/**
 * prepares the name of the user given the id.  also makes it an email link.
 * @param int $p_user_id
 * @return string
 */
function prepare_user_name($p_user_id)
{
    # Catch a user_id of NO_USER (like when a handler hasn't been assigned)
    if (NO_USER == $p_user_id) {
        return '';
    }
    $t_username = user_get_name($p_user_id);
    if (user_exists($p_user_id) && user_get_field($p_user_id, 'enabled')) {
        $t_username = string_display_line($t_username);
        // WK/BFE: Original-Zeile auskommentiert: , LB/BFE 2015
        //		return '<a href="' . string_sanitize_url( 'view_user_page.php?id=' . $p_user_id, true ) . '">' . $t_username . '</a>';
        // ersetzt durch: (Link auf view_user_page nur wenn globale Rolle mindestens $g_manage_user_threshold
        if (user_is_administrator(auth_get_current_user_id())) {
            return '<a href="' . string_sanitize_url('view_user_page.php?id=' . $p_user_id, true) . '">' . $t_username . '</a>';
        } else {
            return $t_username;
        }
        // WK/BFE: Ende der Modifikation
    } else {
        $t_result = '<font STYLE="text-decoration: line-through">';
        $t_result .= string_display_line($t_username);
        $t_result .= '</font>';
        return $t_result;
    }
}

function displayResultsCore($query, $fields)
{
    $result = db_query_bound($query);
    $nbRows = 0;
    while ($row = db_fetch_array($result)) {
        $nbRows++;
        $t_bug = bug_get($row['id']);
        print "<tr> \n";
        print '<td><a href="' . string_get_bug_view_url($row['id']) . '">' . bug_format_id($row['id']) . '</a></td>';
        //print "<td> ".string_get_bug_view_url( ))." </td>\n";
        print "<td> " . string_display_line(get_enum_element('status', $t_bug->status)) . " </td>\n";
        print "<td> " . category_get_row($t_bug->category_id)['name'] . " </td>\n";
        print "<td> " . $t_bug->summary . " </td>\n";
        print "<td> " . user_get_field($t_bug->reporter_id, 'username') . " </td>\n";
        if ($t_bug->handler_id != null) {
            print "<td> " . user_get_field($t_bug->handler_id, 'username') . " </td>\n";
        }
        if (sizeof($fields) > 0) {
            for ($i = 0; $i < sizeof($fields); $i++) {
                print "<td> " . $row[$fields[$i]] . " </td>\n";
            }
        }
        print "</tr>\n";
    }
    return $nbRows;
}

/**
 * Get username, realname and email from for a given user id
 * @param integer $p_user_id A valid user identifier.
 * @return array
 */
function mci_account_get_array_by_id($p_user_id)
{
    $t_result = array();
    $t_result['id'] = $p_user_id;
    if (user_exists($p_user_id)) {
        $t_current_user_id = auth_get_current_user_id();
        $t_access_level = user_get_field($t_current_user_id, 'access_level');
        $t_can_manage = access_has_global_level(config_get('manage_user_threshold')) && access_has_global_level($t_access_level);
        # this deviates from the behaviour of view_user_page.php, but it is more intuitive
        $t_is_same_user = $t_current_user_id === $p_user_id;
        $t_can_see_realname = access_has_project_level(config_get('show_user_realname_threshold'));
        $t_can_see_email = access_has_project_level(config_get('show_user_email_threshold'));
        $t_result['name'] = user_get_field($p_user_id, 'username');
        if ($t_is_same_user || $t_can_manage || $t_can_see_realname) {
            $t_realname = user_get_realname($p_user_id);
            if (!empty($t_realname)) {
                $t_result['real_name'] = $t_realname;
            }
        }
        if ($t_is_same_user || $t_can_manage || $t_can_see_email) {
            $t_email = user_get_email($p_user_id);
            if (!empty($t_email)) {
                $t_result['email'] = $t_email;
            }
        }
    }
    return $t_result;
}

