/**
  * @param Member $user
  * @return string
  */
 private static function generate_token($user)
 {
     $iat = time();
     $data = ['iat' => $iat, 'jti' => AuthFactory::generate_token($user), 'iss' => Config::inst()->get('JwtAuth', 'Issuer'), 'expire' => $iat + Config::inst()->get('JwtAuth', 'ExpireTime'), 'userId' => $user->ID];
     $key = self::get_key();
     return self::jwt_encode($data, $key);
 }

 public static function current($request)
 {
     try {
         $token = AuthFactory::get_token($request);
         return self::get_member_from_token($token);
     } catch (\Exception $e) {
         \SS_Log::log($e->getMessage(), \SS_Log::INFO);
     }
     return false;
 }

 public function init()
 {
     /* Initialize action controller here */
     parent::init();
     $this->auth = AuthFactory::create(AuthFactory::$AGENT, $this->db, $this->_request);
     $this->chatRequestModel = new Chat_Request($this->db);
     $this->chatSessionModel = new Chat_Session($this->db);
     $this->appChatRequestModel = new App_ChatRequest();
     $this->leadModel = new App_Lead();
     $this->agentModel = new App_Agent();
 }

 /**
  * @param \Member $user
  * @return ApiSession
  */
 public static function createSession($user)
 {
     $user->logIn();
     /** @var \Member $user */
     $user = \DataObject::get(\Config::inst()->get('BaseRestController', 'Owner'))->byID($user->ID);
     // create session
     $session = ApiSession::create();
     $session->User = $user;
     $session->Token = AuthFactory::generate_token($user);
     return $session;
 }

 public static function authenticate($email, $password)
 {
     $authenticator = new MemberAuthenticator();
     if ($user = $authenticator->authenticate(['Password' => $password, 'Email' => $email])) {
         // create session
         $session = ApiSession::create();
         $session->User = $user;
         $session->Token = AuthFactory::generate_token($user);
         // save session
         $cache = SS_Cache::factory('rest_cache');
         $cache->save(json_encode(['token' => $session->Token, 'user' => $session->User->ID]), $session->Token);
         return $session;
     }
 }

 public static function authenticate($email, $password)
 {
     // auth
     $authenticator = new \MemberAuthenticator();
     if ($user = $authenticator->authenticate(['Password' => $password, 'Email' => $email])) {
         $user->logIn();
         $user = DataObject::get(Config::inst()->get('BaseRestController', 'Owner'))->byID($user->ID);
         // create session
         $session = ApiSession::create();
         $session->User = $user;
         $session->Token = AuthFactory::generate_token($user);
         return $session;
     }
 }

 public function init()
 {
     parent::init();
     $this->auth = AuthFactory::create(AuthFactory::$OWNER, $this->db, $this->_request);
     $this->model = new Owner_Owner($this->db);
     $this->model->setRequestObject($this->_request);
     $this->ownerModel = new App_Owner();
     $this->timezoneModel = new App_Timezone();
     $this->timezoneGroupModel = new App_TimezoneGroup();
     $this->businessTypeModel = new App_BusinessType();
     $this->numberOfHitModel = new App_NumberOfHit();
     $this->leadModel = new App_Lead();
     $this->memberModel = new App_Member();
     $this->baseUrlDashboard = $this->baseUrl . "/js/leadschat-dashboard";
 }

