Source code taken from cacert-20131120.tar.bz2
[cacert-devel.git] / includes / account.php
index 54373b0..f28cf49 100644 (file)
@@ -10,7 +10,7 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-  
+
     You should have received a copy of the GNU General Public License
     along with this program; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
@@ -82,7 +82,7 @@
                if($checkemail != "OK")
                {
                        showheader(_("My CAcert.org Account!"));
-                       if (substr($checkemail, 0, 1) == "4") 
+                       if (substr($checkemail, 0, 1) == "4")
                        {
                                echo "<p>"._("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.")."</p>\n";
                        } else {
                $delcount = 0;
                if(array_key_exists('delid',$_REQUEST) && is_array($_REQUEST['delid']))
                {
+                       $deltitle=false;
                        foreach($_REQUEST['delid'] as $id)
                        {
+                               if (!$deltitle) {
+                                       echo _('The following email addresses have been removed:')."<br>\n";
+                                       $deltitle=true;
+                               }
                                $id = intval($id);
                                $query = "select * from `email` where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."' and
                                                `email`!='".$_SESSION['profile']['email']."'";
                {
                        echo _("You did not select any email accounts for removal.");
                }
-               if($delcount > 0)
+               if(0 == $delcount)
                {
-                       echo _("The following accounts have been removed:")."<br>\n";
-               } else {
-                       echo _("You failed to select any accounts to be removed, or you attempted to remove the default account. No action was taken.");
+                       echo _("You did not select any accounts to be removed, or you attempted to remove the default account. No action was taken.");
                }
 
                showfooter();
                                showfooter();
                                exit;
                        }
-                       
+
                        write_user_agreement(intval($_SESSION['profile']['id']), "CCA", "certificate creation", "", 1);
 
                        $query = "insert into emailcerts set
-                                               `CN`='$defaultemail', 
+                                               `CN`='$defaultemail',
                                                `keytype`='NS',
                                                `memid`='".intval($_SESSION['profile']['id'])."',
                                                `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
                } else if($_REQUEST['keytype'] == "MS" || $_REQUEST['keytype'] == "VI") {
                        if($csr == "")
                                $csr = "-----BEGIN CERTIFICATE REQUEST-----\n".clean_csr($_REQUEST['CSR'])."\n-----END CERTIFICATE REQUEST-----\n";
-                       
+
                        if (($weakKey = checkWeakKeyCSR($csr)) !== "")
                        {
                                $id = 4;
                                showfooter();
                                exit;
                        }
-                       
+
                        $tmpfname = tempnam("/tmp", "id4CSR");
                        $fp = fopen($tmpfname, "w");
                        fputs($fp, $csr);
                                showfooter();
                                exit;
                        }
-                       $query = "insert into emailcerts set 
-                                               `CN`='$defaultemail', 
+                       $query = "insert into emailcerts set
+                                               `CN`='$defaultemail',
                                                `keytype`='".sanitizeHTML($_REQUEST['keytype'])."',
                                                `memid`='".$_SESSION['profile']['id']."',
                                                `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
                {
                        showheader(_("My CAcert.org Account!"));
                        //echo "<p>"._("Email Address given was invalid, or a test connection couldn't be made to your server, or the server rejected the email address as invalid")."</p>\n";
-                       if (substr($checkemail, 0, 1) == "4") 
+                       if (substr($checkemail, 0, 1) == "4")
                        {
                                echo "<p>"._("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.")."</p>\n";
                        } else {
                        // In case the CSR is missing the ---BEGIN lines, add them automatically:
                        $CSR = "-----BEGIN CERTIFICATE REQUEST-----\n".$CSR."\n-----END CERTIFICATE REQUEST-----\n";
                }
-               
+
                if (($weakKey = checkWeakKeyCSR($CSR)) !== "")
                {
                        showheader(_("My CAcert.org Account!"));
                        showfooter();
                        exit;
                }
-               
+
                if(trim($_REQUEST['description']) != ""){
                        $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
                }else{
                        showfooter();
                        exit;
                }
-               
+
                if (($weakKey = checkWeakKeyCSR(file_get_contents(
                                $_SESSION['_config']['tmpfname']))) !== "")
                {
                        showfooter();
                        exit;
                }
-               
+
                $id = 11;
                if($_SESSION['_config']['0.CN'] == "" && $_SESSION['_config']['0.subjectAltName'] == "")
                {
 
