From 52618af8cba1b96c87bfc71e29b5ec3162404823 Mon Sep 17 00:00:00 2001
From: webpwnized <webpwnized@gmail.com>
Date: Fri, 27 Sep 2024 18:27:16 -0400
Subject: [PATCH] 2.11.18 Preparing for mandatory logins

---
 src/edit-account-profile.php           |  65 +++++++-------
 src/includes/constants.php             |   2 +-
 src/includes/header.php                |  10 +--
 src/includes/main-menu.php             |   2 +-
 src/includes/process-commands.php      |  18 ++--
 src/includes/process-login-attempt.php |  61 +++++++-------
 src/index.php                          | 112 +++++++++++--------------
 src/login.php                          |  41 +++++----
 version                                |   2 +-
 9 files changed, 153 insertions(+), 160 deletions(-)

diff --git a/src/edit-account-profile.php b/src/edit-account-profile.php
index 6ca5e947..04999e4a 100755
--- a/src/edit-account-profile.php
+++ b/src/edit-account-profile.php
@@ -1,26 +1,27 @@
 <?php
-    require_once (__SITE_ROOT__.'/classes/CSRFTokenHandler.php');
+    require_once __SITE_ROOT__.'/classes/CSRFTokenHandler.php';
     $lCSRFTokenHandler = new CSRFTokenHandler($_SESSION["security-level"], "edit-account-profile");
     
     switch ($_SESSION["security-level"]){
+		default: // Default case: This code is insecure
         case "0": // This code is insecure
             // DO NOTHING: This is equivalent to using client side security
-            $lEnableJavaScriptValidation = FALSE;
-            $lEnableHTMLControls = FALSE;
-            $lProtectAgainstMethodTampering = FALSE;
-            $lProtectAgainstIDOR = FALSE;
-            $lProtectAgainstPasswordLeakage = FALSE;
-            $lEncodeOutput = FALSE;
+            $lEnableJavaScriptValidation = false;
+            $lEnableHTMLControls = false;
+            $lProtectAgainstMethodTampering = false;
+            $lProtectAgainstIDOR = false;
+            $lProtectAgainstPasswordLeakage = false;
+            $lEncodeOutput = false;
             break;
             
         case "1": // This code is insecure
             // DO NOTHING: This is equivalent to using client side security
-            $lEnableJavaScriptValidation = TRUE;
-            $lEnableHTMLControls = TRUE;
-            $lProtectAgainstMethodTampering = FALSE;
-            $lProtectAgainstIDOR = FALSE;
-            $lProtectAgainstPasswordLeakage = FALSE;
-            $lEncodeOutput = FALSE;
+            $lEnableJavaScriptValidation = true;
+            $lEnableHTMLControls = true;
+            $lProtectAgainstMethodTampering = false;
+            $lProtectAgainstIDOR = false;
+            $lProtectAgainstPasswordLeakage = false;
+            $lEncodeOutput = false;
             break;
             
         case "2":
@@ -31,12 +32,12 @@
              * Concerning SQL Injection, use parameterized stored procedures. Parameterized
              * queries is not good enough. You cannot use least privilege with queries.
              */
-            $lEnableJavaScriptValidation = TRUE;
-            $lEnableHTMLControls = TRUE;
-            $lProtectAgainstMethodTampering = TRUE;
-            $lProtectAgainstIDOR = TRUE;
-            $lProtectAgainstPasswordLeakage = TRUE;
-            $lEncodeOutput = TRUE;
+            $lEnableJavaScriptValidation = true;
+            $lEnableHTMLControls = true;
+            $lProtectAgainstMethodTampering = true;
+            $lProtectAgainstIDOR = true;
+            $lProtectAgainstPasswordLeakage = true;
+            $lEncodeOutput = true;
             break;
     }// end switch
     
@@ -46,14 +47,14 @@
 
 <div class="page-title">Edit Profile</div>
 
-<?php include_once (__SITE_ROOT__.'/includes/back-button.inc');?>
-<?php include_once (__SITE_ROOT__.'/includes/hints/hints-menu-wrapper.inc'); ?>
+<?php include_once __SITE_ROOT__.'/includes/back-button.inc';?>
+<?php include_once __SITE_ROOT__.'/includes/hints/hints-menu-wrapper.inc'; ?>
 
