Index: branches/1.1dev/lib/AuthSQL.inc.php
===================================================================
--- branches/1.1dev/lib/AuthSQL.inc.php	(revision 569)
+++ branches/1.1dev/lib/AuthSQL.inc.php	(revision 570)
@@ -23,20 +23,20 @@
     {
         global $CFG;
-        
+
         // The name of this auth session.
         $this->_params['auth_name'] = isset($params['auth_name']) ? $params['auth_name'] : '';
-        
+
         // The database table containing users to authenticate.
         $this->_params['user_tbl'] = isset($params['user_tbl']) ? $params['user_tbl'] : 'user_tbl';
-        
+
         // The name of the primary key for the user_tbl.
         $this->_params['user_id_column'] = isset($params['user_id_column']) ? $params['user_id_column'] : 'user_id';
-        
+
         // The name of the username key for the user_tbl.
         $this->_params['username_column'] = isset($params['username_column']) ? $params['username_column'] : 'username';
-        
+
         // If using the login_tbl feature, specify the login_tbl. The primary key must match the primary key for the user_tbl.
         $this->_params['login_tbl'] = isset($params['login_tbl']) ? $params['login_tbl'] : 'login_tbl';
-        
+
         // The type of encryption to use for passwords stored in the user_tbl. Use 'md5' or 'crypt'.
         $this->_params['encryption_type'] = isset($params['encryption_type']) ? $params['encryption_type'] : 'md5';
@@ -48,5 +48,5 @@
         // This applies to admins and users. In seconds. 21600 seconds = 6 hours.
         $this->_params['login_timeout'] = isset($params['login_timeout']) ? $params['login_timeout'] : $CFG->login_timeout;
-        
+
         // The maximum amount of time a user is allowed to be idle before their session expires. They will be forced to login again if they expire.
         // This applies to admins and users. In seconds. 3600 seconds = 1 hour.
@@ -56,7 +56,4 @@
         // Days and hours, like this: 'DD:HH'
         $this->_params['login_abuse_timeframe'] = isset($params['login_abuse_timeframe']) ? $params['login_abuse_timeframe'] : $CFG->login_abuse_timeframe;
-
-        // When an account is accessed from this many different IPs, the user's password is reset and they are issued a warning.
-        $this->_params['login_abuse_warning_ips'] = isset($params['login_abuse_warning_ips']) ? $params['login_abuse_warning_ips'] : $CFG->login_abuse_warning_ips;
 
         // The number of warnings a user will receive (and their password reset each time) before their account is completely blocked.
@@ -71,16 +68,16 @@
         $this->_params['login_abuse_ip_bitmask'] = isset($params['login_abuse_ip_bitmask']) ? $params['login_abuse_ip_bitmask'] : $CFG->login_abuse_ip_bitmask;
 
-        // Specify usernames to exclude from the account abuse detection system. This is specified as a hardcoded array provided at 
+        // Specify usernames to exclude from the account abuse detection system. This is specified as a hardcoded array provided at
         // class instantiation time, or can be saved in the user_tbl under the login_abuse_exempt field.
         $this->_params['login_abuse_exempt_usernames'] = isset($params['login_abuse_exempt_usernames']) && is_array($params['login_abuse_exempt_usernames']) ? $params['login_abuse_exempt_usernames'] : $CFG->login_abuse_exempt_usernames;
-        
+
         $this->_params['trusted_networks'] = isset($params['trusted_networks']) && is_array($params['trusted_networks']) ? $params['trusted_networks'] : $CFG->trusted_networks;
 
         // Feature: Allow user accounts to be blocked? Requires the user table to have the columns 'blocked' and 'blocked_reason'
         $this->_params['features']['blocking'] = isset($params['features']['blocking']) ? $params['features']['blocking'] : false;
-        
+
         // Feature: Use a login_tbl to detect excessive logins. This requires blocking to be enabled.
         $this->_params['features']['abuse_detection'] = isset($params['features']['abuse_detection']) ? $params['features']['abuse_detection'] : false;
-        
+
         // Array of usernames which are exempt from remote_ip matching. Users behind proxy servers should be appended to this array so their shifting remote IP will not log them out.
         $this->_params['match_remote_ip_exempt_usernames'] = isset($params['match_remote_ip_exempt_usernames']) && is_array($params['match_remote_ip_exempt_usernames']) ? $params['match_remote_ip_exempt_usernames'] : $CFG->match_remote_ip_exempt_usernames;
@@ -88,5 +85,5 @@
         // Feature: Match the user's current remote IP against the one they logged in with.