function adduser_validate(Pieform $form, $values)
{
    global $USER;
    $authobj = AuthFactory::create($values['authinstance']);
    $institution = $authobj->institution;
    // Institutional admins can only set their own institutions' authinstances
    if (!$USER->get('admin') && !$USER->is_institutional_admin($authobj->institution)) {
        $form->set_error('authinstance', get_string('notadminforinstitution', 'admin'));
        return;
    }
    $institution = new Institution($authobj->institution);
    // Don't exceed max user accounts for the institution
    if ($institution->isFull()) {
        $SESSION->add_error_msg(get_string('institutionmaxusersexceeded', 'admin'));
        redirect('/admin/users/add.php');
    }
    $username = $values['username'];
    $firstname = $values['firstname'];
    $lastname = $values['lastname'];
    $email = $values['email'];
    $password = $values['password'];
    if (method_exists($authobj, 'is_username_valid') && !$authobj->is_username_valid($username)) {
        $form->set_error('username', get_string('addusererrorinvalidusername', 'admin'));
        return;
    }
    if (!$form->get_error('username') && record_exists_select('usr', 'LOWER(username) = ?', strtolower($username))) {
        $form->set_error('username', get_string('usernamealreadytaken', 'auth.internal'));
        return;
    }
    if (!$form->get_error('firstname') && !preg_match('/\\S/', $firstname)) {
        $form->set_error('firstname', $form->i18n('required'));
    }
    if (!$form->get_error('lastname') && !preg_match('/\\S/', $lastname)) {
        $form->set_error('lastname', $form->i18n('required'));
    }
    if (record_exists('usr', 'email', $email) || record_exists('artefact_internal_profile_email', 'email', $email)) {
        $form->set_error('email', get_string('emailalreadytaken', 'auth.internal'));
    }
    if (method_exists($authobj, 'is_password_valid') && !$authobj->is_password_valid($password)) {
        $form->set_error('password', get_string('passwordinvalidform', 'auth.' . $authobj->type));
        return;
    }
}

 /**
  * @param SS_HTTPRequest $request
  * @return array
  * @throws RestUserException
  */
 public function delete($request)
 {
     // check param for id
     $data = [];
     try {
         if ($id = $request->param('ID')) {
             if ($id != 'me') {
                 throw new RestUserException("No session found", 404);
             }
             AuthFactory::createAuth()->delete($request);
         } else {
             throw new RestUserException("No id specified for deletion", 404);
         }
     } catch (RestUserException $e) {
         throw $e;
     } catch (Exception $e) {
         throw new RestUserException("ApiSession was not found", 404);
     }
     $meta = ['timestamp' => time()];
     $data['meta'] = $meta;
     return $data;
 }

 /**
  * Installs a site using $CFG->dataroot and $CFG->dbprefix
  * As we are setting up the behat test environment, these settings
  * are replaced by $CFG->behat_dataroot and $CFG->behat_dbprefix
  *
  * @throws SystemException
  * @return void
  */
 public static function install_site()
 {
     if (!defined('BEHAT_UTIL')) {
         throw new SystemException('This method can be only used by Behat CLI tool');
     }
     if (table_exists(new XMLDBTable('config'))) {
         behat_error(BEHAT_EXITCODE_INSTALLED);
     }
     // New dataroot.
     self::reset_dataroot();
     // Determine what we will install
     $upgrades = check_upgrades();
     $upgrades['firstcoredata'] = true;
     $upgrades['localpreinst'] = true;
     $upgrades['lastcoredata'] = true;
     $upgrades['localpostinst'] = true;
     upgrade_mahara($upgrades);
     $userobj = new User();
     $userobj = $userobj->find_by_username('admin');
     $userobj->email = self::$sitedefaultinfo['admin']['email'];
     $userobj->commit();
     // Password changes should be performed by the authfactory
     $authobj = AuthFactory::create($userobj->authinstance);
     $authobj->change_password($userobj, self::$sitedefaultinfo['admin']['password'], true);
     // Set site name
     set_config('sitename', self::$sitedefaultinfo['sitename']);
     // We need to keep the installed dataroot artefact files.
     // So each time we reset the dataroot before running a test, the default files are still installed.
     self::save_original_data_files();
     // Disable some settings that are not wanted on test sites.
     set_config('sendemail', false);
     // Keeps the current version of database and dataroot.
     self::store_versions_hash();
     // Stores the database contents for fast reset.
     self::store_database_state();
 }