 <?php
 
 	if ($lFormSubmitted){
 		
-		try {					
+		try {
 			$lValidationFailed = false;
 					
 	   		if ($lProtectAgainstMethodTampering) {
@@ -84,16 +85,16 @@
 			}// end if
 					
 		   	if (strlen($lUsername) == 0) {
-		   		$lValidationFailed = TRUE;
+		   		$lValidationFailed = true;
 				echo '<h2 class="error-message">Username cannot be blank</h2>';
 		   	}// end if
 					
 		   	if ($lPassword != $lConfirmedPassword ) {
-				$lValidationFailed = TRUE;
+				$lValidationFailed = true;
 		   		echo '<h2 class="error-message">Passwords do not match</h2>';
 		   	}// end if
 						   	
-		   	if (!$lValidationFailed){					
+		   	if (!$lValidationFailed){
 		   		$lRowsAffected = $SQLQueryHandler->updateUserAccount($lUsername, $lPassword, $lUserSignature);
 				echo '<div class="success-message">Profile updated for ' . $lUsernameText . '</div>';
 				$LogHandler->writeToLog("Profile updated for: " . $lUsername);
@@ -110,7 +111,7 @@
 	    if(isset($_SESSION['uid'])){
 	       $lUserUID = $_SESSION['uid'];
 	    }else{
-	        $lUserUID = NULL;
+			$lUserUID = null;
 	    } // if isset
 	}else{
 	    if(isset($_REQUEST['uid'])){
@@ -119,7 +120,7 @@
 	        if(isset($_COOKIE['uid'])){
 	            $lUserUID = $_COOKIE['uid'];
 	        }else{
-	            $lUserUID = NULL;
+				$lUserUID = null;
 	        } // if isset
 	    } // if isset
 	} // $lProtectAgainstIDOR
@@ -129,7 +130,7 @@
 	$lUsername = "";
 	$lPassword = "";
 	$lSignature = "";
-	$lResultsFound = FALSE;
+	$lResultsFound = false;
 	
 	if($lUserLoggedIn){
 	    try {
@@ -137,9 +138,7 @@
 	           $LogHandler->writeToLog("Got account with UID : " . $lUserUID);
 	           
 	           if (isset($lQueryResult->num_rows)){
-	               if ($lQueryResult->num_rows > 0) {
-	                   $lResultsFound = TRUE;
-	               }//end if
+				   $lResultsFound = $lQueryResult->num_rows > 0;
 	           }//end if
 
 	           if($lResultsFound){
@@ -294,7 +293,7 @@ function onSubmitOfForm(/*HTMLFormElement*/ theForm){
 				Dont have an account? <a href="index.php?page=register.php">Please register here</a>
 			</td>
 		</tr>
-	</table>	
+	</table>
 </div>
 
 <script>
@@ -312,4 +311,4 @@ function onSubmitOfForm(/*HTMLFormElement*/ theForm){
 	if ($lFormSubmitted) {
 		echo $lCSRFTokenHandler->generateCSRFHTMLReport();
 	}// end if
-?>
\ No newline at end of file
+?>
diff --git a/src/includes/constants.php b/src/includes/constants.php
index d3313116..4458fce5 100755
--- a/src/includes/constants.php
+++ b/src/includes/constants.php
@@ -2,7 +2,7 @@
 	/* ------------------------------------------
 	 * @VERSION
 	 * ------------------------------------------*/
-	$C_VERSION = "2.11.17";
+	$C_VERSION = "2.11.18";
 	$C_VERSION_STRING = "Version: " . $C_VERSION;
 	$C_MAX_HINT_LEVEL = 1;
 
diff --git a/src/includes/header.php b/src/includes/header.php
index 943dcdc9..e245b3c2 100755
--- a/src/includes/header.php
+++ b/src/includes/header.php
@@ -18,13 +18,13 @@
             break;
     }// end switch
 