/**
 * Calculates a key to be used for RSS authentication based on user name, cookie and password.
 * if the user changes his user name or password, then the key becomes invalid.
 * @param int $p_user_id
 * @return string
 */
function rss_calculate_key($p_user_id = null)
{
    if ($p_user_id === null) {
        $t_user_id = auth_get_current_user_id();
    } else {
        $t_user_id = $p_user_id;
    }
    $t_seed = config_get_global('rss_key_seed');
    $t_username = user_get_field($t_user_id, 'username');
    $t_password = user_get_field($t_user_id, 'password');
    $t_cookie = user_get_field($t_user_id, 'cookie_string');
    return md5($t_seed . $t_username . $t_cookie . $t_password);
}

function email_group_reminder($p_user_id, $issues)
{
    $t_username = user_get_field($p_user_id, 'username');
    $t_email = user_get_email($p_user_id);
    $t_message = $issues;
    $t_subject = config_get('plugin_Reminder_reminder_subject');
    if (!is_blank($t_email)) {
        email_store($t_email, $t_subject, $t_message);
        if (OFF == config_get('email_send_using_cronjob')) {
            email_send_all();
        }
    }
}

/**
 * prepares the name of the user given the id.  also makes it an email link.
 * @param int $p_user_id
 * @return string
 */
function prepare_user_name( $p_user_id ) {
	# Catch a user_id of NO_USER (like when a handler hasn't been assigned)
	if( NO_USER == $p_user_id ) {
		return '';
	}

	$t_username = user_get_name( $p_user_id );
	$t_username = string_display_line( $t_username );
	if( user_exists( $p_user_id ) && user_get_field( $p_user_id, 'enabled' ) ) {
		return '<a class="user" href="' . string_sanitize_url( 'view_user_page.php?id=' . $p_user_id, true ) . '">' . $t_username . '</a>';
	} else {
		return '<del class="user">' . $t_username . '</del>';
	}
}

/**
 * Calculates a key to be used for RSS authentication based on user name,
 * cookie and password. If the user changes their user name or password, this
 * RSS authentication key will become invalidated.
 * @param integer $p_user_id User ID for the user which the key is being calculated for.
 * @return string RSS authentication key (384bit) encoded according to the base64 with URI safe alphabet approach described in RFC4648.
 */
function rss_calculate_key($p_user_id = null)
{
    if ($p_user_id === null) {
        $t_user_id = auth_get_current_user_id();
    } else {
        $t_user_id = $p_user_id;
    }
    $t_username = user_get_field($t_user_id, 'username');
    $t_password = user_get_field($t_user_id, 'password');
    $t_cookie = user_get_field($t_user_id, 'cookie_string');
    $t_key_raw = hash('whirlpool', 'rss_key' . config_get_global('crypto_master_salt') . $t_username . $t_password . $t_cookie, true);
    # Note: We truncate the last 8 bits from the hash output so that base64
    # encoding can be performed without any trailing padding.
    $t_key_base64_encoded = base64_encode(substr($t_key_raw, 0, 63));
    $t_key = strtr($t_key_base64_encoded, '+/', '-_');
    return $t_key;
}

/**
 * prepares the name of the user given the id.  also makes it an email link.
 * @param int $p_user_id
 * @return string
 */
function prepare_user_name($p_user_id)
{
    # Catch a user_id of NO_USER (like when a handler hasn't been assigned)
    if (NO_USER == $p_user_id) {
        return '';
    }
    $t_username = user_get_name($p_user_id);
    if (user_exists($p_user_id) && user_get_field($p_user_id, 'enabled')) {
        $t_username = string_display_line($t_username);
        return '<a href="' . string_sanitize_url('view_user_page.php?id=' . $p_user_id, true) . '">' . $t_username . '</a>';
    } else {
        $t_result = '<font STYLE="text-decoration: line-through">';
        $t_result .= string_display_line($t_username);
        $t_result .= '</font>';
        return $t_result;
    }
}