                if(array_key_exists('0',$_SESSION['_config']['rowid']) && $_SESSION['_config']['rowid']['0'] > 0)
                {
-                       $query = "insert into `domaincerts` set 
+                       $query = "insert into `domaincerts` set
                                                `CN`='".mysql_real_escape_string($_SESSION['_config']['rows']['0'])."',
                                                `domid`='".mysql_real_escape_string($_SESSION['_config']['rowid']['0'])."',
                                                `created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
                                                `rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."',
                                                `description`='".$_SESSION['_config']['description']."'";
                } elseif(array_key_exists('0',$_SESSION['_config']['altid']) && $_SESSION['_config']['altid']['0'] > 0) {
-                       $query = "insert into `domaincerts` set 
+                       $query = "insert into `domaincerts` set
                                                `CN`='".mysql_real_escape_string($_SESSION['_config']['altrows']['0'])."',
                                                `domid`='".mysql_real_escape_string($_SESSION['_config']['altid']['0'])."',
                                                `created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
                                        printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br/>\n", $id);
                                        continue;
                                }
-                               
+
                                $row = mysql_fetch_assoc($res);
-                               
+
                                if (($weakKey = checkWeakKeyX509(file_get_contents(
                                                $row['crt_name']))) !== "")
                                {
                                        echo $weakKey, "<br/>\n";
                                        continue;
                                }
-                               
+
                                mysql_query("update `domaincerts` set `renewed`='1' where `id`='$id'");
-                               $query = "insert into `domaincerts` set 
-                                               `domid`='".$row['domid']."', 
+                               $query = "insert into `domaincerts` set
+                                               `domid`='".$row['domid']."',
                                                `CN`='".mysql_real_escape_string($row['CN'])."',
                                                `subject`='".mysql_real_escape_string($row['subject'])."',".
                                                //`csr_name`='".$row['csr_name']."', // RACE CONDITION
                                                "`created`='".$row['created']."',
-                                               `modified`=NOW(), 
+                                               `modified`=NOW(),
                                                `rootcert`='".$row['rootcert']."',
                                                `type`='".$row['type']."',
                                                `pkhash`='".$row['pkhash']."',
                        foreach($_REQUEST['revokeid'] as $id)
                        {
                                $id = intval($id);
-                               $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains` 
+                               $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains`
                                                where `domaincerts`.`id`='$id' and
                                                `domaincerts`.`domid`=`domains`.`id` and
                                                `domains`.`memid`='".$_SESSION['profile']['id']."'";
                        foreach($_REQUEST['delid'] as $id)
                        {
                                $id = intval($id);
-                               $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired` from `domaincerts`,`domains` 
+                               $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired` from `domaincerts`,`domains`
                                                where `domaincerts`.`id`='$id' and
                                                `domaincerts`.`domid`=`domains`.`id` and
                                                `domains`.`memid`='".$_SESSION['profile']['id']."'";
                        foreach($_REQUEST['revokeid'] as $id)
                        {
                                $id = intval($id);
-                               $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts` 
+                               $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
                                                where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
                                $res = mysql_query($query);
                                if(mysql_num_rows($res) <= 0)
                                        printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
                                        continue;
                                }
-                               
+
                                $row = mysql_fetch_assoc($res);
-                               
+
                                if (($weakKey = checkWeakKeyX509(file_get_contents(
                                                $row['crt_name']))) !== "")
                                {
                                        echo $weakKey, "<br/>\n";
                                        continue;
                                }
-                               
+
                                mysql_query("update `emailcerts` set `renewed`='1' where `id`='$id'");
-                               $query = "insert into emailcerts set 
-                                               `memid`='".$row['memid']."', 
+                               $query = "insert into emailcerts set
+                                               `memid`='".$row['memid']."',
                                                `CN`='".mysql_real_escape_string($row['CN'])."',
                                                `subject`='".mysql_real_escape_string($row['subject'])."',
-                                               `keytype`='".$row['keytype']."', 
-                                               `csr_name`='".$row['csr_name']."', 
-                                               `created`='".$row['created']."', 
+                                               `keytype`='".$row['keytype']."',
+                                               `csr_name`='".$row['csr_name']."',
+                                               `created`='".$row['created']."',
                                                `modified`=NOW(),
                                                `disablelogin`='".$row['disablelogin']."',
                                                `codesign`='".$row['codesign']."',
                        foreach($_REQUEST['revokeid'] as $id)
                        {
                                $id = intval($id);
-                               $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts` 
+                               $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
                                                where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
                                $res = mysql_query($query);
                                if(mysql_num_rows($res) <= 0)
                        foreach($_REQUEST['delid'] as $id)
                        {
                                $id = intval($id);
-                               $query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `emailcerts` 
+                               $query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `emailcerts`
                                                where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
                                $res = mysql_query($query);
                                if(mysql_num_rows($res) <= 0)
                $ddres = mysql_query($ddquery);
                $ddrow = mysql_fetch_assoc($ddres);
                $_SESSION['profile']['points'] = $ddrow['total'];
-               
+
                if($_SESSION['profile']['points'] == 0)
                {
                        $_SESSION['_config']['user']['fname'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['fname']))));
                                                where `id`='".$_SESSION['profile']['id']."'";
                mysql_query($query);
 