-	if($_SESSION['loggedin'] == "True"){
+	if($_SESSION["user_is_logged_in"] == "True"){
 
 	    switch ($lSecurityLevel){
 	   		case "0": // This code is insecure
 	   		case "1": // This code is insecure
 	   			// DO NOTHING: This is equivalent to using client side security
-				$logged_in_user = $_SESSION['logged_in_user'];
+				$logged_in_user = $_SESSION["logged_in_user"];
 			break;
 
 	   		case "2":
@@ -33,7 +33,7 @@
 	   		case "5": // This code is fairly secure
 	   			// encode the entire message following OWASP standards
 	   			// this is HTML encoding because we are outputting data into HTML
-				$logged_in_user = $Encoder->encodeForHTML($_SESSION['logged_in_user']);
+				$logged_in_user = $Encoder->encodeForHTML($_SESSION["logged_in_user"]);
 			break;
 	   	}// end switch
 
@@ -54,7 +54,7 @@
 	} else {
 		$logged_in_user = "anonymous";
 		$lAuthenticationStatusMessage = "Not Logged In";
-	}// end if($_SESSION['loggedin'] == "True")
+	}// end if($_SESSION["user_is_logged_in"] == "True")
 
 	if ($_SESSION["EnforceSSL"] == "True"){
 		$lEnforceSSLLabel = "Drop TLS";
@@ -109,7 +109,7 @@
 			<a href="index.php?page=home.php&popUpNotificationCode=HPH0">Home</a>
 			|
 			<?php
-				if ($_SESSION['loggedin'] == 'True'){
+				if ($_SESSION["user_is_logged_in"] == 'True'){
 					echo '<a href="index.php?do=logout">Logout</a>';
 				} else {
 					echo '<a href="index.php?page=login.php">Login/Register</a>';
diff --git a/src/includes/main-menu.php b/src/includes/main-menu.php
index 04d89c69..6ee84716 100755
--- a/src/includes/main-menu.php
+++ b/src/includes/main-menu.php
@@ -1,6 +1,6 @@
 <?php
 	$lUserIDString = "";
-	if($_SESSION['loggedin'] == "True"){
+	if($_SESSION["user_is_logged_in"] == "True"){
 	    $lUserIDString = "&uid=" . $lUserID;
 	} //end if
 ?>
diff --git a/src/includes/process-commands.php b/src/includes/process-commands.php
index 956945ea..169215f9 100755
--- a/src/includes/process-commands.php
+++ b/src/includes/process-commands.php
@@ -40,10 +40,10 @@ function logMessage($lMessage){
     	break;//case "toggle-enforce-ssl"
 
     	case "logout":
-    	    logMessage("Logout user: {$_SESSION['logged_in_user']} ({$_SESSION['uid']})");
-		    $_SESSION["loggedin"] = "False";
-		    $_SESSION['logged_in_user'] = '';
-		    $_SESSION['logged_in_usersignature'] = '';
+    	    logMessage("Logout user: {$_SESSION["logged_in_user"]} ({$_SESSION['uid']})");
+		    $_SESSION["user_is_logged_in"] = "False";
+		    $_SESSION["logged_in_user"] = '';
+		    $_SESSION["logged_in_user_signature"] = '';
 			$_SESSION['uid'] = '';
 			$_SESSION['is_admin'] = 'FALSE';
 
@@ -142,9 +142,9 @@ function logMessage($lMessage){
 
 		    /* If we have looped back around to security level 0,
 		     * show the hints again */
-		    if ($lSecurityLevel == 0){
-		    	$_SESSION["showhints"] = 1;
-		    	$_SESSION["hints-enabled"] = "Enabled";
+		    if ($lSecurityLevel == 0){
+		    	$_SESSION["showhints"] = 1;
+		    	$_SESSION["hints-enabled"] = "Enabled";
 
 		    	$l_cookie_options = array (
 		    	    'expires' => 0,              // 0 means session cookie
@@ -155,8 +155,8 @@ function logMessage($lMessage){
 		    	    'samesite' => 'Lax'          // None || Lax  || Strict
 		    	);
 		    	setcookie('showhints', "1", $l_cookie_options);
-
-		    }// end if
+
+		    }// end if
 