/**
 * Get username, realname and email from for a given user id
 * @param integer $p_user_id A valid user identifier.
 * @return array
 */
function mci_account_get_array_by_id($p_user_id)
{
    $t_result = array();
    $t_result['id'] = $p_user_id;
    if (user_exists($p_user_id)) {
        $t_result['name'] = user_get_field($p_user_id, 'username');
        $t_dummy = user_get_field($p_user_id, 'realname');
        if (!empty($t_dummy)) {
            $t_result['real_name'] = $t_dummy;
        }
        $t_dummy = user_get_field($p_user_id, 'email');
        if (!empty($t_dummy)) {
            $t_result['email'] = $t_dummy;
        }
    }
    return $t_result;
}

function addExtraBugData($bug)
{
    $bug["project_name"] = project_get_name($bug["project_id"]);
    if ($bug["reporter_id"] != "") {
        $bug["reporter_name"] = user_get_field($bug["reporter_id"], 'username');
    }
    $bug["severity_name"] = get_enum_element('severity', $bug["severity"]);
    $bug["priority_name"] = get_enum_element('priority', $bug["priority"]);
    $bug["status_name"] = get_enum_element('status', $bug["status"]);
    $bug["reproducibility_name"] = get_enum_element('reproducibility', $bug["reproducibility"]);
    if ($bug["handler_id"] == "") {
        $bug["handler_name"] = user_get_field($bug["handler_id"], 'username');
    }
    $bug["projection_name"] = get_enum_element('projection', $bug["projection"]);
    $bug["eta_name"] = get_enum_element('eta', $bug["eta"]);
    $bug["resolution_name"] = get_enum_element('resolution', $bug["resolution"]);
    $bug["description"] = bug_get_text_field($bug["id"], 'description');
    return $bug;
}

function prepare_user_name($p_user_id)
{
    # Catch a user_id of NO_USER (like when a handler hasn't been assigned)
    if (NO_USER == $p_user_id) {
        return '';
    }
    $t_username = user_get_name($p_user_id);
    if (user_exists($p_user_id) && user_get_field($p_user_id, 'enabled')) {
        $t_email = user_get_email($p_user_id);
        if (!is_blank($t_email)) {
            return prepare_email_link($t_email, $t_username);
        } else {
            return string_display($t_username);
        }
    } else {
        $t_result = '<font STYLE="text-decoration: line-through">';
        $t_result .= string_display($t_username);
        $t_result .= '</font>';
        return $t_result;
    }
}

/**
 * Reset the user's password
 *  Take into account the 'send_reset_password' setting
 *   - if it is ON, generate a random password and send an email
 *      (unless the second parameter is false)
 *   - if it is OFF, set the password to blank
 *  Return false if the user is protected, true if the password was
 *   successfully reset
 *
 * @param integer $p_user_id    A valid user identifier.
 * @param boolean $p_send_email Whether to send confirmation email.
 * @return boolean
 */
function user_reset_password($p_user_id, $p_send_email = true)
{
    $t_protected = user_get_field($p_user_id, 'protected');
    # Go with random password and email it to the user
    if (ON == $t_protected) {
        return false;
    }
    # @@@ do we want to force blank password instead of random if
    #      email notifications are turned off?
    #     How would we indicate that we had done this with a return value?
    #     Should we just have two functions? (user_reset_password_random()
    #     and user_reset_password() )?
    if (ON == config_get('send_reset_password') && ON == config_get('enable_email_notification')) {
        $t_email = user_get_field($p_user_id, 'email');
        if (is_blank($t_email)) {
            trigger_error(ERROR_LOST_PASSWORD_NO_EMAIL_SPECIFIED, ERROR);
        }
        # Create random password
        $t_password = auth_generate_random_password();
        $t_password2 = auth_process_plain_password($t_password);
        user_set_field($p_user_id, 'password', $t_password2);
        # Send notification email
        if ($p_send_email) {
            $t_confirm_hash = auth_generate_confirm_hash($p_user_id);
            email_send_confirm_hash_url($p_user_id, $t_confirm_hash);
        }
    } else {
        # use blank password, no emailing
        $t_password = auth_process_plain_password('');
        user_set_field($p_user_id, 'password', $t_password);
        # reset the failed login count because in this mode there is no emailing
        user_reset_failed_login_count_to_zero($p_user_id);
    }
    return true;
}