function accountprefs_submit(Pieform $form, $values)
{
    global $USER;
    $authobj = AuthFactory::create($USER->authinstance);
    db_begin();
    if (isset($values['password1']) && $values['password1'] !== '') {
        global $authclass;
        $password = $authobj->change_password($USER, $values['password1']);
        $USER->password = $password;
        $USER->passwordchange = 0;
        $USER->commit();
    }
    // use this as looping through values is not safe.
    $expectedprefs = expected_account_preferences();
    foreach (array_keys($expectedprefs) as $pref) {
        if (isset($values[$pref])) {
            $USER->set_account_preference($pref, $values[$pref]);
        }
    }
    $returndata = array();
    if (isset($values['username']) && $values['username'] != $USER->get('username')) {
        $USER->username = $values['username'];
        $USER->commit();
        $returndata['username'] = $values['username'];
    }
    db_commit();
    $returndata['message'] = get_string('prefssaved', 'account');
    $form->json_reply(PIEFORM_OK, $returndata);
}

 function create_registered_user($profilefields = array())
 {
     global $registration, $SESSION, $USER;
     require_once get_config('libroot') . 'user.php';
     db_begin();
     // Move the user record to the usr table from the registration table
     $registrationid = $registration->id;
     unset($registration->id);
     unset($registration->expiry);
     if ($expirytime = get_config('defaultregistrationexpirylifetime')) {
         $registration->expiry = db_format_timestamp(time() + $expirytime);
     }
     $registration->lastlogin = db_format_timestamp(time());
     $authinstance = get_record('auth_instance', 'institution', $registration->institution, 'authname', $registration->authtype ? $registration->authtype : 'internal');
     if (false == $authinstance) {
         throw new ConfigException('No ' . ($registration->authtype ? $registration->authtype : 'internal') . ' auth instance for institution');
     }
     if (!empty($registration->extra)) {
         // Additional user settings were added during confirmation
         $extrafields = unserialize($registration->extra);
     }
     $user = new User();
     $user->active = 1;
     $user->authinstance = $authinstance->id;
     $user->firstname = $registration->firstname;
     $user->lastname = $registration->lastname;
     $user->email = $registration->email;
     $user->username = get_new_username($user->firstname . $user->lastname);
     $user->passwordchange = 1;
     // Points that indicate the user is a "new user" who should be restricted from spammy activities.
     // We count these down when they do good things; when they have 0 they're no longer a "new user"
     if (is_using_probation()) {
         $user->probation = get_config('probationstartingpoints');
     } else {
         $user->probation = 0;
     }
     if ($registration->institution != 'mahara') {
         if (count_records_select('institution', "name != 'mahara'") == 1 || $registration->pending == 2) {
             if (get_config_plugin('artefact', 'file', 'institutionaloverride')) {
                 $user->quota = get_field('institution', 'defaultquota', 'name', $registration->institution);
             }
         }
     }
     create_user($user, $profilefields);
     // If the institution is 'mahara' then don't do anything
     if ($registration->institution != 'mahara') {
         $institutions = get_records_select_array('institution', "name != 'mahara'");
         // If there is only one available, join it without requiring approval
         if (count($institutions) == 1) {
             $user->join_institution($registration->institution);
         } else {
             if ($registration->pending == 2) {
                 if (get_config('requireregistrationconfirm') || get_field('institution', 'registerconfirm', 'name', $registration->institution)) {
                     $user->join_institution($registration->institution);
                 }
             } else {
                 if ($registration->authtype && $registration->authtype != 'internal') {
                     $auth = AuthFactory::create($authinstance->id);
                     if ($auth->weautocreateusers) {
                         $user->join_institution($registration->institution);
                     } else {
                         $user->add_institution_request($registration->institution);
                     }
                 } else {
                     $user->add_institution_request($registration->institution);
                 }
             }
         }
         if (!empty($extrafields->institutionstaff)) {
             // If the user isn't a member yet, this does nothing, but that's okay, it'll
             // only be set after successful confirmation.
             set_field('usr_institution', 'staff', 1, 'usr', $user->id, 'institution', $registration->institution);
         }
     }
     if (!empty($registration->lang) && $registration->lang != 'default') {
         set_account_preference($user->id, 'lang', $registration->lang);
     }
     // Delete the old registration record
     delete_records('usr_registration', 'id', $registrationid);
     db_commit();
     // Log the user in and send them to the homepage
     $USER = new LiveUser();
     $USER->reanimate($user->id, $authinstance->id);
     if (function_exists('local_post_register')) {
         local_post_register($registration);
     }
     $SESSION->add_ok_msg(get_string('registrationcomplete', 'mahara', get_config('sitename')));
     $SESSION->set('resetusername', true);
     redirect();
 }