 		    /* Disable hints unless we are on security level 0.
 		     * There is a way to defeat this */
diff --git a/src/includes/process-login-attempt.php b/src/includes/process-login-attempt.php
index 211b7f66..faefe92a 100755
--- a/src/includes/process-login-attempt.php
+++ b/src/includes/process-login-attempt.php
@@ -6,13 +6,14 @@ function logLoginAttempt($lMessage){
 			$LogHandler->writeToLog($lMessage);
 		} catch (Exception $e) {
 			/*do nothing*/
-		};
-	};//end function logLoginAttempt
+		}
+	}//end function logLoginAttempt
 
     try {
 		$lQueryString = "";
     	switch ($_SESSION["security-level"]){
-	   		case "0": // This code is insecure
+			default: // Default case: This code is insecure
+			case "0": // This code is insecure
 	   		case "1": // This code is insecure
 				/*
 				 * Grab username and password from parameters.
@@ -23,8 +24,8 @@ function logLoginAttempt($lMessage){
 				 */
 				$lUsername = $_REQUEST["username"];
 				$lPassword = $_REQUEST["password"];
-	   			$lProtectCookies = FALSE;
-	   			$lConfidentialityRequired = FALSE;
+	   			$lProtectCookies = false;
+	   			$lConfidentialityRequired = false;
 	   		break;
 
 			case "2":
@@ -34,8 +35,8 @@ function logLoginAttempt($lMessage){
 	   			/* Restrict paramters to POST */
 				$lUsername = $_POST["username"];
 				$lPassword = $_POST["password"];
-	   			$lProtectCookies = TRUE;
-	   			$lConfidentialityRequired = TRUE;
+	   			$lProtectCookies = true;
+	   			$lConfidentialityRequired = true;
 	   		break;
 	   	}// end switch
 
@@ -48,8 +49,8 @@ function logLoginAttempt($lMessage){
 	   	$cUSERNAME_OR_PASSWORD_INCORRECT = 5;
 
 	   	$lAuthenticationAttemptResult = $cUNSURE;
-	   	$lAuthenticationAttemptResultFound = FALSE;
-	   	$lKeepGoing = TRUE;
+	   	$lAuthenticationAttemptResultFound = false;
+	   	$lKeepGoing = true;
 	   	$lQueryResult=NULL;
 
    		logLoginAttempt("User {$lUsername} attempting to authenticate");
@@ -60,36 +61,34 @@ function logLoginAttempt($lMessage){
    		    }else{
    		        $lAuthenticationAttemptResult = $cACCOUNT_DOES_NOT_EXIST;
    		    }// end if
-   			$lKeepGoing = FALSE;
+   			$lKeepGoing = false;
    			logLoginAttempt("Login Failed: Account {$lUsername} does not exist");
    		}// end if accountExists
 
-		if ($lKeepGoing){
-   			if (!$SQLQueryHandler->authenticateAccount($lUsername, $lPassword)){
-   			    if ($lConfidentialityRequired){
-   			        $lAuthenticationAttemptResult = $cUSERNAME_OR_PASSWORD_INCORRECT;
-   			    }else{
-   			        $lAuthenticationAttemptResult = $cPASSWORD_INCORRECT;
-   			    }// end if
-	   			$lKeepGoing = FALSE;
-	   			logLoginAttempt("Login Failed: Password for {$lUsername} incorrect");
-	   		}//end if authenticateAccount
-   		}//end if $lKeepGoing
-
+		if ($lKeepGoing && !$SQLQueryHandler->authenticateAccount($lUsername, $lPassword)){
+			if ($lConfidentialityRequired){
+				$lAuthenticationAttemptResult = $cUSERNAME_OR_PASSWORD_INCORRECT;
+			}else{
+				$lAuthenticationAttemptResult = $cPASSWORD_INCORRECT;
+			}// end if
+			$lKeepGoing = false;
+			logLoginAttempt("Login Failed: Password for {$lUsername} incorrect");
+		}//end if authenticateAccount
+   		
 		$lQueryResult = $SQLQueryHandler->getUserAccount($lUsername, $lPassword);
 
 		if (isset($lQueryResult->num_rows)){
    			if ($lQueryResult->num_rows > 0) {
-	   			$lAuthenticationAttemptResultFound = TRUE;
+	   			$lAuthenticationAttemptResultFound = true;
    			}//end if
 		}//end if
 
 		if ($lAuthenticationAttemptResultFound){
 			$lRecord = $lQueryResult->fetch_object();
-			$_SESSION['loggedin'] = 'True';
+			$_SESSION["user_is_logged_in"] = 'True';
 			$_SESSION['uid'] = $lRecord->cid;
-			$_SESSION['logged_in_user'] = $lRecord->username;
-			$_SESSION['logged_in_usersignature'] = $lRecord->mysignature;
+			$_SESSION["logged_in_user"] = $lRecord->username;
+			$_SESSION["logged_in_user_signature"] = $lRecord->mysignature;
 			$_SESSION['is_admin'] = $lRecord->is_admin;
 