/**
 * Returns the specified field of the currently logged in user
 *
 * @param field_name  Name of user property as in the table definition.
 * @return Get the value of the specified field for current user.
 * @access public
 */
function current_user_get_field($p_field_name)
{
    return user_get_field(auth_get_current_user_id(), $p_field_name);
}

	return;
}

$t_anonymous_user_id = user_get_id_by_name( $t_anonymous_account );
check_print_test_row(
	'anonymous_account is a valid user account',
	$t_anonymous_user_id !== false,
	array( false => 'You need to specify a valid user account to use with the anonymous_account configuration options.' )
);

check_print_test_row(
	'anonymous_account user has the enabled flag set',
	user_is_enabled( $t_anonymous_user_id ),
	array( false => 'The anonymous user account must be enabled before it can be used.' )
);

check_print_test_row(
	'anonymous_account user has the protected flag set',
	user_get_field( $t_anonymous_user_id, 'protected' ),
	array( false => 'The anonymous user account needs to have the protected flag set to prevent anonymous users modifying the account.' )
);

check_print_test_row(
	'anonymous_account user does not have administrator permissions',
	!user_is_administrator( $t_anonymous_user_id ),
	array(
		true => 'The anonymous user account currently has an access level of: ' . htmlentities( get_enum_element( 'access_levels', user_get_access_level( $t_anonymous_user_id ) ) ),
		false => 'The anonymous user account should not have administrator level permissions.'
	)
);

    $t_bug = $t_issues[$i];
    $about = $link = $t_path . "view.php?id=" . $t_bug->id;
    $title = bug_format_id($t_bug->id) . ': ' . $t_bug->summary;
    if ($t_bug->view_state == VS_PRIVATE) {
        $title .= ' [' . lang_get('private') . ']';
    }
    $description = string_rss_links($t_bug->description);
    # subject is category.
    $subject = category_full_name($t_bug->category_id, false);
    # optional DC value
    $date = $t_bug->last_updated;
    # author of item
    $author = '';
    if (access_has_global_level(config_get('show_user_email_threshold'))) {
        $t_author_name = user_get_name($t_bug->reporter_id);
        $t_author_email = user_get_field($t_bug->reporter_id, 'email');
        if (!is_blank($t_author_email)) {
            if (!is_blank($t_author_name)) {
                $author = $t_author_name . ' <' . $t_author_email . '>';
            } else {
                $author = $t_author_email;
            }
        }
    }
    # $comments = 'http://www.example.com/sometext.php?somevariable=somevalue&comments=1';	# url to comment page rss 2.0 value
    $comments = $t_path . 'view.php?id=' . $t_bug->id . '#bugnotes';
    # optional mod_im value for dispaying a different pic for every item
    $image = '';
    $rssfile->addRSSItem($about, $title, $link, $description, $subject, $date, $author, $comments, $image);
}
/** @todo consider making this a configuration option - 0.91 / 1.0 / 2.0 */