         $this->_params['features']['match_remote_ip'] = isset($params['features']['match_remote_ip']) ? $params['features']['match_remote_ip'] : true;
-        
+
         $this->_auth_name = '_auth_' . $this->_params['auth_name'];
     }
@@ -100,5 +97,5 @@
     {
         dbQuery("
-            UPDATE " . $this->_params['user_tbl'] . " SET 
+            UPDATE " . $this->_params['user_tbl'] . " SET
             seconds_online = seconds_online + (UNIX_TIMESTAMP() - UNIX_TIMESTAMP(last_access_datetime)),
             last_login_datetime = '0000-00-00 00:00:00'
@@ -145,5 +142,5 @@
         }
     }
-    
+
     /**
      * Set the features of an auth object.
@@ -186,13 +183,13 @@
      */
     function authenticate($username, $password)
-    {        
+    {
         // Query DB for user matching credentials.
         $qid = dbQuery("
-            SELECT *, " . $this->_params['user_id_column'] . " AS user_id 
+            SELECT *, " . $this->_params['user_id_column'] . " AS user_id
             FROM " . $this->_params['user_tbl'] . "
             WHERE BINARY username = '" . mysql_real_escape_string($username) . "'
             AND BINARY userpass = '" . mysql_real_escape_string($this->encryptPassword($password)) . "'
         ");
-        
+
         // Return user data if found.
         if ($user_data = mysql_fetch_assoc($qid)) {
@@ -237,5 +234,5 @@
             'user_data'             => $user_data
         );
-        
+
         /**
          * Check if the account is blocked, respond in context to reason. Cancel the login if blocked.
@@ -243,7 +240,7 @@
         if ($this->getFeature('blocking')) {
             if (!empty($user_data['blocked'])) {
-                
+
                 logMsg(sprintf('Login failed, blocked account. User: %s (%s) Reason: %s', $user_data['user_id'], $username, $user_data['blocked_reason']), LOG_NOTICE, __FILE__, __LINE__);
-                
+
                 switch ($user_data['blocked_reason']) {
                     case 'account abuse' :
@@ -254,5 +251,5 @@
                         break;
                 }
-                
+
                 // No login: user is blocked!
                 $this->clearAuth();
@@ -260,5 +257,5 @@
             }
         }
-        
+
         /**
          * Check the login_tbl for too many logins under this account.
@@ -298,6 +295,6 @@
             dbQuery("
                 INSERT INTO " . $this->_params['login_tbl'] . " (
-                    " . $this->_params['user_id_column'] . ", 
-                    login_datetime, 
+                    " . $this->_params['user_id_column'] . ",
+                    login_datetime,
                     remote_ip_binary
                 ) VALUES (
@@ -308,5 +305,5 @@
             ");
         }
-        
+
         // Update user table with this login.
         dbQuery("
@@ -317,5 +314,5 @@
             WHERE " . $this->_params['user_id_column'] . " = '" . $this->getVal('user_id') . "'
         ");
-        
+
         // We're logged-in!
         return true;
@@ -344,18 +341,18 @@
             return (mysql_num_rows($qid) > 0);
         }
-        
+
         // User login test need only be run once per script execution. We cache the result in the session.
         if ($this->_authentication_tested && isset($_SESSION[$this->_auth_name]['authenticated'])) {
             return $_SESSION[$this->_auth_name]['authenticated'];
         }
-        
+
         // Tesing login should occur once. This is the first time. Set flag.
         $this->_authentication_tested = true;
-        
+
         // Some users will access from networks with changing IP number (i.e. behind a proxy server). These users must be allowed entry be adding their IP to the list of trusted_networks.
         if ($trusted_net = ipInRange(getRemoteAddr(), $this->_params['trusted_networks'])) {
         	$user_in_trusted_network = true;
-        	logMsg(sprintf('%s%s accessing from trusted network %s', 
-        	    ucfirst($this->_params['auth_name']), 
+        	logMsg(sprintf('%s%s accessing from trusted network %s',
+        	    ucfirst($this->_params['auth_name']),
         	    ($this->getVal('user_id') ? ' ' . $this->getVal('user_id') . ' (' .  $this->getVal('username') . ')' : ''),
         	    $trusted_net
@@ -363,6 +360,6 @@
         } else if (preg_match('/proxy.aol.com$/i', getRemoteAddr(true))) {
         	$user_in_trusted_network = true;
-        	logMsg(sprintf('%s%s accessing from trusted network proxy.aol.com', 
-                ucfirst($this->_params['auth_name']), 
+        	logMsg(sprintf('%s%s accessing from trusted network proxy.aol.com',
+                ucfirst($this->_params['auth_name']),
                 ($this->getVal('user_id') ? ' ' . $this->getVal('user_id') . ' (' .  $this->getVal('username') . ')' : '')
             ), LOG_NOTICE, __FILE__, __LINE__);
@@ -370,16 +367,16 @@
         	$user_in_trusted_network = false;
         }
-        
+
         // Do we match the user's remote IP at all? Yes, if set in config and not disabled for specific user.