    				/*
@@ -114,8 +113,8 @@ function logLoginAttempt($lMessage){
 				    'expires' => 0,              // 0 means session cookie
 				    'path' => '/',               // '/' means entire domain
 				    //'domain' => '.example.com', // default is current domain
-				    'secure' => FALSE,           // true or false
-				    'httponly' => TRUE,         // true or false
+				    'secure' => false,           // true or false
+				    'httponly' => true,         // true or false
 				    'samesite' => 'Strict'          // None || Lax  || Strict
 				);
 				setcookie("username", $lUsernameCookie, $l_cookie_options);
@@ -127,8 +126,8 @@ function logLoginAttempt($lMessage){
 				    'expires' => 0,              // 0 means session cookie
 				    'path' => '/',               // '/' means entire domain
 				    //'domain' => '.example.com', // default is current domain
-				    'secure' => FALSE,           // true or false
-				    'httponly' => FALSE,         // true or false
+				    'secure' => false,           // true or false
+				    'httponly' => false,         // true or false
 				    'samesite' => 'Lax'          // None || Lax  || Strict
 				);
 				setrawcookie("username", $lUsernameCookie, $l_cookie_options);
@@ -150,4 +149,4 @@ function logLoginAttempt($lMessage){
 		$lAuthenticationAttemptResult = $cAUTHENTICATION_EXCEPTION_OCCURED;
 	}// end try;
 
-?>
\ No newline at end of file
+?>
diff --git a/src/index.php b/src/index.php
index 08a55fcd..48eb6922 100755
--- a/src/index.php
+++ b/src/index.php
@@ -3,18 +3,18 @@
 	/* ------------------------------------------
 	 * Constants used in application
 	 * ------------------------------------------ */
-	require_once ('./includes/constants.php');
+	require_once './includes/constants.php';
 
 	/* ------------------------------------------------------
 	 * INCLUDE CLASS DEFINITION PRIOR TO INITIALIZING SESSION
 	 * ------------------------------------------------------ */
-	require_once (__SITE_ROOT__.'/classes/EncodingHandler.php');
-	require_once (__SITE_ROOT__.'/classes/MySQLHandler.php');
-	require_once (__SITE_ROOT__.'/classes/SQLQueryHandler.php');
-	require_once (__SITE_ROOT__.'/classes/CustomErrorHandler.php');
-	require_once (__SITE_ROOT__.'/classes/LogHandler.php');
-	require_once (__SITE_ROOT__.'/classes/RemoteFileHandler.php');
-	require_once (__SITE_ROOT__.'/classes/RequiredSoftwareHandler.php');
+	require_once __SITE_ROOT__.'/classes/EncodingHandler.php';
+	require_once __SITE_ROOT__.'/classes/MySQLHandler.php';
+	require_once __SITE_ROOT__.'/classes/SQLQueryHandler.php';
+	require_once __SITE_ROOT__.'/classes/CustomErrorHandler.php';
+	require_once __SITE_ROOT__.'/classes/LogHandler.php';
+	require_once __SITE_ROOT__.'/classes/RemoteFileHandler.php';
+	require_once __SITE_ROOT__.'/classes/RequiredSoftwareHandler.php';
 
     /* ------------------------------------------
      * INITIALIZE SESSION
@@ -39,7 +39,8 @@
     }// end if
 
     switch ($_SESSION["security-level"]){
-    	case "0": // This code is insecure
+    	default: // Add a default case. This code is insecure.
+		case "0": // This code is insecure
     	case "1": // This code is insecure
 		    if ($_SESSION["EnforceSSL"] == "True"){
 		    	if(!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS']!="on"){
@@ -56,7 +57,7 @@
     	case "5": // This code is fairly secure
 		    if ($_SESSION["EnforceSSL"] == "True"){
 		    	if(!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS']!="on"){
-		    		require_once('ssl-enforced.php');
+		    		require_once 'ssl-enforced.php';
 		    		exit();
 		    	}//end if
 		    }//end if
@@ -68,10 +69,10 @@
      * ----------------------------------------------------
      * user is logged out by default
      */
-    if (!isset($_SESSION["loggedin"])){
-	    $_SESSION['loggedin'] = 'False';
-	    $_SESSION['logged_in_user'] = '';
-	    $_SESSION['logged_in_usersignature'] = '';
+    if (!isset($_SESSION["user_is_logged_in"])){
+	    $_SESSION["user_is_logged_in"] = 'False';
+	    $_SESSION["logged_in_user"] = '';
+	    $_SESSION["logged_in_user_signature"] = '';
     }// end if
 