user_ensure_name_valid($f_username);
user_ensure_realname_valid($f_realname);
user_ensure_realname_unique($f_username, $f_realname);
$f_email = email_append_domain($f_email);
email_ensure_valid($f_email);
$c_email = db_prepare_string($f_email);
$c_username = db_prepare_string($f_username);
$c_realname = db_prepare_string($f_realname);
$c_protected = db_prepare_bool($f_protected);
$c_enabled = db_prepare_bool($f_enabled);
$c_user_id = db_prepare_int($f_user_id);
$c_access_level = db_prepare_int($f_access_level);
$t_user_table = config_get('mantis_user_table');
$t_old_protected = user_get_field($f_user_id, 'protected');
# check that we are not downgrading the last administrator
$t_old_access = user_get_field($f_user_id, 'access_level');
if (ADMINISTRATOR == $t_old_access && $t_old_access != $f_access_level && 1 >= user_count_level(ADMINISTRATOR)) {
    trigger_error(ERROR_USER_CHANGE_LAST_ADMIN, ERROR);
}
# Project specific access rights override global levels, hence, for users who are changed
# to be administrators, we have to remove project specific rights.
if ($c_access_level >= ADMINISTRATOR && !user_is_administrator($c_user_id)) {
    user_delete_project_specific_access_levels($c_user_id);
}
# if the user is already protected and the admin is not removing the
#  protected flag then don't update the access level and enabled flag.
#  If the user was unprotected or the protected flag is being turned off
#  then proceed with a full update.
if ($f_protected && $t_old_protected) {
    $query = "UPDATE {$t_user_table}\n\t    \t\tSET username='{$c_username}', email='{$c_email}',\n\t    \t\t\tprotected='{$c_protected}', realname='{$c_realname}'\n\t    \t\tWHERE id='{$c_user_id}'";
} else {

/**
 * Print the reporter field
 * @return void
 */
function print_filter_reporter_id()
{
    global $g_select_modifier, $g_filter;
    ?>
		<select<?php 
    echo $g_select_modifier;
    ?>
 name="<?php 
    echo FILTER_PROPERTY_REPORTER_ID;
    ?>
[]">
		<?php 
    # if current user is a reporter, and limited reports set to ON, only display that name
    # @@@ thraxisp - access_has_project_level checks greater than or equal to,
    #   this assumed that there aren't any holes above REPORTER where the limit would apply
    #
    if (ON === config_get('limit_reporters') && !access_has_project_level(config_get('report_bug_threshold') + 1)) {
        $t_id = auth_get_current_user_id();
        $t_username = user_get_field($t_id, 'username');
        $t_realname = user_get_field($t_id, 'realname');
        $t_display_name = string_attribute($t_username);
        if (isset($t_realname) && $t_realname > '' && ON == config_get('show_realname')) {
            $t_display_name = string_attribute($t_realname);
        }
        echo '<option value="' . $t_id . '" selected="selected">' . $t_display_name . '</option>';
    } else {
        ?>
		<option value="<?php 
        echo META_FILTER_ANY;
        ?>
"<?php 
        check_selected($g_filter[FILTER_PROPERTY_REPORTER_ID], META_FILTER_ANY);
        ?>
>[<?php 
        echo lang_get('any');
        ?>
]</option>
		<?php 
        if (access_has_project_level(config_get('report_bug_threshold'))) {
            echo '<option value="' . META_FILTER_MYSELF . '" ';
            check_selected($g_filter[FILTER_PROPERTY_REPORTER_ID], META_FILTER_MYSELF);
            echo '>[' . lang_get('myself') . ']</option>';
        }
        print_reporter_option_list($g_filter[FILTER_PROPERTY_REPORTER_ID]);
    }
    ?>
		</select>
		<?php 
}