         if ($this->getFeature('match_remote_ip') && !$this->getVal('match_remote_ip_exempt')) {
             $remote_ip_is_matched = ($_SESSION[$this->_auth_name]['remote_ip'] == getRemoteAddr() || $user_in_trusted_network);
         } else {
-            logMsg(sprintf('%s%s exempt from remote_ip match.', 
-                ucfirst($this->_params['auth_name']), 
+            logMsg(sprintf('%s%s exempt from remote_ip match.',
+                ucfirst($this->_params['auth_name']),
                 ($this->getVal('user_id') ? ' ' . $this->getVal('user_id') . ' (' .  $this->getVal('username') . ')' : '')
             ), LOG_DEBUG, __FILE__, __LINE__);
             $remote_ip_is_matched = true;
         }
-        
+
         // Test login with information stored in session. Skip IP matching for users from trusted networks.
         if (true === $_SESSION[$this->_auth_name]['authenticated']
@@ -394,5 +391,5 @@
             // Update the DB with the last_access_datetime and increment the seconds_online.
             dbQuery("
-                UPDATE " . $this->_params['user_tbl'] . " SET 
+                UPDATE " . $this->_params['user_tbl'] . " SET
                 seconds_online = seconds_online + (UNIX_TIMESTAMP() - UNIX_TIMESTAMP(last_access_datetime)) + 1,
                 last_access_datetime = '" . $this->getVal('last_access_datetime') . "'
@@ -408,5 +405,5 @@
             // User is authenticated, but login has expired.
             raiseMsg(sprintf(_("Your %s session has closed. You need to log-in again."), strtolower($this->_params['auth_name'])), MSG_NOTICE, __FILE__, __LINE__);
-            
+
             // Log the reason for login expiration.
             $expire_reasons = array();
@@ -460,5 +457,5 @@
      * This sets the 'blocked' field for a user in the user_tbl, and also
      * adds an optional reason
-     * 
+     *
      * @param  string   $reason      The reason for blocking the account.
      */
@@ -470,5 +467,5 @@
             	logMsg(sprintf('Blocked reason provided is greater than 255 characters: %s', $reason), LOG_WARNING, __FILE__, __LINE__);
             }
-            
+
             // Get user_id if specified.
             $user_id = isset($user_id) ? $user_id : $this->getVal('user_id');
@@ -483,5 +480,5 @@
 
     /**
-     * Unblocks a user in the user_tbl, and clears any blocked_reason. 
+     * Unblocks a user in the user_tbl, and clears any blocked_reason.
      */
     function unblockAccount($user_id=null)
@@ -507,5 +504,5 @@
      */
     function usernameExists($username)
-    {	
+    {
         $qid = dbQuery("SELECT 1 FROM " . $this->_params['user_tbl'] . " WHERE username = '" . mysql_real_escape_string($username) . "'");
         return (mysql_num_rows($qid) > 0);
@@ -520,5 +517,5 @@
      */
     function getUsername($user_id)
-    {	
+    {
         $qid = dbQuery("SELECT " . $this->_params['username_column'] . " FROM " . $this->_params['user_tbl'] . " WHERE " . $this->_params['user_id_column'] . " = '" . mysql_real_escape_string($user_id) . "'");
         if (list($username) = mysql_fetch_row($qid)) {
@@ -560,5 +557,5 @@
         return $str;
     }
-    
+
     /**
      *
@@ -570,9 +567,9 @@
             return $password;
             break;
-            
+
         case 'crypt' :
             return crypt($password, crypt($password));
             break;
-            
+
         case 'sha1' :
             if (function_exists('sha1')) { // Only in PHP 4.3.0+
@@ -580,5 +577,5 @@
                 break;
             }
-            
+
         case 'md5' :
         default :
@@ -589,14 +586,14 @@
 
     /**
-     * 
+     *
      */
     function setPassword($user_id=null, $password)
-    {        
+    {
         // Get user_id if specified.