     /* ----------------------------------------------------
@@ -107,14 +108,14 @@
 	   	switch ($_SESSION["security-level"]){
 	   		case "0": // This code is insecure
 	   		case "1": // This code is insecure
-	   			$lProtectCookies = FALSE;
+	   			$lProtectCookies = false;
 	   		break;
 
 			case "2":
 			case "3":
 			case "4":
 	   		case "5": // This code is fairly secure
-	   			$lProtectCookies = TRUE;
+	   			$lProtectCookies = true;
 	   		break;
 	   	}// end switch
 
@@ -122,15 +123,15 @@
 	   	    'expires' => 0,              // 0 means session cookie
 	   	    'path' => '/',               // '/' means entire domain
 	   	    //'domain' => '.example.com', // default is current domain
-	   	    'secure' => FALSE,           // true or false
-	   	    'httponly' => FALSE,         // true or false
+	   	    'secure' => false,           // true or false
+	   	    'httponly' => false,         // true or false
 	   	    'samesite' => 'Lax'          // None || Lax  || Strict
 	   	);
 
 	   	if ($lProtectCookies){
-	   	    /* The showhints cookie is unprotected on purpose because
-	   	     * it is used in one of the lab assignments */
-	   	    //$l_cookie_options['httponly'] = TRUE;
+	   	    /* The showhints cookie does not have HTTPOnly
+			 on purpose because
+	   	     it is used in one of the lab assignments */
 	   	    $l_cookie_options['samesite'] = 'Strict';
 	   	}// end if
 
@@ -144,6 +145,7 @@
 		switch ($l_showhints){
 			case 0: $_SESSION["hints-enabled"] = "Disabled"; break;
 			case 1: $_SESSION["hints-enabled"] = "Enabled"; break;
+			default: $_SESSION["hints-enabled"] = "Enabled"; break;
 		}// end switch
 	}//end if
 
@@ -156,27 +158,15 @@
  	* Test for database availability
  	* ------------------------------------------ */
 
-	function handleError($errno, $errstr, $errfile, $errline, array $errcontext){
-		/*
-		restore_error_handler();
-		restore_exception_handler();
-		header("Location: database-offline.php", true, 302);
-		exit();
-		*/
-	}// end function
-
-	function handleException($exception){
-		//restore_error_handler();
+	function handleException(){
 		restore_exception_handler();
 		header("Location: database-offline.php", true, 302);
 		exit();
 	}// end function
 
 	if ($_SESSION["UserOKWithDatabaseFailure"] == "FALSE") {
-		//set_error_handler('handleError', E_ALL & ~E_NOTICE);
 		set_exception_handler('handleException');
-	    	MySQLHandler::databaseAvailable();
-		//restore_error_handler();
+	    MySQLHandler::databaseAvailable();
 		restore_exception_handler();
 	}//end if
 
@@ -248,13 +238,13 @@ function handleException($exception){
 				    // should never be in cookies.
 				    if ($lQueryResult->num_rows > 0) {
 					    $row = $lQueryResult->fetch_object();
-						$_SESSION['loggedin'] = 'True';
+						$_SESSION["user_is_logged_in"] = 'True';
 						$_SESSION['uid'] = $row->cid;
-						$_SESSION['logged_in_user'] = $row->username;
-						$_SESSION['logged_in_usersignature'] = $row->mysignature;
+						$_SESSION["logged_in_user"] = $row->username;
+						$_SESSION["logged_in_user_signature"] = $row->mysignature;
 						$_SESSION['is_admin'] = $row->is_admin;
-						if (isset($_SESSION['logged_in_user'])){
-						    header('Logged-In-User: '.$_SESSION['logged_in_user'], true);
+						if (isset($_SESSION["logged_in_user"])){
+						    header('Logged-In-User: '.$_SESSION["logged_in_user"], true);
 						}// end if
 			    	}// end if ($result->num_rows > 0)
 