function ldap_authenticate($p_user_id, $p_password)
{
    # if password is empty and ldap allows anonymous login, then
    # the user will be able to login, hence, we need to check
    # for this special case.
    if (is_blank($p_password)) {
        return false;
    }
    $t_ldap_organization = config_get('ldap_organization');
    $t_ldap_root_dn = config_get('ldap_root_dn');
    $t_username = user_get_field($p_user_id, 'username');
    $t_ldap_uid_field = config_get('ldap_uid_field', 'uid');
    $t_search_filter = "(&{$t_ldap_organization}({$t_ldap_uid_field}={$t_username}))";
    $t_search_attrs = array($t_ldap_uid_field, 'dn');
    $t_ds = ldap_connect_bind();
    # Search for the user id
    $t_sr = ldap_search($t_ds, $t_ldap_root_dn, $t_search_filter, $t_search_attrs);
    $t_info = ldap_get_entries($t_ds, $t_sr);
    $t_authenticated = false;
    if ($t_info) {
        # Try to authenticate to each until we get a match
        for ($i = 0; $i < $t_info['count']; $i++) {
            $t_dn = $t_info[$i]['dn'];
            # Attempt to bind with the DN and password
            if (@ldap_bind($t_ds, $t_dn, $p_password)) {
                $t_authenticated = true;
                break;
                # Don't need to go any further
            }
        }
    }
    ldap_free_result($t_sr);
    ldap_unbind($t_ds);
    return $t_authenticated;
}

 * @link http://www.mantisbt.org
 *
 * @uses check_api.php
 * @uses config_api.php
 * @uses user_api.php
 */
if (!defined('CHECK_ANONYMOUS_INC_ALLOW')) {
    return;
}
/**
 * MantisBT Check API
 */
require_once 'check_api.php';
require_api('config_api.php');
require_api('user_api.php');
check_print_section_header_row('Anonymous access');
$t_anonymous_access_enabled = config_get_global('allow_anonymous_login');
check_print_info_row('Anonymous access is enabled', $t_anonymous_access_enabled ? 'Yes' : 'No');
if (!$t_anonymous_access_enabled) {
    return;
}
$t_anonymous_account = config_get_global('anonymous_account');
check_print_test_row('anonymous_account configuration option is specified', $t_anonymous_account !== '', array(true => 'The account currently being used for anonymous access is: ' . htmlentities($t_anonymous_account), false => 'The anonymous_account configuration option must specify the username of an account to use for anonymous logins.'));
if ($t_anonymous_account === '') {
    return;
}
$t_anonymous_user_id = user_get_id_by_name($t_anonymous_account);
check_print_test_row('anonymous_account is a valid user account', $t_anonymous_user_id !== false, array(false => 'You need to specify a valid user account to use with the anonymous_account configuration options.'));
check_print_test_row('anonymous_account user has the enabled flag set', user_is_enabled($t_anonymous_user_id), array(false => 'The anonymous user account must be enabled before it can be used.'));
check_print_test_row('anonymous_account user has the protected flag set', user_get_field($t_anonymous_user_id, 'protected'), array(false => 'The anonymous user account needs to have the protected flag set to prevent anonymous users modifying the account.'));
check_print_test_row('anonymous_account user does not have administrator permissions', !user_is_administrator($t_anonymous_user_id), array(true => 'The anonymous user account currently has an access level of: ' . htmlentities(get_enum_element('access_levels', user_get_access_level($t_anonymous_user_id))), false => 'The anonymous user account should not have administrator level permissions.'));

/**
 * Check for authentication tokens, and display re-authentication page if needed.
 * Currently, if using BASIC or HTTP authentication methods, or if logged in anonymously,
 * this function will always "authenticate" the user (do nothing).
 *
 * @return bool
 * @access public
 */
function auth_reauthenticate()
{
    if (config_get_global('reauthentication') == OFF || BASIC_AUTH == config_get('login_method') || HTTP_AUTH == config_get('login_method')) {
        return true;
    }
    $t_auth_token = token_get(TOKEN_AUTHENTICATED);
    if (null != $t_auth_token) {
        token_touch($t_auth_token['id'], config_get_global('reauthentication_expiry'));
        return true;
    } else {
        $t_anon_account = config_get('anonymous_account');
        $t_anon_allowed = config_get('allow_anonymous_login');
        $t_user_id = auth_get_current_user_id();
        $t_username = user_get_field($t_user_id, 'username');
        # check for anonymous login
        if (ON == $t_anon_allowed && $t_anon_account == $t_username) {
            return true;
        }
        return auth_reauthenticate_page($t_user_id, $t_username);
    }
}