 /**
  * Create test users from one place to share between update
  * and favourites
  */
 function create_user2_for_update()
 {
     //can run this test only if test usernames don't exist
     foreach (array('veryimprobabletestusername2', 'veryimprobabletestusername2_updated') as $username) {
         $existinguser = get_record('usr', 'username', $username);
         if (!empty($existinguser)) {
             delete_user($existinguser->id);
         }
     }
     $user2 = new stdClass();
     $user2->authinstance = $this->authinstance->id;
     $user2->username = 'veryimprobabletestusername2';
     if ($dbuser2 = get_record('usr', 'username', $user2->username)) {
         return $dbuser2;
     }
     $user2->password = 'testpassword2';
     $user2->firstname = 'testfirstname2';
     $user2->lastname = 'testlastname2';
     $user2->email = '[email protected]';
     $profilefields = new StdClass();
     db_begin();
     $userid = create_user($user2, $profilefields, $this->institution, $this->authinstance);
     db_commit();
     $dbuser2 = get_record('usr', 'username', $user2->username);
     $this->assertTrue($dbuser2 instanceof stdClass);
     $userobj = new User();
     $userobj = $userobj->find_by_id($dbuser2->id);
     $authobj_tmp = AuthFactory::create($dbuser2->authinstance);
     $authobj_tmp->change_password($userobj, $dbuser2->password, false);
     $this->created_users[] = $dbuser2->id;
     $dbuser2 = get_record('usr', 'username', $user2->username);
     return $dbuser2;
 }

 public function login($email)
 {
     // This will do one of 3 things
     // 1 - If a user has an account, log them in
     // 2 - If a user doesn't have an account, and there is an auth method (which also has weautocreate), create acc and login
     // 3 - If a user doesn't have an account, and there is more than one auth method, show a registration page
     $sql = "SELECT\n                    a.id, i.name AS institutionname\n                FROM\n                    {auth_instance} a\n                JOIN\n                    {institution} i ON a.institution = i.name\n                WHERE\n                    a.authname = 'browserid' AND\n                    i.suspended = 0";
     $authinstances = get_records_sql_array($sql, array());
     if (!$authinstances) {
         throw new ConfigException(get_string('browseridnotenabled', 'auth.browserid'));
     }
     $autocreate = array();
     // Remember the authinstances that are happy to create users
     foreach ($authinstances as $authinstance) {
         $auth = AuthFactory::create($authinstance->id);
         $institutionjoin = '';
         $institutionwhere = '';
         $sqlvalues = array($email);
         if ($authinstance->institutionname != 'mahara') {
             // Make sure that user is in the right institution
             $institutionjoin = 'JOIN {usr_institution} ui ON ui.usr = u.id';
             $institutionwhere = 'AND ui.institution = ?';
             $sqlvalues[] = $authinstance->institutionname;
         }