@@ -269,8 +259,8 @@ function handleException($exception){
 	   			 * (PHP defends itself against HTTP response splitting by
 	   			 * filtering "new line" characters)
 	   			 */
-   			    if (isset($_SESSION['logged_in_user'])){
-   			        header('Logged-In-User: '.$_SESSION['logged_in_user'], true);
+   			    if (isset($_SESSION["logged_in_user"])){
+   			        header('Logged-In-User: '.$_SESSION["logged_in_user"], true);
    			    }// end if
    			}// end if
 
@@ -288,8 +278,8 @@ function handleException($exception){
   			 * prevent response splitting. The critical chars in response splitting
   			 * are CR-LF. Dont fall for filtering. Just encode it all.
   			 */
-   		    if (isset($_SESSION['logged_in_user'])){
-   		        header('Logged-In-User: '.$Encoder->encodeForHTML($_SESSION['logged_in_user']), TRUE);
+   		    if (isset($_SESSION["logged_in_user"])){
+   		        header('Logged-In-User: '.$Encoder->encodeForHTML($_SESSION["logged_in_user"]), true);
    		    }// end if
    		break;
    	}// end switch
@@ -304,16 +294,16 @@ function handleException($exception){
    		case "0": // This code is insecure
    		case "1":
 			/* Built-in user-agent defenses */
-			header("X-XSS-Protection: 0;", TRUE);
+			header("X-XSS-Protection: 0;", true);
 
 			/* Disable HSTS */
-			header("Strict-Transport-Security: max-age=0", TRUE);
+			header("Strict-Transport-Security: max-age=0", true);
 
 			// HTTP/1.1 cache control
-			header("Cache-Control: public", TRUE);
+			header("Cache-Control: public", true);
 
 			/* Referrer Policy */
-			header("Referrer-Policy: unsafe-url", TRUE);
+			header("Referrer-Policy: unsafe-url", true);
 
 			header_remove("Pragma");
 
@@ -326,27 +316,27 @@ function handleException($exception){
    		case "4":
    		case "5": // This code is fairly secure
 			/* Built-in user-agent defenses */
-			header("X-XSS-Protection: 1; mode=block;", TRUE);
+			header("X-XSS-Protection: 1; mode=block;", true);
 
 			/* Enable HSTS - I would like to enable this but the problem is this header caches so messes
 			* up labs once the user sets the security level back to level 0*/
-			//header("Strict-Transport-Security: max-age=31536000; includeSubDomains", TRUE);
+			//header("Strict-Transport-Security: max-age=31536000; includeSubDomains", true);
 
 			// HTTP/1.1 cache control
-			header('Cache-Control: no-store, no-cache', TRUE);
+			header('Cache-Control: no-store, no-cache', true);
 
 			// HTTP/1.0 cache-control
-			header("Pragma: no-cache", TRUE);
+			header("Pragma: no-cache", true);
 
 			/* Cross-frame scripting and click-jacking */
-			header('X-FRAME-OPTIONS: DENY', TRUE);
-			header("Content-Security-Policy: frame-ancestors 'none';", TRUE);
+			header('X-FRAME-OPTIONS: DENY', true);
+			header("Content-Security-Policy: frame-ancestors 'none';", true);
 
 			/* Content sniffing */
-			header("X-Content-Type-Options: nosniff", TRUE);
+			header("X-Content-Type-Options: nosniff", true);
 
 			/* Referrer Policy */
-			header("Referrer-Policy: no-referrer", TRUE);
+			header("Referrer-Policy: no-referrer", true);
 
 			/* Server version banners */
 			header_remove("X-Powered-By");
@@ -360,7 +350,7 @@ function handleException($exception){
    	/* ------------------------------------------
    	 * Set the HTTP content-type of this page
    	 * ------------------------------------------ */
-   	header("Content-Type: text/html;charset=UTF-8", TRUE);
+   	header("Content-Type: text/html;charset=UTF-8", true);
 