-               //!!!Should be rewritten 
+               //!!!Should be rewritten
                $_SESSION['_config']['user']['otphash'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otphash']))));
                $_SESSION['_config']['user']['otppin'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otppin']))));
                if($_SESSION['_config']['user']['otphash'] != "" && $_SESSION['_config']['user']['otppin'] != "")
                                showfooter();
                                exit;
                        }
-                       
-                       $query = "insert into `orgemailcerts` set 
-                                               `CN`='$defaultemail', 
+
+                       $query = "insert into `orgemailcerts` set
+                                               `CN`='$defaultemail',
+                                               `ou`='".$_SESSION['_config']['OU']."',
                                                `keytype`='NS',
                                                `orgid`='".$org['orgid']."',
                                                `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
                        mysql_query("update `orgemailcerts` set `csr_name`='$CSRname' where `id`='$emailid'");
                } else if($_REQUEST['keytype'] == "MS" || $_REQUEST['keytype']=="VI") {
                        $csr = "-----BEGIN CERTIFICATE REQUEST-----\n".clean_csr($_REQUEST['CSR'])."-----END CERTIFICATE REQUEST-----\n";
-                       
+
                        if (($weakKey = checkWeakKeyCSR($csr)) !== "")
                        {
                                $id = 17;
                                showfooter();
                                exit;
                        }
-                       
+
                        $tmpfname = tempnam("/tmp", "id17CSR");
                        $fp = fopen($tmpfname, "w");
                        fputs($fp, $csr);
                        if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
                                $_SESSION['_config']['rootcert'] = 1;
 
-                       $query = "insert into `orgemailcerts` set 
-                                               `CN`='$defaultemail', 
+                       $query = "insert into `orgemailcerts` set
+                                               `CN`='$defaultemail',
+                                               `ou`='".$_SESSION['_config']['OU']."',
                                                `keytype`='" . sanitizeHTML($_REQUEST['keytype']) . "',
                                                `orgid`='".$org['orgid']."',
                                                `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
                                        printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
                                        continue;
                                }
-                               
+
                                $row = mysql_fetch_assoc($res);
-                               
+
                                if (($weakKey = checkWeakKeyX509(file_get_contents(
                                                $row['crt_name']))) !== "")
                                {
                                        echo $weakKey, "<br/>\n";
                                        continue;
                                }
-                               
+
                                mysql_query("update `orgemailcerts` set `renewed`='1' where `id`='$id'");
                                if($row['revoke'] > 0)
                                {
                                        printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."<br>\n", $row['CN']);
                                        continue;
                                }
-                               $query = "insert into `orgemailcerts` set 
-                                               `orgid`='".$row['orgid']."', 
+                               $query = "insert into `orgemailcerts` set
+                                               `orgid`='".$row['orgid']."',
                                                `CN`='".$row['CN']."',
+                                               `ou`='".$row['ou']."',
                                                `subject`='".$row['subject']."',
-                                               `keytype`='".$row['keytype']."', 
-                                               `csr_name`='".$row['csr_name']."', 
-                                               `created`='".$row['created']."', 
+                                               `keytype`='".$row['keytype']."',
+                                               `csr_name`='".$row['csr_name']."',
+                                               `created`='".$row['created']."',
                                                `modified`=NOW(),
                                                `codesign`='".$row['codesign']."',
                                                `rootcert`='".$row['rootcert']."',
                exit;
        }
 