         $sql = "SELECT\n                        u.*,\n                        " . db_format_tsfield('u.expiry', 'expiry') . ",\n                        " . db_format_tsfield('u.lastlogin', 'lastlogin') . ",\n                        " . db_format_tsfield('u.lastlastlogin', 'lastlastlogin') . ",\n                        " . db_format_tsfield('u.lastaccess', 'lastaccess') . ",\n                        " . db_format_tsfield('u.suspendedctime', 'suspendedctime') . ",\n                        " . db_format_tsfield('u.ctime', 'ctime') . "\n                    FROM\n                        {usr} u\n                    JOIN\n                        {artefact_internal_profile_email} a ON a.owner = u.id\n                    {$institutionjoin}\n                    WHERE\n                        a.verified = 1 AND\n                        a.email = ?\n                    {$institutionwhere}";
         $user = get_record_sql($sql, $sqlvalues);
         if (!$user) {
             if ($auth->weautocreateusers) {
                 if ($authinstance->institutionname == 'mahara') {
                     array_unshift($autocreate, $auth);
                     // Try "No Instititution" first when creating users below
                 } else {
                     $autocreate[] = $auth;
                 }
             }
             continue;
             // skip to the next auth_instance
         }
         if (is_site_closed($user->admin)) {
             return false;
         }
         ensure_user_account_is_active($user);
         $this->authenticate($user, $auth->instanceid);
         return true;
     }
     foreach ($autocreate as $auth) {
         if (!($user = $auth->create_new_user($email))) {
             continue;
         }
         $this->authenticate($user, $auth->instanceid);
         return;
     }
     // Autocreation failed; try registration.
     list($form, $registerconfirm) = auth_generate_registration_form('register', 'browserid', '/register.php');
     if (!$form) {
         throw new AuthUnknownUserException(get_string('emailnotfound', 'auth.browserid', $email));
     }
     if (record_exists('usr', 'email', $email) || record_exists('artefact_internal_profile_email', 'email', $email)) {
         throw new AuthUnknownUserException(get_string('emailalreadytaken', 'auth.internal', $email));
     }
     $form['elements']['email'] = array('type' => 'hidden', 'value' => $email);
     $form['elements']['authtype'] = array('type' => 'hidden', 'value' => 'browserid');
     list($formhtml, $js) = auth_generate_registration_form_js($form, $registerconfirm);
     $registerdescription = get_string('registerwelcome');
     if ($registerterms = get_config('registerterms')) {
         $registerdescription .= ' ' . get_string('registeragreeterms');
     }
     $registerdescription .= ' ' . get_string('registerprivacy');
     $smarty = smarty();
     $smarty->assign('register_form', $formhtml);
     $smarty->assign('registerdescription', $registerdescription);
     if ($registerterms) {
         $smarty->assign('termsandconditions', get_site_page_content('termsandconditions'));
     }
     $smarty->assign('PAGEHEADING', get_string('register', 'auth.browserid'));
     $smarty->assign('INLINEJAVASCRIPT', $js);
     $smarty->display('register.tpl');
     die;
 }