 	/* ------------------------------------------
      * DISPLAY PAGE
@@ -444,10 +434,10 @@ function handleException($exception){
 		  			/* To prevent unauthorized access, we start with the basic priciple
 		  			 * of "DENY ALL".
 		  			 */
-		   			$lUserAuthorized = FALSE;
+		   			$lUserAuthorized = false;
 		   			if(isset($_SESSION['is_admin'])){
 		   				if($_SESSION['is_admin'] == 'TRUE'){
-		   					$lUserAuthorized = TRUE;
+		   					$lUserAuthorized = true;
 		   				}// end if is_admin
 		   			}// end if isseet $_SESSION['is_admin']
 
@@ -489,8 +479,8 @@ function handleException($exception){
                 "report-uri includes/capture-data.php;" .
                 "report-to csp-endpoint;";
 
-        header($lReportToHeader, TRUE);
-        header($lCSP, TRUE);
+        header($lReportToHeader, true);
+        header($lCSP, true);
     }else{
         $CSPNonce = "";
     }// end if
diff --git a/src/login.php b/src/login.php
index 63577ba5..aeaca5e6 100755
--- a/src/login.php
+++ b/src/login.php
@@ -1,20 +1,25 @@
 <?php
 	try {
-    	switch ($_SESSION["security-level"]){
-    		case "0": // This code is insecure.
-				$lEnableJavaScriptValidation = FALSE;
-				$lEnableHTMLControls = FALSE;
+		switch ($_SESSION["security-level"]){
+			case "0": // This code is insecure.
+				$lEnableJavaScriptValidation = false;
+				$lEnableHTMLControls = false;
 			break;
-
-    		case "1": // This code is insecure.
-	   		case "2":
-	   		case "3":
-	   		case "4":
-    		case "5": // This code is fairly secure
-    			$lEnableJavaScriptValidation = TRUE;
-				$lEnableHTMLControls = TRUE;
-    		break;
-    	}// end switch
+		
+			case "1": // This code is insecure.
+			case "2":
+			case "3":
+			case "4":
+			case "5": // This code is fairly secure
+				$lEnableJavaScriptValidation = true;
+				$lEnableHTMLControls = true;
+			break;
+		
+			default: // Add a default case
+				$lEnableJavaScriptValidation = false;
+				$lEnableHTMLControls = false;
+			break;
+		}// end switch
 
 	} catch(Exception $e){
 		echo $CustomErrorHandler->FormatError($e, "Error setting up configuration.");
@@ -24,7 +29,7 @@
 <script type="text/javascript">
 <!--
 	<?php
-		if ($_SESSION["loggedin"]=="True") {
+		if ($_SESSION["user_is_logged_in"]=="True") {
 			echo "var l_loggedIn = true;" . PHP_EOL;
 		}else {
 			echo "var l_loggedIn = false;" . PHP_EOL;
@@ -93,7 +98,7 @@ function onSubmitOfLoginForm(/*HTMLFormElement*/ theForm){
 							autofocus="autofocus"
 					<?php
 						if ($lEnableHTMLControls) {
-							echo('minlength="1" maxlength="15" required="required"');
+							echo 'minlength="1" maxlength="15" required="required"';
 						}// end if
 					?>
 					/>
@@ -105,7 +110,7 @@ function onSubmitOfLoginForm(/*HTMLFormElement*/ theForm){
 					<input type="password" name="password" size="20"
 					<?php
 						if ($lEnableHTMLControls) {
-							echo('minlength="1" maxlength="15" required="required"');
+							echo 'minlength="1" maxlength="15" required="required"';
 						}// end if
 					?>
 					/>
@@ -130,7 +135,7 @@ function onSubmitOfLoginForm(/*HTMLFormElement*/ theForm){
 <div id="id-log-out-div" style="text-align: center; display: none;">
 	<table>
 		<tr>
-			<td colspan="2" class="hint-header">You are logged in as <?php echo $_SESSION['logged_in_user']; ?></td>
+			<td colspan="2" class="hint-header">You are logged in as <?php echo $_SESSION["logged_in_user"]; ?></td>
 		</tr>
 		<tr><td></td></tr>
 		<tr><td></td></tr>
diff --git a/version b/version
index 2b908d54..ee2951a5 100644
--- a/version
+++ b/version
@@ -1 +1 @@
-2.11.17
+2.11.18