+       if($oldid == 18 && array_key_exists('filter',$_REQUEST) && $_REQUEST['filter']!= "")
+       {
+               $id=18;
+               $_SESSION['_config']['orgfilterid']=$_REQUEST['orgfilterid'];
+               $_SESSION['_config']['sorting']=$_REQUEST['sorting'];
+               $_SESSION['_config']['status']=$_REQUEST['status'];
+       }
+
+       if($oldid == 18 && array_key_exists('reset',$_REQUEST) && $_REQUEST['reset']!= "")
+       {
+               $id=18;
+               $_SESSION['_config']['orgfilterid']=0;
+               $_SESSION['_config']['sorting']=0;
+               $_SESSION['_config']['status']=0;
+       }
 
        if($process != "" && $oldid == 20)
        {
                $CSR = clean_csr($_REQUEST['CSR']);
-               
+
                if (($weakKey = checkWeakKeyCSR($CSR)) !== "")
                {
                        $id = 20;
                        showfooter();
                        exit;
                }
-               
+
                if(trim($_REQUEST['description']) != ""){
                        $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
                }else{
        if($process != "" && $oldid == 21)
        {
                $id = 21;
-               
+
                if(!file_exists($_SESSION['_config']['tmpfname']))
                {
                        showheader(_("My CAcert.org Account!"));
                        showfooter();
                        exit;
                }
-               
+
                if (($weakKey = checkWeakKeyCSR(file_get_contents(
                                $_SESSION['_config']['tmpfname']))) !== "")
                {
                if(is_array($_SESSION['_config']['rows']))
                        foreach($_SESSION['_config']['rows'] as $row)
                                $csrsubject .= "/commonName=$row";
-               $SAN="";                
+               $SAN="";
                if(is_array($_SESSION['_config']['altrows']))
                        foreach($_SESSION['_config']['altrows'] as $subalt)
                        {
                                        printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
                                        continue;
                                }
-                               
+
                                $row = mysql_fetch_assoc($res);
-                               
+
                                if (($weakKey = checkWeakKeyX509(file_get_contents(
                                                $row['crt_name']))) !== "")
                                {
                                        echo $weakKey, "<br/>\n";
                                        continue;
                                }
-                               
+
                                mysql_query("update `orgdomaincerts` set `renewed`='1' where `id`='$id'");
                                if($row['revoke'] > 0)
                                {
                                        printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."<br>\n", $row['CN']);
                                        continue;
                                }
-                               $query = "insert into `orgdomaincerts` set 
-                                               `orgid`='".$row['orgid']."', 
+                               $query = "insert into `orgdomaincerts` set
+                                               `orgid`='".$row['orgid']."',
                                                `CN`='".$row['CN']."',
-                                               `csr_name`='".$row['csr_name']."', 
+                                               `csr_name`='".$row['csr_name']."',
                                                `created`='".$row['created']."',
-                                               `modified`=NOW(), 
-                                               `subject`='".$row['subject']."', 
+                                               `modified`=NOW(),
+                                               `subject`='".$row['subject']."',
                                                `type`='".$row['type']."',
                                                `rootcert`='".$row['rootcert']."',
                                                `description`='".$row['description']."'";
                exit;
        }
 
+       if($oldid == 22 && array_key_exists('filter',$_REQUEST) && $_REQUEST['filter']!= "")
+       {
+               $id=22;
+               $_SESSION['_config']['dorgfilterid']=$_REQUEST['dorgfilterid'];
+               $_SESSION['_config']['dsorting']=$_REQUEST['dsorting'];
+               $_SESSION['_config']['dstatus']=$_REQUEST['dstatus'];
+       }
+
+       if($oldid == 22 && array_key_exists('reset',$_REQUEST) && $_REQUEST['reset']!= "")
+       {
+               $id=22;
+               $_SESSION['_config']['dorgfilterid']=0;
+               $_SESSION['_config']['dsorting']=0;
+               $_SESSION['_config']['dstatus']=0;
+       }
+
 