         $user_id = isset($user_id) ? $user_id : $this->getVal('user_id');
-        
+
         // Issue the password change query.
         dbQuery("
-            UPDATE " . $this->_params['user_tbl'] . " 
+            UPDATE " . $this->_params['user_tbl'] . "
             SET userpass = '" . mysql_real_escape_string($this->encryptPassword($password)) . "'
             WHERE " . $this->_params['user_id_column'] . " = '" . mysql_real_escape_string($user_id) . "'
@@ -615,8 +612,8 @@
     {
         global $CFG;
-        
+
         // Get user_id if specified.
         $user_id = isset($user_id) ? $user_id : $this->getVal('user_id');
-        
+
         // Reset password of a specific user.
         $qid = dbQuery("
@@ -628,8 +625,8 @@
         // Get new password.
         $password = $this->generatePassword();
-        
+
         // Issue the password change query.
         dbQuery("
-            UPDATE " . $this->_params['user_tbl'] . " 
+            UPDATE " . $this->_params['user_tbl'] . "
             SET userpass = '" . mysql_real_escape_string($this->encryptPassword($password)) . "'
             WHERE " . $this->_params['user_id_column'] . " = '" . mysql_real_escape_string($user_id) . "'
@@ -641,11 +638,11 @@
             mail($user_data['email'], $email_subject, $email_body, "From: $CFG->site_name <$CFG->site_email>\r\n", $CFG->envelope_sender_address);
         }
-    
+
         return array('username'=>$user_data['username'], 'userpass'=>$password);
     }
-    
+
     /**
      * If the current user has access to the specified $security_zone, return true.
-     * If the optional $priv is supplied, test that against the zone. 
+     * If the optional $priv is supplied, test that against the zone.
      *
      * @param  constant $security_zone   string of comma delimited priviliges for the zone
@@ -658,6 +655,6 @@
         $zone_members = preg_split('/,\s*/', $security_zone);
         $priv = empty($priv) ? $this->getVal('priv') : $priv;
-        
-        // If the current user's privilege level is NOT in that array or if the 
+
+        // If the current user's privilege level is NOT in that array or if the
         // user has no privilege, return false. Otherwise the user is clear.
         if (!in_array($priv, $zone_members) || empty($priv)) {
@@ -667,8 +664,8 @@
         }
     }
-    
+
     /**
      * This function tests a list of arguments $security_zone against the priv that the current user has.
-     * If the user doesn't have one of the supplied privs, die. 
+     * If the user doesn't have one of the supplied privs, die.
      *
      * @param  constant $security_zone   string of comma delimited priviliges for the zone
@@ -677,6 +674,6 @@
     {
         $zone_members = preg_split('/,\s*/', $security_zone);
-    
-        /* If the current user's privilege level is NOT in that array or if the 
+
+        /* If the current user's privilege level is NOT in that array or if the
          * user has no privilege, DIE with a message. */
         if (!in_array($this->getVal('priv'), $zone_members) || !$this->getVal('priv')) {
@@ -691,5 +688,5 @@
 // CIDR cheatsheet
 //
-// Netmask              Netmask (binary)                 CIDR     Notes    
+// Netmask              Netmask (binary)                 CIDR     Notes
 // _____________________________________________________________________________
 // 255.255.255.255  11111111.11111111.11111111.11111111  /32  Host (single addr)
@@ -702,5 +699,5 @@
 // 255.255.255.128  11111111.11111111.11111111.10000000  /25  126  useable
 // 255.255.255.0    11111111.11111111.11111111.00000000  /24 "Class C" 254 useable
-// 
+//
 // 255.255.254.0    11111111.11111111.11111110.00000000  /23    2  Class C's
 // 255.255.252.0    11111111.11111111.11111100.00000000  /22    4  Class C's
@@ -711,5 +708,5 @@
 // 255.255.128.0    11111111.11111111.10000000.00000000  /17  128  Class C's
 // 255.255.0.0      11111111.11111111.00000000.00000000  /16  "Class B"
-//      
+//
 // 255.254.0.0      11111111.11111110.00000000.00000000  /15    2  Class B's
 // 255.252.0.0      11111111.11111100.00000000.00000000  /14    4  Class B's
@@ -720,5 +717,5 @@
 // 255.128.0.0      11111111.10000000.00000000.00000000  /9   128  Class B's
 // 255.0.0.0        11111111.00000000.00000000.00000000  /8   "Class A"
-//   
+//
 // 254.0.0.0        11111110.00000000.00000000.00000000  /7
 // 252.0.0.0        11111100.00000000.00000000.00000000  /6