$settings->options = $options;
$settings->info = get_string('cliinstallerdescription', 'admin');
$cli->setup($settings);
// Check whether we need to do anything
if (table_exists(new XMLDBTable('config'))) {
    cli::cli_exit(get_string('maharainstalled', 'admin'), false);
}
// Check initial password and e-mail address before we install
try {
    $adminpassword = $cli->get_cli_param('adminpassword');
    $adminemail = $cli->get_cli_param('adminemail');
} catch (ParameterException $e) {
    cli::cli_exit($e->getMessage(), true);
}
// Determine what we will install
$upgrades = check_upgrades();
$upgrades['firstcoredata'] = true;
$upgrades['localpreinst'] = true;
$upgrades['lastcoredata'] = true;
$upgrades['localpostinst'] = true;
// Actually perform the installation
log_info(get_string('cliinstallingmahara', 'admin'));
upgrade_mahara($upgrades);
// Set initial password and e-mail address
$userobj = new User();
$userobj = $userobj->find_by_username('admin');
$userobj->email = $adminemail;
$userobj->commit();
// Password changes should be performed by the authfactory
$authobj = AuthFactory::create($userobj->authinstance);
$authobj->change_password($userobj, $adminpassword, true);

 /**
  * Create a test user
  * @param array $record
  * @throws SystemException if creating failed
  * @return int new user id
  */
 public function create_user($record)
 {
     // Data validation
     // Set default auth method for a new user is 'internal' for 'No institution' if not set
     if (empty($record['institution']) || empty($record['authname'])) {
         $record['institution'] = 'mahara';
         $record['authname'] = 'internal';
     }
     if (!($auth = get_record('auth_instance', 'institution', $record['institution'], 'authname', $record['authname']))) {
         throw new SystemException("The authentication method authname" . $record['authname'] . " for institution '" . $record['institution'] . "' does not exist.");
     }
     $record['authinstance'] = $auth->id;
     // Don't exceed max user accounts for the institution
     $institution = new Institution($record['institution']);
     if ($institution->isFull()) {
         throw new SystemException("Can not add new users to the institution '" . $record['institution'] . "' as it is full.");
     }
     $record['firstname'] = sanitize_firstname($record['firstname']);
     $record['lastname'] = sanitize_lastname($record['lastname']);
     $record['email'] = sanitize_email($record['email']);
     $authobj = AuthFactory::create($auth->id);
     if (method_exists($authobj, 'is_username_valid_admin') && !$authobj->is_username_valid_admin($record['username'])) {
         throw new SystemException("New username'" . $record['username'] . "' is not valid.");
     }
     if (method_exists($authobj, 'is_username_valid') && !$authobj->is_username_valid($record['username'])) {
         throw new SystemException("New username'" . $record['username'] . "' is not valid.");
     }
     if (record_exists_select('usr', 'LOWER(username) = ?', array(strtolower($record['username'])))) {
         throw new ErrorException("The username'" . $record['username'] . "' has been taken.");
     }
     if (method_exists($authobj, 'is_password_valid') && !$authobj->is_password_valid($record['password'])) {
         throw new ErrorException("The password'" . $record['password'] . "' is not valid.");
     }
     if (record_exists('usr', 'email', $record['email']) || record_exists('artefact_internal_profile_email', 'email', $record['email'])) {
         throw new ErrorException("The email'" . $record['email'] . "' has been taken.");
     }
     // Create new user
     db_begin();
     raise_time_limit(180);
     $user = (object) array('authinstance' => $record['authinstance'], 'username' => $record['username'], 'firstname' => $record['firstname'], 'lastname' => $record['lastname'], 'email' => $record['email'], 'password' => $record['password'], 'passwordchange' => 0);
     if ($record['institution'] == 'mahara') {
         if ($record['role'] == 'admin') {
             $user->admin = 1;
         } else {
             if ($record['role'] == 'staff') {
                 $user->staff = 1;
             }
         }
     }
     $remoteauth = $record['authname'] != 'internal';
     if (!isset($record['remoteusername'])) {
         $record['remoteusername'] = null;
     }
     $user->id = create_user($user, array(), $record['institution'], $remoteauth, $record['remoteusername'], $record);
     if (isset($user->admin) && $user->admin) {
         require_once 'activity.php';
         activity_add_admin_defaults(array($user->id));
     }
     if ($record['institution'] != 'mahara') {
         if ($record['role'] == 'admin') {
             set_field('usr_institution', 'admin', 1, 'usr', $user->id, 'institution', $record['institution']);
         } else {
             if ($record['role'] == 'staff') {
                 set_field('usr_institution', 'staff', 1, 'usr', $user->id, 'institution', $record['institution']);
             }
         }
     }
     db_commit();
     $this->usercounter++;
     return $user->id;
 }

