST) && $_REQUEST['adadmin'] > 0)
+       if($id == 43 && array_key_exists('adadmin',$_REQUEST) && $_REQUEST['adadmin'] > 0 && $ticketvalidation==TRUE)
        {
                $memid = $_REQUEST['userid'] = intval($_REQUEST['adadmin']);
                $query = "select * from `users` where `id`='$memid'";
                if($ver > 2)
                        $ver = 0;
                mysql_query("update `users` set `adadmin`='$ver' where `id`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change advertising admin status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('locadmin',$_REQUEST) && $_REQUEST['locadmin'] > 0)
+       if($id == 43 && array_key_exists('locadmin',$_REQUEST) && $_REQUEST['locadmin'] > 0 && $ticketvalidation==TRUE)
        {
                $memid = $_REQUEST['userid'] = intval($_REQUEST['locadmin']);
                $query = "select * from `users` where `id`='$memid'";
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['locadmin'];
                mysql_query("update `users` set `locadmin`='$ver' where `id`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change location admin status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('admin',$_REQUEST) && $_REQUEST['admin'] > 0)
+       if($id == 43 && array_key_exists('admin',$_REQUEST) && $_REQUEST['admin'] > 0 && $ticketvalidation==TRUE)
        {
                csrf_check('admsetadmin');
                $memid = $_REQUEST['userid'] = intval($_REQUEST['admin']);
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['admin'];
                mysql_query("update `users` set `admin`='$ver' where `id`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change SE status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('general',$_REQUEST) && $_REQUEST['general'] > 0)
+       if($id == 43 && array_key_exists('general',$_REQUEST) && $_REQUEST['general'] > 0 && $ticketvalidation==TRUE)
        {
                $memid = $_REQUEST['userid'] = intval($_REQUEST['general']);
                $query = "select * from `alerts` where `memid`='$memid'";
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['general'];
                mysql_query("update `alerts` set `general`='$ver' where `memid`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change general status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('country',$_REQUEST) && $_REQUEST['country'] > 0)
+       if($id == 43 && array_key_exists('country',$_REQUEST) && $_REQUEST['country'] > 0 && $ticketvalidation==TRUE)
        {
                $memid = $_REQUEST['userid'] = intval($_REQUEST['country']);
                $query = "select * from `alerts` where `memid`='$memid'";
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['country'];
                mysql_query("update `alerts` set `country`='$ver' where `memid`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change country status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('regional',$_REQUEST) && $_REQUEST['regional'] > 0)
+       if($id == 43 && array_key_exists('regional',$_REQUEST) && $_REQUEST['regional'] > 0 && $ticketvalidation==TRUE)
        {
                $memid = $_REQUEST['userid'] = intval($_REQUEST['regional']);
                $query = "select * from `alerts` where `memid`='$memid'";
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['regional'];
                mysql_query("update `alerts` set `regional`='$ver' where `memid`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change regional status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
-       if($id == 43 && array_key_exists('radius',$_REQUEST) && $_REQUEST['radius'] > 0)
+       if($id == 43 && array_key_exists('radius',$_REQUEST) && $_REQUEST['radius'] > 0 && $ticketvalidation==TRUE)
        {
                $memid = $_REQUEST['userid'] = intval($_REQUEST['radius']);
                $query = "select * from `alerts` where `memid`='$memid'";
                $row = mysql_fetch_assoc(mysql_query($query));
                $ver = !$row['radius'];
                mysql_query("update `alerts` set `radius`='$ver' where `memid`='$memid'");
+               write_se_log($memid, $_SESSION['profile']['id'],'AD Change radius status',$ticketno);
+       }else{
+               $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
        }
 