        if(($id == 24 || $oldid == 24 || $id == 25 || $oldid == 25 || $id == 26 || $oldid == 26 ||
                $id == 27 || $oldid == 27 || $id == 28 || $oldid == 28 || $id == 29 || $oldid == 29 ||
 
        if(($oldid == 29 || $oldid == 30) && $process != "")      // _("Cancel") is handled in front of account.php
        {
-               $query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where 
+               $query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where
                                `orgdomlink`.`orgdomid`=`orgdomains`.`id` and
                                `orgdomaincerts`.`id`=`orgdomlink`.`orgcertid` and
                                `orgdomains`.`id`='".intval($domid)."'";
                while($row = mysql_fetch_assoc($res))
                        mysql_query("update `orgdomaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$row['id']."'");
 
-               $query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where 
+               $query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where
                                `orgemaillink`.`domid`=`orgdomains`.`id` and
                                `orgemailcerts`.`id`=`orgemaillink`.`emailcertsid` and
                                `orgdomains`.`id`='".intval($domid)."'";
                $dres = mysql_query($query);
                while($drow = mysql_fetch_assoc($dres))
                {
-                       $query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where 
+                       $query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where
                                        `orgdomlink`.`orgdomid`=`orgdomains`.`id` and
                                        `orgdomaincerts`.`id`=`orgdomlink`.`orgcertid` and
                                        `orgdomains`.`id`='".intval($drow['id'])."'";
                                mysql_query("delete from `orgdomlink` where `domid`='".intval($row['id'])."'");
                        }
 
-                       $query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where 
+                       $query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where
                                        `orgemaillink`.`domid`=`orgdomains`.`id` and
                                        `orgemailcerts`.`id`=`orgemaillink`.`emailcertsid` and
                                        `orgdomains`.`id`='".intval($drow['id'])."'";
                        $row = mysql_fetch_assoc($res);
                        if ( !is_assurer(intval($row['id'])) )
                        {
-                               $id = $oldid;\r
-                               $oldid=0;\r
+                               $id = $oldid;
+                               $oldid=0;
                                $_SESSION['_config']['errmsg'] =
                                                _("The user is not an Assurer yet");
                        } else {
                exit;
        }
 
-       if($oldid == 54 || ($id == 53 && array_key_exists('action',$_REQUEST) && $_REQUEST['action'] != "") || 
+       if($oldid == 54 || ($id == 53 && array_key_exists('action',$_REQUEST) && $_REQUEST['action'] != "") ||
                        ($id == 54 && array_key_exists('action',$_REQUEST) && $_REQUEST['action'] != "" &&
                        $_REQUEST['action'] != "aliases" && $_REQUEST['action'] != "edit" && $_REQUEST['action'] != "add"))
        {
                        showfooter();
                        exit;
                }
-               
+
                if (($weakKey = checkWeakKeyCSR($CSR)) !== "")
                {
                        showheader(_("My CAcert.org Account!"));
                        exit;
                }
 
-               $query = "insert into `domaincerts` set 
+               $query = "insert into `domaincerts` set
                                                `CN`='".$_SESSION['_config']['0.CN']."',
                                                `domid`='".$_SESSION['_config']['row']['id']."',
                                                `created`=NOW()";
 
        if($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0)
        {
-               csrf_check('admactlock');       
+               csrf_check('admactlock');
                $memid = $_REQUEST['userid'] = intval($_REQUEST['locked']);
                $query = "select * from `users` where `id`='$memid'";
                $row = mysql_fetch_assoc(mysql_query($query));
                        while($row = mysql_fetch_assoc($res))
                                $body .= $row['comment']."\n";
                        $body .= "\n";
-                       
+
                        $body .= _("Best regards")."\n";
                        $body .= _("CAcert Support Team");
                        sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form@cacert.org", "support@cacert.org", "", "CAcert Tverify");
                        $body .= "\n";
 
                        $body .= _("You are welcome to try submitting another request at any time in the future, please make sure you take the reviewer comments into consideration or you risk having your application rejected again.")."\n\n";
-                       
+
                        $body .= _("Best regards")."\n";
                        $body .= _("CAcert Support Team");
                        sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form@cacert.org", "support@cacert.org", "", "CAcert Tverify");