function adduser_validate(Pieform $form, $values)
{
    global $USER, $TRANSPORTER;
    $authobj = AuthFactory::create($values['authinstance']);
    $institution = $authobj->institution;
    // Institutional admins can only set their own institutions' authinstances
    if (!$USER->get('admin') && !$USER->is_institutional_admin($authobj->institution)) {
        $form->set_error('authinstance', get_string('notadminforinstitution', 'admin'));
        return;
    }
    $institution = new Institution($authobj->institution);
    // Don't exceed max user accounts for the institution
    if ($institution->isFull()) {
        $institution->send_admin_institution_is_full_message();
        $form->set_error('authinstance', get_string('institutionmaxusersexceeded', 'admin'));
        return;
    }
    $username = $values['username'];
    $firstname = sanitize_firstname($values['firstname']);
    $lastname = sanitize_lastname($values['lastname']);
    $email = sanitize_email($values['email']);
    $password = $values['password'];
    if ($USER->get('admin') || get_config_plugin('artefact', 'file', 'institutionaloverride')) {
        $maxquotaenabled = get_config_plugin('artefact', 'file', 'maxquotaenabled');
        $maxquota = get_config_plugin('artefact', 'file', 'maxquota');
        if ($maxquotaenabled && $values['quota'] > $maxquota) {
            $form->set_error('quota', get_string('maxquotaexceededform', 'artefact.file', display_size($maxquota)));
        }
    }
    if (method_exists($authobj, 'is_username_valid_admin')) {
        if (!$authobj->is_username_valid_admin($username)) {
            $form->set_error('username', get_string('usernameinvalidadminform', 'auth.internal'));
        }
    } else {
        if (method_exists($authobj, 'is_username_valid')) {
            if (!$authobj->is_username_valid($username)) {
                $form->set_error('username', get_string('usernameinvalidform', 'auth.internal'));
            }
        }
    }
    if (!$form->get_error('username') && record_exists_select('usr', 'LOWER(username) = ?', array(strtolower($username)))) {
        $form->set_error('username', get_string('usernamealreadytaken', 'auth.internal'));
    }
    if (method_exists($authobj, 'is_password_valid') && !$authobj->is_password_valid($password)) {
        $form->set_error('password', get_string('passwordinvalidform', 'auth.' . $authobj->type));
    }
    if (isset($_POST['createmethod']) && $_POST['createmethod'] == 'leap2a') {
        $form->set_error('firstname', null);
        $form->set_error('lastname', null);
        $form->set_error('email', null);
        if (!$values['leap2afile'] && ($_FILES['leap2afile']['error'] == UPLOAD_ERR_INI_SIZE || $_FILES['leap2afile']['error'] == UPLOAD_ERR_FORM_SIZE)) {
            $form->reply(PIEFORM_ERR, array('message' => get_string('uploadedfiletoobig'), 'goto' => '/admin/users/add.php'));
            $form->set_error('leap2afile', get_string('uploadedfiletoobig'));
            return;
        } else {
            if (!$values['leap2afile']) {
                $form->set_error('leap2afile', $form->i18n('rule', 'required', 'required'));
                return;
            }
        }
        if ($values['leap2afile']['type'] == 'application/octet-stream') {
            require_once 'file.php';
            $mimetype = file_mime_type($values['leap2afile']['tmp_name']);
        } else {
            $mimetype = trim($values['leap2afile']['type'], '"');
        }
        $date = time();
        $niceuser = preg_replace('/[^a-zA-Z0-9_-]/', '-', $values['username']);
        safe_require('import', 'leap');
        $fakeimportrecord = (object) array('data' => array('importfile' => $values['leap2afile']['tmp_name'], 'importfilename' => $values['leap2afile']['name'], 'importid' => $niceuser . '-' . $date, 'mimetype' => $mimetype));
        $TRANSPORTER = new LocalImporterTransport($fakeimportrecord);
        try {
            $TRANSPORTER->extract_file();
            PluginImportLeap::validate_transported_data($TRANSPORTER);
        } catch (Exception $e) {
            $form->set_error('leap2afile', $e->getMessage());
        }
    } else {
        if (!$form->get_error('firstname') && empty($firstname)) {
            $form->set_error('firstname', $form->i18n('rule', 'required', 'required'));
        }
        if (!$form->get_error('lastname') && empty($lastname)) {
            $form->set_error('lastname', $form->i18n('rule', 'required', 'required'));
        }
        if (!$form->get_error('email')) {
            if (!$form->get_error('email') && empty($email)) {
                $form->set_error('email', get_string('invalidemailaddress', 'artefact.internal'));
            }
            if (record_exists('usr', 'email', $email) || record_exists('artefact_internal_profile_email', 'email', $email)) {
                $form->set_error('email', get_string('emailalreadytaken', 'auth.internal'));
            }
        }
    }
}

 /**
  * Synchronize users and groups with the LDAP server
  */
 public static function auth_ldap_sync_cron()
 {
     $auths = get_records_array('auth_instance', 'authname', 'ldap', 'id', 'id');
     if (!$auths) {
         return;
     }
     foreach ($auths as $auth) {
         /* @var $authobj AuthLdap */
         $authobj = AuthFactory::create($auth->id);
         // Each instance will decide for itself whether it should sync users and/or groups
         // User sync needs to be called before group sync in order for new users to wind
         // up in the correct groups
         $authobj->sync_users();
         $authobj->sync_groups();
     }
 }