        if($id == 50)
        if($oldid == 50 && $process != "")
        {
                $_REQUEST['userid'] = intval($_REQUEST['userid']);
-               $res = mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'");
-               if(mysql_num_rows($res) > 0)
-               {
-                       $query = "update `domaincerts`,`domains` SET `domaincerts`.`revoked`='1970-01-01 10:00:01'
-                                       WHERE `domaincerts`.`domid` = `domains`.`id` AND `domains`.`memid`='".intval($_REQUEST['userid'])."'";
-                       mysql_query($query);
-                       $query = "update `domains` SET `deleted`=NOW() WHERE `domains`.`memid`='".intval($_REQUEST['userid'])."'";
-                       mysql_query($query);
-                       $query = "update `emailcerts` SET `revoked`='1970-01-01 10:00:01' WHERE `memid`='".intval($_REQUEST['userid'])."'";
-                       mysql_query($query);
-                       $query = "update `email` SET `deleted`=NOW() WHERE `memid`='".intval($_REQUEST['userid'])."'";
-                       mysql_query($query);
-                       $query = "delete from `org` WHERE `memid`='".intval($_REQUEST['userid'])."'";
-                       mysql_query($query);
-                       $query = "update `users` SET `deleted`=NOW() WHERE `id`='".intval($_REQUEST['userid'])."'";
-                       mysql_query($query);
+               if (trim($_REQUEST['arbitrationno'])==""){
+                       showheader(_("My CAcert.org Account!"));
+                       echo _("You did not enter an arbitration number entry.");
+                       showfooter();
+                       exit;
+               }
+               if ( 1 !== preg_match('/^[a-z]\d{8}\.\d+\.\d+$/i',trim($_REQUEST['arbitrationno'])) ) {
+                       showheader(_("My CAcert.org Account!"));
+                       printf(_("'%s' is not a valid arbitration number entry."), sanitizeHTML(trim($_REQUEST['arbitrationno'])));
+                       showfooter();
+                       exit;
                }
+               if (check_email_exists(trim($_REQUEST['arbitrationno']).'@cacert.org')) {
+                       showheader(_("My CAcert.org Account!"));
+                       printf(_("The email address '%s' is already in a different account. Can't continue."), sanitizeHTML($_REQUEST['arbitrationno'].'@cacert.org'));
+                       showfooter();
+                       exit;
+                }
+               if (check_client_cert_running($_REQUEST['userid'],1) ||
+                       check_server_cert_running($_REQUEST['userid'],1) ||
+                       check_gpg_cert_running($_REQUEST['userid'],1)) {
+                       showheader(_("My CAcert.org Account!"));
+                       printf(_("The CCA retention time for at least one certificate is not over. Can't continue."));
+                       showfooter();
+                       exit;
+               }
+               if (check_is_orgadmin($_REQUEST['userid'],1)) {
+                       showheader(_("My CAcert.org Account!"));
+                       printf(_("The user is listed as Organisation Administrator. Can't continue."));
+                       showfooter();
+                       exit;
+               }
+               account_delete($_REQUEST['userid'], trim($_REQUEST['arbitrationno']), $_SESSION['profile']['id']);
        }
 
+       if(($id == 51 || $id == 52 || $oldid == 52))
+       {
+               showheader(_("My CAcert.org Account!"));
+               echo _("You don't have access to this area.\nThe Tverify programme is terminated as of 16th November 2010" );
+               showfooter();
+               exit;
+       }
+
+       /* this area not needed as the The Tverify programme is Terminated as of 16th November 2010
+
        if(($id == 51 || $id == 52 || $oldid == 52) && $_SESSION['profile']['tverify'] <= 0)
        {
                showheader(_("My CAcert.org Account!"));
                showfooter();
                exit;
        }
-
        if($oldid == 52)
        {
                $uid = intval($_REQUEST['uid']);
                showfooter();
                exit;
        }
+ */
+       if($id == 59){
+               if ($oldid==43) {
+                       se_write_log($_REQUEST['userid'], $_SESSION['profile']['id'], 'View account history', $_REQUEST['ticketno']);
+                       $support=1;
+               }ELSEIF ($oldid==13){
+                       $support=0;
+               }ELSE{
+                       showheader(_("My CAcert.org Account!"));
+                       echo _("You do not have access to this page.");
+                       showfooter();
+                       exit;
+               }
+       }
+
 
        if(intval($cert) > 0)
                $_SESSION['_config']['cert'] = intval($cert);