function forgotpasschange_submit(Pieform $form, $values)
{
    global $SESSION, $USER;
    unset($SESSION->forgotpasskey);
    try {
        $user = new User();
        $user->find_by_id($values['user']);
    } catch (AuthUnknownUserException $e) {
        throw new UserException('Request to change the password for a user who does not exist');
    }
    $authobj = AuthFactory::create($user->authinstance);
    if ($password = $authobj->change_password($user, $values['password1'])) {
        // Remove the password request(s) for the user
        delete_records('usr_password_request', 'usr', $values['user']);
        ensure_user_account_is_active($user);
        $USER->reanimate($user->id, $user->authinstance);
        // Destroy other sessions of the user
        remove_user_sessions($USER->get('id'));
        $SESSION->add_ok_msg(get_string('passwordchangedok'));
        redirect();
        exit;
    }
    throw new SystemException('User "' . $user->username . ' tried to change their password, but the attempt failed');
}

function auth_register_submit(Pieform $form, $values)
{
    global $SESSION;
    safe_require('auth', 'internal');
    $values['key'] = get_random_key();
    $values['lang'] = $SESSION->get('lang');
    // If the institution requires approval, mark the record as pending
    // @todo the expiry date should be configurable
    if ($confirm = get_config('requireregistrationconfirm') || get_field('institution', 'registerconfirm', 'name', $values['institution'])) {
        if (isset($values['authtype']) && $values['authtype'] != 'internal') {
            $authinstance = get_record('auth_instance', 'institution', $values['institution'], 'authname', $values['authtype'] ? $values['authtype'] : 'internal');
            $auth = AuthFactory::create($authinstance->id);
            $confirm = !$auth->weautocreateusers;
        }
        if ($confirm) {
            $values['pending'] = 1;
            $values['expiry'] = db_format_timestamp(time() + 86400 * 14);
            // now + 2 weeks
        } else {
            $values['pending'] = 0;
            $values['expiry'] = db_format_timestamp(time() + 86400);
        }
    } else {
        $values['pending'] = 0;
        $values['expiry'] = db_format_timestamp(time() + 86400);
    }
    if (function_exists('local_register_submit')) {
        local_register_submit($values);
    }
    try {
        if (!record_exists('usr_registration', 'email', $values['email'])) {
            insert_record('usr_registration', $values);
        } else {
            update_record('usr_registration', $values, array('email' => $values['email']));
        }
        $user = (object) $values;
        $user->admin = 0;
        $user->staff = 0;
        // If the institution requires approval, notify institutional admins.
        if ($confirm) {
            $fullname = sprintf("%s %s", trim($user->firstname), trim($user->lastname));
            $institution = new Institution($values['institution']);
            $pendingregistrationslink = sprintf("%sadmin/users/pendingregistrations.php?institution=%s", get_config('wwwroot'), $values['institution']);
            // list of admins for this institution
            if (count($institution->admins()) > 0) {
                $admins = $institution->admins();
            } else {
                // use site admins if the institution doesn't have any
                $admins = get_column('usr', 'id', 'admin', 1, 'deleted', 0);
            }
            require_once get_config('libroot') . 'pieforms/pieform/elements/expiry.php';
            $expirytime = pieform_element_expiry_get_expiry_from_seconds(get_config('defaultregistrationexpirylifetime'));
            if ($expirytime == null) {
                $expirystring = get_config('defaultregistrationexpirylifetime') . ' ' . get_string('seconds', 'performance');
            } else {
                if ($expirytime['units'] == 'noenddate') {
                    $expirystring = get_string('element.expiry.noenddate', 'pieforms');
                } else {
                    $expirystring = $expirytime['number'] . ' ' . get_string('element.expiry.' . $expirytime['units'], 'pieforms');
                }
            }
            // email each admin
            // @TODO Respect the notification preferences of the admins.
            foreach ($admins as $admin) {
                $adminuser = new User();
                $adminuser->find_by_id($admin);
                email_user($adminuser, null, get_string('pendingregistrationadminemailsubject', 'auth.internal', $institution->displayname, get_config('sitename')), get_string('pendingregist